@pipeline-builder/api-server 0.0.1

package/lib/api/app-factory.js

@@ -0,0 +1,328 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { sendSuccess, sendError, generateOpenApiSpec, ErrorCode, createLogger, verifyServicePrincipal, createHealthRouter, setCounterEmitter, safeCreateRequire, requireAuth } from '@pipeline-builder/api-core';
+import { Config, CoreConstants } from '@pipeline-builder/pipeline-core';
+import { getConnection } from '@pipeline-builder/pipeline-data';
+import compression from 'compression';
+import cors from 'cors';
+import express, {} from 'express';
+import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
+import helmet from 'helmet';
+import swaggerUi from 'swagger-ui-express';
+import { v7 as uuid } from 'uuid';
+import { etagMiddleware } from './etag-middleware.js';
+import { createEnvRedisIdempotencyStore, setIdempotencyStore } from './idempotency-middleware.js';
+import { metricsMiddleware, metricsHandler, incCounter } from './metrics.js';
+import { readinessGuard } from './readiness.js';
+import { SSEManager, SSE_REQUEST_ID_RE } from '../http/sse-connection-manager.js';
+import { createEnvRedisSSERelay } from '../http/sse-relay.js';
+import { createEnvRedisTicketStore } from '../http/sse-ticket-store.js';
+// Wire api-core's counter shim to the real prom-client registry. This is
+// a no-op until incCounter is called for the first time (lazy registration
+// in metrics.ts), and lets api-core helpers like the quota client record
+// `quota_fail_open_total` without taking a hard dep on api-server.
+setCounterEmitter(incCounter);
+/**
+ * Create and configure an Express application with common middleware
+ *
+ * Sets up:
+ * - CORS with configured origins
+ * - Helmet security headers
+ * - Rate limiting
+ * - JSON and URL-encoded body parsing
+ * - Trust proxy settings
+ * - Health check endpoint (/health)
+ * - Metrics endpoint (/metrics)
+ * - SSE logs endpoint (/logs/:requestId)
+ *
+ * @param options - Configuration options
+ * @returns Configured Express app and SSE manager
+ *
+ * @example
+ * ```typescript
+ * const { app, sseManager } = createApp();
+ *
+ * app.post('/api/resource', requireAuth, async (req, res) => {
+ *   // Your route handler
+ * });
+ *
+ * startServer(app, { name: 'My Service' });
+ * ```
+ */
+export function createApp(options = {}) {
+    const { enableCors = true, enableHelmet = true, enableRateLimit = true, enableJsonBody = true, jsonLimit = '1mb', enableUrlEncoded = true, urlEncodedLimit = '1mb', 
+    // Default SSE manager wired to the shared env Redis ticket/ownership store
+    // when Redis is configured (multi-pod correctness + cross-service stream
+    // ownership), else the in-memory default. A caller-supplied `sseManager`
+    // skips this entirely.
+    sseManager = new SSEManager({
+        ticketStore: createEnvRedisTicketStore() ?? undefined,
+        relay: createEnvRedisSSERelay() ?? undefined,
+    }), checkDependencies, enableOpenApi = true, openApiOptions, enableCompression = true, warmupHooks = [], idempotencyStore, } = options;
+    // Fail fast if JWT_SECRET is not configured — prevents silent auth failures at runtime
+    if (!process.env.JWT_SECRET) {
+        throw new Error('JWT_SECRET environment variable is required. Set it before starting the server.');
+    }
+    // Wire the idempotency replay-cache backend used by the post-auth route
+    // factories (createProtectedRoute / createAuthenticatedWithOrgRoute). Prefer
+    // an explicitly injected store; otherwise auto-construct from the shared env
+    // Redis so keyed mutation retries dedupe across replicas. Falls back to the
+    // in-memory default when no Redis is configured (single-replica correctness).
+    const resolvedIdempotencyStore = idempotencyStore ?? createEnvRedisIdempotencyStore();
+    if (resolvedIdempotencyStore) {
+        setIdempotencyStore(resolvedIdempotencyStore);
+    }
+    // OpenTelemetry is NOT initialized here: by the time createApp runs, express
+    // and http have already been required, so the auto-instrumentation hooks
+    // would have nothing to patch (no inbound span → no trace id). Tracing is
+    // started by the `otel-bootstrap.js` preload instead (node -r … — see each
+    // service's Dockerfile CMD / start script), which runs before any
+    // instrumented module loads. `currentTraceId()` then reads the active span.
+    const serverConfig = Config.get('server');
+    const app = express();
+    // Security middleware.
+    //
+    // Swagger UI needs unsafe-inline + unsafe-eval for its bundled scripts —
+    // but we only relax CSP that far when (a) OpenAPI is enabled AND (b) we're
+    // not in production. In prod, Swagger should be served behind a separate
+    // host or auth-gated route; the main app keeps the strict CSP so a Stored
+    // XSS in any handler can't `eval()` arbitrary script.
+    const isProduction = process.env.NODE_ENV === 'production';
+    const allowSwaggerCsp = enableOpenApi && !isProduction;
+    if (enableHelmet) {
+        app.use(helmet({
+            contentSecurityPolicy: {
+                directives: {
+                    defaultSrc: ["'self'"],
+                    scriptSrc: allowSwaggerCsp
+                        ? ["'self'", "'unsafe-inline'", "'unsafe-eval'"]
+                        : ["'self'"],
+                    styleSrc: ["'self'", "'unsafe-inline'"],
+                    imgSrc: ["'self'", 'data:', 'blob:'],
+                    connectSrc: ["'self'"],
+                    fontSrc: ["'self'"],
+                    objectSrc: ["'none'"],
+                    frameAncestors: ["'none'"],
+                    baseUri: ["'self'"],
+                    formAction: ["'self'"],
+                },
+            },
+        }));
+    }
+    if (enableCors) {
+        app.use(cors(serverConfig.cors));
+    }
+    // Response compression (gzip/deflate) — skip SSE streams
+    if (enableCompression) {
+        app.use(compression({
+            filter: (req, res) => {
+                // Don't compress SSE streams. Match by inclusion: the Accept header is
+                // often a list (e.g. "text/event-stream, */*"), so exact equality missed
+                // those and compressed/buffered the stream.
+                if ((req.headers.accept || '').includes('text/event-stream'))
+                    return false;
+                return compression.filter(req, res);
+            },
+            threshold: CoreConstants.COMPRESSION_THRESHOLD_BYTES,
+        }));
+    }
+    // ETag support for conditional GET requests (304 Not Modified)
+    app.use(etagMiddleware());
+    // Body parsing
+    if (enableJsonBody) {
+        const jsonParser = express.json({ limit: jsonLimit });
+        const exclude = options.jsonBodyExclude ?? [];
+        if (exclude.length > 0) {
+            // Skip the global JSON parser for raw-body paths so a per-path `express.raw()`
+            // can read the exact bytes (see `jsonBodyExclude`).
+            app.use((req, res, next) => (exclude.some((p) => req.path.startsWith(p)) ? next() : jsonParser(req, res, next)));
+        }
+        else {
+            app.use(jsonParser);
+        }
+    }
+    if (enableUrlEncoded) {
+        app.use(express.urlencoded({ extended: true, limit: urlEncodedLimit }));
+    }
+    // Trust proxy (must be set before rate limiter so req.ip resolves correctly)
+    app.set('trust proxy', serverConfig.trustProxy);
+    // Request ID — prefer existing header from nginx, otherwise generate one
+    app.use((req, res, next) => {
+        const hdr = req.headers['x-request-id'];
+        const requestId = (Array.isArray(hdr) ? hdr[0] : hdr) || uuid();
+        req.requestId = requestId;
+        res.setHeader('X-Request-Id', requestId);
+        next();
+    });
+    // Health check registered before rate limiter so it is never throttled
+    app.use(createHealthRouter({
+        serviceName: process.env.SERVICE_NAME || 'api',
+        checkDependencies,
+    }));
+    // Readiness guard — 503s business traffic while the service is NotReady
+    // (datastore still connecting at startup, or dropped). Mounted right after
+    // the health router and before everything else so a NotReady request is
+    // rejected cheaply, before rate-limit / idempotency / business handlers ever
+    // touch a disconnected datastore. It allowlists the infra endpoints
+    // (/metrics, /warmup, /docs, /logs) registered below, plus /health + /ready.
+    app.use(readinessGuard());
+    // Warm-up endpoint — pre-opens connection pools so the first real request
+    // doesn't pay cold-start latency. Always pings Postgres; services using
+    // Mongo / Redis / SQS pass `warmupHooks` so those are warmed in parallel.
+    app.get('/warmup', async (_req, res) => {
+        try {
+            await Promise.all([
+                getConnection().testConnection(),
+                ...warmupHooks.map((hook) => hook()),
+            ]);
+            sendSuccess(res, 200, { warmed: true, hooks: warmupHooks.length });
+        }
+        catch {
+            sendError(res, 503, 'Warmup failed');
+        }
+    });
+    // Prometheus metrics endpoint — always registered (never throttled)
+    app.get('/metrics', metricsHandler());
+    // OpenAPI spec and Swagger UI (registered before rate limiter)
+    if (enableOpenApi) {
+        const spec = generateOpenApiSpec(openApiOptions);
+        app.get('/docs/openapi.json', (_req, res) => {
+            res.json(spec);
+        });
+        app.use('/docs', swaggerUi.serve, swaggerUi.setup(spec, {
+            customSiteTitle: openApiOptions?.title ?? 'Pipeline Builder API Docs',
+        }));
+    }
+    // Rate limiting — uses Redis when redisUrl is provided for shared state across instances
+    if (enableRateLimit) {
+        const rateLimitConfig = Config.get('rateLimit');
+        const rateLimitOptions = {
+            max: rateLimitConfig.max,
+            windowMs: rateLimitConfig.windowMs,
+            standardHeaders: true,
+            legacyHeaders: false,
+            // Skip rate limiting only for CRYPTOGRAPHICALLY-VERIFIED internal service
+            // callers. The limiter runs before requireAuth, so the previously-trusted
+            // plaintext `x-internal-service` header was spoofable by any external
+            // client → total bypass. verifyServicePrincipal verifies the signed
+            // service JWT instead; inter-service callers all send one
+            // (getServiceAuthHeader).
+            skip: (req) => verifyServicePrincipal(req),
+            // Key on client IP only. The limiter runs pre-auth, so `req.user` is unset
+            // and any org id would come from the caller-supplied `x-org-id` header —
+            // spoofable, letting an attacker rotate values to evade the bucket or
+            // flood a victim org's bucket. ipKeyGenerator normalizes IPv6 to a /64
+            // prefix (also required by express-rate-limit 8.x's validator).
+            keyGenerator: (req) => ipKeyGenerator(req.ip || 'anon', 64),
+            handler: (_req, res) => {
+                sendError(res, 429, 'Too many requests, please try again later.', ErrorCode.RATE_LIMIT_EXCEEDED);
+            },
+        };
+        // Use Redis store when available for shared state across instances
+        if (options.redisUrl) {
+            try {
+                // ESM has no global `require`; safeCreateRequire loads the optional
+                // redis deps synchronously here (only when a redisUrl is configured).
+                // (CJS-bundle safe — see api-core's safe-require.ts.)
+                const require = safeCreateRequire(import.meta.url);
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { RedisStore } = require('rate-limit-redis');
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const Redis = require('ioredis');
+                const redisClient = new Redis(options.redisUrl);
+                // ioredis emits 'error' on connection loss; without a listener Node
+                // treats it as an unhandled 'error' event and CRASHES the process. Log
+                // and let ioredis auto-reconnect (rate limiting falls back per-store).
+                redisClient.on('error', (e) => createLogger('rate-limit').warn('Redis rate-limit store error', { error: e instanceof Error ? e.message : String(e) }));
+                rateLimitOptions.store = new RedisStore({
+                    sendCommand: (...args) => redisClient.call(...args),
+                });
+            }
+            catch {
+                createLogger('rate-limit').warn('Redis store unavailable, falling back to in-memory rate limiting');
+            }
+        }
+        app.use(rateLimit(rateLimitOptions));
+    }
+    // Express request timeout — uses CoreConstants to share the same default as Lambda handlers
+    const timeoutMs = CoreConstants.HANDLER_TIMEOUT_MS;
+    app.use((_req, res, next) => {
+        res.setTimeout(timeoutMs, () => {
+            if (!res.headersSent) {
+                sendError(res, 503, 'Request timeout');
+            }
+        });
+        next();
+    });
+    // Request duration logging
+    const durationLogger = createLogger('request-duration');
+    app.use((req, res, next) => {
+        const start = Date.now();
+        res.on('finish', () => {
+            const duration = Date.now() - start;
+            // Log `req.path` (no query string) — a stray `?token=`/`?ticket=` must not be
+            // persisted verbatim on every request (mirrors the authz-denial auditor's strip).
+            durationLogger.info(`${req.method} ${req.path} ${res.statusCode} ${duration}ms`, {
+                method: req.method,
+                path: req.path,
+                statusCode: res.statusCode,
+                durationMs: duration,
+                requestId: req.requestId,
+            });
+        });
+        next();
+    });
+    // Prometheus metrics middleware — records request duration and count
+    app.use(metricsMiddleware());
+    // NOTE: idempotency is intentionally NOT mounted here. It needs the VERIFIED
+    // org id to namespace its replay cache, but this pre-auth position runs before
+    // `requireAuth`/`attachRequestContext` populate identity, so a global mount
+    // here is a permanent no-op (org always undefined → skip). It is instead wired
+    // into the post-auth route chains — see `createProtectedRoute` /
+    // `createAuthenticatedWithOrgRoute` in middleware-factory.ts.
+    // SSE logs endpoint — ticket-gated (Wave 2b).
+    // The stream carries per-org build logs, so it must not be world-readable.
+    // Clients first POST /logs/ticket (JWT-authenticated) to mint a short-lived,
+    // single-use ticket bound to their org AND to the specific `requestId` stream
+    // they intend to open, then open the EventSource with ?ticket=<t>. This keeps
+    // the JWT out of query strings / access logs while enforcing org ownership,
+    // per-subject authorization, and the per-org connection cap on the stream.
+    // Mirrors the message-service notifications SSE ticket exchange.
