@pipeline-builder/api-core 5.2.2 → 5.2.4

package/lib/helpers/support-calendar.js

@@ -0,0 +1,179 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * When a support case's first response is DUE.
+ *
+ * WHY A DEADLINE FUNCTION AND NOT A CLOCK. The targets are stated in business
+ * DAYS ("2 business days", "next business day"), and that choice is what makes
+ * this small. An hours-based target ("48 business hours") would need an
+ * accumulating within-day clock: pause at the end of the working day, resume at
+ * the start of the next, count elapsed working seconds, and decide what a case
+ * opened five minutes before closing is owed. A business-DAY target needs only
+ * one answer — given an open timestamp, what instant is the end of the Nth
+ * following working day — which is a pure function of a calendar.
+ *
+ * WHY THE RESULT IS FROZEN ONTO THE CASE. The caller stores this on
+ * `support_case.response_due_at` at open, exactly as it freezes `level`. Three
+ * things follow, and together they are the reason to do it this way:
+ *
+ *   - a holiday-list or working-week change after a case opens cannot move a
+ *     promise already made to a customer;
+ *   - the staff queue orders by a real deadline with no calendar arithmetic per
+ *     row;
+ *   - the standard/priority breach alert becomes CONTRACTUAL rather than the
+ *     operational "the queue is not being worked" guard it has to be today,
+ *     because a wall-clock quantile cannot express a business-day target at all
+ *     (a priority case raised at 17:01 on a Friday is not late until Monday
+ *     evening, about 79 wall-clock hours later).
+ *
+ * ONE PLATFORM CALENDAR, not the tenant's. With per-tenant timezones the same
+ * case raised at the same instant has a different deadline per customer, and the
+ * staff queue cannot be ordered by "most at risk" without computing per-tenant
+ * business time for every row. One clock, one ordering, one number to defend. A
+ * customer who cannot live with a business calendar at all is the PREMIUM
+ * customer, which is a cleaner upsell than silently running two dozen clocks.
+ */
+import { envInt, envStr } from '../utils/env.js';
+/**
+ * The measure behind each level's published target.
+ *
+ * Premium is `elapsed-hours` on purpose, and that is the whole of its 24×7
+ * claim: its clock does not stop for nights, weekends or holidays, so no
+ * calendar is consulted. It is also why premium is the one level whose target
+ * the wall-clock histogram can check directly.
+ */
+export const SUPPORT_TARGET_MEASURES = {
+    support_standard: { kind: 'business-days', days: 2 },
+    support_priority: { kind: 'business-days', days: 1 },
+    support_premium: { kind: 'elapsed-hours', hours: 8 },
+};
+/** `YYYY-MM-DD` and the weekday of an instant, as seen in `timeZone`. */
+function localParts(at, timeZone) {
+    // `en-CA` yields ISO-ordered date parts, which is the cheapest way to get a
+    // zone-correct YYYY-MM-DD without pulling a date library in.
+    const fmt = new Intl.DateTimeFormat('en-CA', {
+        timeZone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        hour12: false,
+        weekday: 'short',
+    });
+    const parts = new Map(fmt.formatToParts(at).map((p) => [p.type, p.value]));
+    const weekdays = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+    return {
+        date: `${parts.get('year')}-${parts.get('month')}-${parts.get('day')}`,
+        weekday: Math.max(0, weekdays.indexOf(parts.get('weekday') ?? '')),
+        // `hour12: false` can render midnight as 24 in some engines.
+        hour: Number(parts.get('hour')) % 24,
+    };
+}
+/** The UTC instant of `hour:00` on local date `ymd` in `timeZone`. */
+function instantAtLocalHour(ymd, hour, timeZone) {
+    // Guess from the naive UTC reading, then correct by the zone's actual offset
+    // at that moment. One correction is enough: the residual error could only
+    // exceed an hour if the offset itself changed between the guess and the
+    // target, which no real zone does.
+    const guess = new Date(`${ymd}T${String(hour).padStart(2, '0')}:00:00Z`);
+    const seen = localParts(guess, timeZone);
+    const seenUtc = Date.parse(`${seen.date}T${String(seen.hour).padStart(2, '0')}:00:00Z`);
+    return new Date(guess.getTime() + (guess.getTime() - seenUtc));
+}
+/** Step one calendar day forward from a `YYYY-MM-DD`. */
+function nextYmd(ymd) {
+    const d = new Date(`${ymd}T12:00:00Z`);
+    d.setUTCDate(d.getUTCDate() + 1);
+    return d.toISOString().slice(0, 10);
+}
+const isWorkingDay = (ymd, weekday, cal) => cal.days.includes(weekday) && !cal.holidays.has(ymd);
+/** The weekday of a `YYYY-MM-DD`, read at local noon so no zone shifts the date. */
+const weekdayOf = (ymd, timeZone) => localParts(new Date(`${ymd}T12:00:00Z`), timeZone).weekday;
+/**
+ * The instant a first response is due, or null for a level with no target.
+ *
+ * For a business-day target: the close of the Nth working day AFTER the one the
+ * case was opened on. A case opened on a Friday with a next-business-day target
+ * is due at Monday's close, not Saturday's — Saturday is not a working day, so
+ * it is not counted. A case opened ON a non-working day starts counting from the
+ * next working day, which is the reading that favours the customer and is the
+ * only one that can be explained in a sentence.
+ *
+ * The day of opening is never itself the deadline, however early the case
+ * arrives. "Next business day" has to mean tomorrow, not "later today" — a case
+ * opened at 09:01 and one opened at 16:59 are owed the same thing, and anything
+ * else turns the target into an hours clock by the back door.
+ */
+export function responseDueAt(openedAt, level, cal = businessCalendar()) {
+    const measure = SUPPORT_TARGET_MEASURES[level];
+    if (!measure)
+        return null;
+    if (measure.kind === 'elapsed-hours') {
+        return new Date(openedAt.getTime() + measure.hours * 3600_000);
+    }
+    // No working days configured at all would otherwise spin forever. Treated as
+    // "no deadline" rather than a throw: a misconfigured calendar must not make
+    // opening a case fail.
+    if (cal.days.length === 0)
+        return null;
+    let ymd = localParts(openedAt, cal.timeZone).date;
+    let counted = 0;
+    // Bounded: 366 steps covers a year, which is far past any holiday list that
+    // is not itself a configuration error.
+    for (let step = 0; step < 366 && counted < measure.days; step += 1) {
+        ymd = nextYmd(ymd);
+        if (isWorkingDay(ymd, weekdayOf(ymd, cal.timeZone), cal))
+            counted += 1;
+    }
+    if (counted < measure.days)
+        return null;
+    return instantAtLocalHour(ymd, cal.endHour, cal.timeZone);
+}
+/** `1,2,3,4,5` → `[1,2,3,4,5]`, ignoring anything that is not a weekday index. */
+function parseDays(raw) {
+    const out = raw.split(',')
+        .map((v) => Number(v.trim()))
+        .filter((v) => Number.isInteger(v) && v >= 0 && v <= 6);
+    return [...new Set(out)].sort((a, b) => a - b);
+}
+/** `2026-12-25,2027-01-01` → a set, ignoring anything not `YYYY-MM-DD`. */
+function parseHolidays(raw) {
+    return new Set(raw.split(',').map((v) => v.trim()).filter((v) => /^\d{4}-\d{2}-\d{2}$/.test(v)));
+}
+/**
+ * The configured calendar.
+ *
+ * `SUPPORT_BUSINESS_HOURS_TZ` takes an **IANA zone**, default
+ * `America/New_York`, and NOT a fixed abbreviation like `EST`. `EST` is
+ * permanently UTC−5, so an `EST` setting would put the desk an hour out for the
+ * eight months of the year that are EDT — the same reason
+ * `ASK_SCHEDULE_TIMEZONE` takes an IANA zone for its cron windows. An
+ * unrecognised zone falls back to UTC rather than throwing, because a bad
+ * timezone must not stop cases being opened; it is validated here so the
+ * fallback is deliberate rather than an exception thrown from `Intl` deep inside
+ * a request.
+ *
+ * Every stored timestamp stays UTC. The zone is applied only to derive a
+ * deadline.
+ *
+ * Holidays are an explicit operator-maintained list rather than a library: a
+ * library pulls both a dependency and a holiday POLICY that cannot be explained
+ * to a customer disputing a deadline.
+ */
+export function businessCalendar() {
+    const configured = envStr('SUPPORT_BUSINESS_HOURS_TZ', 'America/New_York');
+    let timeZone = configured;
+    try {
+        new Intl.DateTimeFormat('en-CA', { timeZone: configured }).format(new Date());
+    }
+    catch {
+        timeZone = 'UTC';
+    }
+    return {
+        timeZone,
+        days: parseDays(envStr('SUPPORT_BUSINESS_HOURS_DAYS', '1,2,3,4,5')),
+        endHour: envInt('SUPPORT_BUSINESS_HOURS_END_HOUR', 17, { min: 0, max: 23 }),
+        holidays: parseHolidays(envStr('SUPPORT_BUSINESS_HOURS_HOLIDAYS', '')),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3VwcG9ydC1jYWxlbmRhci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzL3N1cHBvcnQtY2FsZW5kYXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQ0c7QUFFSCxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBU2pEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBZ0Q7SUFDbEYsZ0JBQWdCLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLElBQUksRUFBRSxDQUFDLEVBQUU7SUFDcEQsZ0JBQWdCLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLElBQUksRUFBRSxDQUFDLEVBQUU7SUFDcEQsZUFBZSxFQUFFLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxFQUFFO0NBQ3JELENBQUM7QUFjRix5RUFBeUU7QUFDekUsU0FBUyxVQUFVLENBQUMsRUFBUSxFQUFFLFFBQWdCO0lBQzVDLDRFQUE0RTtJQUM1RSw2REFBNkQ7SUFDN0QsTUFBTSxHQUFHLEdBQUcsSUFBSSxJQUFJLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRTtRQUMzQyxRQUFRO1FBQ1IsSUFBSSxFQUFFLFNBQVM7UUFDZixLQUFLLEVBQUUsU0FBUztRQUNoQixHQUFHLEVBQUUsU0FBUztRQUNkLElBQUksRUFBRSxTQUFTO1FBQ2YsTUFBTSxFQUFFLEtBQUs7UUFDYixPQUFPLEVBQUUsT0FBTztLQUNqQixDQUFDLENBQUM7SUFDSCxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0UsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNuRSxPQUFPO1FBQ0wsSUFBSSxFQUFFLEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUU7UUFDdEUsT0FBTyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNsRSw2REFBNkQ7UUFDN0QsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRTtLQUNyQyxDQUFDO0FBQ0osQ0FBQztBQUVELHNFQUFzRTtBQUN0RSxTQUFTLGtCQUFrQixDQUFDLEdBQVcsRUFBRSxJQUFZLEVBQUUsUUFBZ0I7SUFDckUsNkVBQTZFO0lBQzdFLDBFQUEwRTtJQUMxRSx3RUFBd0U7SUFDeEUsbUNBQW1DO0lBQ25DLE1BQU0sS0FBSyxHQUFHLElBQUksSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUN6RSxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxJQUFJLENBQUMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDeEYsT0FBTyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQztBQUNqRSxDQUFDO0FBRUQseURBQXlEO0FBQ3pELFNBQVMsT0FBTyxDQUFDLEdBQVc7SUFDMUIsTUFBTSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsR0FBRyxHQUFHLFlBQVksQ0FBQyxDQUFDO0lBQ3ZDLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ2pDLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDdEMsQ0FBQztBQUVELE1BQU0sWUFBWSxHQUFHLENBQUMsR0FBVyxFQUFFLE9BQWUsRUFBRSxHQUFxQixFQUFXLEVBQUUsQ0FDcEYsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUV2RCxvRkFBb0Y7QUFDcEYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxHQUFXLEVBQUUsUUFBZ0IsRUFBVSxFQUFFLENBQzFELFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQyxHQUFHLEdBQUcsWUFBWSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDO0FBRTdEOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBQ0gsTUFBTSxVQUFVLGFBQWEsQ0FDM0IsUUFBYyxFQUNkLEtBQWEsRUFDYixHQUFHLEdBQXFCLGdCQUFnQixFQUFFO0lBRTFDLE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9DLElBQUksQ0FBQyxPQUFPO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDMUIsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLGVBQWUsRUFBRSxDQUFDO1FBQ3JDLE9BQU8sSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxHQUFHLE9BQU8sQ0FBQyxLQUFLLEdBQUcsUUFBUSxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELDZFQUE2RTtJQUM3RSw0RUFBNEU7SUFDNUUsdUJBQXVCO0lBQ3ZCLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXZDLElBQUksR0FBRyxHQUFHLFVBQVUsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUNsRCxJQUFJLE9BQU8sR0FBRyxDQUFDLENBQUM7SUFDaEIsNEVBQTRFO0lBQzVFLHVDQUF1QztJQUN2QyxLQUFLLElBQUksSUFBSSxHQUFHLENBQUMsRUFBRSxJQUFJLEdBQUcsR0FBRyxJQUFJLE9BQU8sR0FBRyxPQUFPLENBQUMsSUFBSSxFQUFFLElBQUksSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNuRSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ25CLElBQUksWUFBWSxDQUFDLEdBQUcsRUFBRSxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxJQUFJLE9BQU8sR0FBRyxPQUFPLENBQUMsSUFBSTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ3hDLE9BQU8sa0JBQWtCLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzVELENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsU0FBUyxTQUFTLENBQUMsR0FBVztJQUM1QixNQUFNLEdBQUcsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQztTQUN2QixHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztTQUM1QixNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDakQsQ0FBQztBQUVELDJFQUEyRTtBQUMzRSxTQUFTLGFBQWEsQ0FBQyxHQUFXO0lBQ2hDLE9BQU8sSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNuRyxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFDSCxNQUFNLFVBQVUsZ0JBQWdCO0lBQzlCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQywyQkFBMkIsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO0lBQzNFLElBQUksUUFBUSxHQUFHLFVBQVUsQ0FBQztJQUMxQixJQUFJLENBQUM7UUFDSCxJQUFJLElBQUksQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNuQixDQUFDO0lBQ0QsT0FBTztRQUNMLFFBQVE7UUFDUixJQUFJLEVBQUUsU0FBUyxDQUFDLE1BQU0sQ0FBQyw2QkFBNkIsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNuRSxPQUFPLEVBQUUsTUFBTSxDQUFDLGlDQUFpQyxFQUFFLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxDQUFDO1FBQzNFLFFBQVEsRUFBRSxhQUFhLENBQUMsTUFBTSxDQUFDLGlDQUFpQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0tBQ3ZFLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogV2hlbiBhIHN1cHBvcnQgY2FzZSdzIGZpcnN0IHJlc3BvbnNlIGlzIERVRS5cbiAqXG4gKiBXSFkgQSBERUFETElORSBGVU5DVElPTiBBTkQgTk9UIEEgQ0xPQ0suIFRoZSB0YXJnZXRzIGFyZSBzdGF0ZWQgaW4gYnVzaW5lc3NcbiAqIERBWVMgKFwiMiBidXNpbmVzcyBkYXlzXCIsIFwibmV4dCBidXNpbmVzcyBkYXlcIiksIGFuZCB0aGF0IGNob2ljZSBpcyB3aGF0IG1ha2VzXG4gKiB0aGlzIHNtYWxsLiBBbiBob3Vycy1iYXNlZCB0YXJnZXQgKFwiNDggYnVzaW5lc3MgaG91cnNcIikgd291bGQgbmVlZCBhblxuICogYWNjdW11bGF0aW5nIHdpdGhpbi1kYXkgY2xvY2s6IHBhdXNlIGF0IHRoZSBlbmQgb2YgdGhlIHdvcmtpbmcgZGF5LCByZXN1bWUgYXRcbiAqIHRoZSBzdGFydCBvZiB0aGUgbmV4dCwgY291bnQgZWxhcHNlZCB3b3JraW5nIHNlY29uZHMsIGFuZCBkZWNpZGUgd2hhdCBhIGNhc2VcbiAqIG9wZW5lZCBmaXZlIG1pbnV0ZXMgYmVmb3JlIGNsb3NpbmcgaXMgb3dlZC4gQSBidXNpbmVzcy1EQVkgdGFyZ2V0IG5lZWRzIG9ubHlcbiAqIG9uZSBhbnN3ZXIg4oCUIGdpdmVuIGFuIG9wZW4gdGltZXN0YW1wLCB3aGF0IGluc3RhbnQgaXMgdGhlIGVuZCBvZiB0aGUgTnRoXG4gKiBmb2xsb3dpbmcgd29ya2luZyBkYXkg4oCUIHdoaWNoIGlzIGEgcHVyZSBmdW5jdGlvbiBvZiBhIGNhbGVuZGFyLlxuICpcbiAqIFdIWSBUSEUgUkVTVUxUIElTIEZST1pFTiBPTlRPIFRIRSBDQVNFLiBUaGUgY2FsbGVyIHN0b3JlcyB0aGlzIG9uXG4gKiBgc3VwcG9ydF9jYXNlLnJlc3BvbnNlX2R1ZV9hdGAgYXQgb3BlbiwgZXhhY3RseSBhcyBpdCBmcmVlemVzIGBsZXZlbGAuIFRocmVlXG4gKiB0aGluZ3MgZm9sbG93LCBhbmQgdG9nZXRoZXIgdGhleSBhcmUgdGhlIHJlYXNvbiB0byBkbyBpdCB0aGlzIHdheTpcbiAqXG4gKiAgIC0gYSBob2xpZGF5LWxpc3Qgb3Igd29ya2luZy13ZWVrIGNoYW5nZSBhZnRlciBhIGNhc2Ugb3BlbnMgY2Fubm90IG1vdmUgYVxuICogICAgIHByb21pc2UgYWxyZWFkeSBtYWRlIHRvIGEgY3VzdG9tZXI7XG4gKiAgIC0gdGhlIHN0YWZmIHF1ZXVlIG9yZGVycyBieSBhIHJlYWwgZGVhZGxpbmUgd2l0aCBubyBjYWxlbmRhciBhcml0aG1ldGljIHBlclxuICogICAgIHJvdztcbiAqICAgLSB0aGUgc3RhbmRhcmQvcHJpb3JpdHkgYnJlYWNoIGFsZXJ0IGJlY29tZXMgQ09OVFJBQ1RVQUwgcmF0aGVyIHRoYW4gdGhlXG4gKiAgICAgb3BlcmF0aW9uYWwgXCJ0aGUgcXVldWUgaXMgbm90IGJlaW5nIHdvcmtlZFwiIGd1YXJkIGl0IGhhcyB0byBiZSB0b2RheSxcbiAqICAgICBiZWNhdXNlIGEgd2FsbC1jbG9jayBxdWFudGlsZSBjYW5ub3QgZXhwcmVzcyBhIGJ1c2luZXNzLWRheSB0YXJnZXQgYXQgYWxsXG4gKiAgICAgKGEgcHJpb3JpdHkgY2FzZSByYWlzZWQgYXQgMTc6MDEgb24gYSBGcmlkYXkgaXMgbm90IGxhdGUgdW50aWwgTW9uZGF5XG4gKiAgICAgZXZlbmluZywgYWJvdXQgNzkgd2FsbC1jbG9jayBob3VycyBsYXRlcikuXG4gKlxuICogT05FIFBMQVRGT1JNIENBTEVOREFSLCBub3QgdGhlIHRlbmFudCdzLiBXaXRoIHBlci10ZW5hbnQgdGltZXpvbmVzIHRoZSBzYW1lXG4gKiBjYXNlIHJhaXNlZCBhdCB0aGUgc2FtZSBpbnN0YW50IGhhcyBhIGRpZmZlcmVudCBkZWFkbGluZSBwZXIgY3VzdG9tZXIsIGFuZCB0aGVcbiAqIHN0YWZmIHF1ZXVlIGNhbm5vdCBiZSBvcmRlcmVkIGJ5IFwibW9zdCBhdCByaXNrXCIgd2l0aG91dCBjb21wdXRpbmcgcGVyLXRlbmFudFxuICogYnVzaW5lc3MgdGltZSBmb3IgZXZlcnkgcm93LiBPbmUgY2xvY2ssIG9uZSBvcmRlcmluZywgb25lIG51bWJlciB0byBkZWZlbmQuIEFcbiAqIGN1c3RvbWVyIHdobyBjYW5ub3QgbGl2ZSB3aXRoIGEgYnVzaW5lc3MgY2FsZW5kYXIgYXQgYWxsIGlzIHRoZSBQUkVNSVVNXG4gKiBjdXN0b21lciwgd2hpY2ggaXMgYSBjbGVhbmVyIHVwc2VsbCB0aGFuIHNpbGVudGx5IHJ1bm5pbmcgdHdvIGRvemVuIGNsb2Nrcy5cbiAqL1xuXG5pbXBvcnQgeyBlbnZJbnQsIGVudlN0ciB9IGZyb20gJy4uL3V0aWxzL2Vudi5qcyc7XG5cbi8qKiBIb3cgYSBsZXZlbCdzIHRhcmdldCBpcyBtZWFzdXJlZC4gKi9cbmV4cG9ydCB0eXBlIFN1cHBvcnRUYXJnZXRLaW5kID1cbiAgLyoqIE4gd29ya2luZyBkYXlzLCBlbmRpbmcgYXQgdGhlIGNsb3NlIG9mIHRoZSBOdGguICovXG4gIHwgeyBraW5kOiAnYnVzaW5lc3MtZGF5cyc7IGRheXM6IG51bWJlciB9XG4gIC8qKiBOIGhvdXJzIG9mIHdhbGwgY2xvY2ssIHdpdGggbm8gY2FsZW5kYXIgYXBwbGllZCBhdCBhbGwuICovXG4gIHwgeyBraW5kOiAnZWxhcHNlZC1ob3Vycyc7IGhvdXJzOiBudW1iZXIgfTtcblxuLyoqXG4gKiBUaGUgbWVhc3VyZSBiZWhpbmQgZWFjaCBsZXZlbCdzIHB1Ymxpc2hlZCB0YXJnZXQuXG4gKlxuICogUHJlbWl1bSBpcyBgZWxhcHNlZC1ob3Vyc2Agb24gcHVycG9zZSwgYW5kIHRoYXQgaXMgdGhlIHdob2xlIG9mIGl0cyAyNMOXN1xuICogY2xhaW06IGl0cyBjbG9jayBkb2VzIG5vdCBzdG9wIGZvciBuaWdodHMsIHdlZWtlbmRzIG9yIGhvbGlkYXlzLCBzbyBub1xuICogY2FsZW5kYXIgaXMgY29uc3VsdGVkLiBJdCBpcyBhbHNvIHdoeSBwcmVtaXVtIGlzIHRoZSBvbmUgbGV2ZWwgd2hvc2UgdGFyZ2V0XG4gKiB0aGUgd2FsbC1jbG9jayBoaXN0b2dyYW0gY2FuIGNoZWNrIGRpcmVjdGx5LlxuICovXG5leHBvcnQgY29uc3QgU1VQUE9SVF9UQVJHRVRfTUVBU1VSRVM6IFJlYWRvbmx5PFJlY29yZDxzdHJpbmcsIFN1cHBvcnRUYXJnZXRLaW5kPj4gPSB7XG4gIHN1cHBvcnRfc3RhbmRhcmQ6IHsga2luZDogJ2J1c2luZXNzLWRheXMnLCBkYXlzOiAyIH0sXG4gIHN1cHBvcnRfcHJpb3JpdHk6IHsga2luZDogJ2J1c2luZXNzLWRheXMnLCBkYXlzOiAxIH0sXG4gIHN1cHBvcnRfcHJlbWl1bTogeyBraW5kOiAnZWxhcHNlZC1ob3VycycsIGhvdXJzOiA4IH0sXG59O1xuXG4vKiogVGhlIHJlc29sdmVkIGJ1c2luZXNzIGNhbGVuZGFyLiAqL1xuZXhwb3J0IGludGVyZmFjZSBCdXNpbmVzc0NhbGVuZGFyIHtcbiAgLyoqIElBTkEgem9uZS4gTmV2ZXIgYSBmaXhlZCBhYmJyZXZpYXRpb24g4oCUIHNlZSB7QGxpbmsgYnVzaW5lc3NDYWxlbmRhcn0uICovXG4gIHRpbWVab25lOiBzdHJpbmc7XG4gIC8qKiBXb3JraW5nIHdlZWtkYXlzLCAwID0gU3VuZGF5IOKApiA2ID0gU2F0dXJkYXkuICovXG4gIGRheXM6IHJlYWRvbmx5IG51bWJlcltdO1xuICAvKiogVGhlIGhvdXIgKDDigJMyMykgYXQgd2hpY2ggYSB3b3JraW5nIGRheSBDTE9TRVMsIGluIGB0aW1lWm9uZWAuICovXG4gIGVuZEhvdXI6IG51bWJlcjtcbiAgLyoqIE5vbi13b3JraW5nIGRhdGVzLCBgWVlZWS1NTS1ERGAgaW4gYHRpbWVab25lYC4gKi9cbiAgaG9saWRheXM6IFJlYWRvbmx5U2V0PHN0cmluZz47XG59XG5cbi8qKiBgWVlZWS1NTS1ERGAgYW5kIHRoZSB3ZWVrZGF5IG9mIGFuIGluc3RhbnQsIGFzIHNlZW4gaW4gYHRpbWVab25lYC4gKi9cbmZ1bmN0aW9uIGxvY2FsUGFydHMoYXQ6IERhdGUsIHRpbWVab25lOiBzdHJpbmcpOiB7IGRhdGU6IHN0cmluZzsgd2Vla2RheTogbnVtYmVyOyBob3VyOiBudW1iZXIgfSB7XG4gIC8vIGBlbi1DQWAgeWllbGRzIElTTy1vcmRlcmVkIGRhdGUgcGFydHMsIHdoaWNoIGlzIHRoZSBjaGVhcGVzdCB3YXkgdG8gZ2V0IGFcbiAgLy8gem9uZS1jb3JyZWN0IFlZWVktTU0tREQgd2l0aG91dCBwdWxsaW5nIGEgZGF0ZSBsaWJyYXJ5IGluLlxuICBjb25zdCBmbXQgPSBuZXcgSW50bC5EYXRlVGltZUZvcm1hdCgnZW4tQ0EnLCB7XG4gICAgdGltZVpvbmUsXG4gICAgeWVhcjogJ251bWVyaWMnLFxuICAgIG1vbnRoOiAnMi1kaWdpdCcsXG4gICAgZGF5OiAnMi1kaWdpdCcsXG4gICAgaG91cjogJzItZGlnaXQnLFxuICAgIGhvdXIxMjogZmFsc2UsXG4gICAgd2Vla2RheTogJ3Nob3J0JyxcbiAgfSk7XG4gIGNvbnN0IHBhcnRzID0gbmV3IE1hcChmbXQuZm9ybWF0VG9QYXJ0cyhhdCkubWFwKChwKSA9PiBbcC50eXBlLCBwLnZhbHVlXSkpO1xuICBjb25zdCB3ZWVrZGF5cyA9IFsnU3VuJywgJ01vbicsICdUdWUnLCAnV2VkJywgJ1RodScsICdGcmknLCAnU2F0J107XG4gIHJldHVybiB7XG4gICAgZGF0ZTogYCR7cGFydHMuZ2V0KCd5ZWFyJyl9LSR7cGFydHMuZ2V0KCdtb250aCcpfS0ke3BhcnRzLmdldCgnZGF5Jyl9YCxcbiAgICB3ZWVrZGF5OiBNYXRoLm1heCgwLCB3ZWVrZGF5cy5pbmRleE9mKHBhcnRzLmdldCgnd2Vla2RheScpID8/ICcnKSksXG4gICAgLy8gYGhvdXIxMjogZmFsc2VgIGNhbiByZW5kZXIgbWlkbmlnaHQgYXMgMjQgaW4gc29tZSBlbmdpbmVzLlxuICAgIGhvdXI6IE51bWJlcihwYXJ0cy5nZXQoJ2hvdXInKSkgJSAyNCxcbiAgfTtcbn1cblxuLyoqIFRoZSBVVEMgaW5zdGFudCBvZiBgaG91cjowMGAgb24gbG9jYWwgZGF0ZSBgeW1kYCBpbiBgdGltZVpvbmVgLiAqL1xuZnVuY3Rpb24gaW5zdGFudEF0TG9jYWxIb3VyKHltZDogc3RyaW5nLCBob3VyOiBudW1iZXIsIHRpbWVab25lOiBzdHJpbmcpOiBEYXRlIHtcbiAgLy8gR3Vlc3MgZnJvbSB0aGUgbmFpdmUgVVRDIHJlYWRpbmcsIHRoZW4gY29ycmVjdCBieSB0aGUgem9uZSdzIGFjdHVhbCBvZmZzZXRcbiAgLy8gYXQgdGhhdCBtb21lbnQuIE9uZSBjb3JyZWN0aW9uIGlzIGVub3VnaDogdGhlIHJlc2lkdWFsIGVycm9yIGNvdWxkIG9ubHlcbiAgLy8gZXhjZWVkIGFuIGhvdXIgaWYgdGhlIG9mZnNldCBpdHNlbGYgY2hhbmdlZCBiZXR3ZWVuIHRoZSBndWVzcyBhbmQgdGhlXG4gIC8vIHRhcmdldCwgd2hpY2ggbm8gcmVhbCB6b25lIGRvZXMuXG4gIGNvbnN0IGd1ZXNzID0gbmV3IERhdGUoYCR7eW1kfVQke1N0cmluZyhob3VyKS5wYWRTdGFydCgyLCAnMCcpfTowMDowMFpgKTtcbiAgY29uc3Qgc2VlbiA9IGxvY2FsUGFydHMoZ3Vlc3MsIHRpbWVab25lKTtcbiAgY29uc3Qgc2VlblV0YyA9IERhdGUucGFyc2UoYCR7c2Vlbi5kYXRlfVQke1N0cmluZyhzZWVuLmhvdXIpLnBhZFN0YXJ0KDIsICcwJyl9OjAwOjAwWmApO1xuICByZXR1cm4gbmV3IERhdGUoZ3Vlc3MuZ2V0VGltZSgpICsgKGd1ZXNzLmdldFRpbWUoKSAtIHNlZW5VdGMpKTtcbn1cblxuLyoqIFN0ZXAgb25lIGNhbGVuZGFyIGRheSBmb3J3YXJkIGZyb20gYSBgWVlZWS1NTS1ERGAuICovXG5mdW5jdGlvbiBuZXh0WW1kKHltZDogc3RyaW5nKTogc3RyaW5nIHtcbiAgY29uc3QgZCA9IG5ldyBEYXRlKGAke3ltZH1UMTI6MDA6MDBaYCk7XG4gIGQuc2V0VVRDRGF0ZShkLmdldFVUQ0RhdGUoKSArIDEpO1xuICByZXR1cm4gZC50b0lTT1N0cmluZygpLnNsaWNlKDAsIDEwKTtcbn1cblxuY29uc3QgaXNXb3JraW5nRGF5ID0gKHltZDogc3RyaW5nLCB3ZWVrZGF5OiBudW1iZXIsIGNhbDogQnVzaW5lc3NDYWxlbmRhcik6IGJvb2xlYW4gPT5cbiAgY2FsLmRheXMuaW5jbHVkZXMod2Vla2RheSkgJiYgIWNhbC5ob2xpZGF5cy5oYXMoeW1kKTtcblxuLyoqIFRoZSB3ZWVrZGF5IG9mIGEgYFlZWVktTU0tRERgLCByZWFkIGF0IGxvY2FsIG5vb24gc28gbm8gem9uZSBzaGlmdHMgdGhlIGRhdGUuICovXG5jb25zdCB3ZWVrZGF5T2YgPSAoeW1kOiBzdHJpbmcsIHRpbWVab25lOiBzdHJpbmcpOiBudW1iZXIgPT5cbiAgbG9jYWxQYXJ0cyhuZXcgRGF0ZShgJHt5bWR9VDEyOjAwOjAwWmApLCB0aW1lWm9uZSkud2Vla2RheTtcblxuLyoqXG4gKiBUaGUgaW5zdGFudCBhIGZpcnN0IHJlc3BvbnNlIGlzIGR1ZSwgb3IgbnVsbCBmb3IgYSBsZXZlbCB3aXRoIG5vIHRhcmdldC5cbiAqXG4gKiBGb3IgYSBidXNpbmVzcy1kYXkgdGFyZ2V0OiB0aGUgY2xvc2Ugb2YgdGhlIE50aCB3b3JraW5nIGRheSBBRlRFUiB0aGUgb25lIHRoZVxuICogY2FzZSB3YXMgb3BlbmVkIG9uLiBBIGNhc2Ugb3BlbmVkIG9uIGEgRnJpZGF5IHdpdGggYSBuZXh0LWJ1c2luZXNzLWRheSB0YXJnZXRcbiAqIGlzIGR1ZSBhdCBNb25kYXkncyBjbG9zZSwgbm90IFNhdHVyZGF5J3Mg4oCUIFNhdHVyZGF5IGlzIG5vdCBhIHdvcmtpbmcgZGF5LCBzb1xuICogaXQgaXMgbm90IGNvdW50ZWQuIEEgY2FzZSBvcGVuZWQgT04gYSBub24td29ya2luZyBkYXkgc3RhcnRzIGNvdW50aW5nIGZyb20gdGhlXG4gKiBuZXh0IHdvcmtpbmcgZGF5LCB3aGljaCBpcyB0aGUgcmVhZGluZyB0aGF0IGZhdm91cnMgdGhlIGN1c3RvbWVyIGFuZCBpcyB0aGVcbiAqIG9ubHkgb25lIHRoYXQgY2FuIGJlIGV4cGxhaW5lZCBpbiBhIHNlbnRlbmNlLlxuICpcbiAqIFRoZSBkYXkgb2Ygb3BlbmluZyBpcyBuZXZlciBpdHNlbGYgdGhlIGRlYWRsaW5lLCBob3dldmVyIGVhcmx5IHRoZSBjYXNlXG4gKiBhcnJpdmVzLiBcIk5leHQgYnVzaW5lc3MgZGF5XCIgaGFzIHRvIG1lYW4gdG9tb3Jyb3csIG5vdCBcImxhdGVyIHRvZGF5XCIg4oCUIGEgY2FzZVxuICogb3BlbmVkIGF0IDA5OjAxIGFuZCBvbmUgb3BlbmVkIGF0IDE2OjU5IGFyZSBvd2VkIHRoZSBzYW1lIHRoaW5nLCBhbmQgYW55dGhpbmdcbiAqIGVsc2UgdHVybnMgdGhlIHRhcmdldCBpbnRvIGFuIGhvdXJzIGNsb2NrIGJ5IHRoZSBiYWNrIGRvb3IuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNwb25zZUR1ZUF0KFxuICBvcGVuZWRBdDogRGF0ZSxcbiAgbGV2ZWw6IHN0cmluZyxcbiAgY2FsOiBCdXNpbmVzc0NhbGVuZGFyID0gYnVzaW5lc3NDYWxlbmRhcigpLFxuKTogRGF0ZSB8IG51bGwge1xuICBjb25zdCBtZWFzdXJlID0gU1VQUE9SVF9UQVJHRVRfTUVBU1VSRVNbbGV2ZWxdO1xuICBpZiAoIW1lYXN1cmUpIHJldHVybiBudWxsO1xuICBpZiAobWVhc3VyZS5raW5kID09PSAnZWxhcHNlZC1ob3VycycpIHtcbiAgICByZXR1cm4gbmV3IERhdGUob3BlbmVkQXQuZ2V0VGltZSgpICsgbWVhc3VyZS5ob3VycyAqIDM2MDBfMDAwKTtcbiAgfVxuICAvLyBObyB3b3JraW5nIGRheXMgY29uZmlndXJlZCBhdCBhbGwgd291bGQgb3RoZXJ3aXNlIHNwaW4gZm9yZXZlci4gVHJlYXRlZCBhc1xuICAvLyBcIm5vIGRlYWRsaW5lXCIgcmF0aGVyIHRoYW4gYSB0aHJvdzogYSBtaXNjb25maWd1cmVkIGNhbGVuZGFyIG11c3Qgbm90IG1ha2VcbiAgLy8gb3BlbmluZyBhIGNhc2UgZmFpbC5cbiAgaWYgKGNhbC5kYXlzLmxlbmd0aCA9PT0gMCkgcmV0dXJuIG51bGw7XG5cbiAgbGV0IHltZCA9IGxvY2FsUGFydHMob3BlbmVkQXQsIGNhbC50aW1lWm9uZSkuZGF0ZTtcbiAgbGV0IGNvdW50ZWQgPSAwO1xuICAvLyBCb3VuZGVkOiAzNjYgc3RlcHMgY292ZXJzIGEgeWVhciwgd2hpY2ggaXMgZmFyIHBhc3QgYW55IGhvbGlkYXkgbGlzdCB0aGF0XG4gIC8vIGlzIG5vdCBpdHNlbGYgYSBjb25maWd1cmF0aW9uIGVycm9yLlxuICBmb3IgKGxldCBzdGVwID0gMDsgc3RlcCA8IDM2NiAmJiBjb3VudGVkIDwgbWVhc3VyZS5kYXlzOyBzdGVwICs9IDEpIHtcbiAgICB5bWQgPSBuZXh0WW1kKHltZCk7XG4gICAgaWYgKGlzV29ya2luZ0RheSh5bWQsIHdlZWtkYXlPZih5bWQsIGNhbC50aW1lWm9uZSksIGNhbCkpIGNvdW50ZWQgKz0gMTtcbiAgfVxuICBpZiAoY291bnRlZCA8IG1lYXN1cmUuZGF5cykgcmV0dXJuIG51bGw7XG4gIHJldHVybiBpbnN0YW50QXRMb2NhbEhvdXIoeW1kLCBjYWwuZW5kSG91ciwgY2FsLnRpbWVab25lKTtcbn1cblxuLyoqIGAxLDIsMyw0LDVgIOKGkiBgWzEsMiwzLDQsNV1gLCBpZ25vcmluZyBhbnl0aGluZyB0aGF0IGlzIG5vdCBhIHdlZWtkYXkgaW5kZXguICovXG5mdW5jdGlvbiBwYXJzZURheXMocmF3OiBzdHJpbmcpOiBudW1iZXJbXSB7XG4gIGNvbnN0IG91dCA9IHJhdy5zcGxpdCgnLCcpXG4gICAgLm1hcCgodikgPT4gTnVtYmVyKHYudHJpbSgpKSlcbiAgICAuZmlsdGVyKCh2KSA9PiBOdW1iZXIuaXNJbnRlZ2VyKHYpICYmIHYgPj0gMCAmJiB2IDw9IDYpO1xuICByZXR1cm4gWy4uLm5ldyBTZXQob3V0KV0uc29ydCgoYSwgYikgPT4gYSAtIGIpO1xufVxuXG4vKiogYDIwMjYtMTItMjUsMjAyNy0wMS0wMWAg4oaSIGEgc2V0LCBpZ25vcmluZyBhbnl0aGluZyBub3QgYFlZWVktTU0tRERgLiAqL1xuZnVuY3Rpb24gcGFyc2VIb2xpZGF5cyhyYXc6IHN0cmluZyk6IFNldDxzdHJpbmc+IHtcbiAgcmV0dXJuIG5ldyBTZXQocmF3LnNwbGl0KCcsJykubWFwKCh2KSA9PiB2LnRyaW0oKSkuZmlsdGVyKCh2KSA9PiAvXlxcZHs0fS1cXGR7Mn0tXFxkezJ9JC8udGVzdCh2KSkpO1xufVxuXG4vKipcbiAqIFRoZSBjb25maWd1cmVkIGNhbGVuZGFyLlxuICpcbiAqIGBTVVBQT1JUX0JVU0lORVNTX0hPVVJTX1RaYCB0YWtlcyBhbiAqKklBTkEgem9uZSoqLCBkZWZhdWx0XG4gKiBgQW1lcmljYS9OZXdfWW9ya2AsIGFuZCBOT1QgYSBmaXhlZCBhYmJyZXZpYXRpb24gbGlrZSBgRVNUYC4gYEVTVGAgaXNcbiAqIHBlcm1hbmVudGx5IFVUQ+KIkjUsIHNvIGFuIGBFU1RgIHNldHRpbmcgd291bGQgcHV0IHRoZSBkZXNrIGFuIGhvdXIgb3V0IGZvciB0aGVcbiAqIGVpZ2h0IG1vbnRocyBvZiB0aGUgeWVhciB0aGF0IGFyZSBFRFQg4oCUIHRoZSBzYW1lIHJlYXNvblxuICogYEFTS19TQ0hFRFVMRV9USU1FWk9ORWAgdGFrZXMgYW4gSUFOQSB6b25lIGZvciBpdHMgY3JvbiB3aW5kb3dzLiBBblxuICogdW5yZWNvZ25pc2VkIHpvbmUgZmFsbHMgYmFjayB0byBVVEMgcmF0aGVyIHRoYW4gdGhyb3dpbmcsIGJlY2F1c2UgYSBiYWRcbiAqIHRpbWV6b25lIG11c3Qgbm90IHN0b3AgY2FzZXMgYmVpbmcgb3BlbmVkOyBpdCBpcyB2YWxpZGF0ZWQgaGVyZSBzbyB0aGVcbiAqIGZhbGxiYWNrIGlzIGRlbGliZXJhdGUgcmF0aGVyIHRoYW4gYW4gZXhjZXB0aW9uIHRocm93biBmcm9tIGBJbnRsYCBkZWVwIGluc2lkZVxuICogYSByZXF1ZXN0LlxuICpcbiAqIEV2ZXJ5IHN0b3JlZCB0aW1lc3RhbXAgc3RheXMgVVRDLiBUaGUgem9uZSBpcyBhcHBsaWVkIG9ubHkgdG8gZGVyaXZlIGFcbiAqIGRlYWRsaW5lLlxuICpcbiAqIEhvbGlkYXlzIGFyZSBhbiBleHBsaWNpdCBvcGVyYXRvci1tYWludGFpbmVkIGxpc3QgcmF0aGVyIHRoYW4gYSBsaWJyYXJ5OiBhXG4gKiBsaWJyYXJ5IHB1bGxzIGJvdGggYSBkZXBlbmRlbmN5IGFuZCBhIGhvbGlkYXkgUE9MSUNZIHRoYXQgY2Fubm90IGJlIGV4cGxhaW5lZFxuICogdG8gYSBjdXN0b21lciBkaXNwdXRpbmcgYSBkZWFkbGluZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJ1c2luZXNzQ2FsZW5kYXIoKTogQnVzaW5lc3NDYWxlbmRhciB7XG4gIGNvbnN0IGNvbmZpZ3VyZWQgPSBlbnZTdHIoJ1NVUFBPUlRfQlVTSU5FU1NfSE9VUlNfVFonLCAnQW1lcmljYS9OZXdfWW9yaycpO1xuICBsZXQgdGltZVpvbmUgPSBjb25maWd1cmVkO1xuICB0cnkge1xuICAgIG5ldyBJbnRsLkRhdGVUaW1lRm9ybWF0KCdlbi1DQScsIHsgdGltZVpvbmU6IGNvbmZpZ3VyZWQgfSkuZm9ybWF0KG5ldyBEYXRlKCkpO1xuICB9IGNhdGNoIHtcbiAgICB0aW1lWm9uZSA9ICdVVEMnO1xuICB9XG4gIHJldHVybiB7XG4gICAgdGltZVpvbmUsXG4gICAgZGF5czogcGFyc2VEYXlzKGVudlN0cignU1VQUE9SVF9CVVNJTkVTU19IT1VSU19EQVlTJywgJzEsMiwzLDQsNScpKSxcbiAgICBlbmRIb3VyOiBlbnZJbnQoJ1NVUFBPUlRfQlVTSU5FU1NfSE9VUlNfRU5EX0hPVVInLCAxNywgeyBtaW46IDAsIG1heDogMjMgfSksXG4gICAgaG9saWRheXM6IHBhcnNlSG9saWRheXMoZW52U3RyKCdTVVBQT1JUX0JVU0lORVNTX0hPVVJTX0hPTElEQVlTJywgJycpKSxcbiAgfTtcbn1cbiJdfQ==

