@pipeline-builder/api-core 0.0.1

package/lib/middleware/auth.js

@@ -0,0 +1,588 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { randomUUID } from 'crypto';
+import jwt from 'jsonwebtoken';
+import { HttpStatus } from '../constants/http-status.js';
+import { ErrorCode } from '../types/error-codes.js';
+import { hasPermission } from '../types/permissions.js';
+import { getHeaderString } from '../utils/headers.js';
+import { getIdentity } from '../utils/identity.js';
+import { createLogger } from '../utils/logger.js';
+import { emitCounter } from '../utils/metric-emitter.js';
+import { sendError } from '../utils/response.js';
+const logger = createLogger('auth-middleware');
+/** Cached JWT secret with periodic refresh from env var. */
+let _jwtSecret;
+let _jwtSecretRefreshedAt = 0;
+/** Cached PREVIOUS JWT secret (optional) — enables zero-downtime rotation. */
+let _jwtSecretPrevious;
+let _jwtSecretPreviousRefreshedAt = 0;
+const JWT_SECRET_REFRESH_INTERVAL_MS = 300_000; // 5 minutes
+function getJwtSecret() {
+    const now = Date.now();
+    if (!_jwtSecret || now - _jwtSecretRefreshedAt > JWT_SECRET_REFRESH_INTERVAL_MS) {
+        const secret = process.env.JWT_SECRET;
+        if (!secret) {
+            logger.error('JWT_SECRET environment variable is not set');
+            throw new Error('JWT_SECRET environment variable is required');
+        }
+        if (_jwtSecret && _jwtSecret !== secret) {
+            logger.info('JWT secret rotated');
+        }
+        _jwtSecret = secret;
+        _jwtSecretRefreshedAt = now;
+    }
+    return _jwtSecret;
+}
+/**
+ * The optional PREVIOUS JWT secret (`JWT_SECRET_PREVIOUS`), cached with the same
+ * TTL as the primary. Returns `undefined` when unset. During a `JWT_SECRET`
+ * rotation, operators set `JWT_SECRET_PREVIOUS` to the old value so tokens signed
+ * with EITHER secret keep verifying — closing the auth-outage window where
+ * still-valid old-signed (or freshly new-signed) tokens would otherwise be
+ * rejected. `undefined` is a valid cached value, so this refreshes purely on the
+ * time interval (not on emptiness).
+ */
+function getJwtSecretPrevious() {
+    const now = Date.now();
+    if (now - _jwtSecretPreviousRefreshedAt > JWT_SECRET_REFRESH_INTERVAL_MS) {
+        _jwtSecretPrevious = process.env.JWT_SECRET_PREVIOUS || undefined;
+        _jwtSecretPreviousRefreshedAt = now;
+    }
+    return _jwtSecretPrevious;
+}
+/**
+ * Verify a JWT against the primary secret, falling back to the previous secret
+ * (when `JWT_SECRET_PREVIOUS` is configured) ONLY on a signature/verification
+ * failure. This makes token verification survive a secret rotation with zero
+ * downtime: a token valid under EITHER secret passes.
+ *
+ * jsonwebtoken's `verify` takes a single secret, so this is try-primary-then-
+ * previous — NOT a secret array. No existing check is weakened:
+ *   - `verifyOptions` (algorithm pinning + optional issuer/audience) is applied
+ *     identically on BOTH attempts, so alg-confusion / `alg:none` stay blocked.
+ *   - Expiry / not-before from the PRIMARY attempt are authoritative and are
+ *     re-thrown without a previous-secret retry, so a `TokenExpiredError` is
+ *     never masked into an "invalid signature".
+ *   - When no previous secret is set, behaviour is byte-for-byte the original:
+ *     the primary error propagates unchanged.
+ */
+function verifyJwtWithRotation(token, verifyOptions) {
+    try {
+        return jwt.verify(token, getJwtSecret(), verifyOptions);
+    }
+    catch (err) {
+        const previous = getJwtSecretPrevious();
+        // Fall back to the previous secret only for a signature/verification failure
+        // (a plain JsonWebTokenError). Expiry / not-before are enforced regardless of
+        // which secret signed the token, so those errors must surface as-is.
+        if (previous
+            && err instanceof jwt.JsonWebTokenError
+            && !(err instanceof jwt.TokenExpiredError)
+            && !(err instanceof jwt.NotBeforeError)) {
+            // A token signed by the previous secret verifies here; if it is instead
+            // expired/invalid under the previous secret, that error propagates and is
+            // handled by the caller exactly like a primary failure.
+            return jwt.verify(token, previous, verifyOptions);
+        }
+        throw err;
+    }
+}
+export function requireAuth(reqOrOptions, res, next) {
+    if (reqOrOptions && res && next && 'headers' in reqOrOptions) {
+        return _requireAuth({}, reqOrOptions, res, next);
+    }
+    const options = reqOrOptions || {};
+    return (req, resInner, nextInner) => {
+        _requireAuth(options, req, resInner, nextInner);
+    };
+}
+let tokenRevocationStore;
+/**
+ * Register (or clear, with `undefined`) the process-wide token-revocation store.
+ * When unset (the default), `requireAuth` performs NO revocation check (it relies
+ * on the short access-token TTL); services opt in at boot by wiring their Redis
+ * client. Platform keeps its own Mongo-backed check and need not register one.
+ */
+export function setTokenRevocationStore(store) {
+    tokenRevocationStore = store;
+    if (store)
+        revocationStoreMissingWarned = false; // re-arm if a store is (re)registered
+}
+/** One-shot guard so the "revocation inactive" warning doesn't flood the logs. */
+let revocationStoreMissingWarned = false;
+/**
+ * Returns true when `decoded` has been revoked per the registered store: its
+ * embedded `tokenVersion` is strictly behind the store's current version.
+ * Fail-open — any store error, a missing entry, or a token/store without a
+ * usable version yields `false` (allow). Never throws.
+ */
+async function isTokenRevoked(decoded) {
+    const store = tokenRevocationStore;
+    if (!store) {
+        // Make the "revocation is OFF" state OBSERVABLE: a service that verifies user
+        // tokens but forgot `setTokenRevocationStore()` silently disables the session
+        // kill-switch. Warn ONCE (only for a revocable user token) so a misconfigured
+        // boot surfaces in the logs instead of failing open invisibly.
+        if (!revocationStoreMissingWarned && decoded.sub && typeof decoded.tokenVersion === 'number') {
+            revocationStoreMissingWarned = true;
+            logger.warn('Token revocation store NOT registered — revocation checks are INACTIVE (setTokenRevocationStore was never called); revoked/compromised sessions stay valid until natural TTL');
+        }
+        return false;
+    }
+    if (!decoded.sub || typeof decoded.tokenVersion !== 'number')
+        return false;
+    try {
+        const current = await store.getCurrentVersion(decoded.sub);
+        return current !== null && decoded.tokenVersion < current;
+    }
+    catch {
+        // Fail-open: a revocation-store outage must not lock every user out.
+        return false;
+    }
+}
+/**
+ * Public revocation check for routes that verify a platform JWT OUTSIDE
+ * `requireAuth` (e.g. the image-registry `/token` mint path, which resolves
+ * identity itself). Returns true when the token's `tokenVersion` is strictly
+ * behind the store's current version. Fail-open (never throws) — a store outage
+ * or a token/store without a usable version yields false (allow), matching
+ * `requireAuth`. Pass the verified JWT claims (`sub`, `tokenVersion`).
+ */
+export async function isAccessTokenRevoked(claims) {
+    return isTokenRevoked(claims);
+}
+function _requireAuth(options, req, res, next) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader) {
+        return sendError(res, HttpStatus.UNAUTHORIZED, 'Authorization header required', ErrorCode.TOKEN_MISSING);
+    }
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2 || parts[0] !== 'Bearer') {
+        return sendError(res, HttpStatus.UNAUTHORIZED, 'Invalid authorization format. Use: Bearer <token>', ErrorCode.TOKEN_INVALID);
+    }
+    try {
+        // Pass through optional issuer/audience verification when env-configured.
+        // Without these, a JWT signed by any system that happens to share the
+        // same JWT_SECRET would be accepted — defence-in-depth for shared-secret
+        // misconfigurations across services / environments.
+        // Pin the accepted algorithm to the configured HMAC alg (default HS256).
+        // Without an allow-list, `jwt.verify` accepts any algorithm the key can
+        // verify — the classic alg-confusion vector (and a hard guard against
+        // `alg:none`). Env-driven so it stays in lockstep with how tokens are
+        // signed (see signServiceToken + platform's config.auth.jwt.algorithm).
+        const verifyOptions = { algorithms: [(process.env.JWT_ALGORITHM || 'HS256')] };
+        const expectedIssuer = process.env.JWT_ISSUER;
+        const expectedAudience = process.env.JWT_AUDIENCE;
+        if (expectedIssuer)
+            verifyOptions.issuer = expectedIssuer;
+        if (expectedAudience)
+            verifyOptions.audience = expectedAudience;
+        const decoded = verifyJwtWithRotation(parts[1], verifyOptions);
+        if (decoded.type !== 'access') {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Only access tokens can be used for API requests', ErrorCode.TOKEN_INVALID);
+        }
+        if (!decoded.sub || !decoded.role) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Token missing required fields', ErrorCode.TOKEN_INVALID);
+        }
+        // Service-token kill-switch: reject a service principal whose service has
+        // been added to the denylist. Rotating the shared JWT secret is the only
+        // other way to invalidate a service token before its (short) TTL — but that
+        // nukes EVERY service token fleet-wide. This lets one compromised/rogue
+        // service be cut off surgically. O(1) Set lookup, zero cost when the denylist
+        // is empty (the default), so it never taxes the S2S hot path unless armed.
+        if (decoded.sub.startsWith('service:') && isServiceTokenDenied(decoded.sub)) {
+            emitCounter('service_token_denied_total', { service: decoded.sub.slice('service:'.length) });
+            logger.warn('Rejected denylisted service token', { sub: decoded.sub });
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Service token revoked', ErrorCode.TOKEN_REVOKED);
+        }
+        req.user = { ...decoded };
+        // The x-org-id/x-org-name override lets a SYS-ADMIN act on a chosen org
+        // (cross-org admin tooling). It is gated on the verified `isSuperAdmin` claim
+        // here so that even a route which mistakenly enables `allowOrgHeaderOverride`
+        // can NEVER let an ordinary authenticated user spoof another tenant's org via
+        // the header — defence-in-depth against the cross-tenant break this caused.
+        if (options.allowOrgHeaderOverride && decoded.isSuperAdmin === true) {
+            const headerOrgId = getHeaderString(req.headers['x-org-id']);
+            const headerOrgName = getHeaderString(req.headers['x-org-name']);
+            if (headerOrgId)
+                req.user.organizationId = headerOrgId;
+            if (headerOrgName)
+                req.user.organizationName = headerOrgName;
+        }
+        // Re-derive the request's tenant identity from the NOW-verified JWT.
+        //
+        // `attachRequestContext` runs as a global middleware BEFORE this per-route
+        // `requireAuth`, so it captured `req.context.identity` while `req.user` was
+        // still undefined — at which point `getIdentity` falls back to the raw,
+        // client-settable `x-org-id`/`x-user-id` headers. Every downstream tenant-
+        // authority consumer (requireOrgId, withTenantContext's RLS scope, checkQuota,
+        // withRoute, and the idempotency namespace) reads `req.context.identity`, so
+        // that frozen header-derived value — not the JWT — was governing tenancy on
+        // any non-nginx path. Recomputing here, at the single post-verification choke
+        // point, makes `getIdentity` prefer the verified `req.user` (see identity.ts)
+        // so tenancy is JWT-authoritative. The nginx `x-org-id` overwrite stays as
+        // defence-in-depth. Guarded on `req.context` so services/paths that never
+        // attach a context (or run requireAuth pre-context) are unaffected.
+        const reqCtx = req.context;
+        if (reqCtx) {
+            reqCtx.identity = getIdentity(req);
+        }
+        // Session-invalidation check for the stateless services: reject a token
+        // whose `tokenVersion` is behind the revocation store's current value (a
+        // privilege change the platform published). No store registered ⇒ this is a
+        // no-op and control passes straight through. Fail-open on any store error.
+        if (tokenRevocationStore && decoded.sub && typeof decoded.tokenVersion === 'number') {
+            // `.catch(next)` forwards a DOWNSTREAM synchronous throw from `next()` to
+            // Express's error middleware — without it, that throw would surface as an
+            // unhandled rejection (this `next()` runs in a microtask, outside the
+            // surrounding try/catch and Express's per-layer dispatch). `isTokenRevoked`
+            // itself never rejects (it fail-opens internally), so the catch only ever
+            // sees a genuine downstream error.
+            isTokenRevoked(decoded)
+                .then((revoked) => {
+                if (revoked) {
+                    return sendError(res, HttpStatus.UNAUTHORIZED, 'Session has been revoked; please sign in again', ErrorCode.TOKEN_REVOKED);
+                }
+                next();
+            })
+                .catch(next);
+            return;
+        }
+        next();
+    }
+    catch (error) {
+        if (error instanceof jwt.TokenExpiredError) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Token has expired', ErrorCode.TOKEN_EXPIRED);
+        }
+        if (error instanceof jwt.JsonWebTokenError) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Invalid token', ErrorCode.TOKEN_INVALID);
+        }
+        return sendError(res, HttpStatus.UNAUTHORIZED, 'Authentication failed', ErrorCode.UNAUTHORIZED);
+    }
+}
+/**
+ * Whether the request's user holds `permission`. Superadmins implicitly hold
+ * every permission. Reads the resolved `permissions` claim (set at token issue,
+ * or re-derived per request by the platform).
+ */
+export function userHasPermission(req, permission) {
+    return hasPermission(req.user?.permissions, permission, req.user?.isSuperAdmin);
+}
+/**
+ * Optional sink for denied-authorization events. Left unset by default so
+ * api-core stays decoupled from any audit transport — a service registers one
+ * at boot (typically forwarding to its `RemoteAuditClient` as an
+ * `authz.denied` event, or, on platform, to the local `audit()` helper).
+ * MUST be best-effort: it is invoked inside the request path, so it must never
+ * throw or block (the gate wraps the call in try/catch regardless).
+ */
+let authzDenialAuditor;
+/**
+ * Register (or clear, with `undefined`) the process-wide authorization-denial
+ * auditor. Idempotent; the last registration wins.
+ */
+export function setAuthzDenialAuditor(fn) {
+    authzDenialAuditor = fn;
+}
+/**
+ * Emit a denial event, best-effort. Only fires for state-changing (non-GET,
+ * non-HEAD/OPTIONS) requests — a rejected GET is low-signal probing noise and
+ * would amplify audit volume under a scan. Never throws.
+ */
+function auditAuthzDenial(req, required) {
+    const auditor = authzDenialAuditor;
+    if (!auditor)
+        return;
+    const method = req.method.toUpperCase();
+    if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS')
+        return;
+    try {
+        auditor({
+            actorId: req.user?.sub,
+            actorEmail: req.user?.email,
+            orgId: req.user?.organizationId,
+            method,
+            // Strip the query string — a denied request may carry a token/secret as a
+            // query param, and this path is persisted verbatim into the audit log.
+            path: (req.originalUrl || req.url).split('?')[0],
+            required,
+        });
+    }
+    catch {
+        // Best-effort — a broken auditor must never break the auth gate.
+    }
+}
+/**
+ * Requires that the user hold AT LEAST ONE of the given permissions (or be a
+ * superadmin). Use after requireAuth. Mirrors `requireRole`'s any-of semantics;
+ * pass a single permission for a specific action, or several when any one of
+ * them should grant access.
+ */
+export function requirePermission(...permissions) {
+    return (req, res, next) => {
+        if (!req.user) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Authentication required', ErrorCode.UNAUTHORIZED);
+        }
+        // userHasPermission → hasPermission already grants superadmins every
+        // permission, so this single check covers both the superadmin bypass and
+        // the any-of membership test without re-inlining either.
+        if (permissions.some((p) => userHasPermission(req, p)))
+            return next();
+        auditAuthzDenial(req, permissions.join(' or '));
+        return sendError(res, HttpStatus.FORBIDDEN, `Missing required permission: ${permissions.join(' or ')}`, ErrorCode.INSUFFICIENT_PERMISSIONS);
+    };
+}
+/**
+ * Requires that the user hold EVERY one of the given permissions (or be a
+ * superadmin) — the AND counterpart to `requirePermission`'s any-of. Use for a
+ * sensitive action that legitimately demands two distinct capabilities at once
+ * (e.g. a cross-surface operation), so the guarantee is explicit rather than
+ * approximated by chaining two `requirePermission` gates. Superadmins bypass
+ * (they implicitly hold every permission).
+ */
+export function requireAllPermissions(...permissions) {
+    return (req, res, next) => {
+        if (!req.user) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Authentication required', ErrorCode.UNAUTHORIZED);
+        }
+        const missing = permissions.filter((p) => !userHasPermission(req, p));
+        if (missing.length === 0)
+            return next();
+        auditAuthzDenial(req, permissions.join(' and '));
+        return sendError(res, HttpStatus.FORBIDDEN, `Missing required permission: ${missing.join(' and ')}`, ErrorCode.INSUFFICIENT_PERMISSIONS);
+    };
+}
+/**
+ * Like {@link requirePermission} (any-of) but ALSO admits an internal service
+ * principal (a `service:*` machine token). For READ endpoints that BOTH
+ * interactive users — who must hold one of the `:read` capabilities — AND
+ * service-to-service callers legitimately hit; service tokens carry no
+ * permission claims (they're least-privilege `role:member`), so a plain
+ * `requirePermission` would wrongly 403 them. Superadmins pass via
+ * `userHasPermission`'s implicit-all. Use only where a service caller is a known,
+ * intended consumer of the route (verify the callers); prefer plain
+ * `requirePermission` for purely user-facing reads.
+ */
+export function requirePermissionOrService(...permissions) {
+    return (req, res, next) => {
+        if (!req.user) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Authentication required', ErrorCode.UNAUTHORIZED);
+        }
+        if (isServicePrincipal(req) || permissions.some((p) => userHasPermission(req, p)))
+            return next();
+        auditAuthzDenial(req, permissions.join(' or '));
+        return sendError(res, HttpStatus.FORBIDDEN, `Missing required permission: ${permissions.join(' or ')}`, ErrorCode.INSUFFICIENT_PERMISSIONS);
+    };
+}
+/**
+ * Gate an endpoint to internal service-to-service callers only (a `service:*`
+ * machine principal minted via {@link signServiceToken} / `getServiceAuthHeader`).
+ * Rejects any user token. For NON-user-facing endpoints — entity-event ingest,
+ * auto-subscribe, and similar peer-service hooks — that a browser must never
+ * reach. Compose after `requireAuth` so `req.user` is populated.
+ */
+export function requireServicePrincipal(req, res, next) {
+    if (!isServicePrincipal(req)) {
+        // 403 (not 400) — this is an authorization refusal; status must match the
+        // INSUFFICIENT_PERMISSIONS code and the sibling gates (requirePermission, etc.).