+    app.post('/logs/ticket', requireAuth, async (req, res) => {
+        const orgId = req.user?.organizationId?.toLowerCase();
+        if (!orgId) {
+            sendError(res, 400, 'Token missing organization', ErrorCode.VALIDATION_ERROR);
+            return;
+        }
+        // The caller must name the stream subject up front so the ticket is bound to
+        // it. Without this, a ticket could be replayed against ANY requestId the
+        // org could guess, letting it attach to another org's log stream. Strictly
+        // format-validated so it can't carry an injection payload into the subject.
+        const requestId = req.body?.requestId;
+        if (typeof requestId !== 'string' || !SSE_REQUEST_ID_RE.test(requestId)) {
+            sendError(res, 400, 'Missing or invalid requestId', ErrorCode.VALIDATION_ERROR);
+            return;
+        }
+        const result = await sseManager.createTicket(orgId, requestId);
+        if (!result.ok) {
+            if (result.reason === 'forbidden') {
+                // The subject is owned by another org — do not confirm it exists; a plain
+                // 403 is enough and leaks nothing about which requestIds are live.
+                sendError(res, 403, 'Not authorized for this log stream', ErrorCode.INSUFFICIENT_PERMISSIONS);
+            }
+            else if (result.reason === 'org-limit') {
+                sendError(res, 429, 'Too many log stream tickets issued', ErrorCode.QUOTA_EXCEEDED);
+            }
+            else {
+                sendError(res, 503, 'Log streaming subsystem at capacity', ErrorCode.QUOTA_EXCEEDED);
+            }
+            return;
+        }
+        sendSuccess(res, 200, { ticket: result.ticket });
+    });
+    // The stream itself resolves + consumes the ticket inside middleware() and
+    // rejects any anonymous / invalid / expired / already-used ticket with 401.
+    app.get('/logs/:requestId', sseManager.middleware());
+    return { app, sseManager };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLWZhY3RvcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpL2FwcC1mYWN0b3J5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsbUJBQW1CLEVBQUUsU0FBUyxFQUFFLFlBQVksRUFBRSxzQkFBc0IsRUFBRSxrQkFBa0IsRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUVqTixPQUFPLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3hFLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUNoRSxPQUFPLFdBQVcsTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQ3hCLE9BQU8sT0FBTyxFQUFFLEVBQWdFLE1BQU0sU0FBUyxDQUFDO0FBQ2hHLE9BQU8sU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDL0QsT0FBTyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQzVCLE9BQU8sU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQzNDLE9BQU8sRUFBRSxFQUFFLElBQUksSUFBSSxFQUFFLE1BQU0sTUFBTSxDQUFDO0FBQ2xDLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUN0RCxPQUFPLEVBQUUsOEJBQThCLEVBQUUsbUJBQW1CLEVBQXlCLE1BQU0sNkJBQTZCLENBQUM7QUFDekgsT0FBTyxFQUFFLGlCQUFpQixFQUFFLGNBQWMsRUFBRSxVQUFVLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDN0UsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ2hELE9BQU8sRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxtQ0FBbUMsQ0FBQztBQUNsRixPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUM5RCxPQUFPLEVBQUUseUJBQXlCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUV4RSx5RUFBeUU7QUFDekUsMkVBQTJFO0FBQzNFLHlFQUF5RTtBQUN6RSxtRUFBbUU7QUFDbkUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLENBQUM7QUFtRTlCOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQTBCRztBQUNILE1BQU0sVUFBVSxTQUFTLENBQUMsT0FBTyxHQUFxQixFQUFFO0lBQ3RELE1BQU0sRUFDSixVQUFVLEdBQUcsSUFBSSxFQUNqQixZQUFZLEdBQUcsSUFBSSxFQUNuQixlQUFlLEdBQUcsSUFBSSxFQUN0QixjQUFjLEdBQUcsSUFBSSxFQUNyQixTQUFTLEdBQUcsS0FBSyxFQUNqQixnQkFBZ0IsR0FBRyxJQUFJLEVBQ3ZCLGVBQWUsR0FBRyxLQUFLO0lBQ3ZCLDJFQUEyRTtJQUMzRSx5RUFBeUU7SUFDekUseUVBQXlFO0lBQ3pFLHVCQUF1QjtJQUN2QixVQUFVLEdBQUcsSUFBSSxVQUFVLENBQUM7UUFDMUIsV0FBVyxFQUFFLHlCQUF5QixFQUFFLElBQUksU0FBUztRQUNyRCxLQUFLLEVBQUUsc0JBQXNCLEVBQUUsSUFBSSxTQUFTO0tBQzdDLENBQUMsRUFDRixpQkFBaUIsRUFDakIsYUFBYSxHQUFHLElBQUksRUFDcEIsY0FBYyxFQUNkLGlCQUFpQixHQUFHLElBQUksRUFDeEIsV0FBVyxHQUFHLEVBQUUsRUFDaEIsZ0JBQWdCLEdBQ2pCLEdBQUcsT0FBTyxDQUFDO0lBRVosdUZBQXVGO0lBQ3ZGLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsaUZBQWlGLENBQUMsQ0FBQztJQUNyRyxDQUFDO0lBRUQsd0VBQXdFO0lBQ3hFLDZFQUE2RTtJQUM3RSw2RUFBNkU7SUFDN0UsNEVBQTRFO0lBQzVFLDhFQUE4RTtJQUM5RSxNQUFNLHdCQUF3QixHQUFHLGdCQUFnQixJQUFJLDhCQUE4QixFQUFFLENBQUM7SUFDdEYsSUFBSSx3QkFBd0IsRUFBRSxDQUFDO1FBQzdCLG1CQUFtQixDQUFDLHdCQUF3QixDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUVELDZFQUE2RTtJQUM3RSx5RUFBeUU7SUFDekUsMEVBQTBFO0lBQzFFLDJFQUEyRTtJQUMzRSxrRUFBa0U7SUFDbEUsNEVBQTRFO0lBRTVFLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUMsTUFBTSxHQUFHLEdBQUcsT0FBTyxFQUFFLENBQUM7SUFFdEIsdUJBQXVCO0lBQ3ZCLEVBQUU7SUFDRix5RUFBeUU7SUFDekUsMkVBQTJFO0lBQzNFLHlFQUF5RTtJQUN6RSwwRUFBMEU7SUFDMUUsc0RBQXNEO0lBQ3RELE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFlBQVksQ0FBQztJQUMzRCxNQUFNLGVBQWUsR0FBRyxhQUFhLElBQUksQ0FBQyxZQUFZLENBQUM7SUFDdkQsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUNqQixHQUFHLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQztZQUNiLHFCQUFxQixFQUFFO2dCQUNyQixVQUFVLEVBQUU7b0JBQ1YsVUFBVSxFQUFFLENBQUMsUUFBUSxDQUFDO29CQUN0QixTQUFTLEVBQUUsZUFBZTt3QkFDeEIsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLGlCQUFpQixFQUFFLGVBQWUsQ0FBQzt3QkFDaEQsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO29CQUNkLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQztvQkFDdkMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUM7b0JBQ3BDLFVBQVUsRUFBRSxDQUFDLFFBQVEsQ0FBQztvQkFDdEIsT0FBTyxFQUFFLENBQUMsUUFBUSxDQUFDO29CQUNuQixTQUFTLEVBQUUsQ0FBQyxRQUFRLENBQUM7b0JBQ3JCLGNBQWMsRUFBRSxDQUFDLFFBQVEsQ0FBQztvQkFDMUIsT0FBTyxFQUFFLENBQUMsUUFBUSxDQUFDO29CQUNuQixVQUFVLEVBQUUsQ0FBQyxRQUFRLENBQUM7aUJBQ3ZCO2FBQ0Y7U0FDRixDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7SUFFRCxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2YsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDbkMsQ0FBQztJQUVELHlEQUF5RDtJQUN6RCxJQUFJLGlCQUFpQixFQUFFLENBQUM7UUFDdEIsR0FBRyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUM7WUFDbEIsTUFBTSxFQUFFLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxFQUFFO2dCQUN0Qyx1RUFBdUU7Z0JBQ3ZFLHlFQUF5RTtnQkFDekUsNENBQTRDO2dCQUM1QyxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDO29CQUFFLE9BQU8sS0FBSyxDQUFDO2dCQUMzRSxPQUFPLFdBQVcsQ0FBQyxNQUFNLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ3RDLENBQUM7WUFDRCxTQUFTLEVBQUUsYUFBYSxDQUFDLDJCQUEyQjtTQUNyRCxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7SUFFRCwrREFBK0Q7SUFDL0QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDO0lBRTFCLGVBQWU7SUFDZixJQUFJLGNBQWMsRUFBRSxDQUFDO1FBQ25CLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUN0RCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsZUFBZSxJQUFJLEVBQUUsQ0FBQztRQUM5QyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkIsK0VBQStFO1lBQy9FLG9EQUFvRDtZQUNwRCxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNuSCxDQUFDO2FBQU0sQ0FBQztZQUNOLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdEIsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLGdCQUFnQixFQUFFLENBQUM7UUFDckIsR0FBRyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFRCw2RUFBNkU7SUFDN0UsR0FBRyxDQUFDLEdBQUcsQ0FBQyxhQUFhLEVBQUUsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBRWhELHlFQUF5RTtJQUN6RSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxJQUFrQixFQUFFLEVBQUU7UUFDMUQsTUFBTSxHQUFHLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN4QyxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUM7UUFDaEUsR0FBRyxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7UUFDMUIsR0FBRyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDekMsSUFBSSxFQUFFLENBQUM7SUFDVCxDQUFDLENBQUMsQ0FBQztJQUVILHVFQUF1RTtJQUN2RSxHQUFHLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFDO1FBQ3pCLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFlBQVksSUFBSSxLQUFLO1FBQzlDLGlCQUFpQjtLQUNsQixDQUFDLENBQUMsQ0FBQztJQUVKLHdFQUF3RTtJQUN4RSwyRUFBMkU7SUFDM0Usd0VBQXdFO0lBQ3hFLDZFQUE2RTtJQUM3RSxvRUFBb0U7SUFDcEUsNkVBQTZFO0lBQzdFLEdBQUcsQ0FBQyxHQUFHLