aws-cdk-github-oidc 5.0.2 → 5.1.1

package/.jsii

@@ -9011,7 +9011,7 @@
     "stability": "experimental"
   },
   "homepage": "https://github.com/aripalo/aws-cdk-github-oidc.git",
-  "jsiiVersion": "6.0.9 (build 547955e)",
+  "jsiiVersion": "6.0.14 (build 44649f3)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -9035,7 +9035,7 @@
   },
   "name": "aws-cdk-github-oidc",
   "readme": {
-    "markdown": "> [!IMPORTANT]\n> Migrating **to `v4`**? See [Migration Guide](#migration-guide) at the end of this README.\n\n\n# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\npnpm add -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n  scope,\n  \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n  provider: provider, // reference into the OIDC provider\n  owner: \"octo-org\", // your repository owner (organization or user) name\n  repo: \"octo-repo\", // your repository name (without the owner name)\n  filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  roleName: \"MyDeployRole\",\n  description: \"This role deploys stuff to AWS\",\n  maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n  iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value                 | Descrition                               |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'`           | Allow only tags with prefix of `v`       |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch`     |\n| `'pull_request'`               | Allow only from pull request             |\n| `'environment:Production'`     | Allow only from `Production` environment |\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\n```yaml\njobs:\n  whoami:\n    name: Who Am I\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n    steps:\n      - name: Configure AWS credentials\n        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n          #role-session-name: MySessionName # Optional\n          aws-region: us-east-1\n      - name: Get Caller Identity\n        run: |\n          aws sts get-caller-identity\n```\n\n<br/>\n\n\n## Migration Guide\n\n- [v2→v3](#v2v3)\n- [v3→v4](#v3v4)\n\n### v2→v3\n\n1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):\n\n    ```sh\n    pnpm add -D aws-cdk-lib@^2.237.0\n    ```\n\n2. Install `v3.1.0` (or newer v3 release) of this library:\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^3.1\n    ```\n\n3. No additional steps required, as the v3 major version does not introduce any breaking changes (just a lot of internal tooling changes).\n\n### v3→v4\n\n> [!CAUTION]\n> The following steps describe a _**no-downtime** migration path_.\n> It is the recommended approach, but somewhat _involved_: Hence some users may decide to use \"destroy + redeploy\" strategy instead, which causes downtime to authenticating from GitHub Actions to AWS using OIDC.\n\n1. Ensure you are running `v3.1.0` (or newer v3 release) of this library, see [v2→v3](#v2v3).\n\n2. Configure `RETAIN` removal policy for the provider:\n\n    ```diff\n    const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    });\n    ```\n\n3. Run `pnpm exec cdk diff`, which will show an output similar to:\n\n    ```sh\n    Resources\n    [~] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB\n    ├─ [~] DeletionPolicy\n    │   ├─ [-] Delete\n    │   └─ [+] Retain\n    └─ [~] UpdateReplacePolicy\n        ├─ [-] Delete\n        └─ [+] Retain\n    ```\n\n\n4. Deploy the changes `pnpm exec cdk deploy`\n\n5. Once the `RETAIN` removal policy has been successfully deployed, upgrade this library to `v4.2` (or newer v4 release):\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^4.2\n    ```\n\n6. Temporarily change from provider initializion to provider lookup:\n\n    ```diff\n    - const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    -  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    - });\n    + const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\"); // NOTICE the different construct ID\n    ```\n    ⚠️ **Notice the different construct ID** (in the example `GithubProviderReference` instead of ~~`GithubProvider`~~). This is required so that the CDK treats the GitHub OIDC provider lookup as a different \"thing\" and does not try to change the type of existing construct.\n\n7. Check `pnpm exec cdk diff` which should look similar to:\n    ```sh\n    Resources\n    [-] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB orphan\n    [-] AWS::IAM::Role Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Role CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65 destroy\n    [-] AWS::Lambda::Function Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Handler CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0 destroy\n    ```\n\n8. Deploy the changes with `pnpm exec cdk deploy`\n\n9. Once the deployment has succeeded, remove the provider lookup and replace it with the original provider initialization:\n\n    ```diff\n    - const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\");\n    + const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    + });\n    ```\n\n10. Copy the ARN of the existing OIDC provider, it will be in the format of:\n\n    ```\n    arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com # REPLACE with your account ID\n    ```\n\n11. Use [cdk import](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html):\n\n    ```sh\n    pnpm exec cdk import <YOUR_STACK_NAME>\n    ```\n\n    ... and when asked, input the provider ARN you copied in step 10:\n    ```sh\n    <YOUR_STACK_NAME>/GithubProvider/Resource (AWS::IAM::OIDCProvider): enter Arn (empty to skip)\n    ```\n\n12. You should be done now, but you may want to **perform manual verification** in addition to [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html) and/or `cdk diff``\u001b to verify.\n\n\n\n"
+    "markdown": "> [!IMPORTANT]\n> Migrating **to `v4`**? See [Migration Guide](#migration-guide) at the end of this README.\n\n\n# AWS CDK Github OpenID Connect\n\n![cdk-support](https://img.shields.io/badge/cdk-%20typescript%20|%20python%20-informational \"TypeScript | Python\")\n[![release](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml/badge.svg)](https://github.com/aripalo/aws-cdk-github-oidc/actions/workflows/release.yml)\n[![codecov](https://codecov.io/gh/aripalo/aws-cdk-github-oidc/branch/main/graph/badge.svg?token=5X44RM6J17)](https://codecov.io/gh/aripalo/aws-cdk-github-oidc)\n\n---\n\nAWS [CDK](https://aws.amazon.com/cdk/) constructs that define:\n\n- Github Actions as OpenID Connect Identity Provider into AWS IAM\n- IAM Roles that can be assumed by Github Actions workflows\n\nThese constructs allows you to harden your AWS deployment security by removing the need to create long-term access keys for Github Actions and instead use OpenID Connect to Authenticate your Github Action workflow with AWS IAM.\n\n## Background information\n\n![github-aws-oidc](/assets/github-aws-oidc.svg \"Github OIDC with AWS\")\n\n- [GitHub Actions: Secure cloud deployments with OpenID Connect](https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/) on Github Changelog Blog.\n- [Security hardening your deployments](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments) on Github Docs.\n- [Assuming a role with `aws-actions/configure-aws-credentials`](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n- Shout-out to [Richard H. Boyd](https://twitter.com/rchrdbyd) for helping me to debug Github OIDC setup with AWS IAM and his [Deploying to AWS with Github Actions](https://www.githubuniverse.com/2021/session/692586/deploying-to-aws-with-github-actions)-talk.\n- Shout-out to [Aidan W Steele](https://twitter.com/__steele) and his blog post [AWS federation comes to GitHub Actions](https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html) for being the original inspiration for this.\n\n<br/>\n\n## Getting started\n\n```shell\npnpm add -D aws-cdk-github-oidc\n```\n\n<br/>\n\n### OpenID Connect Identity Provider trust for AWS IAM\n\nTo create a new Github OIDC provider configuration into AWS IAM:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = new GithubActionsIdentityProvider(scope, \"GithubProvider\");\n```\n\nIn the background this creates an OIDC provider trust configuration into AWS IAM with an [issuer URL of `https://token.actions.githubusercontent.com`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) and audiences (client IDs) configured as `['sts.amazonaws.com']` (which matches the [`aws-actions/configure-aws-credentials`](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#adding-the-identity-provider-to-aws) implementation).