+        return sendError(res, HttpStatus.FORBIDDEN, 'Internal service calls only', ErrorCode.INSUFFICIENT_PERMISSIONS);
+    }
+    next();
+}
+/**
+ * The system tenant's canonical org **id** — a fixed, well-known ObjectId (NOT
+ * the string 'system'). This is the single knob every service resolves the
+ * system tenant through; override via the `SYSTEM_ORG_ID` env for alternate
+ * installs. The system org's human identifier stays the slug/name 'system'
+ * (see {@link SYSTEM_ORG_SLUG}); only its `_id` is this ObjectId.
+ */
+export const SYSTEM_ORG_ID = (process.env.SYSTEM_ORG_ID || '000000000000000000000001').toLowerCase();
+/** The system org's well-known slug/name (the human identifier; its `_id` is {@link SYSTEM_ORG_ID}). */
+export const SYSTEM_ORG_SLUG = 'system';
+/**
+ * Check if an orgId or orgName/slug matches the system org. Use this instead of
+ * comparing directly: the id is now an ObjectId ({@link SYSTEM_ORG_ID}) while the
+ * name/slug is 'system' ({@link SYSTEM_ORG_SLUG}), so the two are compared against
+ * their respective canonical values.
+ */
+export function isSystemOrgId(orgId, orgName) {
+    return orgId?.toLowerCase() === SYSTEM_ORG_ID || orgName?.toLowerCase() === SYSTEM_ORG_SLUG;
+}
+/**
+ * Check if the request is from a system admin.
+ *
+ * Authority is granted solely by the user-level `isSuperAdmin` flag carried
+ * in the JWT. The "membership in the well-known 'system' org with role
+ * admin/owner" path was removed — it conflated a Pipeline Builder operator
+ * with a real customer tenant in the data model, and meant any unintended
+ * write that created a 'system'-named org could quietly grant cross-org
+ * authority. The `system` org still exists as a *content holder* for shared
+ * sample data; it just no longer confers privilege.
+ */
+export function isSystemAdmin(req) {
+    return req.user?.isSuperAdmin === true;
+}
+/**
+ * Whether the request's token carries a specific capability `scope` (e.g.
+ * `'reporting:ingest'`). Used to gate endpoints that accept a narrow machine
+ * identity — a normal interactive user token has no `scope` and returns false.
+ */
+export function hasScope(req, scope) {
+    return req.user?.scope === scope;
+}
+/** Requires a system admin — granted solely by the `isSuperAdmin` token claim
+ *  (the org-membership path was removed). Use after requireAuth. */
+export function requireSystemAdmin(req, res, next) {
+    if (!isSystemAdmin(req)) {
+        auditAuthzDenial(req, 'system-admin');
+        return sendError(res, HttpStatus.FORBIDDEN, 'Access denied. Only system administrators can perform this action.', ErrorCode.INSUFFICIENT_PERMISSIONS);
+    }
+    next();
+}
+/**
+ * Require a specific feature flag. Use after requireAuth.
+ * Checks the `features` array in the JWT payload (set at token issuance).
+ * Sysadmins (isSuperAdmin) bypass — they always have every feature.
+ */
+export function requireFeature(feature) {
+    return (req, res, next) => {
+        if (!req.user) {
+            return sendError(res, HttpStatus.UNAUTHORIZED, 'Authentication required', ErrorCode.UNAUTHORIZED);
+        }
+        // Sysadmins get all features; the `features` array on their token is
+        // populated with every flag at issuance time but the bypass here keeps
+        // the rule explicit and survives a token issued before a new feature
+        // flag was added.
+        if (req.user.isSuperAdmin === true)
+            return next();
+        if (!req.user.features?.includes(feature)) {
+            // Route feature-gate denials through the same audit sink as
+            // requirePermission / requireSystemAdmin so a probe for an
+            // unentitled capability leaves a trail (state-changing methods only).
+            auditAuthzDenial(req, `feature:${feature}`);
+            return sendError(res, HttpStatus.FORBIDDEN, `This feature requires a higher plan (${feature})`, ErrorCode.INSUFFICIENT_PERMISSIONS);
+        }
+        next();
+    };
+}
+// ---------------------------------------------------------------------------
+// Service-to-service tokens
+//
+// Inter-service HTTP calls (billing → message, platform → compliance, etc.)
+// need to satisfy the same `requireAuth` middleware as user requests.
+// `signServiceToken` mints a short-lived JWT signed with the shared
+// JWT_SECRET, identifying the calling service via `sub: 'service:<name>'`.
+// `requireAuth` accepts these tokens transparently — they pass `decoded.sub`
+// and `decoded.role` checks, and downstream `requireOrganization` /
+// `requireSystemAdmin` rely on the org/role embedded in the token.
+//
+// Tokens default to 5-minute TTL — long enough to survive a backend hop,
+// short enough that a leaked token is low-value.
+// ---------------------------------------------------------------------------
+const DEFAULT_SERVICE_TOKEN_TTL_SECONDS = 300;
+/**
+ * Denylist of service NAMES (the `<name>` in `sub: service:<name>`) whose tokens
+ * `requireAuth` must reject. Seeded from `SERVICE_TOKEN_DENYLIST` (comma-separated)
+ * at module load; a service can push live updates (e.g. from a Redis-subscribed
+ * kill-switch) via {@link setServiceTokenDenylist} so a compromised service can be
+ * cut off WITHOUT rotating the shared JWT secret (which invalidates all of them).
+ */
+let serviceTokenDenylist = new Set((process.env.SERVICE_TOKEN_DENYLIST || '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean));
+/** Replace the service-token denylist (service names). Empty ⇒ kill-switch off. */
+export function setServiceTokenDenylist(names) {
+    serviceTokenDenylist = new Set([...names].map((s) => s.trim()).filter(Boolean));
+}
+/** True when `sub` is `service:<name>` and `<name>` is on the denylist. */
+export function isServiceTokenDenied(sub) {
+    if (serviceTokenDenylist.size === 0)
+        return false;
+    if (!sub.startsWith('service:'))
+        return false;
+    return serviceTokenDenylist.has(sub.slice('service:'.length));
+}
+/**
+ * Mint a JWT identifying the calling service. Used for inter-service HTTP calls.
+ * The token satisfies `requireAuth` and (when orgId is present) `requireOrganization`.
+ * Scope it with `opts.role` — least privilege keeps a leaked token low-value.
+ */
+export function signServiceToken(opts) {
+    const role = opts.role;
+    const payload = {
+        sub: `service:${opts.serviceName}`,
+        username: `${opts.serviceName}-service`,
+        email: `${opts.serviceName}@internal`,
+        role,
+        isAdmin: role === 'owner' || role === 'admin',
+        type: 'access',
+        organizationId: opts.orgId,
+        organizationName: opts.orgName ?? opts.orgId,
+        // Least-privilege capability claim (optional) — lets a member-role token
+        // satisfy a specific permission gate without carrying isAdmin.
+        ...(opts.permissions && opts.permissions.length > 0 ? { permissions: opts.permissions } : {}),
+    };
+    // Match the optional issuer/audience that requireAuth verifies, when
+    // configured. Without these, a service token signed here would fail
+    // requireAuth in a deployment that has set JWT_ISSUER/JWT_AUDIENCE.
+    const signOptions = {
+        expiresIn: opts.ttlSeconds ?? DEFAULT_SERVICE_TOKEN_TTL_SECONDS,
+        // Sign with the same configured alg requireAuth pins on verify, so service
+        // tokens stay valid under a non-default JWT_ALGORITHM.
+        algorithm: (process.env.JWT_ALGORITHM || 'HS256'),
+        // Unique token id on every mint. Combined with the short (300s default) TTL
+        // this gives each service token a distinct identity — the building block for
+        // replay detection (a verifier can track seen jtis) and the correlation
+        // handle for tracing which mint performed a cross-service action. It does
+        // NOT by itself prevent replay within the TTL window; true replay defence
+        // needs the asymmetric-key work tracked separately.
+        jwtid: randomUUID(),
+    };
+    if (process.env.JWT_ISSUER)
+        signOptions.issuer = process.env.JWT_ISSUER;
+    if (process.env.JWT_AUDIENCE)
+        signOptions.audience = process.env.JWT_AUDIENCE;
+    return jwt.sign(payload, getJwtSecret(), signOptions);
+}
+/** Convenience: returns a `Bearer <token>` header value for fetch/axios calls. */
+export function getServiceAuthHeader(opts) {
+    return `Bearer ${signServiceToken(opts)}`;
+}
+/** True when `req.user.sub` was issued by `signServiceToken` (i.e. starts with `service:`). */
+export function isServicePrincipal(req) {
+    return req.user?.sub?.startsWith('service:') ?? false;
+}
+/**
+ * PRE-auth check: cryptographically verify the request carries a valid, signed
+ * SERVICE token (`sub` starts with `service:`). Unlike {@link isServicePrincipal}
+ * (which reads the already-populated `req.user`), this verifies the bearer token
+ * itself, so it is safe to call BEFORE `requireAuth` runs — e.g. the global rate
+ * limiter's `skip`, which must not trust the spoofable `x-internal-service`
+ * header. Mirrors `requireAuth`'s verification (algorithm pinning + optional
+ * issuer/audience) and returns `false` on any missing/invalid/non-service token.
+ */
+export function verifyServicePrincipal(req) {
+    const parts = req.headers.authorization?.split(' ');
+    if (!parts || parts.length !== 2 || parts[0] !== 'Bearer')
+        return false;
+    try {
+        const verifyOptions = { algorithms: [(process.env.JWT_ALGORITHM || 'HS256')] };
+        if (process.env.JWT_ISSUER)
+            verifyOptions.issuer = process.env.JWT_ISSUER;
+        if (process.env.JWT_AUDIENCE)
+            verifyOptions.audience = process.env.JWT_AUDIENCE;
+        const decoded = verifyJwtWithRotation(parts[1], verifyOptions);
+        if (decoded.type !== 'access' || typeof decoded.sub !== 'string' || !decoded.sub.startsWith('service:'))
+            return false;
+        // A denylisted (killed) service must NOT be treated as a trusted principal —
+        // otherwise it keeps the rate-limiter exemption even though requireAuth rejects
+        // it on real routes. Fold the kill-switch into the pre-auth check too.
