@aws-cdk/toolkit-lib 0.3.2 → 0.3.4

package/lib/api/diff/diff-formatter.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DiffFormatter = void 0;
+const node_util_1 = require("node:util");
+const cxschema = require("@aws-cdk/cloud-assembly-schema");
+const cloudformation_diff_1 = require("@aws-cdk/cloudformation-diff");
+const chalk = require("chalk");
+const payloads_1 = require("../../payloads");
+const private_1 = require("../io/private");
+const streams_1 = require("../streams");
+/**
+ * Class for formatting the diff output
+ */
+class DiffFormatter {
+    ioHelper;
+    oldTemplate;
+    newTemplate;
+    stackName;
+    changeSet;
+    nestedStacks;
+    isImport;
+    /**
+     * Stores the TemplateDiffs that get calculated in this DiffFormatter,
+     * indexed by the stack name.
+     */
+    _diffs = {};
+    constructor(props) {
+        this.ioHelper = props.ioHelper;
+        this.oldTemplate = props.templateInfo.oldTemplate;
+        this.newTemplate = props.templateInfo.newTemplate;
+        this.stackName = props.templateInfo.newTemplate.displayName ?? props.templateInfo.newTemplate.stackName;
+        this.changeSet = props.templateInfo.changeSet;
+        this.nestedStacks = props.templateInfo.nestedStacks;
+        this.isImport = props.templateInfo.isImport ?? false;
+    }
+    get diffs() {
+        return this._diffs;
+    }
+    /**
+     * Get or creates the diff of a stack.
+     * If it creates the diff, it stores the result in a map for
+     * easier retreval later.
+     */
+    diff(stackName, oldTemplate) {
+        const realStackName = stackName ?? this.stackName;
+        if (!this._diffs[realStackName]) {
+            this._diffs[realStackName] = (0, cloudformation_diff_1.fullDiff)(oldTemplate ?? this.oldTemplate, this.newTemplate.template, this.changeSet, this.isImport);
+        }
+        return this._diffs[realStackName];
+    }
+    /**
+     * Return whether the diff has security-impacting changes that need confirmation.
+     *
+     * If no stackName is given, then the root stack name is used.
+     */
+    permissionType(stackName) {
+        const diff = this.diff(stackName);
+        if (diff.permissionsBroadened) {
+            return payloads_1.PermissionChangeType.BROADENING;
+        }
+        else if (diff.permissionsAnyChanges) {
+            return payloads_1.PermissionChangeType.NON_BROADENING;
+        }
+        else {
+            return payloads_1.PermissionChangeType.NONE;
+        }
+    }
+    /**
+     * Format the stack diff
+     */
+    formatStackDiff(options = {}) {
+        const ioDefaultHelper = new private_1.IoDefaultMessages(this.ioHelper);
+        return this.formatStackDiffHelper(this.oldTemplate, this.stackName, this.nestedStacks, {
+            ...options,
+            ioDefaultHelper,
+        });
+    }
+    formatStackDiffHelper(oldTemplate, stackName, nestedStackTemplates, options) {
+        let diff = this.diff(stackName, oldTemplate);
+        // The stack diff is formatted via `Formatter`, which takes in a stream
+        // and sends its output directly to that stream. To faciliate use of the
+        // global CliIoHost, we create our own stream to capture the output of
+        // `Formatter` and return the output as a string for the consumer of
+        // `formatStackDiff` to decide what to do with it.
+        const stream = new streams_1.StringWriteStream();
+        let numStacksWithChanges = 0;
+        let formattedDiff = '';
+        let filteredChangesCount = 0;
+        try {
+            // must output the stack name if there are differences, even if quiet
+            if (stackName && (!options.quiet || !diff.isEmpty)) {
+                stream.write((0, node_util_1.format)(`Stack ${chalk.bold(stackName)}\n`));
+            }
+            if (!options.quiet && this.isImport) {
+                stream.write('Parameters and rules created during migration do not affect resource configuration.\n');
+            }
+            // detect and filter out mangled characters from the diff
+            if (diff.differenceCount && !options.strict) {
+                const mangledNewTemplate = JSON.parse((0, cloudformation_diff_1.mangleLikeCloudFormation)(JSON.stringify(this.newTemplate.template)));
+                const mangledDiff = (0, cloudformation_diff_1.fullDiff)(this.oldTemplate, mangledNewTemplate, this.changeSet);
+                filteredChangesCount = Math.max(0, diff.differenceCount - mangledDiff.differenceCount);
+                if (filteredChangesCount > 0) {
+                    diff = mangledDiff;
+                }
+            }
+            // filter out 'AWS::CDK::Metadata' resources from the template
+            // filter out 'CheckBootstrapVersion' rules from the template
+            if (!options.strict) {
+                obscureDiff(diff);
+            }
+            if (!diff.isEmpty) {
+                numStacksWithChanges++;
+                // formatDifferences updates the stream with the formatted stack diff
+                (0, cloudformation_diff_1.formatDifferences)(stream, diff, {
+                    ...logicalIdMapFromTemplate(this.oldTemplate),
+                    ...buildLogicalToPathMap(this.newTemplate),
+                }, options.context);
+            }
+            else if (!options.quiet) {
+                stream.write(chalk.green('There were no differences\n'));
+            }
+            if (filteredChangesCount > 0) {
+                stream.write(chalk.yellow(`Omitted ${filteredChangesCount} changes because they are likely mangled non-ASCII characters. Use --strict to print them.\n`));
+            }
+        }
+        finally {
+            // store the stream containing a formatted stack diff
+            formattedDiff = stream.toString();
+            stream.end();
+        }
+        for (const nestedStackLogicalId of Object.keys(nestedStackTemplates ?? {})) {
+            if (!nestedStackTemplates) {
+                break;
+            }
+            const nestedStack = nestedStackTemplates[nestedStackLogicalId];
+            this.newTemplate._template = nestedStack.generatedTemplate;
+            const nextDiff = this.formatStackDiffHelper(nestedStack.deployedTemplate, nestedStack.physicalName ?? nestedStackLogicalId, nestedStack.nestedStackTemplates, options);
+            numStacksWithChanges += nextDiff.numStacksWithChanges;
+            formattedDiff += nextDiff.formattedDiff;
+        }
+        return {
+            numStacksWithChanges,
+            formattedDiff,
+        };
+    }
+    /**
+     * Format the security diff
+     */
+    formatSecurityDiff() {
+        const diff = this.diff();
+        // The security diff is formatted via `Formatter`, which takes in a stream
+        // and sends its output directly to that stream. To faciliate use of the
+        // global CliIoHost, we create our own stream to capture the output of
+        // `Formatter` and return the output as a string for the consumer of
+        // `formatSecurityDiff` to decide what to do with it.
+        const stream = new streams_1.StringWriteStream();
+        stream.write((0, node_util_1.format)(`Stack ${chalk.bold(this.stackName)}\n`));
+        try {
+            // formatSecurityChanges updates the stream with the formatted security diff
+            (0, cloudformation_diff_1.formatSecurityChanges)(stream, diff, buildLogicalToPathMap(this.newTemplate));
+        }
+        finally {
+            stream.end();
+        }
+        // store the stream containing a formatted stack diff
+        const formattedDiff = stream.toString();
+        return { formattedDiff, permissionChangeType: this.permissionType() };
+    }
+}
+exports.DiffFormatter = DiffFormatter;
+function buildLogicalToPathMap(stack) {
+    const map = {};
+    for (const md of stack.findMetadataByType(cxschema.ArtifactMetadataEntryType.LOGICAL_ID)) {
+        map[md.data] = md.path;
+    }
+    return map;
+}
+function logicalIdMapFromTemplate(template) {
+    const ret = {};
+    for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+        const path = resource?.Metadata?.['aws:cdk:path'];
+        if (path) {
+            ret[logicalId] = path;
+        }
+    }
+    return ret;
+}
+/**
+ * Remove any template elements that we don't want to show users.