\n\n<br/>\n\n### Retrieving a reference to an existing Github OIDC provider configuration\n\nRemember, **there can be only one (Github OIDC provider per AWS Account)**, so to retrieve a reference to existing Github OIDC provider use `fromAccount` static method:\n\n```ts\nimport { GithubActionsIdentityProvider } from \"aws-cdk-github-oidc\";\n\nconst provider = GithubActionsIdentityProvider.fromAccount(\n  scope,\n  \"GithubProvider\"\n);\n```\n\n<br/>\n\n### Defining a role for Github Actions workflow to assume\n\n```ts\nimport { GithubActionsRole } from \"aws-cdk-github-oidc\";\n\nconst uploadRole = new GithubActionsRole(scope, \"UploadRole\", {\n  provider: provider, // reference into the OIDC provider\n  owner: \"octo-org\", // your repository owner (organization or user) name\n  repo: \"octo-repo\", // your repository name (without the owner name)\n  filter: \"ref:refs/tags/v*\", // JWT sub suffix filter, defaults to '*'\n});\n\n// use it like any other role, for example grant S3 bucket write access:\nmyBucket.grantWrite(uploadRole);\n```\n\nYou may pass in any `iam.RoleProps` into the construct's props, except `assumedBy` which will be defined by this construct (CDK will fail if you do):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  roleName: \"MyDeployRole\",\n  description: \"This role deploys stuff to AWS\",\n  maxSessionDuration: cdk.Duration.hours(2),\n});\n\n// You may also use various \"add*\" policy methods!\n// \"AdministratorAccess\" not really a good idea, just for an example here:\ndeployRole.addManagedPolicy(\n  iam.ManagedPolicy.fromAwsManagedPolicyName(\"AdministratorAccess\")\n);\n```\n\n<br/>\n\n#### Subject Filter\n\nBy default the value of `filter` property will be `'*'` which means any workflow (from given repository) from any branch, tag, environment or pull request can assume this role. To further stricten the OIDC trust policy on the role, you may adjust the subject filter as seen on the [examples in Github Docs](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#configuring-the-oidc-trust-with-the-cloud); For example:\n\n| `filter` value                 | Descrition                               |\n| :----------------------------- | :--------------------------------------- |\n| `'ref:refs/tags/v*'`           | Allow only tags with prefix of `v`       |\n| `'ref:refs/heads/demo-branch'` | Allow only from branch `demo-branch`     |\n| `'pull_request'`               | Allow only from pull request             |\n| `'environment:Production'`     | Allow only from `Production` environment |\n\n<br/>\n\n#### Immutable Subject\n\nGive both `ownerId` and `repoId` to form the trust policy with an [immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims):\n\n```ts\nconst deployRole = new GithubActionsRole(scope, \"DeployRole\", {\n  provider: provider,\n  owner: \"octo-org\",\n  repo: \"octo-repo\",\n  ownerId: \"123456\", // your repository owner ID\n  repoId: \"456789\", // your repository ID\n  filter: \"ref:refs/tags/v*\",\n});\n```\n\nWhich results in a subject condition of `repo:octo-org@123456/octo-repo@456789:ref:refs/tags/v*` instead of `repo:octo-org/octo-repo:ref:refs/tags/v*`. Both properties must be given together, as CDK will fail if you only provide one of them.\n\n> [!IMPORTANT]\n> Ensure Github actually [issues an immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims) for your repository **before** deploying a role which requires one, as otherwise `sts:AssumeRoleWithWebIdentity` will be denied.\n\n<br/>\n\n### Github Actions Workflow\n\nTo actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).\n\n```yaml\njobs:\n  whoami:\n    name: Who Am I\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write # needed to interact with GitHub's OIDC Token endpoint.\n    steps:\n      - name: Configure AWS credentials\n        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role/MyUploadRole\n          #role-session-name: MySessionName # Optional\n          aws-region: us-east-1\n      - name: Get Caller Identity\n        run: |\n          aws sts get-caller-identity\n```\n\n<br/>\n\n\n## Migration Guide\n\n- [v2→v3](#v2v3)\n- [v3→v4](#v3v4)\n\n### v2→v3\n\n1. Install AWS CDK version [`v2.237.0`](https://github.com/aws/aws-cdk/releases/tag/v2.237.0) or newer required (due to support of [OIDC provider removal policy](https://github.com/aws/aws-cdk/commit/09383cbad28336441f0fb405c9d8a190135620dc)):\n\n    ```sh\n    pnpm add -D aws-cdk-lib@^2.237.0\n    ```\n\n2. Install `v3.1.0` (or newer v3 release) of this library:\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^3.1\n    ```\n\n3. No additional steps required, as the v3 major version does not introduce any breaking changes (just a lot of internal tooling changes).\n\n### v3→v4\n\n> [!CAUTION]\n> The following steps describe a _**no-downtime** migration path_.\n> It is the recommended approach, but somewhat _involved_: Hence some users may decide to use \"destroy + redeploy\" strategy instead, which causes downtime to authenticating from GitHub Actions to AWS using OIDC.\n\n1. Ensure you are running `v3.1.0` (or newer v3 release) of this library, see [v2→v3](#v2v3).\n\n2. Configure `RETAIN` removal policy for the provider:\n\n    ```diff\n    const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    });\n    ```\n\n3. Run `pnpm exec cdk diff`, which will show an output similar to:\n\n    ```sh\n    Resources\n    [~] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB\n    ├─ [~] DeletionPolicy\n    │   ├─ [-] Delete\n    │   └─ [+] Retain\n    └─ [~] UpdateReplacePolicy\n        ├─ [-] Delete\n        └─ [+] Retain\n    ```\n\n\n4. Deploy the changes `pnpm exec cdk deploy`\n\n5. Once the `RETAIN` removal policy has been successfully deployed, upgrade this library to `v4.2` (or newer v4 release):\n\n    ```sh\n    pnpm add -D aws-cdk-github-oidc@^4.2\n    ```\n\n6. Temporarily change from provider initializion to provider lookup:\n\n    ```diff\n    - const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    -  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    - });\n    + const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\"); // NOTICE the different construct ID\n    ```\n    ⚠️ **Notice the different construct ID** (in the example `GithubProviderReference` instead of ~~`GithubProvider`~~). This is required so that the CDK treats the GitHub OIDC provider lookup as a different \"thing\" and does not try to change the type of existing construct.\n\n7. Check `pnpm exec cdk diff` which should look similar to:\n    ```sh\n    Resources\n    [-] Custom::AWSCDKOpenIdConnectProvider GithubProvider/Resource GithubProvider1CDE27EB orphan\n    [-] AWS::IAM::Role Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Role CustomAWSCDKOpenIdConnectProviderCustomResourceProviderRole517FED65 destroy\n    [-] AWS::Lambda::Function Custom::AWSCDKOpenIdConnectProviderCustomResourceProvider/Handler CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0 destroy\n    ```\n\n8. Deploy the changes with `pnpm exec cdk deploy`\n\n9. Once the deployment has succeeded, remove the provider lookup and replace it with the original provider initialization:\n\n    ```diff\n    - const provider = GithubActionsIdentityProvider.fromAccount(this, \"GithubProviderReference\");\n    + const provider = new GithubActionsIdentityProvider(this, \"GithubProvider\", {\n    +  removalPolicy: cdk.RemovalPolicy.RETAIN,\n    + });\n    ```\n\n10. Copy the ARN of the existing OIDC provider, it will be in the format of:\n\n    ```\n    arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com # REPLACE with your account ID\n    ```\n\n11. Use [cdk import](https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-import.html):\n\n    ```sh\n    pnpm exec cdk import <YOUR_STACK_NAME>\n    ```\n\n    ... and when asked, input the provider ARN you copied in step 10:\n    ```sh\n    <YOUR_STACK_NAME>/GithubProvider/Resource (AWS::IAM::OIDCProvider): enter Arn (empty to skip)\n    ```\n\n12. You should be done now, but you may want to **perform manual verification** in addition to [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html) and/or `cdk diff``\u001b to verify.\n\n\n\n"
   },
   "repository": {
     "type": "git",
@@ -9232,7 +9232,7 @@
         },
         "locationInModule": {
           "filename": "src/role.ts",
-          "line": 154
+          "line": 203
         },
         "parameters": [
           {
@@ -9258,7 +9258,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/role.ts",
-        "line": 95
+        "line": 124
       },
       "name": "GithubActionsRole",
       "symbolId": "src/role:GithubActionsRole"
@@ -9280,7 +9280,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/role.ts",
-        "line": 74
+        "line": 103
       },
       "name": "GithubActionsRoleProps",
       "symbolId": "src/role:GithubActionsRoleProps"
@@ -9356,6 +9356,7 @@
           "docs": {
             "default": "'*'\n\nYou may use this value to only allow Github to assume the role on specific branches, tags, environments, pull requests etc.",
             "example": "'ref:refs/tags/v*'\n'ref:refs/heads/demo-branch'\n'pull_request'\n'environment:Production'",
+            "remarks": "With `ownerId` & `repoId` given, appended after\n`repo:${owner}@${ownerId}/${repo}@${repoId}:` instead.",
             "see": "https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#examples",
             "stability": "experimental",
             "summary": "Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM Role trust relationship."