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQztJQUUxQiwwRUFBMEU7SUFDMUUsd0VBQXdFO0lBQ3hFLDBFQUEwRTtJQUMxRSxHQUFHLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxLQUFLLEVBQUUsSUFBYSxFQUFFLEdBQWEsRUFBRSxFQUFFO1FBQ3hELElBQUksQ0FBQztZQUNILE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztnQkFDaEIsYUFBYSxFQUFFLENBQUMsY0FBYyxFQUFFO2dCQUNoQyxHQUFHLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDO2FBQ3JDLENBQUMsQ0FBQztZQUNILFdBQVcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLFNBQVMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUVILG9FQUFvRTtJQUNwRSxHQUFHLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFDO0lBRXRDLCtEQUErRDtJQUMvRCxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ2xCLE1BQU0sSUFBSSxHQUFHLG1CQUFtQixDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2pELEdBQUcsQ0FBQyxHQUFHLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxJQUFhLEVBQUUsR0FBYSxFQUFFLEVBQUU7WUFDN0QsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNqQixDQUFDLENBQUMsQ0FBQztRQUNILEdBQUcsQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUU7WUFDdEQsZUFBZSxFQUFFLGNBQWMsRUFBRSxLQUFLLElBQUksMkJBQTJCO1NBQ3RFLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVELHlGQUF5RjtJQUN6RixJQUFJLGVBQWUsRUFBRSxDQUFDO1FBQ3BCLE1BQU0sZUFBZSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUM7UUFFaEQsTUFBTSxnQkFBZ0IsR0FBb0M7WUFDeEQsR0FBRyxFQUFFLGVBQWUsQ0FBQyxHQUFHO1lBQ3hCLFFBQVEsRUFBRSxlQUFlLENBQUMsUUFBUTtZQUNsQyxlQUFlLEVBQUUsSUFBSTtZQUNyQixhQUFhLEVBQUUsS0FBSztZQUNwQiwwRUFBMEU7WUFDMUUsMEVBQTBFO1lBQzFFLHNFQUFzRTtZQUN0RSxvRUFBb0U7WUFDcEUsMERBQTBEO1lBQzFELDBCQUEwQjtZQUMxQixJQUFJLEVBQUUsQ0FBQyxHQUFZLEVBQUUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLEdBQUcsQ0FBQztZQUNuRCwyRUFBMkU7WUFDM0UseUVBQXlFO1lBQ3pFLHNFQUFzRTtZQUN0RSx1RUFBdUU7WUFDdkUsZ0VBQWdFO1lBQ2hFLFlBQVksRUFBRSxDQUFDLEdBQVksRUFBRSxFQUFFLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxFQUFFLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUNwRSxPQUFPLEVBQUUsQ0FBQyxJQUFhLEVBQUUsR0FBYSxFQUFFLEVBQUU7Z0JBQ3hDLFNBQVMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLDRDQUE0QyxFQUFFLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1lBQ25HLENBQUM7U0FDRixDQUFDO1FBRUYsbUVBQW1FO1FBQ25FLElBQUksT0FBTyxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ3JCLElBQUksQ0FBQztnQkFDSCxvRUFBb0U7Z0JBQ3BFLHNFQUFzRTtnQkFDdEUsc0RBQXNEO2dCQUN0RCxNQUFNLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDbkQsaUVBQWlFO2dCQUNqRSxNQUFNLEVBQUUsVUFBVSxFQUFFLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDLENBQUM7Z0JBQ25ELGlFQUFpRTtnQkFDakUsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUNqQyxNQUFNLFdBQVcsR0FBRyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQ2hELG9FQUFvRTtnQkFDcEUsdUVBQXVFO2dCQUN2RSx1RUFBdUU7Z0JBQ3ZFLFdBQVcsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBVSxFQUFFLEVBQUUsQ0FDckMsWUFBWSxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksQ0FBQyw4QkFBOEIsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQzFILGdCQUFnQixDQUFDLEtBQUssR0FBRyxJQUFJLFVBQVUsQ0FBQztvQkFDdEMsV0FBVyxFQUFFLENBQUMsR0FBRyxJQUFjLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUM7aUJBQzlELENBQUMsQ0FBQztZQUNMLENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsWUFBWSxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1lBQ3RHLENBQUM7UUFDSCxDQUFDO1FBRUQsR0FBRyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFFRCw0RkFBNEY7SUFDNUYsTUFBTSxTQUFTLEdBQUcsYUFBYSxDQUFDLGtCQUFrQixDQUFDO0lBQ25ELEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFhLEVBQUUsR0FBYSxFQUFFLElBQWtCLEVBQUUsRUFBRTtRQUMzRCxHQUFHLENBQUMsVUFBVSxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUU7WUFDN0IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDckIsU0FBUyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztZQUN6QyxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLEVBQUUsQ0FBQztJQUNULENBQUMsQ0FBQyxDQUFDO0lBRUgsMkJBQTJCO0lBQzNCLE1BQU0sY0FBYyxHQUFHLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ3hELEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFZLEVBQUUsR0FBYSxFQUFFLElBQWtCLEVBQUUsRUFBRTtRQUMxRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDekIsR0FBRyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsR0FBRyxFQUFFO1lBQ3BCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUM7WUFDcEMsOEVBQThFO1lBQzlFLGtGQUFrRjtZQUNsRixjQUFjLENBQUMsSUFBSSxDQUFDLEdBQUcsR0FBRyxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLElBQUksUUFBUSxJQUFJLEVBQUU7Z0JBQy9FLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtnQkFDbEIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO2dCQUNkLFVBQVUsRUFBRSxHQUFHLENBQUMsVUFBVTtnQkFDMUIsVUFBVSxFQUFFLFFBQVE7Z0JBQ3BCLFNBQVMsRUFBRSxHQUFHLENBQUMsU0FBUzthQUN6QixDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksRUFBRSxDQUFDO0lBQ1QsQ0FBQyxDQUFDLENBQUM7SUFFSCxxRUFBcUU7SUFDckUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDLENBQUM7SUFFN0IsNkVBQTZFO0lBQzdFLCtFQUErRTtJQUMvRSw0RUFBNEU7SUFDNUUsK0VBQStFO0lBQy9FLGlFQUFpRTtJQUNqRSw4REFBOEQ7SUFFOUQsOENBQThDO0lBQzlDLDJFQUEyRTtJQUMzRSw2RUFBNkU7SUFDN0UsOEVBQThFO0lBQzlFLDhFQUE4RTtJQUM5RSw0RUFBNEU7SUFDNUUsMkVBQTJFO0lBQzNFLGlFQUFpRTtJQUNqRSxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxXQUFXLEVBQUUsS0FBSyxFQUFFLEdBQVksRUFBRSxHQUFhLEVBQUUsRUFBRTtRQUMxRSxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsQ0FBQztRQUN0RCxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWCxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSw0QkFBNEIsRUFBRSxTQUFTLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUM5RSxPQUFPO1FBQ1QsQ0FBQztRQUNELDZFQUE2RTtRQUM3RSx5RUFBeUU7UUFDekUsMkVBQTJFO1FBQzNFLDRFQUE0RTtRQUM1RSxNQUFNLFNBQVMsR0FBSSxHQUFHLENBQUMsSUFBNEMsRUFBRSxTQUFTLENBQUM7UUFDL0UsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSw4QkFBOEIsRUFBRSxTQUFTLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUNoRixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDL0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNmLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxXQUFXLEVBQUUsQ0FBQztnQkFDbEMsMEVBQTBFO2dCQUMxRSxtRUFBbUU7Z0JBQ25FLFNBQVMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLG9DQUFvQyxFQUFFLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1lBQ2hHLENBQUM7aUJBQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLFdBQVcsRUFBRSxDQUFDO2dCQUN6QyxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxvQ0FBb0MsRUFBRSxTQUFTLENBQUMsY0FBYyxDQUFDLENBQUM7WUFDdEYsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFNBQVMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLHFDQUFxQyxFQUFFLFNBQVMsQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUN2RixDQUFDO1lBQ0QsT0FBTztRQUNULENBQUM7UUFDRCxXQUFXLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNuRCxDQUFDLENBQUMsQ0FBQztJQUVILDJFQUEyRTtJQUMzRSw0RUFBNEU7SUFDNUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUVyRCxPQUFPLEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQzdCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgc2VuZFN1Y2Nlc3MsIHNlbmRFcnJvciwgZ2VuZXJhdGVPcGVuQXBpU3BlYywgRXJyb3JDb2RlLCBjcmVhdGVMb2dnZXIsIHZlcmlmeVNlcnZpY2VQcmluY2lwYWwsIGNyZWF0ZUhlYWx0aFJvdXRlciwgc2V0Q291bnRlckVtaXR0ZXIsIHNhZmVDcmVhdGVSZXF1aXJlLCByZXF1aXJlQXV0aCB9IGZyb20gJ0BwaXBlbGluZS1idWlsZGVyL2FwaS1jb3JlJztcbmltcG9ydCB0eXBlIHsgT3BlbkFwaVNwZWNPcHRpb25zIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUnO1xuaW1wb3J0IHsgQ29uZmlnLCBDb3JlQ29uc3RhbnRzIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvcGlwZWxpbmUtY29yZSc7XG5pbXBvcnQgeyBnZXRDb25uZWN0aW9uIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvcGlwZWxpbmUtZGF0YSc7XG5pbXBvcnQgY29tcHJlc3Npb24gZnJvbSAnY29tcHJlc3Npb24nO1xuaW1wb3J0IGNvcnMgZnJvbSAnY29ycyc7XG5pbXBvcnQgZXhwcmVzcywgeyB0eXBlIEV4cHJlc3MsIHR5cGUgTmV4dEZ1bmN0aW9uLCB0eXBlIFJlcXVlc3QsIHR5cGUgUmVzcG9uc2UgfSBmcm9tICdleHByZXNzJztcbmltcG9ydCByYXRlTGltaXQsIHsgaXBLZXlHZW5lcmF0b3IgfSBmcm9tICdleHByZXNzLXJhdGUtbGltaXQnO1xuaW1wb3J0IGhlbG1ldCBmcm9tICdoZWxtZXQnO1xuaW1wb3J0IHN3YWdnZXJVaSBmcm9tICdzd2FnZ2VyLXVpLWV4cHJlc3MnO1xuaW1wb3J0IHsgdjcgYXMgdXVpZCB9IGZyb20gJ3V1aWQnO1xuaW1wb3J0IHsgZXRhZ01pZGRsZXdhcmUgfSBmcm9tICcuL2V0YWctbWlkZGxld2FyZS5qcyc7XG5pbXBvcnQgeyBjcmVhdGVFbnZSZWRpc0lkZW1wb3RlbmN5U3RvcmUsIHNldElkZW1wb3RlbmN5U3RvcmUsIHR5cGUgSWRlbXBvdGVuY3lTdG9yZSB9IGZyb20gJy4vaWRlbXBvdGVuY3ktbWlkZGxld2FyZS5qcyc7XG5pbXBvcnQgeyBtZXRyaWNzTWlkZGxld2FyZSwgbWV0cmljc0hhbmRsZXIsIGluY0NvdW50ZXIgfSBmcm9tICcuL21ldHJpY3MuanMnO1xuaW1wb3J0IHsgcmVhZGluZXNzR3VhcmQgfSBmcm9tICcuL3JlYWRpbmVzcy5qcyc7XG5pbXBvcnQgeyBTU0VNYW5hZ2VyLCBTU0VfUkVRVUVTVF9JRF9SRSB9IGZyb20gJy4uL2h0dHAvc3NlLWNvbm5lY3Rpb24tbWFuYWdlci5qcyc7XG5pbXBvcnQgeyBjcmVhdGVFbnZSZWRpc1NTRVJlbGF5IH0gZnJvbSAnLi4vaHR0cC9zc2UtcmVsYXkuanMnO1xuaW1wb3J0IHsgY3JlYXRlRW52UmVkaXNUaWNrZXRTdG9yZSB9IGZyb20gJy4uL2h0dHAvc3NlLXRpY2tldC1zdG9yZS5qcyc7XG5cbi8vIFdpcmUgYXBpLWNvcmUncyBjb3VudGVyIHNoaW0gdG8gdGhlIHJlYWwgcHJvbS1jbGllbnQgcmVnaXN0cnkuIFRoaXMgaXNcbi8vIGEgbm8tb3AgdW50aWwgaW5jQ291bnRlciBpcyBjYWxsZWQgZm9yIHRoZSBmaXJzdCB0aW1lIChsYXp5IHJlZ2lzdHJhdGlvblxuLy8gaW4gbWV0cmljcy50cyksIGFuZCBsZXRzIGFwaS1jb3JlIGhlbHBlcnMgbGlrZSB0aGUgcXVvdGEgY2xpZW50IHJlY29yZFxuLy8gYHF1b3RhX2ZhaWxfb3Blbl90b3RhbGAgd2l0aG91dCB0YWtpbmcgYSBoYXJkIGRlcCBvbiBhcGktc2VydmVyLlxuc2V0Q291bnRlckVtaXR0ZXIoaW5jQ291bnRlcik7XG5cbi8qKlxuICogT3B0aW9ucyBmb3IgY3JlYXRpbmcgYW4gRXhwcmVzcyBhcHBsaWNhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIENyZWF0ZUFwcE9wdGlvbnMge1xuICAvKiogRW5hYmxlIENPUlMgKGRlZmF1bHQ6IHRydWUpICovXG4gIGVuYWJsZUNvcnM/OiBib29sZWFuO1xuICAvKiogRW5hYmxlIEhlbG1ldCBzZWN1cml0eSBoZWFkZXJzIChkZWZhdWx0OiB0cnVlKSAqL1xuICBlbmFibGVIZWxtZXQ/OiBib29sZWFuO1xuICAvKiogRW5hYmxlIHJhdGUgbGltaXRpbmcgKGRlZmF1bHQ6IHRydWUpICovXG4gIGVuYWJsZVJhdGVMaW1pdD86IGJvb2xlYW47XG4gIC8qKiBSZWRpcyBVUkwgZm9yIHNoYXJlZCByYXRlLWxpbWl0IHN0YXRlIChlLmcuICdyZWRpczovL2hvc3Q6NjM3OScpLiBJbi1tZW1vcnkgd2hlbiBvbWl0dGVkLiAqL1xuICByZWRpc1VybD86IHN0cmluZztcbiAgLyoqIEVuYWJsZSBKU09OIGJvZHkgcGFyc2luZyAoZGVmYXVsdDogdHJ1ZSkgKi9cbiAgZW5hYmxlSnNvbkJvZHk/OiBib29sZWFuO1xuICAvKiogSlNPTiBib2R5IHNpemUgbGltaXQgKGRlZmF1bHQ6ICcxbWInKSAqL1xuICBqc29uTGltaXQ/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBQYXRoIHByZWZpeGVzIHRoZSBnbG9iYWwgSlNPTiBib2R5IHBhcnNlciBtdXN0IE5PVCB0b3VjaCDigJQgZm9yIHJvdXRlcyB0aGF0IG5lZWRcbiAgICogdGhlIHJhdyBib2R5IChlLmcuIGEgU3RyaXBlIHdlYmhvb2sgd2hvc2UgSE1BQyBpcyBjb21wdXRlZCBvdmVyIHRoZSBleGFjdCBieXRlcykuXG4gICAqIFdpdGhvdXQgdGhpcyB0aGUgZ2xvYmFsIHBhcnNlciBjb25zdW1lcyB0aGUgYm9keSBmaXJzdCBhbmQgYSBsYXRlciBgZXhwcmVzcy5yYXcoKWBcbiAgICogb24gdGhlIHNhbWUgcGF0aCBpcyBhIG5vLW9wLCBicmVha2luZyBzaWduYXR1cmUgdmVyaWZpY2F0aW9uLlxuICAgKi9cbiAganNvbkJvZHlFeGNsdWRlPzogc3RyaW5nW107XG4gIC8qKiBFbmFibGUgVVJMLWVuY29kZWQgYm9keSBwYXJzaW5nIChkZWZhdWx0OiB0cnVlKSAqL1xuICBlbmFibGVVcmxFbmNvZGVkPzogYm9vbGVhbjtcbiAgLyoqIFVSTC1lbmNvZGVkIGJvZHkgc2l6ZSBsaW1pdCAoZGVmYXVsdDogJzFtYicpICovXG4gIHVybEVuY29kZWRMaW1pdD86IHN0cmluZztcbiAgLyoqIEN1c3RvbSBTU0UgbWFuYWdlciBpbnN0YW5jZSAqL1xuICBzc2VNYW5hZ2VyPzogU1NFTWFuYWdlcjtcbiAgLyoqIEhlYWx0aCBjaGVjayBkZXBlbmRlbmN5IGNoZWNrZXIg4oCUIGlmIHByb3ZpZGVkLCAvaGVhbHRoIHJlcG9ydHMgZGVwZW5kZW5jeSBzdGF0dXMgKi9cbiAgY2hlY2tEZXBlbmRlbmNpZXM/OiAoKSA9PiBQcm9taXNlPFJlY29yZDxzdHJpbmcsICdjb25uZWN0ZWQnIHwgJ2Rpc2Nvbm5lY3RlZCcgfCAndW5rbm93bic+PjtcbiAgLyoqIEVuYWJsZSBPcGVuQVBJIHNwZWMgYXQgL2RvY3Mvb3BlbmFwaS5qc29uIGFuZCBTd2FnZ2VyIFVJIGF0IC9kb2NzIChkZWZhdWx0OiB0cnVlKSAqL1xuICBlbmFibGVPcGVuQXBpPzogYm9vbGVhbjtcbiAgLyoqIE9wZW5BUEkgc3BlYyBjdXN0b21pemF0aW9uIG9wdGlvbnMgKi9cbiAgb3BlbkFwaU9wdGlvbnM/OiBPcGVuQXBpU3BlY09wdGlvbnM7XG4gIC8qKiBFbmFibGUgZ3ppcC9kZWZsYXRlIHJlc3BvbnNlIGNvbXByZXNzaW9uIChkZWZhdWx0OiB0cnVlKSAqL1xuICBlbmFibGVDb21wcmVzc2lvbj86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBJZGVtcG90ZW5jeSByZXBsYXktY2FjaGUgYmFja2VuZCBmb3Iga2V5ZWQgbXV0YXRpb24gcmV0cmllcy4gV2hlbiBvbWl0dGVkLFxuICAgKiBjcmVhdGVBcHAgYXV0by13aXJlcyB0aGUgc2hhcmVkIGVudiBSZWRpcyBzdG9yZSAobXVsdGktcmVwbGljYSBkZWR1cCkgaWZcbiAgICogUmVkaXMgaXMgY29uZmlndXJlZCwgZWxzZSBrZWVwcyB0aGUgaW4tbWVtb3J5IGRlZmF1bHQgKHNpbmdsZS1yZXBsaWNhKS5cbiAgICogUGFzcyBhbiBleHBsaWNpdCBzdG9yZSB0byBpbmplY3QgYSBiZXNwb2tlIGJhY2tlbmQgKGUuZy4gYSBzZXJ2aWNlJ3Mgb3duXG4gICAqIGlvcmVkaXMgY29ubmVjdGlvbikuXG4gICAqL1xuICBpZGVtcG90ZW5jeVN0b3JlPzogSWRlbXBvdGVuY3lTdG9yZTtcbiAgLyoqXG4gICAqIEV4dHJhIHdhcm11cCBjYWxsYmFja3MgaW52b2tlZCBieSBgR0VUIC93YXJtdXBgIGluIGFkZGl0aW9uIHRvIHRoZVxuICAgKiBkZWZhdWx0IFBvc3RncmVzIHBpbmcuIFVzZSBmb3Igc2VydmljZXMgdGhhdCBkZXBlbmQgb24gTW9uZ28sIFJlZGlzLFxuICAgKiBTUVMsIGV0Yy4g4oCUIHByZS13YXJtaW5nIG9wZW5zIGNvbm5lY3Rpb24gcG9vbHMgYmVmb3JlIHJlYWwgdHJhZmZpY1xuICAgKiBhcnJpdmVzLiBFYWNoIGNhbGxiYWNrIHNob3VsZCByZXNvbHZlIHdoZW4gaXRzIGRlcGVuZGVuY3kgaXMgcmVhZHk7XG4gICAqIGFueSByZWplY3Rpb24gY2F1c2VzIC93YXJtdXAgdG8gcmV0dXJuIDUwMy5cbiAgICovXG4gIHdhcm11cEhvb2tzPzogQXJyYXk8KCkgPT4gUHJvbWlzZTx2b2lkPj47XG59XG5cbi8qKlxuICogUmVzdWx0IG9mIGNyZWF0aW5nIGFuIEV4cHJlc3MgYXBwbGljYXRpb25cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDcmVhdGVBcHBSZXN1bHQge1xuICAvKiogQ29uZmlndXJlZCBFeHByZXNzIGFwcGxpY2F0aW9uICovXG4gIGFwcDogRXhwcmVzcztcbiAgLyoqIFNTRSBtYW5hZ2VyIGluc3RhbmNlICovXG4gIHNzZU1hbmFnZXI6IFNTRU1hbmFnZXI7XG59XG5cbi8qKlxuICogQ3JlYXRlIGFuZCBjb25maWd1cmUgYW4gRXhwcmVzcyBhcHBsaWNhdGlvbiB3aXRoIGNvbW1vbiBtaWRkbGV3YXJlXG4gKlxuICogU2V0cyB1cDpcbiAqIC0gQ09SUyB3aXRoIGNvbmZpZ3VyZWQgb3JpZ2luc1xuICogLSBIZWxtZXQgc2VjdXJpdHkgaGVhZGVyc1xuICogLSBSYXRlIGxpbWl0aW5nXG4gKiAtIEpTT04gYW5kIFVSTC1lbmNvZGVkIGJvZHkgcGFyc2luZ1xuICogLSBUcnVzdCBwcm94eSBzZXR0aW5nc1xuICogLSBIZWFsdGggY2hlY2sgZW5kcG9pbnQgKC9oZWFsdGgpXG4gKiAtIE1ldHJpY3MgZW5kcG9pbnQgKC9tZXRyaWNzKVxuICogLSBTU0UgbG9ncyBlbmRwb2ludCAoL2xvZ3MvOnJlcXVlc3RJZClcbiAqXG4gKiBAcGFyYW0gb3B0aW9ucyAtIENvbmZpZ3VyYXRpb24gb3B0aW9uc1xuICogQHJldHVybnMgQ29uZmlndXJlZCBFeHByZXNzIGFwcCBhbmQgU1NFIG1hbmFnZXJcbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgeyBhcHAsIHNzZU1hbmFnZXIgfSA9IGNyZWF0ZUFwcCgpO1xuICpcbiAqIGFwcC5wb3N0KCcvYXBpL3Jlc291cmNlJywgcmVxdWlyZUF1dGgsIGFzeW5jIChyZXEsIHJlcykgPT4ge1xuICogICAvLyBZb3VyIHJvdXRlIGhhbmRsZXJcbiAqIH0pO1xuICpcbiAqIHN0YXJ0U2VydmVyKGFwcCwgeyBuYW1lOiAnTXkgU2VydmljZScgfSk7XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZUFwcChvcHRpb25zOiBDcmVhdGVBcHBPcHRpb25zID0ge30pOiBDcmVhdGVBcHBSZXN1bHQge1xuICBjb25zdCB7XG4gICAgZW5hYmxlQ29ycyA9IHRydWUsXG4gICAgZW5hYmxlSGVsbWV0ID0gdHJ1ZSxcbiAgICBlbmFibGVSYXRlTGltaXQgPSB0cnVlLFxuICAgIGVuYWJsZUpzb25Cb2R5ID0gdHJ1ZSxcbiAgICBqc29uTGltaXQgPSAnMW1iJyxcbiAgICBlbmFibGVVcmxFbmNvZGVkID0gdHJ1ZSxcbiAgICB1cmxFbmNvZGVkTGltaXQgPSAnMW1iJyxcbiAgICAvLyBEZWZhdWx0IFNTRSBtYW5hZ2VyIHdpcmVkIHRvIHRoZSBzaGFyZWQgZW52IFJlZGlzIHRpY2tldC9vd25lcnNoaXAgc3RvcmVcbiAgICAvLyB3aGVuIFJlZGlzIGlzIGNvbmZpZ3VyZWQgKG11bHRpLXBvZCBjb3JyZWN0bmVzcyArIGNyb3NzLXNlcnZpY2Ugc3RyZWFtXG4gICAgLy8gb3duZXJzaGlwKSwgZWxzZSB0aGUgaW4tbWVtb3J5IGRlZmF1bHQuIEEgY2FsbGVyLXN1cHBsaWVkIGBzc2VNYW5hZ2VyYFxuICAgIC8vIHNraXBzIHRoaXMgZW50aXJlbHkuXG4gICAgc3NlTWFuYWdlciA9IG5ldyBTU0VNYW5hZ2VyKHtcbiAgICAgIHRpY2tldFN0b3JlOiBjcmVhdGVFbnZSZWRpc1RpY2tldFN0b3JlKCkgPz8gdW5kZWZpbmVkLFxuICAgICAgcmVsYXk6IGNyZWF0ZUVudlJlZGlzU1NFUmVsYXkoKSA/PyB1bmRlZmluZWQsXG4gICAgfSksXG4gICAgY2hlY2tEZXBlbmRlbmNpZXMsXG4gICAgZW5hYmxlT3BlbkFwaSA9IHRydWUsXG4gICAgb3BlbkFwaU9wdGlvbnMsXG4gICAgZW5hYmxlQ29tcHJlc3Npb24gPSB0cnVlLFxuICAgIHdhcm11cEhvb2tzID0gW10sXG4gICAgaWRlbXBvdGVuY3lTdG9yZSxcbiAgfSA9IG9wdGlvbnM7XG5cbiAgLy8gRmFpbCBmYXN0IGlmIEpXVF9TRUNSRVQgaXMgbm90IGNvbmZpZ3VyZWQg4oCUIHByZXZlbnRzIHNpbGVudCBhdXRoIGZhaWx1cmVzIGF0IHJ1bnRpbWVcbiAgaWYgKCFwcm9jZXNzLmVudi5KV1RfU0VDUkVUKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdKV1RfU0VDUkVUIGVudmlyb25tZW50IHZhcmlhYmxlIGlzIHJlcXVpcmVkLiBTZXQgaXQgYmVmb3JlIHN0YXJ0aW5nIHRoZSBzZXJ2ZXIuJyk7XG4gIH1cblxuICAvLyBXaXJlIHRoZSBpZGVtcG90ZW5jeSByZXBsYXktY2FjaGUgYmFja2VuZCB1c2VkIGJ5IHRoZSBwb3N0LWF1dGggcm91dGVcbiAgLy8gZmFjdG9yaWVzIChjcmVhdGVQcm90ZWN0ZWRSb3V0ZSAvIGNyZWF0ZUF1dGhlbnRpY2F0ZWRXaXRoT3JnUm91dGUpLiBQcmVmZXJcbiAgLy8gYW4gZXhwbGljaXRseSBpbmplY3RlZCBzdG9yZTsgb3RoZXJ3aXNlIGF1dG8tY29uc3RydWN0IGZyb20gdGhlIHNoYXJlZCBlbnZcbiAgLy8gUmVkaXMgc28ga2V5ZWQgbXV0YXRpb24gcmV0cmllcyBkZWR1cGUgYWNyb3NzIHJlcGxpY2FzLiBGYWxscyBiYWNrIHRvIHRoZVxuICAvLyBpbi1tZW1vcnkgZGVmYXVsdCB3aGVuIG5vIFJlZGlzIGlzIGNvbmZpZ3VyZWQgKHNpbmdsZS1yZXBsaWNhIGNvcnJlY3RuZXNzKS5cbiAgY29uc3QgcmVzb2x2ZWRJZGVtcG90ZW5jeVN0b3JlID0gaWRlbXBvdGVuY3lTdG9yZSA/PyBjcmVhdGVFbnZSZWRpc0lkZW1wb3RlbmN5U3RvcmUoKTtcbiAgaWYgKHJlc29sdmVkSWRlbXBvdGVuY3lTdG9yZSkge1xuICAgIHNldElkZW1wb3RlbmN5U3RvcmUocmVzb2x2ZWRJZGVtcG90ZW5jeVN0b3JlKTtcbiAgfVxuXG4gIC8vIE9wZW5UZWxlbWV0cnkgaXMgTk9UIGluaXRpYWxpemVkIGhlcmU6IGJ5IHRoZSB0aW1lIGNyZWF0ZUFwcCBydW5zLCBleHByZXNzXG4gIC8vIGFuZCBodHRwIGhhdmUgYWxyZWFkeSBiZWVuIHJlcXVpcmVkLCBzbyB0aGUgYXV0by1pbnN0cnVtZW50YXRpb24gaG9va3NcbiAgLy8gd291bGQgaGF2ZSBub3RoaW5nIHRvIHBhdGNoIChubyBpbmJvdW5kIHNwYW4g4oaSIG5vIHRyYWNlIGlkKS4gVHJhY2luZyBpc1xuICAvLyBzdGFydGVkIGJ5IHRoZSBgb3RlbC1ib290c3RyYXAuanNgIHByZWxvYWQgaW5zdGVhZCAobm9kZSAtciDigKYg4oCUIHNlZSBlYWNoXG4gIC8vIHNlcnZpY2UncyBEb2NrZXJmaWxlIENNRCAvIHN0YXJ0IHNjcmlwdCksIHdoaWNoIHJ1bnMgYmVmb3JlIGFueVxuICAvLyBpbnN0cnVtZW50ZWQgbW9kdWxlIGxvYWRzLiBgY3VycmVudFRyYWNlSWQoKWAgdGhlbiByZWFkcyB0aGUgYWN0aXZlIHNwYW4uXG5cbiAgY29uc3Qgc2VydmVyQ29uZmlnID0gQ29uZmlnLmdldCgnc2VydmVyJyk7XG4gIGNvbnN0IGFwcCA9IGV4cHJlc3MoKTtcblxuICAvLyBTZWN1cml0eSBtaWRkbGV3YXJlLlxuICAvL1xuICAvLyBTd2FnZ2VyIFVJIG5lZWRzIHVuc2FmZS1pbmxpbmUgKyB1bnNhZmUtZXZhbCBmb3IgaXRzIGJ1bmRsZWQgc2NyaXB0cyDigJRcbiAgLy8gYnV0IHdlIG9ubHkgcmVsYXggQ1NQIHRoYXQgZmFyIHdoZW4gKGEpIE9wZW5BUEkgaXMgZW5hYmxlZCBBTkQgKGIpIHdlJ3JlXG4gIC8vIG5vdCBpbiBwcm9kdWN0aW9uLiBJbiBwcm9kLCBTd2FnZ2VyIHNob3VsZCBiZSBzZXJ2ZWQgYmVoaW5kIGEgc2VwYXJhdGVcbiAgLy8gaG9zdCBvciBhdXRoLWdhdGVkIHJvdXRlOyB0aGUgbWFpbiBhcHAga2VlcHMgdGhlIHN0cmljdCBDU1Agc28gYSBTdG9yZWRcbiAgLy8gWFNTIGluIGFueSBoYW5kbGVyIGNhbid0IGBldmFsKClgIGFyYml0cmFyeSBzY3JpcHQuXG4gIGNvbnN0IGlzUHJvZHVjdGlvbiA9IHByb2Nlc3MuZW52Lk5PREVfRU5WID09PSAncHJvZHVjdGlvbic7XG4gIGNvbnN0IGFsbG93U3dhZ2dlckNzcCA9IGVuYWJsZU9wZW5BcGkgJiYgIWlzUHJvZHVjdGlvbjtcbiAgaWYgKGVuYWJsZUhlbG1ldCkge1xuICAgIGFwcC51c2UoaGVsbWV0KHtcbiAgICAgIGNvbnRlbnRTZWN1cml0eVBvbGljeToge1xuICAgICAgICBkaXJlY3RpdmVzOiB7XG4gICAgICAgICAgZGVmYXVsdFNyYzogW1wiJ3NlbGYnXCJdLFxuICAgICAgICAgIHNjcmlwdFNyYzogYWxsb3dTd2FnZ2VyQ3NwXG4gICAgICAgICAgICA/IFtcIidzZWxmJ1wiLCBcIid1bnNhZmUtaW5saW5lJ1wiLCBcIid1bnNhZmUtZXZhbCdcIl1cbiAgICAgICAgICAgIDogW1wiJ3NlbGYnXCJdLFxuICAgICAgICAgIHN0eWxlU3JjOiBbXCInc2VsZidcIiwgXCIndW5zYWZlLWlubGluZSdcIl0sXG4gICAgICAgICAgaW1nU3JjOiBbXCInc2VsZidcIiwgJ2RhdGE6JywgJ2Jsb2I6J10sXG4gICAgICAgICAgY29ubmVjdFNyYzogW1wiJ3NlbGYnXCJdLFxuICAgICAgICAgIGZvbnRTcmM6IFtcIidzZWxmJ1wiXSxcbiAgICAgICAgICBvYmplY3RTcmM6IFtcIidub25lJ1wiXSxcbiAgICAgICAgICBmcmFtZUFuY2VzdG9yczogW1wiJ25vbmUnXCJdLFxuICAgICAgICAgIGJhc2VVcmk6IFtcIidzZWxmJ1wiXSxcbiAgICAgICAgICBmb3JtQWN0aW9uOiBbXCInc2VsZidcIl0sXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pKTtcbiAgfVxuXG4gIGlmIChlbmFibGVDb3JzKSB7XG4gICAgYXBwLnVzZShjb3JzKHNlcnZlckNvbmZpZy5jb3JzKSk7XG4gIH1cblxuICAvLyBSZXNwb25zZSBjb21wcmVzc2lvbiAoZ3ppcC9kZWZsYXRlKSDigJQgc2tpcCBTU0Ugc3RyZWFtc1xuICBpZiAoZW5hYmxlQ29tcHJlc3Npb24pIHtcbiAgICBhcHAudXNlKGNvbXByZXNzaW9uKHtcbiAgICAgIGZpbHRlcjogKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSkgPT4ge1xuICAgICAgICAvLyBEb24ndCBjb21wcmVzcyBTU0Ugc3RyZWFtcy4gTWF0Y2ggYnkgaW5jbHVzaW9uOiB0aGUgQWNjZXB0IGhlYWRlciBpc1xuICAgICAgICAvLyBvZnRlbiBhIGxpc3QgKGUuZy4gXCJ0ZXh0L2V2ZW50LXN0cmVhbSwgKi8qXCIpLCBzbyBleGFjdCBlcXVhbGl0eSBtaXNzZWRcbiAgICAgICAgLy8gdGhvc2UgYW5kIGNvbXByZXNzZWQvYnVmZmVyZWQgdGhlIHN0cmVhbS5cbiAgICAgICAgaWYgKChyZXEuaGVhZGVycy5hY2NlcHQgfHwgJycpLmluY2x1ZGVzKCd0ZXh0L2V2ZW50LXN0cmVhbScpKSByZXR1cm4gZmFsc2U7XG4gICAgICAgIHJldHVybiBjb21wcmVzc2lvbi5maWx0ZXIocmVxLCByZXMpO1xuICAgICAgfSxcbiAgICAgIHRocmVzaG9sZDogQ29yZUNvbnN0YW50cy5DT01QUkVTU0lPTl9USFJFU0hPTERfQllURVMsXG4gICAgfSkpO1xuICB9XG5cbiAgLy8gRVRhZyBzdXBwb3J0IGZvciBjb25kaXRpb25hbCBHRVQgcmVxdWVzdHMgKDMwNCBOb3QgTW9kaWZpZWQpXG4gIGFwcC51c2UoZXRhZ01pZGRsZXdhcmUoKSk7XG5cbiAgLy8gQm9keSBwYXJzaW5nXG4gIGlmIChlbmFibGVKc29uQm9keSkge1xuICAgIGNvbnN0IGpzb25QYXJzZXIgPSBleHByZXNzLmpzb24oeyBsaW1pdDoganNvbkxpbWl0IH0pO1xuICAgIGNvbnN0IGV4Y2x1ZGUgPSBvcHRpb25zLmpzb25Cb2R5RXhjbHVkZSA/PyBbXTtcbiAgICBpZiAoZXhjbHVkZS5sZW5ndGggPiAwKSB7XG4gICAgICAvLyBTa2lwIHRoZSBnbG9iYWwgSlNPTiBwYXJzZXIgZm9yIHJhdy1ib2R5IHBhdGhzIHNvIGEgcGVyLXBhdGggYGV4cHJlc3MucmF3KClgXG4gICAgICAvLyBjYW4gcmVhZCB0aGUgZXhhY3QgYnl0ZXMgKHNlZSBganNvbkJvZHlFeGNsdWRlYCkuXG4gICAgICBhcHAudXNlKChyZXEsIHJlcywgbmV4dCkgPT4gKGV4Y2x1ZGUuc29tZSgocCkgPT4gcmVxLnBhdGguc3RhcnRzV2l0aChwKSkgPyBuZXh0KCkgOiBqc29uUGFyc2VyKHJlcSwgcmVzLCBuZXh0KSkpO1xuICAgIH0gZWxzZSB7XG4gICAgICBhcHAudXNlKGpzb25QYXJzZXIpO1xuICAgIH1cbiAgfVxuXG4gIGlmIChlbmFibGVVcmxFbmNvZGVkKSB7XG4gICAgYXBwLnVzZShleHByZXNzLnVybGVuY29kZWQoeyBleHRlbmRlZDogdHJ1ZSwgbGltaXQ6IHVybEVuY29kZWRMaW1pdCB9KSk7XG4gIH1cblxuICAvLyBUcnVzdCBwcm94eSAobXVzdCBiZSBzZXQgYmVmb3JlIHJhdGUgbGltaXRlciBzbyByZXEuaXAgcmVzb2x2ZXMgY29ycmVjdGx5KVxuICBhcHAuc2V0KCd0cnVzdCBwcm94eScsIHNlcnZlckNvbmZpZy50cnVzdFByb3h5KTtcblxuICAvLyBSZXF1ZXN0IElEIOKAlCBwcmVmZXIgZXhpc3RpbmcgaGVhZGVyIGZyb20gbmdpbngsIG90aGVyd2lzZSBnZW5lcmF0ZSBvbmVcbiAgYXBwLnVzZSgocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pID0+IHtcbiAgICBjb25zdCBoZHIgPSByZXEuaGVhZGVyc1sneC1yZXF1ZXN0LWlkJ107XG4gICAgY29uc3QgcmVxdWVzdElkID0gKEFycmF5LmlzQXJyYXkoaGRyKSA/IGhkclswXSA6IGhkcikgfHwgdXVpZCgpO1xuICAgIHJlcS5yZXF1ZXN0SWQgPSByZXF1ZXN0SWQ7XG4gICAgcmVzLnNldEhlYWRlcignWC1SZXF1ZXN0LUlkJywgcmVxdWVzdElkKTtcbiAgICBuZXh0KCk7XG4gIH0pO1xuXG4gIC8vIEhlYWx0aCBjaGVjayByZWdpc3RlcmVkIGJlZm9yZSByYXRlIGxpbWl0ZXIgc28gaXQgaXMgbmV2ZXIgdGhyb3R0bGVkXG4gIGFwcC51c2UoY3JlYXRlSGVhbHRoUm91dGVyKHtcbiAgICBzZXJ2aWNlTmFtZTogcHJvY2Vzcy5lbnYuU0VSVklDRV9OQU1FIHx8ICdhcGknLFxuICAgIGNoZWNrRGVwZW5kZW5jaWVzLFxuICB9KSk7XG5cbiAgLy8gUmVhZGluZXNzIGd1YXJkIOKAlCA1MDNzIGJ1c2luZXNzIHRyYWZmaWMgd2hpbGUgdGhlIHNlcnZpY2UgaXMgTm90UmVhZHlcbiAgLy8gKGRhdGFzdG9yZSBzdGlsbCBjb25uZWN0aW5nIGF0IHN0YXJ0dXAsIG9yIGRyb3BwZWQpLiBNb3VudGVkIHJpZ2h0IGFmdGVyXG4gIC8vIHRoZSBoZWFsdGggcm91dGVyIGFuZCBiZWZvcmUgZXZlcnl0aGluZyBlbHNlIHNvIGEgTm90UmVhZHkgcmVxdWVzdCBpc1xuICAvLyByZWplY3RlZCBjaGVhcGx5LCBiZWZvcmUgcmF0ZS1saW1pdCAvIGlkZW1wb3RlbmN5IC8gYnVzaW5lc3MgaGFuZGxlcnMgZXZlclxuICAvLyB0b3VjaCBhIGRpc2Nvbm5lY3RlZCBkYXRhc3RvcmUuIEl0IGFsbG93bGlzdHMgdGhlIGluZnJhIGVuZHBvaW50c1xuICAvLyAoL21ldHJpY3MsIC93YXJtdXAsIC9kb2NzLCAvbG9ncykgcmVnaXN0ZXJlZCBiZWxvdywgcGx1cyAvaGVhbHRoICsgL3JlYWR5LlxuICBhcHAudXNlKHJlYWRpbmVzc0d1YXJkKCkpO1xuXG4gIC8vIFdhcm0tdXAgZW5kcG9pbnQg4oCUIHByZS1vcGVucyBjb25uZWN0aW9uIHBvb2xzIHNvIHRoZSBmaXJzdCByZWFsIHJlcXVlc3RcbiAgLy8gZG9lc24ndCBwYXkgY29sZC1zdGFydCBsYXRlbmN5LiBBbHdheXMgcGluZ3MgUG9zdGdyZXM7IHNlcnZpY2VzIHVzaW5nXG4gIC8vIE1vbmdvIC8gUmVkaXMgLyBTUVMgcGFzcyBgd2FybXVwSG9va3NgIHNvIHRob3NlIGFyZSB3YXJtZWQgaW4gcGFyYWxsZWwuXG4gIGFwcC5nZXQoJy93YXJtdXAnLCBhc3luYyAoX3JlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSkgPT4ge1xuICAgIHRyeSB7XG4gICAgICBhd2FpdCBQcm9taXNlLmFsbChbXG4gICAgICAgIGdldENvbm5lY3Rpb24oKS50ZXN0Q29ubmVjdGlvbigpLFxuICAgICAgICAuLi53YXJtdXBIb29rcy5tYXAoKGhvb2spID0+IGhvb2soKSksXG4gICAgICBdKTtcbiAgICAgIHNlbmRTdWNjZXNzKHJlcywgMjAwLCB7IHdhcm1lZDogdHJ1ZSwgaG9va3M6IHdhcm11cEhvb2tzLmxlbmd0aCB9KTtcbiAgICB9IGNhdGNoIHtcbiAgICAgIHNlbmRFcnJvcihyZXMsIDUwMywgJ1dhcm11cCBmYWlsZWQnKTtcbiAgICB9XG4gIH0pO1xuXG4gIC8vIFByb21ldGhldXMgbWV0cmljcyBlbmRwb2ludCDigJQgYWx3YXlzIHJlZ2lzdGVyZWQgKG5ldmVyIHRocm90dGxlZClcbiAgYXBwLmdldCgnL21ldHJpY3MnLCBtZXRyaWNzSGFuZGxlcigpKTtcblxuICAvLyBPcGVuQVBJIHNwZWMgYW5kIFN3YWdnZXIgVUkgKHJlZ2lzdGVyZWQgYmVmb3JlIHJhdGUgbGltaXRlcilcbiAgaWYgKGVuYWJsZU9wZW5BcGkpIHtcbiAgICBjb25zdCBzcGVjID0gZ2VuZXJhdGVPcGVuQXBpU3BlYyhvcGVuQXBpT3B0aW9ucyk7XG4gICAgYXBwLmdldCgnL2RvY3Mvb3BlbmFwaS5qc29uJywgKF9yZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UpID0+IHtcbiAgICAgIHJlcy5qc29uKHNwZWMpO1xuICAgIH0pO1xuICAgIGFwcC51c2UoJy9kb2NzJywgc3dhZ2dlclVpLnNlcnZlLCBzd2FnZ2VyVWkuc2V0dXAoc3BlYywge1xuICAgICAgY3VzdG9tU2l0ZVRpdGxlOiBvcGVuQXBpT3B0aW9ucz8udGl0bGUgPz8gJ1BpcGVsaW5lIEJ1aWxkZXIgQVBJIERvY3MnLFxuICAgIH0pKTtcbiAgfVxuXG4gIC8vIFJhdGUgbGltaXRpbmcg4oCUIHVzZXMgUmVkaXMgd2hlbiByZWRpc1VybCBpcyBwcm92aWRlZCBmb3Igc2hhcmVkIHN0YXRlIGFjcm9zcyBpbnN0YW5jZXNcbiAgaWYgKGVuYWJsZVJhdGVMaW1pdCkge1xuICAgIGNvbnN0IHJhdGVMaW1pdENvbmZpZyA9IENvbmZpZy5nZXQoJ3JhdGVMaW1pdCcpO1xuXG4gICAgY29uc3QgcmF0ZUxpbWl0T3B0aW9uczogUGFyYW1ldGVyczx0eXBlb2YgcmF0ZUxpbWl0PlswXSA9IHtcbiAgICAgIG1heDogcmF0ZUxpbWl0Q29uZmlnLm1heCxcbiAgICAgIHdpbmRvd01zOiByYXRlTGltaXRDb25maWcud2luZG93TXMsXG4gICAgICBzdGFuZGFyZEhlYWRlcnM6IHRydWUsXG4gICAgICBsZWdhY3lIZWFkZXJzOiBmYWxzZSxcbiAgICAgIC8vIFNraXAgcmF0ZSBsaW1pdGluZyBvbmx5IGZvciBDUllQVE9HUkFQSElDQUxMWS1WRVJJRklFRCBpbnRlcm5hbCBzZXJ2aWNlXG4gICAgICAvLyBjYWxsZXJzLiBUaGUgbGltaXRlciBydW5zIGJlZm9yZSByZXF1aXJlQXV0aCwgc28gdGhlIHByZXZpb3VzbHktdHJ1c3RlZFxuICAgICAgLy8gcGxhaW50ZXh0IGB4LWludGVybmFsLXNlcnZpY2VgIGhlYWRlciB3YXMgc3Bvb2ZhYmxlIGJ5IGFueSBleHRlcm5hbFxuICAgICAgLy8gY2xpZW50IOKGkiB0b3RhbCBieXBhc3MuIHZlcmlmeVNlcnZpY2VQcmluY2lwYWwgdmVyaWZpZXMgdGhlIHNpZ25lZFxuICAgICAgLy8gc2VydmljZSBKV1QgaW5zdGVhZDsgaW50ZXItc2VydmljZSBjYWxsZXJzIGFsbCBzZW5kIG9uZVxuICAgICAgLy8gKGdldFNlcnZpY2VBdXRoSGVhZGVyKS5cbiAgICAgIHNraXA6IChyZXE6IFJlcXVlc3QpID0+IHZlcmlmeVNlcnZpY2VQcmluY2lwYWwocmVxKSxcbiAgICAgIC8vIEtleSBvbiBjbGllbnQgSVAgb25seS4gVGhlIGxpbWl0ZXIgcnVucyBwcmUtYXV0aCwgc28gYHJlcS51c2VyYCBpcyB1bnNldFxuICAgICAgLy8gYW5kIGFueSBvcmcgaWQgd291bGQgY29tZSBmcm9tIHRoZSBjYWxsZXItc3VwcGxpZWQgYHgtb3JnLWlkYCBoZWFkZXIg4oCUXG4gICAgICAvLyBzcG9vZmFibGUsIGxldHRpbmcgYW4gYXR0YWNrZXIgcm90YXRlIHZhbHVlcyB0byBldmFkZSB0aGUgYnVja2V0IG9yXG4gICAgICAvLyBmbG9vZCBhIHZpY3RpbSBvcmcncyBidWNrZXQuIGlwS2V5R2VuZXJhdG9yIG5vcm1hbGl6ZXMgSVB2NiB0byBhIC82NFxuICAgICAgLy8gcHJlZml4IChhbHNvIHJlcXVpcmVkIGJ5IGV4cHJlc3MtcmF0ZS1saW1pdCA4LngncyB2YWxpZGF0b3IpLlxuICAgICAga2V5R2VuZXJhdG9yOiAocmVxOiBSZXF1ZXN0KSA9PiBpcEtleUdlbmVyYXRvcihyZXEuaXAgfHwgJ2Fub24nLCA2NCksXG4gICAgICBoYW5kbGVyOiAoX3JlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSkgPT4ge1xuICAgICAgICBzZW5kRXJyb3IocmVzLCA0MjksICdUb28gbWFueSByZXF1ZXN0cywgcGxlYXNlIHRyeSBhZ2FpbiBsYXRlci4nLCBFcnJvckNvZGUuUkFURV9MSU1JVF9FWENFRURFRCk7XG4gICAgICB9LFxuICAgIH07XG5cbiAgICAvLyBVc2UgUmVkaXMgc3RvcmUgd2hlbiBhdmFpbGFibGUgZm9yIHNoYXJlZCBzdGF0ZSBhY3Jvc3MgaW5zdGFuY2VzXG4gICAgaWYgKG9wdGlvbnMucmVkaXNVcmwpIHtcbiAgICAgIHRyeSB7XG4gICAgICAgIC8vIEVTTSBoYXMgbm8gZ2xvYmFsIGByZXF1aXJlYDsgc2FmZUNyZWF0ZVJlcXVpcmUgbG9hZHMgdGhlIG9wdGlvbmFsXG4gICAgICAgIC8vIHJlZGlzIGRlcHMgc3luY2hyb25vdXNseSBoZXJlIChvbmx5IHdoZW4gYSByZWRpc1VybCBpcyBjb25maWd1cmVkKS5cbiAgICAgICAgLy8gKENKUy1idW5kbGUgc2FmZSDigJQgc2VlIGFwaS1jb3JlJ3Mgc2FmZS1yZXF1aXJlLnRzLilcbiAgICAgICAgY29uc3QgcmVxdWlyZSA9IHNhZmVDcmVhdGVSZXF1aXJlKGltcG9ydC5tZXRhLnVybCk7XG4gICAgICAgIC8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzXG4gICAgICAgIGNvbnN0IHsgUmVkaXNTdG9yZSB9ID0gcmVxdWlyZSgncmF0ZS1saW1pdC1yZWRpcycpO1xuICAgICAgICAvLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgQHR5cGVzY3JpcHQtZXNsaW50L25vLXJlcXVpcmUtaW1wb3J0c1xuICAgICAgICBjb25zdCBSZWRpcyA9IHJlcXVpcmUoJ2lvcmVkaXMnKTtcbiAgICAgICAgY29uc3QgcmVkaXNDbGllbnQgPSBuZXcgUmVkaXMob3B0aW9ucy5yZWRpc1VybCk7XG4gICAgICAgIC8vIGlvcmVkaXMgZW1pdHMgJ2Vycm9yJyBvbiBjb25uZWN0aW9uIGxvc3M7IHdpdGhvdXQgYSBsaXN0ZW5lciBOb2RlXG4gICAgICAgIC8vIHRyZWF0cyBpdCBhcyBhbiB1bmhhbmRsZWQgJ2Vycm9yJyBldmVudCBhbmQgQ1JBU0hFUyB0aGUgcHJvY2Vzcy4gTG9nXG4gICAgICAgIC8vIGFuZCBsZXQgaW9yZWRpcyBhdXRvLXJlY29ubmVjdCAocmF0ZSBsaW1pdGluZyBmYWxscyBiYWNrIHBlci1zdG9yZSkuXG4gICAgICAgIHJlZGlzQ2xpZW50Lm9uKCdlcnJvcicsIChlOiB1bmtub3duKSA9PlxuICAgICAgICAgIGNyZWF0ZUxvZ2dlcigncmF0ZS1saW1pdCcpLndhcm4oJ1JlZGlzIHJhdGUtbGltaXQgc3RvcmUgZXJyb3InLCB7IGVycm9yOiBlIGluc3RhbmNlb2YgRXJyb3IgPyBlLm1lc3NhZ2UgOiBTdHJpbmcoZSkgfSkpO1xuICAgICAgICByYXRlTGltaXRPcHRpb25zLnN0b3JlID0gbmV3IFJlZGlzU3RvcmUoe1xuICAgICAgICAgIHNlbmRDb21tYW5kOiAoLi4uYXJnczogc3RyaW5nW10pID0+IHJlZGlzQ2xpZW50LmNhbGwoLi4uYXJncyksXG4gICAgICAgIH0pO1xuICAgICAgfSBjYXRjaCB7XG4gICAgICAgIGNyZWF0ZUxvZ2dlcigncmF0ZS1saW1pdCcpLndhcm4oJ1JlZGlzIHN0b3JlIHVuYXZhaWxhYmxlLCBmYWxsaW5nIGJhY2sgdG8gaW4tbWVtb3J5IHJhdGUgbGltaXRpbmcnKTtcbiAgICAgIH1cbiAgICB9XG5cbiAgICBhcHAudXNlKHJhdGVMaW1pdChyYXRlTGltaXRPcHRpb25zKSk7XG4gIH1cblxuICAvLyBFeHByZXNzIHJlcXVlc3QgdGltZW91dCDigJQgdXNlcyBDb3JlQ29uc3RhbnRzIHRvIHNoYXJlIHRoZSBzYW1lIGRlZmF1bHQgYXMgTGFtYmRhIGhhbmRsZXJzXG4gIGNvbnN0IHRpbWVvdXRNcyA9IENvcmVDb25zdGFudHMuSEFORExFUl9USU1FT1VUX01TO1xuICBhcHAudXNlKChfcmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pID0+IHtcbiAgICByZXMuc2V0VGltZW91dCh0aW1lb3V0TXMsICgpID0+IHtcbiAgICAgIGlmICghcmVzLmhlYWRlcnNTZW50KSB7XG4gICAgICAgIHNlbmRFcnJvcihyZXMsIDUwMywgJ1JlcXVlc3QgdGltZW91dCcpO1xuICAgICAgfVxuICAgIH0pO1xuICAgIG5leHQoKTtcbiAgfSk7XG5cbiAgLy8gUmVxdWVzdCBkdXJhdGlvbiBsb2dnaW5nXG4gIGNvbnN0IGR1cmF0aW9uTG9nZ2VyID0gY3JlYXRlTG9nZ2VyKCdyZXF1ZXN0LWR1cmF0aW9uJyk7XG4gIGFwcC51c2UoKHJlcTogUmVxdWVzdCwgcmVzOiBSZXNwb25zZSwgbmV4dDogTmV4dEZ1bmN0aW9uKSA9PiB7XG4gICAgY29uc3Qgc3RhcnQgPSBEYXRlLm5vdygpO1xuICAgIHJlcy5vbignZmluaXNoJywgKCkgPT4ge1xuICAgICAgY29uc3QgZHVyYXRpb24gPSBEYXRlLm5vdygpIC0gc3RhcnQ7XG4gICAgICAvLyBMb2cgYHJlcS5wYXRoYCAobm8gcXVlcnkgc3RyaW5nKSDigJQgYSBzdHJheSBgP3Rva2VuPWAvYD90aWNrZXQ9YCBtdXN0IG5vdCBiZVxuICAgICAgLy8gcGVyc2lzdGVkIHZlcmJhdGltIG9uIGV2ZXJ5IHJlcXVlc3QgKG1pcnJvcnMgdGhlIGF1dGh6LWRlbmlhbCBhdWRpdG9yJ3Mgc3RyaXApLlxuICAgICAgZHVyYXRpb25Mb2dnZXIuaW5mbyhgJHtyZXEubWV0aG9kfSAke3JlcS5wYXRofSAke3Jlcy5zdGF0dXNDb2RlfSAke2R1cmF0aW9ufW1zYCwge1xuICAgICAgICBtZXRob2Q6IHJlcS5tZXRob2QsXG4gICAgICAgIHBhdGg6IHJlcS5wYXRoLFxuICAgICAgICBzdGF0dXNDb2RlOiByZXMuc3RhdHVzQ29kZSxcbiAgICAgICAgZHVyYXRpb25NczogZHVyYXRpb24sXG4gICAgICAgIHJlcXVlc3RJZDogcmVxLnJlcXVlc3RJZCxcbiAgICAgIH0pO1xuICAgIH0pO1xuICAgIG5leHQoKTtcbiAgfSk7XG5cbiAgLy8gUHJvbWV0aGV1cyBtZXRyaWNzIG1pZGRsZXdhcmUg4oCUIHJlY29yZHMgcmVxdWVzdCBkdXJhdGlvbiBhbmQgY291bnRcbiAgYXBwLnVzZShtZXRyaWNzTWlkZGxld2FyZSgpKTtcblxuICAvLyBOT1RFOiBpZGVtcG90ZW5jeSBpcyBpbnRlbnRpb25hbGx5IE5PVCBtb3VudGVkIGhlcmUuIEl0IG5lZWRzIHRoZSBWRVJJRklFRFxuICAvLyBvcmcgaWQgdG8gbmFtZXNwYWNlIGl0cyByZXBsYXkgY2FjaGUsIGJ1dCB0aGlzIHByZS1hdXRoIHBvc2l0aW9uIHJ1bnMgYmVmb3JlXG4gIC8vIGByZXF1aXJlQXV0aGAvYGF0dGFjaFJlcXVlc3RDb250ZXh0YCBwb3B1bGF0ZSBpZGVudGl0eSwgc28gYSBnbG9iYWwgbW91bnRcbiAgLy8gaGVyZSBpcyBhIHBlcm1hbmVudCBuby1vcCAob3JnIGFsd2F5cyB1bmRlZmluZWQg4oaSIHNraXApLiBJdCBpcyBpbnN0ZWFkIHdpcmVkXG4gIC8vIGludG8gdGhlIHBvc3QtYXV0aCByb3V0ZSBjaGFpbnMg4oCUIHNlZSBgY3JlYXRlUHJvdGVjdGVkUm91dGVgIC9cbiAgLy8gYGNyZWF0ZUF1dGhlbnRpY2F0ZWRXaXRoT3JnUm91dGVgIGluIG1pZGRsZXdhcmUtZmFjdG9yeS50cy5cblxuICAvLyBTU0UgbG9ncyBlbmRwb2ludCDigJQgdGlja2V0LWdhdGVkIChXYXZlIDJiKS5cbiAgLy8gVGhlIHN0cmVhbSBjYXJyaWVzIHBlci1vcmcgYnVpbGQgbG9ncywgc28gaXQgbXVzdCBub3QgYmUgd29ybGQtcmVhZGFibGUuXG4gIC8vIENsaWVudHMgZmlyc3QgUE9TVCAvbG9ncy90aWNrZXQgKEpXVC1hdXRoZW50aWNhdGVkKSB0byBtaW50IGEgc2hvcnQtbGl2ZWQsXG4gIC8vIHNpbmdsZS11c2UgdGlja2V0IGJvdW5kIHRvIHRoZWlyIG9yZyBBTkQgdG8gdGhlIHNwZWNpZmljIGByZXF1ZXN0SWRgIHN0cmVhbVxuICAvLyB0aGV5IGludGVuZCB0byBvcGVuLCB0aGVuIG9wZW4gdGhlIEV2ZW50U291cmNlIHdpdGggP3RpY2tldD08dD4uIFRoaXMga2VlcHNcbiAgLy8gdGhlIEpXVCBvdXQgb2YgcXVlcnkgc3RyaW5ncyAvIGFjY2VzcyBsb2dzIHdoaWxlIGVuZm9yY2luZyBvcmcgb3duZXJzaGlwLFxuICAvLyBwZXItc3ViamVjdCBhdXRob3JpemF0aW9uLCBhbmQgdGhlIHBlci1vcmcgY29ubmVjdGlvbiBjYXAgb24gdGhlIHN0cmVhbS5cbiAgLy8gTWlycm9ycyB0aGUgbWVzc2FnZS1zZXJ2aWNlIG5vdGlmaWNhdGlvbnMgU1NFIHRpY2tldCBleGNoYW5nZS5cbiAgYXBwLnBvc3QoJy9sb2dzL3RpY2tldCcsIHJlcXVpcmVBdXRoLCBhc3luYyAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlKSA9PiB7XG4gICAgY29uc3Qgb3JnSWQgPSByZXEudXNlcj8ub3JnYW5pemF0aW9uSWQ/LnRvTG93ZXJDYXNlKCk7XG4gICAgaWYgKCFvcmdJZCkge1xuICAgICAgc2VuZEVycm9yKHJlcywgNDAwLCAnVG9rZW4gbWlzc2luZyBvcmdhbml6YXRpb24nLCBFcnJvckNvZGUuVkFMSURBVElPTl9FUlJPUik7XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIC8vIFRoZSBjYWxsZXIgbXVzdCBuYW1lIHRoZSBzdHJlYW0gc3ViamVjdCB1cCBmcm9udCBzbyB0aGUgdGlja2V0IGlzIGJvdW5kIHRvXG4gICAgLy8gaXQuIFdpdGhvdXQgdGhpcywgYSB0aWNrZXQgY291bGQgYmUgcmVwbGF5ZWQgYWdhaW5zdCBBTlkgcmVxdWVzdElkIHRoZVxuICAgIC8vIG9yZyBjb3VsZCBndWVzcywgbGV0dGluZyBpdCBhdHRhY2ggdG8gYW5vdGhlciBvcmcncyBsb2cgc3RyZWFtLiBTdHJpY3RseVxuICAgIC8vIGZvcm1hdC12YWxpZGF0ZWQgc28gaXQgY2FuJ3QgY2FycnkgYW4gaW5qZWN0aW9uIHBheWxvYWQgaW50byB0aGUgc3ViamVjdC5cbiAgICBjb25zdCByZXF1ZXN0SWQgPSAocmVxLmJvZHkgYXMgeyByZXF1ZXN0SWQ/OiB1bmtub3duIH0gfCB1bmRlZmluZWQpPy5yZXF1ZXN0SWQ7XG4gICAgaWYgKHR5cGVvZiByZXF1ZXN0SWQgIT09ICdzdHJpbmcnIHx8ICFTU0VfUkVRVUVTVF9JRF9SRS50ZXN0KHJlcXVlc3RJZCkpIHtcbiAgICAgIHNlbmRFcnJvcihyZXMsIDQwMCwgJ01pc3Npbmcgb3IgaW52YWxpZCByZXF1ZXN0SWQnLCBFcnJvckNvZGUuVkFMSURBVElPTl9FUlJPUik7XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHNzZU1hbmFnZXIuY3JlYXRlVGlja2V0KG9yZ0lkLCByZXF1ZXN0SWQpO1xuICAgIGlmICghcmVzdWx0Lm9rKSB7XG4gICAgICBpZiAocmVzdWx0LnJlYXNvbiA9PT0gJ2ZvcmJpZGRlbicpIHtcbiAgICAgICAgLy8gVGhlIHN1YmplY3QgaXMgb3duZWQgYnkgYW5vdGhlciBvcmcg4oCUIGRvIG5vdCBjb25maXJtIGl0IGV4aXN0czsgYSBwbGFpblxuICAgICAgICAvLyA0MDMgaXMgZW5vdWdoIGFuZCBsZWFrcyBub3RoaW5nIGFib3V0IHdoaWNoIHJlcXVlc3RJZHMgYXJlIGxpdmUuXG4gICAgICAgIHNlbmRFcnJvcihyZXMsIDQwMywgJ05vdCBhdXRob3JpemVkIGZvciB0aGlzIGxvZyBzdHJlYW0nLCBFcnJvckNvZGUuSU5TVUZGSUNJRU5UX1BFUk1JU1NJT05TKTtcbiAgICAgIH0gZWxzZSBpZiAocmVzdWx0LnJlYXNvbiA9PT0gJ29yZy1saW1pdCcpIHtcbiAgICAgICAgc2VuZEVycm9yKHJlcywgNDI5LCAnVG9vIG1hbnkgbG9nIHN0cmVhbSB0aWNrZXRzIGlzc3VlZCcsIEVycm9yQ29kZS5RVU9UQV9FWENFRURFRCk7XG4gICAgICB9IGVsc2Uge1xuICAgICAgICBzZW5kRXJyb3IocmVzLCA1MDMsICdMb2cgc3RyZWFtaW5nIHN1YnN5c3RlbSBhdCBjYXBhY2l0eScsIEVycm9yQ29kZS5RVU9UQV9FWENFRURFRCk7XG4gICAgICB9XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIHNlbmRTdWNjZXNzKHJlcywgMjAwLCB7IHRpY2tldDogcmVzdWx0LnRpY2tldCB9KTtcbiAgfSk7XG5cbiAgLy8gVGhlIHN0cmVhbSBpdHNlbGYgcmVzb2x2ZXMgKyBjb25zdW1lcyB0aGUgdGlja2V0IGluc2lkZSBtaWRkbGV3YXJlKCkgYW5kXG4gIC8vIHJlamVjdHMgYW55IGFub255bW91cyAvIGludmFsaWQgLyBleHBpcmVkIC8gYWxyZWFkeS11c2VkIHRpY2tldCB3aXRoIDQwMS5cbiAgYXBwLmdldCgnL2xvZ3MvOnJlcXVlc3RJZCcsIHNzZU1hbmFnZXIubWlkZGxld2FyZSgpKTtcblxuICByZXR1cm4geyBhcHAsIHNzZU1hbmFnZXIgfTtcbn1cbiJdfQ==