package/lib/middleware/auth.js

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import jwt from 'jsonwebtoken';
 import { refuseForAssurance } from './assurance.js';
+import { runDeferredQuotaCheck } from './deferred-quota-check.js';
 import { hasValidIdentityClaims, verifyBearerToken } from './jwt-verify.js';
 import { recordAuthzDenial } from './permission-gates.js';
 import { checkRevocation, isImpersonationWriteBlocked, needsRevocationCheck } from './revocation.js';
@@ -170,11 +171,13 @@ async function verifyAndAttach(options, rawToken, req, res, next) {
             checkRevocation(decoded).then((refusal) => {
                 if (refusal)
                     return sendError(res, HttpStatus.UNAUTHORIZED, refusal, ErrorCode.TOKEN_REVOKED);
-                next();
+                runDeferredQuotaCheck(req, res, next);
             }).catch(next);
             return;
         }
-        next();
+        // The apiCalls check a mount armed (api-server `apiCallsQuota`) runs here,
+        // now that tenancy is JWT-authoritative; a plain next() where none was armed.
+        runDeferredQuotaCheck(req, res, next);
     }
     catch (error) {
         if (error instanceof jwt.TokenExpiredError) {
@@ -196,4 +199,4 @@ async function verifyAndAttach(options, rawToken, req, res, next) {
         return sendError(res, HttpStatus.UNAUTHORIZED, 'Authentication failed', ErrorCode.UNAUTHORIZED);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9taWRkbGV3YXJlL2F1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQVF0QyxPQUFPLEdBQUcsTUFBTSxjQUFjLENBQUM7QUFDL0IsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxFQUFFLHNCQUFzQixFQUFFLGlCQUFpQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDNUUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDMUQsT0FBTyxFQUFFLGVBQWUsRUFBRSwyQkFBMkIsRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQ3JHLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNoRCxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsYUFBYSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDMUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQ3pELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxlQUFlLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUNsRixPQUFPLEVBQUUsZUFBZSxFQUFFLGVBQWUsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQy9FLE9BQU8sRUFBdUIsTUFBTSxvQkFBb0IsQ0FBQztBQUN6RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFFcEQsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3JELE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RCxPQUFPLEVBQUUsV0FBVyxFQUF3QixNQUFNLHNCQUFzQixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFDekQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBRWpELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0FBb0QvQyxNQUFNLFVBQVUsV0FBVyxDQUN6QixZQUEyQyxFQUMzQyxHQUFjLEVBQ2QsSUFBbUI7SUFFbkIsSUFBSSxZQUFZLElBQUksR0FBRyxJQUFJLElBQUksSUFBSSxTQUFTLElBQUksWUFBWSxFQUFFLENBQUM7UUFDN0QsT0FBTyxZQUFZLENBQUMsRUFBRSxFQUFFLFlBQXVCLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBSSxZQUFtQyxJQUFJLEVBQUUsQ0FBQztJQUMzRCxNQUFNLElBQUksR0FBRyxZQUFZLENBQUMsQ0FBQyxHQUFZLEVBQUUsUUFBa0IsRUFBRSxTQUF1QixFQUFFLEVBQUU7UUFDdEYsWUFBWSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQ2xELENBQUMsRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3JCLElBQUksT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3pCLFlBQVksQ0FBQyxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDckosQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQztBQUNELFlBQVksQ0FBQyxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUU1QyxTQUFTLFlBQVksQ0FDbkIsT0FBMkIsRUFDM0IsR0FBWSxFQUNaLEdBQWEsRUFDYixJQUFrQjtJQUVsQixNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQztJQUU3QyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDaEIsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsK0JBQStCLEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzNHLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2hELE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLG1EQUFtRCxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQseUVBQXlFO0lBQ3pFLHVFQUF1RTtJQUN2RSw0RUFBNEU7SUFDNUUsK0RBQStEO0lBQy9ELGtDQUFrQztJQUNsQyxJQUFJLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdCLEtBQUssYUFBYSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUN0RCxPQUFPO0lBQ1QsQ0FBQztJQUVELDBFQUEwRTtJQUMxRSwwRUFBMEU7SUFDMUUsZ0NBQWdDO0lBQ2hDLEtBQUssZUFBZSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDdEUsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxLQUFLLFVBQVUsYUFBYSxDQUMxQixPQUEyQixFQUMzQixHQUFXLEVBQ1gsR0FBWSxFQUNaLEdBQWEsRUFDYixJQUFrQjtJQUVsQiw0RUFBNEU7SUFDNUUsMEVBQTBFO0lBQzFFLDhFQUE4RTtJQUM5RSxxRUFBcUU7SUFDckUsTUFBTSxFQUFFLGNBQWMsRUFBRSw4QkFBOEIsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLGlDQUFpQyxDQUFDLENBQUM7SUFDM0csSUFBSSxLQUFhLENBQUM7SUFDbEIsSUFBSSxDQUFDO1FBQ0gsS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksOEJBQThCLEVBQUUsQ0FBQztZQUNwRCxPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLG1CQUFtQixFQUNuQyxrRUFBa0UsRUFDbEUsU0FBUyxDQUFDLG1CQUFtQixDQUM5QixDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLCtCQUErQixFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRyxDQUFDO0lBQ0QsTUFBTSxlQUFlLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRCxLQUFLLFVBQVUsZUFBZSxDQUM1QixPQUEyQixFQUMzQixRQUFnQixFQUNoQixHQUFZLEVBQ1osR0FBYSxFQUNiLElBQWtCO0lBRWxCLElBQUksQ0FBQztRQUNILDJFQUEyRTtRQUMzRSwwRUFBMEU7UUFDMUUsNEVBQTRFO1FBQzVFLGlFQUFpRTtRQUNqRSw0RUFBNEU7UUFDNUUsV0FBVztRQUNYLE1BQU0sT0FBTyxHQUFHLE1BQU0saUJBQWlCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFbEQsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzlCLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLGlEQUFpRCxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM3SCxDQUFDO1FBRUQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxJQUFJLENBQUMsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUN0RSxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSwrQkFBK0IsRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0csQ0FBQztRQUVELDBFQUEwRTtRQUMxRSxxRUFBcUU7UUFDckUsdUVBQXVFO1FBQ3ZFLHFIQUFxSDtRQUNySCwyRUFBMkU7UUFDM0UsSUFBSSxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ2xDLFdBQVcsQ0FBQyw0QkFBNEIsRUFBRSxFQUFFLE9BQU8sRUFBRSxhQUFhLENBQUMsT0FBTyxDQUFDLElBQUksU0FBUyxFQUFFLENBQUMsQ0FBQztZQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZFLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLHVCQUF1QixFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNuRyxDQUFDO1FBRUQsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEdBQUcsT0FBTyxFQUFFLENBQUM7UUFFMUIsNkVBQTZFO1FBQzdFLDJFQUEyRTtRQUMzRSx5RUFBeUU7UUFDekUsc0VBQXNFO1FBQ3RFLElBQUksMkJBQTJCLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3JELElBQUksR0FBRyxDQUFDLE1BQU07Z0JBQUUsaUJBQWlCLENBQUMsR0FBRyxFQUFFLHlCQUF5QixDQUFDLENBQUM7WUFDbEUsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLGlHQUFpRyxFQUNqRyxTQUFTLENBQUMsdUJBQXVCLENBQ2xDLENBQUM7UUFDSixDQUFDO1FBRUQsNERBQTREO1FBQzVELDJFQUEyRTtRQUMzRSwyRUFBMkU7UUFDM0UsNkVBQTZFO1FBQzdFLDRFQUE0RTtRQUM1RSxxRUFBcUU7UUFDckUsNkJBQTZCO1FBQzdCLElBQUksT0FBTyxDQUFDLG9CQUFvQixLQUFLLElBQUksRUFBRSxDQUFDO1lBQzFDLFdBQVcsQ0FBQywrQkFBK0IsRUFBRSxFQUFFLE9BQU8sRUFBRSxlQUFlLEVBQUUsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQyxDQUFDO1lBQzFHLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxlQUFlLENBQUMsQ0FBQztZQUN4QyxPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLFNBQVMsRUFDekIsdUZBQXVGLEVBQ3ZGLFNBQVMsQ0FBQyx1QkFBdUIsQ0FDbEMsQ0FBQztRQUNKLENBQUM7UUFFRCxxRUFBcUU7UUFDckUsSUFBSSxPQUFPLENBQUMsWUFBWTtlQUNuQixrQkFBa0IsQ0FBQyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDO1lBQUUsT0FBTztRQUVoSyx3RUFBd0U7UUFDeEUsOEVBQThFO1FBQzlFLDhFQUE4RTtRQUM5RSw4RUFBOEU7UUFDOUUsNEVBQTRFO1FBQzVFLElBQUksT0FBTyxDQUFDLHNCQUFzQixJQUFJLE9BQU8sQ0FBQyxZQUFZLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEUsTUFBTSxXQUFXLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztZQUM3RCxNQUFNLGFBQWEsR0FBRyxlQUFlLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1lBQ2pFLElBQUksV0FBVztnQkFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsR0FBRyxXQUFXLENBQUM7WUFDdkQsSUFBSSxhQUFhO2dCQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsYUFBYSxDQUFDO1FBQy9ELENBQUM7UUFFRCxxRUFBcUU7UUFDckUsRUFBRTtRQUNGLDJFQUEyRTtRQUMzRSw0RUFBNEU7UUFDNUUsd0VBQXdFO1FBQ3hFLDJFQUEyRTtRQUMzRSwrRUFBK0U7UUFDL0UsNkVBQTZFO1FBQzdFLDRFQUE0RTtRQUM1RSw4RUFBOEU7UUFDOUUsOEVBQThFO1FBQzlFLDJFQUEyRTtRQUMzRSwwRUFBMEU7UUFDMUUsb0VBQW9FO1FBQ3BFLE1BQU0sTUFBTSxHQUFJLEdBQTZELENBQUMsT0FBTyxDQUFDO1FBQ3RGLElBQUksTUFBTSxFQUFFLENBQUM7WUFDWCxNQUFNLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxHQUE2QixDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUVELG9FQUFvRTtRQUNwRSw0RUFBNEU7UUFDNUUsSUFBSSxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ2xDLDBFQUEwRTtZQUMxRSwwRUFBMEU7WUFDMUUsNkRBQTZEO1lBQzdELGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRTtnQkFDeEMsSUFBSSxPQUFPO29CQUFFLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLE9BQU8sRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQzlGLElBQUksRUFBRSxDQUFDO1lBQ1QsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ2YsT0FBTztRQUNULENBQUM7UUFFRCxJQUFJLEVBQUUsQ0FBQztJQUNULENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksR0FBRyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDM0MsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsbUJBQW1CLEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFFRCw0RUFBNEU7UUFDNUUsd0VBQXdFO1FBQ3hFLHlFQUF5RTtRQUN6RSw0RUFBNEU7UUFDNUUsMEVBQTBFO1FBQzFFLG9FQUFvRTtRQUNwRSxJQUFJLEtBQUssWUFBWSxvQkFBb0IsSUFBSSxLQUFLLFlBQVksZUFBZSxFQUFFLENBQUM7WUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMzRixPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLG1CQUFtQixFQUNuQyw2REFBNkQsRUFDN0QsU0FBUyxDQUFDLG1CQUFtQixDQUM5QixDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksS0FBSyxZQUFZLGVBQWUsSUFBSSxLQUFLLFlBQVksR0FBRyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDL0UsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsZUFBZSxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsdUJBQXVCLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ2xHLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogYHJlcXVpcmVBdXRoYDogYmVhcmVyIC8gYWNjZXNzLWtleSBhdXRoZW50aWNhdGlvbiwgdGhlIGNoZWNrcyBldmVyeVxuICogdmVyaWZpZWQgcmVxdWVzdCBwYXNzZXMsIGFuZCB0aGUgdGVuYW50IGlkZW50aXR5IGl0IGF0dGFjaGVzLlxuICovXG5cbmltcG9ydCB0eXBlIHsgUmVxdWVzdCwgUmVzcG9uc2UsIE5leHRGdW5jdGlvbiB9IGZyb20gJ2V4cHJlc3MnO1xuaW1wb3J0IGp3dCBmcm9tICdqc29ud2VidG9rZW4nO1xuaW1wb3J0IHsgcmVmdXNlRm9yQXNzdXJhbmNlIH0gZnJvbSAnLi9hc3N1cmFuY2UuanMnO1xuaW1wb3J0IHsgaGFzVmFsaWRJZGVudGl0eUNsYWltcywgdmVyaWZ5QmVhcmVyVG9rZW4gfSBmcm9tICcuL2p3dC12ZXJpZnkuanMnO1xuaW1wb3J0IHsgcmVjb3JkQXV0aHpEZW5pYWwgfSBmcm9tICcuL3Blcm1pc3Npb24tZ2F0ZXMuanMnO1xuaW1wb3J0IHsgY2hlY2tSZXZvY2F0aW9uLCBpc0ltcGVyc29uYXRpb25Xcml0ZUJsb2NrZWQsIG5lZWRzUmV2b2NhdGlvbkNoZWNrIH0gZnJvbSAnLi9yZXZvY2F0aW9uLmpzJztcbmltcG9ydCB7IHRhZ1JvdXRlR2F0ZSB9IGZyb20gJy4vcm91dGUtdGFibGUuanMnO1xuaW1wb3J0IHsgaXNTZXJ2aWNlVG9rZW5EZW5pZWQsIHNlcnZpY2VOYW1lT2YgfSBmcm9tICcuL3NlcnZpY2UtdG9rZW5zLmpzJztcbmltcG9ydCB7IEh0dHBTdGF0dXMgfSBmcm9tICcuLi9jb25zdGFudHMvaHR0cC1zdGF0dXMuanMnO1xuaW1wb3J0IHsgSndrc1VuYXZhaWxhYmxlRXJyb3IsIFVua25vd25LaWRFcnJvciB9IGZyb20gJy4uL3NlcnZpY2VzL2p3a3MtY2FjaGUuanMnO1xuaW1wb3J0IHsgU2VydmljZUtleUVycm9yLCBzZXJ2aWNlSWRlbnRpdHkgfSBmcm9tICcuLi9zZXJ2aWNlcy9zZXJ2aWNlLWtleXMuanMnO1xuaW1wb3J0IHsgdHlwZSBBc3N1cmFuY2VMZXZlbCB9IGZyb20gJy4uL3R5cGVzL2NvbW1vbi5qcyc7XG5pbXBvcnQgeyBFcnJvckNvZGUgfSBmcm9tICcuLi90eXBlcy9lcnJvci1jb2Rlcy5qcyc7XG5pbXBvcnQgdHlwZSB7IEh0dHBSZXF1ZXN0IH0gZnJvbSAnLi4vdHlwZXMvaHR0cC5qcyc7XG5pbXBvcnQgeyBpc09wYXF1ZUFwaUtleSB9IGZyb20gJy4uL3V0aWxzL2FwaS1rZXkuanMnO1xuaW1wb3J0IHsgZ2V0SGVhZGVyU3RyaW5nIH0gZnJvbSAnLi4vdXRpbHMvaGVhZGVycy5qcyc7XG5pbXBvcnQgeyBnZXRJZGVudGl0eSwgdHlwZSBSZXF1ZXN0SWRlbnRpdHkgfSBmcm9tICcuLi91dGlscy9pZGVudGl0eS5qcyc7XG5pbXBvcnQgeyBjcmVhdGVMb2dnZXIgfSBmcm9tICcuLi91dGlscy9sb2dnZXIuanMnO1xuaW1wb3J0IHsgZW1pdENvdW50ZXIgfSBmcm9tICcuLi91dGlscy9tZXRyaWMtZW1pdHRlci5qcyc7XG5pbXBvcnQgeyBzZW5kRXJyb3IgfSBmcm9tICcuLi91dGlscy9yZXNwb25zZS5qcyc7XG5cbmNvbnN0IGxvZ2dlciA9IGNyZWF0ZUxvZ2dlcignYXV0aC1taWRkbGV3YXJlJyk7XG5leHBvcnQgaW50ZXJmYWNlIFJlcXVpcmVBdXRoT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBBbGxvdyB4LW9yZy1pZC94LW9yZy1uYW1lIGhlYWRlcnMgdG8gb3ZlcnJpZGUgdGhlIEpXVCdzIG9yZ2FuaXphdGlvbiBmaWVsZHMuXG4gICAqXG4gICAqIFdoZW4gZW5hYmxlZCwgdGhlIGB4LW9yZy1pZGAvYHgtb3JnLW5hbWVgIGhlYWRlcnMgb3ZlcnJpZGUgdGhlIGNhbGxlcidzIG9yZ1xuICAgKiDigJQgYnV0IE9OTFkgZm9yIGEgdmVyaWZpZWQgU1lTLUFETUlOIChgaXNTdXBlckFkbWluYCBjbGFpbSkuIEZvciBhbnkgb3JkaW5hcnlcbiAgICogYXV0aGVudGljYXRlZCB1c2VyIHRoZSBoZWFkZXJzIGFyZSBpZ25vcmVkLCBzbyBlbmFibGluZyB0aGlzIGNhbiBuZXZlciBsZXQgYVxuICAgKiBub3JtYWwgdXNlciBpbXBlcnNvbmF0ZSBhbm90aGVyIHRlbmFudCdzIG9yZy4gVXNlIGZvciBjcm9zcy1vcmcgYWRtaW4gdG9vbGluZ1xuICAgKiAoZS5nLiBhIHN5c2FkbWluIG1hbmFnaW5nIGEgZ2l2ZW4gb3JnJ3MgYmlsbGluZykuIElmIHVuc3VyZSwgbGVhdmUgaXQgZGlzYWJsZWQuXG4gICAqL1xuICBhbGxvd09yZ0hlYWRlck92ZXJyaWRlPzogYm9vbGVhbjtcbiAgLyoqXG4gICAqIERlbWFuZCB0aGF0IHRoZSB3aG9sZSBTRVNTSU9OIGJlIGF0IGxlYXN0IHRoaXMgYXNzdXJhbmNlIGxldmVsLlxuICAgKlxuICAgKiBgbWluQXNzdXJhbmNlOiAyYCBtZWFucyB0aGUgcGVyc29uIGF1dGhlbnRpY2F0ZWQgd2l0aCBhIHNlY29uZCBmYWN0b3Ig4oCUIGFcbiAgICogcGFzc2tleSB3aXRoIHVzZXIgdmVyaWZpY2F0aW9uLCBhIHBhc3N3b3JkIHBsdXMgYW4gYXV0aGVudGljYXRvciBjb2RlLCBvclxuICAgKiBTU08gdGhyb3VnaCBhbiBJZFAgdGhlIG9yZyBtYXJrZWQgYXMgZW5mb3JjaW5nIE1GQS4gQSB3ZWFrZXIgdG9rZW4gZ2V0c1xuICAgKiAqKjQwMSBgTUZBX1JFUVVJUkVEYCoqLCB3aGljaCB0aGUgY2xpZW50IGFuc3dlcnMgYnkgc2VuZGluZyB0aGUgcGVyc29uIHRvXG4gICAqIGVucm9sbWVudCBvciB0byBhIHN0cm9uZ2VyIHNpZ24taW47IHJlZnJlc2hpbmcgY2Fubm90IGhlbHAsIGJlY2F1c2UgYGFhbGBcbiAgICogbGl2ZXMgb24gdGhlIHNlc3Npb24gc2xvdCBhbmQgYSByZWZyZXNoIG5ldmVyIHJhaXNlcyBpdC5cbiAgICpcbiAgICogVGhpcyBpcyB0aGUgU0VTU0lPTi1sZXZlbCBjb3VudGVycGFydCB0byB7QGxpbmsgcmVxdWlyZVN0ZXBVcH0sIHdoaWNoIHN0YXlzXG4gICAqIGEgZnJlc2gsIHBlci1hY3Rpb24gY29uZmlybWF0aW9uLiBVc2UgYm90aCBvbiB0aGUgbW9zdCBkYW5nZXJvdXMgcm91dGVzLlxuICAgKlxuICAgKiBNQUNISU5FUyBORVZFUiBTQVRJU0ZZIElULiBBIHNlcnZpY2UgcHJpbmNpcGFsLCBhbiBvcmcgc2VydmljZSBhY2NvdW50IGFuZFxuICAgKiBhbiBleGNoYW5nZWQgYWNjZXNzIGtleSBhbGwgZ2V0ICoqNDAzIGBIVU1BTl9TRVNTSU9OX1JFUVVJUkVEYCoqIOKAlCB0aGVyZSBpc1xuICAgKiBubyBwZXJzb24gYmVoaW5kIHRoZW0gdG8gaGF2ZSBwcmVzZW50ZWQgYSBmYWN0b3IsIHNvIFwiYXNzdXJhbmNlXCIgaXMgbm90IGFcbiAgICogcXVlc3Rpb24gdGhlaXIgY3JlZGVudGlhbCBjYW4gYW5zd2VyLiBUaGF0IGlzIGRlbGliZXJhdGVseSBub3QgYSBzaWxlbnRcbiAgICogcGFzcy10aHJvdWdoIGZvciBpbnRlcm5hbCBzZXJ2aWNlczogYSByb3V0ZSB0aGF0IGRlbWFuZHMgTUZBIGlzIGEgcm91dGUgYVxuICAgKiBodW1hbiBpcyBkb2luZyBzb21ldGhpbmcgZGFuZ2Vyb3VzIG9uLlxuICAgKi9cbiAgbWluQXNzdXJhbmNlPzogQXNzdXJhbmNlTGV2ZWw7XG4gIC8qKlxuICAgKiBXaXRoIHtAbGluayBtaW5Bc3N1cmFuY2V9LCBhZGRpdGlvbmFsbHkgYm91bmQgaG93IGxvbmcgYWdvIHRoYXQgc2lnbi1pblxuICAgKiBoYXBwZW5lZCAoc2Vjb25kcywgY29tcGFyZWQgYWdhaW5zdCB0aGUgdG9rZW4ncyBgYXV0aF90aW1lYCkuIEEgc2Vzc2lvbiB0aGF0XG4gICAqIGlzIE1GQS1ncmFkZSBidXQgb2xkZXIgdGhhbiB0aGlzIGdldHMgKio0MDEgYFJFQVVUSF9SRVFVSVJFRGAqKi4gSWdub3JlZFxuICAgKiB3aXRob3V0IGBtaW5Bc3N1cmFuY2VgIOKAlCBcImhvdyByZWNlbnRcIiBpcyBvbmx5IG1lYW5pbmdmdWwgb25jZSBcImhvdyBzdHJvbmdcIlxuICAgKiBpcyBiZWluZyBhc2tlZC5cbiAgICovXG4gIG1heEFnZT86IG51bWJlcjtcbn1cblxuLyoqIEpXVCBhdXRoIG1pZGRsZXdhcmUuIFVzZSBkaXJlY3RseSBvciBjYWxsIHdpdGggb3B0aW9ucy4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXF1aXJlQXV0aChcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBuZXh0OiBOZXh0RnVuY3Rpb24sXG4pOiB2b2lkO1xuZXhwb3J0IGZ1bmN0aW9uIHJlcXVpcmVBdXRoKFxuICBvcHRpb25zPzogUmVxdWlyZUF1dGhPcHRpb25zLFxuKTogKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSwgbmV4dDogTmV4dEZ1bmN0aW9uKSA9PiB2b2lkO1xuZXhwb3J0IGZ1bmN0aW9uIHJlcXVpcmVBdXRoKFxuICByZXFPck9wdGlvbnM/OiBSZXF1ZXN0IHwgUmVxdWlyZUF1dGhPcHRpb25zLFxuICByZXM/OiBSZXNwb25zZSxcbiAgbmV4dD86IE5leHRGdW5jdGlvbixcbik6IHZvaWQgfCAoKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSwgbmV4dDogTmV4dEZ1bmN0aW9uKSA9PiB2b2lkKSB7XG4gIGlmIChyZXFPck9wdGlvbnMgJiYgcmVzICYmIG5leHQgJiYgJ2hlYWRlcnMnIGluIHJlcU9yT3B0aW9ucykge1xuICAgIHJldHVybiBfcmVxdWlyZUF1dGgoe30sIHJlcU9yT3B0aW9ucyBhcyBSZXF1ZXN0LCByZXMsIG5leHQpO1xuICB9XG5cbiAgY29uc3Qgb3B0aW9ucyA9IChyZXFPck9wdGlvbnMgYXMgUmVxdWlyZUF1dGhPcHRpb25zKSB8fCB7fTtcbiAgY29uc3QgZ2F0ZSA9IHRhZ1JvdXRlR2F0ZSgocmVxOiBSZXF1ZXN0LCByZXNJbm5lcjogUmVzcG9uc2UsIG5leHRJbm5lcjogTmV4dEZ1bmN0aW9uKSA9PiB7XG4gICAgX3JlcXVpcmVBdXRoKG9wdGlvbnMsIHJlcSwgcmVzSW5uZXIsIG5leHRJbm5lcik7XG4gIH0sIHsga2luZDogJ2F1dGgnIH0pO1xuICBpZiAob3B0aW9ucy5taW5Bc3N1cmFuY2UpIHtcbiAgICB0YWdSb3V0ZUdhdGUoZ2F0ZSwgeyBraW5kOiAnYXNzdXJhbmNlJywgbWluQXNzdXJhbmNlOiBvcHRpb25zLm1pbkFzc3VyYW5jZSwgLi4uKG9wdGlvbnMubWF4QWdlICE9PSB1bmRlZmluZWQgPyB7IG1heEFnZTogb3B0aW9ucy5tYXhBZ2UgfSA6IHt9KSB9KTtcbiAgfVxuICByZXR1cm4gZ2F0ZTtcbn1cbnRhZ1JvdXRlR2F0ZShyZXF1aXJlQXV0aCwgeyBraW5kOiAnYXV0aCcgfSk7XG5cbmZ1bmN0aW9uIF9yZXF1aXJlQXV0aChcbiAgb3B0aW9uczogUmVxdWlyZUF1dGhPcHRpb25zLFxuICByZXE6IFJlcXVlc3QsXG4gIHJlczogUmVzcG9uc2UsXG4gIG5leHQ6IE5leHRGdW5jdGlvbixcbik6IHZvaWQge1xuICBjb25zdCBhdXRoSGVhZGVyID0gcmVxLmhlYWRlcnMuYXV0aG9yaXphdGlvbjtcblxuICBpZiAoIWF1dGhIZWFkZXIpIHtcbiAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdBdXRob3JpemF0aW9uIGhlYWRlciByZXF1aXJlZCcsIEVycm9yQ29kZS5UT0tFTl9NSVNTSU5HKTtcbiAgfVxuXG4gIGNvbnN0IHBhcnRzID0gYXV0aEhlYWRlci5zcGxpdCgnICcpO1xuICBpZiAocGFydHMubGVuZ3RoICE9PSAyIHx8IHBhcnRzWzBdICE9PSAnQmVhcmVyJykge1xuICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ0ludmFsaWQgYXV0aG9yaXphdGlvbiBmb3JtYXQuIFVzZTogQmVhcmVyIDx0b2tlbj4nLCBFcnJvckNvZGUuVE9LRU5fSU5WQUxJRCk7XG4gIH1cblxuICAvLyBBbiBPUEFRVUUgQUNDRVNTIEtFWSAoYHBiX3BhdF/igKZgIC8gYHBiX3NhX+KApmApIGNhcnJpZXMgbm8gY2xhaW1zIGFuZCBub1xuICAvLyBzaWduYXR1cmUsIHNvIGl0IGNhbm5vdCBiZSB2ZXJpZmllZCBoZXJlLiBUcmFkZSBpdCBhdCBwbGF0Zm9ybSBmb3IgYVxuICAvLyBzaG9ydC1saXZlZCBKV1QgKGNhY2hlZCBpbi1wcm9jZXNzIHVudGlsIGl0IGV4cGlyZXMpIGFuZCB0aGVuIHZlcmlmeSB0aGF0XG4gIC8vIEpXVCBvbiB0aGUgbm9ybWFsIHBhdGgg4oCUIHNlcnZpY2VzIG5ldmVyIHJlYWQgYSBrZXkgaGFzaC4gU2VlXG4gIC8vIGBzZXJ2aWNlcy9hcGkta2V5LWV4Y2hhbmdlLnRzYC5cbiAgaWYgKGlzT3BhcXVlQXBpS2V5KHBhcnRzWzFdKSkge1xuICAgIHZvaWQgcmVzb2x2ZUFwaUtleShvcHRpb25zLCBwYXJ0c1sxXSwgcmVxLCByZXMsIG5leHQpO1xuICAgIHJldHVybjtcbiAgfVxuXG4gIC8vIGAuY2F0Y2gobmV4dClgIGZvcndhcmRzIGEgRE9XTlNUUkVBTSBzeW5jaHJvbm91cyB0aHJvdyBmcm9tIGBuZXh0KClgIHRvXG4gIC8vIEV4cHJlc3MncyBlcnJvciBtaWRkbGV3YXJlIOKAlCB2ZXJpZmljYXRpb24gaXRzZWxmIG5ldmVyIHJlamVjdHMgKGl0IG1hcHNcbiAgLy8gZXZlcnkgZmFpbHVyZSB0byBhIHJlc3BvbnNlKS5cbiAgdm9pZCB2ZXJpZnlBbmRBdHRhY2gob3B0aW9ucywgcGFydHNbMV0sIHJlcSwgcmVzLCBuZXh0KS5jYXRjaChuZXh0KTtcbn1cblxuLyoqXG4gKiBFeGNoYW5nZSBhbiBvcGFxdWUga2V5IGZvciBhIEpXVCwgdGhlbiBjb250aW51ZSBvbiB0aGUgbm9ybWFsIHZlcmlmaWNhdGlvblxuICogcGF0aC4gQSByZWZ1c2VkIGtleSBpcyBhIDQwMTsgYW4gdW5yZWFjaGFibGUgcGxhdGZvcm0gaXMgYSA1MDMgKG5ldmVyIGEgcGFzcyDigJRcbiAqIGFuIHVudmVyaWZpYWJsZSBjcmVkZW50aWFsIGlzIG5vdCBhbiBpZGVudGl0eSkuXG4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlc29sdmVBcGlLZXkoXG4gIG9wdGlvbnM6IFJlcXVpcmVBdXRoT3B0aW9ucyxcbiAga2V5OiBzdHJpbmcsXG4gIHJlcTogUmVxdWVzdCxcbiAgcmVzOiBSZXNwb25zZSxcbiAgbmV4dDogTmV4dEZ1bmN0aW9uLFxuKTogUHJvbWlzZTx2b2lkPiB7XG4gIC8vIExvYWRlZCBMQVpJTFksIG9uIHRoZSBmaXJzdCBrZXkgZXZlciBwcmVzZW50ZWQuIEEgc3RhdGljIGltcG9ydCB3b3VsZCBwdXRcbiAgLy8gdGhlIEhUVFAgY2xpZW50IChhbmQgcGxhdGZvcm0ncyBhZGRyZXNzKSBpbnRvIHRoZSBpbXBvcnQgZ3JhcGggb2YgZXZlcnlcbiAgLy8gbW9kdWxlIHRoYXQgbWVyZWx5IHVzZXMgYHJlcXVpcmVBdXRoYCwgd2hpY2ggYm90aCB3aWRlbnMgdGhlIGJvb3QgZ3JhcGggYW5kXG4gIC8vIGJyZWFrcyBhbnkgdGVzdCB0aGF0IG1vY2tzIGBodHRwLWNsaWVudC5qc2Agd2l0aCBhIHBhcnRpYWwgbW9kdWxlLlxuICBjb25zdCB7IGV4Y2hhbmdlQXBpS2V5LCBBcGlLZXlFeGNoYW5nZVVuYXZhaWxhYmxlRXJyb3IgfSA9IGF3YWl0IGltcG9ydCgnLi4vc2VydmljZXMvYXBpLWtleS1leGNoYW5nZS5qcycpO1xuICBsZXQgdG9rZW46IHN0cmluZztcbiAgdHJ5IHtcbiAgICB0b2tlbiA9IGF3YWl0IGV4Y2hhbmdlQXBpS2V5KGtleSk7XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgaWYgKGVycm9yIGluc3RhbmNlb2YgQXBpS2V5RXhjaGFuZ2VVbmF2YWlsYWJsZUVycm9yKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKFxuICAgICAgICByZXMsIEh0dHBTdGF0dXMuU0VSVklDRV9VTkFWQUlMQUJMRSxcbiAgICAgICAgJ0FjY2Vzcy1rZXkgdmVyaWZpY2F0aW9uIGlzIHRlbXBvcmFyaWx5IHVuYXZhaWxhYmxlOyBwbGVhc2UgcmV0cnknLFxuICAgICAgICBFcnJvckNvZGUuU0VSVklDRV9VTkFWQUlMQUJMRSxcbiAgICAgICk7XG4gICAgfVxuICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ0ludmFsaWQgb3IgcmV2b2tlZCBhY2Nlc3Mga2V5JywgRXJyb3JDb2RlLlRPS0VOX0lOVkFMSUQpO1xuICB9XG4gIGF3YWl0IHZlcmlmeUFuZEF0dGFjaChvcHRpb25zLCB0b2tlbiwgcmVxLCByZXMsIG5leHQpO1xufVxuXG5hc3luYyBmdW5jdGlvbiB2ZXJpZnlBbmRBdHRhY2goXG4gIG9wdGlvbnM6IFJlcXVpcmVBdXRoT3B0aW9ucyxcbiAgcmF3VG9rZW46IHN0cmluZyxcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBuZXh0OiBOZXh0RnVuY3Rpb24sXG4pOiBQcm9taXNlPHZvaWQ+IHtcbiAgdHJ5IHtcbiAgICAvLyBUd28gY2hhaW5zLCBvbmUgZW50cnkgcG9pbnQgKHNlZSBgdmVyaWZ5QmVhcmVyVG9rZW5gKTogYSB1c2VyIHRva2VuIG11c3RcbiAgICAvLyBiZSBFUzI1NiBzaWduZWQgYnkgcGxhdGZvcm0gYW5kIHZlcmlmaWVkIGFnYWluc3QgaXRzIHB1Ymxpc2hlZCBKV0tTOyBhblxuICAgIC8vIGludGVybmFsIHNlcnZpY2UgdG9rZW4gbXVzdCBiZSBFUzI1NiBzaWduZWQgYnkgdGhhdCBzZXJ2aWNlJ3MgT1dOIGtleSBhbmRcbiAgICAvLyBkZWNsYXJlIGl0c2VsZiBhIHNlcnZpY2UgcHJpbmNpcGFsLiBCb3RoIHBpbiB0aGUgYWxnb3JpdGhtIChub1xuICAgIC8vIGFsZy1jb25mdXNpb24sIG5vIGBhbGc6bm9uZWApIGFuZCBib3RoIGFwcGx5IHRoZSBvcHRpb25hbCBpc3N1ZXIvYXVkaWVuY2VcbiAgICAvLyBiaW5kaW5nLlxuICAgIGNvbnN0IGRlY29kZWQgPSBhd2FpdCB2ZXJpZnlCZWFyZXJUb2tlbihyYXdUb2tlbik7XG5cbiAgICBpZiAoZGVjb2RlZC50eXBlICE9PSAnYWNjZXNzJykge1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnT25seSBhY2Nlc3MgdG9rZW5zIGNhbiBiZSB1c2VkIGZvciBBUEkgcmVxdWVzdHMnLCBFcnJvckNvZGUuVE9LRU5fSU5WQUxJRCk7XG4gICAgfVxuXG4gICAgaWYgKCFkZWNvZGVkLnN1YiB8fCAhZGVjb2RlZC5yb2xlIHx8ICFoYXNWYWxpZElkZW50aXR5Q2xhaW1zKGRlY29kZWQpKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdUb2tlbiBtaXNzaW5nIHJlcXVpcmVkIGZpZWxkcycsIEVycm9yQ29kZS5UT0tFTl9JTlZBTElEKTtcbiAgICB9XG5cbiAgICAvLyBTZXJ2aWNlLXRva2VuIGtpbGwtc3dpdGNoOiByZWplY3QgYSBzZXJ2aWNlIHByaW5jaXBhbCB3aG9zZSBzZXJ2aWNlIGhhc1xuICAgIC8vIGJlZW4gYWRkZWQgdG8gdGhlIGRlbnlsaXN0LiBPdGhlcndpc2UgdGhlIG9ubHkgd2F5IHRvIGludmFsaWRhdGUgYVxuICAgIC8vIHNlcnZpY2UncyB0b2tlbnMgYmVmb3JlIHRoZWlyIChzaG9ydCkgVFRMIGlzIHJvdGF0aW5nIHRoYXQgc2VydmljZSdzXG4gICAgLy8gc2lnbmluZyBrZXk7IHRoaXMgY3V0cyBvbmUgY29tcHJvbWlzZWQvcm9ndWUgc2VydmljZSBvZmYgaW1tZWRpYXRlbHkuIE8oMSkgU2V0IGxvb2t1cCwgemVybyBjb3N0IHdoZW4gdGhlIGRlbnlsaXN0XG4gICAgLy8gaXMgZW1wdHkgKHRoZSBkZWZhdWx0KSwgc28gaXQgbmV2ZXIgdGF4ZXMgdGhlIFMyUyBob3QgcGF0aCB1bmxlc3MgYXJtZWQuXG4gICAgaWYgKGlzU2VydmljZVRva2VuRGVuaWVkKGRlY29kZWQpKSB7XG4gICAgICBlbWl0Q291bnRlcignc2VydmljZV90b2tlbl9kZW5pZWRfdG90YWwnLCB7IHNlcnZpY2U6IHNlcnZpY2VOYW1lT2YoZGVjb2RlZCkgPz8gJ3Vua25vd24nIH0pO1xuICAgICAgbG9nZ2VyLndhcm4oJ1JlamVjdGVkIGRlbnlsaXN0ZWQgc2VydmljZSB0b2tlbicsIHsgc3ViOiBkZWNvZGVkLnN1YiB9KTtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ1NlcnZpY2UgdG9rZW4gcmV2b2tlZCcsIEVycm9yQ29kZS5UT0tFTl9SRVZPS0VEKTtcbiAgICB9XG5cbiAgICByZXEudXNlciA9IHsgLi4uZGVjb2RlZCB9O1xuXG4gICAgLy8gUkVBRC1PTkxZIElNUEVSU09OQVRJT04uIFRoZSB0b2tlbiBuYW1lcyB0aGUgb3BlcmF0b3IgQU5EIHNheXMgaXQgbWF5IG9ubHlcbiAgICAvLyBsb29rOiBldmVyeSBzZXJ2aWNlIHJlZnVzZXMgYSBzdGF0ZSBjaGFuZ2UgdW5kZXIgaXQsIG5vdCBvbmx5IHBsYXRmb3JtIOKAlFxuICAgIC8vIGEgc3VwcG9ydCBzZXNzaW9uIHRoYXQgY291bGQgd3JpdGUgdG8gcGx1Z2luL2NvbXBsaWFuY2UvYmlsbGluZyBpcyBub3RcbiAgICAvLyByZWFkLW9ubHkuIENoZWNrZWQgYmVmb3JlIGFueSBvdGhlciBnYXRlIHNvIG5vIHJvdXRlIGNhbiBmb3JnZXQgaXQuXG4gICAgaWYgKGlzSW1wZXJzb25hdGlvbldyaXRlQmxvY2tlZChyZXEubWV0aG9kLCBkZWNvZGVkKSkge1xuICAgICAgaWYgKHJlcS5tZXRob2QpIHJlY29yZEF1dGh6RGVuaWFsKHJlcSwgJ2ltcGVyc29uYXRpb24tcmVhZC1vbmx5Jyk7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKFxuICAgICAgICByZXMsIEh0dHBTdGF0dXMuRk9SQklEREVOLFxuICAgICAgICAnV3JpdGUgcmVxdWVzdHMgYXJlIGRpc2FibGVkIGR1cmluZyByZWFkLW9ubHkgaW1wZXJzb25hdGlvbi4gU3RvcCBpbXBlcnNvbmF0aW5nIHRvIG1ha2UgY2hhbmdlcy4nLFxuICAgICAgICBFcnJvckNvZGUuSU1QRVJTT05BVElPTl9SRUFEX09OTFksXG4gICAgICApO1xuICAgIH1cblxuICAgIC8vIEJPT1RTVFJBUC1BRE1JTiBFTlJPTE1FTlQgU0VTU0lPTi4gU3VjaCBhIHRva2VuIGV4aXN0cyBzb1xuICAgIC8vIHRoZSBpbnN0YWxsJ3Mgb25seSBhZG1pbiBjYW4gZW5yb2wgYSBmYWN0b3I7IGl0IGlzIGBhYWw6IDFgIGFuZCBtdXN0IG5vdFxuICAgIC8vIHJlYWNoIGFueXRoaW5nIGVsc2UuIFBsYXRmb3JtIOKAlCB3aGljaCBvd25zIHRoZSBleGNlcHRpb24gYW5kIGtub3dzIHdoaWNoXG4gICAgLy8gb2YgaXRzIG93biByb3V0ZXMgYGluaXQtcGxhdGZvcm0uc2hgIGNhbGxzIOKAlCBhbGxvd3MgYW4gZXhwbGljaXQgZmV3IGJlZm9yZVxuICAgIC8vIHRoaXMgcG9pbnQgKHNlZSBpdHMgb3duIGByZXF1aXJlQXV0aGApOyBpbiBFVkVSWSBvdGhlciBzZXJ2aWNlIHRoZSBhbnN3ZXJcbiAgICAvLyBpcyBzaW1wbHkgbm8sIHNvIHRoZSByZWFjaCByZXN0cmljdGlvbiBob2xkcyB3aXRob3V0IGEgcGVyLXNlcnZpY2VcbiAgICAvLyBhbGxvd2xpc3QgdG8ga2VlcCBpbiBzeW5jLlxuICAgIGlmIChkZWNvZGVkLm1mYUVucm9sbG1lbnRQZW5kaW5nID09PSB0cnVlKSB7XG4gICAgICBlbWl0Q291bnRlcignbWZhX2VuZm9yY2VtZW50X3JlZnVzZWRfdG90YWwnLCB7IHNlcnZpY2U6IHNlcnZpY2VJZGVudGl0eSgpLCByZWFzb246ICdib290c3RyYXBfc2Vzc2lvbicgfSk7XG4gICAgICByZWNvcmRBdXRoekRlbmlhbChyZXEsICdtZmEtZW5yb2xtZW50Jyk7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKFxuICAgICAgICByZXMsIEh0dHBTdGF0dXMuRk9SQklEREVOLFxuICAgICAgICAnRmluaXNoIHNldHRpbmcgdXAgdHdvLWZhY3RvciBhdXRoZW50aWNhdGlvbiBiZWZvcmUgdXNpbmcgdGhlIHJlc3Qgb2YgUGlwZWxpbmUgQnVpbGRlcicsXG4gICAgICAgIEVycm9yQ29kZS5NRkFfRU5ST0xMTUVOVF9SRVFVSVJFRCxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgLy8gU2Vzc2lvbi1sZXZlbCBhc3N1cmFuY2UgKGByZXF1aXJlQXV0aCh7IG1pbkFzc3VyYW5jZSwgbWF4QWdlIH0pYCkuXG4gICAgaWYgKG9wdGlvbnMubWluQXNzdXJhbmNlXG4gICAgICAmJiByZWZ1c2VGb3JBc3N1cmFuY2UoeyBtaW5Bc3N1cmFuY2U6IG9wdGlvbnMubWluQXNzdXJhbmNlLCAuLi4ob3B0aW9ucy5tYXhBZ2UgIT09IHVuZGVmaW5lZCA/IHsgbWF4QWdlOiBvcHRpb25zLm1heEFnZSB9IDoge30pIH0sIGRlY29kZWQsIHJlcSwgcmVzKSkgcmV0dXJuO1xuXG4gICAgLy8gVGhlIHgtb3JnLWlkL3gtb3JnLW5hbWUgb3ZlcnJpZGUgbGV0cyBhIFNZUy1BRE1JTiBhY3Qgb24gYSBjaG9zZW4gb3JnXG4gICAgLy8gKGNyb3NzLW9yZyBhZG1pbiB0b29saW5nKS4gSXQgaXMgZ2F0ZWQgb24gdGhlIHZlcmlmaWVkIGBpc1N1cGVyQWRtaW5gIGNsYWltXG4gICAgLy8gaGVyZSBzbyB0aGF0IGV2ZW4gYSByb3V0ZSB3aGljaCBtaXN0YWtlbmx5IGVuYWJsZXMgYGFsbG93T3JnSGVhZGVyT3ZlcnJpZGVgXG4gICAgLy8gY2FuIE5FVkVSIGxldCBhbiBvcmRpbmFyeSBhdXRoZW50aWNhdGVkIHVzZXIgc3Bvb2YgYW5vdGhlciB0ZW5hbnQncyBvcmcgdmlhXG4gICAgLy8gdGhlIGhlYWRlciDigJQgZGVmZW5jZS1pbi1kZXB0aCBhZ2FpbnN0IHRoZSBjcm9zcy10ZW5hbnQgYnJlYWsgdGhpcyBjYXVzZWQuXG4gICAgaWYgKG9wdGlvbnMuYWxsb3dPcmdIZWFkZXJPdmVycmlkZSAmJiBkZWNvZGVkLmlzU3VwZXJBZG1pbiA9PT0gdHJ1ZSkge1xuICAgICAgY29uc3QgaGVhZGVyT3JnSWQgPSBnZXRIZWFkZXJTdHJpbmcocmVxLmhlYWRlcnNbJ3gtb3JnLWlkJ10pO1xuICAgICAgY29uc3QgaGVhZGVyT3JnTmFtZSA9IGdldEhlYWRlclN0cmluZyhyZXEuaGVhZGVyc1sneC1vcmctbmFtZSddKTtcbiAgICAgIGlmIChoZWFkZXJPcmdJZCkgcmVxLnVzZXIub3JnYW5pemF0aW9uSWQgPSBoZWFkZXJPcmdJZDtcbiAgICAgIGlmIChoZWFkZXJPcmdOYW1lKSByZXEudXNlci5vcmdhbml6YXRpb25OYW1lID0gaGVhZGVyT3JnTmFtZTtcbiAgICB9XG5cbiAgICAvLyBSZS1kZXJpdmUgdGhlIHJlcXVlc3QncyB0ZW5hbnQgaWRlbnRpdHkgZnJvbSB0aGUgTk9XLXZlcmlmaWVkIEpXVC5cbiAgICAvL1xuICAgIC8vIGBhdHRhY2hSZXF1ZXN0Q29udGV4dGAgcnVucyBhcyBhIGdsb2JhbCBtaWRkbGV3YXJlIEJFRk9SRSB0aGlzIHBlci1yb3V0ZVxuICAgIC8vIGByZXF1aXJlQXV0aGAsIHNvIGl0IGNhcHR1cmVkIGByZXEuY29udGV4dC5pZGVudGl0eWAgd2hpbGUgYHJlcS51c2VyYCB3YXNcbiAgICAvLyBzdGlsbCB1bmRlZmluZWQg4oCUIGF0IHdoaWNoIHBvaW50IGBnZXRJZGVudGl0eWAgZmFsbHMgYmFjayB0byB0aGUgcmF3LFxuICAgIC8vIGNsaWVudC1zZXR0YWJsZSBgeC1vcmctaWRgL2B4LXVzZXItaWRgIGhlYWRlcnMuIEV2ZXJ5IGRvd25zdHJlYW0gdGVuYW50LVxuICAgIC8vIGF1dGhvcml0eSBjb25zdW1lciAocmVxdWlyZU9yZ0lkLCB3aXRoVGVuYW50Q29udGV4dCdzIFJMUyBzY29wZSwgY2hlY2tRdW90YSxcbiAgICAvLyB3aXRoUm91dGUsIGFuZCB0aGUgaWRlbXBvdGVuY3kgbmFtZXNwYWNlKSByZWFkcyBgcmVxLmNvbnRleHQuaWRlbnRpdHlgLCBzb1xuICAgIC8vIHRoYXQgZnJvemVuIGhlYWRlci1kZXJpdmVkIHZhbHVlIOKAlCBub3QgdGhlIEpXVCDigJQgd2FzIGdvdmVybmluZyB0ZW5hbmN5IG9uXG4gICAgLy8gYW55IG5vbi1uZ2lueCBwYXRoLiBSZWNvbXB1dGluZyBoZXJlLCBhdCB0aGUgc2luZ2xlIHBvc3QtdmVyaWZpY2F0aW9uIGNob2tlXG4gICAgLy8gcG9pbnQsIG1ha2VzIGBnZXRJZGVudGl0eWAgcHJlZmVyIHRoZSB2ZXJpZmllZCBgcmVxLnVzZXJgIChzZWUgaWRlbnRpdHkudHMpXG4gICAgLy8gc28gdGVuYW5jeSBpcyBKV1QtYXV0aG9yaXRhdGl2ZS4gVGhlIG5naW54IGB4LW9yZy1pZGAgb3ZlcndyaXRlIHN0YXlzIGFzXG4gICAgLy8gZGVmZW5jZS1pbi1kZXB0aC4gR3VhcmRlZCBvbiBgcmVxLmNvbnRleHRgIHNvIHNlcnZpY2VzL3BhdGhzIHRoYXQgbmV2ZXJcbiAgICAvLyBhdHRhY2ggYSBjb250ZXh0IChvciBydW4gcmVxdWlyZUF1dGggcHJlLWNvbnRleHQpIGFyZSB1bmFmZmVjdGVkLlxuICAgIGNvbnN0IHJlcUN0eCA9IChyZXEgYXMgUmVxdWVzdCAmIHsgY29udGV4dD86IHsgaWRlbnRpdHk6IFJlcXVlc3RJZGVudGl0eSB9IH0pLmNvbnRleHQ7XG4gICAgaWYgKHJlcUN0eCkge1xuICAgICAgcmVxQ3R4LmlkZW50aXR5ID0gZ2V0SWRlbnRpdHkocmVxIGFzIHVua25vd24gYXMgSHR0cFJlcXVlc3QpO1xuICAgIH1cblxuICAgIC8vIFNlc3Npb24gaW52YWxpZGF0aW9uICh0b2tlbi12ZXJzaW9uIHN0b3JlICsgaW1wZXJzb25hdGlvbi1zZXNzaW9uXG4gICAgLy8gbGl2ZW5lc3MpLiBObyBzdG9yZSByZWdpc3RlcmVkIOKHkiBvbmx5IGltcGVyc29uYXRpb24gc2Vzc2lvbnMgYXJlIGNoZWNrZWQuXG4gICAgaWYgKG5lZWRzUmV2b2NhdGlvbkNoZWNrKGRlY29kZWQpKSB7XG4gICAgICAvLyBgLmNhdGNoKG5leHQpYCBmb3J3YXJkcyBhIERPV05TVFJFQU0gc3luY2hyb25vdXMgdGhyb3cgZnJvbSBgbmV4dCgpYCB0b1xuICAgICAgLy8gRXhwcmVzcydzIGVycm9yIG1pZGRsZXdhcmUg4oCUIHRoaXMgYG5leHQoKWAgcnVucyBpbiBhIG1pY3JvdGFzaywgb3V0c2lkZVxuICAgICAgLy8gdGhlIHN1cnJvdW5kaW5nIHRyeS9jYXRjaC4gVGhlIGNoZWNrIGl0c2VsZiBuZXZlciByZWplY3RzLlxuICAgICAgY2hlY2tSZXZvY2F0aW9uKGRlY29kZWQpLnRoZW4oKHJlZnVzYWwpID0+IHtcbiAgICAgICAgaWYgKHJlZnVzYWwpIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgcmVmdXNhbCwgRXJyb3JDb2RlLlRPS0VOX1JFVk9LRUQpO1xuICAgICAgICBuZXh0KCk7XG4gICAgICB9KS5jYXRjaChuZXh0KTtcbiAgICAgIHJldHVybjtcbiAgICB9XG5cbiAgICBuZXh0KCk7XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgaWYgKGVycm9yIGluc3RhbmNlb2Ygand0LlRva2VuRXhwaXJlZEVycm9yKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdUb2tlbiBoYXMgZXhwaXJlZCcsIEVycm9yQ29kZS5UT0tFTl9FWFBJUkVEKTtcbiAgICB9XG5cbiAgICAvLyBUaGUgc2lnbmluZyBrZXlzIGNvdWxkbid0IGJlIGZldGNoZWQsIHNvIHRoZSB0b2tlbidzIHZhbGlkaXR5IGlzIFVOS05PV04uXG4gICAgLy8gRmFpbCBDTE9TRUQgd2l0aCBhIHJldHJ5YWJsZSA1MDMg4oCUIG5ldmVyIGEgcGFzcywgYW5kIG5ldmVyIGEgNDAxIHRoYXRcbiAgICAvLyB3b3VsZCBzZW5kIGEgbGVnaXRpbWF0ZSBjbGllbnQgb2ZmIHRvIHJlLWF1dGhlbnRpY2F0ZSBvdmVyIG91ciBvdXRhZ2UuXG4gICAgLy8gU2FtZSByZWFzb25pbmcgZm9yIHRoZSBTRVJWSUNFIGNoYWluOiBubyByZWFkYWJsZSBrZXkgYnVuZGxlIG1lYW5zIG5vIHdheVxuICAgIC8vIHRvIHRlbGwgYSBwZWVyJ3MgdG9rZW4gZnJvbSBhIGZvcmdlcnksIHNvIHRoZSByZXF1ZXN0IGlzIHJlZnVzZWQgd2l0aCBhXG4gICAgLy8gcmV0cnlhYmxlIDUwMyByYXRoZXIgdGhhbiBhZG1pdHRlZCBvciBib3VuY2VkIHRvIHJlLWF1dGhlbnRpY2F0ZS5cbiAgICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBKd2tzVW5hdmFpbGFibGVFcnJvciB8fCBlcnJvciBpbnN0YW5jZW9mIFNlcnZpY2VLZXlFcnJvcikge1xuICAgICAgbG9nZ2VyLndhcm4oJ1JlamVjdGluZyByZXF1ZXN0OiB0b2tlbiBzaWduaW5nIGtleXMgdW5hdmFpbGFibGUnLCB7IGVycm9yOiBlcnJvci5tZXNzYWdlIH0pO1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgICAgcmVzLCBIdHRwU3RhdHVzLlNFUlZJQ0VfVU5BVkFJTEFCTEUsXG4gICAgICAgICdUb2tlbiB2ZXJpZmljYXRpb24gaXMgdGVtcG9yYXJpbHkgdW5hdmFpbGFibGU7IHBsZWFzZSByZXRyeScsXG4gICAgICAgIEVycm9yQ29kZS5TRVJWSUNFX1VOQVZBSUxBQkxFLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBVbmtub3duS2lkRXJyb3IgfHwgZXJyb3IgaW5zdGFuY2VvZiBqd3QuSnNvbldlYlRva2VuRXJyb3IpIHtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ0ludmFsaWQgdG9rZW4nLCBFcnJvckNvZGUuVE9LRU5fSU5WQUxJRCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnQXV0aGVudGljYXRpb24gZmFpbGVkJywgRXJyb3JDb2RlLlVOQVVUSE9SSVpFRCk7XG4gIH1cbn1cblxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9taWRkbGV3YXJlL2F1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQVF0QyxPQUFPLEdBQUcsTUFBTSxjQUFjLENBQUM7QUFDL0IsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxFQUFFLHFCQUFxQixFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDbEUsT0FBTyxFQUFFLHNCQUFzQixFQUFFLGlCQUFpQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDNUUsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDMUQsT0FBTyxFQUFFLGVBQWUsRUFBRSwyQkFBMkIsRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQ3JHLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNoRCxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsYUFBYSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDMUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQ3pELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxlQUFlLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUNsRixPQUFPLEVBQUUsZUFBZSxFQUFFLGVBQWUsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQy9FLE9BQU8sRUFBdUIsTUFBTSxvQkFBb0IsQ0FBQztBQUN6RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFFcEQsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3JELE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RCxPQUFPLEVBQUUsV0FBVyxFQUF3QixNQUFNLHNCQUFzQixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFDekQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBRWpELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0FBb0QvQyxNQUFNLFVBQVUsV0FBVyxDQUN6QixZQUEyQyxFQUMzQyxHQUFjLEVBQ2QsSUFBbUI7SUFFbkIsSUFBSSxZQUFZLElBQUksR0FBRyxJQUFJLElBQUksSUFBSSxTQUFTLElBQUksWUFBWSxFQUFFLENBQUM7UUFDN0QsT0FBTyxZQUFZLENBQUMsRUFBRSxFQUFFLFlBQXVCLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBSSxZQUFtQyxJQUFJLEVBQUUsQ0FBQztJQUMzRCxNQUFNLElBQUksR0FBRyxZQUFZLENBQUMsQ0FBQyxHQUFZLEVBQUUsUUFBa0IsRUFBRSxTQUF1QixFQUFFLEVBQUU7UUFDdEYsWUFBWSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQ2xELENBQUMsRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3JCLElBQUksT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3pCLFlBQVksQ0FBQyxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDckosQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQztBQUNELFlBQVksQ0FBQyxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUU1QyxTQUFTLFlBQVksQ0FDbkIsT0FBMkIsRUFDM0IsR0FBWSxFQUNaLEdBQWEsRUFDYixJQUFrQjtJQUVsQixNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQztJQUU3QyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDaEIsT0FBTyxTQUFTLENBQUMsR0FBRyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsK0JBQStCLEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzNHLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2hELE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLG1EQUFtRCxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQseUVBQXlFO0lBQ3pFLHVFQUF1RTtJQUN2RSw0RUFBNEU7SUFDNUUsK0RBQStEO0lBQy9ELGtDQUFrQztJQUNsQyxJQUFJLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdCLEtBQUssYUFBYSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUN0RCxPQUFPO0lBQ1QsQ0FBQztJQUVELDBFQUEwRTtJQUMxRSwwRUFBMEU7SUFDMUUsZ0NBQWdDO0lBQ2hDLEtBQUssZUFBZSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDdEUsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxLQUFLLFVBQVUsYUFBYSxDQUMxQixPQUEyQixFQUMzQixHQUFXLEVBQ1gsR0FBWSxFQUNaLEdBQWEsRUFDYixJQUFrQjtJQUVsQiw0RUFBNEU7SUFDNUUsMEVBQTBFO0lBQzFFLDhFQUE4RTtJQUM5RSxxRUFBcUU7SUFDckUsTUFBTSxFQUFFLGNBQWMsRUFBRSw4QkFBOEIsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLGlDQUFpQyxDQUFDLENBQUM7SUFDM0csSUFBSSxLQUFhLENBQUM7SUFDbEIsSUFBSSxDQUFDO1FBQ0gsS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksOEJBQThCLEVBQUUsQ0FBQztZQUNwRCxPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLG1CQUFtQixFQUNuQyxrRUFBa0UsRUFDbEUsU0FBUyxDQUFDLG1CQUFtQixDQUM5QixDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLCtCQUErQixFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRyxDQUFDO0lBQ0QsTUFBTSxlQUFlLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRCxLQUFLLFVBQVUsZUFBZSxDQUM1QixPQUEyQixFQUMzQixRQUFnQixFQUNoQixHQUFZLEVBQ1osR0FBYSxFQUNiLElBQWtCO0lBRWxCLElBQUksQ0FBQztRQUNILDJFQUEyRTtRQUMzRSwwRUFBMEU7UUFDMUUsNEVBQTRFO1FBQzVFLGlFQUFpRTtRQUNqRSw0RUFBNEU7UUFDNUUsV0FBVztRQUNYLE1BQU0sT0FBTyxHQUFHLE1BQU0saUJBQWlCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFbEQsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzlCLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLGlEQUFpRCxFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM3SCxDQUFDO1FBRUQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxJQUFJLENBQUMsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUN0RSxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSwrQkFBK0IsRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0csQ0FBQztRQUVELDBFQUEwRTtRQUMxRSxxRUFBcUU7UUFDckUsdUVBQXVFO1FBQ3ZFLHFIQUFxSDtRQUNySCwyRUFBMkU7UUFDM0UsSUFBSSxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ2xDLFdBQVcsQ0FBQyw0QkFBNEIsRUFBRSxFQUFFLE9BQU8sRUFBRSxhQUFhLENBQUMsT0FBTyxDQUFDLElBQUksU0FBUyxFQUFFLENBQUMsQ0FBQztZQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZFLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLHVCQUF1QixFQUFFLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNuRyxDQUFDO1FBRUQsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEdBQUcsT0FBTyxFQUFFLENBQUM7UUFFMUIsNkVBQTZFO1FBQzdFLDJFQUEyRTtRQUMzRSx5RUFBeUU7UUFDekUsc0VBQXNFO1FBQ3RFLElBQUksMkJBQTJCLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3JELElBQUksR0FBRyxDQUFDLE1BQU07Z0JBQUUsaUJBQWlCLENBQUMsR0FBRyxFQUFFLHlCQUF5QixDQUFDLENBQUM7WUFDbEUsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLGlHQUFpRyxFQUNqRyxTQUFTLENBQUMsdUJBQXVCLENBQ2xDLENBQUM7UUFDSixDQUFDO1FBRUQsNERBQTREO1FBQzVELDJFQUEyRTtRQUMzRSwyRUFBMkU7UUFDM0UsNkVBQTZFO1FBQzdFLDRFQUE0RTtRQUM1RSxxRUFBcUU7UUFDckUsNkJBQTZCO1FBQzdCLElBQUksT0FBTyxDQUFDLG9CQUFvQixLQUFLLElBQUksRUFBRSxDQUFDO1lBQzFDLFdBQVcsQ0FBQywrQkFBK0IsRUFBRSxFQUFFLE9BQU8sRUFBRSxlQUFlLEVBQUUsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQyxDQUFDO1lBQzFHLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxlQUFlLENBQUMsQ0FBQztZQUN4QyxPQUFPLFNBQVMsQ0FDZCxHQUFHLEVBQUUsVUFBVSxDQUFDLFNBQVMsRUFDekIsdUZBQXVGLEVBQ3ZGLFNBQVMsQ0FBQyx1QkFBdUIsQ0FDbEMsQ0FBQztRQUNKLENBQUM7UUFFRCxxRUFBcUU7UUFDckUsSUFBSSxPQUFPLENBQUMsWUFBWTtlQUNuQixrQkFBa0IsQ0FBQyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDO1lBQUUsT0FBTztRQUVoSyx3RUFBd0U7UUFDeEUsOEVBQThFO1FBQzlFLDhFQUE4RTtRQUM5RSw4RUFBOEU7UUFDOUUsNEVBQTRFO1FBQzVFLElBQUksT0FBTyxDQUFDLHNCQUFzQixJQUFJLE9BQU8sQ0FBQyxZQUFZLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEUsTUFBTSxXQUFXLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztZQUM3RCxNQUFNLGFBQWEsR0FBRyxlQUFlLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1lBQ2pFLElBQUksV0FBVztnQkFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsR0FBRyxXQUFXLENBQUM7WUFDdkQsSUFBSSxhQUFhO2dCQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsYUFBYSxDQUFDO1FBQy9ELENBQUM7UUFFRCxxRUFBcUU7UUFDckUsRUFBRTtRQUNGLDJFQUEyRTtRQUMzRSw0RUFBNEU7UUFDNUUsd0VBQXdFO1FBQ3hFLDJFQUEyRTtRQUMzRSwrRUFBK0U7UUFDL0UsNkVBQTZFO1FBQzdFLDRFQUE0RTtRQUM1RSw4RUFBOEU7UUFDOUUsOEVBQThFO1FBQzlFLDJFQUEyRTtRQUMzRSwwRUFBMEU7UUFDMUUsb0VBQW9FO1FBQ3BFLE1BQU0sTUFBTSxHQUFJLEdBQTZELENBQUMsT0FBTyxDQUFDO1FBQ3RGLElBQUksTUFBTSxFQUFFLENBQUM7WUFDWCxNQUFNLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxHQUE2QixDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUVELG9FQUFvRTtRQUNwRSw0RUFBNEU7UUFDNUUsSUFBSSxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ2xDLDBFQUEwRTtZQUMxRSwwRUFBMEU7WUFDMUUsNkRBQTZEO1lBQzdELGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRTtnQkFDeEMsSUFBSSxPQUFPO29CQUFFLE9BQU8sU0FBUyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLE9BQU8sRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQzlGLHFCQUFxQixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDeEMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ2YsT0FBTztRQUNULENBQUM7UUFFRCwyRUFBMkU7UUFDM0UsOEVBQThFO1FBQzlFLHFCQUFxQixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSxHQUFHLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMzQyxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSxtQkFBbUIsRUFBRSxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDL0YsQ0FBQztRQUVELDRFQUE0RTtRQUM1RSx3RUFBd0U7UUFDeEUseUVBQXlFO1FBQ3pFLDRFQUE0RTtRQUM1RSwwRUFBMEU7UUFDMUUsb0VBQW9FO1FBQ3BFLElBQUksS0FBSyxZQUFZLG9CQUFvQixJQUFJLEtBQUssWUFBWSxlQUFlLEVBQUUsQ0FBQztZQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLG1EQUFtRCxFQUFFLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQzNGLE9BQU8sU0FBUyxDQUNkLEdBQUcsRUFBRSxVQUFVLENBQUMsbUJBQW1CLEVBQ25DLDZEQUE2RCxFQUM3RCxTQUFTLENBQUMsbUJBQW1CLENBQzlCLENBQUM7UUFDSixDQUFDO1FBRUQsSUFBSSxLQUFLLFlBQVksZUFBZSxJQUFJLEtBQUssWUFBWSxHQUFHLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMvRSxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSxlQUFlLEVBQUUsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzNGLENBQUM7UUFFRCxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSx1QkFBdUIsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDbEcsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBgcmVxdWlyZUF1dGhgOiBiZWFyZXIgLyBhY2Nlc3Mta2V5IGF1dGhlbnRpY2F0aW9uLCB0aGUgY2hlY2tzIGV2ZXJ5XG4gKiB2ZXJpZmllZCByZXF1ZXN0IHBhc3NlcywgYW5kIHRoZSB0ZW5hbnQgaWRlbnRpdHkgaXQgYXR0YWNoZXMuXG4gKi9cblxuaW1wb3J0IHR5cGUgeyBSZXF1ZXN0LCBSZXNwb25zZSwgTmV4dEZ1bmN0aW9uIH0gZnJvbSAnZXhwcmVzcyc7XG5pbXBvcnQgand0IGZyb20gJ2pzb253ZWJ0b2tlbic7XG5pbXBvcnQgeyByZWZ1c2VGb3JBc3N1cmFuY2UgfSBmcm9tICcuL2Fzc3VyYW5jZS5qcyc7XG5pbXBvcnQgeyBydW5EZWZlcnJlZFF1b3RhQ2hlY2sgfSBmcm9tICcuL2RlZmVycmVkLXF1b3RhLWNoZWNrLmpzJztcbmltcG9ydCB7IGhhc1ZhbGlkSWRlbnRpdHlDbGFpbXMsIHZlcmlmeUJlYXJlclRva2VuIH0gZnJvbSAnLi9qd3QtdmVyaWZ5LmpzJztcbmltcG9ydCB7IHJlY29yZEF1dGh6RGVuaWFsIH0gZnJvbSAnLi9wZXJtaXNzaW9uLWdhdGVzLmpzJztcbmltcG9ydCB7IGNoZWNrUmV2b2NhdGlvbiwgaXNJbXBlcnNvbmF0aW9uV3JpdGVCbG9ja2VkLCBuZWVkc1Jldm9jYXRpb25DaGVjayB9IGZyb20gJy4vcmV2b2NhdGlvbi5qcyc7XG5pbXBvcnQgeyB0YWdSb3V0ZUdhdGUgfSBmcm9tICcuL3JvdXRlLXRhYmxlLmpzJztcbmltcG9ydCB7IGlzU2VydmljZVRva2VuRGVuaWVkLCBzZXJ2aWNlTmFtZU9mIH0gZnJvbSAnLi9zZXJ2aWNlLXRva2Vucy5qcyc7XG5pbXBvcnQgeyBIdHRwU3RhdHVzIH0gZnJvbSAnLi4vY29uc3RhbnRzL2h0dHAtc3RhdHVzLmpzJztcbmltcG9ydCB7IEp3a3NVbmF2YWlsYWJsZUVycm9yLCBVbmtub3duS2lkRXJyb3IgfSBmcm9tICcuLi9zZXJ2aWNlcy9qd2tzLWNhY2hlLmpzJztcbmltcG9ydCB7IFNlcnZpY2VLZXlFcnJvciwgc2VydmljZUlkZW50aXR5IH0gZnJvbSAnLi4vc2VydmljZXMvc2VydmljZS1rZXlzLmpzJztcbmltcG9ydCB7IHR5cGUgQXNzdXJhbmNlTGV2ZWwgfSBmcm9tICcuLi90eXBlcy9jb21tb24uanMnO1xuaW1wb3J0IHsgRXJyb3JDb2RlIH0gZnJvbSAnLi4vdHlwZXMvZXJyb3ItY29kZXMuanMnO1xuaW1wb3J0IHR5cGUgeyBIdHRwUmVxdWVzdCB9IGZyb20gJy4uL3R5cGVzL2h0dHAuanMnO1xuaW1wb3J0IHsgaXNPcGFxdWVBcGlLZXkgfSBmcm9tICcuLi91dGlscy9hcGkta2V5LmpzJztcbmltcG9ydCB7IGdldEhlYWRlclN0cmluZyB9IGZyb20gJy4uL3V0aWxzL2hlYWRlcnMuanMnO1xuaW1wb3J0IHsgZ2V0SWRlbnRpdHksIHR5cGUgUmVxdWVzdElkZW50aXR5IH0gZnJvbSAnLi4vdXRpbHMvaWRlbnRpdHkuanMnO1xuaW1wb3J0IHsgY3JlYXRlTG9nZ2VyIH0gZnJvbSAnLi4vdXRpbHMvbG9nZ2VyLmpzJztcbmltcG9ydCB7IGVtaXRDb3VudGVyIH0gZnJvbSAnLi4vdXRpbHMvbWV0cmljLWVtaXR0ZXIuanMnO1xuaW1wb3J0IHsgc2VuZEVycm9yIH0gZnJvbSAnLi4vdXRpbHMvcmVzcG9uc2UuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ2F1dGgtbWlkZGxld2FyZScpO1xuZXhwb3J0IGludGVyZmFjZSBSZXF1aXJlQXV0aE9wdGlvbnMge1xuICAvKipcbiAgICogQWxsb3cgeC1vcmctaWQveC1vcmctbmFtZSBoZWFkZXJzIHRvIG92ZXJyaWRlIHRoZSBKV1QncyBvcmdhbml6YXRpb24gZmllbGRzLlxuICAgKlxuICAgKiBXaGVuIGVuYWJsZWQsIHRoZSBgeC1vcmctaWRgL2B4LW9yZy1uYW1lYCBoZWFkZXJzIG92ZXJyaWRlIHRoZSBjYWxsZXIncyBvcmdcbiAgICog4oCUIGJ1dCBPTkxZIGZvciBhIHZlcmlmaWVkIFNZUy1BRE1JTiAoYGlzU3VwZXJBZG1pbmAgY2xhaW0pLiBGb3IgYW55IG9yZGluYXJ5XG4gICAqIGF1dGhlbnRpY2F0ZWQgdXNlciB0aGUgaGVhZGVycyBhcmUgaWdub3JlZCwgc28gZW5hYmxpbmcgdGhpcyBjYW4gbmV2ZXIgbGV0IGFcbiAgICogbm9ybWFsIHVzZXIgaW1wZXJzb25hdGUgYW5vdGhlciB0ZW5hbnQncyBvcmcuIFVzZSBmb3IgY3Jvc3Mtb3JnIGFkbWluIHRvb2xpbmdcbiAgICogKGUuZy4gYSBzeXNhZG1pbiBtYW5hZ2luZyBhIGdpdmVuIG9yZydzIGJpbGxpbmcpLiBJZiB1bnN1cmUsIGxlYXZlIGl0IGRpc2FibGVkLlxuICAgKi9cbiAgYWxsb3dPcmdIZWFkZXJPdmVycmlkZT86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBEZW1hbmQgdGhhdCB0aGUgd2hvbGUgU0VTU0lPTiBiZSBhdCBsZWFzdCB0aGlzIGFzc3VyYW5jZSBsZXZlbC5cbiAgICpcbiAgICogYG1pbkFzc3VyYW5jZTogMmAgbWVhbnMgdGhlIHBlcnNvbiBhdXRoZW50aWNhdGVkIHdpdGggYSBzZWNvbmQgZmFjdG9yIOKAlCBhXG4gICAqIHBhc3NrZXkgd2l0aCB1c2VyIHZlcmlmaWNhdGlvbiwgYSBwYXNzd29yZCBwbHVzIGFuIGF1dGhlbnRpY2F0b3IgY29kZSwgb3JcbiAgICogU1NPIHRocm91Z2ggYW4gSWRQIHRoZSBvcmcgbWFya2VkIGFzIGVuZm9yY2luZyBNRkEuIEEgd2Vha2VyIHRva2VuIGdldHNcbiAgICogKio0MDEgYE1GQV9SRVFVSVJFRGAqKiwgd2hpY2ggdGhlIGNsaWVudCBhbnN3ZXJzIGJ5IHNlbmRpbmcgdGhlIHBlcnNvbiB0b1xuICAgKiBlbnJvbG1lbnQgb3IgdG8gYSBzdHJvbmdlciBzaWduLWluOyByZWZyZXNoaW5nIGNhbm5vdCBoZWxwLCBiZWNhdXNlIGBhYWxgXG4gICAqIGxpdmVzIG9uIHRoZSBzZXNzaW9uIHNsb3QgYW5kIGEgcmVmcmVzaCBuZXZlciByYWlzZXMgaXQuXG4gICAqXG4gICAqIFRoaXMgaXMgdGhlIFNFU1NJT04tbGV2ZWwgY291bnRlcnBhcnQgdG8ge0BsaW5rIHJlcXVpcmVTdGVwVXB9LCB3aGljaCBzdGF5c1xuICAgKiBhIGZyZXNoLCBwZXItYWN0aW9uIGNvbmZpcm1hdGlvbi4gVXNlIGJvdGggb24gdGhlIG1vc3QgZGFuZ2Vyb3VzIHJvdXRlcy5cbiAgICpcbiAgICogTUFDSElORVMgTkVWRVIgU0FUSVNGWSBJVC4gQSBzZXJ2aWNlIHByaW5jaXBhbCwgYW4gb3JnIHNlcnZpY2UgYWNjb3VudCBhbmRcbiAgICogYW4gZXhjaGFuZ2VkIGFjY2VzcyBrZXkgYWxsIGdldCAqKjQwMyBgSFVNQU5fU0VTU0lPTl9SRVFVSVJFRGAqKiDigJQgdGhlcmUgaXNcbiAgICogbm8gcGVyc29uIGJlaGluZCB0aGVtIHRvIGhhdmUgcHJlc2VudGVkIGEgZmFjdG9yLCBzbyBcImFzc3VyYW5jZVwiIGlzIG5vdCBhXG4gICAqIHF1ZXN0aW9uIHRoZWlyIGNyZWRlbnRpYWwgY2FuIGFuc3dlci4gVGhhdCBpcyBkZWxpYmVyYXRlbHkgbm90IGEgc2lsZW50XG4gICAqIHBhc3MtdGhyb3VnaCBmb3IgaW50ZXJuYWwgc2VydmljZXM6IGEgcm91dGUgdGhhdCBkZW1hbmRzIE1GQSBpcyBhIHJvdXRlIGFcbiAgICogaHVtYW4gaXMgZG9pbmcgc29tZXRoaW5nIGRhbmdlcm91cyBvbi5cbiAgICovXG4gIG1pbkFzc3VyYW5jZT86IEFzc3VyYW5jZUxldmVsO1xuICAvKipcbiAgICogV2l0aCB7QGxpbmsgbWluQXNzdXJhbmNlfSwgYWRkaXRpb25hbGx5IGJvdW5kIGhvdyBsb25nIGFnbyB0aGF0IHNpZ24taW5cbiAgICogaGFwcGVuZWQgKHNlY29uZHMsIGNvbXBhcmVkIGFnYWluc3QgdGhlIHRva2VuJ3MgYGF1dGhfdGltZWApLiBBIHNlc3Npb24gdGhhdFxuICAgKiBpcyBNRkEtZ3JhZGUgYnV0IG9sZGVyIHRoYW4gdGhpcyBnZXRzICoqNDAxIGBSRUFVVEhfUkVRVUlSRURgKiouIElnbm9yZWRcbiAgICogd2l0aG91dCBgbWluQXNzdXJhbmNlYCDigJQgXCJob3cgcmVjZW50XCIgaXMgb25seSBtZWFuaW5nZnVsIG9uY2UgXCJob3cgc3Ryb25nXCJcbiAgICogaXMgYmVpbmcgYXNrZWQuXG4gICAqL1xuICBtYXhBZ2U/OiBudW1iZXI7XG59XG5cbi8qKiBKV1QgYXV0aCBtaWRkbGV3YXJlLiBVc2UgZGlyZWN0bHkgb3IgY2FsbCB3aXRoIG9wdGlvbnMuICovXG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZUF1dGgoXG4gIHJlcTogUmVxdWVzdCxcbiAgcmVzOiBSZXNwb25zZSxcbiAgbmV4dDogTmV4dEZ1bmN0aW9uLFxuKTogdm9pZDtcbmV4cG9ydCBmdW5jdGlvbiByZXF1aXJlQXV0aChcbiAgb3B0aW9ucz86IFJlcXVpcmVBdXRoT3B0aW9ucyxcbik6IChyZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIG5leHQ6IE5leHRGdW5jdGlvbikgPT4gdm9pZDtcbmV4cG9ydCBmdW5jdGlvbiByZXF1aXJlQXV0aChcbiAgcmVxT3JPcHRpb25zPzogUmVxdWVzdCB8IFJlcXVpcmVBdXRoT3B0aW9ucyxcbiAgcmVzPzogUmVzcG9uc2UsXG4gIG5leHQ/OiBOZXh0RnVuY3Rpb24sXG4pOiB2b2lkIHwgKChyZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIG5leHQ6IE5leHRGdW5jdGlvbikgPT4gdm9pZCkge1xuICBpZiAocmVxT3JPcHRpb25zICYmIHJlcyAmJiBuZXh0ICYmICdoZWFkZXJzJyBpbiByZXFPck9wdGlvbnMpIHtcbiAgICByZXR1cm4gX3JlcXVpcmVBdXRoKHt9LCByZXFPck9wdGlvbnMgYXMgUmVxdWVzdCwgcmVzLCBuZXh0KTtcbiAgfVxuXG4gIGNvbnN0IG9wdGlvbnMgPSAocmVxT3JPcHRpb25zIGFzIFJlcXVpcmVBdXRoT3B0aW9ucykgfHwge307XG4gIGNvbnN0IGdhdGUgPSB0YWdSb3V0ZUdhdGUoKHJlcTogUmVxdWVzdCwgcmVzSW5uZXI6IFJlc3BvbnNlLCBuZXh0SW5uZXI6IE5leHRGdW5jdGlvbikgPT4ge1xuICAgIF9yZXF1aXJlQXV0aChvcHRpb25zLCByZXEsIHJlc0lubmVyLCBuZXh0SW5uZXIpO1xuICB9LCB7IGtpbmQ6ICdhdXRoJyB9KTtcbiAgaWYgKG9wdGlvbnMubWluQXNzdXJhbmNlKSB7XG4gICAgdGFnUm91dGVHYXRlKGdhdGUsIHsga2luZDogJ2Fzc3VyYW5jZScsIG1pbkFzc3VyYW5jZTogb3B0aW9ucy5taW5Bc3N1cmFuY2UsIC4uLihvcHRpb25zLm1heEFnZSAhPT0gdW5kZWZpbmVkID8geyBtYXhBZ2U6IG9wdGlvbnMubWF4QWdlIH0gOiB7fSkgfSk7XG4gIH1cbiAgcmV0dXJuIGdhdGU7XG59XG50YWdSb3V0ZUdhdGUocmVxdWlyZUF1dGgsIHsga2luZDogJ2F1dGgnIH0pO1xuXG5mdW5jdGlvbiBfcmVxdWlyZUF1dGgoXG4gIG9wdGlvbnM6IFJlcXVpcmVBdXRoT3B0aW9ucyxcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBuZXh0OiBOZXh0RnVuY3Rpb24sXG4pOiB2b2lkIHtcbiAgY29uc3QgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmF1dGhvcml6YXRpb247XG5cbiAgaWYgKCFhdXRoSGVhZGVyKSB7XG4gICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnQXV0aG9yaXphdGlvbiBoZWFkZXIgcmVxdWlyZWQnLCBFcnJvckNvZGUuVE9LRU5fTUlTU0lORyk7XG4gIH1cblxuICBjb25zdCBwYXJ0cyA9IGF1dGhIZWFkZXIuc3BsaXQoJyAnKTtcbiAgaWYgKHBhcnRzLmxlbmd0aCAhPT0gMiB8fCBwYXJ0c1swXSAhPT0gJ0JlYXJlcicpIHtcbiAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdJbnZhbGlkIGF1dGhvcml6YXRpb24gZm9ybWF0LiBVc2U6IEJlYXJlciA8dG9rZW4+JywgRXJyb3JDb2RlLlRPS0VOX0lOVkFMSUQpO1xuICB9XG5cbiAgLy8gQW4gT1BBUVVFIEFDQ0VTUyBLRVkgKGBwYl9wYXRf4oCmYCAvIGBwYl9zYV/igKZgKSBjYXJyaWVzIG5vIGNsYWltcyBhbmQgbm9cbiAgLy8gc2lnbmF0dXJlLCBzbyBpdCBjYW5ub3QgYmUgdmVyaWZpZWQgaGVyZS4gVHJhZGUgaXQgYXQgcGxhdGZvcm0gZm9yIGFcbiAgLy8gc2hvcnQtbGl2ZWQgSldUIChjYWNoZWQgaW4tcHJvY2VzcyB1bnRpbCBpdCBleHBpcmVzKSBhbmQgdGhlbiB2ZXJpZnkgdGhhdFxuICAvLyBKV1Qgb24gdGhlIG5vcm1hbCBwYXRoIOKAlCBzZXJ2aWNlcyBuZXZlciByZWFkIGEga2V5IGhhc2guIFNlZVxuICAvLyBgc2VydmljZXMvYXBpLWtleS1leGNoYW5nZS50c2AuXG4gIGlmIChpc09wYXF1ZUFwaUtleShwYXJ0c1sxXSkpIHtcbiAgICB2b2lkIHJlc29sdmVBcGlLZXkob3B0aW9ucywgcGFydHNbMV0sIHJlcSwgcmVzLCBuZXh0KTtcbiAgICByZXR1cm47XG4gIH1cblxuICAvLyBgLmNhdGNoKG5leHQpYCBmb3J3YXJkcyBhIERPV05TVFJFQU0gc3luY2hyb25vdXMgdGhyb3cgZnJvbSBgbmV4dCgpYCB0b1xuICAvLyBFeHByZXNzJ3MgZXJyb3IgbWlkZGxld2FyZSDigJQgdmVyaWZpY2F0aW9uIGl0c2VsZiBuZXZlciByZWplY3RzIChpdCBtYXBzXG4gIC8vIGV2ZXJ5IGZhaWx1cmUgdG8gYSByZXNwb25zZSkuXG4gIHZvaWQgdmVyaWZ5QW5kQXR0YWNoKG9wdGlvbnMsIHBhcnRzWzFdLCByZXEsIHJlcywgbmV4dCkuY2F0Y2gobmV4dCk7XG59XG5cbi8qKlxuICogRXhjaGFuZ2UgYW4gb3BhcXVlIGtleSBmb3IgYSBKV1QsIHRoZW4gY29udGludWUgb24gdGhlIG5vcm1hbCB2ZXJpZmljYXRpb25cbiAqIHBhdGguIEEgcmVmdXNlZCBrZXkgaXMgYSA0MDE7IGFuIHVucmVhY2hhYmxlIHBsYXRmb3JtIGlzIGEgNTAzIChuZXZlciBhIHBhc3Mg4oCUXG4gKiBhbiB1bnZlcmlmaWFibGUgY3JlZGVudGlhbCBpcyBub3QgYW4gaWRlbnRpdHkpLlxuICovXG5hc3luYyBmdW5jdGlvbiByZXNvbHZlQXBpS2V5KFxuICBvcHRpb25zOiBSZXF1aXJlQXV0aE9wdGlvbnMsXG4gIGtleTogc3RyaW5nLFxuICByZXE6IFJlcXVlc3QsXG4gIHJlczogUmVzcG9uc2UsXG4gIG5leHQ6IE5leHRGdW5jdGlvbixcbik6IFByb21pc2U8dm9pZD4ge1xuICAvLyBMb2FkZWQgTEFaSUxZLCBvbiB0aGUgZmlyc3Qga2V5IGV2ZXIgcHJlc2VudGVkLiBBIHN0YXRpYyBpbXBvcnQgd291bGQgcHV0XG4gIC8vIHRoZSBIVFRQIGNsaWVudCAoYW5kIHBsYXRmb3JtJ3MgYWRkcmVzcykgaW50byB0aGUgaW1wb3J0IGdyYXBoIG9mIGV2ZXJ5XG4gIC8vIG1vZHVsZSB0aGF0IG1lcmVseSB1c2VzIGByZXF1aXJlQXV0aGAsIHdoaWNoIGJvdGggd2lkZW5zIHRoZSBib290IGdyYXBoIGFuZFxuICAvLyBicmVha3MgYW55IHRlc3QgdGhhdCBtb2NrcyBgaHR0cC1jbGllbnQuanNgIHdpdGggYSBwYXJ0aWFsIG1vZHVsZS5cbiAgY29uc3QgeyBleGNoYW5nZUFwaUtleSwgQXBpS2V5RXhjaGFuZ2VVbmF2YWlsYWJsZUVycm9yIH0gPSBhd2FpdCBpbXBvcnQoJy4uL3NlcnZpY2VzL2FwaS1rZXktZXhjaGFuZ2UuanMnKTtcbiAgbGV0IHRva2VuOiBzdHJpbmc7XG4gIHRyeSB7XG4gICAgdG9rZW4gPSBhd2FpdCBleGNoYW5nZUFwaUtleShrZXkpO1xuICB9IGNhdGNoIChlcnJvcikge1xuICAgIGlmIChlcnJvciBpbnN0YW5jZW9mIEFwaUtleUV4Y2hhbmdlVW5hdmFpbGFibGVFcnJvcikge1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgICAgcmVzLCBIdHRwU3RhdHVzLlNFUlZJQ0VfVU5BVkFJTEFCTEUsXG4gICAgICAgICdBY2Nlc3Mta2V5IHZlcmlmaWNhdGlvbiBpcyB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZTsgcGxlYXNlIHJldHJ5JyxcbiAgICAgICAgRXJyb3JDb2RlLlNFUlZJQ0VfVU5BVkFJTEFCTEUsXG4gICAgICApO1xuICAgIH1cbiAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdJbnZhbGlkIG9yIHJldm9rZWQgYWNjZXNzIGtleScsIEVycm9yQ29kZS5UT0tFTl9JTlZBTElEKTtcbiAgfVxuICBhd2FpdCB2ZXJpZnlBbmRBdHRhY2gob3B0aW9ucywgdG9rZW4sIHJlcSwgcmVzLCBuZXh0KTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gdmVyaWZ5QW5kQXR0YWNoKFxuICBvcHRpb25zOiBSZXF1aXJlQXV0aE9wdGlvbnMsXG4gIHJhd1Rva2VuOiBzdHJpbmcsXG4gIHJlcTogUmVxdWVzdCxcbiAgcmVzOiBSZXNwb25zZSxcbiAgbmV4dDogTmV4dEZ1bmN0aW9uLFxuKTogUHJvbWlzZTx2b2lkPiB7XG4gIHRyeSB7XG4gICAgLy8gVHdvIGNoYWlucywgb25lIGVudHJ5IHBvaW50IChzZWUgYHZlcmlmeUJlYXJlclRva2VuYCk6IGEgdXNlciB0b2tlbiBtdXN0XG4gICAgLy8gYmUgRVMyNTYgc2lnbmVkIGJ5IHBsYXRmb3JtIGFuZCB2ZXJpZmllZCBhZ2FpbnN0IGl0cyBwdWJsaXNoZWQgSldLUzsgYW5cbiAgICAvLyBpbnRlcm5hbCBzZXJ2aWNlIHRva2VuIG11c3QgYmUgRVMyNTYgc2lnbmVkIGJ5IHRoYXQgc2VydmljZSdzIE9XTiBrZXkgYW5kXG4gICAgLy8gZGVjbGFyZSBpdHNlbGYgYSBzZXJ2aWNlIHByaW5jaXBhbC4gQm90aCBwaW4gdGhlIGFsZ29yaXRobSAobm9cbiAgICAvLyBhbGctY29uZnVzaW9uLCBubyBgYWxnOm5vbmVgKSBhbmQgYm90aCBhcHBseSB0aGUgb3B0aW9uYWwgaXNzdWVyL2F1ZGllbmNlXG4gICAgLy8gYmluZGluZy5cbiAgICBjb25zdCBkZWNvZGVkID0gYXdhaXQgdmVyaWZ5QmVhcmVyVG9rZW4ocmF3VG9rZW4pO1xuXG4gICAgaWYgKGRlY29kZWQudHlwZSAhPT0gJ2FjY2VzcycpIHtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ09ubHkgYWNjZXNzIHRva2VucyBjYW4gYmUgdXNlZCBmb3IgQVBJIHJlcXVlc3RzJywgRXJyb3JDb2RlLlRPS0VOX0lOVkFMSUQpO1xuICAgIH1cblxuICAgIGlmICghZGVjb2RlZC5zdWIgfHwgIWRlY29kZWQucm9sZSB8fCAhaGFzVmFsaWRJZGVudGl0eUNsYWltcyhkZWNvZGVkKSkge1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnVG9rZW4gbWlzc2luZyByZXF1aXJlZCBmaWVsZHMnLCBFcnJvckNvZGUuVE9LRU5fSU5WQUxJRCk7XG4gICAgfVxuXG4gICAgLy8gU2VydmljZS10b2tlbiBraWxsLXN3aXRjaDogcmVqZWN0IGEgc2VydmljZSBwcmluY2lwYWwgd2hvc2Ugc2VydmljZSBoYXNcbiAgICAvLyBiZWVuIGFkZGVkIHRvIHRoZSBkZW55bGlzdC4gT3RoZXJ3aXNlIHRoZSBvbmx5IHdheSB0byBpbnZhbGlkYXRlIGFcbiAgICAvLyBzZXJ2aWNlJ3MgdG9rZW5zIGJlZm9yZSB0aGVpciAoc2hvcnQpIFRUTCBpcyByb3RhdGluZyB0aGF0IHNlcnZpY2Unc1xuICAgIC8vIHNpZ25pbmcga2V5OyB0aGlzIGN1dHMgb25lIGNvbXByb21pc2VkL3JvZ3VlIHNlcnZpY2Ugb2ZmIGltbWVkaWF0ZWx5LiBPKDEpIFNldCBsb29rdXAsIHplcm8gY29zdCB3aGVuIHRoZSBkZW55bGlzdFxuICAgIC8vIGlzIGVtcHR5ICh0aGUgZGVmYXVsdCksIHNvIGl0IG5ldmVyIHRheGVzIHRoZSBTMlMgaG90IHBhdGggdW5sZXNzIGFybWVkLlxuICAgIGlmIChpc1NlcnZpY2VUb2tlbkRlbmllZChkZWNvZGVkKSkge1xuICAgICAgZW1pdENvdW50ZXIoJ3NlcnZpY2VfdG9rZW5fZGVuaWVkX3RvdGFsJywgeyBzZXJ2aWNlOiBzZXJ2aWNlTmFtZU9mKGRlY29kZWQpID8/ICd1bmtub3duJyB9KTtcbiAgICAgIGxvZ2dlci53YXJuKCdSZWplY3RlZCBkZW55bGlzdGVkIHNlcnZpY2UgdG9rZW4nLCB7IHN1YjogZGVjb2RlZC5zdWIgfSk7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdTZXJ2aWNlIHRva2VuIHJldm9rZWQnLCBFcnJvckNvZGUuVE9LRU5fUkVWT0tFRCk7XG4gICAgfVxuXG4gICAgcmVxLnVzZXIgPSB7IC4uLmRlY29kZWQgfTtcblxuICAgIC8vIFJFQUQtT05MWSBJTVBFUlNPTkFUSU9OLiBUaGUgdG9rZW4gbmFtZXMgdGhlIG9wZXJhdG9yIEFORCBzYXlzIGl0IG1heSBvbmx5XG4gICAgLy8gbG9vazogZXZlcnkgc2VydmljZSByZWZ1c2VzIGEgc3RhdGUgY2hhbmdlIHVuZGVyIGl0LCBub3Qgb25seSBwbGF0Zm9ybSDigJRcbiAgICAvLyBhIHN1cHBvcnQgc2Vzc2lvbiB0aGF0IGNvdWxkIHdyaXRlIHRvIHBsdWdpbi9jb21wbGlhbmNlL2JpbGxpbmcgaXMgbm90XG4gICAgLy8gcmVhZC1vbmx5LiBDaGVja2VkIGJlZm9yZSBhbnkgb3RoZXIgZ2F0ZSBzbyBubyByb3V0ZSBjYW4gZm9yZ2V0IGl0LlxuICAgIGlmIChpc0ltcGVyc29uYXRpb25Xcml0ZUJsb2NrZWQocmVxLm1ldGhvZCwgZGVjb2RlZCkpIHtcbiAgICAgIGlmIChyZXEubWV0aG9kKSByZWNvcmRBdXRoekRlbmlhbChyZXEsICdpbXBlcnNvbmF0aW9uLXJlYWQtb25seScpO1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgICAgcmVzLCBIdHRwU3RhdHVzLkZPUkJJRERFTixcbiAgICAgICAgJ1dyaXRlIHJlcXVlc3RzIGFyZSBkaXNhYmxlZCBkdXJpbmcgcmVhZC1vbmx5IGltcGVyc29uYXRpb24uIFN0b3AgaW1wZXJzb25hdGluZyB0byBtYWtlIGNoYW5nZXMuJyxcbiAgICAgICAgRXJyb3JDb2RlLklNUEVSU09OQVRJT05fUkVBRF9PTkxZLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICAvLyBCT09UU1RSQVAtQURNSU4gRU5ST0xNRU5UIFNFU1NJT04uIFN1Y2ggYSB0b2tlbiBleGlzdHMgc29cbiAgICAvLyB0aGUgaW5zdGFsbCdzIG9ubHkgYWRtaW4gY2FuIGVucm9sIGEgZmFjdG9yOyBpdCBpcyBgYWFsOiAxYCBhbmQgbXVzdCBub3RcbiAgICAvLyByZWFjaCBhbnl0aGluZyBlbHNlLiBQbGF0Zm9ybSDigJQgd2hpY2ggb3ducyB0aGUgZXhjZXB0aW9uIGFuZCBrbm93cyB3aGljaFxuICAgIC8vIG9mIGl0cyBvd24gcm91dGVzIGBpbml0LXBsYXRmb3JtLnNoYCBjYWxscyDigJQgYWxsb3dzIGFuIGV4cGxpY2l0IGZldyBiZWZvcmVcbiAgICAvLyB0aGlzIHBvaW50IChzZWUgaXRzIG93biBgcmVxdWlyZUF1dGhgKTsgaW4gRVZFUlkgb3RoZXIgc2VydmljZSB0aGUgYW5zd2VyXG4gICAgLy8gaXMgc2ltcGx5IG5vLCBzbyB0aGUgcmVhY2ggcmVzdHJpY3Rpb24gaG9sZHMgd2l0aG91dCBhIHBlci1zZXJ2aWNlXG4gICAgLy8gYWxsb3dsaXN0IHRvIGtlZXAgaW4gc3luYy5cbiAgICBpZiAoZGVjb2RlZC5tZmFFbnJvbGxtZW50UGVuZGluZyA9PT0gdHJ1ZSkge1xuICAgICAgZW1pdENvdW50ZXIoJ21mYV9lbmZvcmNlbWVudF9yZWZ1c2VkX3RvdGFsJywgeyBzZXJ2aWNlOiBzZXJ2aWNlSWRlbnRpdHkoKSwgcmVhc29uOiAnYm9vdHN0cmFwX3Nlc3Npb24nIH0pO1xuICAgICAgcmVjb3JkQXV0aHpEZW5pYWwocmVxLCAnbWZhLWVucm9sbWVudCcpO1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgICAgcmVzLCBIdHRwU3RhdHVzLkZPUkJJRERFTixcbiAgICAgICAgJ0ZpbmlzaCBzZXR0aW5nIHVwIHR3by1mYWN0b3IgYXV0aGVudGljYXRpb24gYmVmb3JlIHVzaW5nIHRoZSByZXN0IG9mIFBpcGVsaW5lIEJ1aWxkZXInLFxuICAgICAgICBFcnJvckNvZGUuTUZBX0VOUk9MTE1FTlRfUkVRVUlSRUQsXG4gICAgICApO1xuICAgIH1cblxuICAgIC8vIFNlc3Npb24tbGV2ZWwgYXNzdXJhbmNlIChgcmVxdWlyZUF1dGgoeyBtaW5Bc3N1cmFuY2UsIG1heEFnZSB9KWApLlxuICAgIGlmIChvcHRpb25zLm1pbkFzc3VyYW5jZVxuICAgICAgJiYgcmVmdXNlRm9yQXNzdXJhbmNlKHsgbWluQXNzdXJhbmNlOiBvcHRpb25zLm1pbkFzc3VyYW5jZSwgLi4uKG9wdGlvbnMubWF4QWdlICE9PSB1bmRlZmluZWQgPyB7IG1heEFnZTogb3B0aW9ucy5tYXhBZ2UgfSA6IHt9KSB9LCBkZWNvZGVkLCByZXEsIHJlcykpIHJldHVybjtcblxuICAgIC8vIFRoZSB4LW9yZy1pZC94LW9yZy1uYW1lIG92ZXJyaWRlIGxldHMgYSBTWVMtQURNSU4gYWN0IG9uIGEgY2hvc2VuIG9yZ1xuICAgIC8vIChjcm9zcy1vcmcgYWRtaW4gdG9vbGluZykuIEl0IGlzIGdhdGVkIG9uIHRoZSB2ZXJpZmllZCBgaXNTdXBlckFkbWluYCBjbGFpbVxuICAgIC8vIGhlcmUgc28gdGhhdCBldmVuIGEgcm91dGUgd2hpY2ggbWlzdGFrZW5seSBlbmFibGVzIGBhbGxvd09yZ0hlYWRlck92ZXJyaWRlYFxuICAgIC8vIGNhbiBORVZFUiBsZXQgYW4gb3JkaW5hcnkgYXV0aGVudGljYXRlZCB1c2VyIHNwb29mIGFub3RoZXIgdGVuYW50J3Mgb3JnIHZpYVxuICAgIC8vIHRoZSBoZWFkZXIg4oCUIGRlZmVuY2UtaW4tZGVwdGggYWdhaW5zdCB0aGUgY3Jvc3MtdGVuYW50IGJyZWFrIHRoaXMgY2F1c2VkLlxuICAgIGlmIChvcHRpb25zLmFsbG93T3JnSGVhZGVyT3ZlcnJpZGUgJiYgZGVjb2RlZC5pc1N1cGVyQWRtaW4gPT09IHRydWUpIHtcbiAgICAgIGNvbnN0IGhlYWRlck9yZ0lkID0gZ2V0SGVhZGVyU3RyaW5nKHJlcS5oZWFkZXJzWyd4LW9yZy1pZCddKTtcbiAgICAgIGNvbnN0IGhlYWRlck9yZ05hbWUgPSBnZXRIZWFkZXJTdHJpbmcocmVxLmhlYWRlcnNbJ3gtb3JnLW5hbWUnXSk7XG4gICAgICBpZiAoaGVhZGVyT3JnSWQpIHJlcS51c2VyLm9yZ2FuaXphdGlvbklkID0gaGVhZGVyT3JnSWQ7XG4gICAgICBpZiAoaGVhZGVyT3JnTmFtZSkgcmVxLnVzZXIub3JnYW5pemF0aW9uTmFtZSA9IGhlYWRlck9yZ05hbWU7XG4gICAgfVxuXG4gICAgLy8gUmUtZGVyaXZlIHRoZSByZXF1ZXN0J3MgdGVuYW50IGlkZW50aXR5IGZyb20gdGhlIE5PVy12ZXJpZmllZCBKV1QuXG4gICAgLy9cbiAgICAvLyBgYXR0YWNoUmVxdWVzdENvbnRleHRgIHJ1bnMgYXMgYSBnbG9iYWwgbWlkZGxld2FyZSBCRUZPUkUgdGhpcyBwZXItcm91dGVcbiAgICAvLyBgcmVxdWlyZUF1dGhgLCBzbyBpdCBjYXB0dXJlZCBgcmVxLmNvbnRleHQuaWRlbnRpdHlgIHdoaWxlIGByZXEudXNlcmAgd2FzXG4gICAgLy8gc3RpbGwgdW5kZWZpbmVkIOKAlCBhdCB3aGljaCBwb2ludCBgZ2V0SWRlbnRpdHlgIGZhbGxzIGJhY2sgdG8gdGhlIHJhdyxcbiAgICAvLyBjbGllbnQtc2V0dGFibGUgYHgtb3JnLWlkYC9geC11c2VyLWlkYCBoZWFkZXJzLiBFdmVyeSBkb3duc3RyZWFtIHRlbmFudC1cbiAgICAvLyBhdXRob3JpdHkgY29uc3VtZXIgKHJlcXVpcmVPcmdJZCwgd2l0aFRlbmFudENvbnRleHQncyBSTFMgc2NvcGUsIGNoZWNrUXVvdGEsXG4gICAgLy8gd2l0aFJvdXRlLCBhbmQgdGhlIGlkZW1wb3RlbmN5IG5hbWVzcGFjZSkgcmVhZHMgYHJlcS5jb250ZXh0LmlkZW50aXR5YCwgc29cbiAgICAvLyB0aGF0IGZyb3plbiBoZWFkZXItZGVyaXZlZCB2YWx1ZSDigJQgbm90IHRoZSBKV1Qg4oCUIHdhcyBnb3Zlcm5pbmcgdGVuYW5jeSBvblxuICAgIC8vIGFueSBub24tbmdpbnggcGF0aC4gUmVjb21wdXRpbmcgaGVyZSwgYXQgdGhlIHNpbmdsZSBwb3N0LXZlcmlmaWNhdGlvbiBjaG9rZVxuICAgIC8vIHBvaW50LCBtYWtlcyBgZ2V0SWRlbnRpdHlgIHByZWZlciB0aGUgdmVyaWZpZWQgYHJlcS51c2VyYCAoc2VlIGlkZW50aXR5LnRzKVxuICAgIC8vIHNvIHRlbmFuY3kgaXMgSldULWF1dGhvcml0YXRpdmUuIFRoZSBuZ2lueCBgeC1vcmctaWRgIG92ZXJ3cml0ZSBzdGF5cyBhc1xuICAgIC8vIGRlZmVuY2UtaW4tZGVwdGguIEd1YXJkZWQgb24gYHJlcS5jb250ZXh0YCBzbyBzZXJ2aWNlcy9wYXRocyB0aGF0IG5ldmVyXG4gICAgLy8gYXR0YWNoIGEgY29udGV4dCAob3IgcnVuIHJlcXVpcmVBdXRoIHByZS1jb250ZXh0KSBhcmUgdW5hZmZlY3RlZC5cbiAgICBjb25zdCByZXFDdHggPSAocmVxIGFzIFJlcXVlc3QgJiB7IGNvbnRleHQ/OiB7IGlkZW50aXR5OiBSZXF1ZXN0SWRlbnRpdHkgfSB9KS5jb250ZXh0O1xuICAgIGlmIChyZXFDdHgpIHtcbiAgICAgIHJlcUN0eC5pZGVudGl0eSA9IGdldElkZW50aXR5KHJlcSBhcyB1bmtub3duIGFzIEh0dHBSZXF1ZXN0KTtcbiAgICB9XG5cbiAgICAvLyBTZXNzaW9uIGludmFsaWRhdGlvbiAodG9rZW4tdmVyc2lvbiBzdG9yZSArIGltcGVyc29uYXRpb24tc2Vzc2lvblxuICAgIC8vIGxpdmVuZXNzKS4gTm8gc3RvcmUgcmVnaXN0ZXJlZCDih5Igb25seSBpbXBlcnNvbmF0aW9uIHNlc3Npb25zIGFyZSBjaGVja2VkLlxuICAgIGlmIChuZWVkc1Jldm9jYXRpb25DaGVjayhkZWNvZGVkKSkge1xuICAgICAgLy8gYC5jYXRjaChuZXh0KWAgZm9yd2FyZHMgYSBET1dOU1RSRUFNIHN5bmNocm9ub3VzIHRocm93IGZyb20gYG5leHQoKWAgdG9cbiAgICAgIC8vIEV4cHJlc3MncyBlcnJvciBtaWRkbGV3YXJlIOKAlCB0aGlzIGBuZXh0KClgIHJ1bnMgaW4gYSBtaWNyb3Rhc2ssIG91dHNpZGVcbiAgICAgIC8vIHRoZSBzdXJyb3VuZGluZyB0cnkvY2F0Y2guIFRoZSBjaGVjayBpdHNlbGYgbmV2ZXIgcmVqZWN0cy5cbiAgICAgIGNoZWNrUmV2b2NhdGlvbihkZWNvZGVkKS50aGVuKChyZWZ1c2FsKSA9PiB7XG4gICAgICAgIGlmIChyZWZ1c2FsKSByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsIHJlZnVzYWwsIEVycm9yQ29kZS5UT0tFTl9SRVZPS0VEKTtcbiAgICAgICAgcnVuRGVmZXJyZWRRdW90YUNoZWNrKHJlcSwgcmVzLCBuZXh0KTtcbiAgICAgIH0pLmNhdGNoKG5leHQpO1xuICAgICAgcmV0dXJuO1xuICAgIH1cblxuICAgIC8vIFRoZSBhcGlDYWxscyBjaGVjayBhIG1vdW50IGFybWVkIChhcGktc2VydmVyIGBhcGlDYWxsc1F1b3RhYCkgcnVucyBoZXJlLFxuICAgIC8vIG5vdyB0aGF0IHRlbmFuY3kgaXMgSldULWF1dGhvcml0YXRpdmU7IGEgcGxhaW4gbmV4dCgpIHdoZXJlIG5vbmUgd2FzIGFybWVkLlxuICAgIHJ1bkRlZmVycmVkUXVvdGFDaGVjayhyZXEsIHJlcywgbmV4dCk7XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgaWYgKGVycm9yIGluc3RhbmNlb2Ygand0LlRva2VuRXhwaXJlZEVycm9yKSB7XG4gICAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdUb2tlbiBoYXMgZXhwaXJlZCcsIEVycm9yQ29kZS5UT0tFTl9FWFBJUkVEKTtcbiAgICB9XG5cbiAgICAvLyBUaGUgc2lnbmluZyBrZXlzIGNvdWxkbid0IGJlIGZldGNoZWQsIHNvIHRoZSB0b2tlbidzIHZhbGlkaXR5IGlzIFVOS05PV04uXG4gICAgLy8gRmFpbCBDTE9TRUQgd2l0aCBhIHJldHJ5YWJsZSA1MDMg4oCUIG5ldmVyIGEgcGFzcywgYW5kIG5ldmVyIGEgNDAxIHRoYXRcbiAgICAvLyB3b3VsZCBzZW5kIGEgbGVnaXRpbWF0ZSBjbGllbnQgb2ZmIHRvIHJlLWF1dGhlbnRpY2F0ZSBvdmVyIG91ciBvdXRhZ2UuXG4gICAgLy8gU2FtZSByZWFzb25pbmcgZm9yIHRoZSBTRVJWSUNFIGNoYWluOiBubyByZWFkYWJsZSBrZXkgYnVuZGxlIG1lYW5zIG5vIHdheVxuICAgIC8vIHRvIHRlbGwgYSBwZWVyJ3MgdG9rZW4gZnJvbSBhIGZvcmdlcnksIHNvIHRoZSByZXF1ZXN0IGlzIHJlZnVzZWQgd2l0aCBhXG4gICAgLy8gcmV0cnlhYmxlIDUwMyByYXRoZXIgdGhhbiBhZG1pdHRlZCBvciBib3VuY2VkIHRvIHJlLWF1dGhlbnRpY2F0ZS5cbiAgICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBKd2tzVW5hdmFpbGFibGVFcnJvciB8fCBlcnJvciBpbnN0YW5jZW9mIFNlcnZpY2VLZXlFcnJvcikge1xuICAgICAgbG9nZ2VyLndhcm4oJ1JlamVjdGluZyByZXF1ZXN0OiB0b2tlbiBzaWduaW5nIGtleXMgdW5hdmFpbGFibGUnLCB7IGVycm9yOiBlcnJvci5tZXNzYWdlIH0pO1xuICAgICAgcmV0dXJuIHNlbmRFcnJvcihcbiAgICAgICAgcmVzLCBIdHRwU3RhdHVzLlNFUlZJQ0VfVU5BVkFJTEFCTEUsXG4gICAgICAgICdUb2tlbiB2ZXJpZmljYXRpb24gaXMgdGVtcG9yYXJpbHkgdW5hdmFpbGFibGU7IHBsZWFzZSByZXRyeScsXG4gICAgICAgIEVycm9yQ29kZS5TRVJWSUNFX1VOQVZBSUxBQkxFLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICBpZiAoZXJyb3IgaW5zdGFuY2VvZiBVbmtub3duS2lkRXJyb3IgfHwgZXJyb3IgaW5zdGFuY2VvZiBqd3QuSnNvbldlYlRva2VuRXJyb3IpIHtcbiAgICAgIHJldHVybiBzZW5kRXJyb3IocmVzLCBIdHRwU3RhdHVzLlVOQVVUSE9SSVpFRCwgJ0ludmFsaWQgdG9rZW4nLCBFcnJvckNvZGUuVE9LRU5fSU5WQUxJRCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIEh0dHBTdGF0dXMuVU5BVVRIT1JJWkVELCAnQXV0aGVudGljYXRpb24gZmFpbGVkJywgRXJyb3JDb2RlLlVOQVVUSE9SSVpFRCk7XG4gIH1cbn1cblxuIl19

