@pipeline-builder/api-core 0.0.1

package/lib/services/remote-audit-client.d.ts

@@ -0,0 +1,160 @@
+import { type AuditSpool } from './audit-spool.js';
+/**
+ * The exact set of audit actions a NON-PLATFORM (remote) service is permitted to
+ * emit through `POST /audit/events`. This is the SINGLE SOURCE — `RemoteAuditAction`
+ * is derived from it, so the type and the runtime allow-list can never drift.
+ *
+ * SECURITY: platform's ingest validates `action` against this subset (via
+ * {@link isRemoteAuditAction}), NOT the full platform `AuditAction` union — a
+ * `service:*` token must not be able to forge platform-authority events
+ * (`admin.superadmin.grant`, `org.ownership.transfer`, `user.login`, …). Keep
+ * this list free of any platform-only action.
+ */
+export declare const REMOTE_AUDIT_ACTIONS: readonly ['plugin.build.completed', 'plugin.build.failed', 'plugin.build.timeout', 'plugin.delete', 'plugin.restore', 'plugin.purge', 'plugin.update', 'plugin.upload', 'plugin.deploy', 'plugin.bulk.update', 'plugin.bulk.delete', 'plugin.dlq.purge', 'pipeline.create', 'pipeline.update', 'pipeline.delete', 'pipeline.restore', 'pipeline.purge', 'pipeline_template.create', 'pipeline_template.update', 'pipeline_template.delete', 'pipeline_template.restore', 'pipeline_template.purge', 'pipeline.execution.start', 'pipeline.execution.cancel', 'pipeline.registry.register', 'pipeline.registry.deregister', 'quota.reset', 'quota.limit.update', 'quota.delete', 'compliance.exemption.approve', 'compliance.exemption.revoke', 'compliance.rule.toggle', 'compliance.rule.create', 'compliance.rule.update', 'compliance.rule.delete', 'compliance.rule.restore', 'compliance.rule.purge', 'compliance.policy.create', 'compliance.policy.update', 'compliance.policy.delete', 'compliance.policy.restore', 'compliance.policy.purge', 'compliance.scan-schedule.create', 'compliance.scan-schedule.update', 'compliance.scan-schedule.delete', 'compliance.template.apply', 'compliance.scan.cancel', 'registry.gc', 'registry.image.delete', 'registry.image.copy', 'message.announcement.create', 'message.delete', 'message.restore', 'message.purge', 'billing.subscription.cancel', 'billing.subscription.delete', 'billing.tier.override', 'billing.addon.add', 'billing.addon.remove', 'billing.addon.prune', 'billing.discount.generate', 'billing.discount.issue', 'billing.discount.apply', 'billing.discount.remove', 'billing.discount.revoke', 'billing.promotion.create', 'billing.promotion.update', 'billing.promotion.revoke', 'billing.promotion.grant', 'billing.promotion.activate', 'billing.credit.consumed', 'billing.credit.exhausted', 'billing.combo.expired', 'authz.denied', 'ask.query', 'ask.agent.turn'];
+export type RemoteAuditAction = typeof REMOTE_AUDIT_ACTIONS[number];
+/** Whether `value` is an action a remote service may emit (the ingest allow-list). */
+export declare function isRemoteAuditAction(value: string): value is RemoteAuditAction;
+export interface RemoteAuditEvent {
+    action: RemoteAuditAction;
+    actorId: string;
+    actorEmail?: string;
+    orgId?: string;
+    affectedOrgId?: string;
+    targetType?: string;
+    targetId?: string;
+    /**
+     * Did the audited action succeed or fail? Defaults to 'success' when omitted
+     * (the platform ingest applies the same default). Denied-authz events set
+     * 'failure' so a reviewer can filter attempts from completed actions.
+     */
+    outcome?: 'success' | 'failure';
+    /**
+     * When the audited action actually OCCURRED (ISO-8601), stamped at emission.
+     * The platform stores this for reviewers; it is NOT the chain-ordering field
+     * (the tamper-evident chain orders by ingest/`createdAt`). It matters for
+     * SPOOLED events: one buffered during a platform outage is re-delivered — and
+     * so chained — later, but `occurredAt` preserves when it really happened.
+     */
+    occurredAt?: string;
+    /**
+     * Stable per-emission dedup key (also sent as the `Idempotency-Key` header the
+     * platform ingest dedups on). Stamped by `record()` and carried on the spooled
+     * copy so a live attempt and its later re-delivery collapse to ONE stored row.
+     */
+    idempotencyKey?: string;
+    details?: Record<string, unknown>;
+}
+/**
+ * Client for POSTing audit events to the platform's `/audit-events` ingest
+ * endpoint. Mints a fresh service token per call (5 min TTL)  there's no
+ * meaningful caching benefit when emissions are sparse.
+ */
+export interface RemoteAuditClient {
+    /**
+     * Fire-and-forget audit emission. Failures are logged at warn level but
+     * never thrown  the originating action (e.g. a plugin build) has its
+     * own success/failure path that shouldn't get polluted by a flaky audit
+     * downstream. When a {@link AuditSpool} is configured, an emission that
+     * exhausts its live retries is buffered and re-delivered later instead of
+     * being dropped.
+     */
+    record(event: RemoteAuditEvent, serviceName: string): void;
+    /** Stop the background spool-drain timer (if any). Safe to call repeatedly. */
+    close(): void;
+}
+/**
+ * Configuration for the remote audit client.
+ */
+export interface RemoteAuditClientConfig {
+    /** Platform service host (default: env PLATFORM_SERVICE_HOST or 'platform') */
+    host?: string;
+    /** Platform service port (default: env PLATFORM_SERVICE_PORT or 3000) */
+    port?: number;
+    /** Request timeout ms (default 3000  audit shouldn't block the worker). */
+    timeout?: number;
+    /**
+     * Optional durable buffer. When set, an emission that exhausts its live retry
+     * budget (sustained platform outage) is spooled and re-delivered — on the next
+     * successful emission and on a periodic timer — instead of being lost.
+     */
+    spool?: AuditSpool;
+    /** Spool-drain interval ms (default 30_000). Only used when `spool` is set. */
+    drainIntervalMs?: number;
+    /** Max entries drained per sweep (default 100). */
+    drainBatchSize?: number;
+}
+/**
+ * Construct a remote-audit client targeted at the platform service.
+ *
+ * Used by api/plugin's build worker to push `plugin.build.*` events into
+ * the platform's MongoDB `audit_events` collection. Other services
+ * with worker-style emitters can use the same client.
+ *
+ * @example
+ * ```typescript
+ * const auditClient = createRemoteAuditClient();
+ * auditClient.record({
+ * action: 'plugin.build.completed',
+ * actorId: 'user-123',
+ * orgId: 'org-acme',
+ * targetType: 'plugin',
+ * targetId: 'plugin-abc',
+ * details: { name: 'my-plugin', version: '1.0.0' },
+ * }, 'plugin');
+ * ```
+ */
+export declare function createRemoteAuditClient(config?: RemoteAuditClientConfig): RemoteAuditClient;
+/**
+ * Register the standard `authz.denied` sink used by every remote-audit service
+ * (pipeline, plugin, compliance, quota, message, billing, reporting, …).
+ *
+ * The shared `requireAuth` gate forwards each DENIED state-changing request to
+ * the auditor set via {@link setAuthzDenialAuditor}; this wires that hook to the
+ * service's {@link RemoteAuditClient}, forwarding a `failure`-outcome
+ * `authz.denied` event so probing / privilege-escalation attempts leave a trail.
+ * Emission is fire-and-forget (the client never throws). `getClient` is a getter
+ * so the client stays lazily constructed (services memoize it on first use).
+ *
+ * Platform is intentionally NOT a caller — it is the audit authority and writes
+ * `authz.denied` straight to its local store (with `affectedOrgId`), not through
+ * a RemoteAuditClient.
+ */
+export declare function wireAuthzDenialAuditor(serviceName: string, getClient: () => RemoteAuditClient): void;
+/**
+ * A service-scoped audit client: a durable-spool-backed {@link RemoteAuditClient}
+ * with the service name pre-bound for emission. Replaces the per-service
+ * boilerplate of `createRemoteAuditClient({ spool: createEnvRedisAuditSpool() ?? undefined })`
+ * plus a hand-rolled `emit<Service>Audit` wrapper that repeats the service name.
+ */
+export interface ServiceAuditClient {
+    /** Emit an audit event with the service name bound. Fire-and-forget. */
+    emit(event: RemoteAuditEvent): void;
+    /** The underlying remote client — for `wireAuthzDenialAuditor` + `close()`. */
+    readonly client: RemoteAuditClient;
+}
+/**
+ * Build a service's audit client: a RemoteAuditClient wired to the durable Redis
+ * spool (from ambient env; null → no spool) with `serviceName` bound. Construct
+ * ONCE per process — memoize behind a lazy `getAuditClient()` in the service's
+ * `services/audit.ts`. Pass `config.spool` to override the env-derived spool
+ * (e.g. reuse a service's existing ioredis connection).
+ */
+export declare function createServiceAuditClient(serviceName: string, config?: RemoteAuditClientConfig): ServiceAuditClient;
+/**
+ * Lazily-constructed remote-audit accessor for a service. Every service's
+ * `services/audit.ts` used to hand-roll the same module singleton (a `let audit`
+ * + `svc()` that builds a {@link ServiceAuditClient} on first use, then a
+ * `getAuditClient()` returning `.client` and an `emit(event)` forwarding to
+ * `.emit`). This packages that pattern in ONE place so each service's audit
+ * wiring is a one-liner and can't drift.
+ *
+ * Lazy on purpose: the underlying client wires an env-Redis audit spool, so
+ * building it at import time would force that connection wherever the module is
+ * merely imported (e.g. tests). `getAuditClient` is passed to
+ * `wireAuthzDenialAuditor`; `emit` backs the per-service `emitXAudit` helpers.
+ * Both stay FIRE-AND-FORGET (record never throws / is not awaited).
+ */
+export declare function createRemoteAuditAccessor(serviceName: string): {
+    getAuditClient: () => RemoteAuditClient;
+    emit: (event: RemoteAuditEvent) => void;
+};

package/lib/services/remote-audit-client.js

@@ -0,0 +1,390 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { randomUUID } from 'crypto';
+import { createEnvRedisAuditSpool } from './audit-spool.js';
+import { createSafeClient } from './http-client.js';
+import { getServiceAuthHeader, setAuthzDenialAuditor } from '../middleware/auth.js';
+import { createLogger } from '../utils/logger.js';
+import { emitCounter } from '../utils/metric-emitter.js';
+const logger = createLogger('remote-audit');
+/**
+ * Audit ingest is best-effort and MUST NOT block the caller, but a transient
+ * failure (429 / 5xx / connection reset / timeout) should not silently drop the
+ * row on the first attempt. Each emission carries a stable per-event
+ * `Idempotency-Key` (see `record`), so the http-client treats the POST as
+ * retry-safe and the platform can dedup a retried delivery instead of writing a
+ * duplicate row. Budget is kept small so a hard-down platform can't back the
+ * worker up for long: base delay ×(2 retries) + a couple of 429 backoffs.
+ */
+const AUDIT_REQUEST_OPTIONS = {
+    maxRateLimitRetries: 2,
+    maxRetries: 2,
+};
+/**
+ * The exact set of audit actions a NON-PLATFORM (remote) service is permitted to
+ * emit through `POST /audit/events`. This is the SINGLE SOURCE — `RemoteAuditAction`
+ * is derived from it, so the type and the runtime allow-list can never drift.
+ *
+ * SECURITY: platform's ingest validates `action` against this subset (via
+ * {@link isRemoteAuditAction}), NOT the full platform `AuditAction` union — a
+ * `service:*` token must not be able to forge platform-authority events
+ * (`admin.superadmin.grant`, `org.ownership.transfer`, `user.login`, …). Keep
+ * this list free of any platform-only action.
+ */
+export const REMOTE_AUDIT_ACTIONS = [
+    'plugin.build.completed',
+    'plugin.build.failed',
+    'plugin.build.timeout',
+    // Plugin lifecycle mutations (api/plugin route handlers) — the destructive /
+    // publishing surface that builds already audit's counterpart: registry delete,
+    // source upload, and deploy-to-cluster. `targetId` is the plugin id.
+    'plugin.delete',
+    'plugin.restore',
+    // Manual purge: permanent hard-delete of a soft-deleted plugin tombstone on
+    // demand (finalizes what the retention sweep would otherwise do later).
+    'plugin.purge',
+    'plugin.update',
+    'plugin.upload',
+    'plugin.deploy',
+    // Plugin bulk mutations (api/plugin bulk-plugin route) + DLQ purge (drops all
+    // dead-lettered build jobs, cross-org, sysadmin). `details` carries counts.
+    'plugin.bulk.update',
+    'plugin.bulk.delete',
+    'plugin.dlq.purge',
+    // Pipeline mutations — emitted by api/pipeline's route handlers
+    // (create/update/delete + CodePipeline execution trigger/cancel) and
+    // posted to platform's `POST /audit/events` ingest.
+    'pipeline.create',
+    'pipeline.update',
+    'pipeline.delete',
+    'pipeline.restore',
+    // Manual purge: permanent hard-delete of a soft-deleted pipeline /
+    // pipeline_template tombstone on demand (finalizes what the retention sweep
+    // would otherwise do later). `targetId` is the purged id.