package/lib/api/check-quota.d.ts

@@ -0,0 +1,13 @@
+import type { QuotaType, QuotaService } from '@pipeline-builder/api-core';
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Create middleware that checks a specific quota type before proceeding.
+ *
+ * On quota exceeded, returns a 429 response with quota details.
+ * On quota service failure, fails open (allows the request).
+ *
+ * @param quotaService - Quota service client
+ * @param quotaType - Which quota to check (e.g. 'apiCalls', 'pipelines', 'plugins')
+ * @returns Express middleware
+ */
+export declare function checkQuota(quotaService: QuotaService, quotaType: QuotaType): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/lib/api/check-quota.js

@@ -0,0 +1,74 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { ErrorCode, createLogger, sendError, sendQuotaExceeded } from '@pipeline-builder/api-core';
+import { getContext } from './get-context.js';
+const logger = createLogger('check-quota');
+/** Human-readable labels for quota exceeded messages. */
+const QUOTA_LABELS = {
+    apiCalls: 'API call',
+    aiCalls: 'AI call',
+    pipelines: 'Pipeline',
+    plugins: 'Plugin',
+    storageBytes: 'Registry storage',
+    dashboards: 'Dashboard',
+    alertRules: 'Alert rule',
+    alertDestinations: 'Alert destination',
+    idpConfigs: 'IdP configuration',
+};
+/**
+ * Create middleware that checks a specific quota type before proceeding.
+ *
+ * On quota exceeded, returns a 429 response with quota details.
+ * On quota service failure, fails open (allows the request).
+ *
+ * @param quotaService - Quota service client
+ * @param quotaType - Which quota to check (e.g. 'apiCalls', 'pipelines', 'plugins')
+ * @returns Express middleware
+ */
+export function checkQuota(quotaService, quotaType) {
+    return async (req, res, next) => {
+        let orgId;
+        let authHeader = '';
+        try {
+            const ctx = getContext(req);
+            orgId = ctx.identity.orgId;
+            authHeader = req.headers.authorization || '';
+        }
+        catch {
+            // Context middleware not applied — fail open (log and continue)
+            logger.warn('Quota check skipped: request context not initialized');
+            return next();
+        }
+        if (!orgId) {
+            sendError(res, 400, 'Organization ID is required for quota check', ErrorCode.VALIDATION_ERROR);
+            return;
+        }
+        try {
+            const quotaStatus = await quotaService.check(orgId, quotaType, authHeader);
+            if (!quotaStatus.allowed) {
+                logger.warn(`${quotaType} quota exceeded`, {
+                    orgId,
+                    limit: quotaStatus.limit,
+                    used: quotaStatus.used,
+                });
+                // Route through the shared helper so the check-gate 429 emits the same
+                // Retry-After + X-Quota-* headers as the reserve-path 429 (the inline
+                // 429 this replaced omitted them). Custom message keeps the
+                // "contact your administrator" copy.
+                sendQuotaExceeded(res, quotaType, { type: quotaType, limit: quotaStatus.limit, used: quotaStatus.used, remaining: quotaStatus.remaining }, quotaStatus.resetAt, `${QUOTA_LABELS[quotaType]} quota exceeded. Please contact your administrator to increase your quota.`);
+                return;
+            }
+            next();
+        }
+        catch (error) {
+            // Fail open — allow the request if quota service is unavailable
+            logger.warn('QUOTA_FAIL_OPEN: Quota check exception, allowing request', {
+                orgId,
+                quotaType,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            next();
+        }
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hlY2stcXVvdGEuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpL2NoZWNrLXF1b3RhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFHbkcsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRTlDLE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxhQUFhLENBQUMsQ0FBQztBQUUzQyx5REFBeUQ7QUFDekQsTUFBTSxZQUFZLEdBQThCO0lBQzlDLFFBQVEsRUFBRSxVQUFVO0lBQ3BCLE9BQU8sRUFBRSxTQUFTO0lBQ2xCLFNBQVMsRUFBRSxVQUFVO0lBQ3JCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFlBQVksRUFBRSxrQkFBa0I7SUFDaEMsVUFBVSxFQUFFLFdBQVc7SUFDdkIsVUFBVSxFQUFFLFlBQVk7SUFDeEIsaUJBQWlCLEVBQUUsbUJBQW1CO0lBQ3RDLFVBQVUsRUFBRSxtQkFBbUI7Q0FDaEMsQ0FBQztBQUVGOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sVUFBVSxVQUFVLENBQ3hCLFlBQTBCLEVBQzFCLFNBQW9CO0lBRXBCLE9BQU8sS0FBSyxFQUFFLEdBQVksRUFBRSxHQUFhLEVBQUUsSUFBa0IsRUFBaUIsRUFBRTtRQUM5RSxJQUFJLEtBQXlCLENBQUM7UUFDOUIsSUFBSSxVQUFVLEdBQUcsRUFBRSxDQUFDO1FBRXBCLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM1QixLQUFLLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7WUFDM0IsVUFBVSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsYUFBYSxJQUFJLEVBQUUsQ0FBQztRQUMvQyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsZ0VBQWdFO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0RBQXNELENBQUMsQ0FBQztZQUNwRSxPQUFPLElBQUksRUFBRSxDQUFDO1FBQ2hCLENBQUM7UUFFRCxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWCxTQUFTLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSw2Q0FBNkMsRUFBRSxTQUFTLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUMvRixPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sV0FBVyxHQUFHLE1BQU0sWUFBWSxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBRTNFLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLGlCQUFpQixFQUFFO29CQUN6QyxLQUFLO29CQUNMLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSztvQkFDeEIsSUFBSSxFQUFFLFdBQVcsQ0FBQyxJQUFJO2lCQUN2QixDQUFDLENBQUM7Z0JBRUgsdUVBQXVFO2dCQUN2RSxzRUFBc0U7Z0JBQ3RFLDREQUE0RDtnQkFDNUQscUNBQXFDO2dCQUNyQyxpQkFBaUIsQ0FDZixHQUFHLEVBQ0gsU0FBUyxFQUNULEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsV0FBVyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUN2RyxXQUFXLENBQUMsT0FBTyxFQUNuQixHQUFHLFlBQVksQ0FBQyxTQUFTLENBQUMsNEVBQTRFLENBQ3ZHLENBQUM7Z0JBQ0YsT0FBTztZQUNULENBQUM7WUFFRCxJQUFJLEVBQUUsQ0FBQztRQUNULENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsZ0VBQWdFO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELEVBQUU7Z0JBQ3RFLEtBQUs7Z0JBQ0wsU0FBUztnQkFDVCxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQzthQUM5RCxDQUFDLENBQUM7WUFDSCxJQUFJLEVBQUUsQ0FBQztRQUNULENBQUM7SUFDSCxDQUFDLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IEVycm9yQ29kZSwgY3JlYXRlTG9nZ2VyLCBzZW5kRXJyb3IsIHNlbmRRdW90YUV4Y2VlZGVkIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUnO1xuaW1wb3J0IHR5cGUgeyBRdW90YVR5cGUsIFF1b3RhU2VydmljZSB9IGZyb20gJ0BwaXBlbGluZS1idWlsZGVyL2FwaS1jb3JlJztcbmltcG9ydCB0eXBlIHsgUmVxdWVzdCwgUmVzcG9uc2UsIE5leHRGdW5jdGlvbiB9IGZyb20gJ2V4cHJlc3MnO1xuaW1wb3J0IHsgZ2V0Q29udGV4dCB9IGZyb20gJy4vZ2V0LWNvbnRleHQuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ2NoZWNrLXF1b3RhJyk7XG5cbi8qKiBIdW1hbi1yZWFkYWJsZSBsYWJlbHMgZm9yIHF1b3RhIGV4Y2VlZGVkIG1lc3NhZ2VzLiAqL1xuY29uc3QgUVVPVEFfTEFCRUxTOiBSZWNvcmQ8UXVvdGFUeXBlLCBzdHJpbmc+ID0ge1xuICBhcGlDYWxsczogJ0FQSSBjYWxsJyxcbiAgYWlDYWxsczogJ0FJIGNhbGwnLFxuICBwaXBlbGluZXM6ICdQaXBlbGluZScsXG4gIHBsdWdpbnM6ICdQbHVnaW4nLFxuICBzdG9yYWdlQnl0ZXM6ICdSZWdpc3RyeSBzdG9yYWdlJyxcbiAgZGFzaGJvYXJkczogJ0Rhc2hib2FyZCcsXG4gIGFsZXJ0UnVsZXM6ICdBbGVydCBydWxlJyxcbiAgYWxlcnREZXN0aW5hdGlvbnM6ICdBbGVydCBkZXN0aW5hdGlvbicsXG4gIGlkcENvbmZpZ3M6ICdJZFAgY29uZmlndXJhdGlvbicsXG59O1xuXG4vKipcbiAqIENyZWF0ZSBtaWRkbGV3YXJlIHRoYXQgY2hlY2tzIGEgc3BlY2lmaWMgcXVvdGEgdHlwZSBiZWZvcmUgcHJvY2VlZGluZy5cbiAqXG4gKiBPbiBxdW90YSBleGNlZWRlZCwgcmV0dXJucyBhIDQyOSByZXNwb25zZSB3aXRoIHF1b3RhIGRldGFpbHMuXG4gKiBPbiBxdW90YSBzZXJ2aWNlIGZhaWx1cmUsIGZhaWxzIG9wZW4gKGFsbG93cyB0aGUgcmVxdWVzdCkuXG4gKlxuICogQHBhcmFtIHF1b3RhU2VydmljZSAtIFF1b3RhIHNlcnZpY2UgY2xpZW50XG4gKiBAcGFyYW0gcXVvdGFUeXBlIC0gV2hpY2ggcXVvdGEgdG8gY2hlY2sgKGUuZy4gJ2FwaUNhbGxzJywgJ3BpcGVsaW5lcycsICdwbHVnaW5zJylcbiAqIEByZXR1cm5zIEV4cHJlc3MgbWlkZGxld2FyZVxuICovXG5leHBvcnQgZnVuY3Rpb24gY2hlY2tRdW90YShcbiAgcXVvdGFTZXJ2aWNlOiBRdW90YVNlcnZpY2UsXG4gIHF1b3RhVHlwZTogUXVvdGFUeXBlLFxuKSB7XG4gIHJldHVybiBhc3luYyAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pOiBQcm9taXNlPHZvaWQ+ID0+IHtcbiAgICBsZXQgb3JnSWQ6IHN0cmluZyB8IHVuZGVmaW5lZDtcbiAgICBsZXQgYXV0aEhlYWRlciA9ICcnO1xuXG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IGN0eCA9IGdldENvbnRleHQocmVxKTtcbiAgICAgIG9yZ0lkID0gY3R4LmlkZW50aXR5Lm9yZ0lkO1xuICAgICAgYXV0aEhlYWRlciA9IHJlcS5oZWFkZXJzLmF1dGhvcml6YXRpb24gfHwgJyc7XG4gICAgfSBjYXRjaCB7XG4gICAgICAvLyBDb250ZXh0IG1pZGRsZXdhcmUgbm90IGFwcGxpZWQg4oCUIGZhaWwgb3BlbiAobG9nIGFuZCBjb250aW51ZSlcbiAgICAgIGxvZ2dlci53YXJuKCdRdW90YSBjaGVjayBza2lwcGVkOiByZXF1ZXN0IGNvbnRleHQgbm90IGluaXRpYWxpemVkJyk7XG4gICAgICByZXR1cm4gbmV4dCgpO1xuICAgIH1cblxuICAgIGlmICghb3JnSWQpIHtcbiAgICAgIHNlbmRFcnJvcihyZXMsIDQwMCwgJ09yZ2FuaXphdGlvbiBJRCBpcyByZXF1aXJlZCBmb3IgcXVvdGEgY2hlY2snLCBFcnJvckNvZGUuVkFMSURBVElPTl9FUlJPUik7XG4gICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHF1b3RhU3RhdHVzID0gYXdhaXQgcXVvdGFTZXJ2aWNlLmNoZWNrKG9yZ0lkLCBxdW90YVR5cGUsIGF1dGhIZWFkZXIpO1xuXG4gICAgICBpZiAoIXF1b3RhU3RhdHVzLmFsbG93ZWQpIHtcbiAgICAgICAgbG9nZ2VyLndhcm4oYCR7cXVvdGFUeXBlfSBxdW90YSBleGNlZWRlZGAsIHtcbiAgICAgICAgICBvcmdJZCxcbiAgICAgICAgICBsaW1pdDogcXVvdGFTdGF0dXMubGltaXQsXG4gICAgICAgICAgdXNlZDogcXVvdGFTdGF0dXMudXNlZCxcbiAgICAgICAgfSk7XG5cbiAgICAgICAgLy8gUm91dGUgdGhyb3VnaCB0aGUgc2hhcmVkIGhlbHBlciBzbyB0aGUgY2hlY2stZ2F0ZSA0MjkgZW1pdHMgdGhlIHNhbWVcbiAgICAgICAgLy8gUmV0cnktQWZ0ZXIgKyBYLVF1b3RhLSogaGVhZGVycyBhcyB0aGUgcmVzZXJ2ZS1wYXRoIDQyOSAodGhlIGlubGluZVxuICAgICAgICAvLyA0MjkgdGhpcyByZXBsYWNlZCBvbWl0dGVkIHRoZW0pLiBDdXN0b20gbWVzc2FnZSBrZWVwcyB0aGVcbiAgICAgICAgLy8gXCJjb250YWN0IHlvdXIgYWRtaW5pc3RyYXRvclwiIGNvcHkuXG4gICAgICAgIHNlbmRRdW90YUV4Y2VlZGVkKFxuICAgICAgICAgIHJlcyxcbiAgICAgICAgICBxdW90YVR5cGUsXG4gICAgICAgICAgeyB0eXBlOiBxdW90YVR5cGUsIGxpbWl0OiBxdW90YVN0YXR1cy5saW1pdCwgdXNlZDogcXVvdGFTdGF0dXMudXNlZCwgcmVtYWluaW5nOiBxdW90YVN0YXR1cy5yZW1haW5pbmcgfSxcbiAgICAgICAgICBxdW90YVN0YXR1cy5yZXNldEF0LFxuICAgICAgICAgIGAke1FVT1RBX0xBQkVMU1txdW90YVR5cGVdfSBxdW90YSBleGNlZWRlZC4gUGxlYXNlIGNvbnRhY3QgeW91ciBhZG1pbmlzdHJhdG9yIHRvIGluY3JlYXNlIHlvdXIgcXVvdGEuYCxcbiAgICAgICAgKTtcbiAgICAgICAgcmV0dXJuO1xuICAgICAgfVxuXG4gICAgICBuZXh0KCk7XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIC8vIEZhaWwgb3BlbiDigJQgYWxsb3cgdGhlIHJlcXVlc3QgaWYgcXVvdGEgc2VydmljZSBpcyB1bmF2YWlsYWJsZVxuICAgICAgbG9nZ2VyLndhcm4oJ1FVT1RBX0ZBSUxfT1BFTjogUXVvdGEgY2hlY2sgZXhjZXB0aW9uLCBhbGxvd2luZyByZXF1ZXN0Jywge1xuICAgICAgICBvcmdJZCxcbiAgICAgICAgcXVvdGFUeXBlLFxuICAgICAgICBlcnJvcjogZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IGVycm9yLm1lc3NhZ2UgOiBTdHJpbmcoZXJyb3IpLFxuICAgICAgfSk7XG4gICAgICBuZXh0KCk7XG4gICAgfVxuICB9O1xufVxuIl19

package/lib/api/context-middleware.d.ts

@@ -0,0 +1,34 @@
+import type { RequestHandler } from 'express';
+import type { SSEManager } from '../http/sse-connection-manager.js';
+/**
+ * Creates middleware that attaches RequestContext to req.context
+ *
+ * The context includes:
+ * - requestId: Unique request identifier
+ * - identity: User identity from JWT (orgId, userId, role)
+ * - log: Logger function that sends to both Winston and SSE
+ *
+ * @param sseManager - SSE manager for real-time logging
+ * @returns Express middleware that attaches context to req.context
+ *
+ * @example
+ * ```typescript
+ * const { app, sseManager } = createApp();
+ *
+ * // Apply context middleware globally
+ * app.use(attachRequestContext(sseManager));
+ *
+ * // Use context in route handlers
+ * app.get('/pipelines', requireAuth, async (req, res) => {
+ *   const ctx = getContext(req);
+ *   ctx.log('INFO', 'Fetching pipelines');
+ *
+ *   if (!ctx.identity.orgId) {
+ *     return sendError(res, 400, 'Organization ID required');
+ *   }
+ *
+ *   // ... rest of handler
+ * });
+ * ```
+ */
+export declare function attachRequestContext(sseManager: SSEManager): RequestHandler;

package/lib/api/context-middleware.js

@@ -0,0 +1,42 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { createRequestContext } from './request-types.js';
+/**
+ * Creates middleware that attaches RequestContext to req.context
+ *
+ * The context includes:
+ * - requestId: Unique request identifier
+ * - identity: User identity from JWT (orgId, userId, role)
+ * - log: Logger function that sends to both Winston and SSE
+ *
+ * @param sseManager - SSE manager for real-time logging
+ * @returns Express middleware that attaches context to req.context
+ *
+ * @example
+ * ```typescript
+ * const { app, sseManager } = createApp();
+ *
+ * // Apply context middleware globally
+ * app.use(attachRequestContext(sseManager));
+ *
+ * // Use context in route handlers
+ * app.get('/pipelines', requireAuth, async (req, res) => {
+ *   const ctx = getContext(req);
+ *   ctx.log('INFO', 'Fetching pipelines');
+ *
+ *   if (!ctx.identity.orgId) {
+ *     return sendError(res, 400, 'Organization ID required');
+ *   }
+ *
+ *   // ... rest of handler
+ * });
+ * ```
+ */
+export function attachRequestContext(sseManager) {
+    return (req, _res, next) => {
+        // Create and attach context to request
+        req.context = createRequestContext(req, sseManager);
+        next();
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGV4dC1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwaS9jb250ZXh0LW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUd0QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUcxRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBOEJHO0FBQ0gsTUFBTSxVQUFVLG9CQUFvQixDQUFDLFVBQXNCO0lBQ3pELE9BQU8sQ0FBQyxHQUFZLEVBQUUsSUFBYyxFQUFFLElBQWtCLEVBQVEsRUFBRTtRQUNoRSx1Q0FBdUM7UUFDdkMsR0FBRyxDQUFDLE9BQU8sR0FBRyxvQkFBb0IsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDcEQsSUFBSSxFQUFFLENBQUM7SUFDVCxDQUFDLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB0eXBlIHsgUmVxdWVzdCwgUmVzcG9uc2UsIE5leHRGdW5jdGlvbiwgUmVxdWVzdEhhbmRsZXIgfSBmcm9tICdleHByZXNzJztcbmltcG9ydCB7IGNyZWF0ZVJlcXVlc3RDb250ZXh0IH0gZnJvbSAnLi9yZXF1ZXN0LXR5cGVzLmpzJztcbmltcG9ydCB0eXBlIHsgU1NFTWFuYWdlciB9IGZyb20gJy4uL2h0dHAvc3NlLWNvbm5lY3Rpb24tbWFuYWdlci5qcyc7XG5cbi8qKlxuICogQ3JlYXRlcyBtaWRkbGV3YXJlIHRoYXQgYXR0YWNoZXMgUmVxdWVzdENvbnRleHQgdG8gcmVxLmNvbnRleHRcbiAqXG4gKiBUaGUgY29udGV4dCBpbmNsdWRlczpcbiAqIC0gcmVxdWVzdElkOiBVbmlxdWUgcmVxdWVzdCBpZGVudGlmaWVyXG4gKiAtIGlkZW50aXR5OiBVc2VyIGlkZW50aXR5IGZyb20gSldUIChvcmdJZCwgdXNlcklkLCByb2xlKVxuICogLSBsb2c6IExvZ2dlciBmdW5jdGlvbiB0aGF0IHNlbmRzIHRvIGJvdGggV2luc3RvbiBhbmQgU1NFXG4gKlxuICogQHBhcmFtIHNzZU1hbmFnZXIgLSBTU0UgbWFuYWdlciBmb3IgcmVhbC10aW1lIGxvZ2dpbmdcbiAqIEByZXR1cm5zIEV4cHJlc3MgbWlkZGxld2FyZSB0aGF0IGF0dGFjaGVzIGNvbnRleHQgdG8gcmVxLmNvbnRleHRcbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgeyBhcHAsIHNzZU1hbmFnZXIgfSA9IGNyZWF0ZUFwcCgpO1xuICpcbiAqIC8vIEFwcGx5IGNvbnRleHQgbWlkZGxld2FyZSBnbG9iYWxseVxuICogYXBwLnVzZShhdHRhY2hSZXF1ZXN0Q29udGV4dChzc2VNYW5hZ2VyKSk7XG4gKlxuICogLy8gVXNlIGNvbnRleHQgaW4gcm91dGUgaGFuZGxlcnNcbiAqIGFwcC5nZXQoJy9waXBlbGluZXMnLCByZXF1aXJlQXV0aCwgYXN5bmMgKHJlcSwgcmVzKSA9PiB7XG4gKiAgIGNvbnN0IGN0eCA9IGdldENvbnRleHQocmVxKTtcbiAqICAgY3R4LmxvZygnSU5GTycsICdGZXRjaGluZyBwaXBlbGluZXMnKTtcbiAqXG4gKiAgIGlmICghY3R4LmlkZW50aXR5Lm9yZ0lkKSB7XG4gKiAgICAgcmV0dXJuIHNlbmRFcnJvcihyZXMsIDQwMCwgJ09yZ2FuaXphdGlvbiBJRCByZXF1aXJlZCcpO1xuICogICB9XG4gKlxuICogICAvLyAuLi4gcmVzdCBvZiBoYW5kbGVyXG4gKiB9KTtcbiAqIGBgYFxuICovXG5leHBvcnQgZnVuY3Rpb24gYXR0YWNoUmVxdWVzdENvbnRleHQoc3NlTWFuYWdlcjogU1NFTWFuYWdlcik6IFJlcXVlc3RIYW5kbGVyIHtcbiAgcmV0dXJuIChyZXE6IFJlcXVlc3QsIF9yZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pOiB2b2lkID0+IHtcbiAgICAvLyBDcmVhdGUgYW5kIGF0dGFjaCBjb250ZXh0IHRvIHJlcXVlc3RcbiAgICByZXEuY29udGV4dCA9IGNyZWF0ZVJlcXVlc3RDb250ZXh0KHJlcSwgc3NlTWFuYWdlcik7XG4gICAgbmV4dCgpO1xuICB9O1xufVxuIl19

package/lib/api/etag-middleware.d.ts

@@ -0,0 +1,7 @@
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Middleware that adds ETag support for conditional GET requests.
+ * Generates a weak ETag from the response body hash.
+ * Returns 304 Not Modified when the client's If-None-Match header matches.
+ */
+export declare function etagMiddleware(): (req: Request, res: Response, next: NextFunction) => void;