@dbx-tools/auth 0.9.31 → 0.9.32

package/src/lifecycle.ts

@@ -16,9 +16,9 @@ export class TokenLifecycle {
     logger.debug("created authentication lifecycle", {
       credential: credentialId(key),
       storage: store.name(),
-      refreshBufferSeconds: options.refreshBufferSeconds,
-      lockTimeoutSeconds: options.lockTimeoutSeconds,
-      loginTimeoutSeconds: options.loginTimeoutSeconds,
+      refreshBufferMs: options.refreshBufferMs,
+      lockTimeoutMs: options.lockTimeoutMs,
+      loginTimeoutMs: options.loginTimeoutMs,
       silentProvider: provider.canAuthenticateSilently(),
     });
   }
@@ -32,7 +32,7 @@ export class TokenLifecycle {
     return this.withLock(async () => {
       await this.store.prepareWrite();
       const token = validateToken(
-        await this.provider.login(this.options.loginTimeoutSeconds * 1000),
+        await this.provider.login(this.options.loginTimeoutMs),
       );
       await this.store.save(this.key, token);
       logger.debug("interactive login stored credential", {
@@ -137,7 +137,7 @@ export class TokenLifecycle {
         });
         if (!login) throw error;
         logger.debug("falling back to interactive login", this.context());
-        token = await this.provider.login(this.options.loginTimeoutSeconds * 1000);
+        token = await this.provider.login(this.options.loginTimeoutMs);
       }
     } else if (this.provider.canAuthenticateSilently()) {
       logger.debug("attempting silent credential acquisition", {
@@ -145,7 +145,7 @@ export class TokenLifecycle {
         loginFallback: login,
       });
       try {
-        token = await this.provider.authenticate(this.options.loginTimeoutSeconds * 1000);
+        token = await this.provider.authenticate(this.options.loginTimeoutMs);
       } catch (error) {
         logger.debug("silent credential acquisition failed", {
           ...this.context(),
@@ -154,11 +154,11 @@ export class TokenLifecycle {
         });
         if (!login) throw error;
         logger.debug("falling back to interactive login", this.context());
-        token = await this.provider.login(this.options.loginTimeoutSeconds * 1000);
+        token = await this.provider.login(this.options.loginTimeoutMs);
       }
     } else if (login) {
       logger.debug("provider requires interactive login", this.context());
-      token = await this.provider.login(this.options.loginTimeoutSeconds * 1000);
+      token = await this.provider.login(this.options.loginTimeoutMs);
     } else {
       throw new AuthError(
         "oauth",
@@ -180,13 +180,17 @@ export class TokenLifecycle {
     if (!isValid(token, this.now())) return false;
     if (!token.expiry) return true;
     return (
-      Date.parse(token.expiry) - this.now().getTime() > this.options.refreshBufferSeconds * 1000
+      Date.parse(token.expiry) - this.now().getTime() > this.options.refreshBufferMs
     );
   }
 
   private async withLock<T>(action: () => Promise<T>): Promise<T> {
     logger.debug("waiting for credential lock", this.context());
-    const lease = await this.store.acquireLock(this.key, this.options.lockTimeoutSeconds * 1000);
+    // Omit the timeout (wait indefinitely) unless a positive cap is configured.
+    // The holder may run for minutes; the caller owns the overall request budget
+    // and the lock is always released when `action` settles (success or error).
+    const lockTimeoutMs = this.options.lockTimeoutMs > 0 ? this.options.lockTimeoutMs : undefined;
+    const lease = await this.store.acquireLock(this.key, lockTimeoutMs);
     logger.debug("credential lock acquired", this.context());
     let failure: unknown;
     try {

package/src/storage.ts

@@ -3,44 +3,94 @@ import type { CredentialStore, LockAdapter, Token } from "./types.ts";
 
 const logger = authLogger("memory-storage");
 
-/** Process-local generic lease registry used by the in-memory store. */
+/** One queued waiter for a held key: resolved when promoted, rejected on timeout. */
+interface MemoryLockWaiter {
+  resolve: (lease: string) => void;
+  reject: (error: unknown) => void;
+}
+
+/**
+ * A key's current owner lease plus its FIFO queue of waiters.
+ *
+ * Owner and queue live in one entry so the key is never half-present: it is
+ * dropped only when it is both unowned and unwanted. A waiter that times out
+ * removes only itself from `queue` and never disturbs `lease`, so a timed-out
+ * waiter can no longer let a later caller bypass the active holder.
+ */
+interface MemoryLockState {
+  lease: string;
+  queue: MemoryLockWaiter[];
+}
+
+/**
+ * Process-local keyed mutex used by the in-memory store.
+ *
+ * Modeled on `@dbx-tools/core`'s `withProcessLock` coordinator: one holder per
+ * key, the rest queue in arrival order, distinct keys proceed concurrently.
+ * Waiting is purely promise-based, so a waiter never blocks the event loop and,
+ * by default, waits indefinitely - a holder may legitimately run for minutes
+ * (e.g. an interactive `databricks auth login` that opens a browser). A finite
+ * `timeoutMs` is opt-in for callers that prefer to fail fast.
+ */
 export class MemoryLockAdapter implements LockAdapter {
-  readonly #tails = new Map<string, Promise<void>>();
-  readonly #leases = new Map<string, () => void>();
+  readonly #states = new Map<string, MemoryLockState>();
   #sequence = 0;
 
-  async acquire(key: string, timeoutMs: number): Promise<string> {
+  acquire(key: string, timeoutMs?: number): Promise<string> {
     const credential = credentialId(key);
-    const previous = this.#tails.get(key) ?? Promise.resolve();
-    let release!: () => void;
-    const current = new Promise<void>((resolve) => {
-      release = resolve;
-    });
-    const tail = previous.then(() => current);
-    this.#tails.set(key, tail);
-    try {
-      logger.debug("waiting for memory lock", { credential, timeoutMs });
-      await withTimeout(previous, timeoutMs, `Timed out waiting for lock ${key}`);
-    } catch (error) {
-      release();
-      if (this.#tails.get(key) === tail) this.#tails.delete(key);
-      throw error;
+    const state = this.#states.get(key);
+    if (!state) {
+      const lease = this.#nextLease(key);
+      this.#states.set(key, { lease, queue: [] });
+      logger.debug("memory lock acquired", { credential });
+      return Promise.resolve(lease);
     }
-    const lease = `${++this.#sequence}:${key}`;
-    this.#leases.set(lease, () => {
-      release();
-      this.#leases.delete(lease);
-      if (this.#tails.get(key) === tail) this.#tails.delete(key);
+    logger.debug("waiting for memory lock", { credential, timeoutMs });
+    return new Promise<string>((resolve, reject) => {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const waiter: MemoryLockWaiter = {
+        resolve: (lease) => {
+          if (timer) clearTimeout(timer);
+          logger.debug("memory lock acquired", { credential });
+          resolve(lease);
+        },
+        reject: (error) => {
+          if (timer) clearTimeout(timer);
+          reject(error);
+        },
+      };
+      state.queue.push(waiter);
+      // A timer is created only for a finite positive budget. Omitted, Infinity,
+      // or non-positive all mean "wait forever" - no timer to leak or fire.
+      if (timeoutMs !== undefined && Number.isFinite(timeoutMs) && timeoutMs > 0) {
+        timer = setTimeout(() => {
+          const index = state.queue.indexOf(waiter);
+          if (index >= 0) state.queue.splice(index, 1);
+          waiter.reject(new Error(`Timed out waiting for lock ${key}`));
+        }, timeoutMs);
+      }
     });
-    logger.debug("memory lock acquired", { credential });
-    return lease;
   }
 
