@aws-cdk/aws-bedrock-agentcore-alpha 2.253.0-alpha.0 → 2.254.0-alpha.0

package/lib/identity/api-key-credential-provider.js

@@ -0,0 +1,249 @@
+"use strict";
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyCredentialProvider = void 0;
+const jsiiDeprecationWarnings = require("../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_bedrockagentcore_1 = require("aws-cdk-lib/aws-bedrockagentcore");
+const iam = require("aws-cdk-lib/aws-iam");
+const helpers_internal_1 = require("aws-cdk-lib/core/lib/helpers-internal");
+const metadata_resource_1 = require("aws-cdk-lib/core/lib/metadata-resource");
+const prop_injectable_1 = require("aws-cdk-lib/core/lib/prop-injectable");
+const grant_helpers_1 = require("./grant-helpers");
+const perms_1 = require("./perms");
+const validation_helpers_1 = require("./validation-helpers");
+/******************************************************************************
+ *                         Abstract base
+ *****************************************************************************/
+class ApiKeyCredentialProviderBase extends aws_cdk_lib_1.Resource {
+    grantPrincipal = new iam.UnknownPrincipal({ resource: this });
+    get apiKeyCredentialProviderRef() {
+        return { credentialProviderArn: this.credentialProviderArn };
+    }
+    constructor(scope, id, props) {
+        super(scope, id, props);
+    }
+    /**
+     * [disable-awslint:no-grants]
+     */
+    grant(grantee, ...actions) {
+        return iam.Grant.addToPrincipal({
+            grantee,
+            actions,
+            resourceArns: (0, grant_helpers_1.buildIdentityResourceArns)(this, this.credentialProviderArn, grant_helpers_1.TOKEN_VAULT_API_KEY_PARENT_RESOURCES),
+            scope: this,
+        });
+    }
+    /**
+     * [disable-awslint:no-grants]
+     */
+    grantRead(grantee) {
+        return (0, grant_helpers_1.grantReadWithList)(this, grantee, this.credentialProviderArn, perms_1.ApiKeyCredentialProviderIdentityPerms.READ_PERMS, perms_1.ApiKeyCredentialProviderIdentityPerms.LIST_PERMS, grant_helpers_1.TOKEN_VAULT_API_KEY_PARENT_RESOURCES);
+    }
+    /**
+     * [disable-awslint:no-grants]
+     */
+    grantAdmin(grantee) {
+        const bedrock = this.grant(grantee, ...perms_1.ApiKeyCredentialProviderIdentityPerms.ADMIN_PERMS);
+        const secret = (0, grant_helpers_1.grantCredentialSecret)(this, grantee, this.apiKeySecretArn, [...perms_1.TOKEN_VAULT_CREDENTIAL_SECRET_WRITE_PERMS]);
+        return secret ? bedrock.combine(secret) : bedrock;
+    }
+    /**
+     * [disable-awslint:no-grants]
+     */
+    grantUse(grantee) {
+        const bedrock = iam.Grant.addToPrincipal({
+            grantee,
+            actions: [...perms_1.ApiKeyCredentialProviderIdentityPerms.USE_PERMS],
+            resourceArns: (0, grant_helpers_1.buildIdentityResourceArns)(this, this.credentialProviderArn, [...grant_helpers_1.TOKEN_VAULT_API_KEY_PARENT_RESOURCES, ...grant_helpers_1.WORKLOAD_IDENTITY_USE_RESOURCES]),
+            scope: this,
+        });
+        const secret = (0, grant_helpers_1.grantCredentialSecret)(this, grantee, this.apiKeySecretArn, [...perms_1.TOKEN_VAULT_CREDENTIAL_SECRET_READ_PERMS]);
+        return secret ? bedrock.combine(secret) : bedrock;
+    }
+    /**
+     * [disable-awslint:no-grants]
+     */
+    grantFullAccess(grantee) {
+        const bedrock = iam.Grant.addToPrincipal({
+            grantee,
+            actions: [...perms_1.ApiKeyCredentialProviderIdentityPerms.FULL_ACCESS_PERMS],
+            resourceArns: (0, grant_helpers_1.buildIdentityResourceArns)(this, this.credentialProviderArn, [...grant_helpers_1.TOKEN_VAULT_API_KEY_PARENT_RESOURCES, ...grant_helpers_1.WORKLOAD_IDENTITY_USE_RESOURCES]),
+            scope: this,
+        });
+        const secret = (0, grant_helpers_1.grantCredentialSecret)(this, grantee, this.apiKeySecretArn, [...perms_1.TOKEN_VAULT_CREDENTIAL_SECRET_READ_PERMS, ...perms_1.TOKEN_VAULT_CREDENTIAL_SECRET_WRITE_PERMS]);
+        return secret ? bedrock.combine(secret) : bedrock;
+    }
+}
+/******************************************************************************
+ *                                Class
+ *****************************************************************************/
+/**
+ * L2 construct for `AWS::BedrockAgentCore::ApiKeyCredentialProvider`.
+ *
+ * Use this to register an API key identity in AgentCore Token Vault. To attach the identity to a
+ * gateway target, use {@link GatewayCredentialProvider.fromApiKeyIdentity} with this construct, or
+ * {@link ApiKeyCredentialProvider.bindForGatewayApiKeyTarget} with {@link GatewayCredentialProvider.fromApiKeyIdentityArn}.
+ *
+ * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-apikeycredentialprovider.html
+ * @resource AWS::BedrockAgentCore::ApiKeyCredentialProvider
+ */
+let ApiKeyCredentialProvider = (() => {
+    let _classDecorators = [prop_injectable_1.propertyInjectable];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiKeyCredentialProviderBase;
+    let _instanceExtraInitializers = [];
+    let _bindForGatewayApiKeyTarget_decorators;
+    var ApiKeyCredentialProvider = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _bindForGatewayApiKeyTarget_decorators = [(0, metadata_resource_1.MethodMetadata)()];
+            __esDecorate(this, null, _bindForGatewayApiKeyTarget_decorators, { kind: "method", name: "bindForGatewayApiKeyTarget", static: false, private: false, access: { has: obj => "bindForGatewayApiKeyTarget" in obj, get: obj => obj.bindForGatewayApiKeyTarget }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            ApiKeyCredentialProvider = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialProvider", version: "2.254.0-alpha.0" };
+        /** Uniquely identifies this class. */
+        static PROPERTY_INJECTION_ID = '@aws-cdk.aws-bedrock-agentcore-alpha.ApiKeyCredentialProvider';
+        /**
+         * Import an existing API key credential provider.
+         */
+        static fromApiKeyCredentialProviderAttributes(scope, id, attrs) {
+            try {
+                jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialProviderAttributes(attrs);
+            }
+            catch (error) {
+                if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                    Error.captureStackTrace(error, this.fromApiKeyCredentialProviderAttributes);
+                }
+                throw error;
+            }
+            class Import extends ApiKeyCredentialProviderBase {
+                credentialProviderArn = attrs.credentialProviderArn;
+                apiKeySecretArn = attrs.apiKeySecretArn;
+                createdTime = attrs.createdTime;
+                lastUpdatedTime = attrs.lastUpdatedTime;
+                constructor(s, i) {
+                    super(s, i);
+                }
+                bindForGatewayApiKeyTarget() {
+                    if (this.apiKeySecretArn == null || this.apiKeySecretArn === '') {
+                        throw new aws_cdk_lib_1.ValidationError((0, helpers_internal_1.lit) `MissingApiKeySecretArn`, 'apiKeySecretArn is not available on this ApiKeyCredentialProvider (imported providers must pass apiKeySecretArn in fromApiKeyCredentialProviderAttributes).', this);
+                    }
+                    return {
+                        providerArn: this.credentialProviderArn,
+                        secretArn: this.apiKeySecretArn,
+                    };
+                }
+            }
+            return new Import(scope, id);
+        }
+        credentialProviderArn = __runInitializers(this, _instanceExtraInitializers);
+        /**
+         * The name of this API key credential provider.
+         * @attribute
+         */
+        apiKeyCredentialProviderName;
+        createdTime;
+        lastUpdatedTime;
+        _apiKeySecretArn;
+        __resource;
+        get apiKeySecretArn() {
+            if (this._apiKeySecretArn === undefined) {
+                this._apiKeySecretArn = aws_cdk_lib_1.Token.asString(this.__resource.attrApiKeySecretArn);
+            }
+            return this._apiKeySecretArn;
+        }
+        constructor(scope, id, props = {}) {
+            super(scope, id, {
+                physicalName: props.apiKeyCredentialProviderName
+                    ?? aws_cdk_lib_1.Lazy.string({
+                        produce: () => aws_cdk_lib_1.Names.uniqueResourceName(this, { maxLength: 128 }),
+                    }),
+            });
+            try {
+                jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_ApiKeyCredentialProviderResourceProps(props);
+            }
+            catch (error) {
+                if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                    Error.captureStackTrace(error, ApiKeyCredentialProvider);
+                }
+                throw error;
+            }
+            (0, metadata_resource_1.addConstructMetadata)(this, props);
+            this.apiKeyCredentialProviderName = this.physicalName;
+            const apiKeyValue = props.apiKey?.unsafeUnwrap();
+            (0, validation_helpers_1.throwIfInvalid)(validation_helpers_1.validateCredentialProviderName, this.apiKeyCredentialProviderName, this);
+            (0, validation_helpers_1.throwIfInvalid)(validation_helpers_1.validateApiKeyValue, apiKeyValue, this);
+            (0, validation_helpers_1.throwIfInvalid)(validation_helpers_1.validateCredentialProviderTags, props.tags, this);
+            const cfnProps = {
+                name: this.apiKeyCredentialProviderName,
+                apiKey: apiKeyValue,
+                tags: props.tags && Object.keys(props.tags).length > 0
+                    ? Object.entries(props.tags).map(([key, value]) => ({ key, value }))
+                    : undefined,
+            };
+            this.__resource = new aws_bedrockagentcore_1.CfnApiKeyCredentialProvider(this, 'Resource', cfnProps);
+            this.credentialProviderArn = this.__resource.attrCredentialProviderArn;
+            this.createdTime = this.__resource.attrCreatedTime;
+            this.lastUpdatedTime = this.__resource.attrLastUpdatedTime;
+        }
+        /**
+         * ARNs for {@link GatewayCredentialProvider.fromApiKeyIdentity} / {@link GatewayCredentialProvider.fromApiKeyIdentityArn}.