@@ -9363,13 +9364,55 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/role.ts",
-            "line": 55
+            "line": 84
           },
           "name": "filter",
           "optional": true,
           "type": {
             "primitive": "string"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- subject refers to the owner and repository by name",
+            "example": "'123456'",
+            "remarks": "Must be given together with `repoId`.",
+            "see": "https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims",
+            "stability": "experimental",
+            "summary": "Numeric Github ID of the repository owner (organization or user), which makes the subject immutable."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/role.ts",
+            "line": 51
+          },
+          "name": "ownerId",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- subject refers to the owner and repository by name",
+            "example": "'456789'",
+            "remarks": "Must be given together with `ownerId`.",
+            "see": "https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims",
+            "stability": "experimental",
+            "summary": "Numeric Github ID of the repository, which makes the subject immutable."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/role.ts",
+            "line": 64
+          },
+          "name": "repoId",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
         }
       ],
       "symbolId": "src/role:GithubConfiguration"
@@ -9588,6 +9631,6 @@
       "symbolId": "src/iam-role-props:RoleProps"
     }
   },
-  "version": "5.0.2",
-  "fingerprint": "1VfD5VEkHhiF66/QQ0ulCHXKbC6GkO+kwPLDqZTH6xE="
+  "version": "5.1.1",
+  "fingerprint": "28xBlmoN/mLWRB+kH16dtnWQR+jYN8I1j9NCUbOMbPo="
 }

package/API.md

@@ -1287,6 +1287,8 @@ const githubActionsRoleProps: GithubActionsRoleProps = { ... }
 | <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.provider">provider</a></code> | <code><a href="#aws-cdk-github-oidc.IGithubActionsIdentityProvider">IGithubActionsIdentityProvider</a></code> | Reference to Github OpenID Connect Provider configured in AWS IAM. |
 | <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.repo">repo</a></code> | <code>string</code> | Repository name (slug) without the owner. |
 | <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.filter">filter</a></code> | <code>string</code> | Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM Role trust relationship. |
+| <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.ownerId">ownerId</a></code> | <code>string</code> | Numeric Github ID of the repository owner (organization or user), which makes the subject immutable. |
+| <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.repoId">repoId</a></code> | <code>string</code> | Numeric Github ID of the repository, which makes the subject immutable. |
 | <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.description">description</a></code> | <code>string</code> | A description of the role. |
 | <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.externalIds">externalIds</a></code> | <code>string[]</code> | List of IDs that the role assumer needs to provide one of when assuming this role. |
 | <code><a href="#aws-cdk-github-oidc.GithubActionsRoleProps.property.inlinePolicies">inlinePolicies</a></code> | <code>{[ key: string ]: aws-cdk-lib.aws_iam.PolicyDocument}</code> | A list of named policies to inline into this role. |
@@ -1363,6 +1365,9 @@ public readonly filter: string;
 
 Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM Role trust relationship.
 
+With `ownerId` & `repoId` given, appended after
+`repo:${owner}@${ownerId}/${repo}@${repoId}:` instead.
+
 > [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#examples](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#examples)
 
 ---
@@ -1377,6 +1382,54 @@ Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM
 ```
 
 
+##### `ownerId`<sup>Optional</sup> <a name="ownerId" id="aws-cdk-github-oidc.GithubActionsRoleProps.property.ownerId"></a>
+
+```typescript
+public readonly ownerId: string;
+```
+
+- *Type:* string
+- *Default:* subject refers to the owner and repository by name
+
+Numeric Github ID of the repository owner (organization or user), which makes the subject immutable.
+
+Must be given together with `repoId`.
+
+> [https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims)
+
+---
+
+*Example*
+
+```typescript
+'123456'
+```
+
+
+##### `repoId`<sup>Optional</sup> <a name="repoId" id="aws-cdk-github-oidc.GithubActionsRoleProps.property.repoId"></a>
+
+```typescript
+public readonly repoId: string;
+```
+
+- *Type:* string
+- *Default:* subject refers to the owner and repository by name
+
+Numeric Github ID of the repository, which makes the subject immutable.
+
+Must be given together with `ownerId`.
+
+> [https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims)
+
+---
+
+*Example*
+
+```typescript
+'456789'
+```
+
+
 ##### `description`<sup>Optional</sup> <a name="description" id="aws-cdk-github-oidc.GithubActionsRoleProps.property.description"></a>
 
 ```typescript
@@ -1551,6 +1604,8 @@ const githubConfiguration: GithubConfiguration = { ... }
 | <code><a href="#aws-cdk-github-oidc.GithubConfiguration.property.provider">provider</a></code> | <code><a href="#aws-cdk-github-oidc.IGithubActionsIdentityProvider">IGithubActionsIdentityProvider</a></code> | Reference to Github OpenID Connect Provider configured in AWS IAM. |
 | <code><a href="#aws-cdk-github-oidc.GithubConfiguration.property.repo">repo</a></code> | <code>string</code> | Repository name (slug) without the owner. |
 | <code><a href="#aws-cdk-github-oidc.GithubConfiguration.property.filter">filter</a></code> | <code>string</code> | Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM Role trust relationship. |
+| <code><a href="#aws-cdk-github-oidc.GithubConfiguration.property.ownerId">ownerId</a></code> | <code>string</code> | Numeric Github ID of the repository owner (organization or user), which makes the subject immutable. |
+| <code><a href="#aws-cdk-github-oidc.GithubConfiguration.property.repoId">repoId</a></code> | <code>string</code> | Numeric Github ID of the repository, which makes the subject immutable. |
 
 ---
 
@@ -1619,6 +1674,9 @@ public readonly filter: string;
 
 Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM Role trust relationship.
 
+With `ownerId` & `repoId` given, appended after
+`repo:${owner}@${ownerId}/${repo}@${repoId}:` instead.
+
 > [https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#examples](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#examples)
 
 ---
@@ -1633,6 +1691,54 @@ Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM
 ```
 
 
+##### `ownerId`<sup>Optional</sup> <a name="ownerId" id="aws-cdk-github-oidc.GithubConfiguration.property.ownerId"></a>
+
+```typescript
+public readonly ownerId: string;
+```
+
+- *Type:* string
+- *Default:* subject refers to the owner and repository by name
+
+Numeric Github ID of the repository owner (organization or user), which makes the subject immutable.
+
+Must be given together with `repoId`.
+
+> [https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims)
+
+---
+
+*Example*
+
+```typescript
+'123456'
+```
+
+
+##### `repoId`<sup>Optional</sup> <a name="repoId" id="aws-cdk-github-oidc.GithubConfiguration.property.repoId"></a>
+
+```typescript
+public readonly repoId: string;
+```
+
+- *Type:* string
+- *Default:* subject refers to the owner and repository by name
+
+Numeric Github ID of the repository, which makes the subject immutable.
+
+Must be given together with `ownerId`.
+
+> [https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims)
+
+---
+
+*Example*
+
+```typescript
+'456789'
+```
+
+
 ### RoleProps <a name="RoleProps" id="aws-cdk-github-oidc.RoleProps"></a>
 
 Properties for defining an IAM Role.

package/README.md

@@ -116,6 +116,28 @@ By default the value of `filter` property will be `'*'` which means any workflow
 
 <br/>
 
+#### Immutable Subject
+
+Give both `ownerId` and `repoId` to form the trust policy with an [immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims):
+
+```ts
+const deployRole = new GithubActionsRole(scope, "DeployRole", {
+  provider: provider,
+  owner: "octo-org",
+  repo: "octo-repo",
+  ownerId: "123456", // your repository owner ID
+  repoId: "456789", // your repository ID
+  filter: "ref:refs/tags/v*",
+});
+```
+
+Which results in a subject condition of `repo:octo-org@123456/octo-repo@456789:ref:refs/tags/v*` instead of `repo:octo-org/octo-repo:ref:refs/tags/v*`. Both properties must be given together, as CDK will fail if you only provide one of them.
+
+> [!IMPORTANT]
+> Ensure Github actually [issues an immutable subject](https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims) for your repository **before** deploying a role which requires one, as otherwise `sts:AssumeRoleWithWebIdentity` will be denied.
+
+<br/>
+
 ### Github Actions Workflow
 
 To actually utilize this in your Github Actions workflow, use [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) to [assume a role](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role).

package/lib/provider.js

@@ -48,7 +48,7 @@ const iam = __importStar(require("aws-cdk-lib/aws-iam"));
  * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
  */
 class GithubActionsIdentityProvider extends iam.OidcProviderNative {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "5.0.2" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsIdentityProvider", version: "5.1.1" };
     static issuer = "token.actions.githubusercontent.com";
     /**
      * Retrieve a reference to existing Github OIDC provider in your AWS account.

package/lib/role.d.ts

@@ -28,9 +28,36 @@ export interface GithubConfiguration {
      * 'octo-repo'
      */
     readonly repo: string;
+    /**
+     * Numeric Github ID of the repository owner (organization or user), which
+     * makes the subject immutable. Must be given together with `repoId`.
+     *
+     * @default - subject refers to the owner and repository by name
+     *
+     * @example
+     * '123456'
+     *
+     * @see https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims
+     */
+    readonly ownerId?: string;
+    /**
+     * Numeric Github ID of the repository, which makes the subject immutable.
+     * Must be given together with `ownerId`.
+     *
+     * @default - subject refers to the owner and repository by name
+     *
+     * @example
+     * '456789'
+     *
+     * @see https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims
+     */
+    readonly repoId?: string;
     /**
      * Subject condition filter, appended after `repo:${owner}/${repo}:` string in IAM Role trust relationship.
      *
+     * With `ownerId` & `repoId` given, appended after
+     * `repo:${owner}@${ownerId}/${repo}@${repoId}:` instead.