-  async release(lease: string): Promise<void> {
-    logger.debug("releasing memory lock", {
-      credential: credentialId(lease.split(":").slice(1).join(":")),
-    });
-    this.#leases.get(lease)?.();
+  release(lease: string): Promise<void> {
+    const key = lease.split(":").slice(1).join(":");
+    logger.debug("releasing memory lock", { credential: credentialId(key) });
+    const state = this.#states.get(key);
+    // Ignore a stale release from anyone who no longer owns the key (a timed-out
+    // or superseded lease). Honoring it would revoke the lock from the holder.
+    if (!state || state.lease !== lease) return Promise.resolve();
+    const next = state.queue.shift();
+    if (!next) {
+      this.#states.delete(key);
+      return Promise.resolve();
+    }
+    state.lease = this.#nextLease(key);
+    next.resolve(state.lease);
+    return Promise.resolve();
+  }
+
+  #nextLease(key: string): string {
+    return `${++this.#sequence}:${key}`;
   }
 }
 
@@ -74,7 +124,7 @@ export class MemoryCredentialStore implements CredentialStore {
     logger.debug("removed memory credential", { credential: credentialId(key) });
   }
 
-  acquireLock(key: string, timeoutMs: number): Promise<string> {
+  acquireLock(key: string, timeoutMs?: number): Promise<string> {
     return this.locks.acquire(key, timeoutMs);
   }
 
@@ -86,19 +136,3 @@ export class MemoryCredentialStore implements CredentialStore {
     return "memory";
   }
 }
-
-async function withTimeout<T>(promise: Promise<T>, timeoutMs: number, message: string): Promise<T> {
-  if (!Number.isFinite(timeoutMs) || timeoutMs < 0)
-    throw new TypeError("timeoutMs must be non-negative");
-  let timeout: ReturnType<typeof setTimeout> | undefined;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise<never>((_, reject) => {
-        timeout = setTimeout(() => reject(new Error(message)), timeoutMs);
-      }),
-    ]);
-  } finally {
-    if (timeout) clearTimeout(timeout);
-  }
-}

package/src/types.ts

@@ -44,17 +44,24 @@ export interface AccessToken {
   scopes: string[];
 }
 
-/** Shared lifecycle configuration embedded by every provider. */
+/** Shared lifecycle configuration embedded by every provider. All times in milliseconds. */
 export interface AuthOptions {
-  refreshBufferSeconds: number;
-  lockTimeoutSeconds: number;
-  loginTimeoutSeconds: number;
+  refreshBufferMs: number;
+  /**
+   * Opt-in cap, in milliseconds, on waiting to acquire the per-credential
+   * refresh lock. `0` (the default) means wait indefinitely: a holder may
+   * legitimately run for minutes (an interactive login that opens a browser),
+   * and the caller owns the overall request budget. Set a positive value to
+   * fail fast instead.
+   */
+  lockTimeoutMs: number;
+  loginTimeoutMs: number;
 }
 
 const AUTH_DEFAULTS: AuthOptions = {
-  refreshBufferSeconds: 300,
-  lockTimeoutSeconds: 30,
-  loginTimeoutSeconds: 900,
+  refreshBufferMs: 300_000,
+  lockTimeoutMs: 0,
+  loginTimeoutMs: 900_000,
 };
 
 /** Record-style factory retained for straightforward Node/Python bridging. */
@@ -131,7 +138,8 @@ export interface DatabricksProfile extends DatabricksProfileSummary {
 
 /** Cross-language lease adapter; implementations may use files, databases, or FFI. */
 export interface LockAdapter {
-  acquire(key: string, timeoutMs: number): Promise<string>;
+  /** Acquire the key's lease. Omit `timeoutMs` (or pass `0`) to wait indefinitely. */
+  acquire(key: string, timeoutMs?: number): Promise<string>;
   release(lease: string): Promise<void>;
 }
 
@@ -141,7 +149,7 @@ export interface CredentialStore {
   prepareWrite(): Promise<void>;
   save(key: string, token: Token): Promise<void>;
   remove(key: string): Promise<void>;
-  acquireLock(key: string, timeoutMs: number): Promise<string>;
+  acquireLock(key: string, timeoutMs?: number): Promise<string>;
   releaseLock(lease: string): Promise<void>;
   name(): string;
 }