+    'pipeline.purge',
+    'pipeline_template.create',
+    'pipeline_template.update',
+    'pipeline_template.delete',
+    'pipeline_template.restore',
+    'pipeline_template.purge',
+    'pipeline.execution.start',
+    'pipeline.execution.cancel',
+    // CodePipeline ARN-registry config (api/pipeline registry route) — registering /
+    // deregistering the external CodePipeline that backs a pipeline (deploy-affecting).
+    'pipeline.registry.register',
+    'pipeline.registry.deregister',
+    // Quota administration (api/quota) — a superadmin resetting an org's usage
+    // counter or editing its tier limits. `affectedOrgId` is the org changed;
+    // `details` carries the quotaType + old/new value.
+    'quota.reset',
+    'quota.limit.update',
+    // A superadmin deleting an org's entire quota document.
+    'quota.delete',
+    // Compliance administration (api/compliance) — the enforcement-posture surface.
+    // Approving/revoking an exemption, toggling/authoring/deleting a rule,
+    // authoring/deleting a policy, managing scan schedules, applying a template,
+    // or cancelling a running scan. `targetId` is the rule/policy/exemption/scan id.
+    'compliance.exemption.approve',
+    'compliance.exemption.revoke',
+    'compliance.rule.toggle',
+    'compliance.rule.create',
+    'compliance.rule.update',
+    'compliance.rule.delete',
+    'compliance.rule.restore',
+    // Manual on-demand hard-delete (PURGE) of a soft-deleted rule/policy tombstone —
+    // the caller-initiated counterpart to the retention sweep's auto-purge. Destroys
+    // the tombstone permanently, so it carries the durable, tamper-evident trail.
+    'compliance.rule.purge',
+    'compliance.policy.create',
+    'compliance.policy.update',
+    'compliance.policy.delete',
+    'compliance.policy.restore',
+    'compliance.policy.purge',
+    'compliance.scan-schedule.create',
+    'compliance.scan-schedule.update',
+    'compliance.scan-schedule.delete',
+    'compliance.template.apply',
+    'compliance.scan.cancel',
+    // Image-registry destructive ops (api/image-registry) — garbage-collection
+    // sweeps and explicit image/tag deletes (previously only a log line).
+    'registry.gc',
+    'registry.image.delete',
+    // Cross-repo tag/image copy (api/image-registry POST /api/images/copy). A
+    // cross-tenant copy moves data across customer boundaries, so it needs the
+    // durable, tamper-evident trail — not just the Loki operator line.
+    'registry.image.copy',
+    // Messaging (api/message) — admin BROADCAST announcements + destructive
+    // deletes. 1:1 user messages are intentionally NOT audited (noise + they would
+    // pull private content into the trail). `details` carry metadata only
+    // (subject/type/scope), NEVER message body content.
+    'message.announcement.create',
+    'message.delete',
+    'message.restore',
+    // Manual on-demand PURGE (permanent hard-delete) of an already-soft-deleted
+    // message tombstone — the destructive finalizer the retention sweep would
+    // otherwise perform at the purge deadline. `details` carry metadata only.
+    'message.purge',
+    // Billing (api/billing) — subscription + entitlement mutations, mirrored to the
+    // central audit trail (these also write to the service-local billing_events
+    // collection). `details` carry plan/tier/addon ids only — never card/payment
+    // secrets or an AWS account id.
+    'billing.subscription.cancel',
+    'billing.subscription.delete',
+    'billing.tier.override',
+    'billing.addon.add',
+    'billing.addon.remove',
+    // System-initiated removal of a tier-included add-on on a plan upgrade (the
+    // account's new tier now bundles the feature) — distinct from a user-initiated
+    // `remove` so finance can tell an auto-prune from a customer action.
+    'billing.addon.prune',
+    // Discounts (docs/billing-discounts.md) — mint/issue/apply/remove/revoke of a
+    // price coupon or usage credit. `details` carry the discount id + kind/value
+    // only, never the opaque token or signing key.
+    'billing.discount.generate',
+    'billing.discount.issue',
+    'billing.discount.apply',
+    'billing.discount.remove',
+    'billing.discount.revoke',
+    // Promotions (docs/billing-discounts.md#promotions) — rule-driven auto-grant
+    // campaigns. `details` carry the promotion id + cents/event only.
+    'billing.promotion.create',
+    'billing.promotion.update',
+    'billing.promotion.revoke',
+    'billing.promotion.grant',
+    'billing.promotion.activate',
+    // Usage-credit realization — a customer/compliance-visible record of credit
+    // movement: `consumed` (Marketplace metered drawdown), `exhausted` (balance hit
+    // zero), and a combo ending. `details` carry cents/ids only, no payment secrets.
+    'billing.credit.consumed',
+    'billing.credit.exhausted',
+    'billing.combo.expired',
+    // Denied authorization attempt — emitted best-effort by the shared
+    // `requirePermission` / `requireSystemAdmin` gate when a state-changing
+    // (non-GET) request is rejected, so probing/escalation attempts are visible
+    // rather than invisible. `details` carries the required permission + path;
+    // `outcome` is 'failure'.
+    'authz.denied',
+    // "Ask" assistant activity — visibility into what the assistant did on a user's
+    // behalf. `ask.query` is a read-only how-to turn; `ask.agent.turn` is a tool-calling
+    // turn. `details` carry SAFE METADATA ONLY (tools used, proposal kinds, query
+    // length, outcome), never the raw query text.
+    'ask.query',
+    'ask.agent.turn',
+];
+/** Whether `value` is an action a remote service may emit (the ingest allow-list). */
+export function isRemoteAuditAction(value) {
+    return REMOTE_AUDIT_ACTIONS.includes(value);
+}
+/**
+ * Construct a remote-audit client targeted at the platform service.
+ *
+ * Used by api/plugin's build worker to push `plugin.build.*` events into
+ * the platform's MongoDB `audit_events` collection. Other services
+ * with worker-style emitters can use the same client.
+ *
+ * @example
+ * ```typescript
+ * const auditClient = createRemoteAuditClient();
+ * auditClient.record({
+ * action: 'plugin.build.completed',
+ * actorId: 'user-123',
+ * orgId: 'org-acme',
+ * targetType: 'plugin',
+ * targetId: 'plugin-abc',
+ * details: { name: 'my-plugin', version: '1.0.0' },
+ * }, 'plugin');
+ * ```
+ */
+export function createRemoteAuditClient(config = {}) {
+    const serviceConfig = {
+        host: config.host ?? process.env.PLATFORM_SERVICE_HOST ?? 'platform',
+        port: config.port ?? parseInt(process.env.PLATFORM_SERVICE_PORT ?? '3000', 10),
+        timeout: config.timeout ?? 3000,
+    };
+    const client = createSafeClient(serviceConfig);
+    const spool = config.spool;
+    const drainBatchSize = config.drainBatchSize ?? 100;
+    /**
+     * Attempt ONE live delivery. Resolves `true` on a 2xx accept, `false` on any
+     * non-2xx / thrown error (the http-client has already applied the retry
+     * budget). A stable per-emission `Idempotency-Key` makes this non-idempotent
+     * POST retry-safe and lets the platform ingest dedup a re-delivered event
+     * instead of writing a duplicate audit row (and duplicate chain link).
+     * `Idempotency-Key` is derived from the event so a SPOOLED re-delivery reuses
+     * the same key as its original live attempt — the two collapse to one row.
+     */
+    async function deliver(event, serviceName) {
+        const authHeader = getServiceAuthHeader({ serviceName, orgId: event.orgId, role: 'member' });
+        const headers = {
+            'Authorization': authHeader,
+            'Idempotency-Key': event.idempotencyKey ?? randomUUID(),
+        };
+        try {
+            const response = await client.post('/audit/events', event, { headers, ...AUDIT_REQUEST_OPTIONS });
+            const ok = !!response && response.statusCode >= 200 && response.statusCode < 300;
+            if (!ok) {
+                logger.warn('Remote audit ingest non-ok', { action: event.action, statusCode: response?.statusCode });
+            }
+            return ok;
+        }
+        catch (err) {
+            logger.warn('Remote audit ingest threw', { action: event.action, error: err instanceof Error ? err.message : String(err) });
+            return false;
+        }
+    }
+    // Serialize spool drains so a periodic tick and an on-success drain can't both
+    // pull the same batch. Stops early the moment a re-delivery fails (platform
+    // still down) so we don't hammer it or churn the buffer.
+    let draining = false;
+    async function drain() {
+        if (!spool || draining)
+            return;
+        draining = true;
+        try {
+            for (;;) {
+                const batch = await spool.take(drainBatchSize);
+                if (batch.length === 0)
+                    return;
+                const delivered = [];
+                const failed = [];
+                let platformDown = false;
+                for (const entry of batch) {
+                    if (platformDown) {
+                        failed.push(entry);
+                        continue;
+                    }
+                    const ok = await deliver(entry.event, entry.serviceName);
+                    if (ok) {
+                        delivered.push(entry);
+                        emitCounter('audit_spool_redelivered_total', { service: entry.serviceName });
+                    }
+                    else {
+                        platformDown = true;
+                        failed.push(entry);
+                    }
+                }
+                // Acknowledge the delivered prefix so it clears the in-progress list; the
+                // reliable take() moved the whole batch there, so unacked survivors are
+                // reclaimed by recover() after a crash rather than being silently lost.
+                if (delivered.length > 0)
+                    await spool.ack(delivered);
+                if (failed.length > 0) {
+                    await spool.requeue(failed);
+                    return; // still down — try again on the next tick
+                }
+            }
+        }
+        catch (err) {
+            logger.warn('Audit spool drain failed', { error: err instanceof Error ? err.message : String(err) });
+        }
+        finally {
+            draining = false;
+        }
+    }
+    let drainTimer;
+    if (spool) {
+        // Reclaim any batch stranded on the in-progress list by a prior crash, then
+        // attempt to flush it. Both are best-effort (the spool swallows its errors).
+        void spool.recover().then(() => drain());
+        drainTimer = setInterval(() => { void drain(); }, config.drainIntervalMs ?? 30_000);
+        // Don't let the drain timer keep the process alive on shutdown.
+        drainTimer.unref?.();
+    }
+    return {
+        record(event, serviceName) {
+            // Stamp when the action actually occurred (survives spool delay) and pin a
+            // stable idempotency key so a live attempt and its spooled retry dedup.
+            const stamped = {
+                ...event,
+                occurredAt: event.occurredAt ?? new Date().toISOString(),
+                idempotencyKey: event.idempotencyKey ?? randomUUID(),
+            };
+            void deliver(stamped, serviceName).then((ok) => {
+                if (ok) {
+                    emitCounter('audit_emitted_total', { service: serviceName, outcome: stamped.outcome ?? 'success' });
+                    if (spool)
+                        void drain(); // platform is reachable — flush any backlog
+                }
+                else if (spool) {
+                    void spool.enqueue({ event: stamped, serviceName });
+                }
+                else {
+                    emitCounter('audit_dropped_total', { service: serviceName });
+                }
+            });
+        },
+        close() {
+            if (drainTimer) {
+                clearInterval(drainTimer);
+                drainTimer = undefined;
+            }
+        },
+    };
+}
+/**
+ * Register the standard `authz.denied` sink used by every remote-audit service
+ * (pipeline, plugin, compliance, quota, message, billing, reporting, …).
+ *
+ * The shared `requireAuth` gate forwards each DENIED state-changing request to
+ * the auditor set via {@link setAuthzDenialAuditor}; this wires that hook to the
+ * service's {@link RemoteAuditClient}, forwarding a `failure`-outcome
+ * `authz.denied` event so probing / privilege-escalation attempts leave a trail.
+ * Emission is fire-and-forget (the client never throws). `getClient` is a getter
+ * so the client stays lazily constructed (services memoize it on first use).
+ *
+ * Platform is intentionally NOT a caller — it is the audit authority and writes
+ * `authz.denied` straight to its local store (with `affectedOrgId`), not through
+ * a RemoteAuditClient.
+ */
+export function wireAuthzDenialAuditor(serviceName, getClient) {
+    setAuthzDenialAuditor((info) => getClient().record({
+        action: 'authz.denied',
+        actorId: info.actorId ?? 'anonymous',
+        actorEmail: info.actorEmail,
+        orgId: info.orgId,
+        outcome: 'failure',
+        details: { method: info.method, path: info.path, required: info.required },
+    }, serviceName));
+}
+/**
+ * Build a service's audit client: a RemoteAuditClient wired to the durable Redis
+ * spool (from ambient env; null → no spool) with `serviceName` bound. Construct
+ * ONCE per process — memoize behind a lazy `getAuditClient()` in the service's
+ * `services/audit.ts`. Pass `config.spool` to override the env-derived spool
+ * (e.g. reuse a service's existing ioredis connection).
+ */
+export function createServiceAuditClient(serviceName, config = {}) {
+    const spool = config.spool ?? createEnvRedisAuditSpool() ?? undefined;
+    const client = createRemoteAuditClient({ ...config, spool });
+    return {
+        emit: (event) => client.record(event, serviceName),
+        client,
+    };
+}
+/**
+ * Lazily-constructed remote-audit accessor for a service. Every service's
+ * `services/audit.ts` used to hand-roll the same module singleton (a `let audit`
+ * + `svc()` that builds a {@link ServiceAuditClient} on first use, then a
+ * `getAuditClient()` returning `.client` and an `emit(event)` forwarding to
+ * `.emit`). This packages that pattern in ONE place so each service's audit
+ * wiring is a one-liner and can't drift.
+ *
+ * Lazy on purpose: the underlying client wires an env-Redis audit spool, so
+ * building it at import time would force that connection wherever the module is
+ * merely imported (e.g. tests). `getAuditClient` is passed to
+ * `wireAuthzDenialAuditor`; `emit` backs the per-service `emitXAudit` helpers.