+ * This is currently:
+ * - AWS::CDK::Metadata resource
+ * - CheckBootstrapVersion Rule
+ */
+function obscureDiff(diff) {
+    if (diff.unknown) {
+        // see https://github.com/aws/aws-cdk/issues/17942
+        diff.unknown = diff.unknown.filter(change => {
+            if (!change) {
+                return true;
+            }
+            if (change.newValue?.CheckBootstrapVersion) {
+                return false;
+            }
+            if (change.oldValue?.CheckBootstrapVersion) {
+                return false;
+            }
+            return true;
+        });
+    }
+    if (diff.resources) {
+        diff.resources = diff.resources.filter(change => {
+            if (!change) {
+                return true;
+            }
+            if (change.newResourceType === 'AWS::CDK::Metadata') {
+                return false;
+            }
+            if (change.oldResourceType === 'AWS::CDK::Metadata') {
+                return false;
+            }
+            return true;
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlmZi1mb3JtYXR0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJkaWZmLWZvcm1hdHRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSx5Q0FBbUM7QUFDbkMsMkRBQTJEO0FBQzNELHNFQU1zQztBQUV0QywrQkFBK0I7QUFDL0IsNkNBQXNEO0FBR3RELDJDQUFrRDtBQUNsRCx3Q0FBK0M7QUF1SC9DOztHQUVHO0FBQ0gsTUFBYSxhQUFhO0lBQ1AsUUFBUSxDQUFXO0lBQ25CLFdBQVcsQ0FBTTtJQUNqQixXQUFXLENBQW9DO0lBQy9DLFNBQVMsQ0FBUztJQUNsQixTQUFTLENBQU87SUFDaEIsWUFBWSxDQUF1RTtJQUNuRixRQUFRLENBQVU7SUFFbkM7OztPQUdHO0lBQ0ssTUFBTSxHQUFxQyxFQUFFLENBQUM7SUFFdEQsWUFBWSxLQUF5QjtRQUNuQyxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUM7UUFDL0IsSUFBSSxDQUFDLFdBQVcsR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztRQUNsRCxJQUFJLENBQUMsV0FBVyxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDO1FBQ2xELElBQUksQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsV0FBVyxJQUFJLEtBQUssQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQztRQUN4RyxJQUFJLENBQUMsU0FBUyxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDO1FBQzlDLElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUM7UUFDcEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQVcsS0FBSztRQUNkLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztJQUNyQixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLElBQUksQ0FBQyxTQUFrQixFQUFFLFdBQWlCO1FBQ2hELE1BQU0sYUFBYSxHQUFHLFNBQVMsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDO1FBRWxELElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDaEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxJQUFBLDhCQUFRLEVBQ25DLFdBQVcsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUMvQixJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsRUFDekIsSUFBSSxDQUFDLFNBQVMsRUFDZCxJQUFJLENBQUMsUUFBUSxDQUNkLENBQUM7UUFDSixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ssY0FBYyxDQUFDLFNBQWtCO1FBQ3ZDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFFbEMsSUFBSSxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztZQUM5QixPQUFPLCtCQUFvQixDQUFDLFVBQVUsQ0FBQztRQUN6QyxDQUFDO2FBQU0sSUFBSSxJQUFJLENBQUMscUJBQXFCLEVBQUUsQ0FBQztZQUN0QyxPQUFPLCtCQUFvQixDQUFDLGNBQWMsQ0FBQztRQUM3QyxDQUFDO2FBQU0sQ0FBQztZQUNOLE9BQU8sK0JBQW9CLENBQUMsSUFBSSxDQUFDO1FBQ25DLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxlQUFlLENBQUMsVUFBa0MsRUFBRTtRQUN6RCxNQUFNLGVBQWUsR0FBRyxJQUFJLDJCQUFpQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM3RCxPQUFPLElBQUksQ0FBQyxxQkFBcUIsQ0FDL0IsSUFBSSxDQUFDLFdBQVcsRUFDaEIsSUFBSSxDQUFDLFNBQVMsRUFDZCxJQUFJLENBQUMsWUFBWSxFQUNqQjtZQUNFLEdBQUcsT0FBTztZQUNWLGVBQWU7U0FDaEIsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUVPLHFCQUFxQixDQUMzQixXQUFnQixFQUNoQixTQUFpQixFQUNqQixvQkFBMEYsRUFDMUYsT0FBaUM7UUFFakMsSUFBSSxJQUFJLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFFN0MsdUVBQXVFO1FBQ3ZFLHdFQUF3RTtRQUN4RSxzRUFBc0U7UUFDdEUsb0VBQW9FO1FBQ3BFLGtEQUFrRDtRQUNsRCxNQUFNLE1BQU0sR0FBRyxJQUFJLDJCQUFpQixFQUFFLENBQUM7UUFFdkMsSUFBSSxvQkFBb0IsR0FBRyxDQUFDLENBQUM7UUFDN0IsSUFBSSxhQUFhLEdBQUcsRUFBRSxDQUFDO1FBQ3ZCLElBQUksb0JBQW9CLEdBQUcsQ0FBQyxDQUFDO1FBQzdCLElBQUksQ0FBQztZQUNILHFFQUFxRTtZQUNyRSxJQUFJLFNBQVMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUNuRCxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUEsa0JBQU0sRUFBQyxTQUFTLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDM0QsQ0FBQztZQUVELElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDcEMsTUFBTSxDQUFDLEtBQUssQ0FBQyx1RkFBdUYsQ0FBQyxDQUFDO1lBQ3hHLENBQUM7WUFFRCx5REFBeUQ7WUFDekQsSUFBSSxJQUFJLENBQUMsZUFBZSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUM1QyxNQUFNLGtCQUFrQixHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBQSw4Q0FBd0IsRUFBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUMzRyxNQUFNLFdBQVcsR0FBRyxJQUFBLDhCQUFRLEVBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ25GLG9CQUFvQixHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLElBQUksQ0FBQyxlQUFlLEdBQUcsV0FBVyxDQUFDLGVBQWUsQ0FBQyxDQUFDO2dCQUN2RixJQUFJLG9CQUFvQixHQUFHLENBQUMsRUFBRSxDQUFDO29CQUM3QixJQUFJLEdBQUcsV0FBVyxDQUFDO2dCQUNyQixDQUFDO1lBQ0gsQ0FBQztZQUVELDhEQUE4RDtZQUM5RCw2REFBNkQ7WUFDN0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDcEIsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3BCLENBQUM7WUFFRCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNsQixvQkFBb0IsRUFBRSxDQUFDO2dCQUV2QixxRUFBcUU7Z0JBQ3JFLElBQUEsdUNBQWlCLEVBQUMsTUFBTSxFQUFFLElBQUksRUFBRTtvQkFDOUIsR0FBRyx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO29CQUM3QyxHQUFHLHFCQUFxQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUM7aUJBQzNDLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3RCLENBQUM7aUJBQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDMUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLDZCQUE2QixDQUFDLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBRUQsSUFBSSxvQkFBb0IsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDN0IsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLFdBQVcsb0JBQW9CLDhGQUE4RixDQUFDLENBQUMsQ0FBQztZQUM1SixDQUFDO1FBQ0gsQ0FBQztnQkFBUyxDQUFDO1lBQ1QscURBQXFEO1lBQ3JELGFBQWEsR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbEMsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ2YsQ0FBQztRQUVELEtBQUssTUFBTSxvQkFBb0IsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLG9CQUFvQixJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDM0UsSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7Z0JBQzFCLE1BQU07WUFDUixDQUFDO1lBQ0QsTUFBTSxXQUFXLEdBQUcsb0JBQW9CLENBQUMsb0JBQW9CLENBQUMsQ0FBQztZQUU5RCxJQUFJLENBQUMsV0FBbUIsQ0FBQyxTQUFTLEdBQUcsV0FBVyxDQUFDLGlCQUFpQixDQUFDO1lBQ3BFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxxQkFBcUIsQ0FDekMsV0FBVyxDQUFDLGdCQUFnQixFQUM1QixXQUFXLENBQUMsWUFBWSxJQUFJLG9CQUFvQixFQUNoRCxXQUFXLENBQUMsb0JBQW9CLEVBQ2hDLE9BQU8sQ0FDUixDQUFDO1lBQ0Ysb0JBQW9CLElBQUksUUFBUSxDQUFDLG9CQUFvQixDQUFDO1lBQ3RELGFBQWEsSUFBSSxRQUFRLENBQUMsYUFBYSxDQUFDO1FBQzFDLENBQUM7UUFFRCxPQUFPO1lBQ0wsb0JBQW9CO1lBQ3BCLGFBQWE7U0FDZCxDQUFDO0lBQ0osQ0FBQztJQUVEOztPQUVHO0lBQ0ksa0JBQWtCO1FBQ3ZCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUV6QiwwRUFBMEU7UUFDMUUsd0VBQXdFO1FBQ3hFLHNFQUFzRTtRQUN0RSxvRUFBb0U7UUFDcEUscURBQXFEO1FBQ3JELE1BQU0sTUFBTSxHQUFHLElBQUksMkJBQWlCLEVBQUUsQ0FBQztRQUV2QyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUEsa0JBQU0sRUFBQyxTQUFTLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBRTlELElBQUksQ0FBQztZQUNILDRFQUE0RTtZQUM1RSxJQUFBLDJDQUFxQixFQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUscUJBQXFCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDL0UsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ2YsQ0FBQztRQUNELHFEQUFxRDtRQUNyRCxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDeEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxvQkFBb0IsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztJQUN4RSxDQUFDO0NBQ0Y7QUFsTUQsc0NBa01DO0FBRUQsU0FBUyxxQkFBcUIsQ0FBQyxLQUF3QztJQUNyRSxNQUFNLEdBQUcsR0FBNkIsRUFBRSxDQUFDO0lBQ3pDLEtBQUssTUFBTSxFQUFFLElBQUksS0FBSyxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyx5QkFBeUIsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3pGLEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBYyxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQztJQUNuQyxDQUFDO0lBQ0QsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDO0FBRUQsU0FBUyx3QkFBd0IsQ0FBQyxRQUFhO0lBQzdDLE1BQU0sR0FBRyxHQUEyQixFQUFFLENBQUM7SUFFdkMsS0FBSyxNQUFNLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzdFLE1BQU0sSUFBSSxHQUFJLFFBQWdCLEVBQUUsUUFBUSxFQUFFLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDM0QsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUNULEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDeEIsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQVMsV0FBVyxDQUFDLElBQWtCO0lBQ3JDLElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2pCLGtEQUFrRDtRQUNsRCxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQzFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDWixPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFDRCxJQUFJLE1BQU0sQ0FBQyxRQUFRLEVBQUUscUJBQXFCLEVBQUUsQ0FBQztnQkFDM0MsT0FBTyxLQUFLLENBQUM7WUFDZixDQUFDO1lBQ0QsSUFBSSxNQUFNLENBQUMsUUFBUSxFQUFFLHFCQUFxQixFQUFFLENBQUM7Z0JBQzNDLE9BQU8sS0FBSyxDQUFDO1lBQ2YsQ0FBQztZQUNELE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsSUFBSSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDbkIsSUFBSSxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRTtZQUM5QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ1osT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBQ0QsSUFBSSxNQUFNLENBQUMsZUFBZSxLQUFLLG9CQUFvQixFQUFFLENBQUM7Z0JBQ3BELE9BQU8sS0FBSyxDQUFDO1lBQ2YsQ0FBQztZQUNELElBQUksTUFBTSxDQUFDLGVBQWUsS0FBSyxvQkFBb0IsRUFBRSxDQUFDO2dCQUNwRCxPQUFPLEtBQUssQ0FBQztZQUNmLENBQUM7WUFDRCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBmb3JtYXQgfSBmcm9tICdub2RlOnV0aWwnO1xuaW1wb3J0ICogYXMgY3hzY2hlbWEgZnJvbSAnQGF3cy1jZGsvY2xvdWQtYXNzZW1ibHktc2NoZW1hJztcbmltcG9ydCB7XG4gIGZvcm1hdERpZmZlcmVuY2VzLFxuICBmb3JtYXRTZWN1cml0eUNoYW5nZXMsXG4gIGZ1bGxEaWZmLFxuICBtYW5nbGVMaWtlQ2xvdWRGb3JtYXRpb24sXG4gIHR5cGUgVGVtcGxhdGVEaWZmLFxufSBmcm9tICdAYXdzLWNkay9jbG91ZGZvcm1hdGlvbi1kaWZmJztcbmltcG9ydCB0eXBlICogYXMgY3hhcGkgZnJvbSAnQGF3cy1jZGsvY3gtYXBpJztcbmltcG9ydCAqIGFzIGNoYWxrIGZyb20gJ2NoYWxrJztcbmltcG9ydCB7IFBlcm1pc3Npb25DaGFuZ2VUeXBlIH0gZnJvbSAnLi4vLi4vcGF5bG9hZHMnO1xuaW1wb3J0IHR5cGUgeyBOZXN0ZWRTdGFja1RlbXBsYXRlcyB9IGZyb20gJy4uL2Nsb3VkZm9ybWF0aW9uJztcbmltcG9ydCB0eXBlIHsgSW9IZWxwZXIgfSBmcm9tICcuLi9pby9wcml2YXRlJztcbmltcG9ydCB7IElvRGVmYXVsdE1lc3NhZ2VzIH0gZnJvbSAnLi4vaW8vcHJpdmF0ZSc7XG5pbXBvcnQgeyBTdHJpbmdXcml0ZVN0cmVhbSB9IGZyb20gJy4uL3N0cmVhbXMnO1xuXG4vKipcbiAqIE91dHB1dCBvZiBmb3JtYXRTZWN1cml0eURpZmZcbiAqL1xuaW50ZXJmYWNlIEZvcm1hdFNlY3VyaXR5RGlmZk91dHB1dCB7XG4gIC8qKlxuICAgKiBDb21wbGV0ZSBmb3JtYXR0ZWQgc2VjdXJpdHkgZGlmZlxuICAgKi9cbiAgcmVhZG9ubHkgZm9ybWF0dGVkRGlmZjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgdHlwZSBvZiBwZXJtaXNzaW9uIGNoYW5nZXMgaW4gdGhlIHNlY3VyaXR5IGRpZmYuXG4gICAqIFRoZSBJb0hvc3Qgd2lsbCB1c2UgdGhpcyB0byBkZWNpZGUgd2hldGhlciBvciBub3QgdG8gcHJpbnQuXG4gICAqL1xuICByZWFkb25seSBwZXJtaXNzaW9uQ2hhbmdlVHlwZTogUGVybWlzc2lvbkNoYW5nZVR5cGU7XG59XG5cbi8qKlxuICogT3V0cHV0IG9mIGZvcm1hdFN0YWNrRGlmZlxuICovXG5pbnRlcmZhY2UgRm9ybWF0U3RhY2tEaWZmT3V0cHV0IHtcbiAgLyoqXG4gICAqIE51bWJlciBvZiBzdGFja3Mgd2l0aCBkaWZmIGNoYW5nZXNcbiAgICovXG4gIHJlYWRvbmx5IG51bVN0YWNrc1dpdGhDaGFuZ2VzOiBudW1iZXI7XG5cbiAgLyoqXG4gICAqIENvbXBsZXRlIGZvcm1hdHRlZCBkaWZmXG4gICAqL1xuICByZWFkb25seSBmb3JtYXR0ZWREaWZmOiBzdHJpbmc7XG59XG5cbi8qKlxuICogUHJvcHMgZm9yIHRoZSBEaWZmIEZvcm1hdHRlclxuICovXG5pbnRlcmZhY2UgRGlmZkZvcm1hdHRlclByb3BzIHtcbiAgLyoqXG4gICAqIEhlbHBlciBmb3IgdGhlIElvSG9zdCBjbGFzc1xuICAgKi9cbiAgcmVhZG9ubHkgaW9IZWxwZXI6IElvSGVscGVyO1xuXG4gIC8qKlxuICAgKiBUaGUgcmVsZXZhbnQgaW5mb3JtYXRpb24gZm9yIHRoZSBUZW1wbGF0ZSB0aGF0IGlzIGJlaW5nIGRpZmZlZC5cbiAgICogSW5jbHVkZXMgdGhlIG9sZC9jdXJyZW50IHN0YXRlIG9mIHRoZSBzdGFjayBhcyB3ZWxsIGFzIHRoZSBuZXcgc3RhdGUuXG4gICAqL1xuICByZWFkb25seSB0ZW1wbGF0ZUluZm86IFRlbXBsYXRlSW5mbztcbn1cblxuLyoqXG4gKiBQUm9wZXJ0aWVzIHNwZWNpZmljIHRvIGZvcm1hdHRpbmcgdGhlIHN0YWNrIGRpZmZcbiAqL1xuaW50ZXJmYWNlIEZvcm1hdFN0YWNrRGlmZk9wdGlvbnMge1xuICAvKipcbiAgICogZG8gbm90IGZpbHRlciBvdXQgQVdTOjpDREs6Ok1ldGFkYXRhIG9yIFJ1bGVzXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBzdHJpY3Q/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBsaW5lcyBvZiBjb250ZXh0IHRvIHVzZSBpbiBhcmJpdHJhcnkgSlNPTiBkaWZmXG4gICAqXG4gICAqIEBkZWZhdWx0IDNcbiAgICovXG4gIHJlYWRvbmx5IGNvbnRleHQ/OiBudW1iZXI7XG5cbiAgLyoqXG4gICAqIHNpbGVuY2VzIFxcJ1RoZXJlIHdlcmUgbm8gZGlmZmVyZW5jZXNcXCcgbWVzc2FnZXNcbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIHJlYWRvbmx5IHF1aWV0PzogYm9vbGVhbjtcbn1cblxuaW50ZXJmYWNlIFJldXNhYmxlU3RhY2tEaWZmT3B0aW9ucyBleHRlbmRzIEZvcm1hdFN0YWNrRGlmZk9wdGlvbnMge1xuICByZWFkb25seSBpb0RlZmF1bHRIZWxwZXI6IElvRGVmYXVsdE1lc3NhZ2VzO1xufVxuXG4vKipcbiAqIEluZm9ybWF0aW9uIG9uIGEgdGVtcGxhdGUncyBvbGQvbmV3IHN0YXRlXG4gKiB0aGF0IGlzIHVzZWQgZm9yIGRpZmYuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVGVtcGxhdGVJbmZvIHtcbiAgLyoqXG4gICAqIFRoZSBvbGQvZXhpc3RpbmcgdGVtcGxhdGVcbiAgICovXG4gIHJlYWRvbmx5IG9sZFRlbXBsYXRlOiBhbnk7XG5cbiAgLyoqXG4gICAqIFRoZSBuZXcgdGVtcGxhdGVcbiAgICovXG4gIHJlYWRvbmx5IG5ld1RlbXBsYXRlOiBjeGFwaS5DbG91ZEZvcm1hdGlvblN0YWNrQXJ0aWZhY3Q7XG5cbiAgLyoqXG4gICAqIEEgQ2xvdWRGb3JtYXRpb24gQ2hhbmdlU2V0IHRvIGhlbHAgdGhlIGRpZmYgb3BlcmF0aW9uLlxuICAgKiBQcm9iYWJseSBjcmVhdGVkIHZpYSBgY3JlYXRlRGlmZkNoYW5nZVNldGAuXG4gICAqXG4gICAqIEBkZWZhdWx0IHVuZGVmaW5lZFxuICAgKi9cbiAgcmVhZG9ubHkgY2hhbmdlU2V0PzogYW55O1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIG9yIG5vdCB0aGVyZSBhcmUgYW55IGltcG9ydGVkIHJlc291cmNlc1xuICAgKlxuICAgKiBAZGVmYXVsdCBmYWxzZVxuICAgKi9cbiAgcmVhZG9ubHkgaXNJbXBvcnQ/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBBbnkgbmVzdGVkIHN0YWNrcyBpbmNsdWRlZCBpbiB0aGUgdGVtcGxhdGVcbiAgICpcbiAgICogQGRlZmF1bHQge31cbiAgICovXG4gIHJlYWRvbmx5IG5lc3RlZFN0YWNrcz86IHtcbiAgICBbbmVzdGVkU3RhY2tMb2dpY2FsSWQ6IHN0cmluZ106IE5lc3RlZFN0YWNrVGVtcGxhdGVzO1xuICB9O1xufVxuXG4vKipcbiAqIENsYXNzIGZvciBmb3JtYXR0aW5nIHRoZSBkaWZmIG91dHB1dFxuICovXG5leHBvcnQgY2xhc3MgRGlmZkZvcm1hdHRlciB7XG4gIHByaXZhdGUgcmVhZG9ubHkgaW9IZWxwZXI6IElvSGVscGVyO1xuICBwcml2YXRlIHJlYWRvbmx5IG9sZFRlbXBsYXRlOiBhbnk7XG4gIHByaXZhdGUgcmVhZG9ubHkgbmV3VGVtcGxhdGU6IGN4YXBpLkNsb3VkRm9ybWF0aW9uU3RhY2tBcnRpZmFjdDtcbiAgcHJpdmF0ZSByZWFkb25seSBzdGFja05hbWU6IHN0cmluZztcbiAgcHJpdmF0ZSByZWFkb25seSBjaGFuZ2VTZXQ/OiBhbnk7XG4gIHByaXZhdGUgcmVhZG9ubHkgbmVzdGVkU3RhY2tzOiB7IFtuZXN0ZWRTdGFja0xvZ2ljYWxJZDogc3RyaW5nXTogTmVzdGVkU3RhY2tUZW1wbGF0ZXMgfSB8IHVuZGVmaW5lZDtcbiAgcHJpdmF0ZSByZWFkb25seSBpc0ltcG9ydDogYm9vbGVhbjtcblxuICAvKipcbiAgICogU3RvcmVzIHRoZSBUZW1wbGF0ZURpZmZzIHRoYXQgZ2V0IGNhbGN1bGF0ZWQgaW4gdGhpcyBEaWZmRm9ybWF0dGVyLFxuICAgKiBpbmRleGVkIGJ5IHRoZSBzdGFjayBuYW1lLlxuICAgKi9cbiAgcHJpdmF0ZSBfZGlmZnM6IHsgW25hbWU6IHN0cmluZ106IFRlbXBsYXRlRGlmZiB9ID0ge307XG5cbiAgY29uc3RydWN0b3IocHJvcHM6IERpZmZGb3JtYXR0ZXJQcm9wcykge1xuICAgIHRoaXMuaW9IZWxwZXIgPSBwcm9wcy5pb0hlbHBlcjtcbiAgICB0aGlzLm9sZFRlbXBsYXRlID0gcHJvcHMudGVtcGxhdGVJbmZvLm9sZFRlbXBsYXRlO1xuICAgIHRoaXMubmV3VGVtcGxhdGUgPSBwcm9wcy50ZW1wbGF0ZUluZm8ubmV3VGVtcGxhdGU7XG4gICAgdGhpcy5zdGFja05hbWUgPSBwcm9wcy50ZW1wbGF0ZUluZm8ubmV3VGVtcGxhdGUuZGlzcGxheU5hbWUgPz8gcHJvcHMudGVtcGxhdGVJbmZvLm5ld1RlbXBsYXRlLnN0YWNrTmFtZTtcbiAgICB0aGlzLmNoYW5nZVNldCA9IHByb3BzLnRlbXBsYXRlSW5mby5jaGFuZ2VTZXQ7XG4gICAgdGhpcy5uZXN0ZWRTdGFja3MgPSBwcm9wcy50ZW1wbGF0ZUluZm8ubmVzdGVkU3RhY2tzO1xuICAgIHRoaXMuaXNJbXBvcnQgPSBwcm9wcy50ZW1wbGF0ZUluZm8uaXNJbXBvcnQgPz8gZmFsc2U7XG4gIH1cblxuICBwdWJsaWMgZ2V0IGRpZmZzKCkge1xuICAgIHJldHVybiB0aGlzLl9kaWZmcztcbiAgfVxuXG4gIC8qKlxuICAgKiBHZXQgb3IgY3JlYXRlcyB0aGUgZGlmZiBvZiBhIHN0YWNrLlxuICAgKiBJZiBpdCBjcmVhdGVzIHRoZSBkaWZmLCBpdCBzdG9yZXMgdGhlIHJlc3VsdCBpbiBhIG1hcCBmb3JcbiAgICogZWFzaWVyIHJldHJldmFsIGxhdGVyLlxuICAgKi9cbiAgcHJpdmF0ZSBkaWZmKHN0YWNrTmFtZT86IHN0cmluZywgb2xkVGVtcGxhdGU/OiBhbnkpIHtcbiAgICBjb25zdCByZWFsU3RhY2tOYW1lID0gc3RhY2tOYW1lID8/IHRoaXMuc3RhY2tOYW1lO1xuXG4gICAgaWYgKCF0aGlzLl9kaWZmc1tyZWFsU3RhY2tOYW1lXSkge1xuICAgICAgdGhpcy5fZGlmZnNbcmVhbFN0YWNrTmFtZV0gPSBmdWxsRGlmZihcbiAgICAgICAgb2xkVGVtcGxhdGUgPz8gdGhpcy5vbGRUZW1wbGF0ZSxcbiAgICAgICAgdGhpcy5uZXdUZW1wbGF0ZS50ZW1wbGF0ZSxcbiAgICAgICAgdGhpcy5jaGFuZ2VTZXQsXG4gICAgICAgIHRoaXMuaXNJbXBvcnQsXG4gICAgICApO1xuICAgIH1cbiAgICByZXR1cm4gdGhpcy5fZGlmZnNbcmVhbFN0YWNrTmFtZV07XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJuIHdoZXRoZXIgdGhlIGRpZmYgaGFzIHNlY3VyaXR5LWltcGFjdGluZyBjaGFuZ2VzIHRoYXQgbmVlZCBjb25maXJtYXRpb24uXG4gICAqXG4gICAqIElmIG5vIHN0YWNrTmFtZSBpcyBnaXZlbiwgdGhlbiB0aGUgcm9vdCBzdGFjayBuYW1lIGlzIHVzZWQuXG4gICAqL1xuICBwcml2YXRlIHBlcm1pc3Npb25UeXBlKHN0YWNrTmFtZT86IHN0cmluZyk6IFBlcm1pc3Npb25DaGFuZ2VUeXBlIHtcbiAgICBjb25zdCBkaWZmID0gdGhpcy5kaWZmKHN0YWNrTmFtZSk7XG5cbiAgICBpZiAoZGlmZi5wZXJtaXNzaW9uc0Jyb2FkZW5lZCkge1xuICAgICAgcmV0dXJuIFBlcm1pc3Npb25DaGFuZ2VUeXBlLkJST0FERU5JTkc7XG4gICAgfSBlbHNlIGlmIChkaWZmLnBlcm1pc3Npb25zQW55Q2hhbmdlcykge1xuICAgICAgcmV0dXJuIFBlcm1pc3Npb25DaGFuZ2VUeXBlLk5PTl9CUk9BREVOSU5HO1xuICAgIH0gZWxzZSB7XG4gICAgICByZXR1cm4gUGVybWlzc2lvbkNoYW5nZVR5cGUuTk9ORTtcbiAgICB9XG4gIH1cblxuICAvKipcbiAgICogRm9ybWF0IHRoZSBzdGFjayBkaWZmXG4gICAqL1xuICBwdWJsaWMgZm9ybWF0U3RhY2tEaWZmKG9wdGlvbnM6IEZvcm1hdFN0YWNrRGlmZk9wdGlvbnMgPSB7fSk6IEZvcm1hdFN0YWNrRGlmZk91dHB1dCB7XG4gICAgY29uc3QgaW9EZWZhdWx0SGVscGVyID0gbmV3IElvRGVmYXVsdE1lc3NhZ2VzKHRoaXMuaW9IZWxwZXIpO1xuICAgIHJldHVybiB0aGlzLmZvcm1hdFN0YWNrRGlmZkhlbHBlcihcbiAgICAgIHRoaXMub2xkVGVtcGxhdGUsXG4gICAgICB0aGlzLnN0YWNrTmFtZSxcbiAgICAgIHRoaXMubmVzdGVkU3RhY2tzLFxuICAgICAge1xuICAgICAgICAuLi5vcHRpb25zLFxuICAgICAgICBpb0RlZmF1bHRIZWxwZXIsXG4gICAgICB9LFxuICAgICk7XG4gIH1cblxuICBwcml2YXRlIGZvcm1hdFN0YWNrRGlmZkhlbHBlcihcbiAgICBvbGRUZW1wbGF0ZTogYW55LFxuICAgIHN0YWNrTmFtZTogc3RyaW5nLFxuICAgIG5lc3RlZFN0YWNrVGVtcGxhdGVzOiB7IFtuZXN0ZWRTdGFja0xvZ2ljYWxJZDogc3RyaW5nXTogTmVzdGVkU3RhY2tUZW1wbGF0ZXMgfSB8IHVuZGVmaW5lZCxcbiAgICBvcHRpb25zOiBSZXVzYWJsZVN0YWNrRGlmZk9wdGlvbnMsXG4gICkge1xuICAgIGxldCBkaWZmID0gdGhpcy5kaWZmKHN0YWNrTmFtZSwgb2xkVGVtcGxhdGUpO1xuXG4gICAgLy8gVGhlIHN0YWNrIGRpZmYgaXMgZm9ybWF0dGVkIHZpYSBgRm9ybWF0dGVyYCwgd2hpY2ggdGFrZXMgaW4gYSBzdHJlYW1cbiAgICAvLyBhbmQgc2VuZHMgaXRzIG91dHB1dCBkaXJlY3RseSB0byB0aGF0IHN0cmVhbS4gVG8gZmFjaWxpYXRlIHVzZSBvZiB0aGVcbiAgICAvLyBnbG9iYWwgQ2xpSW9Ib3N0LCB3ZSBjcmVhdGUgb3VyIG93biBzdHJlYW0gdG8gY2FwdHVyZSB0aGUgb3V0cHV0IG9mXG4gICAgLy8gYEZvcm1hdHRlcmAgYW5kIHJldHVybiB0aGUgb3V0cHV0IGFzIGEgc3RyaW5nIGZvciB0aGUgY29uc3VtZXIgb2ZcbiAgICAvLyBgZm9ybWF0U3RhY2tEaWZmYCB0byBkZWNpZGUgd2hhdCB0byBkbyB3aXRoIGl0LlxuICAgIGNvbnN0IHN0cmVhbSA9IG5ldyBTdHJpbmdXcml0ZVN0cmVhbSgpO1xuXG4gICAgbGV0IG51bVN0YWNrc1dpdGhDaGFuZ2VzID0gMDtcbiAgICBsZXQgZm9ybWF0dGVkRGlmZiA9ICcnO1xuICAgIGxldCBmaWx0ZXJlZENoYW5nZXNDb3VudCA9IDA7XG4gICAgdHJ5IHtcbiAgICAgIC8vIG11c3Qgb3V0cHV0IHRoZSBzdGFjayBuYW1lIGlmIHRoZXJlIGFyZSBkaWZmZXJlbmNlcywgZXZlbiBpZiBxdWlldFxuICAgICAgaWYgKHN0YWNrTmFtZSAmJiAoIW9wdGlvbnMucXVpZXQgfHwgIWRpZmYuaXNFbXB0eSkpIHtcbiAgICAgICAgc3RyZWFtLndyaXRlKGZvcm1hdChgU3RhY2sgJHtjaGFsay5ib2xkKHN0YWNrTmFtZSl9XFxuYCkpO1xuICAgICAgfVxuXG4gICAgICBpZiAoIW9wdGlvbnMucXVpZXQgJiYgdGhpcy5pc0ltcG9ydCkge1xuICAgICAgICBzdHJlYW0ud3JpdGUoJ1BhcmFtZXRlcnMgYW5kIHJ1bGVzIGNyZWF0ZWQgZHVyaW5nIG1pZ3JhdGlvbiBkbyBub3QgYWZmZWN0IHJlc291cmNlIGNvbmZpZ3VyYXRpb24uXFxuJyk7XG4gICAgICB9XG5cbiAgICAgIC8vIGRldGVjdCBhbmQgZmlsdGVyIG91dCBtYW5nbGVkIGNoYXJhY3RlcnMgZnJvbSB0aGUgZGlmZlxuICAgICAgaWYgKGRpZmYuZGlmZmVyZW5jZUNvdW50ICYmICFvcHRpb25zLnN0cmljdCkge1xuICAgICAgICBjb25zdCBtYW5nbGVkTmV3VGVtcGxhdGUgPSBKU09OLnBhcnNlKG1hbmdsZUxpa2VDbG91ZEZvcm1hdGlvbihKU09OLnN0cmluZ2lmeSh0aGlzLm5ld1RlbXBsYXRlLnRlbXBsYXRlKSkpO1xuICAgICAgICBjb25zdCBtYW5nbGVkRGlmZiA9IGZ1bGxEaWZmKHRoaXMub2xkVGVtcGxhdGUsIG1hbmdsZWROZXdUZW1wbGF0ZSwgdGhpcy5jaGFuZ2VTZXQpO1xuICAgICAgICBmaWx0ZXJlZENoYW5nZXNDb3VudCA9IE1hdGgubWF4KDAsIGRpZmYuZGlmZmVyZW5jZUNvdW50IC0gbWFuZ2xlZERpZmYuZGlmZmVyZW5jZUNvdW50KTtcbiAgICAgICAgaWYgKGZpbHRlcmVkQ2hhbmdlc0NvdW50ID4gMCkge1xuICAgICAgICAgIGRpZmYgPSBtYW5nbGVkRGlmZjtcbiAgICAgICAgfVxuICAgICAgfVxuXG4gICAgICAvLyBmaWx0ZXIgb3V0ICdBV1M6OkNESzo6TWV0YWRhdGEnIHJlc291cmNlcyBmcm9tIHRoZSB0ZW1wbGF0ZVxuICAgICAgLy8gZmlsdGVyIG91dCAnQ2hlY2tCb290c3RyYXBWZXJzaW9uJyBydWxlcyBmcm9tIHRoZSB0ZW1wbGF0ZVxuICAgICAgaWYgKCFvcHRpb25zLnN0cmljdCkge1xuICAgICAgICBvYnNjdXJlRGlmZihkaWZmKTtcbiAgICAgIH1cblxuICAgICAgaWYgKCFkaWZmLmlzRW1wdHkpIHtcbiAgICAgICAgbnVtU3RhY2tzV2l0aENoYW5nZXMrKztcblxuICAgICAgICAvLyBmb3JtYXREaWZmZXJlbmNlcyB1cGRhdGVzIHRoZSBzdHJlYW0gd2l0aCB0aGUgZm9ybWF0dGVkIHN0YWNrIGRpZmZcbiAgICAgICAgZm9ybWF0RGlmZmVyZW5jZXMoc3RyZWFtLCBkaWZmLCB7XG4gICAgICAgICAgLi4ubG9naWNhbElkTWFwRnJvbVRlbXBsYXRlKHRoaXMub2xkVGVtcGxhdGUpLFxuICAgICAgICAgIC4uLmJ1aWxkTG9naWNhbFRvUGF0aE1hcCh0aGlzLm5ld1RlbXBsYXRlKSxcbiAgICAgICAgfSwgb3B0aW9ucy5jb250ZXh0KTtcbiAgICAgIH0gZWxzZSBpZiAoIW9wdGlvbnMucXVpZXQpIHtcbiAgICAgICAgc3RyZWFtLndyaXRlKGNoYWxrLmdyZWVuKCdUaGVyZSB3ZXJlIG5vIGRpZmZlcmVuY2VzXFxuJykpO1xuICAgICAgfVxuXG4gICAgICBpZiAoZmlsdGVyZWRDaGFuZ2VzQ291bnQgPiAwKSB7XG4gICAgICAgIHN0cmVhbS53cml0ZShjaGFsay55ZWxsb3coYE9taXR0ZWQgJHtmaWx0ZXJlZENoYW5nZXNDb3VudH0gY2hhbmdlcyBiZWNhdXNlIHRoZXkgYXJlIGxpa2VseSBtYW5nbGVkIG5vbi1BU0NJSSBjaGFyYWN0ZXJzLiBVc2UgLS1zdHJpY3QgdG8gcHJpbnQgdGhlbS5cXG5gKSk7XG4gICAgICB9XG4gICAgfSBmaW5hbGx5IHtcbiAgICAgIC8vIHN0b3JlIHRoZSBzdHJlYW0gY29udGFpbmluZyBhIGZvcm1hdHRlZCBzdGFjayBkaWZmXG4gICAgICBmb3JtYXR0ZWREaWZmID0gc3RyZWFtLnRvU3RyaW5nKCk7XG4gICAgICBzdHJlYW0uZW5kKCk7XG4gICAgfVxuXG4gICAgZm9yIChjb25zdCBuZXN0ZWRTdGFja0xvZ2ljYWxJZCBvZiBPYmplY3Qua2V5cyhuZXN0ZWRTdGFja1RlbXBsYXRlcyA/PyB7fSkpIHtcbiAgICAgIGlmICghbmVzdGVkU3RhY2tUZW1wbGF0ZXMpIHtcbiAgICAgICAgYnJlYWs7XG4gICAgICB9XG4gICAgICBjb25zdCBuZXN0ZWRTdGFjayA9IG5lc3RlZFN0YWNrVGVtcGxhdGVzW25lc3RlZFN0YWNrTG9naWNhbElkXTtcblxuICAgICAgKHRoaXMubmV3VGVtcGxhdGUgYXMgYW55KS5fdGVtcGxhdGUgPSBuZXN0ZWRTdGFjay5nZW5lcmF0ZWRUZW1wbGF0ZTtcbiAgICAgIGNvbnN0IG5leHREaWZmID0gdGhpcy5mb3JtYXRTdGFja0RpZmZIZWxwZXIoXG4gICAgICAgIG5lc3RlZFN0YWNrLmRlcGxveWVkVGVtcGxhdGUsXG4gICAgICAgIG5lc3RlZFN0YWNrLnBoeXNpY2FsTmFtZSA/PyBuZXN0ZWRTdGFja0xvZ2ljYWxJZCxcbiAgICAgICAgbmVzdGVkU3RhY2submVzdGVkU3RhY2tUZW1wbGF0ZXMsXG4gICAgICAgIG9wdGlvbnMsXG4gICAgICApO1xuICAgICAgbnVtU3RhY2tzV2l0aENoYW5nZXMgKz0gbmV4dERpZmYubnVtU3RhY2tzV2l0aENoYW5nZXM7XG4gICAgICBmb3JtYXR0ZWREaWZmICs9IG5leHREaWZmLmZvcm1hdHRlZERpZmY7XG4gICAgfVxuXG4gICAgcmV0dXJuIHtcbiAgICAgIG51bVN0YWNrc1dpdGhDaGFuZ2VzLFxuICAgICAgZm9ybWF0dGVkRGlmZixcbiAgICB9O1xuICB9XG5cbiAgLyoqXG4gICAqIEZvcm1hdCB0aGUgc2VjdXJpdHkgZGlmZlxuICAgKi9cbiAgcHVibGljIGZvcm1hdFNlY3VyaXR5RGlmZigpOiBGb3JtYXRTZWN1cml0eURpZmZPdXRwdXQge1xuICAgIGNvbnN0IGRpZmYgPSB0aGlzLmRpZmYoKTtcblxuICAgIC8vIFRoZSBzZWN1cml0eSBkaWZmIGlzIGZvcm1hdHRlZCB2aWEgYEZvcm1hdHRlcmAsIHdoaWNoIHRha2VzIGluIGEgc3RyZWFtXG4gICAgLy8gYW5kIHNlbmRzIGl0cyBvdXRwdXQgZGlyZWN0bHkgdG8gdGhhdCBzdHJlYW0uIFRvIGZhY2lsaWF0ZSB1c2Ugb2YgdGhlXG4gICAgLy8gZ2xvYmFsIENsaUlvSG9zdCwgd2UgY3JlYXRlIG91ciBvd24gc3RyZWFtIHRvIGNhcHR1cmUgdGhlIG91dHB1dCBvZlxuICAgIC8vIGBGb3JtYXR0ZXJgIGFuZCByZXR1cm4gdGhlIG91dHB1dCBhcyBhIHN0cmluZyBmb3IgdGhlIGNvbnN1bWVyIG9mXG4gICAgLy8gYGZvcm1hdFNlY3VyaXR5RGlmZmAgdG8gZGVjaWRlIHdoYXQgdG8gZG8gd2l0aCBpdC5cbiAgICBjb25zdCBzdHJlYW0gPSBuZXcgU3RyaW5nV3JpdGVTdHJlYW0oKTtcblxuICAgIHN0cmVhbS53cml0ZShmb3JtYXQoYFN0YWNrICR7Y2hhbGsuYm9sZCh0aGlzLnN0YWNrTmFtZSl9XFxuYCkpO1xuXG4gICAgdHJ5IHtcbiAgICAgIC8vIGZvcm1hdFNlY3VyaXR5Q2hhbmdlcyB1cGRhdGVzIHRoZSBzdHJlYW0gd2l0aCB0aGUgZm9ybWF0dGVkIHNlY3VyaXR5IGRpZmZcbiAgICAgIGZvcm1hdFNlY3VyaXR5Q2hhbmdlcyhzdHJlYW0sIGRpZmYsIGJ1aWxkTG9naWNhbFRvUGF0aE1hcCh0aGlzLm5ld1RlbXBsYXRlKSk7XG4gICAgfSBmaW5hbGx5IHtcbiAgICAgIHN0cmVhbS5lbmQoKTtcbiAgICB9XG4gICAgLy8gc3RvcmUgdGhlIHN0cmVhbSBjb250YWluaW5nIGEgZm9ybWF0dGVkIHN0YWNrIGRpZmZcbiAgICBjb25zdCBmb3JtYXR0ZWREaWZmID0gc3RyZWFtLnRvU3RyaW5nKCk7XG4gICAgcmV0dXJuIHsgZm9ybWF0dGVkRGlmZiwgcGVybWlzc2lvbkNoYW5nZVR5cGU6IHRoaXMucGVybWlzc2lvblR5cGUoKSB9O1xuICB9XG59XG5cbmZ1bmN0aW9uIGJ1aWxkTG9naWNhbFRvUGF0aE1hcChzdGFjazogY3hhcGkuQ2xvdWRGb3JtYXRpb25TdGFja0FydGlmYWN0KSB7XG4gIGNvbnN0IG1hcDogeyBbaWQ6IHN0cmluZ106IHN0cmluZyB9ID0ge307XG4gIGZvciAoY29uc3QgbWQgb2Ygc3RhY2suZmluZE1ldGFkYXRhQnlUeXBlKGN4c2NoZW1hLkFydGlmYWN0TWV0YWRhdGFFbnRyeVR5cGUuTE9HSUNBTF9JRCkpIHtcbiAgICBtYXBbbWQuZGF0YSBhcyBzdHJpbmddID0gbWQucGF0aDtcbiAgfVxuICByZXR1cm4gbWFwO1xufVxuXG5mdW5jdGlvbiBsb2dpY2FsSWRNYXBGcm9tVGVtcGxhdGUodGVtcGxhdGU6IGFueSkge1xuICBjb25zdCByZXQ6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7fTtcblxuICBmb3IgKGNvbnN0IFtsb2dpY2FsSWQsIHJlc291cmNlXSBvZiBPYmplY3QuZW50cmllcyh0ZW1wbGF0ZS5SZXNvdXJjZXMgPz8ge30pKSB7XG4gICAgY29uc3QgcGF0aCA9IChyZXNvdXJjZSBhcyBhbnkpPy5NZXRhZGF0YT8uWydhd3M6Y2RrOnBhdGgnXTtcbiAgICBpZiAocGF0aCkge1xuICAgICAgcmV0W2xvZ2ljYWxJZF0gPSBwYXRoO1xuICAgIH1cbiAgfVxuICByZXR1cm4gcmV0O1xufVxuXG4vKipcbiAqIFJlbW92ZSBhbnkgdGVtcGxhdGUgZWxlbWVudHMgdGhhdCB3ZSBkb24ndCB3YW50IHRvIHNob3cgdXNlcnMuXG4gKiBUaGlzIGlzIGN1cnJlbnRseTpcbiAqIC0gQVdTOjpDREs6Ok1ldGFkYXRhIHJlc291cmNlXG4gKiAtIENoZWNrQm9vdHN0cmFwVmVyc2lvbiBSdWxlXG4gKi9cbmZ1bmN0aW9uIG9ic2N1cmVEaWZmKGRpZmY6IFRlbXBsYXRlRGlmZikge1xuICBpZiAoZGlmZi51bmtub3duKSB7XG4gICAgLy8gc2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9hd3MvYXdzLWNkay9pc3N1ZXMvMTc5NDJcbiAgICBkaWZmLnVua25vd24gPSBkaWZmLnVua25vd24uZmlsdGVyKGNoYW5nZSA9PiB7XG4gICAgICBpZiAoIWNoYW5nZSkge1xuICAgICAgICByZXR1cm4gdHJ1ZTtcbiAgICAgIH1cbiAgICAgIGlmIChjaGFuZ2UubmV3VmFsdWU/LkNoZWNrQm9vdHN0cmFwVmVyc2lvbikge1xuICAgICAgICByZXR1cm4gZmFsc2U7XG4gICAgICB9XG4gICAgICBpZiAoY2hhbmdlLm9sZFZhbHVlPy5DaGVja0Jvb3RzdHJhcFZlcnNpb24pIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgICAgfVxuICAgICAgcmV0dXJuIHRydWU7XG4gICAgfSk7XG4gIH1cblxuICBpZiAoZGlmZi5yZXNvdXJjZXMpIHtcbiAgICBkaWZmLnJlc291cmNlcyA9IGRpZmYucmVzb3VyY2VzLmZpbHRlcihjaGFuZ2UgPT4ge1xuICAgICAgaWYgKCFjaGFuZ2UpIHtcbiAgICAgICAgcmV0dXJuIHRydWU7XG4gICAgICB9XG4gICAgICBpZiAoY2hhbmdlLm5ld1Jlc291cmNlVHlwZSA9PT0gJ0FXUzo6Q0RLOjpNZXRhZGF0YScpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgICAgfVxuICAgICAgaWYgKGNoYW5nZS5vbGRSZXNvdXJjZVR5cGUgPT09ICdBV1M6OkNESzo6TWV0YWRhdGEnKSB7XG4gICAgICAgIHJldHVybiBmYWxzZTtcbiAgICAgIH1cbiAgICAgIHJldHVybiB0cnVlO1xuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/api/diff/index.d.ts

@@ -0,0 +1 @@
+export * from './diff-formatter';

package/lib/api/diff/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./diff-formatter"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsbURBQWlDIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9kaWZmLWZvcm1hdHRlcic7XG4iXX0=

package/lib/api/environment/environment-access.d.ts

@@ -0,0 +1,139 @@
+import type * as cxapi from '@aws-cdk/cx-api';
+import type { EnvironmentResources } from './environment-resources';
+import type { StringWithoutPlaceholders } from './placeholders';
+import type { SDK, SdkProvider } from '../aws-auth/private';
+import { type IoHelper } from '../io/private';
+/**
+ * Access particular AWS resources, based on information from the CX manifest
+ *
+ * It is not possible to grab direct access to AWS credentials; 9 times out of 10
+ * we have to allow for role assumption, and role assumption can only work if
+ * there is a CX Manifest that contains a role ARN.
+ *
+ * This class exists so new code isn't tempted to go and get SDK credentials directly.
+ */
+export declare class EnvironmentAccess {
+    private readonly sdkProvider;
+    private readonly sdkCache;
+    private readonly environmentResources;
+    private readonly ioHelper;
+    constructor(sdkProvider: SdkProvider, toolkitStackName: string, ioHelper: IoHelper);
+    /**
+     * Resolves the environment for a stack.
+     */
+    resolveStackEnvironment(stack: cxapi.CloudFormationStackArtifact): Promise<cxapi.Environment>;
+    /**
+     * Get an SDK to access the given stack's environment for stack operations
+     *
+     * Will ask plugins for readonly credentials if available, use the default
+     * AWS credentials if not.
+     *
+     * Will assume the deploy role if configured on the stack. Check the default `deploy-role`
+     * policies to see what you can do with this role.
+     */
+    accessStackForReadOnlyStackOperations(stack: cxapi.CloudFormationStackArtifact): Promise<TargetEnvironment>;
+    /**
+     * Get an SDK to access the given stack's environment for stack operations
+     *
+     * Will ask plugins for mutating credentials if available, use the default AWS