package/lib/src/node-storage.js

@@ -1,207 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
-import { acquireFileLock } from "@dbx-tools/core/file-lock";
-import { authLogger, credentialId, tokenMetadata } from "./_logging.js";
-import { AuthError } from "./errors.js";
-import { FileLayout } from "./types.js";
-const logger = authLogger("file-storage");
-class NodeFileLocks {
-    lockDirectory;
-    leases = new Map();
-    constructor(lockDirectory) {
-        this.lockDirectory = lockDirectory;
-    }
-    async acquire(key, timeoutMs) {
-        logger.debug("waiting for file lock", {
-            credential: credentialId(key),
-            timeoutMs,
-        });
-        const lease = await acquireFileLock(key, { dir: this.lockDirectory, timeoutMs });
-        const id = randomUUID();
-        this.leases.set(id, lease);
-        logger.debug("file lock acquired", {
-            credential: credentialId(key),
-            backend: lease.backend,
-        });
-        return id;
-    }
-    async release(id) {
-        const lease = this.leases.get(id);
-        if (!lease)
-            return;
-        this.leases.delete(id);
-        await lease.release();
-        logger.debug("file lock released", { backend: lease.backend });
-    }
-}
-/** File-backed credential store preserving unrelated Databricks CLI entries. */
-export class FileCredentialStore {
-    root;
-    layout;
-    locks;
-    constructor(root = join(homedir(), ".databricks"), layout = FileLayout.Single, locks) {
-        this.root = root;
-        this.layout = layout;
-        this.locks = locks ?? new NodeFileLocks(join(root, "locks"));
-    }
-    async load(key) {
-        const store = this.forKey(key);
-        return store.withCacheLock(async () => {
-            const token = deserializeToken((await store.readCache()).tokens[key]);
-            logger.debug("loaded file credential", {
-                credential: credentialId(key),
-                layout: this.layout,
-                token: tokenMetadata(token),
-            });
-            return token;
-        });
-    }
-    async prepareWrite() {
-        await ensureDirectory(this.root, 0o700);
-        logger.debug("prepared credential directory", { layout: this.layout });
-    }
-    async save(key, token) {
-        const store = this.forKey(key);
-        await store.withCacheLock(async () => {
-            const cache = await store.readCache();
-            cache.tokens[key] = serializeToken(token);
-            await store.writeCache(cache);
-            logger.debug("saved file credential", {
-                credential: credentialId(key),
-                layout: this.layout,
-                token: tokenMetadata(token),
-            });
-        });
-    }
-    async remove(key) {
-        const store = this.forKey(key);
-        await store.withCacheLock(async () => {
-            const cache = await store.readCache();
-            delete cache.tokens[key];
-            await store.writeCache(cache);
-            logger.debug("removed file credential", {
-                credential: credentialId(key),
-                layout: this.layout,
-            });
-        });
-    }
-    acquireLock(key, timeoutMs) {
-        return this.locks.acquire(this.layout === FileLayout.Single ? `${this.root}:refresh` : `${this.root}:${key}:refresh`, timeoutMs);
-    }
-    releaseLock(lease) {
-        return this.locks.release(lease);
-    }
-    name() {
-        return "file";
-    }
-    forKey(key) {
-        if (this.layout === FileLayout.Single)
-            return this;
-        const digest = createHash("sha256").update(key).digest("hex");
-        return new FileCredentialStore(join(this.root, digest), FileLayout.Single, this.locks);
-    }
-    async withCacheLock(action) {
-        await ensureDirectory(this.root, 0o700);
-        const lease = await this.locks.acquire(`${this.root}:cache`, 30_000);
-        try {
-            return await action();
-        }
-        finally {
-            await this.locks.release(lease);
-        }
-    }
-    async readCache() {
-        try {
-            const source = await readTextFile(join(this.root, "token-cache.json"));
-            const cache = source ? JSON.parse(source) : { version: 1, tokens: {} };
-            if (cache.version !== 1 || typeof cache.tokens !== "object" || !cache.tokens) {
-                throw new AuthError("storage", "Token cache must use version 1");
-            }
-            logger.debug("read token cache", {
-                exists: Boolean(source),
-                credentialCount: Object.keys(cache.tokens).length,
-            });
-            return cache;