+ * Both stay FIRE-AND-FORGET (record never throws / is not awaited).
+ */
+export function createRemoteAuditAccessor(serviceName) {
+    let audit = null;
+    const svc = () => {
+        if (!audit)
+            audit = createServiceAuditClient(serviceName);
+        return audit;
+    };
+    return {
+        getAuditClient: () => svc().client,
+        emit: (event) => svc().emit(event),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLWF1ZGl0LWNsaWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2aWNlcy9yZW1vdGUtYXVkaXQtY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLFFBQVEsQ0FBQztBQUNwQyxPQUFPLEVBQUUsd0JBQXdCLEVBQXlDLE1BQU0sa0JBQWtCLENBQUM7QUFDbkcsT0FBTyxFQUFFLGdCQUFnQixFQUF1QixNQUFNLGtCQUFrQixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxxQkFBcUIsRUFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUUxRyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDbEQsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBRXpELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxjQUFjLENBQUMsQ0FBQztBQUU1Qzs7Ozs7Ozs7R0FRRztBQUNILE1BQU0scUJBQXFCLEdBQStEO0lBQ3hGLG1CQUFtQixFQUFFLENBQUM7SUFDdEIsVUFBVSxFQUFFLENBQUM7Q0FDZCxDQUFDO0FBRUY7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHO0lBQ2xDLHdCQUF3QjtJQUN4QixxQkFBcUI7SUFDckIsc0JBQXNCO0lBQ3RCLDZFQUE2RTtJQUM3RSwrRUFBK0U7SUFDL0UscUVBQXFFO0lBQ3JFLGVBQWU7SUFDZixnQkFBZ0I7SUFDaEIsNEVBQTRFO0lBQzVFLHdFQUF3RTtJQUN4RSxjQUFjO0lBQ2QsZUFBZTtJQUNmLGVBQWU7SUFDZixlQUFlO0lBQ2YsOEVBQThFO0lBQzlFLDRFQUE0RTtJQUM1RSxvQkFBb0I7SUFDcEIsb0JBQW9CO0lBQ3BCLGtCQUFrQjtJQUNsQixnRUFBZ0U7SUFDaEUscUVBQXFFO0lBQ3JFLG9EQUFvRDtJQUNwRCxpQkFBaUI7SUFDakIsaUJBQWlCO0lBQ2pCLGlCQUFpQjtJQUNqQixrQkFBa0I7SUFDbEIsbUVBQW1FO0lBQ25FLDRFQUE0RTtJQUM1RSwwREFBMEQ7SUFDMUQsZ0JBQWdCO0lBQ2hCLDBCQUEwQjtJQUMxQiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDJCQUEyQjtJQUMzQix5QkFBeUI7SUFDekIsMEJBQTBCO0lBQzFCLDJCQUEyQjtJQUMzQixpRkFBaUY7SUFDakYsb0ZBQW9GO0lBQ3BGLDRCQUE0QjtJQUM1Qiw4QkFBOEI7SUFDOUIsMkVBQTJFO0lBQzNFLDBFQUEwRTtJQUMxRSxtREFBbUQ7SUFDbkQsYUFBYTtJQUNiLG9CQUFvQjtJQUNwQix3REFBd0Q7SUFDeEQsY0FBYztJQUNkLGdGQUFnRjtJQUNoRix1RUFBdUU7SUFDdkUsNkVBQTZFO0lBQzdFLGlGQUFpRjtJQUNqRiw4QkFBOEI7SUFDOUIsNkJBQTZCO0lBQzdCLHdCQUF3QjtJQUN4Qix3QkFBd0I7SUFDeEIsd0JBQXdCO0lBQ3hCLHdCQUF3QjtJQUN4Qix5QkFBeUI7SUFDekIsaUZBQWlGO0lBQ2pGLGlGQUFpRjtJQUNqRiw4RUFBOEU7SUFDOUUsdUJBQXVCO0lBQ3ZCLDBCQUEwQjtJQUMxQiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDJCQUEyQjtJQUMzQix5QkFBeUI7SUFDekIsaUNBQWlDO0lBQ2pDLGlDQUFpQztJQUNqQyxpQ0FBaUM7SUFDakMsMkJBQTJCO0lBQzNCLHdCQUF3QjtJQUN4QiwyRUFBMkU7SUFDM0Usc0VBQXNFO0lBQ3RFLGFBQWE7SUFDYix1QkFBdUI7SUFDdkIsMEVBQTBFO0lBQzFFLDJFQUEyRTtJQUMzRSxtRUFBbUU7SUFDbkUscUJBQXFCO0lBQ3JCLHdFQUF3RTtJQUN4RSwrRUFBK0U7SUFDL0Usc0VBQXNFO0lBQ3RFLG9EQUFvRDtJQUNwRCw2QkFBNkI7SUFDN0IsZ0JBQWdCO0lBQ2hCLGlCQUFpQjtJQUNqQiw0RUFBNEU7SUFDNUUsMEVBQTBFO0lBQzFFLDBFQUEwRTtJQUMxRSxlQUFlO0lBQ2YsZ0ZBQWdGO0lBQ2hGLDRFQUE0RTtJQUM1RSw2RUFBNkU7SUFDN0UsZ0NBQWdDO0lBQ2hDLDZCQUE2QjtJQUM3Qiw2QkFBNkI7SUFDN0IsdUJBQXVCO0lBQ3ZCLG1CQUFtQjtJQUNuQixzQkFBc0I7SUFDdEIsNEVBQTRFO0lBQzVFLCtFQUErRTtJQUMvRSxxRUFBcUU7SUFDckUscUJBQXFCO0lBQ3JCLDhFQUE4RTtJQUM5RSw2RUFBNkU7SUFDN0UsK0NBQStDO0lBQy9DLDJCQUEyQjtJQUMzQix3QkFBd0I7SUFDeEIsd0JBQXdCO0lBQ3hCLHlCQUF5QjtJQUN6Qix5QkFBeUI7SUFDekIsNkVBQTZFO0lBQzdFLGtFQUFrRTtJQUNsRSwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQix5QkFBeUI7SUFDekIsNEJBQTRCO0lBQzVCLDRFQUE0RTtJQUM1RSxnRkFBZ0Y7SUFDaEYsaUZBQWlGO0lBQ2pGLHlCQUF5QjtJQUN6QiwwQkFBMEI7SUFDMUIsdUJBQXVCO0lBQ3ZCLG1FQUFtRTtJQUNuRSx3RUFBd0U7SUFDeEUsNEVBQTRFO0lBQzVFLDJFQUEyRTtJQUMzRSwwQkFBMEI7SUFDMUIsY0FBYztJQUNkLGdGQUFnRjtJQUNoRixxRkFBcUY7SUFDckYsOEVBQThFO0lBQzlFLDhDQUE4QztJQUM5QyxXQUFXO0lBQ1gsZ0JBQWdCO0NBQ1IsQ0FBQztBQUlYLHNGQUFzRjtBQUN0RixNQUFNLFVBQVUsbUJBQW1CLENBQUMsS0FBYTtJQUMvQyxPQUFRLG9CQUEwQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNyRSxDQUFDO0FBMEVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBbUJHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUFDLE1BQU0sR0FBNEIsRUFBRTtJQUMxRSxNQUFNLGFBQWEsR0FBa0I7UUFDbkMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxVQUFVO1FBQ3BFLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHFCQUFxQixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7UUFDOUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLElBQUksSUFBSTtLQUNoQyxDQUFDO0lBQ0YsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDL0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQztJQUMzQixNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsY0FBYyxJQUFJLEdBQUcsQ0FBQztJQUVwRDs7Ozs7Ozs7T0FRRztJQUNILEtBQUssVUFBVSxPQUFPLENBQUMsS0FBdUIsRUFBRSxXQUFtQjtRQUNqRSxNQUFNLFVBQVUsR0FBRyxvQkFBb0IsQ0FBQyxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUM3RixNQUFNLE9BQU8sR0FBMkI7WUFDdEMsZUFBZSxFQUFFLFVBQVU7WUFDM0IsaUJBQWlCLEVBQUUsS0FBSyxDQUFDLGNBQWMsSUFBSSxVQUFVLEVBQUU7U0FDeEQsQ0FBQztRQUNGLElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsS0FBSyxFQUFFLEVBQUUsT0FBTyxFQUFFLEdBQUcscUJBQXFCLEVBQUUsQ0FBQyxDQUFDO1lBQ2xHLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLFVBQVUsSUFBSSxHQUFHLElBQUksUUFBUSxDQUFDLFVBQVUsR0FBRyxHQUFHLENBQUM7WUFDakYsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO2dCQUNSLE1BQU0sQ0FBQyxJQUFJLENBQUMsNEJBQTRCLEVBQUUsRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7WUFDeEcsQ0FBQztZQUNELE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixFQUFFLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDNUgsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO0lBQ0gsQ0FBQztJQUVELCtFQUErRTtJQUMvRSw0RUFBNEU7SUFDNUUseURBQXlEO0lBQ3pELElBQUksUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNyQixLQUFLLFVBQVUsS0FBSztRQUNsQixJQUFJLENBQUMsS0FBSyxJQUFJLFFBQVE7WUFBRSxPQUFPO1FBQy9CLFFBQVEsR0FBRyxJQUFJLENBQUM7UUFDaEIsSUFBSSxDQUFDO1lBQ0gsU0FBUyxDQUFDO2dCQUNSLE1BQU0sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztnQkFDL0MsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7b0JBQUUsT0FBTztnQkFDL0IsTUFBTSxTQUFTLEdBQXNCLEVBQUUsQ0FBQztnQkFDeEMsTUFBTSxNQUFNLEdBQXNCLEVBQUUsQ0FBQztnQkFDckMsSUFBSSxZQUFZLEdBQUcsS0FBSyxDQUFDO2dCQUN6QixLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssRUFBRSxDQUFDO29CQUMxQixJQUFJLFlBQVksRUFBRSxDQUFDO3dCQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7d0JBQUMsU0FBUztvQkFBQyxDQUFDO29CQUNuRCxNQUFNLEVBQUUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztvQkFDekQsSUFBSSxFQUFFLEVBQUUsQ0FBQzt3QkFDUCxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO3dCQUN0QixXQUFXLENBQUMsK0JBQStCLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7b0JBQy9FLENBQUM7eUJBQU0sQ0FBQzt3QkFDTixZQUFZLEdBQUcsSUFBSSxDQUFDO3dCQUNwQixNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUNyQixDQUFDO2dCQUNILENBQUM7Z0JBQ0QsMEVBQTBFO2dCQUMxRSx3RUFBd0U7Z0JBQ3hFLHdFQUF3RTtnQkFDeEUsSUFBSSxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUM7b0JBQUUsTUFBTSxLQUFLLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUNyRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ3RCLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztvQkFDNUIsT0FBTyxDQUFDLDBDQUEwQztnQkFDcEQsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMsMEJBQTBCLEVBQUUsRUFBRSxLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN2RyxDQUFDO2dCQUFTLENBQUM7WUFDVCxRQUFRLEdBQUcsS0FBSyxDQUFDO1FBQ25CLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxVQUFzRCxDQUFDO0lBQzNELElBQUksS0FBSyxFQUFFLENBQUM7UUFDViw0RUFBNEU7UUFDNUUsNkVBQTZFO1FBQzdFLEtBQUssS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3pDLFVBQVUsR0FBRyxXQUFXLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsZUFBZSxJQUFJLE1BQU0sQ0FBQyxDQUFDO1FBQ3BGLGdFQUFnRTtRQUMvRCxVQUFnRCxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUM7SUFDOUQsQ0FBQztJQUVELE9BQU87UUFDTCxNQUFNLENBQUMsS0FBSyxFQUFFLFdBQVc7WUFDdkIsMkVBQTJFO1lBQzNFLHdFQUF3RTtZQUN4RSxNQUFNLE9BQU8sR0FBcUI7Z0JBQ2hDLEdBQUcsS0FBSztnQkFDUixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtnQkFDeEQsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLElBQUksVUFBVSxFQUFFO2FBQ3JELENBQUM7WUFDRixLQUFLLE9BQU8sQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUU7Z0JBQzdDLElBQUksRUFBRSxFQUFFLENBQUM7b0JBQ1AsV0FBVyxDQUFDLHFCQUFxQixFQUFFLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sSUFBSSxTQUFTLEVBQUUsQ0FBQyxDQUFDO29CQUNwRyxJQUFJLEtBQUs7d0JBQUUsS0FBSyxLQUFLLEVBQUUsQ0FBQyxDQUFDLDRDQUE0QztnQkFDdkUsQ0FBQztxQkFBTSxJQUFJLEtBQUssRUFBRSxDQUFDO29CQUNqQixLQUFLLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7Z0JBQ3RELENBQUM7cUJBQU0sQ0FBQztvQkFDTixXQUFXLENBQUMscUJBQXFCLEVBQUUsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztnQkFDL0QsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELEtBQUs7WUFDSCxJQUFJLFVBQVUsRUFBRSxDQUFDO2dCQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFBQyxVQUFVLEdBQUcsU0FBUyxDQUFDO1lBQUMsQ0FBQztRQUN4RSxDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7Ozs7R0FjRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FBQyxXQUFtQixFQUFFLFNBQWtDO0lBQzVGLHFCQUFxQixDQUFDLENBQUMsSUFBcUIsRUFBRSxFQUFFLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxDQUFDO1FBQ2xFLE1BQU0sRUFBRSxjQUFjO1FBQ3RCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxJQUFJLFdBQVc7UUFDcEMsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO1FBQzNCLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztRQUNqQixPQUFPLEVBQUUsU0FBUztRQUNsQixPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRTtLQUMzRSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFDbkIsQ0FBQztBQWVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSx3QkFBd0IsQ0FBQyxXQUFtQixFQUFFLE1BQU0sR0FBNEIsRUFBRTtJQUNoRyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxJQUFJLHdCQUF3QixFQUFFLElBQUksU0FBUyxDQUFDO0lBQ3RFLE1BQU0sTUFBTSxHQUFHLHVCQUF1QixDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUM3RCxPQUFPO1FBQ0wsSUFBSSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUM7UUFDbEQsTUFBTTtLQUNQLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILE1BQU0sVUFBVSx5QkFBeUIsQ0FBQyxXQUFtQjtJQUkzRCxJQUFJLEtBQUssR0FBOEIsSUFBSSxDQUFDO0lBQzVDLE1BQU0sR0FBRyxHQUFHLEdBQXVCLEVBQUU7UUFDbkMsSUFBSSxDQUFDLEtBQUs7WUFBRSxLQUFLLEdBQUcsd0JBQXdCLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDMUQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDLENBQUM7SUFDRixPQUFPO1FBQ0wsY0FBYyxFQUFFLEdBQUcsRUFBRSxDQUFDLEdBQUcsRUFBRSxDQUFDLE1BQU07UUFDbEMsSUFBSSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO0tBQ25DLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IHJhbmRvbVVVSUQgfSBmcm9tICdjcnlwdG8nO1xuaW1wb3J0IHsgY3JlYXRlRW52UmVkaXNBdWRpdFNwb29sLCB0eXBlIEF1ZGl0U3Bvb2wsIHR5cGUgQXVkaXRTcG9vbEVudHJ5IH0gZnJvbSAnLi9hdWRpdC1zcG9vbC5qcyc7XG5pbXBvcnQgeyBjcmVhdGVTYWZlQ2xpZW50LCB0eXBlIFJlcXVlc3RPcHRpb25zIH0gZnJvbSAnLi9odHRwLWNsaWVudC5qcyc7XG5pbXBvcnQgeyBnZXRTZXJ2aWNlQXV0aEhlYWRlciwgc2V0QXV0aHpEZW5pYWxBdWRpdG9yLCB0eXBlIEF1dGh6RGVuaWFsSW5mbyB9IGZyb20gJy4uL21pZGRsZXdhcmUvYXV0aC5qcyc7XG5pbXBvcnQgdHlwZSB7IFNlcnZpY2VDb25maWcgfSBmcm9tICcuLi90eXBlcy9jb21tb24uanMnO1xuaW1wb3J0IHsgY3JlYXRlTG9nZ2VyIH0gZnJvbSAnLi4vdXRpbHMvbG9nZ2VyLmpzJztcbmltcG9ydCB7IGVtaXRDb3VudGVyIH0gZnJvbSAnLi4vdXRpbHMvbWV0cmljLWVtaXR0ZXIuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ3JlbW90ZS1hdWRpdCcpO1xuXG4vKipcbiAqIEF1ZGl0IGluZ2VzdCBpcyBiZXN0LWVmZm9ydCBhbmQgTVVTVCBOT1QgYmxvY2sgdGhlIGNhbGxlciwgYnV0IGEgdHJhbnNpZW50XG4gKiBmYWlsdXJlICg0MjkgLyA1eHggLyBjb25uZWN0aW9uIHJlc2V0IC8gdGltZW91dCkgc2hvdWxkIG5vdCBzaWxlbnRseSBkcm9wIHRoZVxuICogcm93IG9uIHRoZSBmaXJzdCBhdHRlbXB0LiBFYWNoIGVtaXNzaW9uIGNhcnJpZXMgYSBzdGFibGUgcGVyLWV2ZW50XG4gKiBgSWRlbXBvdGVuY3ktS2V5YCAoc2VlIGByZWNvcmRgKSwgc28gdGhlIGh0dHAtY2xpZW50IHRyZWF0cyB0aGUgUE9TVCBhc1xuICogcmV0cnktc2FmZSBhbmQgdGhlIHBsYXRmb3JtIGNhbiBkZWR1cCBhIHJldHJpZWQgZGVsaXZlcnkgaW5zdGVhZCBvZiB3cml0aW5nIGFcbiAqIGR1cGxpY2F0ZSByb3cuIEJ1ZGdldCBpcyBrZXB0IHNtYWxsIHNvIGEgaGFyZC1kb3duIHBsYXRmb3JtIGNhbid0IGJhY2sgdGhlXG4gKiB3b3JrZXIgdXAgZm9yIGxvbmc6IGJhc2UgZGVsYXkgw5coMiByZXRyaWVzKSArIGEgY291cGxlIG9mIDQyOSBiYWNrb2Zmcy5cbiAqL1xuY29uc3QgQVVESVRfUkVRVUVTVF9PUFRJT05TOiBQaWNrPFJlcXVlc3RPcHRpb25zLCAnbWF4UmF0ZUxpbWl0UmV0cmllcycgfCAnbWF4UmV0cmllcyc+ID0ge1xuICBtYXhSYXRlTGltaXRSZXRyaWVzOiAyLFxuICBtYXhSZXRyaWVzOiAyLFxufTtcblxuLyoqXG4gKiBUaGUgZXhhY3Qgc2V0IG9mIGF1ZGl0IGFjdGlvbnMgYSBOT04tUExBVEZPUk0gKHJlbW90ZSkgc2VydmljZSBpcyBwZXJtaXR0ZWQgdG9cbiAqIGVtaXQgdGhyb3VnaCBgUE9TVCAvYXVkaXQvZXZlbnRzYC4gVGhpcyBpcyB0aGUgU0lOR0xFIFNPVVJDRSDigJQgYFJlbW90ZUF1ZGl0QWN0aW9uYFxuICogaXMgZGVyaXZlZCBmcm9tIGl0LCBzbyB0aGUgdHlwZSBhbmQgdGhlIHJ1bnRpbWUgYWxsb3ctbGlzdCBjYW4gbmV2ZXIgZHJpZnQuXG4gKlxuICogU0VDVVJJVFk6IHBsYXRmb3JtJ3MgaW5nZXN0IHZhbGlkYXRlcyBgYWN0aW9uYCBhZ2FpbnN0IHRoaXMgc3Vic2V0ICh2aWFcbiAqIHtAbGluayBpc1JlbW90ZUF1ZGl0QWN0aW9ufSksIE5PVCB0aGUgZnVsbCBwbGF0Zm9ybSBgQXVkaXRBY3Rpb25gIHVuaW9uIOKAlCBhXG4gKiBgc2VydmljZToqYCB0b2tlbiBtdXN0IG5vdCBiZSBhYmxlIHRvIGZvcmdlIHBsYXRmb3JtLWF1dGhvcml0eSBldmVudHNcbiAqIChgYWRtaW4uc3VwZXJhZG1pbi5ncmFudGAsIGBvcmcub3duZXJzaGlwLnRyYW5zZmVyYCwgYHVzZXIubG9naW5gLCDigKYpLiBLZWVwXG4gKiB0aGlzIGxpc3QgZnJlZSBvZiBhbnkgcGxhdGZvcm0tb25seSBhY3Rpb24uXG4gKi9cbmV4cG9ydCBjb25zdCBSRU1PVEVfQVVESVRfQUNUSU9OUyA9IFtcbiAgJ3BsdWdpbi5idWlsZC5jb21wbGV0ZWQnLFxuICAncGx1Z2luLmJ1aWxkLmZhaWxlZCcsXG4gICdwbHVnaW4uYnVpbGQudGltZW91dCcsXG4gIC8vIFBsdWdpbiBsaWZlY3ljbGUgbXV0YXRpb25zIChhcGkvcGx1Z2luIHJvdXRlIGhhbmRsZXJzKSDigJQgdGhlIGRlc3RydWN0aXZlIC9cbiAgLy8gcHVibGlzaGluZyBzdXJmYWNlIHRoYXQgYnVpbGRzIGFscmVhZHkgYXVkaXQncyBjb3VudGVycGFydDogcmVnaXN0cnkgZGVsZXRlLFxuICAvLyBzb3VyY2UgdXBsb2FkLCBhbmQgZGVwbG95LXRvLWNsdXN0ZXIuIGB0YXJnZXRJZGAgaXMgdGhlIHBsdWdpbiBpZC5cbiAgJ3BsdWdpbi5kZWxldGUnLFxuICAncGx1Z2luLnJlc3RvcmUnLFxuICAvLyBNYW51YWwgcHVyZ2U6IHBlcm1hbmVudCBoYXJkLWRlbGV0ZSBvZiBhIHNvZnQtZGVsZXRlZCBwbHVnaW4gdG9tYnN0b25lIG9uXG4gIC8vIGRlbWFuZCAoZmluYWxpemVzIHdoYXQgdGhlIHJldGVudGlvbiBzd2VlcCB3b3VsZCBvdGhlcndpc2UgZG8gbGF0ZXIpLlxuICAncGx1Z2luLnB1cmdlJyxcbiAgJ3BsdWdpbi51cGRhdGUnLFxuICAncGx1Z2luLnVwbG9hZCcsXG4gICdwbHVnaW4uZGVwbG95JyxcbiAgLy8gUGx1Z2luIGJ1bGsgbXV0YXRpb25zIChhcGkvcGx1Z2luIGJ1bGstcGx1Z2luIHJvdXRlKSArIERMUSBwdXJnZSAoZHJvcHMgYWxsXG4gIC8vIGRlYWQtbGV0dGVyZWQgYnVpbGQgam9icywgY3Jvc3Mtb3JnLCBzeXNhZG1pbikuIGBkZXRhaWxzYCBjYXJyaWVzIGNvdW50cy5cbiAgJ3BsdWdpbi5idWxrLnVwZGF0ZScsXG4gICdwbHVnaW4uYnVsay5kZWxldGUnLFxuICAncGx1Z2luLmRscS5wdXJnZScsXG4gIC8vIFBpcGVsaW5lIG11dGF0aW9ucyDigJQgZW1pdHRlZCBieSBhcGkvcGlwZWxpbmUncyByb3V0ZSBoYW5kbGVyc1xuICAvLyAoY3JlYXRlL3VwZGF0ZS9kZWxldGUgKyBDb2RlUGlwZWxpbmUgZXhlY3V0aW9uIHRyaWdnZXIvY2FuY2VsKSBhbmRcbiAgLy8gcG9zdGVkIHRvIHBsYXRmb3JtJ3MgYFBPU1QgL2F1ZGl0L2V2ZW50c2AgaW5nZXN0LlxuICAncGlwZWxpbmUuY3JlYXRlJyxcbiAgJ3BpcGVsaW5lLnVwZGF0ZScsXG4gICdwaXBlbGluZS5kZWxldGUnLFxuICAncGlwZWxpbmUucmVzdG9yZScsXG4gIC8vIE1hbnVhbCBwdXJnZTogcGVybWFuZW50IGhhcmQtZGVsZXRlIG9mIGEgc29mdC1kZWxldGVkIHBpcGVsaW5lIC9cbiAgLy8gcGlwZWxpbmVfdGVtcGxhdGUgdG9tYnN0b25lIG9uIGRlbWFuZCAoZmluYWxpemVzIHdoYXQgdGhlIHJldGVudGlvbiBzd2VlcFxuICAvLyB3b3VsZCBvdGhlcndpc2UgZG8gbGF0ZXIpLiBgdGFyZ2V0SWRgIGlzIHRoZSBwdXJnZWQgaWQuXG4gICdwaXBlbGluZS5wdXJnZScsXG4gICdwaXBlbGluZV90ZW1wbGF0ZS5jcmVhdGUnLFxuICAncGlwZWxpbmVfdGVtcGxhdGUudXBkYXRlJyxcbiAgJ3BpcGVsaW5lX3RlbXBsYXRlLmRlbGV0ZScsXG4gICdwaXBlbGluZV90ZW1wbGF0ZS5yZXN0b3JlJyxcbiAgJ3BpcGVsaW5lX3RlbXBsYXRlLnB1cmdlJyxcbiAgJ3BpcGVsaW5lLmV4ZWN1dGlvbi5zdGFydCcsXG4gICdwaXBlbGluZS5leGVjdXRpb24uY2FuY2VsJyxcbiAgLy8gQ29kZVBpcGVsaW5lIEFSTi1yZWdpc3RyeSBjb25maWcgKGFwaS9waXBlbGluZSByZWdpc3RyeSByb3V0ZSkg4oCUIHJlZ2lzdGVyaW5nIC9cbiAgLy8gZGVyZWdpc3RlcmluZyB0aGUgZXh0ZXJuYWwgQ29kZVBpcGVsaW5lIHRoYXQgYmFja3MgYSBwaXBlbGluZSAoZGVwbG95LWFmZmVjdGluZykuXG4gICdwaXBlbGluZS5yZWdpc3RyeS5yZWdpc3RlcicsXG4gICdwaXBlbGluZS5yZWdpc3RyeS5kZXJlZ2lzdGVyJyxcbiAgLy8gUXVvdGEgYWRtaW5pc3RyYXRpb24gKGFwaS9xdW90YSkg4oCUIGEgc3VwZXJhZG1pbiByZXNldHRpbmcgYW4gb3JnJ3MgdXNhZ2VcbiAgLy8gY291bnRlciBvciBlZGl0aW5nIGl0cyB0aWVyIGxpbWl0cy4gYGFmZmVjdGVkT3JnSWRgIGlzIHRoZSBvcmcgY2hhbmdlZDtcbiAgLy8gYGRldGFpbHNgIGNhcnJpZXMgdGhlIHF1b3RhVHlwZSArIG9sZC9uZXcgdmFsdWUuXG4gICdxdW90YS5yZXNldCcsXG4gICdxdW90YS5saW1pdC51cGRhdGUnLFxuICAvLyBBIHN1cGVyYWRtaW4gZGVsZXRpbmcgYW4gb3JnJ3MgZW50aXJlIHF1b3RhIGRvY3VtZW50LlxuICAncXVvdGEuZGVsZXRlJyxcbiAgLy8gQ29tcGxpYW5jZSBhZG1pbmlzdHJhdGlvbiAoYXBpL2NvbXBsaWFuY2UpIOKAlCB0aGUgZW5mb3JjZW1lbnQtcG9zdHVyZSBzdXJmYWNlLlxuICAvLyBBcHByb3ZpbmcvcmV2b2tpbmcgYW4gZXhlbXB0aW9uLCB0b2dnbGluZy9hdXRob3JpbmcvZGVsZXRpbmcgYSBydWxlLFxuICAvLyBhdXRob3JpbmcvZGVsZXRpbmcgYSBwb2xpY3ksIG1hbmFnaW5nIHNjYW4gc2NoZWR1bGVzLCBhcHBseWluZyBhIHRlbXBsYXRlLFxuICAvLyBvciBjYW5jZWxsaW5nIGEgcnVubmluZyBzY2FuLiBgdGFyZ2V0SWRgIGlzIHRoZSBydWxlL3BvbGljeS9leGVtcHRpb24vc2NhbiBpZC5cbiAgJ2NvbXBsaWFuY2UuZXhlbXB0aW9uLmFwcHJvdmUnLFxuICAnY29tcGxpYW5jZS5leGVtcHRpb24ucmV2b2tlJyxcbiAgJ2NvbXBsaWFuY2UucnVsZS50b2dnbGUnLFxuICAnY29tcGxpYW5jZS5ydWxlLmNyZWF0ZScsXG4gICdjb21wbGlhbmNlLnJ1bGUudXBkYXRlJyxcbiAgJ2NvbXBsaWFuY2UucnVsZS5kZWxldGUnLFxuICAnY29tcGxpYW5jZS5ydWxlLnJlc3RvcmUnLFxuICAvLyBNYW51YWwgb24tZGVtYW5kIGhhcmQtZGVsZXRlIChQVVJHRSkgb2YgYSBzb2Z0LWRlbGV0ZWQgcnVsZS9wb2xpY3kgdG9tYnN0b25lIOKAlFxuICAvLyB0aGUgY2FsbGVyLWluaXRpYXRlZCBjb3VudGVycGFydCB0byB0aGUgcmV0ZW50aW9uIHN3ZWVwJ3MgYXV0by1wdXJnZS4gRGVzdHJveXNcbiAgLy8gdGhlIHRvbWJzdG9uZSBwZXJtYW5lbnRseSwgc28gaXQgY2FycmllcyB0aGUgZHVyYWJsZSwgdGFtcGVyLWV2aWRlbnQgdHJhaWwuXG4gICdjb21wbGlhbmNlLnJ1bGUucHVyZ2UnLFxuICAnY29tcGxpYW5jZS5wb2xpY3kuY3JlYXRlJyxcbiAgJ2NvbXBsaWFuY2UucG9saWN5LnVwZGF0ZScsXG4gICdjb21wbGlhbmNlLnBvbGljeS5kZWxldGUnLFxuICAnY29tcGxpYW5jZS5wb2xpY3kucmVzdG9yZScsXG4gICdjb21wbGlhbmNlLnBvbGljeS5wdXJnZScsXG4gICdjb21wbGlhbmNlLnNjYW4tc2NoZWR1bGUuY3JlYXRlJyxcbiAgJ2NvbXBsaWFuY2Uuc2Nhbi1zY2hlZHVsZS51cGRhdGUnLFxuICAnY29tcGxpYW5jZS5zY2FuLXNjaGVkdWxlLmRlbGV0ZScsXG4gICdjb21wbGlhbmNlLnRlbXBsYXRlLmFwcGx5JyxcbiAgJ2NvbXBsaWFuY2Uuc2Nhbi5jYW5jZWwnLFxuICAvLyBJbWFnZS1yZWdpc3RyeSBkZXN0cnVjdGl2ZSBvcHMgKGFwaS9pbWFnZS1yZWdpc3RyeSkg4oCUIGdhcmJhZ2UtY29sbGVjdGlvblxuICAvLyBzd2VlcHMgYW5kIGV4cGxpY2l0IGltYWdlL3RhZyBkZWxldGVzIChwcmV2aW91c2x5IG9ubHkgYSBsb2cgbGluZSkuXG4gICdyZWdpc3RyeS5nYycsXG4gICdyZWdpc3RyeS5pbWFnZS5kZWxldGUnLFxuICAvLyBDcm9zcy1yZXBvIHRhZy9pbWFnZSBjb3B5IChhcGkvaW1hZ2UtcmVnaXN0cnkgUE9TVCAvYXBpL2ltYWdlcy9jb3B5KS4gQVxuICAvLyBjcm9zcy10ZW5hbnQgY29weSBtb3ZlcyBkYXRhIGFjcm9zcyBjdXN0b21lciBib3VuZGFyaWVzLCBzbyBpdCBuZWVkcyB0aGVcbiAgLy8gZHVyYWJsZSwgdGFtcGVyLWV2aWRlbnQgdHJhaWwg4oCUIG5vdCBqdXN0IHRoZSBMb2tpIG9wZXJhdG9yIGxpbmUuXG4gICdyZWdpc3RyeS5pbWFnZS5jb3B5JyxcbiAgLy8gTWVzc2FnaW5nIChhcGkvbWVzc2FnZSkg4oCUIGFkbWluIEJST0FEQ0FTVCBhbm5vdW5jZW1lbnRzICsgZGVzdHJ1Y3RpdmVcbiAgLy8gZGVsZXRlcy4gMToxIHVzZXIgbWVzc2FnZXMgYXJlIGludGVudGlvbmFsbHkgTk9UIGF1ZGl0ZWQgKG5vaXNlICsgdGhleSB3b3VsZFxuICAvLyBwdWxsIHByaXZhdGUgY29udGVudCBpbnRvIHRoZSB0cmFpbCkuIGBkZXRhaWxzYCBjYXJyeSBtZXRhZGF0YSBvbmx5XG4gIC8vIChzdWJqZWN0L3R5cGUvc2NvcGUpLCBORVZFUiBtZXNzYWdlIGJvZHkgY29udGVudC5cbiAgJ21lc3NhZ2UuYW5ub3VuY2VtZW50LmNyZWF0ZScsXG4gICdtZXNzYWdlLmRlbGV0ZScsXG4gICdtZXNzYWdlLnJlc3RvcmUnLFxuICAvLyBNYW51YWwgb24tZGVtYW5kIFBVUkdFIChwZXJtYW5lbnQgaGFyZC1kZWxldGUpIG9mIGFuIGFscmVhZHktc29mdC1kZWxldGVkXG4gIC8vIG1lc3NhZ2UgdG9tYnN0b25lIOKAlCB0aGUgZGVzdHJ1Y3RpdmUgZmluYWxpemVyIHRoZSByZXRlbnRpb24gc3dlZXAgd291bGRcbiAgLy8gb3RoZXJ3aXNlIHBlcmZvcm0gYXQgdGhlIHB1cmdlIGRlYWRsaW5lLiBgZGV0YWlsc2AgY2FycnkgbWV0YWRhdGEgb25seS5cbiAgJ21lc3NhZ2UucHVyZ2UnLFxuICAvLyBCaWxsaW5nIChhcGkvYmlsbGluZykg4oCUIHN1YnNjcmlwdGlvbiArIGVudGl0bGVtZW50IG11dGF0aW9ucywgbWlycm9yZWQgdG8gdGhlXG4gIC8vIGNlbnRyYWwgYXVkaXQgdHJhaWwgKHRoZXNlIGFsc28gd3JpdGUgdG8gdGhlIHNlcnZpY2UtbG9jYWwgYmlsbGluZ19ldmVudHNcbiAgLy8gY29sbGVjdGlvbikuIGBkZXRhaWxzYCBjYXJyeSBwbGFuL3RpZXIvYWRkb24gaWRzIG9ubHkg4oCUIG5ldmVyIGNhcmQvcGF5bWVudFxuICAvLyBzZWNyZXRzIG9yIGFuIEFXUyBhY2NvdW50IGlkLlxuICAnYmlsbGluZy5zdWJzY3JpcHRpb24uY2FuY2VsJyxcbiAgJ2JpbGxpbmcuc3Vic2NyaXB0aW9uLmRlbGV0ZScsXG4gICdiaWxsaW5nLnRpZXIub3ZlcnJpZGUnLFxuICAnYmlsbGluZy5hZGRvbi5hZGQnLFxuICAnYmlsbGluZy5hZGRvbi5yZW1vdmUnLFxuICAvLyBTeXN0ZW0taW5pdGlhdGVkIHJlbW92YWwgb2YgYSB0aWVyLWluY2x1ZGVkIGFkZC1vbiBvbiBhIHBsYW4gdXBncmFkZSAodGhlXG4gIC8vIGFjY291bnQncyBuZXcgdGllciBub3cgYnVuZGxlcyB0aGUgZmVhdHVyZSkg4oCUIGRpc3RpbmN0IGZyb20gYSB1c2VyLWluaXRpYXRlZFxuICAvLyBgcmVtb3ZlYCBzbyBmaW5hbmNlIGNhbiB0ZWxsIGFuIGF1dG8tcHJ1bmUgZnJvbSBhIGN1c3RvbWVyIGFjdGlvbi5cbiAgJ2JpbGxpbmcuYWRkb24ucHJ1bmUnLFxuICAvLyBEaXNjb3VudHMgKGRvY3MvYmlsbGluZy1kaXNjb3VudHMubWQpIOKAlCBtaW50L2lzc3VlL2FwcGx5L3JlbW92ZS9yZXZva2Ugb2YgYVxuICAvLyBwcmljZSBjb3Vwb24gb3IgdXNhZ2UgY3JlZGl0LiBgZGV0YWlsc2AgY2FycnkgdGhlIGRpc2NvdW50IGlkICsga2luZC92YWx1ZVxuICAvLyBvbmx5LCBuZXZlciB0aGUgb3BhcXVlIHRva2VuIG9yIHNpZ25pbmcga2V5LlxuICAnYmlsbGluZy5kaXNjb3VudC5nZW5lcmF0ZScsXG4gICdiaWxsaW5nLmRpc2NvdW50Lmlzc3VlJyxcbiAgJ2JpbGxpbmcuZGlzY291bnQuYXBwbHknLFxuICAnYmlsbGluZy5kaXNjb3VudC5yZW1vdmUnLFxuICAnYmlsbGluZy5kaXNjb3VudC5yZXZva2UnLFxuICAvLyBQcm9tb3Rpb25zIChkb2NzL2JpbGxpbmctZGlzY291bnRzLm1kI3Byb21vdGlvbnMpIOKAlCBydWxlLWRyaXZlbiBhdXRvLWdyYW50XG4gIC8vIGNhbXBhaWducy4gYGRldGFpbHNgIGNhcnJ5IHRoZSBwcm9tb3Rpb24gaWQgKyBjZW50cy9ldmVudCBvbmx5LlxuICAnYmlsbGluZy5wcm9tb3Rpb24uY3JlYXRlJyxcbiAgJ2JpbGxpbmcucHJvbW90aW9uLnVwZGF0ZScsXG4gICdiaWxsaW5nLnByb21vdGlvbi5yZXZva2UnLFxuICAnYmlsbGluZy5wcm9tb3Rpb24uZ3JhbnQnLFxuICAnYmlsbGluZy5wcm9tb3Rpb24uYWN0aXZhdGUnLFxuICAvLyBVc2FnZS1jcmVkaXQgcmVhbGl6YXRpb24g4oCUIGEgY3VzdG9tZXIvY29tcGxpYW5jZS12aXNpYmxlIHJlY29yZCBvZiBjcmVkaXRcbiAgLy8gbW92ZW1lbnQ6IGBjb25zdW1lZGAgKE1hcmtldHBsYWNlIG1ldGVyZWQgZHJhd2Rvd24pLCBgZXhoYXVzdGVkYCAoYmFsYW5jZSBoaXRcbiAgLy8gemVybyksIGFuZCBhIGNvbWJvIGVuZGluZy4gYGRldGFpbHNgIGNhcnJ5IGNlbnRzL2lkcyBvbmx5LCBubyBwYXltZW50IHNlY3JldHMuXG4gICdiaWxsaW5nLmNyZWRpdC5jb25zdW1lZCcsXG4gICdiaWxsaW5nLmNyZWRpdC5leGhhdXN0ZWQnLFxuICAnYmlsbGluZy5jb21iby5leHBpcmVkJyxcbiAgLy8gRGVuaWVkIGF1dGhvcml6YXRpb24gYXR0ZW1wdCDigJQgZW1pdHRlZCBiZXN0LWVmZm9ydCBieSB0aGUgc2hhcmVkXG4gIC8vIGByZXF1aXJlUGVybWlzc2lvbmAgLyBgcmVxdWlyZVN5c3RlbUFkbWluYCBnYXRlIHdoZW4gYSBzdGF0ZS1jaGFuZ2luZ1xuICAvLyAobm9uLUdFVCkgcmVxdWVzdCBpcyByZWplY3RlZCwgc28gcHJvYmluZy9lc2NhbGF0aW9uIGF0dGVtcHRzIGFyZSB2aXNpYmxlXG4gIC8vIHJhdGhlciB0aGFuIGludmlzaWJsZS4gYGRldGFpbHNgIGNhcnJpZXMgdGhlIHJlcXVpcmVkIHBlcm1pc3Npb24gKyBwYXRoO1xuICAvLyBgb3V0Y29tZWAgaXMgJ2ZhaWx1cmUnLlxuICAnYXV0aHouZGVuaWVkJyxcbiAgLy8gXCJBc2tcIiBhc3Npc3RhbnQgYWN0aXZpdHkg4oCUIHZpc2liaWxpdHkgaW50byB3aGF0IHRoZSBhc3Npc3RhbnQgZGlkIG9uIGEgdXNlcidzXG4gIC8vIGJlaGFsZi4gYGFzay5xdWVyeWAgaXMgYSByZWFkLW9ubHkgaG93LXRvIHR1cm47IGBhc2suYWdlbnQudHVybmAgaXMgYSB0b29sLWNhbGxpbmdcbiAgLy8gdHVybi4gYGRldGFpbHNgIGNhcnJ5IFNBRkUgTUVUQURBVEEgT05MWSAodG9vbHMgdXNlZCwgcHJvcG9zYWwga2luZHMsIHF1ZXJ5XG4gIC8vIGxlbmd0aCwgb3V0Y29tZSksIG5ldmVyIHRoZSByYXcgcXVlcnkgdGV4dC5cbiAgJ2Fzay5xdWVyeScsXG4gICdhc2suYWdlbnQudHVybicsXG5dIGFzIGNvbnN0O1xuXG5leHBvcnQgdHlwZSBSZW1vdGVBdWRpdEFjdGlvbiA9IHR5cGVvZiBSRU1PVEVfQVVESVRfQUNUSU9OU1tudW1iZXJdO1xuXG4vKiogV2hldGhlciBgdmFsdWVgIGlzIGFuIGFjdGlvbiBhIHJlbW90ZSBzZXJ2aWNlIG1heSBlbWl0ICh0aGUgaW5nZXN0IGFsbG93LWxpc3QpLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzUmVtb3RlQXVkaXRBY3Rpb24odmFsdWU6IHN0cmluZyk6IHZhbHVlIGlzIFJlbW90ZUF1ZGl0QWN0aW9uIHtcbiAgcmV0dXJuIChSRU1PVEVfQVVESVRfQUNUSU9OUyBhcyByZWFkb25seSBzdHJpbmdbXSkuaW5jbHVkZXModmFsdWUpO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFJlbW90ZUF1ZGl0RXZlbnQge1xuICBhY3Rpb246IFJlbW90ZUF1ZGl0QWN0aW9uO1xuICBhY3RvcklkOiBzdHJpbmc7XG4gIGFjdG9yRW1haWw/OiBzdHJpbmc7XG4gIG9yZ0lkPzogc3RyaW5nO1xuICBhZmZlY3RlZE9yZ0lkPzogc3RyaW5nO1xuICB0YXJnZXRUeXBlPzogc3RyaW5nO1xuICB0YXJnZXRJZD86IHN0cmluZztcbiAgLyoqXG4gICAqIERpZCB0aGUgYXVkaXRlZCBhY3Rpb24gc3VjY2VlZCBvciBmYWlsPyBEZWZhdWx0cyB0byAnc3VjY2Vzcycgd2hlbiBvbWl0dGVkXG4gICAqICh0aGUgcGxhdGZvcm0gaW5nZXN0IGFwcGxpZXMgdGhlIHNhbWUgZGVmYXVsdCkuIERlbmllZC1hdXRoeiBldmVudHMgc2V0XG4gICAqICdmYWlsdXJlJyBzbyBhIHJldmlld2VyIGNhbiBmaWx0ZXIgYXR0ZW1wdHMgZnJvbSBjb21wbGV0ZWQgYWN0aW9ucy5cbiAgICovXG4gIG91dGNvbWU/OiAnc3VjY2VzcycgfCAnZmFpbHVyZSc7XG4gIC8qKlxuICAgKiBXaGVuIHRoZSBhdWRpdGVkIGFjdGlvbiBhY3R1YWxseSBPQ0NVUlJFRCAoSVNPLTg2MDEpLCBzdGFtcGVkIGF0IGVtaXNzaW9uLlxuICAgKiBUaGUgcGxhdGZvcm0gc3RvcmVzIHRoaXMgZm9yIHJldmlld2VyczsgaXQgaXMgTk9UIHRoZSBjaGFpbi1vcmRlcmluZyBmaWVsZFxuICAgKiAodGhlIHRhbXBlci1ldmlkZW50IGNoYWluIG9yZGVycyBieSBpbmdlc3QvYGNyZWF0ZWRBdGApLiBJdCBtYXR0ZXJzIGZvclxuICAgKiBTUE9PTEVEIGV2ZW50czogb25lIGJ1ZmZlcmVkIGR1cmluZyBhIHBsYXRmb3JtIG91dGFnZSBpcyByZS1kZWxpdmVyZWQg4oCUIGFuZFxuICAgKiBzbyBjaGFpbmVkIOKAlCBsYXRlciwgYnV0IGBvY2N1cnJlZEF0YCBwcmVzZXJ2ZXMgd2hlbiBpdCByZWFsbHkgaGFwcGVuZWQuXG4gICAqL1xuICBvY2N1cnJlZEF0Pzogc3RyaW5nO1xuICAvKipcbiAgICogU3RhYmxlIHBlci1lbWlzc2lvbiBkZWR1cCBrZXkgKGFsc28gc2VudCBhcyB0aGUgYElkZW1wb3RlbmN5LUtleWAgaGVhZGVyIHRoZVxuICAgKiBwbGF0Zm9ybSBpbmdlc3QgZGVkdXBzIG9uKS4gU3RhbXBlZCBieSBgcmVjb3JkKClgIGFuZCBjYXJyaWVkIG9uIHRoZSBzcG9vbGVkXG4gICAqIGNvcHkgc28gYSBsaXZlIGF0dGVtcHQgYW5kIGl0cyBsYXRlciByZS1kZWxpdmVyeSBjb2xsYXBzZSB0byBPTkUgc3RvcmVkIHJvdy5cbiAgICovXG4gIGlkZW1wb3RlbmN5S2V5Pzogc3RyaW5nO1xuICBkZXRhaWxzPzogUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG59XG5cbi8qKlxuICogQ2xpZW50IGZvciBQT1NUaW5nIGF1ZGl0IGV2ZW50cyB0byB0aGUgcGxhdGZvcm0ncyBgL2F1ZGl0LWV2ZW50c2AgaW5nZXN0XG4gKiBlbmRwb2ludC4gTWludHMgYSBmcmVzaCBzZXJ2aWNlIHRva2VuIHBlciBjYWxsICg1IG1pbiBUVEwpICB0aGVyZSdzIG5vXG4gKiBtZWFuaW5nZnVsIGNhY2hpbmcgYmVuZWZpdCB3aGVuIGVtaXNzaW9ucyBhcmUgc3BhcnNlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlbW90ZUF1ZGl0Q2xpZW50IHtcbiAgLyoqXG4gICAqIEZpcmUtYW5kLWZvcmdldCBhdWRpdCBlbWlzc2lvbi4gRmFpbHVyZXMgYXJlIGxvZ2dlZCBhdCB3YXJuIGxldmVsIGJ1dFxuICAgKiBuZXZlciB0aHJvd24gIHRoZSBvcmlnaW5hdGluZyBhY3Rpb24gKGUuZy4gYSBwbHVnaW4gYnVpbGQpIGhhcyBpdHNcbiAgICogb3duIHN1Y2Nlc3MvZmFpbHVyZSBwYXRoIHRoYXQgc2hvdWxkbid0IGdldCBwb2xsdXRlZCBieSBhIGZsYWt5IGF1ZGl0XG4gICAqIGRvd25zdHJlYW0uIFdoZW4gYSB7QGxpbmsgQXVkaXRTcG9vbH0gaXMgY29uZmlndXJlZCwgYW4gZW1pc3Npb24gdGhhdFxuICAgKiBleGhhdXN0cyBpdHMgbGl2ZSByZXRyaWVzIGlzIGJ1ZmZlcmVkIGFuZCByZS1kZWxpdmVyZWQgbGF0ZXIgaW5zdGVhZCBvZlxuICAgKiBiZWluZyBkcm9wcGVkLlxuICAgKi9cbiAgcmVjb3JkKGV2ZW50OiBSZW1vdGVBdWRpdEV2ZW50LCBzZXJ2aWNlTmFtZTogc3RyaW5nKTogdm9pZDtcbiAgLyoqIFN0b3AgdGhlIGJhY2tncm91bmQgc3Bvb2wtZHJhaW4gdGltZXIgKGlmIGFueSkuIFNhZmUgdG8gY2FsbCByZXBlYXRlZGx5LiAqL1xuICBjbG9zZSgpOiB2b2lkO1xufVxuXG4vKipcbiAqIENvbmZpZ3VyYXRpb24gZm9yIHRoZSByZW1vdGUgYXVkaXQgY2xpZW50LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlbW90ZUF1ZGl0Q2xpZW50Q29uZmlnIHtcbiAgLyoqIFBsYXRmb3JtIHNlcnZpY2UgaG9zdCAoZGVmYXVsdDogZW52IFBMQVRGT1JNX1NFUlZJQ0VfSE9TVCBvciAncGxhdGZvcm0nKSAqL1xuICBob3N0Pzogc3RyaW5nO1xuICAvKiogUGxhdGZvcm0gc2VydmljZSBwb3J0IChkZWZhdWx0OiBlbnYgUExBVEZPUk1fU0VSVklDRV9QT1JUIG9yIDMwMDApICovXG4gIHBvcnQ/OiBudW1iZXI7XG4gIC8qKiBSZXF1ZXN0IHRpbWVvdXQgbXMgKGRlZmF1bHQgMzAwMCAgYXVkaXQgc2hvdWxkbid0IGJsb2NrIHRoZSB3b3JrZXIpLiAqL1xuICB0aW1lb3V0PzogbnVtYmVyO1xuICAvKipcbiAgICogT3B0aW9uYWwgZHVyYWJsZSBidWZmZXIuIFdoZW4gc2V0LCBhbiBlbWlzc2lvbiB0aGF0IGV4aGF1c3RzIGl0cyBsaXZlIHJldHJ5XG4gICAqIGJ1ZGdldCAoc3VzdGFpbmVkIHBsYXRmb3JtIG91dGFnZSkgaXMgc3Bvb2xlZCBhbmQgcmUtZGVsaXZlcmVkIOKAlCBvbiB0aGUgbmV4dFxuICAgKiBzdWNjZXNzZnVsIGVtaXNzaW9uIGFuZCBvbiBhIHBlcmlvZGljIHRpbWVyIOKAlCBpbnN0ZWFkIG9mIGJlaW5nIGxvc3QuXG4gICAqL1xuICBzcG9vbD86IEF1ZGl0U3Bvb2w7XG4gIC8qKiBTcG9vbC1kcmFpbiBpbnRlcnZhbCBtcyAoZGVmYXVsdCAzMF8wMDApLiBPbmx5IHVzZWQgd2hlbiBgc3Bvb2xgIGlzIHNldC4gKi9cbiAgZHJhaW5JbnRlcnZhbE1zPzogbnVtYmVyO1xuICAvKiogTWF4IGVudHJpZXMgZHJhaW5lZCBwZXIgc3dlZXAgKGRlZmF1bHQgMTAwKS4gKi9cbiAgZHJhaW5CYXRjaFNpemU/OiBudW1iZXI7XG59XG5cbi8qKlxuICogQ29uc3RydWN0IGEgcmVtb3RlLWF1ZGl0IGNsaWVudCB0YXJnZXRlZCBhdCB0aGUgcGxhdGZvcm0gc2VydmljZS5cbiAqXG4gKiBVc2VkIGJ5IGFwaS9wbHVnaW4ncyBidWlsZCB3b3JrZXIgdG8gcHVzaCBgcGx1Z2luLmJ1aWxkLipgIGV2ZW50cyBpbnRvXG4gKiB0aGUgcGxhdGZvcm0ncyBNb25nb0RCIGBhdWRpdF9ldmVudHNgIGNvbGxlY3Rpb24uIE90aGVyIHNlcnZpY2VzXG4gKiB3aXRoIHdvcmtlci1zdHlsZSBlbWl0dGVycyBjYW4gdXNlIHRoZSBzYW1lIGNsaWVudC5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgYXVkaXRDbGllbnQgPSBjcmVhdGVSZW1vdGVBdWRpdENsaWVudCgpO1xuICogYXVkaXRDbGllbnQucmVjb3JkKHtcbiAqIGFjdGlvbjogJ3BsdWdpbi5idWlsZC5jb21wbGV0ZWQnLFxuICogYWN0b3JJZDogJ3VzZXItMTIzJyxcbiAqIG9yZ0lkOiAnb3JnLWFjbWUnLFxuICogdGFyZ2V0VHlwZTogJ3BsdWdpbicsXG4gKiB0YXJnZXRJZDogJ3BsdWdpbi1hYmMnLFxuICogZGV0YWlsczogeyBuYW1lOiAnbXktcGx1Z2luJywgdmVyc2lvbjogJzEuMC4wJyB9LFxuICogfSwgJ3BsdWdpbicpO1xuICogYGBgXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVSZW1vdGVBdWRpdENsaWVudChjb25maWc6IFJlbW90ZUF1ZGl0Q2xpZW50Q29uZmlnID0ge30pOiBSZW1vdGVBdWRpdENsaWVudCB7XG4gIGNvbnN0IHNlcnZpY2VDb25maWc6IFNlcnZpY2VDb25maWcgPSB7XG4gICAgaG9zdDogY29uZmlnLmhvc3QgPz8gcHJvY2Vzcy5lbnYuUExBVEZPUk1fU0VSVklDRV9IT1NUID8/ICdwbGF0Zm9ybScsXG4gICAgcG9ydDogY29uZmlnLnBvcnQgPz8gcGFyc2VJbnQocHJvY2Vzcy5lbnYuUExBVEZPUk1fU0VSVklDRV9QT1JUID8/ICczMDAwJywgMTApLFxuICAgIHRpbWVvdXQ6IGNvbmZpZy50aW1lb3V0ID8/IDMwMDAsXG4gIH07XG4gIGNvbnN0IGNsaWVudCA9IGNyZWF0ZVNhZmVDbGllbnQoc2VydmljZUNvbmZpZyk7XG4gIGNvbnN0IHNwb29sID0gY29uZmlnLnNwb29sO1xuICBjb25zdCBkcmFpbkJhdGNoU2l6ZSA9IGNvbmZpZy5kcmFpbkJhdGNoU2l6ZSA/PyAxMDA7XG5cbiAgLyoqXG4gICAqIEF0dGVtcHQgT05FIGxpdmUgZGVsaXZlcnkuIFJlc29sdmVzIGB0cnVlYCBvbiBhIDJ4eCBhY2NlcHQsIGBmYWxzZWAgb24gYW55XG4gICAqIG5vbi0yeHggLyB0aHJvd24gZXJyb3IgKHRoZSBodHRwLWNsaWVudCBoYXMgYWxyZWFkeSBhcHBsaWVkIHRoZSByZXRyeVxuICAgKiBidWRnZXQpLiBBIHN0YWJsZSBwZXItZW1pc3Npb24gYElkZW1wb3RlbmN5LUtleWAgbWFrZXMgdGhpcyBub24taWRlbXBvdGVudFxuICAgKiBQT1NUIHJldHJ5LXNhZmUgYW5kIGxldHMgdGhlIHBsYXRmb3JtIGluZ2VzdCBkZWR1cCBhIHJlLWRlbGl2ZXJlZCBldmVudFxuICAgKiBpbnN0ZWFkIG9mIHdyaXRpbmcgYSBkdXBsaWNhdGUgYXVkaXQgcm93IChhbmQgZHVwbGljYXRlIGNoYWluIGxpbmspLlxuICAgKiBgSWRlbXBvdGVuY3ktS2V5YCBpcyBkZXJpdmVkIGZyb20gdGhlIGV2ZW50IHNvIGEgU1BPT0xFRCByZS1kZWxpdmVyeSByZXVzZXNcbiAgICogdGhlIHNhbWUga2V5IGFzIGl0cyBvcmlnaW5hbCBsaXZlIGF0dGVtcHQg4oCUIHRoZSB0d28gY29sbGFwc2UgdG8gb25lIHJvdy5cbiAgICovXG4gIGFzeW5jIGZ1bmN0aW9uIGRlbGl2ZXIoZXZlbnQ6IFJlbW90ZUF1ZGl0RXZlbnQsIHNlcnZpY2VOYW1lOiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgICBjb25zdCBhdXRoSGVhZGVyID0gZ2V0U2VydmljZUF1dGhIZWFkZXIoeyBzZXJ2aWNlTmFtZSwgb3JnSWQ6IGV2ZW50Lm9yZ0lkLCByb2xlOiAnbWVtYmVyJyB9KTtcbiAgICBjb25zdCBoZWFkZXJzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0ge1xuICAgICAgJ0F1dGhvcml6YXRpb24nOiBhdXRoSGVhZGVyLFxuICAgICAgJ0lkZW1wb3RlbmN5LUtleSc6IGV2ZW50LmlkZW1wb3RlbmN5S2V5ID8/IHJhbmRvbVVVSUQoKSxcbiAgICB9O1xuICAgIHRyeSB7XG4gICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGNsaWVudC5wb3N0KCcvYXVkaXQvZXZlbnRzJywgZXZlbnQsIHsgaGVhZGVycywgLi4uQVVESVRfUkVRVUVTVF9PUFRJT05TIH0pO1xuICAgICAgY29uc3Qgb2sgPSAhIXJlc3BvbnNlICYmIHJlc3BvbnNlLnN0YXR1c0NvZGUgPj0gMjAwICYmIHJlc3BvbnNlLnN0YXR1c0NvZGUgPCAzMDA7XG4gICAgICBpZiAoIW9rKSB7XG4gICAgICAgIGxvZ2dlci53YXJuKCdSZW1vdGUgYXVkaXQgaW5nZXN0IG5vbi1vaycsIHsgYWN0aW9uOiBldmVudC5hY3Rpb24sIHN0YXR1c0NvZGU6IHJlc3BvbnNlPy5zdGF0dXNDb2RlIH0pO1xuICAgICAgfVxuICAgICAgcmV0dXJuIG9rO1xuICAgIH0gY2F0Y2ggKGVycikge1xuICAgICAgbG9nZ2VyLndhcm4oJ1JlbW90ZSBhdWRpdCBpbmdlc3QgdGhyZXcnLCB7IGFjdGlvbjogZXZlbnQuYWN0aW9uLCBlcnJvcjogZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6IFN0cmluZyhlcnIpIH0pO1xuICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbiAgfVxuXG4gIC8vIFNlcmlhbGl6ZSBzcG9vbCBkcmFpbnMgc28gYSBwZXJpb2RpYyB0aWNrIGFuZCBhbiBvbi1zdWNjZXNzIGRyYWluIGNhbid0IGJvdGhcbiAgLy8gcHVsbCB0aGUgc2FtZSBiYXRjaC4gU3RvcHMgZWFybHkgdGhlIG1vbWVudCBhIHJlLWRlbGl2ZXJ5IGZhaWxzIChwbGF0Zm9ybVxuICAvLyBzdGlsbCBkb3duKSBzbyB3ZSBkb24ndCBoYW1tZXIgaXQgb3IgY2h1cm4gdGhlIGJ1ZmZlci5cbiAgbGV0IGRyYWluaW5nID0gZmFsc2U7XG4gIGFzeW5jIGZ1bmN0aW9uIGRyYWluKCk6IFByb21pc2U8dm9pZD4ge1xuICAgIGlmICghc3Bvb2wgfHwgZHJhaW5pbmcpIHJldHVybjtcbiAgICBkcmFpbmluZyA9IHRydWU7XG4gICAgdHJ5IHtcbiAgICAgIGZvciAoOzspIHtcbiAgICAgICAgY29uc3QgYmF0Y2ggPSBhd2FpdCBzcG9vbC50YWtlKGRyYWluQmF0Y2hTaXplKTtcbiAgICAgICAgaWYgKGJhdGNoLmxlbmd0aCA9PT0gMCkgcmV0dXJuO1xuICAgICAgICBjb25zdCBkZWxpdmVyZWQ6IEF1ZGl0U3Bvb2xFbnRyeVtdID0gW107XG4gICAgICAgIGNvbnN0IGZhaWxlZDogQXVkaXRTcG9vbEVudHJ5W10gPSBbXTtcbiAgICAgICAgbGV0IHBsYXRmb3JtRG93biA9IGZhbHNlO1xuICAgICAgICBmb3IgKGNvbnN0IGVudHJ5IG9mIGJhdGNoKSB7XG4gICAgICAgICAgaWYgKHBsYXRmb3JtRG93bikgeyBmYWlsZWQucHVzaChlbnRyeSk7IGNvbnRpbnVlOyB9XG4gICAgICAgICAgY29uc3Qgb2sgPSBhd2FpdCBkZWxpdmVyKGVudHJ5LmV2ZW50LCBlbnRyeS5zZXJ2aWNlTmFtZSk7XG4gICAgICAgICAgaWYgKG9rKSB7XG4gICAgICAgICAgICBkZWxpdmVyZWQucHVzaChlbnRyeSk7XG4gICAgICAgICAgICBlbWl0Q291bnRlcignYXVkaXRfc3Bvb2xfcmVkZWxpdmVyZWRfdG90YWwnLCB7IHNlcnZpY2U6IGVudHJ5LnNlcnZpY2VOYW1lIH0pO1xuICAgICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgICBwbGF0Zm9ybURvd24gPSB0cnVlO1xuICAgICAgICAgICAgZmFpbGVkLnB1c2goZW50cnkpO1xuICAgICAgICAgIH1cbiAgICAgICAgfVxuICAgICAgICAvLyBBY2tub3dsZWRnZSB0aGUgZGVsaXZlcmVkIHByZWZpeCBzbyBpdCBjbGVhcnMgdGhlIGluLXByb2dyZXNzIGxpc3Q7IHRoZVxuICAgICAgICAvLyByZWxpYWJsZSB0YWtlKCkgbW92ZWQgdGhlIHdob2xlIGJhdGNoIHRoZXJlLCBzbyB1bmFja2VkIHN1cnZpdm9ycyBhcmVcbiAgICAgICAgLy8gcmVjbGFpbWVkIGJ5IHJlY292ZXIoKSBhZnRlciBhIGNyYXNoIHJhdGhlciB0aGFuIGJlaW5nIHNpbGVudGx5IGxvc3QuXG4gICAgICAgIGlmIChkZWxpdmVyZWQubGVuZ3RoID4gMCkgYXdhaXQgc3Bvb2wuYWNrKGRlbGl2ZXJlZCk7XG4gICAgICAgIGlmIChmYWlsZWQubGVuZ3RoID4gMCkge1xuICAgICAgICAgIGF3YWl0IHNwb29sLnJlcXVldWUoZmFpbGVkKTtcbiAgICAgICAgICByZXR1cm47IC8vIHN0aWxsIGRvd24g4oCUIHRyeSBhZ2FpbiBvbiB0aGUgbmV4dCB0aWNrXG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9IGNhdGNoIChlcnIpIHtcbiAgICAgIGxvZ2dlci53YXJuKCdBdWRpdCBzcG9vbCBkcmFpbiBmYWlsZWQnLCB7IGVycm9yOiBlcnIgaW5zdGFuY2VvZiBFcnJvciA/IGVyci5tZXNzYWdlIDogU3RyaW5nKGVycikgfSk7XG4gICAgfSBmaW5hbGx5IHtcbiAgICAgIGRyYWluaW5nID0gZmFsc2U7XG4gICAgfVxuICB9XG5cbiAgbGV0IGRyYWluVGltZXI6IFJldHVyblR5cGU8dHlwZW9mIHNldEludGVydmFsPiB8IHVuZGVmaW5lZDtcbiAgaWYgKHNwb29sKSB7XG4gICAgLy8gUmVjbGFpbSBhbnkgYmF0Y2ggc3RyYW5kZWQgb24gdGhlIGluLXByb2dyZXNzIGxpc3QgYnkgYSBwcmlvciBjcmFzaCwgdGhlblxuICAgIC8vIGF0dGVtcHQgdG8gZmx1c2ggaXQuIEJvdGggYXJlIGJlc3QtZWZmb3J0ICh0aGUgc3Bvb2wgc3dhbGxvd3MgaXRzIGVycm9ycykuXG4gICAgdm9pZCBzcG9vbC5yZWNvdmVyKCkudGhlbigoKSA9PiBkcmFpbigpKTtcbiAgICBkcmFpblRpbWVyID0gc2V0SW50ZXJ2YWwoKCkgPT4geyB2b2lkIGRyYWluKCk7IH0sIGNvbmZpZy5kcmFpbkludGVydmFsTXMgPz8gMzBfMDAwKTtcbiAgICAvLyBEb24ndCBsZXQgdGhlIGRyYWluIHRpbWVyIGtlZXAgdGhlIHByb2Nlc3MgYWxpdmUgb24gc2h1dGRvd24uXG4gICAgKGRyYWluVGltZXIgYXMgdW5rbm93biBhcyB7IHVucmVmPzogKCkgPT4gdm9pZCB9KS51bnJlZj8uKCk7XG4gIH1cblxuICByZXR1cm4ge1xuICAgIHJlY29yZChldmVudCwgc2VydmljZU5hbWUpIHtcbiAgICAgIC8vIFN0YW1wIHdoZW4gdGhlIGFjdGlvbiBhY3R1YWxseSBvY2N1cnJlZCAoc3Vydml2ZXMgc3Bvb2wgZGVsYXkpIGFuZCBwaW4gYVxuICAgICAgLy8gc3RhYmxlIGlkZW1wb3RlbmN5IGtleSBzbyBhIGxpdmUgYXR0ZW1wdCBhbmQgaXRzIHNwb29sZWQgcmV0cnkgZGVkdXAuXG4gICAgICBjb25zdCBzdGFtcGVkOiBSZW1vdGVBdWRpdEV2ZW50ID0ge1xuICAgICAgICAuLi5ldmVudCxcbiAgICAgICAgb2NjdXJyZWRBdDogZXZlbnQub2NjdXJyZWRBdCA/PyBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCksXG4gICAgICAgIGlkZW1wb3RlbmN5S2V5OiBldmVudC5pZGVtcG90ZW5jeUtleSA/PyByYW5kb21VVUlEKCksXG4gICAgICB9O1xuICAgICAgdm9pZCBkZWxpdmVyKHN0YW1wZWQsIHNlcnZpY2VOYW1lKS50aGVuKChvaykgPT4ge1xuICAgICAgICBpZiAob2spIHtcbiAgICAgICAgICBlbWl0Q291bnRlcignYXVkaXRfZW1pdHRlZF90b3RhbCcsIHsgc2VydmljZTogc2VydmljZU5hbWUsIG91dGNvbWU6IHN0YW1wZWQub3V0Y29tZSA/PyAnc3VjY2VzcycgfSk7XG4gICAgICAgICAgaWYgKHNwb29sKSB2b2lkIGRyYWluKCk7IC8vIHBsYXRmb3JtIGlzIHJlYWNoYWJsZSDigJQgZmx1c2ggYW55IGJhY2tsb2dcbiAgICAgICAgfSBlbHNlIGlmIChzcG9vbCkge1xuICAgICAgICAgIHZvaWQgc3Bvb2wuZW5xdWV1ZSh7IGV2ZW50OiBzdGFtcGVkLCBzZXJ2aWNlTmFtZSB9KTtcbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICBlbWl0Q291bnRlcignYXVkaXRfZHJvcHBlZF90b3RhbCcsIHsgc2VydmljZTogc2VydmljZU5hbWUgfSk7XG4gICAgICAgIH1cbiAgICAgIH0pO1xuICAgIH0sXG4gICAgY2xvc2UoKSB7XG4gICAgICBpZiAoZHJhaW5UaW1lcikgeyBjbGVhckludGVydmFsKGRyYWluVGltZXIpOyBkcmFpblRpbWVyID0gdW5kZWZpbmVkOyB9XG4gICAgfSxcbiAgfTtcbn1cblxuLyoqXG4gKiBSZWdpc3RlciB0aGUgc3RhbmRhcmQgYGF1dGh6LmRlbmllZGAgc2luayB1c2VkIGJ5IGV2ZXJ5IHJlbW90ZS1hdWRpdCBzZXJ2aWNlXG4gKiAocGlwZWxpbmUsIHBsdWdpbiwgY29tcGxpYW5jZSwgcXVvdGEsIG1lc3NhZ2UsIGJpbGxpbmcsIHJlcG9ydGluZywg4oCmKS5cbiAqXG4gKiBUaGUgc2hhcmVkIGByZXF1aXJlQXV0aGAgZ2F0ZSBmb3J3YXJkcyBlYWNoIERFTklFRCBzdGF0ZS1jaGFuZ2luZyByZXF1ZXN0IHRvXG4gKiB0aGUgYXVkaXRvciBzZXQgdmlhIHtAbGluayBzZXRBdXRoekRlbmlhbEF1ZGl0b3J9OyB0aGlzIHdpcmVzIHRoYXQgaG9vayB0byB0aGVcbiAqIHNlcnZpY2UncyB7QGxpbmsgUmVtb3RlQXVkaXRDbGllbnR9LCBmb3J3YXJkaW5nIGEgYGZhaWx1cmVgLW91dGNvbWVcbiAqIGBhdXRoei5kZW5pZWRgIGV2ZW50IHNvIHByb2JpbmcgLyBwcml2aWxlZ2UtZXNjYWxhdGlvbiBhdHRlbXB0cyBsZWF2ZSBhIHRyYWlsLlxuICogRW1pc3Npb24gaXMgZmlyZS1hbmQtZm9yZ2V0ICh0aGUgY2xpZW50IG5ldmVyIHRocm93cykuIGBnZXRDbGllbnRgIGlzIGEgZ2V0dGVyXG4gKiBzbyB0aGUgY2xpZW50IHN0YXlzIGxhemlseSBjb25zdHJ1Y3RlZCAoc2VydmljZXMgbWVtb2l6ZSBpdCBvbiBmaXJzdCB1c2UpLlxuICpcbiAqIFBsYXRmb3JtIGlzIGludGVudGlvbmFsbHkgTk9UIGEgY2FsbGVyIOKAlCBpdCBpcyB0aGUgYXVkaXQgYXV0aG9yaXR5IGFuZCB3cml0ZXNcbiAqIGBhdXRoei5kZW5pZWRgIHN0cmFpZ2h0IHRvIGl0cyBsb2NhbCBzdG9yZSAod2l0aCBgYWZmZWN0ZWRPcmdJZGApLCBub3QgdGhyb3VnaFxuICogYSBSZW1vdGVBdWRpdENsaWVudC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHdpcmVBdXRoekRlbmlhbEF1ZGl0b3Ioc2VydmljZU5hbWU6IHN0cmluZywgZ2V0Q2xpZW50OiAoKSA9PiBSZW1vdGVBdWRpdENsaWVudCk6IHZvaWQge1xuICBzZXRBdXRoekRlbmlhbEF1ZGl0b3IoKGluZm86IEF1dGh6RGVuaWFsSW5mbykgPT4gZ2V0Q2xpZW50KCkucmVjb3JkKHtcbiAgICBhY3Rpb246ICdhdXRoei5kZW5pZWQnLFxuICAgIGFjdG9ySWQ6IGluZm8uYWN0b3JJZCA/PyAnYW5vbnltb3VzJyxcbiAgICBhY3RvckVtYWlsOiBpbmZvLmFjdG9yRW1haWwsXG4gICAgb3JnSWQ6IGluZm8ub3JnSWQsXG4gICAgb3V0Y29tZTogJ2ZhaWx1cmUnLFxuICAgIGRldGFpbHM6IHsgbWV0aG9kOiBpbmZvLm1ldGhvZCwgcGF0aDogaW5mby5wYXRoLCByZXF1aXJlZDogaW5mby5yZXF1aXJlZCB9LFxuICB9LCBzZXJ2aWNlTmFtZSkpO1xufVxuXG4vKipcbiAqIEEgc2VydmljZS1zY29wZWQgYXVkaXQgY2xpZW50OiBhIGR1cmFibGUtc3Bvb2wtYmFja2VkIHtAbGluayBSZW1vdGVBdWRpdENsaWVudH1cbiAqIHdpdGggdGhlIHNlcnZpY2UgbmFtZSBwcmUtYm91bmQgZm9yIGVtaXNzaW9uLiBSZXBsYWNlcyB0aGUgcGVyLXNlcnZpY2VcbiAqIGJvaWxlcnBsYXRlIG9mIGBjcmVhdGVSZW1vdGVBdWRpdENsaWVudCh7IHNwb29sOiBjcmVhdGVFbnZSZWRpc0F1ZGl0U3Bvb2woKSA/PyB1bmRlZmluZWQgfSlgXG4gKiBwbHVzIGEgaGFuZC1yb2xsZWQgYGVtaXQ8U2VydmljZT5BdWRpdGAgd3JhcHBlciB0aGF0IHJlcGVhdHMgdGhlIHNlcnZpY2UgbmFtZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTZXJ2aWNlQXVkaXRDbGllbnQge1xuICAvKiogRW1pdCBhbiBhdWRpdCBldmVudCB3aXRoIHRoZSBzZXJ2aWNlIG5hbWUgYm91bmQuIEZpcmUtYW5kLWZvcmdldC4gKi9cbiAgZW1pdChldmVudDogUmVtb3RlQXVkaXRFdmVudCk6IHZvaWQ7XG4gIC8qKiBUaGUgdW5kZXJseWluZyByZW1vdGUgY2xpZW50IOKAlCBmb3IgYHdpcmVBdXRoekRlbmlhbEF1ZGl0b3JgICsgYGNsb3NlKClgLiAqL1xuICByZWFkb25seSBjbGllbnQ6IFJlbW90ZUF1ZGl0Q2xpZW50O1xufVxuXG4vKipcbiAqIEJ1aWxkIGEgc2VydmljZSdzIGF1ZGl0IGNsaWVudDogYSBSZW1vdGVBdWRpdENsaWVudCB3aXJlZCB0byB0aGUgZHVyYWJsZSBSZWRpc1xuICogc3Bvb2wgKGZyb20gYW1iaWVudCBlbnY7IG51bGwg4oaSIG5vIHNwb29sKSB3aXRoIGBzZXJ2aWNlTmFtZWAgYm91bmQuIENvbnN0cnVjdFxuICogT05DRSBwZXIgcHJvY2VzcyDigJQgbWVtb2l6ZSBiZWhpbmQgYSBsYXp5IGBnZXRBdWRpdENsaWVudCgpYCBpbiB0aGUgc2VydmljZSdzXG4gKiBgc2VydmljZXMvYXVkaXQudHNgLiBQYXNzIGBjb25maWcuc3Bvb2xgIHRvIG92ZXJyaWRlIHRoZSBlbnYtZGVyaXZlZCBzcG9vbFxuICogKGUuZy4gcmV1c2UgYSBzZXJ2aWNlJ3MgZXhpc3RpbmcgaW9yZWRpcyBjb25uZWN0aW9uKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZVNlcnZpY2VBdWRpdENsaWVudChzZXJ2aWNlTmFtZTogc3RyaW5nLCBjb25maWc6IFJlbW90ZUF1ZGl0Q2xpZW50Q29uZmlnID0ge30pOiBTZXJ2aWNlQXVkaXRDbGllbnQge1xuICBjb25zdCBzcG9vbCA9IGNvbmZpZy5zcG9vbCA/PyBjcmVhdGVFbnZSZWRpc0F1ZGl0U3Bvb2woKSA/PyB1bmRlZmluZWQ7XG4gIGNvbnN0IGNsaWVudCA9IGNyZWF0ZVJlbW90ZUF1ZGl0Q2xpZW50KHsgLi4uY29uZmlnLCBzcG9vbCB9KTtcbiAgcmV0dXJuIHtcbiAgICBlbWl0OiAoZXZlbnQpID0+IGNsaWVudC5yZWNvcmQoZXZlbnQsIHNlcnZpY2VOYW1lKSxcbiAgICBjbGllbnQsXG4gIH07XG59XG5cbi8qKlxuICogTGF6aWx5LWNvbnN0cnVjdGVkIHJlbW90ZS1hdWRpdCBhY2Nlc3NvciBmb3IgYSBzZXJ2aWNlLiBFdmVyeSBzZXJ2aWNlJ3NcbiAqIGBzZXJ2aWNlcy9hdWRpdC50c2AgdXNlZCB0byBoYW5kLXJvbGwgdGhlIHNhbWUgbW9kdWxlIHNpbmdsZXRvbiAoYSBgbGV0IGF1ZGl0YFxuICogKyBgc3ZjKClgIHRoYXQgYnVpbGRzIGEge0BsaW5rIFNlcnZpY2VBdWRpdENsaWVudH0gb24gZmlyc3QgdXNlLCB0aGVuIGFcbiAqIGBnZXRBdWRpdENsaWVudCgpYCByZXR1cm5pbmcgYC5jbGllbnRgIGFuZCBhbiBgZW1pdChldmVudClgIGZvcndhcmRpbmcgdG9cbiAqIGAuZW1pdGApLiBUaGlzIHBhY2thZ2VzIHRoYXQgcGF0dGVybiBpbiBPTkUgcGxhY2Ugc28gZWFjaCBzZXJ2aWNlJ3MgYXVkaXRcbiAqIHdpcmluZyBpcyBhIG9uZS1saW5lciBhbmQgY2FuJ3QgZHJpZnQuXG4gKlxuICogTGF6eSBvbiBwdXJwb3NlOiB0aGUgdW5kZXJseWluZyBjbGllbnQgd2lyZXMgYW4gZW52LVJlZGlzIGF1ZGl0IHNwb29sLCBzb1xuICogYnVpbGRpbmcgaXQgYXQgaW1wb3J0IHRpbWUgd291bGQgZm9yY2UgdGhhdCBjb25uZWN0aW9uIHdoZXJldmVyIHRoZSBtb2R1bGUgaXNcbiAqIG1lcmVseSBpbXBvcnRlZCAoZS5nLiB0ZXN0cykuIGBnZXRBdWRpdENsaWVudGAgaXMgcGFzc2VkIHRvXG4gKiBgd2lyZUF1dGh6RGVuaWFsQXVkaXRvcmA7IGBlbWl0YCBiYWNrcyB0aGUgcGVyLXNlcnZpY2UgYGVtaXRYQXVkaXRgIGhlbHBlcnMuXG4gKiBCb3RoIHN0YXkgRklSRS1BTkQtRk9SR0VUIChyZWNvcmQgbmV2ZXIgdGhyb3dzIC8gaXMgbm90IGF3YWl0ZWQpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY3JlYXRlUmVtb3RlQXVkaXRBY2Nlc3NvcihzZXJ2aWNlTmFtZTogc3RyaW5nKToge1xuICBnZXRBdWRpdENsaWVudDogKCkgPT4gUmVtb3RlQXVkaXRDbGllbnQ7XG4gIGVtaXQ6IChldmVudDogUmVtb3RlQXVkaXRFdmVudCkgPT4gdm9pZDtcbn0ge1xuICBsZXQgYXVkaXQ6IFNlcnZpY2VBdWRpdENsaWVudCB8IG51bGwgPSBudWxsO1xuICBjb25zdCBzdmMgPSAoKTogU2VydmljZUF1ZGl0Q2xpZW50ID0+IHtcbiAgICBpZiAoIWF1ZGl0KSBhdWRpdCA9IGNyZWF0ZVNlcnZpY2VBdWRpdENsaWVudChzZXJ2aWNlTmFtZSk7XG4gICAgcmV0dXJuIGF1ZGl0O1xuICB9O1xuICByZXR1cm4ge1xuICAgIGdldEF1ZGl0Q2xpZW50OiAoKSA9PiBzdmMoKS5jbGllbnQsXG4gICAgZW1pdDogKGV2ZW50KSA9PiBzdmMoKS5lbWl0KGV2ZW50KSxcbiAgfTtcbn1cbiJdfQ==