package/lib/middleware/deferred-quota-check.d.ts

@@ -0,0 +1,5 @@
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+/** Arm `check` to run after this request authenticates. */
+export declare function armDeferredQuotaCheck(res: Response, check: RequestHandler): void;
+/** `requireAuth`'s `next()`: run the armed quota check, if any, then continue. */
+export declare function runDeferredQuotaCheck(req: Request, res: Response, next: NextFunction): void;

package/lib/middleware/deferred-quota-check.js

@@ -0,0 +1,33 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * A quota check armed at MOUNT time and run by `requireAuth` once the caller is
+ * verified.
+ *
+ * Why deferred: the apiCalls meter + check mount ONCE per service, ahead of its
+ * whole user surface (api-server `apiCallsQuota`), but authentication is per
+ * route — routers mix public, user and machine routes under one prefix. At mount
+ * time there is no verified org to check yet, and checking a header-derived or
+ * peeked one would hand a forged token a victim org's usage in the 429 body. So
+ * the mount only ARMS the check here, and `requireAuth` (api-core's, and
+ * platform's own) runs it at its single post-verification choke point, after
+ * the request identity has been re-derived from the JWT. A route that never
+ * authenticates never runs it — there is no org to bill.
+ *
+ * At most once per request: running it empties the slot, so a second
+ * `requireAuth` in the same chain is a plain `next()`.
+ */
+const SLOT = 'deferredQuotaCheck';
+/** Arm `check` to run after this request authenticates. */
+export function armDeferredQuotaCheck(res, check) {
+    res.locals[SLOT] = check;
+}
+/** `requireAuth`'s `next()`: run the armed quota check, if any, then continue. */
+export function runDeferredQuotaCheck(req, res, next) {
+    const check = res.locals?.[SLOT];
+    if (!check)
+        return next();
+    delete res.locals[SLOT];
+    void check(req, res, next);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVmZXJyZWQtcXVvdGEtY2hlY2suanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWlkZGxld2FyZS9kZWZlcnJlZC1xdW90YS1jaGVjay50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBSXRDOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBQ0gsTUFBTSxJQUFJLEdBQUcsb0JBQW9CLENBQUM7QUFFbEMsMkRBQTJEO0FBQzNELE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxHQUFhLEVBQUUsS0FBcUI7SUFDeEUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUM7QUFDM0IsQ0FBQztBQUVELGtGQUFrRjtBQUNsRixNQUFNLFVBQVUscUJBQXFCLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQjtJQUNuRixNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUErQixDQUFDO0lBQy9ELElBQUksQ0FBQyxLQUFLO1FBQUUsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUMxQixPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEIsS0FBSyxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUM3QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB0eXBlIHsgTmV4dEZ1bmN0aW9uLCBSZXF1ZXN0LCBSZXF1ZXN0SGFuZGxlciwgUmVzcG9uc2UgfSBmcm9tICdleHByZXNzJztcblxuLyoqXG4gKiBBIHF1b3RhIGNoZWNrIGFybWVkIGF0IE1PVU5UIHRpbWUgYW5kIHJ1biBieSBgcmVxdWlyZUF1dGhgIG9uY2UgdGhlIGNhbGxlciBpc1xuICogdmVyaWZpZWQuXG4gKlxuICogV2h5IGRlZmVycmVkOiB0aGUgYXBpQ2FsbHMgbWV0ZXIgKyBjaGVjayBtb3VudCBPTkNFIHBlciBzZXJ2aWNlLCBhaGVhZCBvZiBpdHNcbiAqIHdob2xlIHVzZXIgc3VyZmFjZSAoYXBpLXNlcnZlciBgYXBpQ2FsbHNRdW90YWApLCBidXQgYXV0aGVudGljYXRpb24gaXMgcGVyXG4gKiByb3V0ZSDigJQgcm91dGVycyBtaXggcHVibGljLCB1c2VyIGFuZCBtYWNoaW5lIHJvdXRlcyB1bmRlciBvbmUgcHJlZml4LiBBdCBtb3VudFxuICogdGltZSB0aGVyZSBpcyBubyB2ZXJpZmllZCBvcmcgdG8gY2hlY2sgeWV0LCBhbmQgY2hlY2tpbmcgYSBoZWFkZXItZGVyaXZlZCBvclxuICogcGVla2VkIG9uZSB3b3VsZCBoYW5kIGEgZm9yZ2VkIHRva2VuIGEgdmljdGltIG9yZydzIHVzYWdlIGluIHRoZSA0MjkgYm9keS4gU29cbiAqIHRoZSBtb3VudCBvbmx5IEFSTVMgdGhlIGNoZWNrIGhlcmUsIGFuZCBgcmVxdWlyZUF1dGhgIChhcGktY29yZSdzLCBhbmRcbiAqIHBsYXRmb3JtJ3Mgb3duKSBydW5zIGl0IGF0IGl0cyBzaW5nbGUgcG9zdC12ZXJpZmljYXRpb24gY2hva2UgcG9pbnQsIGFmdGVyXG4gKiB0aGUgcmVxdWVzdCBpZGVudGl0eSBoYXMgYmVlbiByZS1kZXJpdmVkIGZyb20gdGhlIEpXVC4gQSByb3V0ZSB0aGF0IG5ldmVyXG4gKiBhdXRoZW50aWNhdGVzIG5ldmVyIHJ1bnMgaXQg4oCUIHRoZXJlIGlzIG5vIG9yZyB0byBiaWxsLlxuICpcbiAqIEF0IG1vc3Qgb25jZSBwZXIgcmVxdWVzdDogcnVubmluZyBpdCBlbXB0aWVzIHRoZSBzbG90LCBzbyBhIHNlY29uZFxuICogYHJlcXVpcmVBdXRoYCBpbiB0aGUgc2FtZSBjaGFpbiBpcyBhIHBsYWluIGBuZXh0KClgLlxuICovXG5jb25zdCBTTE9UID0gJ2RlZmVycmVkUXVvdGFDaGVjayc7XG5cbi8qKiBBcm0gYGNoZWNrYCB0byBydW4gYWZ0ZXIgdGhpcyByZXF1ZXN0IGF1dGhlbnRpY2F0ZXMuICovXG5leHBvcnQgZnVuY3Rpb24gYXJtRGVmZXJyZWRRdW90YUNoZWNrKHJlczogUmVzcG9uc2UsIGNoZWNrOiBSZXF1ZXN0SGFuZGxlcik6IHZvaWQge1xuICByZXMubG9jYWxzW1NMT1RdID0gY2hlY2s7XG59XG5cbi8qKiBgcmVxdWlyZUF1dGhgJ3MgYG5leHQoKWA6IHJ1biB0aGUgYXJtZWQgcXVvdGEgY2hlY2ssIGlmIGFueSwgdGhlbiBjb250aW51ZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBydW5EZWZlcnJlZFF1b3RhQ2hlY2socmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pOiB2b2lkIHtcbiAgY29uc3QgY2hlY2sgPSByZXMubG9jYWxzPy5bU0xPVF0gYXMgUmVxdWVzdEhhbmRsZXIgfCB1bmRlZmluZWQ7XG4gIGlmICghY2hlY2spIHJldHVybiBuZXh0KCk7XG4gIGRlbGV0ZSByZXMubG9jYWxzW1NMT1RdO1xuICB2b2lkIGNoZWNrKHJlcSwgcmVzLCBuZXh0KTtcbn1cbiJdfQ==

package/lib/middleware/ecosystem-guard.d.ts

@@ -3,7 +3,7 @@
  *
  * Only the system org manages or approves the ecosystem. A route that exercises
  * a system-org-only permission (`plugins:moderate`, `publishers:verify`) must
- * therefore check three things, and {@link requireEcosystemPermission} composes
+ * therefore check three things, and {@link requireSystemOrgPermission} composes
  * them so no route can forget one:
  *
  *  1. {@link requireSystemOrg} — the caller's ACTIVE org is the system org. A
@@ -36,7 +36,7 @@ export declare const requireSystemOrg: (req: Request, res: Response, next: NextF
  * as an array, which Express flattens:
  *
  * ```ts
- * router.post('/requests/:id/approve', requireAuth, requireEcosystemPermission('plugins:moderate'),
+ * router.post('/requests/:id/approve', requireAuth, requireSystemOrgPermission('plugins:moderate'),
  *   requireStepUp, audited('plugin.request.approve'), handler);
  * ```
  *
@@ -44,4 +44,4 @@ export declare const requireSystemOrg: (req: Request, res: Response, next: NextF
  * system-org-only — a tenant permission behind this gate would be unreachable
  * for every tenant, which is always a wiring mistake.
  */
-export declare function requireEcosystemPermission(...permissions: Permission[]): RequestHandler[];
+export declare function requireSystemOrgPermission(...permissions: Permission[]): RequestHandler[];