+        return !isServiceTokenDenied(decoded.sub);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9taWRkbGV3YXJlL2F1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sUUFBUSxDQUFDO0FBRXBDLE9BQU8sR0FBRyxNQUFNLGNBQWMsQ0FBQztBQUMvQixPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFekQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXBELE9BQU8sRUFBbUIsYUFBYSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDekUsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3RELE9BQU8sRUFBRSxXQUFXLEVBQXdCLE1BQU0sc0JBQXNCLENBQUM7QUFDekUsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFFakQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLGlCQUFpQixDQUFDLENBQUM7QUFFL0MsNERBQTREO0FBQzVELElBQUksVUFBOEIsQ0FBQztBQUNuQyxJQUFJLHFCQUFxQixHQUFHLENBQUMsQ0FBQztBQUM5Qiw4RUFBOEU7QUFDOUUsSUFBSSxrQkFBc0MsQ0FBQztBQUMzQyxJQUFJLDZCQUE2QixHQUFHLENBQUMsQ0FBQztBQUN0QyxNQUFNLDhCQUE4QixHQUFHLE9BQU8sQ0FBQyxDQUFDLFlBQVk7QUFFNUQsU0FBUyxZQUFZO0lBQ25CLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixJQUFJLENBQUMsVUFBVSxJQUFJLEdBQUcsR0FBRyxxQkFBcUIsR0FBRyw4QkFBOEIsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO1FBQ3RDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLE1BQU0sQ0FBQyxLQUFLLENBQUMsNENBQTRDLENBQUMsQ0FBQztZQUMzRCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELElBQUksVUFBVSxJQUFJLFVBQVUsS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUN4QyxNQUFNLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDcEMsQ0FBQztRQUNELFVBQVUsR0FBRyxNQUFNLENBQUM7UUFDcEIscUJBQXFCLEdBQUcsR0FBRyxDQUFDO0lBQzlCLENBQUM7SUFDRCxPQUFPLFVBQVUsQ0FBQztBQUNwQixDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxTQUFTLG9CQUFvQjtJQUMzQixNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7SUFDdkIsSUFBSSxHQUFHLEdBQUcsNkJBQTZCLEdBQUcsOEJBQThCLEVBQUUsQ0FBQztRQUN6RSxrQkFBa0IsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQixJQUFJLFNBQVMsQ0FBQztRQUNsRSw2QkFBNkIsR0FBRyxHQUFHLENBQUM7SUFDdEMsQ0FBQztJQUNELE9BQU8sa0JBQWtCLENBQUM7QUFDNUIsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUNILFNBQVMscUJBQXFCLENBQUMsS0FBYSxFQUFFLGFBQWdDO0lBQzVFLElBQUksQ0FBQztRQUNILE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsWUFBWSxFQUFFLEVBQUUsYUFBYSxDQUFlLENBQUM7SUFDeEUsQ0FBQztJQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7UUFDYixNQUFNLFFBQVEsR0FBRyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3hDLDZFQUE2RTtRQUM3RSw4RUFBOEU7UUFDOUUscUVBQXFFO1FBQ3JFLElBQ0UsUUFBUTtlQUNMLEdBQUcsWUFBWSxHQUFHLENBQUMsaUJBQWlCO2VBQ3BDLENBQUMsQ0FBQyxHQUFHLFlBQVksR0FBRyxDQUFDLGlCQUFpQixDQUFDO2VBQ3ZDLENBQUMsQ0FBQyxHQUFHLFlBQVksR0FBRyxDQUFDLGNBQWMsQ0FBQyxFQUN2QyxDQUFDO1lBQ0Qsd0VBQXdFO1lBQ3hFLDBFQUEwRTtZQUMxRSx3REFBd0Q7WUFDeEQsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsYUFBYSxDQUFlLENBQUM7UUFDbEUsQ0FBQztRQUNELE1BQU0sR0FBRyxDQUFDO0lBQ1osQ0FBQztBQUNILENBQUM7QUF3QkQsTUFBTSxVQUFVLFdBQVcsQ0FDekIsWUFBMkMsRUFDM0MsR0FBYyxFQUNkLElBQW1CO0lBRW5CLElBQUksWUFBWSxJQUFJLEdBQUcsSUFBSSxJQUFJLElBQUksU0FBUyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQzdELE9BQU8sWUFBWSxDQUFDLEVBQUUsRUFBRSxZQUF1QixFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUksWUFBbUMsSUFBSSxFQUFFLENBQUM7SUFDM0QsT0FBTyxDQUFDLEdBQVksRUFBRSxRQUFrQixFQUFFLFNBQXVCLEVBQUUsRUFBRTtRQUNuRSxZQUFZLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDbEQsQ0FBQyxDQUFDO0FBQ0osQ0FBQztBQWlCRCxJQUFJLG9CQUFzRCxDQUFDO0FBRTNEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUFDLEtBQXVDO0lBQzdFLG9CQUFvQixHQUFHLEtBQUssQ0FBQztJQUM3QixJQUFJLEtBQUs7UUFBRSw0QkFBNEIsR0FBRyxLQUFLLENBQUMsQ0FBQyxzQ0FBc0M7QUFDekYsQ0FBQztBQUVELGtGQUFrRjtBQUNsRixJQUFJLDRCQUE0QixHQUFHLEtBQUssQ0FBQztBQUV6Qzs7Ozs7R0FLRztBQUNILEtBQUssVUFBVSxjQUFjLENBQUMsT0FBbUI7SUFDL0MsTUFBTSxLQUFLLEdBQUcsb0JBQW9CLENBQUM7SUFDbkMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1gsOEVBQThFO1FBQzlFLDhFQUE4RTtRQUM5RSw4RUFBOEU7UUFDOUUsK0RBQStEO1FBQy9ELElBQUksQ0FBQyw0QkFBNEIsSUFBSSxPQUFPLENBQUMsR0FBRyxJQUFJLE9BQU8sT0FBTyxDQUFDLFlBQVksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUM3Riw0QkFBNEIsR0FBRyxJQUFJLENBQUM7WUFDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyw4S0FBOEssQ0FBQyxDQUFDO1FBQzlMLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsSUFBSSxPQUFPLE9BQU8sQ0FBQyxZQUFZLEtBQUssUUFBUTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQzNFLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLE1BQU0sS0FBSyxDQUFDLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMzRCxPQUFPLE9BQU8sS0FBSyxJQUFJLElBQUksT0FBTyxDQUFDLFlBQVksR0FBRyxPQUFPLENBQUM7SUFDNUQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLHFFQUFxRTtRQUNyRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsb0JBQW9CLENBQUMsTUFBK0M7SUFDeEYsT0FBTyxjQUFjLENBQUMsTUFBb0IsQ0FBQyxDQUFDO0FBQzlDLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FDbkIsT0FBMkIsRUFDM0IsR0FBWSxFQUNaLEdBQWEsRUFDYixJQUFrQjtJQUVsQixNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQztJQUU3QyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDaEIsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsK0JBQStCLEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzNHLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2hELE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLG1EQUFtRCxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsMEVBQTBFO1FBQzFFLHNFQUFzRTtRQUN0RSx5RUFBeUU7UUFDekUsb0RBQW9EO1FBQ3BELHlFQUF5RTtRQUN6RSx3RUFBd0U7UUFDeEUsc0VBQXNFO1FBQ3RFLHNFQUFzRTtRQUN0RSx3RUFBd0U7UUFDeEUsTUFBTSxhQUFhLEdBQXNCLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQWtCLENBQUMsRUFBRSxDQUFDO1FBQ25ILE1BQU0sY0FBYyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO1FBQzlDLE1BQU0sZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUM7UUFDbEQsSUFBSSxjQUFjO1lBQUUsYUFBYSxDQUFDLE1BQU0sR0FBRyxjQUFjLENBQUM7UUFDMUQsSUFBSSxnQkFBZ0I7WUFBRSxhQUFhLENBQUMsUUFBUSxHQUFHLGdCQUFnQixDQUFDO1FBQ2hFLE1BQU0sT0FBTyxHQUFHLHFCQUFxQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUUvRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDOUIsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsaURBQWlELEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzdILENBQUM7UUFFRCxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNsQyxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSwrQkFBK0IsRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0csQ0FBQztRQUVELDBFQUEwRTtRQUMxRSx5RUFBeUU7UUFDekUsNEVBQTRFO1FBQzVFLHdFQUF3RTtRQUN4RSw4RUFBOEU7UUFDOUUsMkVBQTJFO1FBQzNFLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksb0JBQW9CLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDNUUsV0FBVyxDQUFDLDRCQUE0QixFQUFFLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDN0YsTUFBTSxDQUFDLElBQUksQ0FBQyxtQ0FBbUMsRUFBRSxFQUFFLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUN2RSxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSx1QkFBdUIsRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDbkcsQ0FBQztRQUVELEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxHQUFHLE9BQU8sRUFBRSxDQUFDO1FBRTFCLHdFQUF3RTtRQUN4RSw4RUFBOEU7UUFDOUUsOEVBQThFO1FBQzlFLDhFQUE4RTtRQUM5RSw0RUFBNEU7UUFDNUUsSUFBSSxPQUFPLENBQUMsc0JBQXNCLElBQUksT0FBTyxDQUFDLFlBQVksS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNwRSxNQUFNLFdBQVcsR0FBRyxlQUFlLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBQzdELE1BQU0sYUFBYSxHQUFHLGVBQWUsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7WUFDakUsSUFBSSxXQUFXO2dCQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxHQUFHLFdBQVcsQ0FBQztZQUN2RCxJQUFJLGFBQWE7Z0JBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxhQUFhLENBQUM7UUFDL0QsQ0FBQztRQUVELHFFQUFxRTtRQUNyRSxFQUFFO1FBQ0YsMkVBQTJFO1FBQzNFLDRFQUE0RTtRQUM1RSx3RUFBd0U7UUFDeEUsMkVBQTJFO1FBQzNFLCtFQUErRTtRQUMvRSw2RUFBNkU7UUFDN0UsNEVBQTRFO1FBQzVFLDhFQUE4RTtRQUM5RSw4RUFBOEU7UUFDOUUsMkVBQTJFO1FBQzNFLDBFQUEwRTtRQUMxRSxvRUFBb0U7UUFDcEUsTUFBTSxNQUFNLEdBQUksR0FBNkQsQ0FBQyxPQUFPLENBQUM7UUFDdEYsSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUNYLE1BQU0sQ0FBQyxRQUFRLEdBQUcsV0FBVyxDQUFDLEdBQTZCLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBRUQsd0VBQXdFO1FBQ3hFLHlFQUF5RTtRQUN6RSw0RUFBNEU7UUFDNUUsMkVBQTJFO1FBQzNFLElBQUksb0JBQW9CLElBQUksT0FBTyxDQUFDLEdBQUcsSUFBSSxPQUFPLE9BQU8sQ0FBQyxZQUFZLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDcEYsMEVBQTBFO1lBQzFFLDBFQUEwRTtZQUMxRSxzRUFBc0U7WUFDdEUsNEVBQTRFO1lBQzVFLDBFQUEwRTtZQUMxRSxtQ0FBbUM7WUFDbkMsY0FBYyxDQUFDLE9BQU8sQ0FBQztpQkFDcEIsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7Z0JBQ2hCLElBQUksT0FBTyxFQUFFLENBQUM7b0JBQ1osT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsZ0RBQWdELEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2dCQUM1SCxDQUFDO2dCQUNELElBQUksRUFBRSxDQUFDO1lBQ1QsQ0FBQyxDQUFDO2lCQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNmLE9BQU87UUFDVCxDQUFDO1FBRUQsSUFBSSxFQUFFLENBQUM7SUFDVCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLEdBQUcsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQzNDLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLG1CQUFtQixFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMvRixDQUFDO1FBRUQsSUFBSSxLQUFLLFlBQVksR0FBRyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDM0MsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsZUFBZSxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsdUJBQXVCLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ2xHLENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxHQUFZLEVBQUUsVUFBc0I7SUFDcEUsT0FBTyxhQUFhLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxJQUFJLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDbEYsQ0FBQztBQW9CRDs7Ozs7OztHQU9HO0FBQ0gsSUFBSSxrQkFBaUUsQ0FBQztBQUV0RTs7O0dBR0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUMsRUFBaUQ7SUFDckYsa0JBQWtCLEdBQUcsRUFBRSxDQUFDO0FBQzFCLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBUyxnQkFBZ0IsQ0FBQyxHQUFZLEVBQUUsUUFBZ0I7SUFDdEQsTUFBTSxPQUFPLEdBQUcsa0JBQWtCLENBQUM7SUFDbkMsSUFBSSxDQUFDLE9BQU87UUFBRSxPQUFPO0lBQ3JCLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDeEMsSUFBSSxNQUFNLEtBQUssS0FBSyxJQUFJLE1BQU0sS0FBSyxNQUFNLElBQUksTUFBTSxLQUFLLFNBQVM7UUFBRSxPQUFPO0lBQzFFLElBQUksQ0FBQztRQUNILE9BQU8sQ0FBQztZQUNOLE9BQU8sRUFBRSxHQUFHLENBQUMsSUFBSSxFQUFFLEdBQUc7WUFDdEIsVUFBVSxFQUFFLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSztZQUMzQixLQUFLLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxjQUFjO1lBQy9CLE1BQU07WUFDTiwwRUFBMEU7WUFDMUUsdUVBQXVFO1lBQ3ZFLElBQUksRUFBRSxDQUFDLEdBQUcsQ0FBQyxXQUFXLElBQUksR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDaEQsUUFBUTtTQUNULENBQUMsQ0FBQztJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxpRUFBaUU7SUFDbkUsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxHQUFHLFdBQXlCO0lBQzVELE9BQU8sQ0FBQyxHQUFZLEVBQUUsR0FBYSxFQUFFLElBQWtCLEVBQVEsRUFBRTtRQUMvRCxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2QsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUseUJBQXlCLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3BHLENBQUM7UUFDRCxxRUFBcUU7UUFDckUseUVBQXlFO1FBQ3pFLHlEQUF5RDtRQUN6RCxJQUFJLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUFFLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEUsZ0JBQWdCLENBQUMsR0FBRyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNoRCxPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLFNBQVMsRUFDekIsZ0NBQWdDLFdBQVcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFDMUQsU0FBUyxDQUFDLHdCQUF3QixDQUNuQyxDQUFDO0lBQ0osQ0FBQyxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUMsR0FBRyxXQUF5QjtJQUNoRSxPQUFPLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQixFQUFRLEVBQUU7UUFDL0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNkLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLHlCQUF5QixFQUFFLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDeEMsZ0JBQWdCLENBQUMsR0FBRyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUNqRCxPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLFNBQVMsRUFDekIsZ0NBQWdDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFDdkQsU0FBUyxDQUFDLHdCQUF3QixDQUNuQyxDQUFDO0lBQ0osQ0FBQyxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLFVBQVUsMEJBQTBCLENBQUMsR0FBRyxXQUF5QjtJQUNyRSxPQUFPLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQixFQUFRLEVBQUU7UUFDL0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNkLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLHlCQUF5QixFQUFFLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBQ0QsSUFBSSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsSUFBSSxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFBRSxPQUFPLElBQUksRUFBRSxDQUFDO1FBQ2pHLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDaEQsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLGdDQUFnQyxXQUFXLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQzFELFNBQVMsQ0FBQyx3QkFBd0IsQ0FDbkMsQ0FBQztJQUNKLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsdUJBQXVCLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQjtJQUNyRixJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM3QiwwRUFBMEU7UUFDMUUsaUZBQWlGO1FBQ2pGLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsU0FBUyxFQUFFLDZCQUE2QixFQUFFLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBQ2pILENBQUM7SUFDRCxJQUFJLEVBQUUsQ0FBQztBQUNULENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxhQUFhLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSwwQkFBMEIsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDO0FBRXJHLHdHQUF3RztBQUN4RyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBRXhDOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGFBQWEsQ0FBQyxLQUFjLEVBQUUsT0FBZ0I7SUFDNUQsT0FBTyxLQUFLLEVBQUUsV0FBVyxFQUFFLEtBQUssYUFBYSxJQUFJLE9BQU8sRUFBRSxXQUFXLEVBQUUsS0FBSyxlQUFlLENBQUM7QUFDOUYsQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLFVBQVUsYUFBYSxDQUFDLEdBQVk7SUFDeEMsT0FBTyxHQUFHLENBQUMsSUFBSSxFQUFFLFlBQVksS0FBSyxJQUFJLENBQUM7QUFDekMsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFDLEdBQVksRUFBRSxLQUFhO0lBQ2xELE9BQU8sR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLEtBQUssS0FBSyxDQUFDO0FBQ25DLENBQUM7QUFFRDtvRUFDb0U7QUFDcEUsTUFBTSxVQUFVLGtCQUFrQixDQUNoQyxHQUFZLEVBQ1osR0FBYSxFQUNiLElBQWtCO0lBRWxCLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN4QixnQkFBZ0IsQ0FBQyxHQUFHLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDdEMsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLG9FQUFvRSxFQUNwRSxTQUFTLENBQUMsd0JBQXdCLENBQ25DLENBQUM7SUFDSixDQUFDO0lBQ0QsSUFBSSxFQUFFLENBQUM7QUFDVCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxjQUFjLENBQUMsT0FBZTtJQUM1QyxPQUFPLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQixFQUFRLEVBQUU7UUFDL0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNkLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLHlCQUF5QixFQUFFLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBRUQscUVBQXFFO1FBQ3JFLHVFQUF1RTtRQUN2RSxxRUFBcUU7UUFDckUsa0JBQWtCO1FBQ2xCLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxZQUFZLEtBQUssSUFBSTtZQUFFLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFFbEQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzFDLDREQUE0RDtZQUM1RCwyREFBMkQ7WUFDM0Qsc0VBQXNFO1lBQ3RFLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxXQUFXLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDNUMsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLHdDQUF3QyxPQUFPLEdBQUcsRUFDbEQsU0FBUyxDQUFDLHdCQUF3QixDQUNuQyxDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksRUFBRSxDQUFDO0lBQ1QsQ0FBQyxDQUFDO0FBQ0osQ0FBQztBQUVELDhFQUE4RTtBQUM5RSw0QkFBNEI7QUFDNUIsRUFBRTtBQUNGLDRFQUE0RTtBQUM1RSxzRUFBc0U7QUFDdEUsb0VBQW9FO0FBQ3BFLDJFQUEyRTtBQUMzRSw2RUFBNkU7QUFDN0Usb0VBQW9FO0FBQ3BFLG1FQUFtRTtBQUNuRSxFQUFFO0FBQ0YseUVBQXlFO0FBQ3pFLGlEQUFpRDtBQUNqRCw4RUFBOEU7QUFFOUUsTUFBTSxpQ0FBaUMsR0FBRyxHQUFHLENBQUM7QUFFOUM7Ozs7OztHQU1HO0FBQ0gsSUFBSSxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FDaEMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHNCQUFzQixJQUFJLEVBQUUsQ0FBQztLQUN2QyxLQUFLLENBQUMsR0FBRyxDQUFDO0tBQ1YsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7S0FDcEIsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUNuQixDQUFDO0FBRUYsbUZBQW1GO0FBQ25GLE1BQU0sVUFBVSx1QkFBdUIsQ0FBQyxLQUF1QjtJQUM3RCxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztBQUNsRixDQUFDO0FBRUQsMkVBQTJFO0FBQzNFLE1BQU0sVUFBVSxvQkFBb0IsQ0FBQyxHQUFXO0lBQzlDLElBQUksb0JBQW9CLENBQUMsSUFBSSxLQUFLLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUNsRCxJQUFJLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUM5QyxPQUFPLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUE2QkQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxJQUF5QjtJQUN4RCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDO0lBQ3ZCLE1BQU0sT0FBTyxHQUFlO1FBQzFCLEdBQUcsRUFBRSxXQUFXLElBQUksQ0FBQyxXQUFXLEVBQUU7UUFDbEMsUUFBUSxFQUFFLEdBQUcsSUFBSSxDQUFDLFdBQVcsVUFBVTtRQUN2QyxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsV0FBVyxXQUFXO1FBQ3JDLElBQUk7UUFDSixPQUFPLEVBQUUsSUFBSSxLQUFLLE9BQU8sSUFBSSxJQUFJLEtBQUssT0FBTztRQUM3QyxJQUFJLEVBQUUsUUFBUTtRQUNkLGNBQWMsRUFBRSxJQUFJLENBQUMsS0FBSztRQUMxQixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxLQUFLO1FBQzVDLHlFQUF5RTtRQUN6RSwrREFBK0Q7UUFDL0QsR0FBRyxDQUFDLElBQUksQ0FBQyxXQUFXLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztLQUM5RixDQUFDO0lBQ0YscUVBQXFFO0lBQ3JFLG9FQUFvRTtJQUNwRSxvRUFBb0U7SUFDcEUsTUFBTSxXQUFXLEdBQW9CO1FBQ25DLFNBQVMsRUFBRSxJQUFJLENBQUMsVUFBVSxJQUFJLGlDQUFpQztRQUMvRCwyRUFBMkU7UUFDM0UsdURBQXVEO1FBQ3ZELFNBQVMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxJQUFJLE9BQU8sQ0FBa0I7UUFDbEUsNEVBQTRFO1FBQzVFLDZFQUE2RTtRQUM3RSx3RUFBd0U7UUFDeEUsMEVBQTBFO1FBQzFFLDBFQUEwRTtRQUMxRSxvREFBb0Q7UUFDcEQsS0FBSyxFQUFFLFVBQVUsRUFBRTtLQUNwQixDQUFDO0lBQ0YsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVU7UUFBRSxXQUFXLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO0lBQ3hFLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZO1FBQUUsV0FBVyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQztJQUM5RSxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFlBQVksRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxVQUFVLG9CQUFvQixDQUFDLElBQXlCO0lBQzVELE9BQU8sVUFBVSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQzVDLENBQUM7QUFFRCwrRkFBK0Y7QUFDL0YsTUFBTSxVQUFVLGtCQUFrQixDQUFDLEdBQVk7SUFDN0MsT0FBTyxHQUFHLENBQUMsSUFBSSxFQUFFLEdBQUcsRUFBRSxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxDQUFDO0FBQ3hELENBQUM7QUFFRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FBQyxHQUFZO0lBQ2pELE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNwRCxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxRQUFRO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDeEUsSUFBSSxDQUFDO1FBQ0gsTUFBTSxhQUFhLEdBQXNCLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQWtCLENBQUMsRUFBRSxDQUFDO1FBQ25ILElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVO1lBQUUsYUFBYSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQztRQUMxRSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWTtZQUFFLGFBQWEsQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUM7UUFDaEYsTUFBTSxPQUFPLEdBQUcscUJBQXFCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBQy9ELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3RILDZFQUE2RTtRQUM3RSxnRkFBZ0Y7UUFDaEYsdUVBQXVFO1FBQ3ZFLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgcmFuZG9tVVVJRCB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgdHlwZSB7IFJlcXVlc3QsIFJlc3BvbnNlLCBOZXh0RnVuY3Rpb24gfSBmcm9tICdleHByZXNzJztcbmltcG9ydCBqd3QgZnJvbSAnanNvbndlYnRva2VuJztcbmltcG9ydCB7IEh0dHBTdGF0dXMgfSBmcm9tICcuLi9jb25zdGFudHMvaHR0cC1zdGF0dXMuanMnO1xuaW1wb3J0IHR5cGUgeyBKd3RQYXlsb2FkIH0gZnJvbSAnLi4vdHlwZXMvY29tbW9uLmpzJztcbmltcG9ydCB7IEVycm9yQ29kZSB9IGZyb20gJy4uL3R5cGVzL2Vycm9yLWNvZGVzLmpzJztcbmltcG9ydCB0eXBlIHsgSHR0cFJlcXVlc3QgfSBmcm9tICcuLi90eXBlcy9odHRwLmpzJztcbmltcG9ydCB7IHR5cGUgUGVybWlzc2lvbiwgaGFzUGVybWlzc2lvbiB9IGZyb20gJy4uL3R5cGVzL3Blcm1pc3Npb25zLmpzJztcbmltcG9ydCB7IGdldEhlYWRlclN0cmluZyB9IGZyb20gJy4uL3V0aWxzL2hlYWRlcnMuanMnO1xuaW1wb3J0IHsgZ2V0SWRlbnRpdHksIHR5cGUgUmVxdWVzdElkZW50aXR5IH0gZnJvbSAnLi4vdXRpbHMvaWRlbnRpdHkuanMnO1xuaW1wb3J0IHsgY3JlYXRlTG9nZ2VyIH0gZnJvbSAnLi4vdXRpbHMvbG9nZ2VyLmpzJztcbmltcG9ydCB7IGVtaXRDb3VudGVyIH0gZnJvbSAnLi4vdXRpbHMvbWV0cmljLWVtaXR0ZXIuanMnO1xuaW1wb3J0IHsgc2VuZEVycm9yIH0gZnJvbSAnLi4vdXRpbHMvcmVzcG9uc2UuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ2F1dGgtbWlkZGxld2FyZScpO1xuXG4vKiogQ2FjaGVkIEpXVCBzZWNyZXQgd2l0aCBwZXJpb2RpYyByZWZyZXNoIGZyb20gZW52IHZhci4gKi9cbmxldCBfand0U2VjcmV0OiBzdHJpbmcgfCB1bmRlZmluZWQ7XG5sZXQgX2p3dFNlY3JldFJlZnJlc2hlZEF0ID0gMDtcbi8qKiBDYWNoZWQgUFJFVklPVVMgSldUIHNlY3JldCAob3B0aW9uYWwpIOKAlCBlbmFibGVzIHplcm8tZG93bnRpbWUgcm90YXRpb24uICovXG5sZXQgX2p3dFNlY3JldFByZXZpb3VzOiBzdHJpbmcgfCB1bmRlZmluZWQ7XG5sZXQgX2p3dFNlY3JldFByZXZpb3VzUmVmcmVzaGVkQXQgPSAwO1xuY29uc3QgSldUX1NFQ1JFVF9SRUZSRVNIX0lOVEVSVkFMX01TID0gMzAwXzAwMDsgLy8gNSBtaW51dGVzXG5cbmZ1bmN0aW9uIGdldEp3dFNlY3JldCgpOiBzdHJpbmcge1xuICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICBpZiAoIV9qd3RTZWNyZXQgfHwgbm93IC0gX2p3dFNlY3JldFJlZnJlc2hlZEF0ID4gSldUX1NFQ1JFVF9SRUZSRVNIX0lOVEVSVkFMX01TKSB7XG4gICAgY29uc3Qgc2VjcmV0ID0gcHJvY2Vzcy5lbnYuSldUX1NFQ1JFVDtcbiAgICBpZiAoIXNlY3JldCkge1xuICAgICAgbG9nZ2VyLmVycm9yKCdKV1RfU0VDUkVUIGVudmlyb25tZW50IHZhcmlhYmxlIGlzIG5vdCBzZXQnKTtcbiAgICAgIHRocm93IG5ldyBFcnJvcignSldUX1NFQ1JFVCBlbnZpcm9ubWVudCB2YXJpYWJsZSBpcyByZXF1aXJlZCcpO1xuICAgIH1cbiAgICBpZiAoX2p3dFNlY3JldCAmJiBfand0U2VjcmV0ICE9PSBzZWNyZXQpIHtcbiAgICAgIGxvZ2dlci5pbmZvKCdKV1Qgc2VjcmV0IHJvdGF0ZWQnKTtcbiAgICB9XG4gICAgX2p3dFNlY3JldCA9IHNlY3JldDtcbiAgICBfand0U2VjcmV0UmVmcmVzaGVkQXQgPSBub3c7XG4gIH1cbiAgcmV0dXJuIF9qd3RTZWNyZXQ7XG59XG5cbi8qKlxuICogVGhlIG9wdGlvbmFsIFBSRVZJT1VTIEpXVCBzZWNyZXQgKGBKV1RfU0VDUkVUX1BSRVZJT1VTYCksIGNhY2hlZCB3aXRoIHRoZSBzYW1lXG4gKiBUVEwgYXMgdGhlIHByaW1hcnkuIFJldHVybnMgYHVuZGVmaW5lZGAgd2hlbiB1bnNldC4gRHVyaW5nIGEgYEpXVF9TRUNSRVRgXG4gKiByb3RhdGlvbiwgb3BlcmF0b3JzIHNldCBgSldUX1NFQ1JFVF9QUkVWSU9VU2AgdG8gdGhlIG9sZCB2YWx1ZSBzbyB0b2tlbnMgc2lnbmVkXG4gKiB3aXRoIEVJVEhFUiBzZWNyZXQga2VlcCB2ZXJpZnlpbmcg4oCUIGNsb3NpbmcgdGhlIGF1dGgtb3V0YWdlIHdpbmRvdyB3aGVyZVxuICogc3RpbGwtdmFsaWQgb2xkLXNpZ25lZCAob3IgZnJlc2hseSBuZXctc2lnbmVkKSB0b2tlbnMgd291bGQgb3RoZXJ3aXNlIGJlXG4gKiByZWplY3RlZC4gYHVuZGVmaW5lZGAgaXMgYSB2YWxpZCBjYWNoZWQgdmFsdWUsIHNvIHRoaXMgcmVmcmVzaGVzIHB1cmVseSBvbiB0aGVcbiAqIHRpbWUgaW50ZXJ2YWwgKG5vdCBvbiBlbXB0aW5lc3MpLlxuICovXG5mdW5jdGlvbiBnZXRKd3RTZWNyZXRQcmV2aW91cygpOiBzdHJpbmcgfCB1bmRlZmluZWQge1xuICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICBpZiAobm93IC0gX2p3dFNlY3JldFByZXZpb3VzUmVmcmVzaGVkQXQgPiBKV1RfU0VDUkVUX1JFRlJFU0hfSU5URVJWQUxfTVMpIHtcbiAgICBfand0U2VjcmV0UHJldmlvdXMgPSBwcm9jZXNzLmVudi5KV1RfU0VDUkVUX1BSRVZJT1VTIHx8IHVuZGVmaW5lZDtcbiAgICBfand0U2VjcmV0UHJldmlvdXNSZWZyZXNoZWRBdCA9IG5vdztcbiAgfVxuICByZXR1