-        }
-        catch (cause) {
-            if (cause instanceof AuthError)
-                throw cause;
-            throw new AuthError("storage", "Could not read Databricks token cache", { cause });
-        }
-    }
-    async writeCache(cache) {
-        try {
-            await atomicWriteTextFile(join(this.root, "token-cache.json"), `${JSON.stringify(cache, null, 2)}\n`, 0o600);
-            logger.debug("wrote token cache", { credentialCount: Object.keys(cache.tokens).length });
-        }
-        catch (cause) {
-            throw new AuthError("storage", "Could not write Databricks token cache", { cause });
-        }
-    }
-}
-async function ensureDirectory(path, mode) {
-    await mkdir(path, { recursive: true, mode });
-    await chmod(path, mode);
-}
-async function readTextFile(path) {
-    try {
-        return await readFile(path, "utf8");
-    }
-    catch (cause) {
-        if (cause.code === "ENOENT")
-            return undefined;
-        throw cause;
-    }
-}
-async function atomicWriteTextFile(path, content, mode) {
-    const parent = dirname(path);
-    await ensureDirectory(parent, 0o700);
-    const temporary = join(parent, `.${basename(path)}-${randomUUID()}.tmp`);
-    try {
-        await writeFile(temporary, content, { mode, flag: "wx" });
-        await chmod(temporary, mode);
-        await rename(temporary, path);
-    }
-    finally {
-        await unlink(temporary).catch((cause) => {
-            if (cause.code !== "ENOENT")
-                throw cause;
-        });
-    }
-}
-function serializeToken(token) {
-    return {
-        access_token: token.accessToken,
-        token_type: token.tokenType,
-        ...(token.refreshToken ? { refresh_token: token.refreshToken } : {}),
-        ...(token.expiry ? { expiry: token.expiry } : {}),
-        ...(token.scopes.length ? { scopes: token.scopes } : {}),
-    };
-}
-function deserializeToken(value) {
-    if (!value || typeof value !== "object")
-        return undefined;
-    const record = value;
-    const accessToken = stringValue(record.access_token ?? record.accessToken);
-    if (!accessToken)
-        return undefined;
-    return {
-        accessToken,
-        tokenType: stringValue(record.token_type ?? record.tokenType) ?? "Bearer",
-        ...(stringValue(record.refresh_token ?? record.refreshToken)
-            ? { refreshToken: stringValue(record.refresh_token ?? record.refreshToken) }
-            : {}),
-        ...(stringValue(record.expiry ?? record.expires_at)
-            ? { expiry: stringValue(record.expiry ?? record.expires_at) }
-            : {}),
-        scopes: Array.isArray(record.scopes)
-            ? record.scopes.filter((scope) => typeof scope === "string")
-            : [],
-    };
-}
-function stringValue(value) {
-    return typeof value === "string" && value.trim() ? value : undefined;
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZS1zdG9yYWdlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL25vZGUtc3RvcmFnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUNyRCxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNyRixPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQ2xDLE9BQU8sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUVwRCxPQUFPLEVBQUUsZUFBZSxFQUFzQixNQUFNLDJCQUEyQixDQUFDO0FBRWhGLE9BQU8sRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUN4RSxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRXhDLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxZQUFZLENBQUM7QUFFeEMsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDO0FBTzFDLE1BQU0sYUFBYTtJQUdZO0lBRlosTUFBTSxHQUFHLElBQUksR0FBRyxFQUF5QixDQUFDO0lBRTNELFlBQTZCLGFBQXFCO1FBQXJCLGtCQUFhLEdBQWIsYUFBYSxDQUFRO0lBQUcsQ0FBQztJQUV0RCxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQVcsRUFBRSxTQUFpQjtRQUMxQyxNQUFNLENBQUMsS0FBSyxDQUFDLHVCQUF1QixFQUFFO1lBQ3BDLFVBQVUsRUFBRSxZQUFZLENBQUMsR0FBRyxDQUFDO1lBQzdCLFNBQVM7U0FDVixDQUFDLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxNQUFNLGVBQWUsQ0FBQyxHQUFHLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLGFBQWEsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQ2pGLE1BQU0sRUFBRSxHQUFHLFVBQVUsRUFBRSxDQUFDO1FBQ3hCLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMzQixNQUFNLENBQUMsS0FBSyxDQUFDLG9CQUFvQixFQUFFO1lBQ2pDLFVBQVUsRUFBRSxZQUFZLENBQUMsR0FBRyxDQUFDO1lBQzdCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTztTQUN2QixDQUFDLENBQUM7UUFDSCxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQVU7UUFDdEIsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEMsSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPO1FBQ25CLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZCLE1BQU0sS