package/lib/middleware/ecosystem-guard.js

@@ -36,7 +36,7 @@ export const requireSystemOrg = tagRouteGate(function requireSystemOrg(req, res,
  * as an array, which Express flattens:
  *
  * ```ts
- * router.post('/requests/:id/approve', requireAuth, requireEcosystemPermission('plugins:moderate'),
+ * router.post('/requests/:id/approve', requireAuth, requireSystemOrgPermission('plugins:moderate'),
  *   requireStepUp, audited('plugin.request.approve'), handler);
  * ```
  *
@@ -44,12 +44,12 @@ export const requireSystemOrg = tagRouteGate(function requireSystemOrg(req, res,
  * system-org-only — a tenant permission behind this gate would be unreachable
  * for every tenant, which is always a wiring mistake.
  */
-export function requireEcosystemPermission(...permissions) {
+export function requireSystemOrgPermission(...permissions) {
     if (permissions.length === 0)
-        throw new Error('requireEcosystemPermission needs at least one permission');
+        throw new Error('requireSystemOrgPermission needs at least one permission');
     const tenant = permissions.filter((p) => !isSystemOrgOnlyPermission(p));
     if (tenant.length > 0) {
-        throw new Error(`requireEcosystemPermission only takes system-org-only permissions; got ${tenant.join(', ')}`);
+        throw new Error(`requireSystemOrgPermission only takes system-org-only permissions; got ${tenant.join(', ')}`);
     }
     return [
         requireSystemOrg,
@@ -57,4 +57,4 @@ export function requireEcosystemPermission(...permissions) {
         requireAssurance({ minAssurance: 2 }),
     ];
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZWNvc3lzdGVtLWd1YXJkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL21pZGRsZXdhcmUvZWNvc3lzdGVtLWd1YXJkLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUF3QnRDLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQzdFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNoRCxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDaEQsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQ3pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNwRCxPQUFPLEVBQUUseUJBQXlCLEVBQW1CLE1BQU0seUJBQXlCLENBQUM7QUFDckYsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUVqRDsrRUFDK0U7QUFDL0UsTUFBTSxVQUFVLGtCQUFrQixDQUFDLEdBQVk7SUFDN0MsT0FBTyxhQUFhLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxjQUFjLENBQUMsQ0FBQztBQUNqRCxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxZQUFZLENBQUMsU0FBUyxnQkFBZ0IsQ0FBQyxHQUFZLEVBQUUsR0FBYSxFQUFFLElBQWtCO0lBQ3BILElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDZCxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSx5QkFBeUIsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUNELElBQUksa0JBQWtCLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUMzQyxXQUFXLENBQUMsZ0NBQWdDLEVBQUUsRUFBRSxTQUFTLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNsRyxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDckMsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLG1HQUFtRyxFQUNuRyxTQUFTLENBQUMsbUJBQW1CLENBQzlCLENBQUM7QUFDSixDQUFDLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztBQUUxQjs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxVQUFVLDBCQUEwQixDQUFDLEdBQUcsV0FBeUI7SUFDckUsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7SUFDMUcsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLDBFQUEwRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNqSCxDQUFDO0lBQ0QsT0FBTztRQUNMLGdCQUFnQjtRQUNoQixpQkFBaUIsQ0FBQyxHQUFHLFdBQVcsQ0FBQztRQUNqQyxnQkFBZ0IsQ0FBQyxFQUFFLFlBQVksRUFBRSxDQUFDLEVBQUUsQ0FBQztLQUNsQixDQUFDO0FBQ3hCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBUaGUgcGx1Z2luLWVjb3N5c3RlbSBnb3Zlcm5hbmNlIGdhdGUgKGRvY3MvcnVuYm9va3MvZWNvc3lzdGVtLW1vZGVyYXRpb24ubWQpLlxuICpcbiAqIE9ubHkgdGhlIHN5c3RlbSBvcmcgbWFuYWdlcyBvciBhcHByb3ZlcyB0aGUgZWNvc3lzdGVtLiBBIHJvdXRlIHRoYXQgZXhlcmNpc2VzXG4gKiBhIHN5c3RlbS1vcmctb25seSBwZXJtaXNzaW9uIChgcGx1Z2luczptb2RlcmF0ZWAsIGBwdWJsaXNoZXJzOnZlcmlmeWApIG11c3RcbiAqIHRoZXJlZm9yZSBjaGVjayB0aHJlZSB0aGluZ3MsIGFuZCB7QGxpbmsgcmVxdWlyZUVjb3N5c3RlbVBlcm1pc3Npb259IGNvbXBvc2VzXG4gKiB0aGVtIHNvIG5vIHJvdXRlIGNhbiBmb3JnZXQgb25lOlxuICpcbiAqICAxLiB7QGxpbmsgcmVxdWlyZVN5c3RlbU9yZ30g4oCUIHRoZSBjYWxsZXIncyBBQ1RJVkUgb3JnIGlzIHRoZSBzeXN0ZW0gb3JnLiBBXG4gKiAgICAgdG9rZW4gbWludGVkIGluIGEgdGVuYW50IG9yZyBpcyByZWZ1c2VkIGV2ZW4gZm9yIHRoZSBzYW1lIHBlcnNvbiAoYW5kIGV2ZW5cbiAqICAgICBmb3IgYSBzdXBlcmFkbWluOiB0aGV5IHN3aXRjaCB0byB0aGUgc3lzdGVtIG9yZyB0byBhY3Qgb24gdGhlIGVjb3N5c3RlbSxcbiAqICAgICBzbyBldmVyeSBnb3Zlcm5hbmNlIGRlY2lzaW9uIGlzIHJlY29yZGVkIHdpdGggdGhlIHN5c3RlbSBvcmcncyBpZCkuXG4gKiAgMi4gdGhlIHBlcm1pc3Npb24gaXRzZWxmIChgcmVxdWlyZVBlcm1pc3Npb25gLCBhbnktb2YpO1xuICogIDMuIGFuIE1GQS1ncmFkZSBzZXNzaW9uIChgcmVxdWlyZUFzc3VyYW5jZSh7IG1pbkFzc3VyYW5jZTogMiB9KWApLCB3aGljaCBhbHNvXG4gKiAgICAgcmVmdXNlcyBldmVyeSBtYWNoaW5lIGNyZWRlbnRpYWwuXG4gKlxuICogVGhlIHJvdXRlLWNvdmVyYWdlIGdvdmVybmFuY2UgY2hlY2sgKGBmaW5kU3lzdGVtT3JnR3VhcmRWaW9sYXRpb25zYCBpblxuICogYHRlc3Rpbmcvcm91dGUtY292ZXJhZ2UudHNgKSBmYWlscyBhbnkgcm91dGUgdGhhdCBnYXRlcyBvbiBhIHN5c3RlbS1vcmctb25seVxuICogcGVybWlzc2lvbiB3aXRob3V0IDEgYW5kIDMsIHNvIGEgaGFuZC1yb2xsZWQgY2hhaW4gY2Fubm90IHNsaXAgdGhyb3VnaC5cbiAqL1xuXG5pbXBvcnQgdHlwZSB7IE5leHRGdW5jdGlvbiwgUmVxdWVzdCwgUmVxdWVzdEhhbmRsZXIsIFJlc3BvbnNlIH0gZnJvbSAnZXhwcmVzcyc7XG5pbXBvcnQgeyByZXF1aXJlQXNzdXJhbmNlIH0gZnJvbSAnLi9hc3N1cmFuY2UuanMnO1xuaW1wb3J0IHsgcmVjb3JkQXV0aHpEZW5pYWwsIHJlcXVpcmVQZXJtaXNzaW9uIH0gZnJvbSAnLi9wZXJtaXNzaW9uLWdhdGVzLmpzJztcbmltcG9ydCB7IHRhZ1JvdXRlR2F0ZSB9IGZyb20gJy4vcm91dGUtdGFibGUuanMnO1xuaW1wb3J0IHsgaXNTeXN0ZW1PcmdJZCB9IGZyb20gJy4vc3lzdGVtLW9yZy5qcyc7XG5pbXBvcnQgeyBIdHRwU3RhdHVzIH0gZnJvbSAnLi4vY29uc3RhbnRzL2h0dHAtc3RhdHVzLmpzJztcbmltcG9ydCB7IEVycm9yQ29kZSB9IGZyb20gJy4uL3R5cGVzL2Vycm9yLWNvZGVzLmpzJztcbmltcG9ydCB7IGlzU3lzdGVtT3JnT25seVBlcm1pc3Npb24sIHR5cGUgUGVybWlzc2lvbiB9IGZyb20gJy4uL3R5cGVzL3Blcm1pc3Npb25zLmpzJztcbmltcG9ydCB7IGVtaXRDb3VudGVyIH0gZnJvbSAnLi4vdXRpbHMvbWV0cmljLWVtaXR0ZXIuanMnO1xuaW1wb3J0IHsgc2VuZEVycm9yIH0gZnJvbSAnLi4vdXRpbHMvcmVzcG9uc2UuanMnO1xuXG4vKiogV2hldGhlciB0aGUgcmVxdWVzdCdzIEFDVElWRSBvcmcgKHRoZSB0b2tlbidzIGBvcmdhbml6YXRpb25JZGApIGlzIHRoZSBzeXN0ZW1cbiAqICBvcmcuIENvbXBhcmVkIGJ5IGlkIG9ubHkg4oCUIGFuIG9yZyBtZXJlbHkgTkFNRUQgXCJzeXN0ZW1cIiBuZXZlciBxdWFsaWZpZXMuICovXG5leHBvcnQgZnVuY3Rpb24gaXNTeXN0ZW1PcmdSZXF1ZXN0KHJlcTogUmVxdWVzdCk6IGJvb2xlYW4ge1xuICByZXR1cm4gaXNTeXN0ZW1PcmdJZChyZXEudXNlcj8ub3JnYW5pemF0aW9uSWQpO1xufVxuXG4vKipcbiAqIFJlcXVpcmUgdGhhdCB0aGUgY2FsbGVyJ3MgYWN0aXZlIG9yZyBpcyB0aGUgc3lzdGVtIG9yZy4gQ29tcG9zZSBhZnRlclxuICogYHJlcXVpcmVBdXRoYC4gUmVmdXNhbHMgYXJlIDQwMyBgU1lTVEVNX09SR19SRVFVSVJFRGAsIGNvdW50ZWRcbiAqIChgc3lzdGVtX29yZ19ndWFyZF9yZWZ1c2VkX3RvdGFsYCkgYW5kIGF1ZGl0ZWQgdGhyb3VnaCB0aGUgc2hhcmVkXG4gKiBgYXV0aHouZGVuaWVkYCBzaW5rIChgcmVxdWlyZWQ6ICdzeXN0ZW0tb3JnJ2ApLlxuICovXG5leHBvcnQgY29uc3QgcmVxdWlyZVN5c3RlbU9yZyA9IHRhZ1JvdXRlR2F0ZShmdW5jdGlvbiByZXF1aXJlU3lzdGVtT3JnKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSwgbmV4dDogTmV4dEZ1bmN0aW9uKTogdm9pZCB7XG4gIGlmICghcmVxLnVzZXIpIHtcbiAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdBdXRoZW50aWNhdGlvbiByZXF1aXJlZCcsIEVycm9yQ29kZS5VTkFVVEhPUklaRUQpO1xuICB9XG4gIGlmIChpc1N5c3RlbU9yZ1JlcXVlc3QocmVxKSkgcmV0dXJuIG5leHQoKTtcbiAgZW1pdENvdW50ZXIoJ3N5c3RlbV9vcmdfZ3VhcmRfcmVmdXNlZF90b3RhbCcsIHsgcHJpbmNpcGFsOiByZXEudXNlci5wcmluY2lwYWxUeXBlID8/ICd1bmtub3duJyB9KTtcbiAgcmVjb3JkQXV0aHpEZW5pYWwocmVxLCAnc3lzdGVtLW9yZycpO1xuICByZXR1cm4gc2VuZEVycm9yKFxuICAgIHJlcywgSHR0cFN0YXR1cy5GT1JCSURERU4sXG4gICAgJ1RoaXMgYWN0aW9uIGlzIHJlc2VydmVkIGZvciB0aGUgc3lzdGVtIG9yZ2FuaXphdGlvbiDigJQgc3dpdGNoIHRvIGl0IHRvIG1hbmFnZSB0aGUgcGx1Z2luIGVjb3N5c3RlbScsXG4gICAgRXJyb3JDb2RlLlNZU1RFTV9PUkdfUkVRVUlSRUQsXG4gICk7XG59LCB7IGtpbmQ6ICdzeXN0ZW1PcmcnIH0pO1xuXG4vKipcbiAqIFRIRSBnYXRlIGZvciBhbiBlY29zeXN0ZW0tZ292ZXJuYW5jZSByb3V0ZTogc3lzdGVtIG9yZyArIChhbnkgb2YpIHRoZSBnaXZlblxuICogc3lzdGVtLW9yZy1vbmx5IHBlcm1pc3Npb24ocykgKyBhbiBNRkEtZ3JhZGUgaHVtYW4gc2Vzc2lvbi4gUmV0dXJucyB0aGUgY2hhaW5cbiAqIGFzIGFuIGFycmF5LCB3aGljaCBFeHByZXNzIGZsYXR0ZW5zOlxuICpcbiAqIGBgYHRzXG4gKiByb3V0ZXIucG9zdCgnL3JlcXVlc3RzLzppZC9hcHByb3ZlJywgcmVxdWlyZUF1dGgsIHJlcXVpcmVFY29zeXN0ZW1QZXJtaXNzaW9uKCdwbHVnaW5zOm1vZGVyYXRlJyksXG4gKiAgIHJlcXVpcmVTdGVwVXAsIGF1ZGl0ZWQoJ3BsdWdpbi5yZXF1ZXN0LmFwcHJvdmUnKSwgaGFuZGxlcik7XG4gKiBgYGBcbiAqXG4gKiBUaHJvd3MgYXQgcm91dGUtZGVmaW5pdGlvbiB0aW1lIHdoZW4gaGFuZGVkIGEgcGVybWlzc2lvbiB0aGF0IGlzIE5PVFxuICogc3lzdGVtLW9yZy1vbmx5IOKAlCBhIHRlbmFudCBwZXJtaXNzaW9uIGJlaGluZCB0aGlzIGdhdGUgd291bGQgYmUgdW5yZWFjaGFibGVcbiAqIGZvciBldmVyeSB0ZW5hbnQsIHdoaWNoIGlzIGFsd2F5cyBhIHdpcmluZyBtaXN0YWtlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZUVjb3N5c3RlbVBlcm1pc3Npb24oLi4ucGVybWlzc2lvbnM6IFBlcm1pc3Npb25bXSk6IFJlcXVlc3RIYW5kbGVyW10ge1xuICBpZiAocGVybWlzc2lvbnMubGVuZ3RoID09PSAwKSB0aHJvdyBuZXcgRXJyb3IoJ3JlcXVpcmVFY29zeXN0ZW1QZXJtaXNzaW9uIG5lZWRzIGF0IGxlYXN0IG9uZSBwZXJtaXNzaW9uJyk7XG4gIGNvbnN0IHRlbmFudCA9IHBlcm1pc3Npb25zLmZpbHRlcigocCkgPT4gIWlzU3lzdGVtT3JnT25seVBlcm1pc3Npb24ocCkpO1xuICBpZiAodGVuYW50Lmxlbmd0aCA+IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYHJlcXVpcmVFY29zeXN0ZW1QZXJtaXNzaW9uIG9ubHkgdGFrZXMgc3lzdGVtLW9yZy1vbmx5IHBlcm1pc3Npb25zOyBnb3QgJHt0ZW5hbnQuam9pbignLCAnKX1gKTtcbiAgfVxuICByZXR1cm4gW1xuICAgIHJlcXVpcmVTeXN0ZW1PcmcsXG4gICAgcmVxdWlyZVBlcm1pc3Npb24oLi4ucGVybWlzc2lvbnMpLFxuICAgIHJlcXVpcmVBc3N1cmFuY2UoeyBtaW5Bc3N1cmFuY2U6IDIgfSksXG4gIF0gYXMgUmVxdWVzdEhhbmRsZXJbXTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZWNvc3lzdGVtLWd1YXJkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL21pZGRsZXdhcmUvZWNvc3lzdGVtLWd1YXJkLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUF3QnRDLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQzdFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNoRCxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDaEQsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQ3pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNwRCxPQUFPLEVBQUUseUJBQXlCLEVBQW1CLE1BQU0seUJBQXlCLENBQUM7QUFDckYsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3pELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUVqRDsrRUFDK0U7QUFDL0UsTUFBTSxVQUFVLGtCQUFrQixDQUFDLEdBQVk7SUFDN0MsT0FBTyxhQUFhLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxjQUFjLENBQUMsQ0FBQztBQUNqRCxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxZQUFZLENBQUMsU0FBUyxnQkFBZ0IsQ0FBQyxHQUFZLEVBQUUsR0FBYSxFQUFFLElBQWtCO0lBQ3BILElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDZCxPQUFPLFNBQVMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLFlBQVksRUFBRSx5QkFBeUIsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUNELElBQUksa0JBQWtCLENBQUMsR0FBRyxDQUFDO1FBQUUsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUMzQyxXQUFXLENBQUMsZ0NBQWdDLEVBQUUsRUFBRSxTQUFTLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNsRyxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDckMsT0FBTyxTQUFTLENBQ2QsR0FBRyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQ3pCLG1HQUFtRyxFQUNuRyxTQUFTLENBQUMsbUJBQW1CLENBQzlCLENBQUM7QUFDSixDQUFDLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztBQUUxQjs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxVQUFVLDBCQUEwQixDQUFDLEdBQUcsV0FBeUI7SUFDckUsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7SUFDMUcsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLDBFQUEwRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNqSCxDQUFDO0lBQ0QsT0FBTztRQUNMLGdCQUFnQjtRQUNoQixpQkFBaUIsQ0FBQyxHQUFHLFdBQVcsQ0FBQztRQUNqQyxnQkFBZ0IsQ0FBQyxFQUFFLFlBQVksRUFBRSxDQUFDLEVBQUUsQ0FBQztLQUNsQixDQUFDO0FBQ3hCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBUaGUgcGx1Z2luLWVjb3N5c3RlbSBnb3Zlcm5hbmNlIGdhdGUgKGRvY3MvcnVuYm9va3MvZWNvc3lzdGVtLW1vZGVyYXRpb24ubWQpLlxuICpcbiAqIE9ubHkgdGhlIHN5c3RlbSBvcmcgbWFuYWdlcyBvciBhcHByb3ZlcyB0aGUgZWNvc3lzdGVtLiBBIHJvdXRlIHRoYXQgZXhlcmNpc2VzXG4gKiBhIHN5c3RlbS1vcmctb25seSBwZXJtaXNzaW9uIChgcGx1Z2luczptb2RlcmF0ZWAsIGBwdWJsaXNoZXJzOnZlcmlmeWApIG11c3RcbiAqIHRoZXJlZm9yZSBjaGVjayB0aHJlZSB0aGluZ3MsIGFuZCB7QGxpbmsgcmVxdWlyZVN5c3RlbU9yZ1Blcm1pc3Npb259IGNvbXBvc2VzXG4gKiB0aGVtIHNvIG5vIHJvdXRlIGNhbiBmb3JnZXQgb25lOlxuICpcbiAqICAxLiB7QGxpbmsgcmVxdWlyZVN5c3RlbU9yZ30g4oCUIHRoZSBjYWxsZXIncyBBQ1RJVkUgb3JnIGlzIHRoZSBzeXN0ZW0gb3JnLiBBXG4gKiAgICAgdG9rZW4gbWludGVkIGluIGEgdGVuYW50IG9yZyBpcyByZWZ1c2VkIGV2ZW4gZm9yIHRoZSBzYW1lIHBlcnNvbiAoYW5kIGV2ZW5cbiAqICAgICBmb3IgYSBzdXBlcmFkbWluOiB0aGV5IHN3aXRjaCB0byB0aGUgc3lzdGVtIG9yZyB0byBhY3Qgb24gdGhlIGVjb3N5c3RlbSxcbiAqICAgICBzbyBldmVyeSBnb3Zlcm5hbmNlIGRlY2lzaW9uIGlzIHJlY29yZGVkIHdpdGggdGhlIHN5c3RlbSBvcmcncyBpZCkuXG4gKiAgMi4gdGhlIHBlcm1pc3Npb24gaXRzZWxmIChgcmVxdWlyZVBlcm1pc3Npb25gLCBhbnktb2YpO1xuICogIDMuIGFuIE1GQS1ncmFkZSBzZXNzaW9uIChgcmVxdWlyZUFzc3VyYW5jZSh7IG1pbkFzc3VyYW5jZTogMiB9KWApLCB3aGljaCBhbHNvXG4gKiAgICAgcmVmdXNlcyBldmVyeSBtYWNoaW5lIGNyZWRlbnRpYWwuXG4gKlxuICogVGhlIHJvdXRlLWNvdmVyYWdlIGdvdmVybmFuY2UgY2hlY2sgKGBmaW5kU3lzdGVtT3JnR3VhcmRWaW9sYXRpb25zYCBpblxuICogYHRlc3Rpbmcvcm91dGUtY292ZXJhZ2UudHNgKSBmYWlscyBhbnkgcm91dGUgdGhhdCBnYXRlcyBvbiBhIHN5c3RlbS1vcmctb25seVxuICogcGVybWlzc2lvbiB3aXRob3V0IDEgYW5kIDMsIHNvIGEgaGFuZC1yb2xsZWQgY2hhaW4gY2Fubm90IHNsaXAgdGhyb3VnaC5cbiAqL1xuXG5pbXBvcnQgdHlwZSB7IE5leHRGdW5jdGlvbiwgUmVxdWVzdCwgUmVxdWVzdEhhbmRsZXIsIFJlc3BvbnNlIH0gZnJvbSAnZXhwcmVzcyc7XG5pbXBvcnQgeyByZXF1aXJlQXNzdXJhbmNlIH0gZnJvbSAnLi9hc3N1cmFuY2UuanMnO1xuaW1wb3J0IHsgcmVjb3JkQXV0aHpEZW5pYWwsIHJlcXVpcmVQZXJtaXNzaW9uIH0gZnJvbSAnLi9wZXJtaXNzaW9uLWdhdGVzLmpzJztcbmltcG9ydCB7IHRhZ1JvdXRlR2F0ZSB9IGZyb20gJy4vcm91dGUtdGFibGUuanMnO1xuaW1wb3J0IHsgaXNTeXN0ZW1PcmdJZCB9IGZyb20gJy4vc3lzdGVtLW9yZy5qcyc7XG5pbXBvcnQgeyBIdHRwU3RhdHVzIH0gZnJvbSAnLi4vY29uc3RhbnRzL2h0dHAtc3RhdHVzLmpzJztcbmltcG9ydCB7IEVycm9yQ29kZSB9IGZyb20gJy4uL3R5cGVzL2Vycm9yLWNvZGVzLmpzJztcbmltcG9ydCB7IGlzU3lzdGVtT3JnT25seVBlcm1pc3Npb24sIHR5cGUgUGVybWlzc2lvbiB9IGZyb20gJy4uL3R5cGVzL3Blcm1pc3Npb25zLmpzJztcbmltcG9ydCB7IGVtaXRDb3VudGVyIH0gZnJvbSAnLi4vdXRpbHMvbWV0cmljLWVtaXR0ZXIuanMnO1xuaW1wb3J0IHsgc2VuZEVycm9yIH0gZnJvbSAnLi4vdXRpbHMvcmVzcG9uc2UuanMnO1xuXG4vKiogV2hldGhlciB0aGUgcmVxdWVzdCdzIEFDVElWRSBvcmcgKHRoZSB0b2tlbidzIGBvcmdhbml6YXRpb25JZGApIGlzIHRoZSBzeXN0ZW1cbiAqICBvcmcuIENvbXBhcmVkIGJ5IGlkIG9ubHkg4oCUIGFuIG9yZyBtZXJlbHkgTkFNRUQgXCJzeXN0ZW1cIiBuZXZlciBxdWFsaWZpZXMuICovXG5leHBvcnQgZnVuY3Rpb24gaXNTeXN0ZW1PcmdSZXF1ZXN0KHJlcTogUmVxdWVzdCk6IGJvb2xlYW4ge1xuICByZXR1cm4gaXNTeXN0ZW1PcmdJZChyZXEudXNlcj8ub3JnYW5pemF0aW9uSWQpO1xufVxuXG4vKipcbiAqIFJlcXVpcmUgdGhhdCB0aGUgY2FsbGVyJ3MgYWN0aXZlIG9yZyBpcyB0aGUgc3lzdGVtIG9yZy4gQ29tcG9zZSBhZnRlclxuICogYHJlcXVpcmVBdXRoYC4gUmVmdXNhbHMgYXJlIDQwMyBgU1lTVEVNX09SR19SRVFVSVJFRGAsIGNvdW50ZWRcbiAqIChgc3lzdGVtX29yZ19ndWFyZF9yZWZ1c2VkX3RvdGFsYCkgYW5kIGF1ZGl0ZWQgdGhyb3VnaCB0aGUgc2hhcmVkXG4gKiBgYXV0aHouZGVuaWVkYCBzaW5rIChgcmVxdWlyZWQ6ICdzeXN0ZW0tb3JnJ2ApLlxuICovXG5leHBvcnQgY29uc3QgcmVxdWlyZVN5c3RlbU9yZyA9IHRhZ1JvdXRlR2F0ZShmdW5jdGlvbiByZXF1aXJlU3lzdGVtT3JnKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSwgbmV4dDogTmV4dEZ1bmN0aW9uKTogdm9pZCB7XG4gIGlmICghcmVxLnVzZXIpIHtcbiAgICByZXR1cm4gc2VuZEVycm9yKHJlcywgSHR0cFN0YXR1cy5VTkFVVEhPUklaRUQsICdBdXRoZW50aWNhdGlvbiByZXF1aXJlZCcsIEVycm9yQ29kZS5VTkFVVEhPUklaRUQpO1xuICB9XG4gIGlmIChpc1N5c3RlbU9yZ1JlcXVlc3QocmVxKSkgcmV0dXJuIG5leHQoKTtcbiAgZW1pdENvdW50ZXIoJ3N5c3RlbV9vcmdfZ3VhcmRfcmVmdXNlZF90b3RhbCcsIHsgcHJpbmNpcGFsOiByZXEudXNlci5wcmluY2lwYWxUeXBlID8/ICd1bmtub3duJyB9KTtcbiAgcmVjb3JkQXV0aHpEZW5pYWwocmVxLCAnc3lzdGVtLW9yZycpO1xuICByZXR1cm4gc2VuZEVycm9yKFxuICAgIHJlcywgSHR0cFN0YXR1cy5GT1JCSURERU4sXG4gICAgJ1RoaXMgYWN0aW9uIGlzIHJlc2VydmVkIGZvciB0aGUgc3lzdGVtIG9yZ2FuaXphdGlvbiDigJQgc3dpdGNoIHRvIGl0IHRvIG1hbmFnZSB0aGUgcGx1Z2luIGVjb3N5c3RlbScsXG4gICAgRXJyb3JDb2RlLlNZU1RFTV9PUkdfUkVRVUlSRUQsXG4gICk7XG59LCB7IGtpbmQ6ICdzeXN0ZW1PcmcnIH0pO1xuXG4vKipcbiAqIFRIRSBnYXRlIGZvciBhbiBlY29zeXN0ZW0tZ292ZXJuYW5jZSByb3V0ZTogc3lzdGVtIG9yZyArIChhbnkgb2YpIHRoZSBnaXZlblxuICogc3lzdGVtLW9yZy1vbmx5IHBlcm1pc3Npb24ocykgKyBhbiBNRkEtZ3JhZGUgaHVtYW4gc2Vzc2lvbi4gUmV0dXJucyB0aGUgY2hhaW5cbiAqIGFzIGFuIGFycmF5LCB3aGljaCBFeHByZXNzIGZsYXR0ZW5zOlxuICpcbiAqIGBgYHRzXG4gKiByb3V0ZXIucG9zdCgnL3JlcXVlc3RzLzppZC9hcHByb3ZlJywgcmVxdWlyZUF1dGgsIHJlcXVpcmVTeXN0ZW1PcmdQZXJtaXNzaW9uKCdwbHVnaW5zOm1vZGVyYXRlJyksXG4gKiAgIHJlcXVpcmVTdGVwVXAsIGF1ZGl0ZWQoJ3BsdWdpbi5yZXF1ZXN0LmFwcHJvdmUnKSwgaGFuZGxlcik7XG4gKiBgYGBcbiAqXG4gKiBUaHJvd3MgYXQgcm91dGUtZGVmaW5pdGlvbiB0aW1lIHdoZW4gaGFuZGVkIGEgcGVybWlzc2lvbiB0aGF0IGlzIE5PVFxuICogc3lzdGVtLW9yZy1vbmx5IOKAlCBhIHRlbmFudCBwZXJtaXNzaW9uIGJlaGluZCB0aGlzIGdhdGUgd291bGQgYmUgdW5yZWFjaGFibGVcbiAqIGZvciBldmVyeSB0ZW5hbnQsIHdoaWNoIGlzIGFsd2F5cyBhIHdpcmluZyBtaXN0YWtlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVxdWlyZVN5c3RlbU9yZ1Blcm1pc3Npb24oLi4ucGVybWlzc2lvbnM6IFBlcm1pc3Npb25bXSk6IFJlcXVlc3RIYW5kbGVyW10ge1xuICBpZiAocGVybWlzc2lvbnMubGVuZ3RoID09PSAwKSB0aHJvdyBuZXcgRXJyb3IoJ3JlcXVpcmVTeXN0ZW1PcmdQZXJtaXNzaW9uIG5lZWRzIGF0IGxlYXN0IG9uZSBwZXJtaXNzaW9uJyk7XG4gIGNvbnN0IHRlbmFudCA9IHBlcm1pc3Npb25zLmZpbHRlcigocCkgPT4gIWlzU3lzdGVtT3JnT25seVBlcm1pc3Npb24ocCkpO1xuICBpZiAodGVuYW50Lmxlbmd0aCA+IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYHJlcXVpcmVTeXN0ZW1PcmdQZXJtaXNzaW9uIG9ubHkgdGFrZXMgc3lzdGVtLW9yZy1vbmx5IHBlcm1pc3Npb25zOyBnb3QgJHt0ZW5hbnQuam9pbignLCAnKX1gKTtcbiAgfVxuICByZXR1cm4gW1xuICAgIHJlcXVpcmVTeXN0ZW1PcmcsXG4gICAgcmVxdWlyZVBlcm1pc3Npb24oLi4ucGVybWlzc2lvbnMpLFxuICAgIHJlcXVpcmVBc3N1cmFuY2UoeyBtaW5Bc3N1cmFuY2U6IDIgfSksXG4gIF0gYXMgUmVxdWVzdEhhbmRsZXJbXTtcbn1cbiJdfQ==