cm4gX2p3dFNlY3JldFByZXZpb3VzO1xufVxuXG4vKipcbiAqIFZlcmlmeSBhIEpXVCBhZ2FpbnN0IHRoZSBwcmltYXJ5IHNlY3JldCwgZmFsbGluZyBiYWNrIHRvIHRoZSBwcmV2aW91cyBzZWNyZXRcbiAqICh3aGVuIGBKV1RfU0VDUkVUX1BSRVZJT1VTYCBpcyBjb25maWd1cmVkKSBPTkxZIG9uIGEgc2lnbmF0dXJlL3ZlcmlmaWNhdGlvblxuICogZmFpbHVyZS4gVGhpcyBtYWtlcyB0b2tlbiB2ZXJpZmljYXRpb24gc3Vydml2ZSBhIHNlY3JldCByb3RhdGlvbiB3aXRoIHplcm9cbiAqIGRvd250aW1lOiBhIHRva2VuIHZhbGlkIHVuZGVyIEVJVEhFUiBzZWNyZXQgcGFzc2VzLlxuICpcbiAqIGpzb253ZWJ0b2tlbidzIGB2ZXJpZnlgIHRha2VzIGEgc2luZ2xlIHNlY3JldCwgc28gdGhpcyBpcyB0cnktcHJpbWFyeS10aGVuLVxuICogcHJldmlvdXMg4oCUIE5PVCBhIHNlY3JldCBhcnJheS4gTm8gZXhpc3RpbmcgY2hlY2sgaXMgd2Vha2VuZWQ6XG4gKiAgIC0gYHZlcmlmeU9wdGlvbnNgIChhbGdvcml0aG0gcGlubmluZyArIG9wdGlvbmFsIGlzc3Vlci9hdWRpZW5jZSkgaXMgYXBwbGllZFxuICogICAgIGlkZW50aWNhbGx5IG9uIEJPVEggYXR0ZW1wdHMsIHNvIGFsZy1jb25mdXNpb24gLyBgYWxnOm5vbmVgIHN0YXkgYmxvY2tlZC5cbiAqICAgLSBFeHBpcnkgLyBub3QtYmVmb3JlIGZyb20gdGhlIFBSSU1BUlkgYXR0ZW1wdCBhcmUgYXV0aG9yaXRhdGl2ZSBhbmQgYXJlXG4gKiAgICAgcmUtdGhyb3duIHdpdGhvdXQgYSBwcmV2aW91cy1zZWNyZXQgcmV0cnksIHNvIGEgYFRva2VuRXhwaXJlZEVycm9yYCBpc1xuICogICAgIG5ldmVyIG1hc2tlZCBpbnRvIGFuIFwiaW52YWxpZCBzaWduYXR1cmVcIi5cbiAqICAgLSBXaGVuIG5vIHByZXZpb3VzIHNlY3JldCBpcyBzZXQsIGJlaGF2aW91ciBpcyBieXRlLWZvci1ieXRlIHRoZSBvcmlnaW5hbDpcbiAqICAgICB0aGUgcHJpbWFyeSBlcnJvciBwcm9wYWdhdGVzIHVuY2hhbmdlZC5cbiAqL1xuZnVuY3Rpb24gdmVyaWZ5Snd0V2l0aFJvdGF0aW9uKHRva2VuOiBzdHJpbmcsIHZlcmlmeU9wdGlvbnM6IGp3dC5WZXJpZnlPcHRpb25zKTogSnd0UGF5bG9hZCB7XG4gIHRyeSB7XG4gICAgcmV0dXJuIGp3dC52ZXJpZnkodG9rZW4sIGdldEp3dFNlY3JldCgpLCB2ZXJpZnlPcHRpb25zKSBhcyBKd3RQYXlsb2FkO1xuICB9IGNhdGNoIChlcnIpIHtcbiAgICBjb25zdCBwcmV2aW91cyA9IGdldEp3dFNlY3JldFByZXZpb3VzKCk7XG4gICAgLy8gRmFsbCBiYWNrIHRvIHRoZSBwcmV2aW91cyBzZWNyZXQgb25seSBmb3IgYSBzaWduYXR1cmUvdmVyaWZpY2F0aW9uIGZhaWx1cmVcbiAgICAvLyAoYSBwbGFpbiBKc29uV2ViVG9rZW5FcnJvcikuIEV4cGlyeSAvIG5vdC1iZWZvcmUgYXJlIGVuZm9yY2VkIHJlZ2FyZGxlc3Mgb2ZcbiAgICAvLyB3aGljaCBzZWNyZXQgc2lnbmVkIHRoZSB0b2tlbiwgc28gdGhvc2UgZXJyb3JzIG11c3Qgc3VyZmFjZSBhcy1pcy5cbiAgICBpZiAoXG4gICAgICBwcmV2aW91c1xuICAgICAgJiYgZXJyIGluc3RhbmNlb2Ygand0Lkpzb25XZWJUb2tlbkVycm9yXG4gICAgICAmJiAhKGVyciBpbnN0YW5jZW9mIGp3dC5Ub2tlbkV4cGlyZWRFcnJvcilcbiAgICAgICYmICEoZXJyIGluc3RhbmNlb2Ygand0Lk5vdEJlZm9yZUVycm9yKVxuICAgICkge1xuICAgICAgLy8gQSB0b2tlbiBzaWduZWQgYnkgdGhlIHByZXZpb3VzIHNlY3JldCB2ZXJpZmllcyBoZXJlOyBpZiBpdCBpcyBpbnN0ZWFkXG4gICAgICAvLyBleHBpcmVkL2ludmFsaWQgdW5kZXIgdGhlIHByZXZpb3VzIHNlY3JldCwgdGhhdCBlcnJvciBwcm9wYWdhdGVzIGFuZCBpc1xuICAgICAgLy8gaGFuZGxlZCBieSB0aGUgY2FsbGVyIGV4YWN0bHkgbGlrZSBhIHByaW1hcnkgZmFpbHVyZS5cbiAgICAgIHJldHVybiBqd3QudmVyaWZ5KHRva2VuLCBwcmV2aW91cywgdmVyaWZ5T3B0aW9ucykgYXMgSnd0UGF5bG9hZDtcbiAgICB9XG4gICAgdGhyb3cgZXJyO1xuICB9XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVxdWlyZUF1dGhPcHRpb25zIHtcbiAgLyoqXG4gICAqIEFsbG93IHgtb3JnLWlkL3gtb3JnLW5hbWUgaGVhZGVycyB0byBvdmVycmlkZSB0aGUgSldUJ3Mgb3JnYW5pemF0aW9uIGZpZWxkcy5cbiAgICpcbiAgICogV2hlbiBlbmFibGVkLCB0aGUgYHgtb3JnLWlkYC9geC1vcmctbmFtZWAgaGVhZGVycyBvdmVycmlkZSB0aGUgY2FsbGVyJ3Mgb3JnXG4gICAqIOKAlCBidXQgT05MWSBmb3IgYSB2ZXJpZmllZCBTWVMtQURNSU4gKGBpc1N1cGVyQWRtaW5gIGNsYWltKS4gRm9yIGFueSBvcmRpbmFyeVxuICAgKiBhdXRoZW50aWNhdGVkIHVzZXIgdGhlIGhlYWRlcnMgYXJlIGlnbm9yZWQsIHNvIGVuYWJsaW5nIHRoaXMgY2FuIG5ldmVyIGxldCBhXG4gICAqIG5vcm1hbCB1c2VyIGltcGVyc29uYXRlIGFub3RoZXIgdGVuYW50J3Mgb3JnLiBVc2UgZm9yIGNyb3NzLW9yZyBhZG1pbiB0b29saW5nXG4gICAqIChlLmcuIGEgc3lzYWRtaW4gbWFuYWdpbmcgYSBnaXZlbiBvcmcncyBiaWxsaW5nKS4gSWYgdW5zdXJlLCBsZWF2ZSBpdCBkaXNhYmxlZC5cbiAgICovXG4gIGFsbG93T3JnSGVhZGVyT3ZlcnJpZGU/OiBib29sZWFuO1xufVxuXG4vKiogSldUIGF1dGggbWlkZGxld2FyZS4gVXNlIGRpcmVjdGx5IG9yIGNhbGwgd2l0aCBvcHRpb25zLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlcXVpcmVBdXRoKFxuICByZXE6IFJlcXVlc3QsXG4gIHJlczogUmVzcG9uc2UsXG4gIG5leHQ6IE5leHRGdW5jdGlvbixcbik6IHZvaWQ7XG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZUF1dGgoXG4gIG9wdGlvbnM/OiBSZXF1aXJlQXV0aE9wdGlvbnMsXG4pOiAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pID0+IHZvaWQ7XG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZUF1dGgoXG4gIHJlcU9yT3B0aW9ucz86IFJlcXVlc3QgfCBSZXF1aXJlQXV0aE9wdGlvbnMsXG4gIHJlcz86IFJlc3BvbnNlLFxuICBuZXh0PzogTmV4dEZ1bmN0aW9uLFxuKTogdm9pZCB8ICgocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pID0+IHZvaWQpIHtcbiAgaWYgKHJlcU9yT3B0aW9ucyAmJiByZXMgJiYgbmV4dCAmJiAnaGVhZGVycycgaW4gcmVxT3JPcHRpb25zKSB7XG4gICAgcmV0dXJuIF9yZXF1aXJlQXV0aCh7fSwgcmVxT3JPcHRpb25zIGFzIFJlcXVlc3QsIHJlcywgbmV4dCk7XG4gIH1cblxuICBjb25zdCBvcHRpb25zID0gKHJlcU9yT3B0aW9ucyBhcyBSZXF1aXJlQXV0aE9wdGlvbnMpIHx8IHt9O1xuICByZXR1cm4gKHJlcTogUmVxdWVzdCwgcmVzSW5uZXI6IFJlc3BvbnNlLCBuZXh0SW5uZXI6IE5leHRGdW5jdGlvbikgPT4ge1xuICAgIF9yZXF1aXJlQXV0aChvcHRpb25zLCByZXEsIHJlc0lubmVyLCBuZXh0SW5uZXIpO1xuICB9O1xufVxuXG4vKipcbiAqIEEgc291cmNlIG9mIHRoZSBDVVJSRU5UIGB0b2tlblZlcnNpb25gIGZvciBhIHVzZXIsIGJhY2tlZCBieSBhIHN0b3JlIHRoZVxuICogc3RhdGVsZXNzIHNlcnZpY2VzIGNhbiByZWFkIChpbiBwcmFjdGljZSBhIFJlZGlzIGtleSB0aGUgcGxhdGZvcm0gcHVibGlzaGVzXG4gKiB0byBvbiBldmVyeSBwcml2aWxlZ2UgY2hhbmdlKS4gUmVnaXN0ZXJlZCB2aWEge0BsaW5rIHNldFRva2VuUmV2b2NhdGlvblN0b3JlfS5cbiAqXG4gKiBgZ2V0Q3VycmVudFZlcnNpb25gIHJldHVybnMgdGhlIHVzZXIncyBjdXJyZW50IHZlcnNpb24sIG9yIGBudWxsYCB3aGVuIHRoZVxuICogc3RvcmUgaGFzIG5vIGVudHJ5IOKAlCBhIG1pc3MgaXMgdHJlYXRlZCBhcyBcIm5vIGtub3duIHJldm9jYXRpb25cIiAoZmFpbC1vcGVuKTpcbiAqIHJldm9jYXRpb24gZW50cmllcyBhcmUgcHVibGlzaGVkIHdpdGggYSBUVEwgbWF0Y2hpbmcgdGhlIGFjY2Vzcy10b2tlblxuICogbGlmZXRpbWUsIHNvIGEgbWlzc2luZyBlbnRyeSBtZWFucyBhbnkgdG9rZW4gb2xkIGVub3VnaCB0byBwcmVkYXRlIGl0IGhhc1xuICogYWxyZWFkeSBleHBpcmVkIG9uIGl0cyBvd24uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVG9rZW5SZXZvY2F0aW9uU3RvcmUge1xuICBnZXRDdXJyZW50VmVyc2lvbih1c2VySWQ6IHN0cmluZyk6IFByb21pc2U8bnVtYmVyIHwgbnVsbD47XG59XG5cbmxldCB0b2tlblJldm9jYXRpb25TdG9yZTogVG9rZW5SZXZvY2F0aW9uU3RvcmUgfCB1bmRlZmluZWQ7XG5cbi8qKlxuICogUmVnaXN0ZXIgKG9yIGNsZWFyLCB3aXRoIGB1bmRlZmluZWRgKSB0aGUgcHJvY2Vzcy13aWRlIHRva2VuLXJldm9jYXRpb24gc3RvcmUuXG4gKiBXaGVuIHVuc2V0ICh0aGUgZGVmYXVsdCksIGByZXF1aXJlQXV0aGAgcGVyZm9ybXMgTk8gcmV2b2NhdGlvbiBjaGVjayAoaXQgcmVsaWVzXG4gKiBvbiB0aGUgc2hvcnQgYWNjZXNzLXRva2VuIFRUTCk7IHNlcnZpY2VzIG9wdCBpbiBhdCBib290IGJ5IHdpcmluZyB0aGVpciBSZWRpc1xuICogY2xpZW50LiBQbGF0Zm9ybSBrZWVwcyBpdHMgb3duIE1vbmdvLWJhY2tlZCBjaGVjayBhbmQgbmVlZCBub3QgcmVnaXN0ZXIgb25lLlxuICovXG5leHBvcnQgZnVuY3Rpb24gc2V0VG9rZW5SZXZvY2F0aW9uU3RvcmUoc3RvcmU6IFRva2VuUmV2b2NhdGlvblN0b3JlIHwgdW5kZWZpbmVkKTogdm9pZCB7XG4gIHRva2VuUmV2b2NhdGlvblN0b3JlID0gc3RvcmU7XG4gIGlmIChzdG9yZSkgcmV2b2NhdGlvblN0b3JlTWlzc2luZ1dhcm5lZCA9IGZhbHNlOyAvLyByZS1hcm0gaWYgYSBzdG9yZSBpcyAocmUpcmVnaXN0ZXJlZFxufVxuXG4vKiogT25lLXNob3QgZ3VhcmQgc28gdGhlIFwicmV2b2NhdGlvbiBpbmFjdGl2ZVwiIHdhcm5pbmcgZG9lc24ndCBmbG9vZCB0aGUgbG9ncy4gKi9cbmxldCByZXZvY2F0aW9uU3RvcmVNaXNzaW5nV2FybmVkID0gZmFsc2U7XG5cbi8qKlxuICogUmV0dXJucyB0cnVlIHdoZW4gYGRlY29kZWRgIGhhcyBiZWVuIHJldm9rZWQgcGVyIHRoZSByZWdpc3RlcmVkIHN0b3JlOiBpdHNcbiAqIGVtYmVkZGVkIGB0b2tlblZlcnNpb25gIGlzIHN0cmljdGx5IGJlaGluZCB0aGUgc3RvcmUncyBjdXJyZW50IHZlcnNpb24uXG4gKiBGYWlsLW9wZW4g4oCUIGFueSBzdG9yZSBlcnJvciwgYSBtaXNzaW5nIGVudHJ5LCBvciBhIHRva2VuL3N0b3JlIHdpdGhvdXQgYVxuICogdXNhYmxlIHZlcnNpb24geWllbGRzIGBmYWxzZWAgKGFsbG93KS4gTmV2ZXIgdGhyb3dzLlxuICovXG5hc3luYyBmdW5jdGlvbiBpc1Rva2VuUmV2b2tlZChkZWNvZGVkOiBKd3RQYXlsb2FkKTogUHJvbWlzZTxib29sZWFuPiB7XG4gIGNvbnN0IHN0b3JlID0gdG9rZW5SZXZvY2F0aW9uU3RvcmU7XG4gIGlmICghc3RvcmUpIHtcbiAgICAvLyBNYWtlIHRoZSBcInJldm9jYXRpb24gaXMgT0ZGXCIgc3RhdGUgT0JTRVJWQUJMRTogYSBzZXJ2aWNlIHRoYXQgdmVyaWZpZXMgdXNlclxuICAgIC8vIHRva2VucyBidXQgZm9yZ290IGBzZXRUb2tlblJldm9jYXRpb25TdG9yZSgpYCBzaWxlbnRseSBkaXNhYmxlcyB0aGUgc2Vzc2lvblxuICAgIC8vIGtpbGwtc3dpdGNoLiBXYXJuIE9OQ0UgKG9ubHkgZm9yIGEgcmV2b2NhYmxlIHVzZXIgdG9rZW4pIHNvIGEgbWlzY29uZmlndXJlZFxuICAgIC8vIGJvb3Qgc3VyZmFjZXMgaW4gdGhlIGxvZ3MgaW5zdGVhZCBvZiBmYWlsaW5nIG9wZW4gaW52aXNpYmx5LlxuICAgIGlmICghcmV2b2NhdGlvblN0b3JlTWlzc2luZ1dhcm5lZCAmJiBkZWNvZGVkLnN1YiAmJiB0eXBlb2YgZGVjb2RlZC50b2tlblZlcnNpb24gPT09ICdudW1iZXInKSB7XG4gICAgICByZXZvY2F0aW9uU3RvcmVNaXNzaW5nV2FybmVkID0gdHJ1ZTtcbiAgICAgIGxvZ2dlci53YXJuKCdUb2tlbiByZXZvY2F0aW9uIHN0b3JlIE5PVCByZWdpc3RlcmVkIOKAlCByZXZvY2F0aW9uIGNoZWNrcyBhcmUgSU5BQ1RJVkUgKHNldFRva2VuUmV2b2NhdGlvblN0b3JlIHdhcyBuZXZlciBjYWxsZWQpOyByZXZva2VkL2NvbXByb21pc2VkIHNlc3Npb25zIHN0YXkgdmFsaWQgdW50aWwgbmF0dXJhbCBUVEwnKTtcbiAgICB9XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIGlmICghZGVjb2RlZC5zdWIgfHwgdHlwZW9mIGRlY29kZWQudG9rZW5WZXJzaW9uICE9PSAnbnVtYmVyJykgcmV0dXJuIGZhbHNlO1xuICB0cnkge1xuICAgIGNvbnN0IGN1cnJlbnQgPSBhd2FpdCBzdG9yZS5nZXRDdXJyZW50VmVyc2lvbihkZWNvZGVkLnN1Yik7XG4gICAgcmV0dXJuIGN1cnJlbnQgIT09IG51bGwgJiYgZGVjb2RlZC50b2tlblZlcnNpb24gPCBjdXJyZW50O1xuICB9IGNhdGNoIHtcbiAgICAvLyBGYWlsLW9wZW46IGEgcmV2b2NhdGlvbi1zdG9yZSBvdXRhZ2UgbXVzdCBub3QgbG9jayBldmVyeSB1c2VyIG91dC5cbiAgICByZXR1cm4gZmFsc2U7XG4gIH1cbn1cblxuLyoqXG4gKiBQdWJsaWMgcmV2b2NhdGlvbiBjaGVjayBmb3Igcm91dGVzIHRoYXQgdmVyaWZ5IGEgcGxhdGZvcm0gSldUIE9VVFNJREVcbiAqIGByZXF1aXJlQXV0aGAgKGUuZy4gdGhlIGltYWdlLXJlZ2lzdHJ5IGAvdG9rZW5gIG1pbnQgcGF0aCwgd2hpY2ggcmVzb2x2ZXNcbiAqIGlkZW50aXR5IGl0c2VsZikuIFJldHVybnMgdHJ1ZSB3aGVuIHRoZSB0b2tlbidzIGB0b2tlblZlcnNpb25gIGlzIHN0cmljdGx5XG4gKiBiZWhpbmQgdGhlIHN0b3JlJ3MgY3VycmVudCB2ZXJzaW9uLiBGYWlsLW9wZW4gKG5ldmVyIHRocm93cykg4oCUIGEgc3RvcmUgb3V0YWdlXG4gKiBvciBhIHRva2VuL3N0b3JlIHdpdGhvdXQgYSB1c2FibGUgdmVyc2lvbiB5aWVsZHMgZmFsc2UgKGFsbG93KSwgbWF0Y2hpbmdcbiAqIGByZXF1aXJlQXV0aGAuIFBhc3MgdGhlIHZlcmlmaWVkIEpXVCBjbGFpbXMgKGBzdWJgLCBgdG9rZW5WZXJzaW9uYCkuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBpc0FjY2Vzc1Rva2VuUmV2b2tlZChjbGFpbXM6IHsgc3ViPzogc3RyaW5nOyB0b2tlblZlcnNpb24/OiBudW1iZXIgfSk6IFByb21pc2U8Ym9vbGVhbj4ge1xuICByZXR1cm4gaXNUb2tlblJldm9rZWQoY2xhaW1zIGFzIEp3dFBheWxvYWQpO1xufVxuXG5mdW5jdGlvbiBfcmVxdWlyZUF1dGgoXG4gIG9wdGlvbnM6IFJlcXVpcmVBdXRoT3B0aW9ucyxcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBuZXh0OiBOZXh0RnVuY3Rpb24sXG4pOiB2b2lkIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmF1dGhvcml6YXRpb247XG5cbiAgaWYgKCFhdXRoSGVhZGVyKSB7XG4gICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnQXV0aG9yaXphdGlvbiBoZWFkZXIgcmVxdWlyZWQnLCBFcnJvckNvZGUuVE9LRU5fTUlTU0lORyk7XG4gIH1cblxuICBjb25zdCBwYXJ0cyA9IGF1dGhIZWFkZXIuc3BsaXQoJyAnKTtcbiAgaWYgKHBhcnRzLmxlbmd0aCAhPT0gMiB8fCBwYXJ0c1swXSAhPT0gJ0JlYXJlcicpIHtcbiAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdJbnZhbGlkIGF1dGhvcml6YXRpb24gZm9ybWF0LiBVc2U6IEJlYXJlciA8dG9rZW4+JywgRXJyb3JDb2RlLlRPS0VOX0lOVkFMSUQpO1xuICB9XG5cbiAgdHJ5IHtcbiAgICAvLyBQYXNzIHRocm91Z2ggb3B0aW9uYWwgaXNzdWVyL2F1ZGllbmNlIHZlcmlmaWNhdGlvbiB3aGVuIGVudi1jb25maWd1cmVkLlxuICAgIC8vIFdpdGhvdXQgdGhlc2UsIGEgSldUIHNpZ25lZCBieSBhbnkgc3lzdGVtIHRoYXQgaGFwcGVucyB0byBzaGFyZSB0aGVcbiAgICAvLyBzYW1lIEpXVF9TRUNSRVQgd291bGQgYmUgYWNjZXB0ZWQg4oCUIGRlZmVuY2UtaW4tZGVwdGggZm9yIHNoYXJlZC1zZWNyZXRcbiAgICAvLyBtaXNjb25maWd1cmF0aW9ucyBhY3Jvc3Mgc2VydmljZXMgLyBlbnZpcm9ubWVudHMuXG4gICAgLy8gUGluIHRoZSBhY2NlcHRlZCBhbGdvcml0aG0gdG8gdGhlIGNvbmZpZ3VyZWQgSE1BQyBhbGcgKGRlZmF1bHQgSFMyNTYpLlxuICAgIC8vIFdpdGhvdXQgYW4gYWxsb3ctbGlzdCwgYGp3dC52ZXJpZnlgIGFjY2VwdHMgYW55IGFsZ29yaXRobSB0aGUga2V5IGNhblxuICAgIC8vIHZlcmlmeSDigJQgdGhlIGNsYXNzaWMgYWxnLWNvbmZ1c2lvbiB2ZWN0b3IgKGFuZCBhIGhhcmQgZ3VhcmQgYWdhaW5zdFxuICAgIC8vIGBhbGc6bm9uZWApLiBFbnYtZHJpdmVuIHNvIGl0IHN0YXlzIGluIGxvY2tzdGVwIHdpdGggaG93IHRva2VucyBhcmVcbiAgICAvLyBzaWduZWQgKHNlZSBzaWduU2VydmljZVRva2VuICsgcGxhdGZvcm0ncyBjb25maWcuYXV0aC5qd3QuYWxnb3JpdGhtKS5cbiAgICBjb25zdCB2ZXJpZnlPcHRpb25zOiBqd3QuVmVyaWZ5T3B0aW9ucyA9IHsgYWxnb3JpdGhtczogWyhwcm9jZXNzLmVudi5KV1RfQUxHT1JJVEhNIHx8ICdIUzI1NicpIGFzIGp3dC5BbGdvcml0aG1dIH07XG4gICAgY29uc3QgZXhwZWN0ZWRJc3N1ZXIgPSBwcm9jZXNzLmVudi5KV1RfSVNTVUVSO1xuICAgIGNvbnN0IGV4cGVjdGVkQXVkaWVuY2UgPSBwcm9jZXNzLmVudi5KV1RfQVVESUVOQ0U7XG4gICAgaWYgKGV4cGVjdGVkSXNzdWVyKSB2ZXJpZnlPcHRpb25zLmlzc3VlciA9IGV4cGVjdGVkSXNzdWVyO1xuICAgIGlmIChleHBlY3RlZEF1ZGllbmNlKSB2ZXJpZnlPcHRpb25zLmF1ZGllbmNlID0gZXhwZWN0ZWRBdWRpZW5jZTtcbiAgICBjb25zdCBkZWNvZGVkID0gdmVyaWZ5Snd0V2l0aFJvdGF0aW9uKHBhcnRzWzFdLCB2ZXJpZnlPcHRpb25zKTtcblxuICAgIGlmIChkZWNvZGVkLnR5cGUgIT09ICdhY2Nlc3MnKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdPbmx5IGFjY2VzcyB0b2tlbnMgY2FuIGJlIHVzZWQgZm9yIEFQSSByZXF1ZXN0cycsIEVycm9yQ29kZS5UT0tFTl9JTlZBTElEKTtcbiAgICB9XG5cbiAgICBpZiAoIWRlY29kZWQuc3ViIHx8ICFkZWNvZGVkLnJvbGUpIHtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ1Rva2VuIG1pc3NpbmcgcmVxdWlyZWQgZmllbGRzJywgRXJyb3JDb2RlLlRPS0VOX0lOVkFMSUQpO1xuICAgIH1cblxuICAgIC8vIFNlcnZpY2UtdG9rZW4ga2lsbC1zd2l0Y2g6IHJlamVjdCBhIHNlcnZpY2UgcHJpbmNpcGFsIHdob3NlIHNlcnZpY2UgaGFzXG4gICAgLy8gYmVlbiBhZGRlZCB0byB0aGUgZGVueWxpc3QuIFJvdGF0aW5nIHRoZSBzaGFyZWQgSldUIHNlY3JldCBpcyB0aGUgb25seVxuICAgIC8vIG90aGVyIHdheSB0byBpbnZhbGlkYXRlIGEgc2VydmljZSB0b2tlbiBiZWZvcmUgaXRzIChzaG9ydCkgVFRMIOKAlCBidXQgdGhhdFxuICAgIC8vIG51a2VzIEVWRVJZIHNlcnZpY2UgdG9rZW4gZmxlZXQtd2lkZS4gVGhpcyBsZXRzIG9uZSBjb21wcm9taXNlZC9yb2d1ZVxuICAgIC8vIHNlcnZpY2UgYmUgY3V0IG9mZiBzdXJnaWNhbGx5LiBPKDEpIFNldCBsb29rdXAsIHplcm8gY29zdCB3aGVuIHRoZSBkZW55bGlzdFxuICAgIC8vIGlzIGVtcHR5ICh0aGUgZGVmYXVsdCksIHNvIGl0IG5ldmVyIHRheGVzIHRoZSBTMlMgaG90IHBhdGggdW5sZXNzIGFybWVkLlxuICAgIGlmIChkZWNvZGVkLnN1Yi5zdGFydHNXaXRoKCdzZXJ2aWNlOicpICYmIGlzU2VydmljZVRva2VuRGVuaWVkKGRlY29kZWQuc3ViKSkge1xuICAgICAgZW1pdENvdW50ZXIoJ3NlcnZpY2VfdG9rZW5fZGVuaWVkX3RvdGFsJywgeyBzZXJ2aWNlOiBkZWNvZGVkLnN1Yi5zbGljZSgnc2VydmljZTonLmxlbmd0aCkgfSk7XG4gICAgICBsb2dnZXIud2FybignUmVqZWN0ZWQgZGVueWxpc3RlZCBzZXJ2aWNlIHRva2VuJywgeyBzdWI6IGRlY29kZWQuc3ViIH0pO1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnU2VydmljZSB0b2tlbiByZXZva2VkJywgRXJyb3JDb2RlLlRPS0VOX1JFVk9LRUQpO1xuICAgIH1cblxuICAgIHJlcS51c2VyID0geyAuLi5kZWNvZGVkIH07XG5cbiAgICAvLyBUaGUgeC1vcmctaWQveC1vcmctbmFtZSBvdmVycmlkZSBsZXRzIGEgU1lTLUFETUlOIGFjdCBvbiBhIGNob3NlbiBvcmdcbiAgICAvLyAoY3Jvc3Mtb3JnIGFkbWluIHRvb2xpbmcpLiBJdCBpcyBnYXRlZCBvbiB0aGUgdmVyaWZpZWQgYGlzU3VwZXJBZG1pbmAgY2xhaW1cbiAgICAvLyBoZXJlIHNvIHRoYXQgZXZlbiBhIHJvdXRlIHdoaWNoIG1pc3Rha2VubHkgZW5hYmxlcyBgYWxsb3dPcmdIZWFkZXJPdmVycmlkZWBcbiAgICAvLyBjYW4gTkVWRVIgbGV0IGFuIG9yZGluYXJ5IGF1dGhlbnRpY2F0ZWQgdXNlciBzcG9vZiBhbm90aGVyIHRlbmFudCdzIG9yZyB2aWFcbiAgICAvLyB0aGUgaGVhZGVyIOKAlCBkZWZlbmNlLWluLWRlcHRoIGFnYWluc3QgdGhlIGNyb3NzLXRlbmFudCBicmVhayB0aGlzIGNhdXNlZC5cbiAgICBpZiAob3B0aW9ucy5hbGxvd09yZ0hlYWRlck92ZXJyaWRlICYmIGRlY29kZWQuaXNTdXBlckFkbWluID09PSB0cnVlKSB7XG4gICAgICBjb25zdCBoZWFkZXJPcmdJZCA9IGdldEhlYWRlclN0cmluZyhyZXEuaGVhZGVyc1sneC1vcmctaWQnXSk7XG4gICAgICBjb25zdCBoZWFkZXJPcmdOYW1lID0gZ2V0SGVhZGVyU3RyaW5nKHJlcS5oZWFkZXJzWyd4LW9yZy1uYW1lJ10pO1xuICAgICAgaWYgKGhlYWRlck9yZ0lkKSByZXEudXNlci5vcmdhbml6YXRpb25JZCA9IGhlYWRlck9yZ0lkO1xuICAgICAgaWYgKGhlYWRlck9yZ05hbWUpIHJlcS51c2VyLm9yZ2FuaXphdGlvbk5hbWUgPSBoZWFkZXJPcmdOYW1lO1xuICAgIH1cblxuICAgIC8vIFJlLWRlcml2ZSB0aGUgcmVxdWVzdCdzIHRlbmFudCBpZGVudGl0eSBmcm9tIHRoZSBOT1ctdmVyaWZpZWQgSldULlxuICAgIC8vXG4gICAgLy8gYGF0dGFjaFJlcXVlc3RDb250ZXh0YCBydW5zIGFzIGEgZ2xvYmFsIG1pZGRsZXdhcmUgQkVGT1JFIHRoaXMgcGVyLXJvdXRlXG4gICAgLy8gYHJlcXVpcmVBdXRoYCwgc28gaXQgY2FwdHVyZWQgYHJlcS5jb250ZXh0LmlkZW50aXR5YCB3aGlsZSBgcmVxLnVzZXJgIHdhc1xuICAgIC8vIHN0aWxsIHVuZGVmaW5lZCDigJQgYXQgd2hpY2ggcG9pbnQgYGdldElkZW50aXR5YCBmYWxscyBiYWNrIHRvIHRoZSByYXcsXG4gICAgLy8gY2xpZW50LXNldHRhYmxlIGB4LW9yZy1pZGAvYHgtdXNlci1pZGAgaGVhZGVycy4gRXZlcnkgZG93bnN0cmVhbSB0ZW5hbnQtXG4gICAgLy8gYXV0aG9yaXR5IGNvbnN1bWVyIChyZXF1aXJlT3JnSWQsIHdpdGhUZW5hbnRDb250ZXh0J3MgUkxTIHNjb3BlLCBjaGVja1F1b3RhLFxuICAgIC8vIHdpdGhSb3V0ZSwgYW5kIHRoZSBpZGVtcG90ZW5jeSBuYW1lc3BhY2UpIHJlYWRzIGByZXEuY29udGV4dC5pZGVudGl0eWAsIHNvXG4gICAgLy8gdGhhdCBmcm96ZW4gaGVhZGVyLWRlcml2ZWQgdmFsdWUg4oCUIG5vdCB0aGUgSldUIOKAlCB3YXMgZ292ZXJuaW5nIHRlbmFuY3kgb25cbiAgICAvLyBhbnkgbm9uLW5naW54IHBhdGguIFJlY29tcHV0aW5nIGhlcmUsIGF0IHRoZSBzaW5nbGUgcG9zdC12ZXJpZmljYXRpb24gY2hva2VcbiAgICAvLyBwb2ludCwgbWFrZXMgYGdldElkZW50aXR5YCBwcmVmZXIgdGhlIHZlcmlmaWVkIGByZXEudXNlcmAgKHNlZSBpZGVudGl0eS50cylcbiAgICAvLyBzbyB0ZW5hbmN5IGlzIEpXVC1hdXRob3JpdGF0aXZlLiBUaGUgbmdpbnggYHgtb3JnLWlkYCBvdmVyd3JpdGUgc3RheXMgYXNcbiAgICAvLyBkZWZlbmNlLWluLWRlcHRoLiBHdWFyZGVkIG9uIGByZXEuY29udGV4dGAgc28gc2VydmljZXMvcGF0aHMgdGhhdCBuZXZlclxuICAgIC8vIGF0dGFjaCBhIGNvbnRleHQgKG9yIHJ1biByZXF1aXJlQXV0aCBwcmUtY29udGV4dCkgYXJlIHVuYWZmZWN0ZWQuXG4gICAgY29uc3QgcmVxQ3R4ID0gKHJlcSBhcyBSZXF1ZXN0ICYgeyBjb250ZXh0PzogeyBpZGVudGl0eTogUmVxdWVzdElkZW50aXR5IH0gfSkuY29udGV4dDtcbiAgICBpZiAocmVxQ3R4KSB7XG4gICAgICByZXFDdHguaWRlbnRpdHkgPSBnZXRJZGVudGl0eShyZXEgYXMgdW5rbm93biBhcyBIdHRwUmVxdWVzdCk7XG4gICAgfVxuXG4gICAgLy8gU2Vzc2lvbi1pbnZhbGlkYXRpb24gY2hlY2sgZm9yIHRoZSBzdGF0ZWxlc3Mgc2VydmljZXM6IHJlamVjdCBhIHRva2VuXG4gICAgLy8gd2hvc2UgYHRva2VuVmVyc2lvbmAgaXMgYmVoaW5kIHRoZSByZXZvY2F0aW9uIHN0b3JlJ3MgY3VycmVudCB2YWx1ZSAoYVxuICAgIC8vIHByaXZpbGVnZSBjaGFuZ2UgdGhlIHBsYXRmb3JtIHB1Ymxpc2hlZCkuIE5vIHN0b3JlIHJlZ2lzdGVyZWQg4oeSIHRoaXMgaXMgYVxuICAgIC8vIG5vLW9wIGFuZCBjb250cm9sIHBhc3NlcyBzdHJhaWdodCB0aHJvdWdoLiBGYWlsLW9wZW4gb24gYW55IHN0b3JlIGVycm9yLlxuICAgIGlmICh0b2tlblJldm9jYXRpb25TdG9yZSAmJiBkZWNvZGVkLnN1YiAmJiB0eXBlb2YgZGVjb2RlZC50b2tlblZlcnNpb24gPT09ICdudW1iZXInKSB7XG4gICAgICAvLyBgLmNhdGNoKG5leHQpYCBmb3J3YXJkcyBhIERPV05TVFJFQU0gc3luY2hyb25vdXMgdGhyb3cgZnJvbSBgbmV4dCgpYCB0b1xuICAgICAgLy8gRXhwcmVzcydzIGVycm9yIG1pZGRsZXdhcmUg4oCUIHdpdGhvdXQgaXQsIHRoYXQgdGhyb3cgd291bGQgc3VyZmFjZSBhcyBhblxuICAgICAgLy8gdW5oYW5kbGVkIHJlamVjdGlvbiAodGhpcyBgbmV4dCgpYCBydW5zIGluIGEgbWljcm90YXNrLCBvdXRzaWRlIHRoZVxuICAgICAgLy8gc3Vycm91bmRpbmcgdHJ5L2NhdGNoIGFuZCBFeHByZXNzJ3MgcGVyLWxheWVyIGRpc3BhdGNoKS4gYGlzVG9rZW5SZXZva2VkYFxuICAgICAgLy8gaXRzZWxmIG5ldmVyIHJlamVjdHMgKGl0IGZhaWwtb3BlbnMgaW50ZXJuYWxseSksIHNvIHRoZSBjYXRjaCBvbmx5IGV2ZXJcbiAgICAgIC8vIHNlZXMgYSBnZW51aW5lIGRvd25zdHJlYW0gZXJyb3IuXG4gICAgICBpc1Rva2VuUmV2b2tlZChkZWNvZGVkKVxuICAgICAgICAudGhlbigocmV2b2tlZCkgPT4ge1xuICAgICAgICAgIGlmIChyZXZva2VkKSB7XG4gICAgICAgICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdTZXNzaW9uIGhhcyBiZWVuIHJldm9rZWQ7IHBsZWFzZSBzaWduIGluIGFnYWluJywgRXJyb3JDb2RlLlRPS0VOX1JFVk9LRUQpO1xuICAgICAgICAgIH1cbiAgICAgICAgICBuZXh0KCk7XG4gICAgICAgIH0pXG4gICAgICAgIC5jYXRjaChuZXh0KTtcbiAgICAgIHJldHVybjtcbiAgICB9XG5cbiAgICBuZXh0KCk7XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgaWYgKGVycm9yIGluc3RhbmNlb2Ygand0LlRva2VuRXhwaXJlZEVycm9yKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdUb2tlbiBoYXMgZXhwaXJlZCcsIEVycm9yQ29kZS5UT0tFTl9FWFBJUkVEKTtcbiAgICB9XG5cbiAgICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBqd3QuSnNvbldlYlRva2VuRXJyb3IpIHtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ0ludmFsaWQgdG9rZW4nLCBFcnJvckNvZGUuVE9LRU5fSU5WQUxJRCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnQXV0aGVudGljYXRpb24gZmFpbGVkJywgRXJyb3JDb2RlLlVOQVVUSE9SSVpFRCk7XG4gIH1cbn1cblxuLyoqXG4gKiBXaGV0aGVyIHRoZSByZXF1ZXN0J3MgdXNlciBob2xkcyBgcGVybWlzc2lvbmAuIFN1cGVyYWRtaW5zIGltcGxpY2l0bHkgaG9sZFxuICogZXZlcnkgcGVybWlzc2lvbi4gUmVhZHMgdGhlIHJlc29sdmVkIGBwZXJtaXNzaW9uc2AgY2xhaW0gKHNldCBhdCB0b2tlbiBpc3N1ZSxcbiAqIG9yIHJlLWRlcml2ZWQgcGVyIHJlcXVlc3QgYnkgdGhlIHBsYXRmb3JtKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHVzZXJIYXNQZXJtaXNzaW9uKHJlcTogUmVxdWVzdCwgcGVybWlzc2lvbjogUGVybWlzc2lvbik6IGJvb2xlYW4ge1xuICByZXR1cm4gaGFzUGVybWlzc2lvbihyZXEudXNlcj8ucGVybWlzc2lvbnMsIHBlcm1pc3Npb24sIHJlcS51c2VyPy5pc1N1cGVyQWRtaW4pO1xufVxuXG4vKipcbiAqIENvbnRleHQgcGFzc2VkIHRvIGEgcmVnaXN0ZXJlZCBhdXRob3JpemF0aW9uLWRlbmlhbCBhdWRpdG9yIHdoZW4gYVxuICogc3RhdGUtY2hhbmdpbmcgcmVxdWVzdCBpcyByZWplY3RlZCBieSBgcmVxdWlyZVBlcm1pc3Npb25gIC9cbiAqIGByZXF1aXJlU3lzdGVtQWRtaW5gLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1dGh6RGVuaWFsSW5mbyB7XG4gIC8qKiBUaGUgZGVuaWVkIHVzZXIncyBpZCAoYHN1YmApLCBpZiBhdXRoZW50aWNhdGVkLiAqL1xuICBhY3RvcklkPzogc3RyaW5nO1xuICBhY3RvckVtYWlsPzogc3RyaW5nO1xuICAvKiogVGhlIHVzZXIncyBhY3RpdmUgb3JnIGF0IGRlbmlhbCB0aW1lLiAqL1xuICBvcmdJZD86IHN0cmluZztcbiAgLyoqIEhUVFAgbWV0aG9kICsgcGF0aCBvZiB0aGUgcmVqZWN0ZWQgcmVxdWVzdC4gKi9cbiAgbWV0aG9kOiBzdHJpbmc7XG4gIHBhdGg6IHN0cmluZztcbiAgLyoqIFdoYXQgd2FzIHJlcXVpcmVkOiB0aGUgbWlzc2luZyBwZXJtaXNzaW9uKHMpLCBvciAnc3lzdGVtLWFkbWluJy4gKi9cbiAgcmVxdWlyZWQ6IHN0cmluZztcbn1cblxuLyoqXG4gKiBPcHRpb25hbCBzaW5rIGZvciBkZW5pZWQtYXV0aG9yaXphdGlvbiBldmVudHMuIExlZnQgdW5zZXQgYnkgZGVmYXVsdCBzb1xuICogYXBpLWNvcmUgc3RheXMgZGVjb3VwbGVkIGZyb20gYW55IGF1ZGl0IHRyYW5zcG9ydCDigJQgYSBzZXJ2aWNlIHJlZ2lzdGVycyBvbmVcbiAqIGF0IGJvb3QgKHR5cGljYWxseSBmb3J3YXJkaW5nIHRvIGl0cyBgUmVtb3RlQXVkaXRDbGllbnRgIGFzIGFuXG4gKiBgYXV0aHouZGVuaWVkYCBldmVudCwgb3IsIG9uIHBsYXRmb3JtLCB0byB0aGUgbG9jYWwgYGF1ZGl0KClgIGhlbHBlcikuXG4gKiBNVVNUIGJlIGJlc3QtZWZmb3J0OiBpdCBpcyBpbnZva2VkIGluc2lkZSB0aGUgcmVxdWVzdCBwYXRoLCBzbyBpdCBtdXN0IG5ldmVyXG4gKiB0aHJvdyBvciBibG9jayAodGhlIGdhdGUgd3JhcHMgdGhlIGNhbGwgaW4gdHJ5L2NhdGNoIHJlZ2FyZGxlc3MpLlxuICovXG5sZXQgYXV0aHpEZW5pYWxBdWRpdG9yOiAoKGluZm86IEF1dGh6RGVuaWFsSW5mbykgPT4gdm9pZCkgfCB1bmRlZmluZWQ7XG5cbi8qKlxuICogUmVnaXN0ZXIgKG9yIGNsZWFyLCB3aXRoIGB1bmRlZmluZWRgKSB0aGUgcHJvY2Vzcy13aWRlIGF1dGhvcml6YXRpb24tZGVuaWFsXG4gKiBhdWRpdG9yLiBJZGVtcG90ZW50OyB0aGUgbGFzdCByZWdpc3RyYXRpb24gd2lucy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNldEF1dGh6RGVuaWFsQXVkaXRvcihmbjogKChpbmZvOiBBdXRoekRlbmlhbEluZm8pID0+IHZvaWQpIHwgdW5kZWZpbmVkKTogdm9pZCB7XG4gIGF1dGh6RGVuaWFsQXVkaXRvciA9IGZuO1xufVxuXG4vKipcbiAqIEVtaXQgYSBkZW5pYWwgZXZlbnQsIGJlc3QtZWZmb3J0LiBPbmx5IGZpcmVzIGZvciBzdGF0ZS1jaGFuZ2luZyAobm9uLUdFVCxcbiAqIG5vbi1IRUFEL09QVElPTlMpIHJlcXVlc3RzIOKAlCBhIHJlamVjdGVkIEdFVCBpcyBsb3ctc2lnbmFsIHByb2Jpbmcgbm9pc2UgYW5kXG4gKiB3b3VsZCBhbXBsaWZ5IGF1ZGl0IHZvbHVtZSB1bmRlciBhIHNjYW4uIE5ldmVyIHRocm93cy5cbiAqL1xuZnVuY3Rpb24gYXVkaXRBdXRoekRlbmlhbChyZXE6IFJlcXVlc3QsIHJlcXVpcmVkOiBzdHJpbmcpOiB2b2lkIHtcbiAgY29uc3QgYXVkaXRvciA9IGF1dGh6RGVuaWFsQXVkaXRvcjtcbiAgaWYgKCFhdWRpdG9yKSByZXR1cm47XG4gIGNvbnN0IG1ldGhvZCA9IHJlcS5tZXRob2QudG9VcHBlckNhc2UoKTtcbiAgaWYgKG1ldGhvZCA9PT0gJ0dFVCcgfHwgbWV0aG9kID09PSAnSEVBRCcgfHwgbWV0aG9kID09PSAnT1BUSU9OUycpIHJldHVybjtcbiAgdHJ5IHtcbiAgICBhdWRpdG9yKHtcbiAgICAgIGFjdG9ySWQ6IHJlcS51c2VyPy5zdWIsXG4gICAgICBhY3RvckVtYWlsOiByZXEudXNlcj8uZW1haWwsXG4gICAgICBvcmdJZDogcmVxLnVzZXI/Lm9yZ2FuaXphdGlvbklkLFxuICAgICAgbWV0aG9kLFxuICAgICAgLy8gU3RyaXAgdGhlIHF1ZXJ5IHN0cmluZyDigJQgYSBkZW5pZWQgcmVxdWVzdCBtYXkgY2FycnkgYSB0b2tlbi9zZWNyZXQgYXMgYVxuICAgICAgLy8gcXVlcnkgcGFyYW0sIGFuZCB0aGlzIHBhdGggaXMgcGVyc2lzdGVkIHZlcmJhdGltIGludG8gdGhlIGF1ZGl0IGxvZy5cbiAgICAgIHBhdGg6IChyZXEub3JpZ2luYWxVcmwgfHwgcmVxLnVybCkuc3BsaXQoJz8nKVswXSxcbiAgICAgIHJlcXVpcmVkLFxuICAgIH0pO1xuICB9IGNhdGNoIHtcbiAgICAvLyBCZXN0LWVmZm9ydCDigJQgYSBicm9rZW4gYXVkaXRvciBtdXN0IG5ldmVyIGJyZWFrIHRoZSBhdXRoIGdhdGUuXG4gIH1cbn1cblxuLyoqXG4gKiBSZXF1aXJlcyB0aGF0IHRoZSB1c2VyIGhvbGQgQVQgTEVBU1QgT05FIG9mIHRoZSBnaXZlbiBwZXJtaXNzaW9ucyAob3IgYmUgYVxuICogc3VwZXJhZG1pbikuIFVzZSBhZnRlciByZXF1aXJlQXV0aC4gTWlycm9ycyBgcmVxdWlyZVJvbGVgJ3MgYW55LW9mIHNlbWFudGljcztcbiAqIHBhc3MgYSBzaW5nbGUgcGVybWlzc2lvbiBmb3IgYSBzcGVjaWZpYyBhY3Rpb24sIG9yIHNldmVyYWwgd2hlbiBhbnkgb25lIG9mXG4gKiB0aGVtIHNob3VsZCBncmFudCBhY2Nlc3MuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXF1aXJlUGVybWlzc2lvbiguLi5wZXJtaXNzaW9uczogUGVybWlzc2lvbltdKSB7XG4gIHJldHVybiAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pOiB2b2lkID0+IHtcbiAgICBpZiAoIXJlcS51c2VyKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdBdXRoZW50aWNhdGlvbiByZXF1aXJlZCcsIEVycm9yQ29kZS5VTkFVVEhPUklaRUQpO1xuICAgIH1cbiAgICAvLyB1c2VySGFzUGVybWlzc2lvbiDihpIgaGFzUGVybWlzc2lvbiBhbHJlYWR5IGdyYW50cyBzdXBlcmFkbWlucyBldmVyeVxuICAgIC8vIHBlcm1pc3Npb24sIHNvIHRoaXMgc2luZ2xlIGNoZWNrIGNvdmVycyBib3RoIHRoZSBzdXBlcmFkbWluIGJ5cGFzcyBhbmRcbiAgICAvLyB0aGUgYW55LW9mIG1lbWJlcnNoaXAgdGVzdCB3aXRob3V0IHJlLWlubGluaW5nIGVpdGhlci5cbiAgICBpZiAocGVybWlzc2lvbnMuc29tZSgocCkgPT4gdXNlckhhc1Blcm1pc3Npb24ocmVxLCBwKSkpIHJldHVybiBuZXh0KCk7XG4gICAgYXVkaXRBdXRoekRlbmlhbChyZXEsIHBlcm1pc3Npb25zLmpvaW4oJyBvciAnKSk7XG4gICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgIHJlcywgSHR0cFN0YXR1cy5GT1JCSURERU4sXG4gICAgICBgTWlzc2luZyByZXF1aXJlZCBwZXJtaXNzaW9uOiAke3Blcm1pc3Npb25zLmpvaW4oJyBvciAnKX1gLFxuICAgICAgRXJyb3JDb2RlLklOU1VGRklDSUVOVF9QRVJNSVNTSU9OUyxcbiAgICApO1xuICB9O1xufVxuXG4vKipcbiAqIFJlcXVpcmVzIHRoYXQgdGhlIHVzZXIgaG9sZCBFVkVSWSBvbmUgb2YgdGhlIGdpdmVuIHBlcm1pc3Npb25zIChvciBiZSBhXG4gKiBzdXBlcmFkbWluKSDigJQgdGhlIEFORCBjb3VudGVycGFydCB0byBgcmVxdWlyZVBlcm1pc3Npb25gJ3MgYW55LW9mLiBVc2UgZm9yIGFcbiAqIHNlbnNpdGl2ZSBhY3Rpb24gdGhhdCBsZWdpdGltYXRlbHkgZGVtYW5kcyB0d28gZGlzdGluY3QgY2FwYWJpbGl0aWVzIGF0IG9uY2VcbiAqIChlLmcuIGEgY3Jvc3Mtc3VyZmFjZSBvcGVyYXRpb24pLCBzbyB0aGUgZ3VhcmFudGVlIGlzIGV4cGxpY2l0IHJhdGhlciB0aGFuXG4gKiBhcHByb3hpbWF0ZWQgYnkgY2hhaW5pbmcgdHdvIGByZXF1aXJlUGVybWlzc2lvbmAgZ2F0ZXMuIFN1cGVyYWRtaW5zIGJ5cGFzc1xuICogKHRoZXkgaW1wbGljaXRseSBob2xkIGV2ZXJ5IHBlcm1pc3Npb24pLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZUFsbFBlcm1pc3Npb25zKC4uLnBlcm1pc3Npb25zOiBQZXJtaXNzaW9uW10pIHtcbiAgcmV0dXJuIChyZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIG5leHQ6IE5leHRGdW5jdGlvbik6IHZvaWQgPT4ge1xuICAgIGlmICghcmVxLnVzZXIpIHtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ0F1dGhlbnRpY2F0aW9uIHJlcXVpcmVkJywgRXJyb3JDb2RlLlVOQVVUSE9SSVpFRCk7XG4gICAgfVxuICAgIGNvbnN0IG1pc3NpbmcgPSBwZXJtaXNzaW9ucy5maWx0ZXIoKHApID0+ICF1c2VySGFzUGVybWlzc2lvbihyZXEsIHApKTtcbiAgICBpZiAobWlzc2luZy5sZW5ndGggPT09IDApIHJldHVybiBuZXh0KCk7XG4gICAgYXVkaXRBdXRoekRlbmlhbChyZXEsIHBlcm1pc3Npb25zLmpvaW4oJyBhbmQgJykpO1xuICAgIHJldHVybiBzZW5kRXJyb3IoXG4gICAgICByZXMsIEh0dHBTdGF0dXMuRk9SQklEREVOLFxuICAgICAgYE1pc3NpbmcgcmVxdWlyZWQgcGVybWlzc2lvbjogJHttaXNzaW5nLmpvaW4oJyBhbmQgJyl9YCxcbiAgICAgIEVycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMsXG4gICAgKTtcbiAgfTtcbn1cblxuLyoqXG4gKiBMaWtlIHtAbGluayByZXF1aXJlUGVybWlzc2lvbn0gKGFueS1vZikgYnV0IEFMU08gYWRtaXRzIGFuIGludGVybmFsIHNlcnZpY2VcbiAqIHByaW5jaXBhbCAoYSBgc2VydmljZToqYCBtYWNoaW5lIHRva2VuKS4gRm9yIFJFQUQgZW5kcG9pbnRzIHRoYXQgQk9USFxuICogaW50ZXJhY3RpdmUgdXNlcnMg4oCUIHdobyBtdXN0IGhvbGQgb25lIG9mIHRoZSBgOnJlYWRgIGNhcGFiaWxpdGllcyDigJQgQU5EXG4gKiBzZXJ2aWNlLXRvLXNlcnZpY2UgY2FsbGVycyBsZWdpdGltYXRlbHkgaGl0OyBzZXJ2aWNlIHRva2VucyBjYXJyeSBub1xuICogcGVybWlzc2lvbiBjbGFpbXMgKHRoZXkncmUgbGVhc3QtcHJpdmlsZWdlIGByb2xlOm1lbWJlcmApLCBzbyBhIHBsYWluXG4gKiBgcmVxdWlyZVBlcm1pc3Npb25gIHdvdWxkIHdyb25nbHkgNDAzIHRoZW0uIFN1cGVyYWRtaW5zIHBhc3MgdmlhXG4gKiBgdXNlckhhc1Blcm1pc3Npb25gJ3MgaW1wbGljaXQtYWxsLiBVc2Ugb25seSB3aGVyZSBhIHNlcnZpY2UgY2FsbGVyIGlzIGEga25vd24sXG4gKiBpbnRlbmRlZCBjb25zdW1lciBvZiB0aGUgcm91dGUgKHZlcmlmeSB0aGUgY2FsbGVycyk7IHByZWZlciBwbGFpblxuICogYHJlcXVpcmVQZXJtaXNzaW9uYCBmb3IgcHVyZWx5IHVzZXItZmFjaW5nIHJlYWRzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZVBlcm1pc3Npb25PclNlcnZpY2UoLi4ucGVybWlzc2lvbnM6IFBlcm1pc3Npb25bXSkge1xuICByZXR1cm4gKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSwgbmV4dDogTmV4dEZ1bmN0aW9uKTogdm9pZCA9PiB7XG4gICAgaWYgKCFyZXEudXNlcikge1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnQXV0aGVudGljYXRpb24gcmVxdWlyZWQnLCBFcnJvckNvZGUuVU5BVVRIT1JJWkVEKTtcbiAgICB9XG4gICAgaWYgKGlzU2VydmljZVByaW5jaXBhbChyZXEpIHx8IHBlcm1pc3Npb25zLnNvbWUoKHApID0+IHVzZXJIYXNQZXJtaXNzaW9uKHJlcSwgcCkpKSByZXR1cm4gbmV4dCgpO1xuICAgIGF1ZGl0QXV0aHpEZW5pYWwocmVxLCBwZXJtaXNzaW9ucy5qb2luKCcgb3IgJykpO1xuICAgIHJldHVybiBzZW5kRXJyb3IoXG4gICAgICByZXMsIEh0dHBTdGF0dXMuRk9SQklEREVOLFxuICAgICAgYE1pc3NpbmcgcmVxdWlyZWQgcGVybWlzc2lvbjogJHtwZXJtaXNzaW9ucy5qb2luKCcgb3IgJyl9YCxcbiAgICAgIEVycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMsXG4gICAgKTtcbiAgfTtcbn1cblxuLyoqXG4gKiBHYXRlIGFuIGVuZHBvaW50IHRvIGludGVybmFsIHNlcnZpY2UtdG8tc2VydmljZSBjYWxsZXJzIG9ubHkgKGEgYHNlcnZpY2U6KmBcbiAqIG1hY2hpbmUgcHJpbmNpcGFsIG1pbnRlZCB2aWEge0BsaW5rIHNpZ25TZXJ2aWNlVG9rZW59IC8gYGdldFNlcnZpY2VBdXRoSGVhZGVyYCkuXG4gKiBSZWplY3RzIGFueSB1c2VyIHRva2VuLiBGb3IgTk9OLXVzZXItZmFjaW5nIGVuZHBvaW50cyDigJQgZW50aXR5LWV2ZW50IGluZ2VzdCxcbiAqIGF1dG8tc3Vic2NyaWJlLCBhbmQgc2ltaWxhciBwZWVyLXNlcnZpY2UgaG9va3Mg4oCUIHRoYXQgYSBicm93c2VyIG11c3QgbmV2ZXJcbiAqIHJlYWNoLiBDb21wb3NlIGFmdGVyIGByZXF1aXJlQXV0aGAgc28gYHJlcS51c2VyYCBpcyBwb3B1bGF0ZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXF1aXJlU2VydmljZVByaW5jaXBhbChyZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIG5leHQ6IE5leHRGdW5jdGlvbik6IHZvaWQge1xuICBpZiAoIWlzU2VydmljZVByaW5jaXBhbChyZXEpKSB7XG4gICAgLy8gNDAzIChub3QgNDAwKSDigJQgdGhpcyBpcyBhbiBhdXRob3JpemF0aW9uIHJlZnVzYWw7IHN0YXR1cyBtdXN0IG1hdGNoIHRoZVxuICAgIC8vIElOU1VGRklDSUVOVF9QRVJNSVNTSU9OUyBjb2RlIGFuZCB0aGUgc2libGluZyBnYXRlcyAocmVxdWlyZVBlcm1pc3Npb24sIGV0Yy4pLlxuICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLkZPUkJJRERFTiwgJ0ludGVybmFsIHNlcnZpY2UgY2FsbHMgb25seScsIEVycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMpO1xuICB9XG4gIG5leHQoKTtcbn1cblxuLyoqXG4gKiBUaGUgc3lzdGVtIHRlbmFudCdzIGNhbm9uaWNhbCBvcmcgKippZCoqIOKAlCBhIGZpeGVkLCB3ZWxsLWtub3duIE9iamVjdElkIChOT1RcbiAqIHRoZSBzdHJpbmcgJ3N5c3RlbScpLiBUaGlzIGlzIHRoZSBzaW5nbGUga25vYiBldmVyeSBzZXJ2aWNlIHJlc29sdmVzIHRoZVxuICogc3lzdGVtIHRlbmFudCB0aHJvdWdoOyBvdmVycmlkZSB2aWEgdGhlIGBTWVNURU1fT1JHX0lEYCBlbnYgZm9yIGFsdGVybmF0ZVxuICogaW5zdGFsbHMuIFRoZSBzeXN0ZW0gb3JnJ3MgaHVtYW4gaWRlbnRpZmllciBzdGF5cyB0aGUgc2x1Zy9uYW1lICdzeXN0ZW0nXG4gKiAoc2VlIHtAbGluayBTWVNURU1fT1JHX1NMVUd9KTsgb25seSBpdHMgYF9pZGAgaXMgdGhpcyBPYmplY3RJZC5cbiAqL1xuZXhwb3J0IGNvbnN0IFNZU1RFTV9PUkdfSUQgPSAocHJvY2Vzcy5lbnYuU1lTVEVNX09SR19JRCB8fCAnMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAxJykudG9Mb3dlckNhc2UoKTtcblxuLyoqIFRoZSBzeXN0ZW0gb3JnJ3Mgd2VsbC1rbm93biBzbHVnL25hbWUgKHRoZSBodW1hbiBpZGVudGlmaWVyOyBpdHMgYF9pZGAgaXMge0BsaW5rIFNZU1RFTV9PUkdfSUR9KS4gKi9cbmV4cG9ydCBjb25zdCBTWVNURU1fT1JHX1NMVUcgPSAnc3lzdGVtJztcblxuLyoqXG4gKiBDaGVjayBpZiBhbiBvcmdJZCBvciBvcmdOYW1lL3NsdWcgbWF0Y2hlcyB0aGUgc3lzdGVtIG9yZy4gVXNlIHRoaXMgaW5zdGVhZCBvZlxuICogY29tcGFyaW5nIGRpcmVjdGx5OiB0aGUgaWQgaXMgbm93IGFuIE9iamVjdElkICh7QGxpbmsgU1lTVEVNX09SR19JRH0pIHdoaWxlIHRoZVxuICogbmFtZS9zbHVnIGlzICdzeXN0ZW0nICh7QGxpbmsgU1lTVEVNX09SR19TTFVHfSksIHNvIHRoZSB0d28gYXJlIGNvbXBhcmVkIGFnYWluc3RcbiAqIHRoZWlyIHJlc3BlY3RpdmUgY2Fub25pY2FsIHZhbHVlcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzU3lzdGVtT3JnSWQob3JnSWQ/OiBzdHJpbmcsIG9yZ05hbWU/OiBzdHJpbmcpOiBib29sZWFuIHtcbiAgcmV0dXJuIG9yZ0lkPy50b0xvd2VyQ2FzZSgpID09PSBTWVNURU1fT1JHX0lEIHx8IG9yZ05hbWU/LnRvTG93ZXJDYXNlKCkgPT09IFNZU1RFTV9PUkdfU0xVRztcbn1cblxuLyoqXG4gKiBDaGVjayBpZiB0aGUgcmVxdWVzdCBpcyBmcm9tIGEgc3lzdGVtIGFkbWluLlxuICpcbiAqIEF1dGhvcml0eSBpcyBncmFudGVkIHNvbGVseSBieSB0aGUgdXNlci1sZXZlbCBgaXNTdXBlckFkbWluYCBmbGFnIGNhcnJpZWRcbiAqIGluIHRoZSBKV1QuIFRoZSBcIm1lbWJlcnNoaXAgaW4gdGhlIHdlbGwta25vd24gJ3N5c3RlbScgb3JnIHdpdGggcm9sZVxuICogYWRtaW4vb3duZXJcIiBwYXRoIHdhcyByZW1vdmVkIOKAlCBpdCBjb25mbGF0ZWQgYSBQaXBlbGluZSBCdWlsZGVyIG9wZXJhdG9yXG4gKiB3aXRoIGEgcmVhbCBjdXN0b21lciB0ZW5hbnQgaW4gdGhlIGRhdGEgbW9kZWwsIGFuZCBtZWFudCBhbnkgdW5pbnRlbmRlZFxuICogd3JpdGUgdGhhdCBjcmVhdGVkIGEgJ3N5c3RlbSctbmFtZWQgb3JnIGNvdWxkIHF1aWV0bHkgZ3JhbnQgY3Jvc3Mtb3JnXG4gKiBhdXRob3JpdHkuIFRoZSBgc3lzdGVtYCBvcmcgc3RpbGwgZXhpc3RzIGFzIGEgKmNvbnRlbnQgaG9sZGVyKiBmb3Igc2hhcmVkXG4gKiBzYW1wbGUgZGF0YTsgaXQganVzdCBubyBsb25nZXIgY29uZmVycyBwcml2aWxlZ2UuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1N5c3RlbUFkbWluKHJlcTogUmVxdWVzdCk6IGJvb2xlYW4ge1xuICByZXR1cm4gcmVxLnVzZXI/LmlzU3VwZXJBZG1pbiA9PT0gdHJ1ZTtcbn1cblxuLyoqXG4gKiBXaGV0aGVyIHRoZSByZXF1ZXN0J3MgdG9rZW4gY2FycmllcyBhIHNwZWNpZmljIGNhcGFiaWxpdHkgYHNjb3BlYCAoZS5nLlxuICogYCdyZXBvcnRpbmc6aW5nZXN0J2ApLiBVc2VkIHRvIGdhdGUgZW5kcG9pbnRzIHRoYXQgYWNjZXB0IGEgbmFycm93IG1hY2hpbmVcbiAqIGlkZW50aXR5IOKAlCBhIG5vcm1hbCBpbnRlcmFjdGl2ZSB1c2VyIHRva2VuIGhhcyBubyBgc2NvcGVgIGFuZCByZXR1cm5zIGZhbHNlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaGFzU2NvcGUocmVxOiBSZXF1ZXN0LCBzY29wZTogc3RyaW5nKTogYm9vbGVhbiB7XG4gIHJldHVybiByZXEudXNlcj8uc2NvcGUgPT09IHNjb3BlO1xufVxuXG4vKiogUmVxdWlyZXMgYSBzeXN0ZW0gYWRtaW4g4oCUIGdyYW50ZWQgc29sZWx5IGJ5IHRoZSBgaXNTdXBlckFkbWluYCB0b2tlbiBjbGFpbVxuICogICh0aGUgb3JnLW1lbWJlcnNoaXAgcGF0aCB3YXMgcmVtb3ZlZCkuIFVzZSBhZnRlciByZXF1aXJlQXV0aC4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXF1aXJlU3lzdGVtQWRtaW4oXG4gIHJlcTogUmVxdWVzdCxcbiAgcmVzOiBSZXNwb25zZSxcbiAgbmV4dDogTmV4dEZ1bmN0aW9uLFxuKTogdm9pZCB7XG4gIGlmICghaXNTeXN0ZW1BZG1pbihyZXEpKSB7XG4gICAgYXVkaXRBdXRoekRlbmlhbChyZXEsICdzeXN0ZW0tYWRtaW4nKTtcbiAgICByZXR1cm4gc2VuZEVycm9yKFxuICAgICAgcmVzLCBIdHRwU3RhdHVzLkZPUkJJRERFTixcbiAgICAgICdBY2Nlc3MgZGVuaWVkLiBPbmx5IHN5c3RlbSBhZG1pbmlzdHJhdG9ycyBjYW4gcGVyZm9ybSB0aGlzIGFjdGlvbi4nLFxuICAgICAgRXJyb3JDb2RlLklOU1VGRklDSUVOVF9QRVJNSVNTSU9OUyxcbiAgICApO1xuICB9XG4gIG5leHQoKTtcbn1cblxuLyoqXG4gKiBSZXF1aXJlIGEgc3BlY2lmaWMgZmVhdHVyZSBmbGFnLiBVc2UgYWZ0ZXIgcmVxdWlyZUF1dGguXG4gKiBDaGVja3MgdGhlIGBmZWF0dXJlc2AgYXJyYXkgaW4gdGhlIEpXVCBwYXlsb2FkIChzZXQgYXQgdG9rZW4gaXNzdWFuY2UpLlxuICogU3lzYWRtaW5zIChpc1N1cGVyQWRtaW4pIGJ5cGFzcyDigJQgdGhleSBhbHdheXMgaGF2ZSBldmVyeSBmZWF0dXJlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZUZlYXR1cmUoZmVhdHVyZTogc3RyaW5nKSB7XG4gIHJldHVybiAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pOiB2b2lkID0+IHtcbiAgICBpZiAoIXJlcS51c2VyKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdBdXRoZW50aWNhdGlvbiByZXF1aXJlZCcsIEVycm9yQ29kZS5VTkFVVEhPUklaRUQpO1xuICAgIH1cblxuICAgIC8vIFN5c2FkbWlucyBnZXQgYWxsIGZlYXR1cmVzOyB0aGUgYGZlYXR1cmVzYCBhcnJheSBvbiB0aGVpciB0b2tlbiBpc1xuICAgIC8vIHBvcHVsYXRlZCB3aXRoIGV2ZXJ5IGZsYWcgYXQgaXNzdWFuY2UgdGltZSBidXQgdGhlIGJ5cGFzcyBoZXJlIGtlZXBzXG4gICAgLy8gdGhlIHJ1bGUgZXhwbGljaXQgYW5kIHN1cnZpdmVzIGEgdG9rZW4gaXNzdWVkIGJlZm9yZSBhIG5ldyBmZWF0dXJlXG4gICAgLy8gZmxhZyB3YXMgYWRkZWQuXG4gICAgaWYgKHJlcS51c2VyLmlzU3VwZXJBZG1pbiA9PT0gdHJ1ZSkgcmV0dXJuIG5leHQoKTtcblxuICAgIGlmICghcmVxLnVzZXIuZmVhdHVyZXM/LmluY2x1ZGVzKGZlYXR1cmUpKSB7XG4gICAgICAvLyBSb3V0ZSBmZWF0dXJlLWdhdGUgZGVuaWFscyB0aHJvdWdoIHRoZSBzYW1lIGF1ZGl0IHNpbmsgYXNcbiAgICAgIC8vIHJlcXVpcmVQZXJtaXNzaW9uIC8gcmVxdWlyZVN5c3RlbUFkbWluIHNvIGEgcHJvYmUgZm9yIGFuXG4gICAgICAvLyB1bmVudGl0bGVkIGNhcGFiaWxpdHkgbGVhdmVzIGEgdHJhaWwgKHN0YXRlLWNoYW5naW5nIG1ldGhvZHMgb25seSkuXG4gICAgICBhdWRpdEF1dGh6RGVuaWFsKHJlcSwgYGZlYXR1cmU6JHtmZWF0dXJlfWApO1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgICAgcmVzLCBIdHRwU3RhdHVzLkZPUkJJRERFTixcbiAgICAgICAgYFRoaXMgZmVhdHVyZSByZXF1aXJlcyBhIGhpZ2hlciBwbGFuICgke2ZlYXR1cmV9KWAsXG4gICAgICAgIEVycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMsXG4gICAgICApO1xuICAgIH1cblxuICAgIG5leHQoKTtcbiAgfTtcbn1cblxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4vLyBTZXJ2aWNlLXRvLXNlcnZpY2UgdG9rZW5zXG4vL1xuLy8gSW50ZXItc2VydmljZSBIVFRQIGNhbGxzIChiaWxsaW5nIOKGkiBtZXNzYWdlLCBwbGF0Zm9ybSDihpIgY29tcGxpYW5jZSwgZXRjLilcbi8vIG5lZWQgdG8gc2F0aXNmeSB0aGUgc2FtZSBgcmVxdWlyZUF1dGhgIG1pZGRsZXdhcmUgYXMgdXNlciByZXF1ZXN0cy5cbi8vIGBzaWduU2VydmljZVRva2VuYCBtaW50cyBhIHNob3J0LWxpdmVkIEpXVCBzaWduZWQgd2l0aCB0aGUgc2hhcmVkXG4vLyBKV1RfU0VDUkVULCBpZGVudGlmeWluZyB0aGUgY2FsbGluZyBzZXJ2aWNlIHZpYSBgc3ViOiAnc2VydmljZTo8bmFtZT4nYC5cbi8vIGByZXF1aXJlQXV0aGAgYWNjZXB0cyB0aGVzZSB0b2tlbnMgdHJhbnNwYXJlbnRseSDigJQgdGhleSBwYXNzIGBkZWNvZGVkLnN1YmBcbi8vIGFuZCBgZGVjb2RlZC5yb2xlYCBjaGVja3MsIGFuZCBkb3duc3RyZWFtIGByZXF1aXJlT3JnYW5pemF0aW9uYCAvXG4vLyBgcmVxdWlyZVN5c3RlbUFkbWluYCByZWx5IG9uIHRoZSBvcmcvcm9sZSBlbWJlZGRlZCBpbiB0aGUgdG9rZW4uXG4vL1xuLy8gVG9rZW5zIGRlZmF1bHQgdG8gNS1taW51dGUgVFRMIOKAlCBsb25nIGVub3VnaCB0byBzdXJ2aXZlIGEgYmFja2VuZCBob3AsXG4vLyBzaG9ydCBlbm91Z2ggdGhhdCBhIGxlYWtlZCB0b2tlbiBpcyBsb3ctdmFsdWUuXG4vLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuY29uc3QgREVGQVVMVF9TRVJWSUNFX1RPS0VOX1RUTF9TRUNPTkRTID0gMzAwO1xuXG4vKipcbiAqIERlbnlsaXN0IG9mIHNlcnZpY2UgTkFNRVMgKHRoZSBgPG5hbWU+YCBpbiBgc3ViOiBzZXJ2aWNlOjxuYW1lPmApIHdob3NlIHRva2Vuc1xuICogYHJlcXVpcmVBdXRoYCBtdXN0IHJlamVjdC4gU2VlZGVkIGZyb20gYFNFUlZJQ0VfVE9LRU5fREVOWUxJU1RgIChjb21tYS1zZXBhcmF0ZWQpXG4gKiBhdCBtb2R1bGUgbG9hZDsgYSBzZXJ2aWNlIGNhbiBwdXNoIGxpdmUgdXBkYXRlcyAoZS5nLiBmcm9tIGEgUmVkaXMtc3Vic2NyaWJlZFxuICoga2lsbC1zd2l0Y2gpIHZpYSB7QGxpbmsgc2V0U2VydmljZVRva2VuRGVueWxpc3R9IHNvIGEgY29tcHJvbWlzZWQgc2VydmljZSBjYW4gYmVcbiAqIGN1dCBvZmYgV0lUSE9VVCByb3RhdGluZyB0aGUgc2hhcmVkIEpXVCBzZWNyZXQgKHdoaWNoIGludmFsaWRhdGVzIGFsbCBvZiB0aGVtKS5cbiAqL1xubGV0IHNlcnZpY2VUb2tlbkRlbnlsaXN0ID0gbmV3IFNldChcbiAgKHByb2Nlc3MuZW52LlNFUlZJQ0VfVE9LRU5fREVOWUxJU1QgfHwgJycpXG4gICAgLnNwbGl0KCcsJylcbiAgICAubWFwKChzKSA9PiBzLnRyaW0oKSlcbiAgICAuZmlsdGVyKEJvb2xlYW4pLFxuKTtcblxuLyoqIFJlcGxhY2UgdGhlIHNlcnZpY2UtdG9rZW4gZGVueWxpc3QgKHNlcnZpY2UgbmFtZXMpLiBFbXB0eSDih5Iga2lsbC1zd2l0Y2ggb2ZmLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNldFNlcnZpY2VUb2tlbkRlbnlsaXN0KG5hbWVzOiBJdGVyYWJsZTxzdHJpbmc+KTogdm9pZCB7XG4gIHNlcnZpY2VUb2tlbkRlbnlsaXN0ID0gbmV3IFNldChbLi4ubmFtZXNdLm1hcCgocykgPT4gcy50cmltKCkpLmZpbHRlcihCb29sZWFuKSk7XG59XG5cbi8qKiBUcnVlIHdoZW4gYHN1YmAgaXMgYHNlcnZpY2U6PG5hbWU+YCBhbmQgYDxuYW1lPmAgaXMgb24gdGhlIGRlbnlsaXN0LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzU2VydmljZVRva2VuRGVuaWVkKHN1Yjogc3RyaW5nKTogYm9vbGVhbiB7XG4gIGlmIChzZXJ2aWNlVG9rZW5EZW55bGlzdC5zaXplID09PSAwKSByZXR1cm4gZmFsc2U7XG4gIGlmICghc3ViLnN0YXJ0c1dpdGgoJ3NlcnZpY2U6JykpIHJldHVybiBmYWxzZTtcbiAgcmV0dXJuIHNlcnZpY2VUb2tlbkRlbnlsaXN0LmhhcyhzdWIuc2xpY2UoJ3NlcnZpY2U6Jy5sZW5ndGgpKTtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBTZXJ2aWNlVG9rZW5PcHRpb25zIHtcbiAgLyoqIENhbGxpbmcgc2VydmljZSBpZGVudGlmaWVyIChlLmcuICdiaWxsaW5nJywgJ3BsYXRmb3JtJykuIEVtYmVkZGVkIGFzIGBzdWI6IHNlcnZpY2U6PG5hbWU+YC4gKi9cbiAgc2VydmljZU5hbWU6IHN0cmluZztcbiAgLyoqIEFjdGl2ZSBvcmcgY29udGV4dCBmb3IgdGhlIGNhbGwuIFVzZSB0aGUgdGFyZ2V0IHRlbmFudCdzIG9yZyBpZCwgb3IgdGhlXG4gICAqICB3ZWxsLWtub3duIGBTWVNURU1fT1JHX0lEYCAoYW4gT2JqZWN0SWQpIGZvciBzeXN0ZW0td2lkZSBvcHMg4oCUIE5PVCB0aGUgc3RyaW5nXG4gICAqICAnc3lzdGVtJywgd2hpY2ggaWQtYmFzZWQgc3lzdGVtLW9yZyBjaGVja3Mgd29uJ3QgcmVjb2duaXplLiAqL1xuICBvcmdJZD86IHN0cmluZztcbiAgLyoqIEFjdGl2ZSBvcmcgbmFtZS4gRGVmYXVsdHMgdG8gb3JnSWQuICovXG4gIG9yZ05hbWU/OiBzdHJpbmc7XG4gIC8qKiBUVEwgaW4gc2Vjb25kcyAoZGVmYXVsdCAzMDApLiAqL1xuICB0dGxTZWNvbmRzPzogbnVtYmVyO1xuICAvKipcbiAgICogUm9sZSB0aGUgdG9rZW4gY2FycmllcyAocmVxdWlyZWQg4oCUIG5vIGltcGxpY2l0IGRlZmF1bHQpLiAqKlBhc3MgdGhlIExPV0VTVFxuICAgKiByb2xlIHRoZSBjYWxsIGFjdHVhbGx5IG5lZWRzKiogKGAnbWVtYmVyJ2AgZm9yIHJlYWQgLyBkYXRhLXBsYW5lIGNhbGxzKSBzbyBhXG4gICAqIGxlYWtlZCBzZXJ2aWNlIHRva2VuIGNhbid0IHBlcmZvcm0gYWRtaW4gYWN0aW9ucyBpbiB0aGUgdGFyZ2V0IG9yZy5cbiAgICogYGlzQWRtaW5gIGlzIGRlcml2ZWQgZnJvbSB0aGlzIChhZG1pbnxvd25lciDihpIgdHJ1ZSkuXG4gICAqL1xuICByb2xlOiAnb3duZXInIHwgJ2FkbWluJyB8ICdtZW1iZXInO1xuICAvKipcbiAgICogT3B0aW9uYWwgZmluZS1ncmFpbmVkIHBlcm1pc3Npb24gY2xhaW0uIFByZWZlciB0aGlzICsgYHJvbGU6ICdtZW1iZXInYCBvdmVyIGFcbiAgICogaGlnaCByb2xlIHdoZW4gYSBjYWxsIG5lZWRzIE9ORSBzcGVjaWZpYyBjYXBhYmlsaXR5IChlLmcuIGBbJ3BsdWdpbnM6d3JpdGUnXWBcbiAgICogdG8gcHVzaCBhIHBsdWdpbiBpbWFnZSkg4oCUIHRoZSB0b2tlbiB0aGVuIHNhdGlzZmllcyB0aGF0IHBlcm1pc3Npb24gZ2F0ZVxuICAgKiBXSVRIT1VUIGNhcnJ5aW5nIGBpc0FkbWluYCwgc28gYSBsZWFrZWQgdG9rZW4gY2FuJ3QgcGVyZm9ybSBhZG1pbiBhY3Rpb25zLlxuICAgKi9cbiAgcGVybWlzc2lvbnM/OiBQZXJtaXNzaW9uW107XG59XG5cbi8qKlxuICogTWludCBhIEpXVCBpZGVudGlmeWluZyB0aGUgY2FsbGluZyBzZXJ2aWNlLiBVc2VkIGZvciBpbnRlci1zZXJ2aWNlIEhUVFAgY2FsbHMuXG4gKiBUaGUgdG9rZW4gc2F0aXNmaWVzIGByZXF1aXJlQXV0aGAgYW5kICh3aGVuIG9yZ0lkIGlzIHByZXNlbnQpIGByZXF1aXJlT3JnYW5pemF0aW9uYC5cbiAqIFNjb3BlIGl0IHdpdGggYG9wdHMucm9sZWAg4oCUIGxlYXN0IHByaXZpbGVnZSBrZWVwcyBhIGxlYWtlZCB0b2tlbiBsb3ctdmFsdWUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzaWduU2VydmljZVRva2VuKG9wdHM6IFNlcnZpY2VUb2tlbk9wdGlvbnMpOiBzdHJpbmcge1xuICBjb25zdCByb2xlID0gb3B0cy5yb2xlO1xuICBjb25zdCBwYXlsb2FkOiBKd3RQYXlsb2FkID0ge1xuICAgIHN1YjogYHNlcnZpY2U6JHtvcHRzLnNlcnZpY2VOYW1lfWAsXG4gICAgdXNlcm5hbWU6IGAke29wdHMuc2VydmljZU5hbWV9LXNlcnZpY2VgLFxuICAgIGVtYWlsOiBgJHtvcHRzLnNlcnZpY2VOYW1lfUBpbnRlcm5hbGAsXG4gICAgcm9sZSxcbiAgICBpc0FkbWluOiByb2xlID09PSAnb3duZXInIHx8IHJvbGUgPT09ICdhZG1pbicsXG4gICAgdHlwZTogJ2FjY2VzcycsXG4gICAgb3JnYW5pemF0aW9uSWQ6IG9wdHMub3JnSWQsXG4gICAgb3JnYW5pemF0aW9uTmFtZTogb3B0cy5vcmdOYW1lID8/IG9wdHMub3JnSWQsXG4gICAgLy8gTGVhc3QtcHJpdmlsZWdlIGNhcGFiaWxpdHkgY2xhaW0gKG9wdGlvbmFsKSDigJQgbGV0cyBhIG1lbWJlci1yb2xlIHRva2VuXG4gICAgLy8gc2F0aXNmeSBhIHNwZWNpZmljIHBlcm1pc3Npb24gZ2F0ZSB3aXRob3V0IGNhcnJ5aW5nIGlzQWRtaW4uXG4gICAgLi4uKG9wdHMucGVybWlzc2lvbnMgJiYgb3B0cy5wZXJtaXNzaW9ucy5sZW5ndGggPiAwID8geyBwZXJtaXNzaW9uczogb3B0cy5wZXJtaXNzaW9ucyB9IDoge30pLFxuICB9O1xuICAvLyBNYXRjaCB0aGUgb3B0aW9uYWwgaXNzdWVyL2F1ZGllbmNlIHRoYXQgcmVxdWlyZUF1dGggdmVyaWZpZXMsIHdoZW5cbiAgLy8gY29uZmlndXJlZC4gV2l0aG91dCB0aGVzZSwgYSBzZXJ2aWNlIHRva2VuIHNpZ25lZCBoZXJlIHdvdWxkIGZhaWxcbiAgLy8gcmVxdWlyZUF1dGggaW4gYSBkZXBsb3ltZW50IHRoYXQgaGFzIHNldCBKV1RfSVNTVUVSL0pXVF9BVURJRU5DRS5cbiAgY29uc3Qgc2lnbk9wdGlvbnM6IGp3dC5TaWduT3B0aW9ucyA9IHtcbiAgICBleHBpcmVzSW46IG9wdHMudHRsU2Vjb25kcyA/PyBERUZBVUxUX1NFUlZJQ0VfVE9LRU5fVFRMX1NFQ09ORFMsXG4gICAgLy8gU2lnbiB3aXRoIHRoZSBzYW1lIGNvbmZpZ3VyZWQgYWxnIHJlcXVpcmVBdXRoIHBpbnMgb24gdmVyaWZ5LCBzbyBzZXJ2aWNlXG4gICAgLy8gdG9rZW5zIHN0YXkgdmFsaWQgdW5kZXIgYSBub24tZGVmYXVsdCBKV1RfQUxHT1JJVEhNLlxuICAgIGFsZ29yaXRobTogKHByb2Nlc3MuZW52LkpXVF9BTEdPUklUSE0gfHwgJ0hTMjU2JykgYXMgand0LkFsZ29yaXRobSxcbiAgICAvLyBVbmlxdWUgdG9rZW4gaWQgb24gZXZlcnkgbWludC4gQ29tYmluZWQgd2l0aCB0aGUgc2hvcnQgKDMwMHMgZGVmYXVsdCkgVFRMXG4gICAgLy8gdGhpcyBnaXZlcyBlYWNoIHNlcnZpY2UgdG9rZW4gYSBkaXN0aW5jdCBpZGVudGl0eSDigJQgdGhlIGJ1aWxkaW5nIGJsb2NrIGZvclxuICAgIC8vIHJlcGxheSBkZXRlY3Rpb24gKGEgdmVyaWZpZXIgY2FuIHRyYWNrIHNlZW4ganRpcykgYW5kIHRoZSBjb3JyZWxhdGlvblxuICAgIC8vIGhhbmRsZSBmb3IgdHJhY2luZyB3aGljaCBtaW50IHBlcmZvcm1lZCBhIGNyb3NzLXNlcnZpY2UgYWN0aW9uLiBJdCBkb2VzXG4gICAgLy8gTk9UIGJ5IGl0c2VsZiBwcmV2ZW50IHJlcGxheSB3aXRoaW4gdGhlIFRUTCB3aW5kb3c7IHRydWUgcmVwbGF5IGRlZmVuY2VcbiAgICAvLyBuZWVkcyB0aGUgYXN5bW1ldHJpYy1rZXkgd29yayB0cmFja2VkIHNlcGFyYXRlbHkuXG4gICAgand0aWQ6IHJhbmRvbVVVSUQoKSxcbiAgfTtcbiAgaWYgKHByb2Nlc3MuZW52LkpXVF9JU1NVRVIpIHNpZ25PcHRpb25zLmlzc3VlciA9IHByb2Nlc3MuZW52LkpXVF9JU1NVRVI7XG4gIGlmIChwcm9jZXNzLmVudi5KV1RfQVVESUVOQ0UpIHNpZ25PcHRpb25zLmF1ZGllbmNlID0gcHJvY2Vzcy5lbnYuSldUX0FVRElFTkNFO1xuICByZXR1cm4gand0LnNpZ24ocGF5bG9hZCwgZ2V0Snd0U2VjcmV0KCksIHNpZ25PcHRpb25zKTtcbn1cblxuLyoqIENvbnZlbmllbmNlOiByZXR1cm5zIGEgYEJlYXJlciA8dG9rZW4+YCBoZWFkZXIgdmFsdWUgZm9yIGZldGNoL2F4aW9zIGNhbGxzLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldFNlcnZpY2VBdXRoSGVhZGVyKG9wdHM6IFNlcnZpY2VUb2tlbk9wdGlvbnMpOiBzdHJpbmcge1xuICByZXR1cm4gYEJlYXJlciAke3NpZ25TZXJ2aWNlVG9rZW4ob3B0cyl9YDtcbn1cblxuLyoqIFRydWUgd2hlbiBgcmVxLnVzZXIuc3ViYCB3YXMgaXNzdWVkIGJ5IGBzaWduU2VydmljZVRva2VuYCAoaS5lLiBzdGFydHMgd2l0aCBgc2VydmljZTpgKS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1NlcnZpY2VQcmluY2lwYWwocmVxOiBSZXF1ZXN0KTogYm9vbGVhbiB7XG4gIHJldHVybiByZXEudXNlcj8uc3ViPy5zdGFydHNXaXRoKCdzZXJ2aWNlOicpID8/IGZhbHNlO1xufVxuXG4vKipcbiAqIFBSRS1hdXRoIGNoZWNrOiBjcnlwdG9ncmFwaGljYWxseSB2ZXJpZnkgdGhlIHJlcXVlc3QgY2FycmllcyBhIHZhbGlkLCBzaWduZWRcbiAqIFNFUlZJQ0UgdG9rZW4gKGBzdWJgIHN0YXJ0cyB3aXRoIGBzZXJ2aWNlOmApLiBVbmxpa2Uge0BsaW5rIGlzU2VydmljZVByaW5jaXBhbH1cbiAqICh3aGljaCByZWFkcyB0aGUgYWxyZWFkeS1wb3B1bGF0ZWQgYHJlcS51c2VyYCksIHRoaXMgdmVyaWZpZXMgdGhlIGJlYXJlciB0b2tlblxuICogaXRzZWxmLCBzbyBpdCBpcyBzYWZlIHRvIGNhbGwgQkVGT1JFIGByZXF1aXJlQXV0aGAgcnVucyDigJQgZS5nLiB0aGUgZ2xvYmFsIHJhdGVcbiAqIGxpbWl0ZXIncyBgc2tpcGAsIHdoaWNoIG11c3Qgbm90IHRydXN0IHRoZSBzcG9vZmFibGUgYHgtaW50ZXJuYWwtc2VydmljZWBcbiAqIGhlYWRlci4gTWlycm9ycyBgcmVxdWlyZUF1dGhgJ3MgdmVyaWZpY2F0aW9uIChhbGdvcml0aG0gcGlubmluZyArIG9wdGlvbmFsXG4gKiBpc3N1ZXIvYXVkaWVuY2UpIGFuZCByZXR1cm5zIGBmYWxzZWAgb24gYW55IG1pc3NpbmcvaW52YWxpZC9ub24tc2VydmljZSB0b2tlbi5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHZlcmlmeVNlcnZpY2VQcmluY2lwYWwocmVxOiBSZXF1ZXN0KTogYm9vbGVhbiB7XG4gIGNvbnN0IHBhcnRzID0gcmVxLmhlYWRlcnMuYXV0aG9yaXphdGlvbj8uc3BsaXQoJyAnKTtcbiAgaWYgKCFwYXJ0cyB8fCBwYXJ0cy5sZW5ndGggIT09IDIgfHwgcGFydHNbMF0gIT09ICdCZWFyZXInKSByZXR1cm4gZmFsc2U7XG4gIHRyeSB7XG4gICAgY29uc3QgdmVyaWZ5T3B0aW9uczogand0LlZlcmlmeU9wdGlvbnMgPSB7IGFsZ29yaXRobXM6IFsocHJvY2Vzcy5lbnYuSldUX0FMR09SSVRITSB8fCAnSFMyNTYnKSBhcyBqd3QuQWxnb3JpdGhtXSB9O1xuICAgIGlmIChwcm9jZXNzLmVudi5KV1RfSVNTVUVSKSB2ZXJpZnlPcHRpb25zLmlzc3VlciA9IHByb2Nlc3MuZW52LkpXVF9JU1NVRVI7XG4gICAgaWYgKHByb2Nlc3MuZW52LkpXVF9BVURJRU5DRSkgdmVyaWZ5T3B0aW9ucy5hdWRpZW5jZSA9IHByb2Nlc3MuZW52LkpXVF9BVURJRU5DRTtcbiAgICBjb25zdCBkZWNvZGVkID0gdmVyaWZ5Snd0V2l0aFJvdGF0aW9uKHBhcnRzWzFdLCB2ZXJpZnlPcHRpb25zKTtcbiAgICBpZiAoZGVjb2RlZC50eXBlICE9PSAnYWNjZXNzJyB8fCB0eXBlb2YgZGVjb2RlZC5zdWIgIT09ICdzdHJpbmcnIHx8ICFkZWNvZGVkLnN1Yi5zdGFydHNXaXRoKCdzZXJ2aWNlOicpKSByZXR1cm4gZmFsc2U7XG4gICAgLy8gQSBkZW55bGlzdGVkIChraWxsZWQpIHNlcnZpY2UgbXVzdCBOT1QgYmUgdHJlYXRlZCBhcyBhIHRydXN0ZWQgcHJpbmNpcGFsIOKAlFxuICAgIC8vIG90aGVyd2lzZSBpdCBrZWVwcyB0aGUgcmF0ZS1saW1pdGVyIGV4ZW1wdGlvbiBldmVuIHRob3VnaCByZXF1aXJlQXV0aCByZWplY3RzXG4gICAgLy8gaXQgb24gcmVhbCByb3V0ZXMuIEZvbGQgdGhlIGtpbGwtc3dpdGNoIGludG8gdGhlIHByZS1hdXRoIGNoZWNrIHRvby5cbiAgICByZXR1cm4gIWlzU2VydmljZVRva2VuRGVuaWVkKGRlY29kZWQuc3ViKTtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG59XG4iXX0=