+         */
+        bindForGatewayApiKeyTarget() {
+            const secretArn = this.apiKeySecretArn;
+            if (secretArn == null) {
+                throw new aws_cdk_lib_1.ValidationError((0, helpers_internal_1.lit) `MissingApiKeySecretArn`, 'apiKeySecretArn is not available — the CloudFormation attribute has not resolved yet.', this);
+            }
+            return {
+                providerArn: this.credentialProviderArn,
+                secretArn,
+            };
+        }
+        static {
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+    };
+    return ApiKeyCredentialProvider = _classThis;
+})();
+exports.ApiKeyCredentialProvider = ApiKeyCredentialProvider;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS1jcmVkZW50aWFsLXByb3ZpZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiYXBpLWtleS1jcmVkZW50aWFsLXByb3ZpZGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQWNBLDZDQUE0RTtBQU01RSwyRUFBK0U7QUFDL0UsMkNBQTJDO0FBQzNDLDRFQUE0RDtBQUM1RCw4RUFBOEY7QUFDOUYsMEVBQTBFO0FBRTFFLG1EQUE2SztBQUM3SyxtQ0FBcUo7QUFDckosNkRBSzhCO0FBcUo5Qjs7K0VBRStFO0FBRS9FLE1BQWUsNEJBQTZCLFNBQVEsc0JBQVE7SUFLMUMsY0FBYyxHQUFtQixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBRTlGLElBQVcsMkJBQTJCO1FBQ3BDLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxJQUFJLENBQUMscUJBQXFCLEVBQUUsQ0FBQztLQUM5RDtJQUVELFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBcUI7UUFDN0QsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7S0FDekI7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxPQUF1QixFQUFFLEdBQUcsT0FBaUI7UUFDeEQsT0FBTyxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQztZQUM5QixPQUFPO1lBQ1AsT0FBTztZQUNQLFlBQVksRUFBRSxJQUFBLHlDQUF5QixFQUFDLElBQUksRUFBRSxJQUFJLENBQUMscUJBQXFCLEVBQUUsb0RBQW9DLENBQUM7WUFDL0csS0FBSyxFQUFFLElBQUk7U0FDWixDQUFDLENBQUM7S0FDSjtJQUVEOztPQUVHO0lBQ0ksU0FBUyxDQUFDLE9BQXVCO1FBQ3RDLE9BQU8sSUFBQSxpQ0FBaUIsRUFDdEIsSUFBSSxFQUNKLE9BQU8sRUFDUCxJQUFJLENBQUMscUJBQXFCLEVBQzFCLDZDQUFxQyxDQUFDLFVBQVUsRUFDaEQsNkNBQXFDLENBQUMsVUFBVSxFQUNoRCxvREFBb0MsQ0FDckMsQ0FBQztLQUNIO0lBRUQ7O09BRUc7SUFDSSxVQUFVLENBQUMsT0FBdUI7UUFDdkMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsR0FBRyw2Q0FBcUMsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUMxRixNQUFNLE1BQU0sR0FBRyxJQUFBLHFDQUFxQixFQUNsQyxJQUFJLEVBQ0osT0FBTyxFQUNQLElBQUksQ0FBQyxlQUFlLEVBQ3BCLENBQUMsR0FBRyxpREFBeUMsQ0FBQyxDQUMvQyxDQUFDO1FBQ0YsT0FBTyxNQUFNLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztLQUNuRDtJQUVEOztPQUVHO0lBQ0ksUUFBUSxDQUFDLE9BQXVCO1FBQ3JDLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDO1lBQ3ZDLE9BQU87WUFDUCxPQUFPLEVBQUUsQ0FBQyxHQUFHLDZDQUFxQyxDQUFDLFNBQVMsQ0FBQztZQUM3RCxZQUFZLEVBQUUsSUFBQSx5Q0FBeUIsRUFDckMsSUFBSSxFQUFFLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLEdBQUcsb0RBQW9DLEVBQUUsR0FBRywrQ0FBK0IsQ0FBQyxDQUNoSDtZQUNELEtBQUssRUFBRSxJQUFJO1NBQ1osQ0FBQyxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBQSxxQ0FBcUIsRUFDbEMsSUFBSSxFQUNKLE9BQU8sRUFDUCxJQUFJLENBQUMsZUFBZSxFQUNwQixDQUFDLEdBQUcsZ0RBQXdDLENBQUMsQ0FDOUMsQ0FBQztRQUNGLE9BQU8sTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7S0FDbkQ7SUFFRDs7T0FFRztJQUNJLGVBQWUsQ0FBQyxPQUF1QjtRQUM1QyxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQztZQUN2QyxPQUFPO1lBQ1AsT0FBTyxFQUFFLENBQUMsR0FBRyw2Q0FBcUMsQ0FBQyxpQkFBaUIsQ0FBQztZQUNyRSxZQUFZLEVBQUUsSUFBQSx5Q0FBeUIsRUFDckMsSUFBSSxFQUFFLElBQUksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDLEdBQUcsb0RBQW9DLEVBQUUsR0FBRywrQ0FBK0IsQ0FBQyxDQUNoSDtZQUNELEtBQUssRUFBRSxJQUFJO1NBQ1osQ0FBQyxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBQSxxQ0FBcUIsRUFDbEMsSUFBSSxFQUNKLE9BQU8sRUFDUCxJQUFJLENBQUMsZUFBZSxFQUNwQixDQUFDLEdBQUcsZ0RBQXdDLEVBQUUsR0FBRyxpREFBeUMsQ0FBQyxDQUM1RixDQUFDO1FBQ0YsT0FBTyxNQUFNLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztLQUNuRDtDQUdGO0FBRUQ7OytFQUUrRTtBQUUvRTs7Ozs7Ozs7O0dBU0c7SUFFVSx3QkFBd0I7NEJBRHBDLG9DQUFrQjs7OztzQkFDMkIsNEJBQTRCOzs7d0NBQXBDLFNBQVEsV0FBNEI7Ozs7c0RBOEZ2RSxJQUFBLGtDQUFjLEdBQUU7WUFDakIsaU9BQU8sMEJBQTBCLDZEQWFoQztZQTVHSCw2S0E2R0M7Ozs7O1FBNUdDLHNDQUFzQztRQUMvQixNQUFNLENBQVUscUJBQXFCLEdBQVcsK0RBQStELENBQUM7UUFFdkg7O1dBRUc7UUFDSSxNQUFNLENBQUMsc0NBQXNDLENBQ2xELEtBQWdCLEVBQ2hCLEVBQVUsRUFDVixLQUF5Qzs7Ozs7Ozs7OztZQUV6QyxNQUFNLE1BQU8sU0FBUSw0QkFBNEI7Z0JBQy9CLHFCQUFxQixHQUFHLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQztnQkFDcEQsZUFBZSxHQUFHLEtBQUssQ0FBQyxlQUFlLENBQUM7Z0JBQ3hDLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDO2dCQUNoQyxlQUFlLEdBQUcsS0FBSyxDQUFDLGVBQWUsQ0FBQztnQkFFeEQsWUFBWSxDQUFZLEVBQUUsQ0FBUztvQkFDakMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztnQkFDZCxDQUFDO2dCQUVNLDBCQUEwQjtvQkFDL0IsSUFBSSxJQUFJLENBQUMsZUFBZSxJQUFJLElBQUksSUFBSSxJQUFJLENBQUMsZUFBZSxLQUFLLEVBQUUsRUFBRSxDQUFDO3dCQUNoRSxNQUFNLElBQUksNkJBQWUsQ0FDdkIsSUFBQSxzQkFBRyxFQUFBLHdCQUF3QixFQUMzQiw2SkFBNkosRUFDN0osSUFBSSxDQUNMLENBQUM7b0JBQ0osQ0FBQztvQkFDRCxPQUFPO3dCQUNMLFdBQVcsRUFBRSxJQUFJLENBQUMscUJBQXFCO3dCQUN2QyxTQUFTLEVBQUUsSUFBSSxDQUFDLGVBQWU7cUJBQ2hDLENBQUM7Z0JBQ0osQ0FBQzthQUNGO1lBQ0QsT0FBTyxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7U0FDOUI7UUFFZSxxQkFBcUIsR0F2QzFCLG1EQUF3QixDQXVDVztRQUM5Qzs7O1dBR0c7UUFDYSw0QkFBNEIsQ0FBUztRQUNyQyxXQUFXLENBQVU7UUFDckIsZUFBZSxDQUFVO1FBRWpDLGdCQUFnQixDQUFVO1FBQ2pCLFVBQVUsQ0FBOEI7UUFFekQsSUFBVyxlQUFlO1lBQ3hCLElBQUksSUFBSSxDQUFDLGdCQUFnQixLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUN4QyxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsbUJBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1lBQzlFLENBQUM7WUFDRCxPQUFPLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztTQUM5QjtRQUVELFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsUUFBK0MsRUFBRTtZQUN6RixLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtnQkFDZixZQUFZLEVBQUUsS0FBSyxDQUFDLDRCQUE0Qjt1QkFDM0Msa0JBQUksQ0FBQyxNQUFNLENBQUM7d0JBQ2IsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLG1CQUFLLENBQUMsa0JBQWtCLENBQUMsSUFBSSxFQUFFLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDO3FCQUNsRSxDQUFDO2FBQ0wsQ0FBQyxDQUFDOzs7Ozs7bURBaEVNLHdCQUF3Qjs7OztZQWtFakMsSUFBQSx3Q0FBb0IsRUFBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFFbEMsSUFBSSxDQUFDLDRCQUE0QixHQUFHLElBQUksQ0FBQyxZQUFZLENBQUM7WUFFdEQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQztZQUVqRCxJQUFBLG1DQUFjLEVBQUMsbURBQThCLEVBQUUsSUFBSSxDQUFDLDRCQUE0QixFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ3hGLElBQUEsbUNBQWMsRUFBQyx3Q0FBbUIsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDdkQsSUFBQSxtQ0FBYyxFQUFDLG1EQUE4QixFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFFakUsTUFBTSxRQUFRLEdBQXFDO2dCQUNqRCxJQUFJLEVBQUUsSUFBSSxDQUFDLDRCQUE0QjtnQkFDdkMsTUFBTSxFQUFFLFdBQVc7Z0JBQ25CLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO29CQUNwRCxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztvQkFDcEUsQ0FBQyxDQUFDLFNBQVM7YUFDZCxDQUFDO1lBRUYsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLGtEQUEyQixDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFFOUUsSUFBSSxDQUFDLHFCQUFxQixHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMseUJBQXlCLENBQUM7WUFDdkUsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQztZQUNuRCxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsbUJBQW1CLENBQUM7U0FDNUQ7UUFFRDs7V0FFRztRQUVJLDBCQUEwQjtZQUMvQixNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDO1lBQ3ZDLElBQUksU0FBUyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN0QixNQUFNLElBQUksNkJBQWUsQ0FDdkIsSUFBQSxzQkFBRyxFQUFBLHdCQUF3QixFQUMzQix1RkFBdUYsRUFDdkYsSUFBSSxDQUNMLENBQUM7WUFDSixDQUFDO1lBQ0QsT0FBTztnQkFDTCxXQUFXLEVBQUUsSUFBSSxDQUFDLHFCQUFxQjtnQkFDdkMsU0FBUzthQUNWLENBQUM7U0FDSDs7WUE1R1UsdURBQXdCOzs7OztBQUF4Qiw0REFBd0IiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqICBDb3B5cmlnaHQgQW1hem9uLmNvbSwgSW5jLiBvciBpdHMgYWZmaWxpYXRlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5cbiAqXG4gKiAgTGljZW5zZWQgdW5kZXIgdGhlIEFwYWNoZSBMaWNlbnNlLCBWZXJzaW9uIDIuMCAodGhlIFwiTGljZW5zZVwiKS4gWW91IG1heSBub3QgdXNlIHRoaXMgZmlsZSBleGNlcHQgaW4gY29tcGxpYW5jZVxuICogIHdpdGggdGhlIExpY2Vuc2UuIEEgY29weSBvZiB0aGUgTGljZW5zZSBpcyBsb2NhdGVkIGF0XG4gKlxuICogICAgICBodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvTElDRU5TRS0yLjBcbiAqXG4gKiAgb3IgaW4gdGhlICdsaWNlbnNlJyBmaWxlIGFjY29tcGFueWluZyB0aGlzIGZpbGUuIFRoaXMgZmlsZSBpcyBkaXN0cmlidXRlZCBvbiBhbiAnQVMgSVMnIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVNcbiAqICBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBleHByZXNzIG9yIGltcGxpZWQuIFNlZSB0aGUgTGljZW5zZSBmb3IgdGhlIHNwZWNpZmljIGxhbmd1YWdlIGdvdmVybmluZyBwZXJtaXNzaW9uc1xuICogIGFuZCBsaW1pdGF0aW9ucyB1bmRlciB0aGUgTGljZW5zZS5cbiAqL1xuXG5pbXBvcnQgdHlwZSB7IElSZXNvdXJjZSwgUmVzb3VyY2VQcm9wcywgU2VjcmV0VmFsdWUgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBMYXp5LCBOYW1lcywgUmVzb3VyY2UsIFRva2VuLCBWYWxpZGF0aW9uRXJyb3IgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7XG4gIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclJlZmVyZW5jZSxcbiAgQ2ZuQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUHJvcHMsXG4gIElBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJSZWYsXG59IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCB7IENmbkFwaUtleUNyZWRlbnRpYWxQcm92aWRlciB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IGxpdCB9IGZyb20gJ2F3cy1jZGstbGliL2NvcmUvbGliL2hlbHBlcnMtaW50ZXJuYWwnO1xuaW1wb3J0IHsgYWRkQ29uc3RydWN0TWV0YWRhdGEsIE1ldGhvZE1ldGFkYXRhIH0gZnJvbSAnYXdzLWNkay1saWIvY29yZS9saWIvbWV0YWRhdGEtcmVzb3VyY2UnO1xuaW1wb3J0IHsgcHJvcGVydHlJbmplY3RhYmxlIH0gZnJvbSAnYXdzLWNkay1saWIvY29yZS9saWIvcHJvcC1pbmplY3RhYmxlJztcbmltcG9ydCB0eXBlIHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBidWlsZElkZW50aXR5UmVzb3VyY2VBcm5zLCBncmFudENyZWRlbnRpYWxTZWNyZXQsIGdyYW50UmVhZFdpdGhMaXN0LCBUT0tFTl9WQVVMVF9BUElfS0VZX1BBUkVOVF9SRVNPVVJDRVMsIFdPUktMT0FEX0lERU5USVRZX1VTRV9SRVNPVVJDRVMgfSBmcm9tICcuL2dyYW50LWhlbHBlcnMnO1xuaW1wb3J0IHsgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcywgVE9LRU5fVkFVTFRfQ1JFREVOVElBTF9TRUNSRVRfUkVBRF9QRVJNUywgVE9LRU5fVkFVTFRfQ1JFREVOVElBTF9TRUNSRVRfV1JJVEVfUEVSTVMgfSBmcm9tICcuL3Blcm1zJztcbmltcG9ydCB7XG4gIHRocm93SWZJbnZhbGlkLFxuICB2YWxpZGF0ZUFwaUtleVZhbHVlLFxuICB2YWxpZGF0ZUNyZWRlbnRpYWxQcm92aWRlck5hbWUsXG4gIHZhbGlkYXRlQ3JlZGVudGlhbFByb3ZpZGVyVGFncyxcbn0gZnJvbSAnLi92YWxpZGF0aW9uLWhlbHBlcnMnO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSW50ZXJmYWNlXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQW4gQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIHJlZ2lzdGVyZWQgaW4gQWdlbnRDb3JlIFRva2VuIFZhdWx0LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIElBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIgZXh0ZW5kcyBJUmVzb3VyY2UsIGlhbS5JR3JhbnRhYmxlLCBJQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUmVmIHtcbiAgLyoqXG4gICAqIFRoZSBBUk4gb2YgdGhpcyBjcmVkZW50aWFsIHByb3ZpZGVyLlxuICAgKiBAYXR0cmlidXRlXG4gICAqL1xuICByZWFkb25seSBjcmVkZW50aWFsUHJvdmlkZXJBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgU2VjcmV0cyBNYW5hZ2VyIHNlY3JldCB0aGF0IHN0b3JlcyB0aGUgQVBJIGtleSBhZnRlciB0aGUgcmVzb3VyY2UgaXMgY3JlYXRlZC5cbiAgICpcbiAgICogTWF5IGJlIHVuZGVmaW5lZCBmb3IgcmVzb3VyY2VzIGltcG9ydGVkIHdpdGhvdXQgdGhpcyBhdHRyaWJ1dGUuXG4gICAqXG4gICAqIEBhdHRyaWJ1dGVcbiAgICovXG4gIHJlYWRvbmx5IGFwaUtleVNlY3JldEFybj86IHN0cmluZztcblxuICAvKipcbiAgICogVGltZXN0YW1wIHdoZW4gdGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIgd2FzIGNyZWF0ZWQuXG4gICAqIEBhdHRyaWJ1dGVcbiAgICovXG4gIHJlYWRvbmx5IGNyZWF0ZWRUaW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaW1lc3RhbXAgd2hlbiB0aGUgY3JlZGVudGlhbCBwcm92aWRlciB3YXMgbGFzdCB1cGRhdGVkLlxuICAgKiBAYXR0cmlidXRlXG4gICAqL1xuICByZWFkb25seSBsYXN0VXBkYXRlZFRpbWU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIEdyYW50cyBJQU0gYWN0aW9ucyB0byB0aGUgSUFNIHByaW5jaXBhbC5cbiAgICovXG4gIGdyYW50KGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlLCAuLi5hY3Rpb25zOiBzdHJpbmdbXSk6IGlhbS5HcmFudDtcblxuICAvKipcbiAgICogR3JhbnQgYEdldEFwaUtleUNyZWRlbnRpYWxQcm92aWRlcmAgYW5kIGBMaXN0QXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyc2AsIHNjb3BlZCB0byB0aGlzXG4gICAqIHByb3ZpZGVyIGFuZCBwYXJlbnQgcmVzb3VyY2VzIHJlcXVpcmVkIGJ5IHRoZSBCZWRyb2NrIEFnZW50Q29yZSBhdXRob3JpemF0aW9uIG1vZGVsLlxuICAgKi9cbiAgZ3JhbnRSZWFkKGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlKTogaWFtLkdyYW50O1xuXG4gIC8qKlxuICAgKiBHcmFudCBjb250cm9sIHBsYW5lIHBlcm1pc3Npb25zIHRvIG1hbmFnZSB0aGlzIHByb3ZpZGVyLlxuICAgKi9cbiAgZ3JhbnRBZG1pbihncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudDtcblxuICAvKipcbiAgICogR3JhbnQgcGVybWlzc2lvbiB0byByZXRyaWV2ZSBBUEkga2V5IG1hdGVyaWFsIGZvciBvdXRib3VuZCBjYWxscyAoYEdldFJlc291cmNlQXBpS2V5YCkuXG4gICAqL1xuICBncmFudFVzZShncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudDtcblxuICAvKipcbiAgICogR3JhbnQgcmVhZCwgYWRtaW4sIGFuZCBjcmVkZW50aWFsIHJldHJpZXZhbCBwZXJtaXNzaW9ucy5cbiAgICovXG4gIGdyYW50RnVsbEFjY2VzcyhncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudDtcblxuICAvKipcbiAgICogQVJOcyBmb3IgdXNlIHdpdGggZ2F0ZXdheSB0YXJnZXRzIChgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlci5mcm9tQXBpS2V5SWRlbnRpdHlgIG9yIGBmcm9tQXBpS2V5SWRlbnRpdHlBcm5gKS5cbiAgICovXG4gIGJpbmRGb3JHYXRld2F5QXBpS2V5VGFyZ2V0KCk6IEdhdGV3YXlBcGlLZXlJZGVudGl0eUJpbmRpbmc7XG59XG5cbi8qKlxuICogUHJvdmlkZXIgYW5kIHNlY3JldCBBUk5zIGZvciB3aXJpbmcgYSBUb2tlbiBWYXVsdCBBUEkga2V5IGlkZW50aXR5IGludG8gYSBnYXRld2F5IHRhcmdldC5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHYXRld2F5QXBpS2V5SWRlbnRpdHlCaW5kaW5nIHtcbiAgLyoqXG4gICAqIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciBBUk4uXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlckFybjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTZWNyZXRzIE1hbmFnZXIgc2VjcmV0IEFSTiBmb3IgdGhlIEFQSSBrZXkgbWF0ZXJpYWwuXG4gICAqL1xuICByZWFkb25seSBzZWNyZXRBcm46IHN0cmluZztcbn1cblxuLyoqXG4gKiBQcm9wZXJ0aWVzIGZvciBhIG5ldyB7QGxpbmsgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyfSAoVG9rZW4gVmF1bHQgcmVzb3VyY2UpLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclJlc291cmNlUHJvcHMge1xuICAvKipcbiAgICogTmFtZSBvZiB0aGUgY3JlZGVudGlhbCBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgYSBuYW1lIGdlbmVyYXRlZCBieSBDREtcbiAgICovXG4gIHJlYWRvbmx5IGFwaUtleUNyZWRlbnRpYWxQcm92aWRlck5hbWU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBBUEkga2V5IHZhbHVlLlxuICAgKlxuICAgKiAqKk5PVEU6KiogVGhlIEFQSSBrZXkgd2lsbCBiZSBpbmNsdWRlZCBpbiB0aGUgQ2xvdWRGb3JtYXRpb24gdGVtcGxhdGUgYXMgcGFydCBvZiBzeW50aGVzaXMuXG4gICAqIFRoZSBzZXJ2aWNlIHN0b3JlcyB0aGUga2V5IGluIFNlY3JldHMgTWFuYWdlciBhZnRlciBjcmVhdGlvbiwgYnV0IHRoZSB2YWx1ZSBpcyB2aXNpYmxlXG4gICAqIGluIHRoZSB0ZW1wbGF0ZSBhbmQgZGVwbG95bWVudCBoaXN0b3J5LiBVc2UgYFNlY3JldFZhbHVlLnVuc2FmZVBsYWluVGV4dCgpYCB0byBleHBsaWNpdGx5XG4gICAqIGFja25vd2xlZGdlIHBsYWludGV4dCwgb3IgcGFzcyBhIHJlZmVyZW5jZSBmcm9tIGFub3RoZXIgY29uc3RydWN0IHRvIGF2b2lkIGVtYmVkZGluZyB0aGVcbiAgICogbGl0ZXJhbCB2YWx1ZS5cbiAgICpcbiAgICogSWYgb21pdHRlZCwgeW91IGNhbiBzdXBwbHkgdGhlIGtleSB0aHJvdWdoIGFub3RoZXIgbWVjaGFuaXNtIHN1cHBvcnRlZCBieSB0aGUgc2VydmljZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyBrZXkgaW4gdGVtcGxhdGUgKHByb3ZpZGVyIG1heSBzdGlsbCBiZSBjcmVhdGVkIGRlcGVuZGluZyBvbiBzZXJ2aWNlIGJlaGF2aW9yKVxuICAgKi9cbiAgcmVhZG9ubHkgYXBpS2V5PzogU2VjcmV0VmFsdWU7XG5cbiAgLyoqXG4gICAqIFRhZ3MgZm9yIHRoaXMgY3JlZGVudGlhbCBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBubyB0YWdzXG4gICAqL1xuICByZWFkb25seSB0YWdzPzogeyBba2V5OiBzdHJpbmddOiBzdHJpbmcgfTtcbn1cblxuLyoqXG4gKiBBdHRyaWJ1dGVzIGZvciBpbXBvcnRpbmcgYW4gZXhpc3RpbmcgQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlckF0dHJpYnV0ZXMge1xuICAvKipcbiAgICogQVJOIG9mIHRoZSBjcmVkZW50aWFsIHByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyQXJuOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIEFSTiBvZiB0aGUgU2VjcmV0cyBNYW5hZ2VyIHNlY3JldCBmb3IgdGhlIEFQSSBrZXksIGlmIGtub3duLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIG5vdCBzZXQ7IHJlcXVpcmVkIGZvciB7QGxpbmsgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyLmJpbmRGb3JHYXRld2F5QXBpS2V5VGFyZ2V0fSBvbiBpbXBvcnRlZCBwcm92aWRlcnNcbiAgICovXG4gIHJlYWRvbmx5IGFwaUtleVNlY3JldEFybj86IHN0cmluZztcblxuICAvKipcbiAgICogUmVzb3VyY2UgY3JlYXRpb24gdGltZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBub3Qgc2V0XG4gICAqL1xuICByZWFkb25seSBjcmVhdGVkVGltZT86IHN0cmluZztcblxuICAvKipcbiAgICogUmVzb3VyY2UgbGFzdC11cGRhdGVkIHRpbWUuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm90IHNldFxuICAgKi9cbiAgcmVhZG9ubHkgbGFzdFVwZGF0ZWRUaW1lPzogc3RyaW5nO1xufVxuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICBBYnN0cmFjdCBiYXNlXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbmFic3RyYWN0IGNsYXNzIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlckJhc2UgZXh0ZW5kcyBSZXNvdXJjZSBpbXBsZW1lbnRzIElBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIge1xuICBwdWJsaWMgYWJzdHJhY3QgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyQXJuOiBzdHJpbmc7XG4gIHB1YmxpYyBhYnN0cmFjdCByZWFkb25seSBhcGlLZXlTZWNyZXRBcm4/OiBzdHJpbmc7XG4gIHB1YmxpYyBhYnN0cmFjdCByZWFkb25seSBjcmVhdGVkVGltZT86IHN0cmluZztcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IGxhc3RVcGRhdGVkVGltZT86IHN0cmluZztcbiAgcHVibGljIHJlYWRvbmx5IGdyYW50UHJpbmNpcGFsOiBpYW0uSVByaW5jaXBhbCA9IG5ldyBpYW0uVW5rbm93blByaW5jaXBhbCh7IHJlc291cmNlOiB0aGlzIH0pO1xuXG4gIHB1YmxpYyBnZXQgYXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUmVmKCk6IEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclJlZmVyZW5jZSB7XG4gICAgcmV0dXJuIHsgY3JlZGVudGlhbFByb3ZpZGVyQXJuOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlckFybiB9O1xuICB9XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM/OiBSZXNvdXJjZVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCBwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqL1xuICBwdWJsaWMgZ3JhbnQoZ3JhbnRlZTogaWFtLklHcmFudGFibGUsIC4uLmFjdGlvbnM6IHN0cmluZ1tdKTogaWFtLkdyYW50IHtcbiAgICByZXR1cm4gaWFtLkdyYW50LmFkZFRvUHJpbmNpcGFsKHtcbiAgICAgIGdyYW50ZWUsXG4gICAgICBhY3Rpb25zLFxuICAgICAgcmVzb3VyY2VBcm5zOiBidWlsZElkZW50aXR5UmVzb3VyY2VBcm5zKHRoaXMsIHRoaXMuY3JlZGVudGlhbFByb3ZpZGVyQXJuLCBUT0tFTl9WQVVMVF9BUElfS0VZX1BBUkVOVF9SRVNPVVJDRVMpLFxuICAgICAgc2NvcGU6IHRoaXMsXG4gICAgfSk7XG4gIH1cblxuICAvKipcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqL1xuICBwdWJsaWMgZ3JhbnRSZWFkKGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlKTogaWFtLkdyYW50IHtcbiAgICByZXR1cm4gZ3JhbnRSZWFkV2l0aExpc3QoXG4gICAgICB0aGlzLFxuICAgICAgZ3JhbnRlZSxcbiAgICAgIHRoaXMuY3JlZGVudGlhbFByb3ZpZGVyQXJuLFxuICAgICAgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcy5SRUFEX1BFUk1TLFxuICAgICAgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcy5MSVNUX1BFUk1TLFxuICAgICAgVE9LRU5fVkFVTFRfQVBJX0tFWV9QQVJFTlRfUkVTT1VSQ0VTLFxuICAgICk7XG4gIH1cblxuICAvKipcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqL1xuICBwdWJsaWMgZ3JhbnRBZG1pbihncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudCB7XG4gICAgY29uc3QgYmVkcm9jayA9IHRoaXMuZ3JhbnQoZ3JhbnRlZSwgLi4uQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcy5BRE1JTl9QRVJNUyk7XG4gICAgY29uc3Qgc2VjcmV0ID0gZ3JhbnRDcmVkZW50aWFsU2VjcmV0KFxuICAgICAgdGhpcyxcbiAgICAgIGdyYW50ZWUsXG4gICAgICB0aGlzLmFwaUtleVNlY3JldEFybixcbiAgICAgIFsuLi5UT0tFTl9WQVVMVF9DUkVERU5USUFMX1NFQ1JFVF9XUklURV9QRVJNU10sXG4gICAgKTtcbiAgICByZXR1cm4gc2VjcmV0ID8gYmVkcm9jay5jb21iaW5lKHNlY3JldCkgOiBiZWRyb2NrO1xuICB9XG5cbiAgLyoqXG4gICAqIFtkaXNhYmxlLWF3c2xpbnQ6bm8tZ3JhbnRzXVxuICAgKi9cbiAgcHVibGljIGdyYW50VXNlKGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlKTogaWFtLkdyYW50IHtcbiAgICBjb25zdCBiZWRyb2NrID0gaWFtLkdyYW50LmFkZFRvUHJpbmNpcGFsKHtcbiAgICAgIGdyYW50ZWUsXG4gICAgICBhY3Rpb25zOiBbLi4uQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcy5VU0VfUEVSTVNdLFxuICAgICAgcmVzb3VyY2VBcm5zOiBidWlsZElkZW50aXR5UmVzb3VyY2VBcm5zKFxuICAgICAgICB0aGlzLCB0aGlzLmNyZWRlbnRpYWxQcm92aWRlckFybiwgWy4uLlRPS0VOX1ZBVUxUX0FQSV9LRVlfUEFSRU5UX1JFU09VUkNFUywgLi4uV09SS0xPQURfSURFTlRJVFlfVVNFX1JFU09VUkNFU10sXG4gICAgICApLFxuICAgICAgc2NvcGU6IHRoaXMsXG4gICAgfSk7XG4gICAgY29uc3Qgc2VjcmV0ID0gZ3JhbnRDcmVkZW50aWFsU2VjcmV0KFxuICAgICAgdGhpcyxcbiAgICAgIGdyYW50ZWUsXG4gICAgICB0aGlzLmFwaUtleVNlY3JldEFybixcbiAgICAgIFsuLi5UT0tFTl9WQVVMVF9DUkVERU5USUFMX1NFQ1JFVF9SRUFEX1BFUk1TXSxcbiAgICApO1xuICAgIHJldHVybiBzZWNyZXQgPyBiZWRyb2NrLmNvbWJpbmUoc2VjcmV0KSA6IGJlZHJvY2s7XG4gIH1cblxuICAvKipcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqL1xuICBwdWJsaWMgZ3JhbnRGdWxsQWNjZXNzKGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlKTogaWFtLkdyYW50IHtcbiAgICBjb25zdCBiZWRyb2NrID0gaWFtLkdyYW50LmFkZFRvUHJpbmNpcGFsKHtcbiAgICAgIGdyYW50ZWUsXG4gICAgICBhY3Rpb25zOiBbLi4uQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVySWRlbnRpdHlQZXJtcy5GVUxMX0FDQ0VTU19QRVJNU10sXG4gICAgICByZXNvdXJjZUFybnM6IGJ1aWxkSWRlbnRpdHlSZXNvdXJjZUFybnMoXG4gICAgICAgIHRoaXMsIHRoaXMuY3JlZGVudGlhbFByb3ZpZGVyQXJuLCBbLi4uVE9LRU5fVkFVTFRfQVBJX0tFWV9QQVJFTlRfUkVTT1VSQ0VTLCAuLi5XT1JLTE9BRF9JREVOVElUWV9VU0VfUkVTT1VSQ0VTXSxcbiAgICAgICksXG4gICAgICBzY29wZTogdGhpcyxcbiAgICB9KTtcbiAgICBjb25zdCBzZWNyZXQgPSBncmFudENyZWRlbnRpYWxTZWNyZXQoXG4gICAgICB0aGlzLFxuICAgICAgZ3JhbnRlZSxcbiAgICAgIHRoaXMuYXBpS2V5U2VjcmV0QXJuLFxuICAgICAgWy4uLlRPS0VOX1ZBVUxUX0NSRURFTlRJQUxfU0VDUkVUX1JFQURfUEVSTVMsIC4uLlRPS0VOX1ZBVUxUX0NSRURFTlRJQUxfU0VDUkVUX1dSSVRFX1BFUk1TXSxcbiAgICApO1xuICAgIHJldHVybiBzZWNyZXQgPyBiZWRyb2NrLmNvbWJpbmUoc2VjcmV0KSA6IGJlZHJvY2s7XG4gIH1cblxuICBwdWJsaWMgYWJzdHJhY3QgYmluZEZvckdhdGV3YXlBcGlLZXlUYXJnZXQoKTogR2F0ZXdheUFwaUtleUlkZW50aXR5QmluZGluZztcbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENsYXNzXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogTDIgY29uc3RydWN0IGZvciBgQVdTOjpCZWRyb2NrQWdlbnRDb3JlOjpBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJgLlxuICpcbiAqIFVzZSB0aGlzIHRvIHJlZ2lzdGVyIGFuIEFQSSBrZXkgaWRlbnRpdHkgaW4gQWdlbnRDb3JlIFRva2VuIFZhdWx0LiBUbyBhdHRhY2ggdGhlIGlkZW50aXR5IHRvIGFcbiAqIGdhdGV3YXkgdGFyZ2V0LCB1c2Uge0BsaW5rIEdhdGV3YXlDcmVkZW50aWFsUHJvdmlkZXIuZnJvbUFwaUtleUlkZW50aXR5fSB3aXRoIHRoaXMgY29uc3RydWN0LCBvclxuICoge0BsaW5rIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlci5iaW5kRm9yR2F0ZXdheUFwaUtleVRhcmdldH0gd2l0aCB7QGxpbmsgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlci5mcm9tQXBpS2V5SWRlbnRpdHlBcm59LlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL0FXU0Nsb3VkRm9ybWF0aW9uL2xhdGVzdC9Vc2VyR3VpZGUvYXdzLXJlc291cmNlLWJlZHJvY2thZ2VudGNvcmUtYXBpa2V5Y3JlZGVudGlhbHByb3ZpZGVyLmh0bWxcbiAqIEByZXNvdXJjZSBBV1M6OkJlZHJvY2tBZ2VudENvcmU6OkFwaUtleUNyZWRlbnRpYWxQcm92aWRlclxuICovXG5AcHJvcGVydHlJbmplY3RhYmxlXG5leHBvcnQgY2xhc3MgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyIGV4dGVuZHMgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQmFzZSB7XG4gIC8qKiBVbmlxdWVseSBpZGVudGlmaWVzIHRoaXMgY2xhc3MuICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgUFJPUEVSVFlfSU5KRUNUSU9OX0lEOiBzdHJpbmcgPSAnQGF3cy1jZGsuYXdzLWJlZHJvY2stYWdlbnRjb3JlLWFscGhhLkFwaUtleUNyZWRlbnRpYWxQcm92aWRlcic7XG5cbiAgLyoqXG4gICAqIEltcG9ydCBhbiBleGlzdGluZyBBUEkga2V5IGNyZWRlbnRpYWwgcHJvdmlkZXIuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21BcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJBdHRyaWJ1dGVzKFxuICAgIHNjb3BlOiBDb25zdHJ1Y3QsXG4gICAgaWQ6IHN0cmluZyxcbiAgICBhdHRyczogQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQXR0cmlidXRlcyxcbiAgKTogSUFwaUtleUNyZWRlbnRpYWxQcm92aWRlciB7XG4gICAgY2xhc3MgSW1wb3J0IGV4dGVuZHMgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQmFzZSB7XG4gICAgICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyQXJuID0gYXR0cnMuY3JlZGVudGlhbFByb3ZpZGVyQXJuO1xuICAgICAgcHVibGljIHJlYWRvbmx5IGFwaUtleVNlY3JldEFybiA9IGF0dHJzLmFwaUtleVNlY3JldEFybjtcbiAgICAgIHB1YmxpYyByZWFkb25seSBjcmVhdGVkVGltZSA9IGF0dHJzLmNyZWF0ZWRUaW1lO1xuICAgICAgcHVibGljIHJlYWRvbmx5IGxhc3RVcGRhdGVkVGltZSA9IGF0dHJzLmxhc3RVcGRhdGVkVGltZTtcblxuICAgICAgY29uc3RydWN0b3IoczogQ29uc3RydWN0LCBpOiBzdHJpbmcpIHtcbiAgICAgICAgc3VwZXIocywgaSk7XG4gICAgICB9XG5cbiAgICAgIHB1YmxpYyBiaW5kRm9yR2F0ZXdheUFwaUtleVRhcmdldCgpOiBHYXRld2F5QXBpS2V5SWRlbnRpdHlCaW5kaW5nIHtcbiAgICAgICAgaWYgKHRoaXMuYXBpS2V5U2VjcmV0QXJuID09IG51bGwgfHwgdGhpcy5hcGlLZXlTZWNyZXRBcm4gPT09ICcnKSB7XG4gICAgICAgICAgdGhyb3cgbmV3IFZhbGlkYXRpb25FcnJvcihcbiAgICAgICAgICAgIGxpdGBNaXNzaW5nQXBpS2V5U2VjcmV0QXJuYCxcbiAgICAgICAgICAgICdhcGlLZXlTZWNyZXRBcm4gaXMgbm90IGF2YWlsYWJsZSBvbiB0aGlzIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlciAoaW1wb3J0ZWQgcHJvdmlkZXJzIG11c3QgcGFzcyBhcGlLZXlTZWNyZXRBcm4gaW4gZnJvbUFwaUtleUNyZWRlbnRpYWxQcm92aWRlckF0dHJpYnV0ZXMpLicsXG4gICAgICAgICAgICB0aGlzLFxuICAgICAgICAgICk7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHtcbiAgICAgICAgICBwcm92aWRlckFybjogdGhpcy5jcmVkZW50aWFsUHJvdmlkZXJBcm4sXG4gICAgICAgICAgc2VjcmV0QXJuOiB0aGlzLmFwaUtleVNlY3JldEFybixcbiAgICAgICAgfTtcbiAgICAgIH1cbiAgICB9XG4gICAgcmV0dXJuIG5ldyBJbXBvcnQoc2NvcGUsIGlkKTtcbiAgfVxuXG4gIHB1YmxpYyByZWFkb25seSBjcmVkZW50aWFsUHJvdmlkZXJBcm46IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSBuYW1lIG9mIHRoaXMgQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyLlxuICAgKiBAYXR0cmlidXRlXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgYXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyTmFtZTogc3RyaW5nO1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlYXRlZFRpbWU/OiBzdHJpbmc7XG4gIHB1YmxpYyByZWFkb25seSBsYXN0VXBkYXRlZFRpbWU/OiBzdHJpbmc7XG5cbiAgcHJpdmF0ZSBfYXBpS2V5U2VjcmV0QXJuPzogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IF9fcmVzb3VyY2U6IENmbkFwaUtleUNyZWRlbnRpYWxQcm92aWRlcjtcblxuICBwdWJsaWMgZ2V0IGFwaUtleVNlY3JldEFybigpOiBzdHJpbmcgfCB1bmRlZmluZWQge1xuICAgIGlmICh0aGlzLl9hcGlLZXlTZWNyZXRBcm4gPT09IHVuZGVmaW5lZCkge1xuICAgICAgdGhpcy5fYXBpS2V5U2VjcmV0QXJuID0gVG9rZW4uYXNTdHJpbmcodGhpcy5fX3Jlc291cmNlLmF0dHJBcGlLZXlTZWNyZXRBcm4pO1xuICAgIH1cbiAgICByZXR1cm4gdGhpcy5fYXBpS2V5U2VjcmV0QXJuO1xuICB9XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclJlc291cmNlUHJvcHMgPSB7fSkge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgcGh5c2ljYWxOYW1lOiBwcm9wcy5hcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJOYW1lXG4gICAgICAgID8/IExhenkuc3RyaW5nKHtcbiAgICAgICAgICBwcm9kdWNlOiAoKSA9PiBOYW1lcy51bmlxdWVSZXNvdXJjZU5hbWUodGhpcywgeyBtYXhMZW5ndGg6IDEyOCB9KSxcbiAgICAgICAgfSksXG4gICAgfSk7XG5cbiAgICBhZGRDb25zdHJ1Y3RNZXRhZGF0YSh0aGlzLCBwcm9wcyk7XG5cbiAgICB0aGlzLmFwaUtleUNyZWRlbnRpYWxQcm92aWRlck5hbWUgPSB0aGlzLnBoeXNpY2FsTmFtZTtcblxuICAgIGNvbnN0IGFwaUtleVZhbHVlID0gcHJvcHMuYXBpS2V5Py51bnNhZmVVbndyYXAoKTtcblxuICAgIHRocm93SWZJbnZhbGlkKHZhbGlkYXRlQ3JlZGVudGlhbFByb3ZpZGVyTmFtZSwgdGhpcy5hcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJOYW1lLCB0aGlzKTtcbiAgICB0aHJvd0lmSW52YWxpZCh2YWxpZGF0ZUFwaUtleVZhbHVlLCBhcGlLZXlWYWx1ZSwgdGhpcyk7XG4gICAgdGhyb3dJZkludmFsaWQodmFsaWRhdGVDcmVkZW50aWFsUHJvdmlkZXJUYWdzLCBwcm9wcy50YWdzLCB0aGlzKTtcblxuICAgIGNvbnN0IGNmblByb3BzOiBDZm5BcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyA9IHtcbiAgICAgIG5hbWU6IHRoaXMuYXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyTmFtZSxcbiAgICAgIGFwaUtleTogYXBpS2V5VmFsdWUsXG4gICAgICB0YWdzOiBwcm9wcy50YWdzICYmIE9iamVjdC5rZXlzKHByb3BzLnRhZ3MpLmxlbmd0aCA+IDBcbiAgICAgICAgPyBPYmplY3QuZW50cmllcyhwcm9wcy50YWdzKS5tYXAoKFtrZXksIHZhbHVlXSkgPT4gKHsga2V5LCB2YWx1ZSB9KSlcbiAgICAgICAgOiB1bmRlZmluZWQsXG4gICAgfTtcblxuICAgIHRoaXMuX19yZXNvdXJjZSA9IG5ldyBDZm5BcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIodGhpcywgJ1Jlc291cmNlJywgY2ZuUHJvcHMpO1xuXG4gICAgdGhpcy5jcmVkZW50aWFsUHJvdmlkZXJBcm4gPSB0aGlzLl9fcmVzb3VyY2UuYXR0ckNyZWRlbnRpYWxQcm92aWRlckFybjtcbiAgICB0aGlzLmNyZWF0ZWRUaW1lID0gdGhpcy5fX3Jlc291cmNlLmF0dHJDcmVhdGVkVGltZTtcbiAgICB0aGlzLmxhc3RVcGRhdGVkVGltZSA9IHRoaXMuX19yZXNvdXJjZS5hdHRyTGFzdFVwZGF0ZWRUaW1lO1xuICB9XG5cbiAgLyoqXG4gICAqIEFSTnMgZm9yIHtAbGluayBHYXRld2F5Q3JlZGVudGlhbFByb3ZpZGVyLmZyb21BcGlLZXlJZGVudGl0eX0gLyB7QGxpbmsgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlci5mcm9tQXBpS2V5SWRlbnRpdHlBcm59LlxuICAgKi9cbiAgQE1ldGhvZE1ldGFkYXRhKClcbiAgcHVibGljIGJpbmRGb3JHYXRld2F5QXBpS2V5VGFyZ2V0KCk6IEdhdGV3YXlBcGlLZXlJZGVudGl0eUJpbmRpbmcge1xuICAgIGNvbnN0IHNlY3JldEFybiA9IHRoaXMuYXBpS2V5U2VjcmV0QXJuO1xuICAgIGlmIChzZWNyZXRBcm4gPT0gbnVsbCkge1xuICAgICAgdGhyb3cgbmV3IFZhbGlkYXRpb25FcnJvcihcbiAgICAgICAgbGl0YE1pc3NpbmdBcGlLZXlTZWNyZXRBcm5gLFxuICAgICAgICAnYXBpS2V5U2VjcmV0QXJuIGlzIG5vdCBhdmFpbGFibGUg4oCUIHRoZSBDbG91ZEZvcm1hdGlvbiBhdHRyaWJ1dGUgaGFzIG5vdCByZXNvbHZlZCB5ZXQuJyxcbiAgICAgICAgdGhpcyxcbiAgICAgICk7XG4gICAgfVxuICAgIHJldHVybiB7XG4gICAgICBwcm92aWRlckFybjogdGhpcy5jcmVkZW50aWFsUHJvdmlkZXJBcm4sXG4gICAgICBzZWNyZXRBcm4sXG4gICAgfTtcbiAgfVxufVxuIl19