package/lib/middleware/index.d.ts

@@ -5,8 +5,11 @@ export { requireAssurance, refuseWeakSession, refuseForOrgAdminAssurance, requir
 export { userHasPermission, setAuthzDenialAuditor, recordAuthzDenial, requirePermission, requireAllPermissions, requirePermissionOrService, requireServicePrincipal, requireInternalService, isSystemAdmin, hasScope, requireSystemAdmin, requireFeature, type AuthzDenialInfo, } from './permission-gates.js';
 export { isSystemOrgId, SYSTEM_ORG_ID, SYSTEM_ORG_SLUG, } from './system-org.js';
 export { serviceNameOf, isServiceTokenDenied, signServiceToken, getServiceAuthHeader, isServicePrincipal, isServiceAccountPrincipal, isServicePrincipalNamed, verifyServicePrincipal, } from './service-tokens.js';
-export { requireSystemOrg, requireEcosystemPermission } from './ecosystem-guard.js';
+export { requireSystemOrg, requireSystemOrgPermission } from './ecosystem-guard.js';
 export { mongoSanitize, MAX_SANITIZE_DEPTH, } from './mongo-sanitize.js';
 export { proposable, ASK_PROVENANCE_REFUSED_COUNTER, } from './ask-provenance.js';
 export { requireStepUp, type StepUpMethod, STRONG_STEP_UP_METHODS, } from './step-up.js';
-export { tagRouteGate, getRouteGates, audited, buildRouteTable, isWriteMethod, summarizeRouteTable, type RouteTableEntry, } from './route-table.js';
+export { tagRouteGate, getRouteGates, audited, dynamicAuthz, buildRouteTable, isWriteMethod, summarizeRouteTable, DYNAMIC_PRINCIPALS, type DynamicPrincipal, type RouteTableEntry, } from './route-table.js';
+export { armDeferredQuotaCheck, runDeferredQuotaCheck, } from './deferred-quota-check.js';
+export { ON_BEHALF_HEADER, ON_BEHALF_CALLERS, onBehalfHeaders, onBehalfCaller, type OnBehalfSubject, } from './on-behalf.js';
+export { QUOTA_EXEMPT_ROUTES, isQuotaExemptRoute, type QuotaExemptRoute, } from './quota-exempt-routes.js';

package/lib/middleware/index.js

@@ -7,9 +7,12 @@ export { requireAssurance, refuseWeakSession, refuseForOrgAdminAssurance, requir
 export { userHasPermission, setAuthzDenialAuditor, recordAuthzDenial, requirePermission, requireAllPermissions, requirePermissionOrService, requireServicePrincipal, requireInternalService, isSystemAdmin, hasScope, requireSystemAdmin, requireFeature, } from './permission-gates.js';
 export { isSystemOrgId, SYSTEM_ORG_ID, SYSTEM_ORG_SLUG, } from './system-org.js';
 export { serviceNameOf, isServiceTokenDenied, signServiceToken, getServiceAuthHeader, isServicePrincipal, isServiceAccountPrincipal, isServicePrincipalNamed, verifyServicePrincipal, } from './service-tokens.js';
-export { requireSystemOrg, requireEcosystemPermission } from './ecosystem-guard.js';
+export { requireSystemOrg, requireSystemOrgPermission } from './ecosystem-guard.js';
 export { mongoSanitize, MAX_SANITIZE_DEPTH, } from './mongo-sanitize.js';
 export { proposable, ASK_PROVENANCE_REFUSED_COUNTER, } from './ask-provenance.js';
 export { requireStepUp, STRONG_STEP_UP_METHODS, } from './step-up.js';
-export { tagRouteGate, getRouteGates, audited, buildRouteTable, isWriteMethod, summarizeRouteTable, } from './route-table.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWlkZGxld2FyZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFDTCxhQUFhLEVBQ2IsaUJBQWlCLEVBQ2pCLHNCQUFzQixHQUN2QixNQUFNLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sRUFDTCxXQUFXLEdBQ1osTUFBTSxXQUFXLENBQUM7QUFDbkIsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixvQkFBb0IsR0FDckIsTUFBTSxpQkFBaUIsQ0FBQztBQUN6QixPQUFPLEVBQ0wsZ0JBQWdCLEVBQ2hCLGlCQUFpQixFQUNqQiwwQkFBMEIsRUFDMUIsd0JBQXdCLEdBRXpCLE1BQU0sZ0JBQWdCLENBQUM7QUFDeEIsT0FBTyxFQUNMLGlCQUFpQixFQUNqQixxQkFBcUIsRUFDckIsaUJBQWlCLEVBQ2pCLGlCQUFpQixFQUNqQixxQkFBcUIsRUFDckIsMEJBQTBCLEVBQzFCLHVCQUF1QixFQUN2QixzQkFBc0IsRUFDdEIsYUFBYSxFQUNiLFFBQVEsRUFDUixrQkFBa0IsRUFDbEIsY0FBYyxHQUVmLE1BQU0sdUJBQXVCLENBQUM7QUFDL0IsT0FBTyxFQUNMLGFBQWEsRUFDYixhQUFhLEVBQ2IsZUFBZSxHQUNoQixNQUFNLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sRUFDTCxhQUFhLEVBQ2Isb0JBQW9CLEVBQ3BCLGdCQUFnQixFQUNoQixvQkFBb0IsRUFDcEIsa0JBQWtCLEVBQ2xCLHlCQUF5QixFQUN6Qix1QkFBdUIsRUFDdkIsc0JBQXNCLEdBQ3ZCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsT0FBTyxFQUFFLGdCQUFnQixFQUFFLDBCQUEwQixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDcEYsT0FBTyxFQUNMLGFBQWEsRUFDYixrQkFBa0IsR0FDbkIsTUFBTSxxQkFBcUIsQ0FBQztBQUM3QixPQUFPLEVBQ0wsVUFBVSxFQUNWLDhCQUE4QixHQUMvQixNQUFNLHFCQUFxQixDQUFDO0FBQzdCLE9BQU8sRUFDTCxhQUFhLEVBRWIsc0JBQXNCLEdBQ3ZCLE1BQU0sY0FBYyxDQUFDO0FBQ3RCLE9BQU8sRUFDTCxZQUFZLEVBQ1osYUFBYSxFQUNiLE9BQU8sRUFDUCxlQUFlLEVBQ2YsYUFBYSxFQUNiLG1CQUFtQixHQUVwQixNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmV4cG9ydCB7XG4gIHZlcmlmeVVzZXJKd3QsXG4gIHZlcmlmeUJlYXJlclRva2VuLFxuICBoYXNWYWxpZElkZW50aXR5Q2xhaW1zLFxufSBmcm9tICcuL2p3dC12ZXJpZnkuanMnO1xuZXhwb3J0IHtcbiAgcmVxdWlyZUF1dGgsXG59IGZyb20gJy4vYXV0aC5qcyc7XG5leHBvcnQge1xuICBzZXRUb2tlblJldm9jYXRpb25TdG9yZSxcbiAgaXNBY2Nlc3NUb2tlblJldm9rZWQsXG59IGZyb20gJy4vcmV2b2NhdGlvbi5qcyc7XG5leHBvcnQge1xuICByZXF1aXJlQXNzdXJhbmNlLFxuICByZWZ1c2VXZWFrU2Vzc2lvbixcbiAgcmVmdXNlRm9yT3JnQWRtaW5Bc3N1cmFuY2UsXG4gIHJlcXVpcmVPcmdBZG1pbkFzc3VyYW5jZSxcbiAgdHlwZSBBc3N1cmFuY2VPcHRpb25zLFxufSBmcm9tICcuL2Fzc3VyYW5jZS5qcyc7XG5leHBvcnQge1xuICB1c2VySGFzUGVybWlzc2lvbixcbiAgc2V0QXV0aHpEZW5pYWxBdWRpdG9yLFxuICByZWNvcmRBdXRoekRlbmlhbCxcbiAgcmVxdWlyZVBlcm1pc3Npb24sXG4gIHJlcXVpcmVBbGxQZXJtaXNzaW9ucyxcbiAgcmVxdWlyZVBlcm1pc3Npb25PclNlcnZpY2UsXG4gIHJlcXVpcmVTZXJ2aWNlUHJpbmNpcGFsLFxuICByZXF1aXJlSW50ZXJuYWxTZXJ2aWNlLFxuICBpc1N5c3RlbUFkbWluLFxuICBoYXNTY29wZSxcbiAgcmVxdWlyZVN5c3RlbUFkbWluLFxuICByZXF1aXJlRmVhdHVyZSxcbiAgdHlwZSBBdXRoekRlbmlhbEluZm8sXG59IGZyb20gJy4vcGVybWlzc2lvbi1nYXRlcy5qcyc7XG5leHBvcnQge1xuICBpc1N5c3RlbU9yZ0lkLFxuICBTWVNURU1fT1JHX0lELFxuICBTWVNURU1fT1JHX1NMVUcsXG59IGZyb20gJy4vc3lzdGVtLW9yZy5qcyc7XG5leHBvcnQge1xuICBzZXJ2aWNlTmFtZU9mLFxuICBpc1NlcnZpY2VUb2tlbkRlbmllZCxcbiAgc2lnblNlcnZpY2VUb2tlbixcbiAgZ2V0U2VydmljZUF1dGhIZWFkZXIsXG4gIGlzU2VydmljZVByaW5jaXBhbCxcbiAgaXNTZXJ2aWNlQWNjb3VudFByaW5jaXBhbCxcbiAgaXNTZXJ2aWNlUHJpbmNpcGFsTmFtZWQsXG4gIHZlcmlmeVNlcnZpY2VQcmluY2lwYWwsXG59IGZyb20gJy4vc2VydmljZS10b2tlbnMuanMnO1xuZXhwb3J0IHsgcmVxdWlyZVN5c3RlbU9yZywgcmVxdWlyZUVjb3N5c3RlbVBlcm1pc3Npb24gfSBmcm9tICcuL2Vjb3N5c3RlbS1ndWFyZC5qcyc7XG5leHBvcnQge1xuICBtb25nb1Nhbml0aXplLFxuICBNQVhfU0FOSVRJWkVfREVQVEgsXG59IGZyb20gJy4vbW9uZ28tc2FuaXRpemUuanMnO1xuZXhwb3J0IHtcbiAgcHJvcG9zYWJsZSxcbiAgQVNLX1BST1ZFTkFOQ0VfUkVGVVNFRF9DT1VOVEVSLFxufSBmcm9tICcuL2Fzay1wcm92ZW5hbmNlLmpzJztcbmV4cG9ydCB7XG4gIHJlcXVpcmVTdGVwVXAsXG4gIHR5cGUgU3RlcFVwTWV0aG9kLFxuICBTVFJPTkdfU1RFUF9VUF9NRVRIT0RTLFxufSBmcm9tICcuL3N0ZXAtdXAuanMnO1xuZXhwb3J0IHtcbiAgdGFnUm91dGVHYXRlLFxuICBnZXRSb3V0ZUdhdGVzLFxuICBhdWRpdGVkLFxuICBidWlsZFJvdXRlVGFibGUsXG4gIGlzV3JpdGVNZXRob2QsXG4gIHN1bW1hcml6ZVJvdXRlVGFibGUsXG4gIHR5cGUgUm91dGVUYWJsZUVudHJ5LFxufSBmcm9tICcuL3JvdXRlLXRhYmxlLmpzJztcbiJdfQ==
+export { tagRouteGate, getRouteGates, audited, dynamicAuthz, buildRouteTable, isWriteMethod, summarizeRouteTable, DYNAMIC_PRINCIPALS, } from './route-table.js';
+export { armDeferredQuotaCheck, runDeferredQuotaCheck, } from './deferred-quota-check.js';
+export { ON_BEHALF_HEADER, ON_BEHALF_CALLERS, onBehalfHeaders, onBehalfCaller, } from './on-behalf.js';
+export { QUOTA_EXEMPT_ROUTES, isQuotaExemptRoute, } from './quota-exempt-routes.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbWlkZGxld2FyZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFDTCxhQUFhLEVBQ2IsaUJBQWlCLEVBQ2pCLHNCQUFzQixHQUN2QixNQUFNLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sRUFDTCxXQUFXLEdBQ1osTUFBTSxXQUFXLENBQUM7QUFDbkIsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixvQkFBb0IsR0FDckIsTUFBTSxpQkFBaUIsQ0FBQztBQUN6QixPQUFPLEVBQ0wsZ0JBQWdCLEVBQ2hCLGlCQUFpQixFQUNqQiwwQkFBMEIsRUFDMUIsd0JBQXdCLEdBRXpCLE1BQU0sZ0JBQWdCLENBQUM7QUFDeEIsT0FBTyxFQUNMLGlCQUFpQixFQUNqQixxQkFBcUIsRUFDckIsaUJBQWlCLEVBQ2pCLGlCQUFpQixFQUNqQixxQkFBcUIsRUFDckIsMEJBQTBCLEVBQzFCLHVCQUF1QixFQUN2QixzQkFBc0IsRUFDdEIsYUFBYSxFQUNiLFFBQVEsRUFDUixrQkFBa0IsRUFDbEIsY0FBYyxHQUVmLE1BQU0sdUJBQXVCLENBQUM7QUFDL0IsT0FBTyxFQUNMLGFBQWEsRUFDYixhQUFhLEVBQ2IsZUFBZSxHQUNoQixNQUFNLGlCQUFpQixDQUFDO0FBQ3pCLE9BQU8sRUFDTCxhQUFhLEVBQ2Isb0JBQW9CLEVBQ3BCLGdCQUFnQixFQUNoQixvQkFBb0IsRUFDcEIsa0JBQWtCLEVBQ2xCLHlCQUF5QixFQUN6Qix1QkFBdUIsRUFDdkIsc0JBQXNCLEdBQ3ZCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsT0FBTyxFQUFFLGdCQUFnQixFQUFFLDBCQUEwQixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDcEYsT0FBTyxFQUNMLGFBQWEsRUFDYixrQkFBa0IsR0FDbkIsTUFBTSxxQkFBcUIsQ0FBQztBQUM3QixPQUFPLEVBQ0wsVUFBVSxFQUNWLDhCQUE4QixHQUMvQixNQUFNLHFCQUFxQixDQUFDO0FBQzdCLE9BQU8sRUFDTCxhQUFhLEVBRWIsc0JBQXNCLEdBQ3ZCLE1BQU0sY0FBYyxDQUFDO0FBQ3RCLE9BQU8sRUFDTCxZQUFZLEVBQ1osYUFBYSxFQUNiLE9BQU8sRUFDUCxZQUFZLEVBQ1osZUFBZSxFQUNmLGFBQWEsRUFDYixtQkFBbUIsRUFDbkIsa0JBQWtCLEdBR25CLE1BQU0sa0JBQWtCLENBQUM7QUFDMUIsT0FBTyxFQUNMLHFCQUFxQixFQUNyQixxQkFBcUIsR0FDdEIsTUFBTSwyQkFBMkIsQ0FBQztBQUNuQyxPQUFPLEVBQ0wsZ0JBQWdCLEVBQ2hCLGlCQUFpQixFQUNqQixlQUFlLEVBQ2YsY0FBYyxHQUVmLE1BQU0sZ0JBQWdCLENBQUM7QUFDeEIsT0FBTyxFQUNMLG1CQUFtQixFQUNuQixrQkFBa0IsR0FFbkIsTUFBTSwwQkFBMEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5leHBvcnQge1xuICB2ZXJpZnlVc2VySnd0LFxuICB2ZXJpZnlCZWFyZXJUb2tlbixcbiAgaGFzVmFsaWRJZGVudGl0eUNsYWltcyxcbn0gZnJvbSAnLi9qd3QtdmVyaWZ5LmpzJztcbmV4cG9ydCB7XG4gIHJlcXVpcmVBdXRoLFxufSBmcm9tICcuL2F1dGguanMnO1xuZXhwb3J0IHtcbiAgc2V0VG9rZW5SZXZvY2F0aW9uU3RvcmUsXG4gIGlzQWNjZXNzVG9rZW5SZXZva2VkLFxufSBmcm9tICcuL3Jldm9jYXRpb24uanMnO1xuZXhwb3J0IHtcbiAgcmVxdWlyZUFzc3VyYW5jZSxcbiAgcmVmdXNlV2Vha1Nlc3Npb24sXG4gIHJlZnVzZUZvck9yZ0FkbWluQXNzdXJhbmNlLFxuICByZXF1aXJlT3JnQWRtaW5Bc3N1cmFuY2UsXG4gIHR5cGUgQXNzdXJhbmNlT3B0aW9ucyxcbn0gZnJvbSAnLi9hc3N1cmFuY2UuanMnO1xuZXhwb3J0IHtcbiAgdXNlckhhc1Blcm1pc3Npb24sXG4gIHNldEF1dGh6RGVuaWFsQXVkaXRvcixcbiAgcmVjb3JkQXV0aHpEZW5pYWwsXG4gIHJlcXVpcmVQZXJtaXNzaW9uLFxuICByZXF1aXJlQWxsUGVybWlzc2lvbnMsXG4gIHJlcXVpcmVQZXJtaXNzaW9uT3JTZXJ2aWNlLFxuICByZXF1aXJlU2VydmljZVByaW5jaXBhbCxcbiAgcmVxdWlyZUludGVybmFsU2VydmljZSxcbiAgaXNTeXN0ZW1BZG1pbixcbiAgaGFzU2NvcGUsXG4gIHJlcXVpcmVTeXN0ZW1BZG1pbixcbiAgcmVxdWlyZUZlYXR1cmUsXG4gIHR5cGUgQXV0aHpEZW5pYWxJbmZvLFxufSBmcm9tICcuL3Blcm1pc3Npb24tZ2F0ZXMuanMnO1xuZXhwb3J0IHtcbiAgaXNTeXN0ZW1PcmdJZCxcbiAgU1lTVEVNX09SR19JRCxcbiAgU1lTVEVNX09SR19TTFVHLFxufSBmcm9tICcuL3N5c3RlbS1vcmcuanMnO1xuZXhwb3J0IHtcbiAgc2VydmljZU5hbWVPZixcbiAgaXNTZXJ2aWNlVG9rZW5EZW5pZWQsXG4gIHNpZ25TZXJ2aWNlVG9rZW4sXG4gIGdldFNlcnZpY2VBdXRoSGVhZGVyLFxuICBpc1NlcnZpY2VQcmluY2lwYWwsXG4gIGlzU2VydmljZUFjY291bnRQcmluY2lwYWwsXG4gIGlzU2VydmljZVByaW5jaXBhbE5hbWVkLFxuICB2ZXJpZnlTZXJ2aWNlUHJpbmNpcGFsLFxufSBmcm9tICcuL3NlcnZpY2UtdG9rZW5zLmpzJztcbmV4cG9ydCB7IHJlcXVpcmVTeXN0ZW1PcmcsIHJlcXVpcmVTeXN0ZW1PcmdQZXJtaXNzaW9uIH0gZnJvbSAnLi9lY29zeXN0ZW0tZ3VhcmQuanMnO1xuZXhwb3J0IHtcbiAgbW9uZ29TYW5pdGl6ZSxcbiAgTUFYX1NBTklUSVpFX0RFUFRILFxufSBmcm9tICcuL21vbmdvLXNhbml0aXplLmpzJztcbmV4cG9ydCB7XG4gIHByb3Bvc2FibGUsXG4gIEFTS19QUk9WRU5BTkNFX1JFRlVTRURfQ09VTlRFUixcbn0gZnJvbSAnLi9hc2stcHJvdmVuYW5jZS5qcyc7XG5leHBvcnQge1xuICByZXF1aXJlU3RlcFVwLFxuICB0eXBlIFN0ZXBVcE1ldGhvZCxcbiAgU1RST05HX1NURVBfVVBfTUVUSE9EUyxcbn0gZnJvbSAnLi9zdGVwLXVwLmpzJztcbmV4cG9ydCB7XG4gIHRhZ1JvdXRlR2F0ZSxcbiAgZ2V0Um91dGVHYXRlcyxcbiAgYXVkaXRlZCxcbiAgZHluYW1pY0F1dGh6LFxuICBidWlsZFJvdXRlVGFibGUsXG4gIGlzV3JpdGVNZXRob2QsXG4gIHN1bW1hcml6ZVJvdXRlVGFibGUsXG4gIERZTkFNSUNfUFJJTkNJUEFMUyxcbiAgdHlwZSBEeW5hbWljUHJpbmNpcGFsLFxuICB0eXBlIFJvdXRlVGFibGVFbnRyeSxcbn0gZnJvbSAnLi9yb3V0ZS10YWJsZS5qcyc7XG5leHBvcnQge1xuICBhcm1EZWZlcnJlZFF1b3RhQ2hlY2ssXG4gIHJ1bkRlZmVycmVkUXVvdGFDaGVjayxcbn0gZnJvbSAnLi9kZWZlcnJlZC1xdW90YS1jaGVjay5qcyc7XG5leHBvcnQge1xuICBPTl9CRUhBTEZfSEVBREVSLFxuICBPTl9CRUhBTEZfQ0FMTEVSUyxcbiAgb25CZWhhbGZIZWFkZXJzLFxuICBvbkJlaGFsZkNhbGxlcixcbiAgdHlwZSBPbkJlaGFsZlN1YmplY3QsXG59IGZyb20gJy4vb24tYmVoYWxmLmpzJztcbmV4cG9ydCB7XG4gIFFVT1RBX0VYRU1QVF9ST1VURVMsXG4gIGlzUXVvdGFFeGVtcHRSb3V0ZSxcbiAgdHlwZSBRdW90YUV4ZW1wdFJvdXRlLFxufSBmcm9tICcuL3F1b3RhLWV4ZW1wdC1yb3V0ZXMuanMnO1xuIl19

package/lib/middleware/on-behalf.d.ts

@@ -0,0 +1,37 @@
+import type { Request } from 'express';
+/** The header carrying the signed on-behalf marker (lower-case, as Node reads it). */
+export declare const ON_BEHALF_HEADER = "x-pb-on-behalf";
+/**
+ * Services whose on-behalf marker is honoured: the ones that forward a user's
+ * token as a matter of design. A marker signed by any other service — valid
+ * signature or not — is ignored, so a compromised peer that never forwards user
+ * tokens cannot start waiving its tenants' meters.
+ */
+export declare const ON_BEHALF_CALLERS: readonly string[];
+/** Who a marker vouches for. Defaults to the ambient request's verified principal. */
+export interface OnBehalfSubject {
+    /** The user (`sub`) whose token rides the same request. */
+    sub: string;
+    /** Their active org. */
+    organizationId: string;
+}
+/**
+ * Headers to add beside a forwarded user `Authorization` so the peer does not
+ * bill the hop a second time. Mint per call (the marker expires in 120 s).
+ *
+ * The subject defaults to the ambient audit context's VERIFIED principal (the
+ * inbound request this call serves). Returns `{}` — the hop is billed normally,
+ * the safe direction — when there is no user principal to vouch for, or when
+ * this process cannot sign (no service key).
+ */
+export declare function onBehalfHeaders(subject?: OnBehalfSubject): Record<string, string>;
+/**
+ * The internal service that vouched for this request with a VALID on-behalf
+ * marker, else `undefined`. Requires the request to be authenticated (`req.user`
+ * set by requireAuth) — the marker is only meaningful against a verified user.
+ *
+ * Every rejection of a PRESENT header is counted on
+ * `quota_on_behalf_rejected_total{reason}`: a forged header from a user lands
+ * there as `invalid` (no service key signs it), and the request is billed.
+ */
+export declare function onBehalfCaller(req: Request): string | undefined;