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3RCLE1BQU0sQ0FBQyxLQUFLLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDakUsQ0FBQztDQUNGO0FBRUQsZ0ZBQWdGO0FBQ2hGLE1BQU0sT0FBTyxtQkFBbUI7SUFJWDtJQUNBO0lBSkYsS0FBSyxDQUFjO0lBRXBDLFlBQ21CLE9BQU8sSUFBSSxDQUFDLE9BQU8sRUFBRSxFQUFFLGFBQWEsQ0FBQyxFQUNyQyxTQUFTLFVBQVUsQ0FBQyxNQUFNLEVBQzNDLEtBQW1CO1FBRkYsU0FBSSxHQUFKLElBQUksQ0FBaUM7UUFDckMsV0FBTSxHQUFOLE1BQU0sQ0FBb0I7UUFHM0MsSUFBSSxDQUFDLEtBQUssR0FBRyxLQUFLLElBQUksSUFBSSxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQVc7UUFDcEIsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMvQixPQUFPLEtBQUssQ0FBQyxhQUFhLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDcEMsTUFBTSxLQUFLLEdBQUcsZ0JBQWdCLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3RFLE1BQU0sQ0FBQyxLQUFLLENBQUMsd0JBQXdCLEVBQUU7Z0JBQ3JDLFVBQVUsRUFBRSxZQUFZLENBQUMsR0FBRyxDQUFDO2dCQUM3QixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07Z0JBQ25CLEtBQUssRUFBRSxhQUFhLENBQUMsS0FBSyxDQUFDO2FBQzVCLENBQUMsQ0FBQztZQUNILE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsS0FBSyxDQUFDLFlBQVk7UUFDaEIsTUFBTSxlQUFlLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN4QyxNQUFNLENBQUMsS0FBSyxDQUFDLCtCQUErQixFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQVcsRUFBRSxLQUFZO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDL0IsTUFBTSxLQUFLLENBQUMsYUFBYSxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ25DLE1BQU0sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzFDLE1BQU0sS0FBSyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUM5QixNQUFNLENBQUMsS0FBSyxDQUFDLHVCQUF1QixFQUFFO2dCQUNwQyxVQUFVLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQztnQkFDN0IsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO2dCQUNuQixLQUFLLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQzthQUM1QixDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQVc7UUFDdEIsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMvQixNQUFNLEtBQUssQ0FBQyxhQUFhLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDbkMsTUFBTSxLQUFLLEdBQUcsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDdEMsT0FBTyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3pCLE1BQU0sS0FBSyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUM5QixNQUFNLENBQUMsS0FBSyxDQUFDLHlCQUF5QixFQUFFO2dCQUN0QyxVQUFVLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQztnQkFDN0IsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO2FBQ3BCLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELFdBQVcsQ0FBQyxHQUFXLEVBQUUsU0FBaUI7UUFDeEMsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FDdkIsSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsSUFBSSxJQUFJLEdBQUcsVUFBVSxFQUMxRixTQUFTLENBQ1YsQ0FBQztJQUNKLENBQUM7SUFFRCxXQUFXLENBQUMsS0FBYTtRQUN2QixPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ25DLENBQUM7SUFFRCxJQUFJO1FBQ0YsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVPLE1BQU0sQ0FBQyxHQUFXO1FBQ3hCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsTUFBTTtZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ25ELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlELE9BQU8sSUFBSSxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBRU8sS0FBSyxDQUFDLGFBQWEsQ0FBSSxNQUF3QjtRQUNyRCxNQUFNLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3hDLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxJQUFJLENBQUMsSUFBSSxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDckUsSUFBSSxDQUFDO1lBQ0gsT0FBTyxNQUFNLE1BQU0sRUFBRSxDQUFDO1FBQ3hCLENBQUM7Z0JBQVMsQ0FBQztZQUNULE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbEMsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsU0FBUztRQUNyQixJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLENBQUM7WUFDdkUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBRSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBZ0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUN2RixJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssQ0FBQyxJQUFJLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzdFLE1BQU0sSUFBSSxTQUFTLENBQUMsU0FBUyxFQUFFLGdDQUFnQyxDQUFDLENBQUM7WUFDbkUsQ0FBQztZQUNELE1BQU0sQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEVBQUU7Z0JBQy9CLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDO2dCQUN2QixlQUFlLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTTthQUNsRCxDQUFDLENBQUM7WUFDSCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksU0FBUztnQkFBRSxNQUFNLEtBQUssQ0FBQztZQUM1QyxNQUFNLElBQUksU0FBUyxDQUFDLFNBQVMsRUFBRSx1Q0FBdUMsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDckYsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQWlCO1FBQ3hDLElBQUksQ0FBQztZQUNILE1BQU0sbUJBQW1CLENBQ3ZCLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLGtCQUFrQixDQUFDLEVBQ25DLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQ3JDLEtBQUssQ0FDTixDQUFDO1lBQ0YsTUFBTSxDQUFDLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLGVBQWUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzNGLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLFNBQVMsQ0FBQyxTQUFTLEVBQUUsd0NBQXdDLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3RGLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFFRCxLQUFLLFVBQVUsZUFBZSxDQUFDLElBQVksRUFBRSxJQUFZO0lBQ3ZELE1BQU0sS0FBSyxDQUFDLElBQUksRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUM3QyxNQUFNLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDMUIsQ0FBQztBQUVELEtBQUssVUFBVSxZQUFZLENBQUMsSUFBWTtJQUN0QyxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ3pFLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRCxLQUFLLFVBQVUsbUJBQW1CLENBQUMsSUFBWSxFQUFFLE9BQWUsRUFBRSxJQUFZO0lBQzVFLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM3QixNQUFNLGVBQWUsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDckMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxVQUFVLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekUsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUMxRCxNQUFNLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDN0IsTUFBTSxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ2hDLENBQUM7WUFBUyxDQUFDO1FBQ1QsTUFBTSxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBNEIsRUFBRSxFQUFFO1lBQzdELElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLE1BQU0sS0FBSyxDQUFDO1FBQzNDLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLGNBQWMsQ0FBQyxLQUFZO0lBQ2xDLE9BQU87UUFDTCxZQUFZLEVBQUUsS0FBSyxDQUFDLFdBQVc7UUFDL0IsVUFBVSxFQUFFLEtBQUssQ0FBQyxTQUFTO1FBQzNCLEdBQUcsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxFQUFFLGFBQWEsRUFBRSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDakQsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztLQUN6RCxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsS0FBYztJQUN0QyxJQUFJLENBQUMsS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUMxRCxNQUFNLE1BQU0sR0FBRyxLQUFnQyxDQUFDO0lBQ2hELE1BQU0sV0FBVyxHQUFHLFdBQVcsQ0FBQyxNQUFNLENBQUMsWUFBWSxJQUFJLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUMzRSxJQUFJLENBQUMsV0FBVztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ25DLE9BQU87UUFDTCxXQUFXO1FBQ1gsU0FBUyxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsVUFBVSxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsSUFBSSxRQUFRO1FBQ3pFLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLGFBQWEsSUFBSSxNQUFNLENBQUMsWUFBWSxDQUFDO1lBQzFELENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLGFBQWEsSUFBSSxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUU7WUFDNUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDO1lBQ2pELENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLEVBQUU7WUFDN0QsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLE1BQU0sRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDbEMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDO1lBQzdFLENBQUMsQ0FBQyxFQUFFO0tBQ1AsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxLQUFjO0lBQ2pDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDdkUsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGNyZWF0ZUhhc2gsIHJhbmRvbVVVSUQgfSBmcm9tIFwibm9kZTpjcnlwdG9cIjtcbmltcG9ydCB7IGNobW9kLCBta2RpciwgcmVhZEZpbGUsIHJlbmFtZSwgdW5saW5rLCB3cml0ZUZpbGUgfSBmcm9tIFwibm9kZTpmcy9wcm9taXNlc1wiO1xuaW1wb3J0IHsgaG9tZWRpciB9IGZyb20gXCJub2RlOm9zXCI7XG5pbXBvcnQgeyBiYXNlbmFtZSwgZGlybmFtZSwgam9pbiB9IGZyb20gXCJub2RlOnBhdGhcIjtcblxuaW1wb3J0IHsgYWNxdWlyZUZpbGVMb2NrLCB0eXBlIEZpbGVMb2NrTGVhc2UgfSBmcm9tIFwiQGRieC10b29scy9jb3JlL2ZpbGUtbG9ja1wiO1xuXG5pbXBvcnQgeyBhdXRoTG9nZ2VyLCBjcmVkZW50aWFsSWQsIHRva2VuTWV0YWRhdGEgfSBmcm9tIFwiLi9fbG9nZ2luZy50c1wiO1xuaW1wb3J0IHsgQXV0aEVycm9yIH0gZnJvbSBcIi4vZXJyb3JzLnRzXCI7XG5pbXBvcnQgdHlwZSB7IENyZWRlbnRpYWxTdG9yZSwgTG9ja0FkYXB0ZXIsIFRva2VuIH0gZnJvbSBcIi4vdHlwZXMudHNcIjtcbmltcG9ydCB7IEZpbGVMYXlvdXQgfSBmcm9tIFwiLi90eXBlcy50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBhdXRoTG9nZ2VyKFwiZmlsZS1zdG9yYWdlXCIpO1xuXG5pbnRlcmZhY2UgVG9rZW5DYWNoZSB7XG4gIHZlcnNpb246IG51bWJlcjtcbiAgdG9rZW5zOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbn1cblxuY2xhc3MgTm9kZUZpbGVMb2NrcyBpbXBsZW1lbnRzIExvY2tBZGFwdGVyIHtcbiAgcHJpdmF0ZSByZWFkb25seSBsZWFzZXMgPSBuZXcgTWFwPHN0cmluZywgRmlsZUxvY2tMZWFzZT4oKTtcblxuICBjb25zdHJ1Y3Rvcihwcml2YXRlIHJlYWRvbmx5IGxvY2tEaXJlY3Rvcnk6IHN0cmluZykge31cblxuICBhc3luYyBhY3F1aXJlKGtleTogc3RyaW5nLCB0aW1lb3V0TXM6IG51bWJlcik6IFByb21pc2U8c3RyaW5nPiB7XG4gICAgbG9nZ2VyLmRlYnVnKFwid2FpdGluZyBmb3IgZmlsZSBsb2NrXCIsIHtcbiAgICAgIGNyZWRlbnRpYWw6IGNyZWRlbnRpYWxJZChrZXkpLFxuICAgICAgdGltZW91dE1zLFxuICAgIH0pO1xuICAgIGNvbnN0IGxlYXNlID0gYXdhaXQgYWNxdWlyZUZpbGVMb2NrKGtleSwgeyBkaXI6IHRoaXMubG9ja0RpcmVjdG9yeSwgdGltZW91dE1zIH0pO1xuICAgIGNvbnN0IGlkID0gcmFuZG9tVVVJRCgpO1xuICAgIHRoaXMubGVhc2VzLnNldChpZCwgbGVhc2UpO1xuICAgIGxvZ2dlci5kZWJ1ZyhcImZpbGUgbG9jayBhY3F1aXJlZFwiLCB7XG4gICAgICBjcmVkZW50aWFsOiBjcmVkZW50aWFsSWQoa2V5KSxcbiAgICAgIGJhY2tlbmQ6IGxlYXNlLmJhY2tlbmQsXG4gICAgfSk7XG4gICAgcmV0dXJuIGlkO1xuICB9XG5cbiAgYXN5bmMgcmVsZWFzZShpZDogc3RyaW5nKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgY29uc3QgbGVhc2UgPSB0aGlzLmxlYXNlcy5nZXQoaWQpO1xuICAgIGlmICghbGVhc2UpIHJldHVybjtcbiAgICB0aGlzLmxlYXNlcy5kZWxldGUoaWQpO1xuICAgIGF3YWl0IGxlYXNlLnJlbGVhc2UoKTtcbiAgICBsb2dnZXIuZGVidWcoXCJmaWxlIGxvY2sgcmVsZWFzZWRcIiwgeyBiYWNrZW5kOiBsZWFzZS5iYWNrZW5kIH0pO1xuICB9XG59XG5cbi8qKiBGaWxlLWJhY2tlZCBjcmVkZW50aWFsIHN0b3JlIHByZXNlcnZpbmcgdW5yZWxhdGVkIERhdGFicmlja3MgQ0xJIGVudHJpZXMuICovXG5leHBvcnQgY2xhc3MgRmlsZUNyZWRlbnRpYWxTdG9yZSBpbXBsZW1lbnRzIENyZWRlbnRpYWxTdG9yZSB7XG4gIHByaXZhdGUgcmVhZG9ubHkgbG9ja3M6IExvY2tBZGFwdGVyO1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcm9vdCA9IGpvaW4oaG9tZWRpcigpLCBcIi5kYXRhYnJpY2tzXCIpLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgbGF5b3V0ID0gRmlsZUxheW91dC5TaW5nbGUsXG4gICAgbG9ja3M/OiBMb2NrQWRhcHRlcixcbiAgKSB7XG4gICAgdGhpcy5sb2NrcyA9IGxvY2tzID8/IG5ldyBOb2RlRmlsZUxvY2tzKGpvaW4ocm9vdCwgXCJsb2Nrc1wiKSk7XG4gIH1cblxuICBhc3luYyBsb2FkKGtleTogc3RyaW5nKTogUHJvbWlzZTxUb2tlbiB8IHVuZGVmaW5lZD4ge1xuICAgIGNvbnN0IHN0b3JlID0gdGhpcy5mb3JLZXkoa2V5KTtcbiAgICByZXR1cm4gc3RvcmUud2l0aENhY2hlTG9jayhhc3luYyAoKSA9PiB7XG4gICAgICBjb25zdCB0b2tlbiA9IGRlc2VyaWFsaXplVG9rZW4oKGF3YWl0IHN0b3JlLnJlYWRDYWNoZSgpKS50b2tlbnNba2V5XSk7XG4gICAgICBsb2dnZXIuZGVidWcoXCJsb2FkZWQgZmlsZSBjcmVkZW50aWFsXCIsIHtcbiAgICAgICAgY3JlZGVudGlhbDogY3JlZGVudGlhbElkKGtleSksXG4gICAgICAgIGxheW91dDogdGhpcy5sYXlvdXQsXG4gICAgICAgIHRva2VuOiB0b2tlbk1ldGFkYXRhKHRva2VuKSxcbiAgICAgIH0pO1xuICAgICAgcmV0dXJuIHRva2VuO1xuICAgIH0pO1xuICB9XG5cbiAgYXN5bmMgcHJlcGFyZVdyaXRlKCk6IFByb21pc2U8dm9pZD4ge1xuICAgIGF3YWl0IGVuc3VyZURpcmVjdG9yeSh0aGlzLnJvb3QsIDBvNzAwKTtcbiAgICBsb2dnZXIuZGVidWcoXCJwcmVwYXJlZCBjcmVkZW50aWFsIGRpcmVjdG9yeVwiLCB7IGxheW91dDogdGhpcy5sYXlvdXQgfSk7XG4gIH1cblxuICBhc3luYyBzYXZlKGtleTogc3RyaW5nLCB0b2tlbjogVG9rZW4pOiBQcm9taXNlPHZvaWQ+IHtcbiAgICBjb25zdCBzdG9yZSA9IHRoaXMuZm9yS2V5KGtleSk7XG4gICAgYXdhaXQgc3RvcmUud2l0aENhY2hlTG9jayhhc3luYyAoKSA9PiB7XG4gICAgICBjb25zdCBjYWNoZSA9IGF3YWl0IHN0b3JlLnJlYWRDYWNoZSgpO1xuICAgICAgY2FjaGUudG9rZW5zW2tleV0gPSBzZXJpYWxpemVUb2tlbih0b2tlbik7XG4gICAgICBhd2FpdCBzdG9yZS53cml0ZUNhY2hlKGNhY2hlKTtcbiAgICAgIGxvZ2dlci5kZWJ1ZyhcInNhdmVkIGZpbGUgY3JlZGVudGlhbFwiLCB7XG4gICAgICAgIGNyZWRlbnRpYWw6IGNyZWRlbnRpYWxJZChrZXkpLFxuICAgICAgICBsYXlvdXQ6IHRoaXMubGF5b3V0LFxuICAgICAgICB0b2tlbjogdG9rZW5NZXRhZGF0YSh0b2tlbiksXG4gICAgICB9KTtcbiAgICB9KTtcbiAgfVxuXG4gIGFzeW5jIHJlbW92ZShrZXk6IHN0cmluZyk6IFByb21pc2U8dm9pZD4ge1xuICAgIGNvbnN0IHN0b3JlID0gdGhpcy5mb3JLZXkoa2V5KTtcbiAgICBhd2FpdCBzdG9yZS53aXRoQ2FjaGVMb2NrKGFzeW5jICgpID0+IHtcbiAgICAgIGNvbnN0IGNhY2hlID0gYXdhaXQgc3RvcmUucmVhZENhY2hlKCk7XG4gICAgICBkZWxldGUgY2FjaGUudG9rZW5zW2tleV07XG4gICAgICBhd2FpdCBzdG9yZS53cml0ZUNhY2hlKGNhY2hlKTtcbiAgICAgIGxvZ2dlci5kZWJ1ZyhcInJlbW92ZWQgZmlsZSBjcmVkZW50aWFsXCIsIHtcbiAgICAgICAgY3JlZGVudGlhbDogY3JlZGVudGlhbElkKGtleSksXG4gICAgICAgIGxheW91dDogdGhpcy5sYXlvdXQsXG4gICAgICB9KTtcbiAgICB9KTtcbiAgfVxuXG4gIGFjcXVpcmVMb2NrKGtleTogc3RyaW5nLCB0aW1lb3V0TXM6IG51bWJlcik6IFByb21pc2U8c3RyaW5nPiB7XG4gICAgcmV0dXJuIHRoaXMubG9ja3MuYWNxdWlyZShcbiAgICAgIHRoaXMubGF5b3V0ID09PSBGaWxlTGF5b3V0LlNpbmdsZSA/IGAke3RoaXMucm9vdH06cmVmcmVzaGAgOiBgJHt0aGlzLnJvb3R9OiR7a2V5fTpyZWZyZXNoYCxcbiAgICAgIHRpbWVvdXRNcyxcbiAgICApO1xuICB9XG5cbiAgcmVsZWFzZUxvY2sobGVhc2U6IHN0cmluZyk6IFByb21pc2U8dm9pZD4ge1xuICAgIHJldHVybiB0aGlzLmxvY2tzLnJlbGVhc2UobGVhc2UpO1xuICB9XG5cbiAgbmFtZSgpOiBzdHJpbmcge1xuICAgIHJldHVybiBcImZpbGVcIjtcbiAgfVxuXG4gIHByaXZhdGUgZm9yS2V5KGtleTogc3RyaW5nKTogRmlsZUNyZWRlbnRpYWxTdG9yZSB7XG4gICAgaWYgKHRoaXMubGF5b3V0ID09PSBGaWxlTGF5b3V0LlNpbmdsZSkgcmV0dXJuIHRoaXM7XG4gICAgY29uc3QgZGlnZXN0ID0gY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUoa2V5KS5kaWdlc3QoXCJoZXhcIik7XG4gICAgcmV0dXJuIG5ldyBGaWxlQ3JlZGVudGlhbFN0b3JlKGpvaW4odGhpcy5yb290LCBkaWdlc3QpLCBGaWxlTGF5b3V0LlNpbmdsZSwgdGhpcy5sb2Nrcyk7XG4gIH1cblxuICBwcml2YXRlIGFzeW5jIHdpdGhDYWNoZUxvY2s8VD4oYWN0aW9uOiAoKSA9PiBQcm9taXNlPFQ+KTogUHJvbWlzZTxUPiB7XG4gICAgYXdhaXQgZW5zdXJlRGlyZWN0b3J5KHRoaXMucm9vdCwgMG83MDApO1xuICAgIGNvbnN0IGxlYXNlID0gYXdhaXQgdGhpcy5sb2Nrcy5hY3F1aXJlKGAke3RoaXMucm9vdH06Y2FjaGVgLCAzMF8wMDApO1xuICAgIHRyeSB7XG4gICAgICByZXR1cm4gYXdhaXQgYWN0aW9uKCk7XG4gICAgfSBmaW5hbGx5IHtcbiAgICAgIGF3YWl0IHRoaXMubG9ja3MucmVsZWFzZShsZWFzZSk7XG4gICAgfVxuICB9XG5cbiAgcHJpdmF0ZSBhc3luYyByZWFkQ2FjaGUoKTogUHJvbWlzZTxUb2tlbkNhY2hlPiB7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHNvdXJjZSA9IGF3YWl0IHJlYWRUZXh0RmlsZShqb2luKHRoaXMucm9vdCwgXCJ0b2tlbi1jYWNoZS5qc29uXCIpKTtcbiAgICAgIGNvbnN0IGNhY2hlID0gc291cmNlID8gKEpTT04ucGFyc2Uoc291cmNlKSBhcyBUb2tlbkNhY2hlKSA6IHsgdmVyc2lvbjogMSwgdG9rZW5zOiB7fSB9O1xuICAgICAgaWYgKGNhY2hlLnZlcnNpb24gIT09IDEgfHwgdHlwZW9mIGNhY2hlLnRva2VucyAhPT0gXCJvYmplY3RcIiB8fCAhY2FjaGUudG9rZW5zKSB7XG4gICAgICAgIHRocm93IG5ldyBBdXRoRXJyb3IoXCJzdG9yYWdlXCIsIFwiVG9rZW4gY2FjaGUgbXVzdCB1c2UgdmVyc2lvbiAxXCIpO1xuICAgICAgfVxuICAgICAgbG9nZ2VyLmRlYnVnKFwicmVhZCB0b2tlbiBjYWNoZVwiLCB7XG4gICAgICAgIGV4aXN0czogQm9vbGVhbihzb3VyY2UpLFxuICAgICAgICBjcmVkZW50aWFsQ291bnQ6IE9iamVjdC5rZXlzKGNhY2hlLnRva2VucykubGVuZ3RoLFxuICAgICAgfSk7XG4gICAgICByZXR1cm4gY2FjaGU7XG4gICAgfSBjYXRjaCAoY2F1c2UpIHtcbiAgICAgIGlmIChjYXVzZSBpbnN0YW5jZW9mIEF1dGhFcnJvcikgdGhyb3cgY2F1c2U7XG4gICAgICB0aHJvdyBuZXcgQXV0aEVycm9yKFwic3RvcmFnZVwiLCBcIkNvdWxkIG5vdCByZWFkIERhdGFicmlja3MgdG9rZW4gY2FjaGVcIiwgeyBjYXVzZSB9KTtcbiAgICB9XG4gIH1cblxuICBwcml2YXRlIGFzeW5jIHdyaXRlQ2FjaGUoY2FjaGU6IFRva2VuQ2FjaGUpOiBQcm9taXNlPHZvaWQ+IHtcbiAgICB0cnkge1xuICAgICAgYXdhaXQgYXRvbWljV3JpdGVUZXh0RmlsZShcbiAgICAgICAgam9pbih0aGlzLnJvb3QsIFwidG9rZW4tY2FjaGUuanNvblwiKSxcbiAgICAgICAgYCR7SlNPTi5zdHJpbmdpZnkoY2FjaGUsIG51bGwsIDIpfVxcbmAsXG4gICAgICAgIDBvNjAwLFxuICAgICAgKTtcbiAgICAgIGxvZ2dlci5kZWJ1ZyhcIndyb3RlIHRva2VuIGNhY2hlXCIsIHsgY3JlZGVudGlhbENvdW50OiBPYmplY3Qua2V5cyhjYWNoZS50b2tlbnMpLmxlbmd0aCB9KTtcbiAgICB9IGNhdGNoIChjYXVzZSkge1xuICAgICAgdGhyb3cgbmV3IEF1dGhFcnJvcihcInN0b3JhZ2VcIiwgXCJDb3VsZCBub3Qgd3JpdGUgRGF0YWJyaWNrcyB0b2tlbiBjYWNoZVwiLCB7IGNhdXNlIH0pO1xuICAgIH1cbiAgfVxufVxuXG5hc3luYyBmdW5jdGlvbiBlbnN1cmVEaXJlY3RvcnkocGF0aDogc3RyaW5nLCBtb2RlOiBudW1iZXIpOiBQcm9taXNlPHZvaWQ+IHtcbiAgYXdhaXQgbWtkaXIocGF0aCwgeyByZWN1cnNpdmU6IHRydWUsIG1vZGUgfSk7XG4gIGF3YWl0IGNobW9kKHBhdGgsIG1vZGUpO1xufVxuXG5hc3luYyBmdW5jdGlvbiByZWFkVGV4dEZpbGUocGF0aDogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmcgfCB1bmRlZmluZWQ+IHtcbiAgdHJ5IHtcbiAgICByZXR1cm4gYXdhaXQgcmVhZEZpbGUocGF0aCwgXCJ1dGY4XCIpO1xuICB9IGNhdGNoIChjYXVzZSkge1xuICAgIGlmICgoY2F1c2UgYXMgTm9kZUpTLkVycm5vRXhjZXB0aW9uKS5jb2RlID09PSBcIkVOT0VOVFwiKSByZXR1cm4gdW5kZWZpbmVkO1xuICAgIHRocm93IGNhdXNlO1xuICB9XG59XG5cbmFzeW5jIGZ1bmN0aW9uIGF0b21pY1dyaXRlVGV4dEZpbGUocGF0aDogc3RyaW5nLCBjb250ZW50OiBzdHJpbmcsIG1vZGU6IG51bWJlcik6IFByb21pc2U8dm9pZD4ge1xuICBjb25zdCBwYXJlbnQgPSBkaXJuYW1lKHBhdGgpO1xuICBhd2FpdCBlbnN1cmVEaXJlY3RvcnkocGFyZW50LCAwbzcwMCk7XG4gIGNvbnN0IHRlbXBvcmFyeSA9IGpvaW4ocGFyZW50LCBgLiR7YmFzZW5hbWUocGF0aCl9LSR7cmFuZG9tVVVJRCgpfS50bXBgKTtcbiAgdHJ5IHtcbiAgICBhd2FpdCB3cml0ZUZpbGUodGVtcG9yYXJ5LCBjb250ZW50LCB7IG1vZGUsIGZsYWc6IFwid3hcIiB9KTtcbiAgICBhd2FpdCBjaG1vZCh0ZW1wb3JhcnksIG1vZGUpO1xuICAgIGF3YWl0IHJlbmFtZSh0ZW1wb3JhcnksIHBhdGgpO1xuICB9IGZpbmFsbHkge1xuICAgIGF3YWl0IHVubGluayh0ZW1wb3JhcnkpLmNhdGNoKChjYXVzZTogTm9kZUpTLkVycm5vRXhjZXB0aW9uKSA9PiB7XG4gICAgICBpZiAoY2F1c2UuY29kZSAhPT0gXCJFTk9FTlRcIikgdGhyb3cgY2F1c2U7XG4gICAgfSk7XG4gIH1cbn1cblxuZnVuY3Rpb24gc2VyaWFsaXplVG9rZW4odG9rZW46IFRva2VuKTogUmVjb3JkPHN0cmluZywgdW5rbm93bj4ge1xuICByZXR1cm4ge1xuICAgIGFjY2Vzc190b2tlbjogdG9rZW4uYWNjZXNzVG9rZW4sXG4gICAgdG9rZW5fdHlwZTogdG9rZW4udG9rZW5UeXBlLFxuICAgIC4uLih0b2tlbi5yZWZyZXNoVG9rZW4gPyB7IHJlZnJlc2hfdG9rZW46IHRva2VuLnJlZnJlc2hUb2tlbiB9IDoge30pLFxuICAgIC4uLih0b2tlbi5leHBpcnkgPyB7IGV4cGlyeTogdG9rZW4uZXhwaXJ5IH0gOiB7fSksXG4gICAgLi4uKHRva2VuLnNjb3Blcy5sZW5ndGggPyB7IHNjb3BlczogdG9rZW4uc2NvcGVzIH0gOiB7fSksXG4gIH07XG59XG5cbmZ1bmN0aW9uIGRlc2VyaWFsaXplVG9rZW4odmFsdWU6IHVua25vd24pOiBUb2tlbiB8IHVuZGVmaW5lZCB7XG4gIGlmICghdmFsdWUgfHwgdHlwZW9mIHZhbHVlICE9PSBcIm9iamVjdFwiKSByZXR1cm4gdW5kZWZpbmVkO1xuICBjb25zdCByZWNvcmQgPSB2YWx1ZSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgY29uc3QgYWNjZXNzVG9rZW4gPSBzdHJpbmdWYWx1ZShyZWNvcmQuYWNjZXNzX3Rva2VuID8/IHJlY29yZC5hY2Nlc3NUb2tlbik7XG4gIGlmICghYWNjZXNzVG9rZW4pIHJldHVybiB1bmRlZmluZWQ7XG4gIHJldHVybiB7XG4gICAgYWNjZXNzVG9rZW4sXG4gICAgdG9rZW5UeXBlOiBzdHJpbmdWYWx1ZShyZWNvcmQudG9rZW5fdHlwZSA/PyByZWNvcmQudG9rZW5UeXBlKSA/PyBcIkJlYXJlclwiLFxuICAgIC4uLihzdHJpbmdWYWx1ZShyZWNvcmQucmVmcmVzaF90b2tlbiA/PyByZWNvcmQucmVmcmVzaFRva2VuKVxuICAgICAgPyB7IHJlZnJlc2hUb2tlbjogc3RyaW5nVmFsdWUocmVjb3JkLnJlZnJlc2hfdG9rZW4gPz8gcmVjb3JkLnJlZnJlc2hUb2tlbikgfVxuICAgICAgOiB7fSksXG4gICAgLi4uKHN0cmluZ1ZhbHVlKHJlY29yZC5leHBpcnkgPz8gcmVjb3JkLmV4cGlyZXNfYXQpXG4gICAgICA/IHsgZXhwaXJ5OiBzdHJpbmdWYWx1ZShyZWNvcmQuZXhwaXJ5ID8/IHJlY29yZC5leHBpcmVzX2F0KSB9XG4gICAgICA6IHt9KSxcbiAgICBzY29wZXM6IEFycmF5LmlzQXJyYXkocmVjb3JkLnNjb3BlcylcbiAgICAgID8gcmVjb3JkLnNjb3Blcy5maWx0ZXIoKHNjb3BlKTogc2NvcGUgaXMgc3RyaW5nID0+IHR5cGVvZiBzY29wZSA9PT0gXCJzdHJpbmdcIilcbiAgICAgIDogW10sXG4gIH07XG59XG5cbmZ1bmN0aW9uIHN0cmluZ1ZhbHVlKHZhbHVlOiB1bmtub3duKTogc3RyaW5nIHwgdW5kZWZpbmVkIHtcbiAgcmV0dXJuIHR5cGVvZiB2YWx1ZSA9PT0gXCJzdHJpbmdcIiAmJiB2YWx1ZS50cmltKCkgPyB2YWx1ZSA6IHVuZGVmaW5lZDtcbn1cbiJdfQ==