package/lib/identity/grant-helpers.d.ts

@@ -0,0 +1,74 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import * as iam from 'aws-cdk-lib/aws-iam';
+import type { IConstruct } from 'constructs';
+/**
+ * Parent/collection resource ARN segments for Token Vault credential providers.
+ *
+ * Bedrock AgentCore uses a hierarchical authorization model where Get/List actions
+ * require IAM permission on the parent and collection resources in addition to the
+ * specific resource instance. For example, GetApiKeyCredentialProvider needs:
+ *   - token-vault/default                             (vault)
+ *   - token-vault/default/apikeycredentialprovider    (collection)
+ *   - token-vault/default/apikeycredentialprovider/*  (instance)
+ *
+ * @internal
+ */
+export declare const TOKEN_VAULT_API_KEY_PARENT_RESOURCES: readonly ["token-vault/default", "token-vault/default/apikeycredentialprovider"];
+/**
+ * @internal
+ */
+export declare const TOKEN_VAULT_OAUTH2_PARENT_RESOURCES: readonly ["token-vault/default", "token-vault/default/oauth2credentialprovider"];
+/**
+ * @internal
+ */
+export declare const WORKLOAD_IDENTITY_PARENT_RESOURCES: readonly ["workload-identity-directory/default", "workload-identity-directory/default/workload-identity"];
+/**
+ * Workload identity resource ARN segments required by data-plane actions
+ * (GetResourceApiKey, GetResourceOauth2Token, CompleteResourceTokenAuth).
+ *
+ * These actions require both the workload identity directory and a wildcard
+ * over workload identities because the specific identity is created dynamically
+ * by the gateway/service at runtime.
+ *
+ * @internal
+ */
+export declare const WORKLOAD_IDENTITY_USE_RESOURCES: readonly ["workload-identity-directory/default", "workload-identity-directory/default/workload-identity/*"];
+/**
+ * Build the full set of resource ARNs for an identity grant: the instance ARN
+ * plus all parent/collection ARNs that the service's authorization model requires.
+ *
+ * @internal
+ */
+export declare function buildIdentityResourceArns(scope: IConstruct, instanceArn: string, parentResources: readonly string[]): string[];
+/**
+ * Grant read and list permissions on a specific identity resource, including
+ * parent/collection ARNs required by the Bedrock AgentCore authorization model.
+ *
+ * @internal
+ */
+export declare function grantReadWithList(scope: IConstruct, grantee: iam.IGrantable, resourceArn: string, resourceReadActions: string[], listActions: string[], parentResources: readonly string[]): iam.Grant;
+/**
+ * Grants Secrets Manager actions on the credential secret when an ARN is available
+ * (e.g. not omitted on import). Used for both read (GetSecretValue) and write
+ * (PutSecretValue) grants.
+ *
+ * The CFN attribute for the secret ARN (e.g. `attrApiKeySecretArn`) resolves to an
+ * object `{ SecretArn: string }` at deploy time, not a plain string, so the Token
+ * cannot be placed directly in IAM Resource fields. When the secret ARN is unresolved
+ * (Token), we fall back to a service-managed prefix wildcard. When a literal ARN is
+ * supplied (e.g. via `fromApiKeyCredentialProviderAttributes`), we scope tightly.
+ *
+ * @internal
+ */
+export declare function grantCredentialSecret(scope: IConstruct, grantee: iam.IGrantable, secretArn: string | undefined, secretActions: string[]): iam.Grant | undefined;

package/lib/identity/grant-helpers.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKLOAD_IDENTITY_USE_RESOURCES = exports.WORKLOAD_IDENTITY_PARENT_RESOURCES = exports.TOKEN_VAULT_OAUTH2_PARENT_RESOURCES = exports.TOKEN_VAULT_API_KEY_PARENT_RESOURCES = void 0;
+exports.buildIdentityResourceArns = buildIdentityResourceArns;
+exports.grantReadWithList = grantReadWithList;
+exports.grantCredentialSecret = grantCredentialSecret;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = require("aws-cdk-lib/aws-iam");
+/**
+ * Parent/collection resource ARN segments for Token Vault credential providers.
+ *
+ * Bedrock AgentCore uses a hierarchical authorization model where Get/List actions
+ * require IAM permission on the parent and collection resources in addition to the
+ * specific resource instance. For example, GetApiKeyCredentialProvider needs:
+ *   - token-vault/default                             (vault)
+ *   - token-vault/default/apikeycredentialprovider    (collection)
+ *   - token-vault/default/apikeycredentialprovider/*  (instance)
+ *
+ * @internal
+ */
+exports.TOKEN_VAULT_API_KEY_PARENT_RESOURCES = [
+    'token-vault/default',
+    'token-vault/default/apikeycredentialprovider',
+];
+/**
+ * @internal
+ */
+exports.TOKEN_VAULT_OAUTH2_PARENT_RESOURCES = [
+    'token-vault/default',
+    'token-vault/default/oauth2credentialprovider',
+];
+/**
+ * @internal
+ */
+exports.WORKLOAD_IDENTITY_PARENT_RESOURCES = [
+    'workload-identity-directory/default',
+    'workload-identity-directory/default/workload-identity',
+];
+/**
+ * Workload identity resource ARN segments required by data-plane actions
+ * (GetResourceApiKey, GetResourceOauth2Token, CompleteResourceTokenAuth).
+ *
+ * These actions require both the workload identity directory and a wildcard
+ * over workload identities because the specific identity is created dynamically
+ * by the gateway/service at runtime.
+ *
+ * @internal
+ */
+exports.WORKLOAD_IDENTITY_USE_RESOURCES = [
+    'workload-identity-directory/default',
+    'workload-identity-directory/default/workload-identity/*',
+];
+/**
+ * Build the full set of resource ARNs for an identity grant: the instance ARN
+ * plus all parent/collection ARNs that the service's authorization model requires.
+ *
+ * @internal
+ */
+function buildIdentityResourceArns(scope, instanceArn, parentResources) {
+    const stack = aws_cdk_lib_1.Stack.of(scope);
+    const parentArns = parentResources.map(resource => stack.formatArn({
+        service: 'bedrock-agentcore',
+        resource,
+        arnFormat: aws_cdk_lib_1.ArnFormat.NO_RESOURCE_NAME,
+    }));
+    return [instanceArn, ...parentArns];
+}
+/**
+ * Grant read and list permissions on a specific identity resource, including
+ * parent/collection ARNs required by the Bedrock AgentCore authorization model.
+ *
+ * @internal
+ */
+function grantReadWithList(scope, grantee, resourceArn, resourceReadActions, listActions, parentResources) {
+    return iam.Grant.addToPrincipal({
+        grantee,
+        actions: [...resourceReadActions, ...listActions],
+        resourceArns: buildIdentityResourceArns(scope, resourceArn, parentResources),
+        scope,
+    });
+}
+/**
+ * Grants Secrets Manager actions on the credential secret when an ARN is available
+ * (e.g. not omitted on import). Used for both read (GetSecretValue) and write
+ * (PutSecretValue) grants.