+     *
      * @default
      * '*'
      *
@@ -92,6 +119,8 @@ export declare class GithubActionsRole extends iam.Role {
     private static validateOwner;
     /** Validates the Github repository name (without owner). */
     private static validateRepo;
+    /** Validates the Github owner and repository IDs. */
+    private static validateIds;
     /** Formats the `sub` value used in trust policy. */
     private static formatSubject;
     /**

package/lib/role.js

@@ -61,7 +61,7 @@ const provider_1 = require("./provider");
  * myBucket.grantWrite(uploadRole);
  */
 class GithubActionsRole extends iam.Role {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "5.0.2" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "aws-cdk-github-oidc.GithubActionsRole", version: "5.1.1" };
     /**
      * Extracts props given for the created IAM Role Construct.
      * @param props for the GithubActionsRole
@@ -72,6 +72,8 @@ class GithubActionsRole extends iam.Role {
         delete extractProps.provider;
         delete extractProps.owner;
         delete extractProps.repo;
+        delete extractProps.ownerId;
+        delete extractProps.repoId;
         delete extractProps.filter;
         return extractProps;
     }
@@ -87,9 +89,18 @@ class GithubActionsRole extends iam.Role {
             cdk.Annotations.of(scope).addError(`Invalid Github Repository Name "${repo}". May not be empty string.`);
         }
     }
+    /** Validates the Github owner and repository IDs. */
+    static validateIds(scope, ownerId, repoId) {
+        if ((ownerId === undefined) !== (repoId === undefined)) {
+            cdk.Annotations.of(scope).addError('Incomplete Github IDs. Both "ownerId" and "repoId" must be given to use an immutable subject, or neither of them.');
+        }
+    }
     /** Formats the `sub` value used in trust policy. */
     static formatSubject(props) {
-        const { owner, repo, filter = "*" } = props;
+        const { owner, repo, ownerId, repoId, filter = "*" } = props;
+        if (ownerId !== undefined && repoId !== undefined) {
+            return `repo:${owner}@${ownerId}/${repo}@${repoId}:${filter}`;
+        }
         return `repo:${owner}/${repo}:${filter}`;
     }
     /**
@@ -111,10 +122,11 @@ class GithubActionsRole extends iam.Role {
      * myBucket.grantWrite(uploadRole);
      */
     constructor(scope, id, props) {
-        const { provider, owner, repo } = props;
+        const { provider, owner, repo, ownerId, repoId } = props;
         // Perform validations
         GithubActionsRole.validateOwner(scope, owner);
         GithubActionsRole.validateRepo(scope, repo);
+        GithubActionsRole.validateIds(scope, ownerId, repoId);
         // Prepare values
         const subject = GithubActionsRole.formatSubject(props);
         const roleProps = GithubActionsRole.extractRoleProps(props);
@@ -136,4 +148,4 @@ class GithubActionsRole extends iam.Role {
     }
 }
 exports.GithubActionsRole = GithubActionsRole;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxpREFBbUM7QUFDbkMseURBQTJDO0FBRzNDLGtFQUFpRDtBQUNqRCx5Q0FHb0I7QUFvRXBCOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQWEsaUJBQWtCLFNBQVEsR0FBRyxDQUFDLElBQUk7O0lBQzdDOzs7O09BSUc7SUFDSyxNQUFNLENBQUMsZ0JBQWdCLENBQzdCLEtBQTZCO1FBRTdCLE1BQU0sWUFBWSxHQUFRLEtBQUssQ0FBQztRQUNoQyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUM7UUFDN0IsT0FBTyxZQUFZLENBQUMsS0FBSyxDQUFDO1FBQzFCLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQztRQUN6QixPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDM0IsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVELDhEQUE4RDtJQUN0RCxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQWdCLEVBQUUsS0FBYTtRQUMxRCxJQUFJLHNCQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUM3QyxHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQ2hDLG9DQUFvQyxLQUFLLDBLQUEwSyxDQUNwTixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCw0REFBNEQ7SUFDcEQsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFnQixFQUFFLElBQVk7UUFDeEQsSUFBSSxJQUFJLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDaEIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUNoQyxtQ0FBbUMsSUFBSSw2QkFBNkIsQ0FDckUsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsb0RBQW9EO0lBQzVDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBMEI7UUFDckQsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztRQUM1QyxPQUFPLFFBQVEsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7O09BaUJHO0lBQ0gsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFeEMsc0JBQXNCO1FBQ3RCLGlCQUFpQixDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDOUMsaUJBQWlCLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztRQUU1QyxpQkFBaUI7UUFDakIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sU0FBUyxHQUFHLGlCQUFpQixDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBRTVELCtCQUErQjtRQUMvQixLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsU0FBUztZQUNaLFNBQVMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUFFO2dCQUNoRSxVQUFVLEVBQUU7b0JBQ1Ysb0RBQW9EO29CQUNwRCxDQUFDLEdBQUcsd0NBQTZCLENBQUMsTUFBTSxNQUFNLENBQUMsRUFBRSxPQUFPO2lCQUN6RDtnQkFDRCxZQUFZLEVBQUU7b0JBQ1osdUVBQXVFO29CQUN2RSwwS0FBMEs7b0JBQzFLLENBQUMsR0FBRyx3Q0FBNkIsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLG1CQUFtQjtpQkFDckU7YUFDRixDQUFDO1NBQ0gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUFyRkgsOENBc0ZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuaW1wb3J0IHsgUm9sZVByb3BzIH0gZnJvbSBcIi4vaWFtLXJvbGUtcHJvcHNcIjtcbmltcG9ydCBnaXRodWJVc2VybmFtZVJlZ2V4IGZyb20gXCIuL293bmVyLXJlZ2V4cFwiO1xuaW1wb3J0IHtcbiAgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIsXG4gIElHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcixcbn0gZnJvbSBcIi4vcHJvdmlkZXJcIjtcblxuLyoqXG4gKiBHaXRodWIgcmVsYXRlZCBjb25maWd1cmF0aW9uIHRoYXQgZm9ybXMgdGhlIHRydXN0IHBvbGljeSBmb3IgdGhpcyBJQU0gUm9sZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRodWJDb25maWd1cmF0aW9uIHtcbiAgLyoqXG4gICAqIFJlZmVyZW5jZSB0byBHaXRodWIgT3BlbklEIENvbm5lY3QgUHJvdmlkZXIgY29uZmlndXJlZCBpbiBBV1MgSUFNLlxuICAgKlxuICAgKiBFaXRoZXIgcGFzcyBhbiBjb25zdHJ1Y3QgZGVmaW5lZCBieSBgbmV3IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyYFxuICAgKiBvciBhIHJldHJpZXZlZCByZWZlcmVuY2UgZnJvbSBgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnRgLlxuICAgKiBUaGVyZSBjYW4gYmUgb25seSBvbmUgKHBlciBBV1MgQWNjb3VudCkuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogSUdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlcm5hbWUpLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1vcmcnXG4gICAqL1xuICByZWFkb25seSBvd25lcjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBSZXBvc2l0b3J5IG5hbWUgKHNsdWcpIHdpdGhvdXQgdGhlIG93bmVyLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiAnb2N0by1yZXBvJ1xuICAgKi9cbiAgcmVhZG9ubHkgcmVwbzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTdWJqZWN0IGNvbmRpdGlvbiBmaWx0ZXIsIGFwcGVuZGVkIGFmdGVyIGByZXBvOiR7b3duZXJ9LyR7cmVwb306YCBzdHJpbmcgaW4gSUFNIFJvbGUgdHJ1c3QgcmVsYXRpb25zaGlwLlxuICAgKlxuICAgKiBAZGVmYXVsdFxuICAgKiAnKidcbiAgICpcbiAgICogWW91IG1heSB1c2UgdGhpcyB2YWx1ZSB0byBvbmx5IGFsbG93IEdpdGh1YiB0byBhc3N1bWUgdGhlIHJvbGUgb24gc3BlY2lmaWMgYnJhbmNoZXMsIHRhZ3MsIGVudmlyb25tZW50cywgcHVsbCByZXF1ZXN0cyBldGMuXG4gICAqIEBleGFtcGxlXG4gICAqICdyZWY6cmVmcy90YWdzL3YqJ1xuICAgKiAncmVmOnJlZnMvaGVhZHMvZGVtby1icmFuY2gnXG4gICAqICdwdWxsX3JlcXVlc3QnXG4gICAqICdlbnZpcm9ubWVudDpQcm9kdWN0aW9uJ1xuICAgKlxuICAgKiBAc2VlIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9hYm91dC1zZWN1cml0eS1oYXJkZW5pbmctd2l0aC1vcGVuaWQtY29ubmVjdCNleGFtcGxlc1xuICAgKi9cbiAgcmVhZG9ubHkgZmlsdGVyPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFByb3BzIHRoYXQgZGVmaW5lIHRoZSBJQU0gUm9sZSB0aGF0IGNhbiBiZSBhc3N1bWVkIGJ5IEdpdGh1YiBBY3Rpb25zIHdvcmtmbG93XG4gKiB2aWEgR2l0aHViIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyLlxuICpcbiAqIEJlc2lkZXMgYEdpdGh1YkNvbmZpZ3VyYXRpb25gLCB5b3UgbWF5IHBhc3MgaW4gYW55IGBpYW0uUm9sZVByb3BzYCBleGNlcHQgYGFzc3VtZWRCeWBcbiAqIHdoaWNoIHdpbGwgYmUgZGVmaW5lZCBieSB0aGlzIGNvbnN0cnVjdCAoQ0RLIHdpbGwgZmFpbCBpZiB5b3UgZG8pLlxuICpcbiAqIEBleGFtcGxlXG4gKiB7XG4gKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gKiAgIHJlcG86ICdvY3RvLXJlcG8nLFxuICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAqICAgcm9sZU5hbWU6ICdNeURlcGxveVJvbGUnLFxuICogfVxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkFjdGlvbnNSb2xlUHJvcHNcbiAgZXh0ZW5kcyBHaXRodWJDb25maWd1cmF0aW9uLCBSb2xlUHJvcHMge31cblxuLyoqXG4gKiBEZWZpbmUgYW4gSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAqXG4gKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAqXG4gKiBAZXhhbXBsZVxuICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAqICAgcHJvdmlkZXI6IEdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmZyb21BY2NvdW50KHNjb3BlLCBcIkdpdGh1YlByb3ZpZGVyXCIpLFxuICogICBvd25lcjogJ29jdG8tb3JnJyxcbiAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gKiAgIGZpbHRlcjogJ3JlZjpyZWZzL3RhZ3MvdionLFxuICogICByb2xlTmFtZTogJ015VXBsb2FkUm9sZScsXG4gKiB9KTtcbiAqXG4gKiBteUJ1Y2tldC5ncmFudFdyaXRlKHVwbG9hZFJvbGUpO1xuICovXG5leHBvcnQgY2xhc3MgR2l0aHViQWN0aW9uc1JvbGUgZXh0ZW5kcyBpYW0uUm9sZSB7XG4gIC8qKlxuICAgKiBFeHRyYWN0cyBwcm9wcyBnaXZlbiBmb3IgdGhlIGNyZWF0ZWQgSUFNIFJvbGUgQ29uc3RydWN0LlxuICAgKiBAcGFyYW0gcHJvcHMgZm9yIHRoZSBHaXRodWJBY3Rpb25zUm9sZVxuICAgKiBAcmV0dXJucyBmb3IgdGhlIElBTSBSb2xlXG4gICAqL1xuICBwcml2YXRlIHN0YXRpYyBleHRyYWN0Um9sZVByb3BzKFxuICAgIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzLFxuICApOiBpYW0uUm9sZVByb3BzIHtcbiAgICBjb25zdCBleHRyYWN0UHJvcHMgPSA8YW55PnByb3BzO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMucHJvdmlkZXI7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5vd25lcjtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnJlcG87XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5maWx0ZXI7XG4gICAgcmV0dXJuIGV4dHJhY3RQcm9wcztcbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiBvd25lciAob3JnYW5pemF0aW9uIG9yIHVzZXIpIG5hbWUuICovXG4gIHByaXZhdGUgc3RhdGljIHZhbGlkYXRlT3duZXIoc2NvcGU6IENvbnN0cnVjdCwgb3duZXI6IHN0cmluZyk6IHZvaWQge1xuICAgIGlmIChnaXRodWJVc2VybmFtZVJlZ2V4LnRlc3Qob3duZXIpICE9PSB0cnVlKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKFxuICAgICAgICBgSW52YWxpZCBHaXRodWIgUmVwb3NpdG9yeSBPd25lciBcIiR7b3duZXJ9XCIuIE11c3Qgb25seSBjb250YWluIGFscGhhbnVtZXJpYyBjaGFyYWN0ZXJzIG9yIGh5cGhlbnMsIGNhbm5vdCBoYXZlIG11bHRpcGxlIGNvbnNlY3V0aXZlIGh5cGhlbnMsIGNhbm5vdCBiZWdpbiBvciBlbmQgd2l0aCBhIGh5cGVuIGFuZCBtYXhpbXVtIGxlbmdodCBpcyAzOSBjaGFyYWN0ZXJzLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBWYWxpZGF0ZXMgdGhlIEdpdGh1YiByZXBvc2l0b3J5IG5hbWUgKHdpdGhvdXQgb3duZXIpLiAqL1xuICBwcml2YXRlIHN0YXRpYyB2YWxpZGF0ZVJlcG8oc2NvcGU6IENvbnN0cnVjdCwgcmVwbzogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKHJlcG8gPT09IFwiXCIpIHtcbiAgICAgIGNkay5Bbm5vdGF0aW9ucy5vZihzY29wZSkuYWRkRXJyb3IoXG4gICAgICAgIGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE5hbWUgXCIke3JlcG99XCIuIE1heSBub3QgYmUgZW1wdHkgc3RyaW5nLmAsXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIC8qKiBGb3JtYXRzIHRoZSBgc3ViYCB2YWx1ZSB1c2VkIGluIHRydXN0IHBvbGljeS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZm9ybWF0U3ViamVjdChwcm9wczogR2l0aHViQ29uZmlndXJhdGlvbik6IHN0cmluZyB7XG4gICAgY29uc3QgeyBvd25lciwgcmVwbywgZmlsdGVyID0gXCIqXCIgfSA9IHByb3BzO1xuICAgIHJldHVybiBgcmVwbzoke293bmVyfS8ke3JlcG99OiR7ZmlsdGVyfWA7XG4gIH1cblxuICAvKipcbiAgICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAgICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAgICpcbiAgICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICAgKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogY29uc3QgdXBsb2FkUm9sZSA9IG5ldyBHaXRodWJBY3Rpb