+     * credentials if not.  The `mode` parameter is only used for querying
+     * plugins.
+     *
+     * Will assume the deploy role if configured on the stack. Check the default `deploy-role`
+     * policies to see what you can do with this role.
+     */
+    accessStackForMutableStackOperations(stack: cxapi.CloudFormationStackArtifact): Promise<TargetEnvironment>;
+    /**
+     * Get an SDK to access the given stack's environment for environmental lookups
+     *
+     * Will use a plugin if available, use the default AWS credentials if not.
+     * The `mode` parameter is only used for querying plugins.
+     *
+     * Will assume the lookup role if configured on the stack. Check the default `lookup-role`
+     * policies to see what you can do with this role. It can generally read everything
+     * in the account that does not require KMS access.
+     *
+     * ---
+     *
+     * For backwards compatibility reasons, there are some scenarios that are handled here:
+     *
+     *  1. The lookup role may not exist (it was added in bootstrap stack version 7). If so:
+     *     a. Return the default credentials if the default credentials are for the stack account
+     *        (you will notice this as `isFallbackCredentials=true`).
+     *     b. Throw an error if the default credentials are not for the stack account.
+     *
+     *  2. The lookup role may not have the correct permissions (for example, ReadOnlyAccess was added in
+     *     bootstrap stack version 8); the stack will have a minimum version number on it.
+     *     a. If it does not we throw an error which should be handled in the calling
+     *        function (and fallback to use a different role, etc)
+     *
+     * Upon success, caller will have an SDK for the right account, which may or may not have
+     * the right permissions.
+     */
+    accessStackForLookup(stack: cxapi.CloudFormationStackArtifact): Promise<TargetEnvironment>;
+    /**
+     * Get an SDK to access the given stack's environment for reading stack attributes
+     *
+     * Will use a plugin if available, use the default AWS credentials if not.
+     * The `mode` parameter is only used for querying plugins.
+     *
+     * Will try to assume the lookup role if given, will use the regular stack operations
+     * access (deploy-role) otherwise. When calling this, you should assume that you will get
+     * the least privileged role, so don't try to use it for anything the `deploy-role`
+     * wouldn't be able to do. Also you cannot rely on being able to read encrypted anything.
+     */
+    accessStackForLookupBestEffort(stack: cxapi.CloudFormationStackArtifact): Promise<TargetEnvironment>;
+    /**
+     * Get an SDK to access the given stack's environment for stack operations
+     *
+     * Will use a plugin if available, use the default AWS credentials if not.
+     * The `mode` parameter is only used for querying plugins.
+     *
+     * Will assume the deploy role if configured on the stack. Check the default `deploy-role`
+     * policies to see what you can do with this role.
+     */
+    private accessStackForStackOperations;
+    /**
+     * Prepare an SDK for use in the given environment and optionally with a role assumed.
+     */
+    private prepareSdk;
+    private cachedSdkForEnvironment;
+}
+/**
+ * SDK obtained by assuming the deploy role
+ * for a given environment
+ */
+export interface TargetEnvironment {
+    /**
+     * The SDK for the given environment
+     */
+    readonly sdk: SDK;
+    /**
+     * The resolved environment for the stack
+     * (no more 'unknown-account/unknown-region')
+     */
+    readonly resolvedEnvironment: cxapi.Environment;
+    /**
+     * Access class for environmental resources to help the deployment
+     */
+    readonly resources: EnvironmentResources;
+    /**
+     * Whether or not we assumed a role in the process of getting these credentials
+     */
+    readonly didAssumeRole: boolean;
+    /**
+     * Whether or not these are fallback credentials
+     *
+     * Fallback credentials means that assuming the intended role failed, but the
+     * base credentials happen to be for the right account so we just picked those
+     * and hope the future SDK calls succeed.
+     *
+     * This is a backwards compatibility mechanism from around the time we introduced
+     * deployment roles.
+     */
+    readonly isFallbackCredentials: boolean;
+    /**
+     * Replace environment placeholders according to the current environment
+     */
+    replacePlaceholders(x: string | undefined): Promise<StringWithoutPlaceholders | undefined>;
+}