+ *
+ * The CFN attribute for the secret ARN (e.g. `attrApiKeySecretArn`) resolves to an
+ * object `{ SecretArn: string }` at deploy time, not a plain string, so the Token
+ * cannot be placed directly in IAM Resource fields. When the secret ARN is unresolved
+ * (Token), we fall back to a service-managed prefix wildcard. When a literal ARN is
+ * supplied (e.g. via `fromApiKeyCredentialProviderAttributes`), we scope tightly.
+ *
+ * @internal
+ */
+function grantCredentialSecret(scope, grantee, secretArn, secretActions) {
+    if (secretArn == null || secretArn === '') {
+        return undefined;
+    }
+    let secretResourceArns;
+    if (aws_cdk_lib_1.Token.isUnresolved(secretArn)) {
+        aws_cdk_lib_1.Annotations.of(scope).addWarningV2('@aws-cdk/aws-bedrock-agentcore-alpha:wildcardSecretArnGrant', 'The secret ARN is an unresolved token. Granting access using a wildcard prefix (bedrock-agentcore-identity!*). ' +
+            'To scope the grant to a specific secret, import the credential provider with an explicit secretArn.');
+        secretResourceArns = [aws_cdk_lib_1.Stack.of(scope).formatArn({
+                service: 'secretsmanager',
+                resource: 'secret',
+                resourceName: 'bedrock-agentcore-identity!*',
+                arnFormat: aws_cdk_lib_1.ArnFormat.COLON_RESOURCE_NAME,
+            })];
+    }
+    else {
+        secretResourceArns = [secretArn];
+    }
+    return iam.Grant.addToPrincipal({
+        grantee,
+        actions: secretActions,
+        resourceArns: secretResourceArns,
+        scope,
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ3JhbnQtaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImdyYW50LWhlbHBlcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBOzs7Ozs7Ozs7OztHQVdHOzs7QUE0REgsOERBY0M7QUFRRCw4Q0FjQztBQWVELHNEQStCQztBQTVJRCw2Q0FBbUU7QUFDbkUsMkNBQTJDO0FBRzNDOzs7Ozs7Ozs7OztHQVdHO0FBQ1UsUUFBQSxvQ0FBb0MsR0FBRztJQUNsRCxxQkFBcUI7SUFDckIsOENBQThDO0NBQ3RDLENBQUM7QUFFWDs7R0FFRztBQUNVLFFBQUEsbUNBQW1DLEdBQUc7SUFDakQscUJBQXFCO0lBQ3JCLDhDQUE4QztDQUN0QyxDQUFDO0FBRVg7O0dBRUc7QUFDVSxRQUFBLGtDQUFrQyxHQUFHO0lBQ2hELHFDQUFxQztJQUNyQyx1REFBdUQ7Q0FDL0MsQ0FBQztBQUVYOzs7Ozs7Ozs7R0FTRztBQUNVLFFBQUEsK0JBQStCLEdBQUc7SUFDN0MscUNBQXFDO0lBQ3JDLHlEQUF5RDtDQUNqRCxDQUFDO0FBRVg7Ozs7O0dBS0c7QUFDSCxTQUFnQix5QkFBeUIsQ0FDdkMsS0FBaUIsRUFDakIsV0FBbUIsRUFDbkIsZUFBa0M7SUFFbEMsTUFBTSxLQUFLLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDOUIsTUFBTSxVQUFVLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUNoRCxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ2QsT0FBTyxFQUFFLG1CQUFtQjtRQUM1QixRQUFRO1FBQ1IsU0FBUyxFQUFFLHVCQUFTLENBQUMsZ0JBQWdCO0tBQ3RDLENBQUMsQ0FDSCxDQUFDO0lBQ0YsT0FBTyxDQUFDLFdBQVcsRUFBRSxHQUFHLFVBQVUsQ0FBQyxDQUFDO0FBQ3RDLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQWdCLGlCQUFpQixDQUMvQixLQUFpQixFQUNqQixPQUF1QixFQUN2QixXQUFtQixFQUNuQixtQkFBNkIsRUFDN0IsV0FBcUIsRUFDckIsZUFBa0M7SUFFbEMsT0FBTyxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQztRQUM5QixPQUFPO1FBQ1AsT0FBTyxFQUFFLENBQUMsR0FBRyxtQkFBbUIsRUFBRSxHQUFHLFdBQVcsQ0FBQztRQUNqRCxZQUFZLEVBQUUseUJBQXlCLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxlQUFlLENBQUM7UUFDNUUsS0FBSztLQUNOLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxTQUFnQixxQkFBcUIsQ0FDbkMsS0FBaUIsRUFDakIsT0FBdUIsRUFDdkIsU0FBNkIsRUFDN0IsYUFBdUI7SUFFdkIsSUFBSSxTQUFTLElBQUksSUFBSSxJQUFJLFNBQVMsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUMxQyxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBQ0QsSUFBSSxrQkFBNEIsQ0FBQztJQUNqQyxJQUFJLG1CQUFLLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDbEMseUJBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsWUFBWSxDQUNoQyw2REFBNkQsRUFDN0QsaUhBQWlIO1lBQ2pILHFHQUFxRyxDQUN0RyxDQUFDO1FBQ0Ysa0JBQWtCLEdBQUcsQ0FBQyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxTQUFTLENBQUM7Z0JBQzlDLE9BQU8sRUFBRSxnQkFBZ0I7Z0JBQ3pCLFFBQVEsRUFBRSxRQUFRO2dCQUNsQixZQUFZLEVBQUUsOEJBQThCO2dCQUM1QyxTQUFTLEVBQUUsdUJBQVMsQ0FBQyxtQkFBbUI7YUFDekMsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO1NBQU0sQ0FBQztRQUNOLGtCQUFrQixHQUFHLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkMsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUM7UUFDOUIsT0FBTztRQUNQLE9BQU8sRUFBRSxhQUFhO1FBQ3RCLFlBQVksRUFBRSxrQkFBa0I7UUFDaEMsS0FBSztLQUNOLENBQUMsQ0FBQztBQUNMLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqICBDb3B5cmlnaHQgQW1hem9uLmNvbSwgSW5jLiBvciBpdHMgYWZmaWxpYXRlcy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5cbiAqXG4gKiAgTGljZW5zZWQgdW5kZXIgdGhlIEFwYWNoZSBMaWNlbnNlLCBWZXJzaW9uIDIuMCAodGhlIFwiTGljZW5zZVwiKS4gWW91IG1heSBub3QgdXNlIHRoaXMgZmlsZSBleGNlcHQgaW4gY29tcGxpYW5jZVxuICogIHdpdGggdGhlIExpY2Vuc2UuIEEgY29weSBvZiB0aGUgTGljZW5zZSBpcyBsb2NhdGVkIGF0XG4gKlxuICogICAgICBodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvTElDRU5TRS0yLjBcbiAqXG4gKiAgb3IgaW4gdGhlICdsaWNlbnNlJyBmaWxlIGFjY29tcGFueWluZyB0aGlzIGZpbGUuIFRoaXMgZmlsZSBpcyBkaXN0cmlidXRlZCBvbiBhbiAnQVMgSVMnIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVNcbiAqICBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBleHByZXNzIG9yIGltcGxpZWQuIFNlZSB0aGUgTGljZW5zZSBmb3IgdGhlIHNwZWNpZmljIGxhbmd1YWdlIGdvdmVybmluZyBwZXJtaXNzaW9uc1xuICogIGFuZCBsaW1pdGF0aW9ucyB1bmRlciB0aGUgTGljZW5zZS5cbiAqL1xuXG5pbXBvcnQgeyBBbm5vdGF0aW9ucywgQXJuRm9ybWF0LCBTdGFjaywgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgdHlwZSB7IElDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcblxuLyoqXG4gKiBQYXJlbnQvY29sbGVjdGlvbiByZXNvdXJjZSBBUk4gc2VnbWVudHMgZm9yIFRva2VuIFZhdWx0IGNyZWRlbnRpYWwgcHJvdmlkZXJzLlxuICpcbiAqIEJlZHJvY2sgQWdlbnRDb3JlIHVzZXMgYSBoaWVyYXJjaGljYWwgYXV0aG9yaXphdGlvbiBtb2RlbCB3aGVyZSBHZXQvTGlzdCBhY3Rpb25zXG4gKiByZXF1aXJlIElBTSBwZXJtaXNzaW9uIG9uIHRoZSBwYXJlbnQgYW5kIGNvbGxlY3Rpb24gcmVzb3VyY2VzIGluIGFkZGl0aW9uIHRvIHRoZVxuICogc3BlY2lmaWMgcmVzb3VyY2UgaW5zdGFuY2UuIEZvciBleGFtcGxlLCBHZXRBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIgbmVlZHM6XG4gKiAgIC0gdG9rZW4tdmF1bHQvZGVmYXVsdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKHZhdWx0KVxuICogICAtIHRva2VuLXZhdWx0L2RlZmF1bHQvYXBpa2V5Y3JlZGVudGlhbHByb3ZpZGVyICAgIChjb2xsZWN0aW9uKVxuICogICAtIHRva2VuLXZhdWx0L2RlZmF1bHQvYXBpa2V5Y3JlZGVudGlhbHByb3ZpZGVyLyogIChpbnN0YW5jZSlcbiAqXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGNvbnN0IFRPS0VOX1ZBVUxUX0FQSV9LRVlfUEFSRU5UX1JFU09VUkNFUyA9IFtcbiAgJ3Rva2VuLXZhdWx0L2RlZmF1bHQnLFxuICAndG9rZW4tdmF1bHQvZGVmYXVsdC9hcGlrZXljcmVkZW50aWFscHJvdmlkZXInLFxuXSBhcyBjb25zdDtcblxuLyoqXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGNvbnN0IFRPS0VOX1ZBVUxUX09BVVRIMl9QQVJFTlRfUkVTT1VSQ0VTID0gW1xuICAndG9rZW4tdmF1bHQvZGVmYXVsdCcsXG4gICd0b2tlbi12YXVsdC9kZWZhdWx0L29hdXRoMmNyZWRlbnRpYWxwcm92aWRlcicsXG5dIGFzIGNvbnN0O1xuXG4vKipcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgY29uc3QgV09SS0xPQURfSURFTlRJVFlfUEFSRU5UX1JFU09VUkNFUyA9IFtcbiAgJ3dvcmtsb2FkLWlkZW50aXR5LWRpcmVjdG9yeS9kZWZhdWx0JyxcbiAgJ3dvcmtsb2FkLWlkZW50aXR5LWRpcmVjdG9yeS9kZWZhdWx0L3dvcmtsb2FkLWlkZW50aXR5Jyxcbl0gYXMgY29uc3Q7XG5cbi8qKlxuICogV29ya2xvYWQgaWRlbnRpdHkgcmVzb3VyY2UgQVJOIHNlZ21lbnRzIHJlcXVpcmVkIGJ5IGRhdGEtcGxhbmUgYWN0aW9uc1xuICogKEdldFJlc291cmNlQXBpS2V5LCBHZXRSZXNvdXJjZU9hdXRoMlRva2VuLCBDb21wbGV0ZVJlc291cmNlVG9rZW5BdXRoKS5cbiAqXG4gKiBUaGVzZSBhY3Rpb25zIHJlcXVpcmUgYm90aCB0aGUgd29ya2xvYWQgaWRlbnRpdHkgZGlyZWN0b3J5IGFuZCBhIHdpbGRjYXJkXG4gKiBvdmVyIHdvcmtsb2FkIGlkZW50aXRpZXMgYmVjYXVzZSB0aGUgc3BlY2lmaWMgaWRlbnRpdHkgaXMgY3JlYXRlZCBkeW5hbWljYWxseVxuICogYnkgdGhlIGdhdGV3YXkvc2VydmljZSBhdCBydW50aW1lLlxuICpcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgY29uc3QgV09SS0xPQURfSURFTlRJVFlfVVNFX1JFU09VUkNFUyA9IFtcbiAgJ3dvcmtsb2FkLWlkZW50aXR5LWRpcmVjdG9yeS9kZWZhdWx0JyxcbiAgJ3dvcmtsb2FkLWlkZW50aXR5LWRpcmVjdG9yeS9kZWZhdWx0L3dvcmtsb2FkLWlkZW50aXR5LyonLFxuXSBhcyBjb25zdDtcblxuLyoqXG4gKiBCdWlsZCB0aGUgZnVsbCBzZXQgb2YgcmVzb3VyY2UgQVJOcyBmb3IgYW4gaWRlbnRpdHkgZ3JhbnQ6IHRoZSBpbnN0YW5jZSBBUk5cbiAqIHBsdXMgYWxsIHBhcmVudC9jb2xsZWN0aW9uIEFSTnMgdGhhdCB0aGUgc2VydmljZSdzIGF1dGhvcml6YXRpb24gbW9kZWwgcmVxdWlyZXMuXG4gKlxuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBidWlsZElkZW50aXR5UmVzb3VyY2VBcm5zKFxuICBzY29wZTogSUNvbnN0cnVjdCxcbiAgaW5zdGFuY2VBcm46IHN0cmluZyxcbiAgcGFyZW50UmVzb3VyY2VzOiByZWFkb25seSBzdHJpbmdbXSxcbik6IHN0cmluZ1tdIHtcbiAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZihzY29wZSk7XG4gIGNvbnN0IHBhcmVudEFybnMgPSBwYXJlbnRSZXNvdXJjZXMubWFwKHJlc291cmNlID0+XG4gICAgc3RhY2suZm9ybWF0QXJuKHtcbiAgICAgIHNlcnZpY2U6ICdiZWRyb2NrLWFnZW50Y29yZScsXG4gICAgICByZXNvdXJjZSxcbiAgICAgIGFybkZvcm1hdDogQXJuRm9ybWF0Lk5PX1JFU09VUkNFX05BTUUsXG4gICAgfSksXG4gICk7XG4gIHJldHVybiBbaW5zdGFuY2VBcm4sIC4uLnBhcmVudEFybnNdO1xufVxuXG4vKipcbiAqIEdyYW50IHJlYWQgYW5kIGxpc3QgcGVybWlzc2lvbnMgb24gYSBzcGVjaWZpYyBpZGVudGl0eSByZXNvdXJjZSwgaW5jbHVkaW5nXG4gKiBwYXJlbnQvY29sbGVjdGlvbiBBUk5zIHJlcXVpcmVkIGJ5IHRoZSBCZWRyb2NrIEFnZW50Q29yZSBhdXRob3JpemF0aW9uIG1vZGVsLlxuICpcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgZnVuY3Rpb24gZ3JhbnRSZWFkV2l0aExpc3QoXG4gIHNjb3BlOiBJQ29uc3RydWN0LFxuICBncmFudGVlOiBpYW0uSUdyYW50YWJsZSxcbiAgcmVzb3VyY2VBcm46IHN0cmluZyxcbiAgcmVzb3VyY2VSZWFkQWN0aW9uczogc3RyaW5nW10sXG4gIGxpc3RBY3Rpb25zOiBzdHJpbmdbXSxcbiAgcGFyZW50UmVzb3VyY2VzOiByZWFkb25seSBzdHJpbmdbXSxcbik6IGlhbS5HcmFudCB7XG4gIHJldHVybiBpYW0uR3JhbnQuYWRkVG9QcmluY2lwYWwoe1xuICAgIGdyYW50ZWUsXG4gICAgYWN0aW9uczogWy4uLnJlc291cmNlUmVhZEFjdGlvbnMsIC4uLmxpc3RBY3Rpb25zXSxcbiAgICByZXNvdXJjZUFybnM6IGJ1aWxkSWRlbnRpdHlSZXNvdXJjZUFybnMoc2NvcGUsIHJlc291cmNlQXJuLCBwYXJlbnRSZXNvdXJjZXMpLFxuICAgIHNjb3BlLFxuICB9KTtcbn1cblxuLyoqXG4gKiBHcmFudHMgU2VjcmV0cyBNYW5hZ2VyIGFjdGlvbnMgb24gdGhlIGNyZWRlbnRpYWwgc2VjcmV0IHdoZW4gYW4gQVJOIGlzIGF2YWlsYWJsZVxuICogKGUuZy4gbm90IG9taXR0ZWQgb24gaW1wb3J0KS4gVXNlZCBmb3IgYm90aCByZWFkIChHZXRTZWNyZXRWYWx1ZSkgYW5kIHdyaXRlXG4gKiAoUHV0U2VjcmV0VmFsdWUpIGdyYW50cy5cbiAqXG4gKiBUaGUgQ0ZOIGF0dHJpYnV0ZSBmb3IgdGhlIHNlY3JldCBBUk4gKGUuZy4gYGF0dHJBcGlLZXlTZWNyZXRBcm5gKSByZXNvbHZlcyB0byBhblxuICogb2JqZWN0IGB7IFNlY3JldEFybjogc3RyaW5nIH1gIGF0IGRlcGxveSB0aW1lLCBub3QgYSBwbGFpbiBzdHJpbmcsIHNvIHRoZSBUb2tlblxuICogY2Fubm90IGJlIHBsYWNlZCBkaXJlY3RseSBpbiBJQU0gUmVzb3VyY2UgZmllbGRzLiBXaGVuIHRoZSBzZWNyZXQgQVJOIGlzIHVucmVzb2x2ZWRcbiAqIChUb2tlbiksIHdlIGZhbGwgYmFjayB0byBhIHNlcnZpY2UtbWFuYWdlZCBwcmVmaXggd2lsZGNhcmQuIFdoZW4gYSBsaXRlcmFsIEFSTiBpc1xuICogc3VwcGxpZWQgKGUuZy4gdmlhIGBmcm9tQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQXR0cmlidXRlc2ApLCB3ZSBzY29wZSB0aWdodGx5LlxuICpcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgZnVuY3Rpb24gZ3JhbnRDcmVkZW50aWFsU2VjcmV0KFxuICBzY29wZTogSUNvbnN0cnVjdCxcbiAgZ3JhbnRlZTogaWFtLklHcmFudGFibGUsXG4gIHNlY3JldEFybjogc3RyaW5nIHwgdW5kZWZpbmVkLFxuICBzZWNyZXRBY3Rpb25zOiBzdHJpbmdbXSxcbik6IGlhbS5HcmFudCB8IHVuZGVmaW5lZCB7XG4gIGlmIChzZWNyZXRBcm4gPT0gbnVsbCB8fCBzZWNyZXRBcm4gPT09ICcnKSB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxuICBsZXQgc2VjcmV0UmVzb3VyY2VBcm5zOiBzdHJpbmdbXTtcbiAgaWYgKFRva2VuLmlzVW5yZXNvbHZlZChzZWNyZXRBcm4pKSB7XG4gICAgQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZFdhcm5pbmdWMihcbiAgICAgICdAYXdzLWNkay9hd3MtYmVkcm9jay1hZ2VudGNvcmUtYWxwaGE6d2lsZGNhcmRTZWNyZXRBcm5HcmFudCcsXG4gICAgICAnVGhlIHNlY3JldCBBUk4gaXMgYW4gdW5yZXNvbHZlZCB0b2tlbi4gR3JhbnRpbmcgYWNjZXNzIHVzaW5nIGEgd2lsZGNhcmQgcHJlZml4IChiZWRyb2NrLWFnZW50Y29yZS1pZGVudGl0eSEqKS4gJyArXG4gICAgICAnVG8gc2NvcGUgdGhlIGdyYW50IHRvIGEgc3BlY2lmaWMgc2VjcmV0LCBpbXBvcnQgdGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIgd2l0aCBhbiBleHBsaWNpdCBzZWNyZXRBcm4uJyxcbiAgICApO1xuICAgIHNlY3JldFJlc291cmNlQXJucyA9IFtTdGFjay5vZihzY29wZSkuZm9ybWF0QXJuKHtcbiAgICAgIHNlcnZpY2U6ICdzZWNyZXRzbWFuYWdlcicsXG4gICAgICByZXNvdXJjZTogJ3NlY3JldCcsXG4gICAgICByZXNvdXJjZU5hbWU6ICdiZWRyb2NrLWFnZW50Y29yZS1pZGVudGl0eSEqJyxcbiAgICAgIGFybkZvcm1hdDogQXJuRm9ybWF0LkNPTE9OX1JFU09VUkNFX05BTUUsXG4gICAgfSldO1xuICB9IGVsc2Uge1xuICAgIHNlY3JldFJlc291cmNlQXJucyA9IFtzZWNyZXRBcm5dO1xuICB9XG4gIHJldHVybiBpYW0uR3JhbnQuYWRkVG9QcmluY2lwYWwoe1xuICAgIGdyYW50ZWUsXG4gICAgYWN0aW9uczogc2VjcmV0QWN0aW9ucyxcbiAgICByZXNvdXJjZUFybnM6IHNlY3JldFJlc291cmNlQXJucyxcbiAgICBzY29wZSxcbiAgfSk7XG59XG4iXX0=