25zUm9sZShzY29wZSwgXCJVcGxvYWRSb2xlXCIsIHtcbiAgICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gICAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gICAqICAgcmVwbzogJ29jdG8tcmVwbycsXG4gICAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gICAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICAgKiB9KTtcbiAgICpcbiAgICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBHaXRodWJBY3Rpb25zUm9sZVByb3BzKSB7XG4gICAgY29uc3QgeyBwcm92aWRlciwgb3duZXIsIHJlcG8gfSA9IHByb3BzO1xuXG4gICAgLy8gUGVyZm9ybSB2YWxpZGF0aW9uc1xuICAgIEdpdGh1YkFjdGlvbnNSb2xlLnZhbGlkYXRlT3duZXIoc2NvcGUsIG93bmVyKTtcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZVJlcG8oc2NvcGUsIHJlcG8pO1xuXG4gICAgLy8gUHJlcGFyZSB2YWx1ZXNcbiAgICBjb25zdCBzdWJqZWN0ID0gR2l0aHViQWN0aW9uc1JvbGUuZm9ybWF0U3ViamVjdChwcm9wcyk7XG4gICAgY29uc3Qgcm9sZVByb3BzID0gR2l0aHViQWN0aW9uc1JvbGUuZXh0cmFjdFJvbGVQcm9wcyhwcm9wcyk7XG5cbiAgICAvLyBUaGUgYWN0dWFsIElBTSBSb2xlIGNyZWF0aW9uXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5yb2xlUHJvcHMsXG4gICAgICBhc3N1bWVkQnk6IG5ldyBpYW0uV2ViSWRlbnRpdHlQcmluY2lwYWwocHJvdmlkZXIub2lkY1Byb3ZpZGVyQXJuLCB7XG4gICAgICAgIFN0cmluZ0xpa2U6IHtcbiAgICAgICAgICAvLyBPbmx5IGFsbG93IHNwZWNpZmllZCBzdWJqZWN0cyB0byBhc3N1bWUgdGhpcyByb2xlXG4gICAgICAgICAgW2Ake0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn06c3ViYF06IHN1YmplY3QsXG4gICAgICAgIH0sXG4gICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgIC8vIEF1ZGllbmNlIGlzIGFsd2F5cyBzdHMuYW1hem9uYXdzLmNvbSB3aXRoIEFXUyBvZmZpY2lhbCBHaXRodWIgQWN0aW9uXG4gICAgICAgICAgLy8gaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9kZXBsb3ltZW50L3NlY3VyaXR5LWhhcmRlbmluZy15b3VyLWRlcGxveW1lbnRzL2NvbmZpZ3VyaW5nLW9wZW5pZC1jb25uZWN0LWluLWFtYXpvbi13ZWItc2VydmljZXMjYWRkaW5nLXRoZS1pZGVudGl0eS1wcm92aWRlci10by1hd3NcbiAgICAgICAgICBbYCR7R2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuaXNzdWVyfTphdWRgXTogXCJzdHMuYW1hem9uYXdzLmNvbVwiLFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxpREFBbUM7QUFDbkMseURBQTJDO0FBRzNDLGtFQUFpRDtBQUNqRCx5Q0FHb0I7QUFpR3BCOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQWEsaUJBQWtCLFNBQVEsR0FBRyxDQUFDLElBQUk7O0lBQzdDOzs7O09BSUc7SUFDSyxNQUFNLENBQUMsZ0JBQWdCLENBQzdCLEtBQTZCO1FBRTdCLE1BQU0sWUFBWSxHQUFRLEtBQUssQ0FBQztRQUNoQyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUM7UUFDN0IsT0FBTyxZQUFZLENBQUMsS0FBSyxDQUFDO1FBQzFCLE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQztRQUN6QixPQUFPLFlBQVksQ0FBQyxPQUFPLENBQUM7UUFDNUIsT0FBTyxZQUFZLENBQUMsTUFBTSxDQUFDO1FBQzNCLE9BQU8sWUFBWSxDQUFDLE1BQU0sQ0FBQztRQUMzQixPQUFPLFlBQVksQ0FBQztJQUN0QixDQUFDO0lBRUQsOERBQThEO0lBQ3RELE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBZ0IsRUFBRSxLQUFhO1FBQzFELElBQUksc0JBQW1CLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQzdDLEdBQUcsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsQ0FDaEMsb0NBQW9DLEtBQUssMEtBQTBLLENBQ3BOLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVELDREQUE0RDtJQUNwRCxNQUFNLENBQUMsWUFBWSxDQUFDLEtBQWdCLEVBQUUsSUFBWTtRQUN4RCxJQUFJLElBQUksS0FBSyxFQUFFLEVBQUUsQ0FBQztZQUNoQixHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQ2hDLG1DQUFtQyxJQUFJLDZCQUE2QixDQUNyRSxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCxxREFBcUQ7SUFDN0MsTUFBTSxDQUFDLFdBQVcsQ0FDeEIsS0FBZ0IsRUFDaEIsT0FBZ0IsRUFDaEIsTUFBZTtRQUVmLElBQUksQ0FBQyxPQUFPLEtBQUssU0FBUyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN2RCxHQUFHLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQ2hDLG1IQUFtSCxDQUNwSCxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCxvREFBb0Q7SUFDNUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUEwQjtRQUNyRCxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sR0FBRyxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFN0QsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNsRCxPQUFPLFFBQVEsS0FBSyxJQUFJLE9BQU8sSUFBSSxJQUFJLElBQUksTUFBTSxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ2hFLENBQUM7UUFFRCxPQUFPLFFBQVEsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7O09BaUJHO0lBQ0gsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQztRQUV6RCxzQkFBc0I7UUFDdEIsaUJBQWlCLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM5QyxpQkFBaUIsQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzVDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBRXRELGlCQUFpQjtRQUNqQixNQUFNLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkQsTUFBTSxTQUFTLEdBQUcsaUJBQWlCLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFNUQsK0JBQStCO1FBQy9CLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxTQUFTO1lBQ1osU0FBUyxFQUFFLElBQUksR0FBRyxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUU7Z0JBQ2hFLFVBQVUsRUFBRTtvQkFDVixvREFBb0Q7b0JBQ3BELENBQUMsR0FBRyx3Q0FBNkIsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxFQUFFLE9BQU87aUJBQ3pEO2dCQUNELFlBQVksRUFBRTtvQkFDWix1RUFBdUU7b0JBQ3ZFLDBLQUEwSztvQkFDMUssQ0FBQyxHQUFHLHdDQUE2QixDQUFDLE1BQU0sTUFBTSxDQUFDLEVBQUUsbUJBQW1CO2lCQUNyRTthQUNGLENBQUM7U0FDSCxDQUFDLENBQUM7SUFDTCxDQUFDOztBQTFHSCw4Q0EyR0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBjZGsgZnJvbSBcImF3cy1jZGstbGliXCI7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5pbXBvcnQgeyBSb2xlUHJvcHMgfSBmcm9tIFwiLi9pYW0tcm9sZS1wcm9wc1wiO1xuaW1wb3J0IGdpdGh1YlVzZXJuYW1lUmVnZXggZnJvbSBcIi4vb3duZXItcmVnZXhwXCI7XG5pbXBvcnQge1xuICBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlcixcbiAgSUdpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLFxufSBmcm9tIFwiLi9wcm92aWRlclwiO1xuXG4vKipcbiAqIEdpdGh1YiByZWxhdGVkIGNvbmZpZ3VyYXRpb24gdGhhdCBmb3JtcyB0aGUgdHJ1c3QgcG9saWN5IGZvciB0aGlzIElBTSBSb2xlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdGh1YkNvbmZpZ3VyYXRpb24ge1xuICAvKipcbiAgICogUmVmZXJlbmNlIHRvIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBQcm92aWRlciBjb25maWd1cmVkIGluIEFXUyBJQU0uXG4gICAqXG4gICAqIEVpdGhlciBwYXNzIGFuIGNvbnN0cnVjdCBkZWZpbmVkIGJ5IGBuZXcgR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXJgXG4gICAqIG9yIGEgcmV0cmlldmVkIHJlZmVyZW5jZSBmcm9tIGBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudGAuXG4gICAqIFRoZXJlIGNhbiBiZSBvbmx5IG9uZSAocGVyIEFXUyBBY2NvdW50KS5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBJR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXI7XG5cbiAgLyoqXG4gICAqIFJlcG9zaXRvcnkgb3duZXIgKG9yZ2FuaXphdGlvbiBvciB1c2VybmFtZSkuXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqICdvY3RvLW9yZydcbiAgICovXG4gIHJlYWRvbmx5IG93bmVyOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFJlcG9zaXRvcnkgbmFtZSAoc2x1Zykgd2l0aG91dCB0aGUgb3duZXIuXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqICdvY3RvLXJlcG8nXG4gICAqL1xuICByZWFkb25seSByZXBvOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIE51bWVyaWMgR2l0aHViIElEIG9mIHRoZSByZXBvc2l0b3J5IG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlciksIHdoaWNoXG4gICAqIG1ha2VzIHRoZSBzdWJqZWN0IGltbXV0YWJsZS4gTXVzdCBiZSBnaXZlbiB0b2dldGhlciB3aXRoIGByZXBvSWRgLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIHN1YmplY3QgcmVmZXJzIHRvIHRoZSBvd25lciBhbmQgcmVwb3NpdG9yeSBieSBuYW1lXG4gICAqXG4gICAqIEBleGFtcGxlXG4gICAqICcxMjM0NTYnXG4gICAqXG4gICAqIEBzZWUgaHR0cHM6Ly9kb2NzLmdpdGh1Yi5jb20vZW4vYWN0aW9ucy9yZWZlcmVuY2Uvc2VjdXJpdHkvb2lkYyNpbW11dGFibGUtc3ViamVjdC1jbGFpbXNcbiAgICovXG4gIHJlYWRvbmx5IG93bmVySWQ/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIE51bWVyaWMgR2l0aHViIElEIG9mIHRoZSByZXBvc2l0b3J5LCB3aGljaCBtYWtlcyB0aGUgc3ViamVjdCBpbW11dGFibGUuXG4gICAqIE11c3QgYmUgZ2l2ZW4gdG9nZXRoZXIgd2l0aCBgb3duZXJJZGAuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gc3ViamVjdCByZWZlcnMgdG8gdGhlIG93bmVyIGFuZCByZXBvc2l0b3J5IGJ5IG5hbWVcbiAgICpcbiAgICogQGV4YW1wbGVcbiAgICogJzQ1Njc4OSdcbiAgICpcbiAgICogQHNlZSBodHRwczovL2RvY3MuZ2l0aHViLmNvbS9lbi9hY3Rpb25zL3JlZmVyZW5jZS9zZWN1cml0eS9vaWRjI2ltbXV0YWJsZS1zdWJqZWN0LWNsYWltc1xuICAgKi9cbiAgcmVhZG9ubHkgcmVwb0lkPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTdWJqZWN0IGNvbmRpdGlvbiBmaWx0ZXIsIGFwcGVuZGVkIGFmdGVyIGByZXBvOiR7b3duZXJ9LyR7cmVwb306YCBzdHJpbmcgaW4gSUFNIFJvbGUgdHJ1c3QgcmVsYXRpb25zaGlwLlxuICAgKlxuICAgKiBXaXRoIGBvd25lcklkYCAmIGByZXBvSWRgIGdpdmVuLCBhcHBlbmRlZCBhZnRlclxuICAgKiBgcmVwbzoke293bmVyfUAke293bmVySWR9LyR7cmVwb31AJHtyZXBvSWR9OmAgaW5zdGVhZC5cbiAgICpcbiAgICogQGRlZmF1bHRcbiAgICogJyonXG4gICAqXG4gICAqIFlvdSBtYXkgdXNlIHRoaXMgdmFsdWUgdG8gb25seSBhbGxvdyBHaXRodWIgdG8gYXNzdW1lIHRoZSByb2xlIG9uIHNwZWNpZmljIGJyYW5jaGVzLCB0YWdzLCBlbnZpcm9ubWVudHMsIHB1bGwgcmVxdWVzdHMgZXRjLlxuICAgKiBAZXhhbXBsZVxuICAgKiAncmVmOnJlZnMvdGFncy92KidcbiAgICogJ3JlZjpyZWZzL2hlYWRzL2RlbW8tYnJhbmNoJ1xuICAgKiAncHVsbF9yZXF1ZXN0J1xuICAgKiAnZW52aXJvbm1lbnQ6UHJvZHVjdGlvbidcbiAgICpcbiAgICogQHNlZSBodHRwczovL2RvY3MuZ2l0aHViLmNvbS9lbi9hY3Rpb25zL2RlcGxveW1lbnQvc2VjdXJpdHktaGFyZGVuaW5nLXlvdXItZGVwbG95bWVudHMvYWJvdXQtc2VjdXJpdHktaGFyZGVuaW5nLXdpdGgtb3BlbmlkLWNvbm5lY3QjZXhhbXBsZXNcbiAgICovXG4gIHJlYWRvbmx5IGZpbHRlcj86IHN0cmluZztcbn1cblxuLyoqXG4gKiBQcm9wcyB0aGF0IGRlZmluZSB0aGUgSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICogdmlhIEdpdGh1YiBPcGVuSUQgQ29ubmVjdCBJZGVudGl0eSBQcm92aWRlci5cbiAqXG4gKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gKiB3aGljaCB3aWxsIGJlIGRlZmluZWQgYnkgdGhpcyBjb25zdHJ1Y3QgKENESyB3aWxsIGZhaWwgaWYgeW91IGRvKS5cbiAqXG4gKiBAZXhhbXBsZVxuICoge1xuICogICBwcm92aWRlcjogR2l0aHViQWN0aW9uc0lkZW50aXR5UHJvdmlkZXIuZnJvbUFjY291bnQoc2NvcGUsIFwiR2l0aHViUHJvdmlkZXJcIiksXG4gKiAgIG93bmVyOiAnb2N0by1vcmcnLFxuICogICByZXBvOiAnb2N0by1yZXBvJyxcbiAqICAgZmlsdGVyOiAncmVmOnJlZnMvdGFncy92KicsXG4gKiAgIHJvbGVOYW1lOiAnTXlEZXBsb3lSb2xlJyxcbiAqIH1cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBHaXRodWJBY3Rpb25zUm9sZVByb3BzXG4gIGV4dGVuZHMgR2l0aHViQ29uZmlndXJhdGlvbiwgUm9sZVByb3BzIHt9XG5cbi8qKlxuICogRGVmaW5lIGFuIElBTSBSb2xlIHRoYXQgY2FuIGJlIGFzc3VtZWQgYnkgR2l0aHViIEFjdGlvbnMgd29ya2Zsb3dcbiAqIHZpYSBHaXRodWIgT3BlbklEIENvbm5lY3QgSWRlbnRpdHkgUHJvdmlkZXIuXG4gKlxuICogQmVzaWRlcyBgR2l0aHViQ29uZmlndXJhdGlvbmAsIHlvdSBtYXkgcGFzcyBpbiBhbnkgYGlhbS5Sb2xlUHJvcHNgIGV4Y2VwdCBgYXNzdW1lZEJ5YFxuICogd2hpY2ggd2lsbCBiZSBkZWZpbmVkIGJ5IHRoaXMgY29uc3RydWN0IChDREsgd2lsbCBmYWlsIGlmIHlvdSBkbykuXG4gKlxuICogQGV4YW1wbGVcbiAqIGNvbnN0IHVwbG9hZFJvbGUgPSBuZXcgR2l0aHViQWN0aW9uc1JvbGUoc2NvcGUsIFwiVXBsb2FkUm9sZVwiLCB7XG4gKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAqICAgb3duZXI6ICdvY3RvLW9yZycsXG4gKiAgIHJlcG86ICdvY3RvLXJlcG8nLFxuICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAqICAgcm9sZU5hbWU6ICdNeVVwbG9hZFJvbGUnLFxuICogfSk7XG4gKlxuICogbXlCdWNrZXQuZ3JhbnRXcml0ZSh1cGxvYWRSb2xlKTtcbiAqL1xuZXhwb3J0IGNsYXNzIEdpdGh1YkFjdGlvbnNSb2xlIGV4dGVuZHMgaWFtLlJvbGUge1xuICAvKipcbiAgICogRXh0cmFjdHMgcHJvcHMgZ2l2ZW4gZm9yIHRoZSBjcmVhdGVkIElBTSBSb2xlIENvbnN0cnVjdC5cbiAgICogQHBhcmFtIHByb3BzIGZvciB0aGUgR2l0aHViQWN0aW9uc1JvbGVcbiAgICogQHJldHVybnMgZm9yIHRoZSBJQU0gUm9sZVxuICAgKi9cbiAgcHJpdmF0ZSBzdGF0aWMgZXh0cmFjdFJvbGVQcm9wcyhcbiAgICBwcm9wczogR2l0aHViQWN0aW9uc1JvbGVQcm9wcyxcbiAgKTogaWFtLlJvbGVQcm9wcyB7XG4gICAgY29uc3QgZXh0cmFjdFByb3BzID0gPGFueT5wcm9wcztcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnByb3ZpZGVyO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMub3duZXI7XG4gICAgZGVsZXRlIGV4dHJhY3RQcm9wcy5yZXBvO1xuICAgIGRlbGV0ZSBleHRyYWN0UHJvcHMub3duZXJJZDtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLnJlcG9JZDtcbiAgICBkZWxldGUgZXh0cmFjdFByb3BzLmZpbHRlcjtcbiAgICByZXR1cm4gZXh0cmFjdFByb3BzO1xuICB9XG5cbiAgLyoqIFZhbGlkYXRlcyB0aGUgR2l0aHViIG93bmVyIChvcmdhbml6YXRpb24gb3IgdXNlcikgbmFtZS4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgdmFsaWRhdGVPd25lcihzY29wZTogQ29uc3RydWN0LCBvd25lcjogc3RyaW5nKTogdm9pZCB7XG4gICAgaWYgKGdpdGh1YlVzZXJuYW1lUmVnZXgudGVzdChvd25lcikgIT09IHRydWUpIHtcbiAgICAgIGNkay5Bbm5vdGF0aW9ucy5vZihzY29wZSkuYWRkRXJyb3IoXG4gICAgICAgIGBJbnZhbGlkIEdpdGh1YiBSZXBvc2l0b3J5IE93bmVyIFwiJHtvd25lcn1cIi4gTXVzdCBvbmx5IGNvbnRhaW4gYWxwaGFudW1lcmljIGNoYXJhY3RlcnMgb3IgaHlwaGVucywgY2Fubm90IGhhdmUgbXVsdGlwbGUgY29uc2VjdXRpdmUgaHlwaGVucywgY2Fubm90IGJlZ2luIG9yIGVuZCB3aXRoIGEgaHlwZW4gYW5kIG1heGltdW0gbGVuZ2h0IGlzIDM5IGNoYXJhY3RlcnMuYCxcbiAgICAgICk7XG4gICAgfVxuICB9XG5cbiAgLyoqIFZhbGlkYXRlcyB0aGUgR2l0aHViIHJlcG9zaXRvcnkgbmFtZSAod2l0aG91dCBvd25lcikuICovXG4gIHByaXZhdGUgc3RhdGljIHZhbGlkYXRlUmVwbyhzY29wZTogQ29uc3RydWN0LCByZXBvOiBzdHJpbmcpOiB2b2lkIHtcbiAgICBpZiAocmVwbyA9PT0gXCJcIikge1xuICAgICAgY2RrLkFubm90YXRpb25zLm9mKHNjb3BlKS5hZGRFcnJvcihcbiAgICAgICAgYEludmFsaWQgR2l0aHViIFJlcG9zaXRvcnkgTmFtZSBcIiR7cmVwb31cIi4gTWF5IG5vdCBiZSBlbXB0eSBzdHJpbmcuYCxcbiAgICAgICk7XG4gICAgfVxuICB9XG5cbiAgLyoqIFZhbGlkYXRlcyB0aGUgR2l0aHViIG93bmVyIGFuZCByZXBvc2l0b3J5IElEcy4gKi9cbiAgcHJpdmF0ZSBzdGF0aWMgdmFsaWRhdGVJZHMoXG4gICAgc2NvcGU6IENvbnN0cnVjdCxcbiAgICBvd25lcklkPzogc3RyaW5nLFxuICAgIHJlcG9JZD86IHN0cmluZyxcbiAgKTogdm9pZCB7XG4gICAgaWYgKChvd25lcklkID09PSB1bmRlZmluZWQpICE9PSAocmVwb0lkID09PSB1bmRlZmluZWQpKSB7XG4gICAgICBjZGsuQW5ub3RhdGlvbnMub2Yoc2NvcGUpLmFkZEVycm9yKFxuICAgICAgICAnSW5jb21wbGV0ZSBHaXRodWIgSURzLiBCb3RoIFwib3duZXJJZFwiIGFuZCBcInJlcG9JZFwiIG11c3QgYmUgZ2l2ZW4gdG8gdXNlIGFuIGltbXV0YWJsZSBzdWJqZWN0LCBvciBuZWl0aGVyIG9mIHRoZW0uJyxcbiAgICAgICk7XG4gICAgfVxuICB9XG5cbiAgLyoqIEZvcm1hdHMgdGhlIGBzdWJgIHZhbHVlIHVzZWQgaW4gdHJ1c3QgcG9saWN5LiAqL1xuICBwcml2YXRlIHN0YXRpYyBmb3JtYXRTdWJqZWN0KHByb3BzOiBHaXRodWJDb25maWd1cmF0aW9uKTogc3RyaW5nIHtcbiAgICBjb25zdCB7IG93bmVyLCByZXBvLCBvd25lcklkLCByZXBvSWQsIGZpbHRlciA9IFwiKlwiIH0gPSBwcm9wcztcblxuICAgIGlmIChvd25lcklkICE9PSB1bmRlZmluZWQgJiYgcmVwb0lkICE9PSB1bmRlZmluZWQpIHtcbiAgICAgIHJldHVybiBgcmVwbzoke293bmVyfUAke293bmVySWR9LyR7cmVwb31AJHtyZXBvSWR9OiR7ZmlsdGVyfWA7XG4gICAgfVxuXG4gICAgcmV0dXJuIGByZXBvOiR7b3duZXJ9LyR7cmVwb306JHtmaWx0ZXJ9YDtcbiAgfVxuXG4gIC8qKlxuICAgKiBEZWZpbmUgYW4gSUFNIFJvbGUgdGhhdCBjYW4gYmUgYXNzdW1lZCBieSBHaXRodWIgQWN0aW9ucyB3b3JrZmxvd1xuICAgKiB2aWEgR2l0aHViIE9wZW5JRCBDb25uZWN0IElkZW50aXR5IFByb3ZpZGVyLlxuICAgKlxuICAgKiBCZXNpZGVzIGBHaXRodWJDb25maWd1cmF0aW9uYCwgeW91IG1heSBwYXNzIGluIGFueSBgaWFtLlJvbGVQcm9wc2AgZXhjZXB0IGBhc3N1bWVkQnlgXG4gICAqIHdoaWNoIHdpbGwgYmUgZGVmaW5lZCBieSB0aGlzIGNvbnN0cnVjdCAoQ0RLIHdpbGwgZmFpbCBpZiB5b3UgZG8pLlxuICAgKlxuICAgKiBAZXhhbXBsZVxuICAgKiBjb25zdCB1cGxvYWRSb2xlID0gbmV3IEdpdGh1YkFjdGlvbnNSb2xlKHNjb3BlLCBcIlVwbG9hZFJvbGVcIiwge1xuICAgKiAgIHByb3ZpZGVyOiBHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5mcm9tQWNjb3VudChzY29wZSwgXCJHaXRodWJQcm92aWRlclwiKSxcbiAgICogICBvd25lcjogJ29jdG8tb3JnJyxcbiAgICogICByZXBvOiAnb2N0by1yZXBvJyxcbiAgICogICBmaWx0ZXI6ICdyZWY6cmVmcy90YWdzL3YqJyxcbiAgICogICByb2xlTmFtZTogJ015VXBsb2FkUm9sZScsXG4gICAqIH0pO1xuICAgKlxuICAgKiBteUJ1Y2tldC5ncmFudFdyaXRlKHVwbG9hZFJvbGUpO1xuICAgKi9cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IEdpdGh1YkFjdGlvbnNSb2xlUHJvcHMpIHtcbiAgICBjb25zdCB7IHByb3ZpZGVyLCBvd25lciwgcmVwbywgb3duZXJJZCwgcmVwb0lkIH0gPSBwcm9wcztcblxuICAgIC8vIFBlcmZvcm0gdmFsaWRhdGlvbnNcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZU93bmVyKHNjb3BlLCBvd25lcik7XG4gICAgR2l0aHViQWN0aW9uc1JvbGUudmFsaWRhdGVSZXBvKHNjb3BlLCByZXBvKTtcbiAgICBHaXRodWJBY3Rpb25zUm9sZS52YWxpZGF0ZUlkcyhzY29wZSwgb3duZXJJZCwgcmVwb0lkKTtcblxuICAgIC8vIFByZXBhcmUgdmFsdWVzXG4gICAgY29uc3Qgc3ViamVjdCA9IEdpdGh1YkFjdGlvbnNSb2xlLmZvcm1hdFN1YmplY3QocHJvcHMpO1xuICAgIGNvbnN0IHJvbGVQcm9wcyA9IEdpdGh1YkFjdGlvbnNSb2xlLmV4dHJhY3RSb2xlUHJvcHMocHJvcHMpO1xuXG4gICAgLy8gVGhlIGFjdHVhbCBJQU0gUm9sZSBjcmVhdGlvblxuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucm9sZVByb3BzLFxuICAgICAgYXNzdW1lZEJ5OiBuZXcgaWFtLldlYklkZW50aXR5UHJpbmNpcGFsKHByb3ZpZGVyLm9pZGNQcm92aWRlckFybiwge1xuICAgICAgICBTdHJpbmdMaWtlOiB7XG4gICAgICAgICAgLy8gT25seSBhbGxvdyBzcGVjaWZpZWQgc3ViamVjdHMgdG8gYXNzdW1lIHRoaXMgcm9sZVxuICAgICAgICAgIFtgJHtHaXRodWJBY3Rpb25zSWRlbnRpdHlQcm92aWRlci5pc3N1ZXJ9OnN1YmBdOiBzdWJqZWN0LFxuICAgICAgICB9LFxuICAgICAgICBTdHJpbmdFcXVhbHM6IHtcbiAgICAgICAgICAvLyBBdWRpZW5jZSBpcyBhbHdheXMgc3RzLmFtYXpvbmF3cy5jb20gd2l0aCBBV1Mgb2ZmaWNpYWwgR2l0aHViIEFjdGlvblxuICAgICAgICAgIC8vIGh0dHBzOi8vZG9jcy5naXRodWIuY29tL2VuL2FjdGlvbnMvZGVwbG95bWVudC9zZWN1cml0eS1oYXJkZW5pbmcteW91ci1kZXBsb3ltZW50cy9jb25maWd1cmluZy1vcGVuaWQtY29ubmVjdC1pbi1hbWF6b24td2ViLXNlcnZpY2VzI2FkZGluZy10aGUtaWRlbnRpdHktcHJvdmlkZXItdG8tYXdzXG4gICAgICAgICAgW2Ake0dpdGh1YkFjdGlvbnNJZGVudGl0eVByb3ZpZGVyLmlzc3Vlcn06YXVkYF06IFwic3RzLmFtYXpvbmF3cy5jb21cIixcbiAgICAgICAgfSxcbiAgICAgIH0pLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/package.json

@@ -20,26 +20,26 @@
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
     "aws-cdk-lib": "2.260.0",
-    "commit-and-tag-version": "^12",
+    "commit-and-tag-version": "^13",
     "constructs": "10.7.2",
     "eslint": "^9",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^2.7.1",
-    "eslint-plugin-import": "^2.28.0",
-    "eslint-plugin-prettier": "^5.5.5",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-prettier": "^5.5.6",
     "jest": "^30",
     "jest-junit": "^17",
     "jsii": "~6.0.7",
-    "jsii-diff": "^1.86.1",
+    "jsii-diff": "^1.140.0",
     "jsii-docgen": "^10.5.0",
-    "jsii-pacmak": "^1.86.1",
+    "jsii-pacmak": "^1.140.0",
     "jsii-rosetta": "~6.0.7",
-    "lefthook": "2.1.4",
-    "prettier": "^3.8.1",
-    "projen": "^0.101.23",
+    "lefthook": "2.1.14",
+    "prettier": "^3.9.8",
+    "projen": "^0.103.25",
     "ts-jest": "^29",
     "ts-node": "^10.9.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^6.0.2"
   },
   "peerDependencies": {
@@ -73,7 +73,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "5.0.2",
+  "version": "5.1.1",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [

package/pnpm-workspace.yaml

@@ -1,5 +1,7 @@
 # ~~ Generated by projen. To modify, edit .projenrc.ts and run "pnpm exec projen".
 
+overrides:
+  js-yaml@<3.15.2: 3.15.2
 nodeLinker: hoisted
 strictDepBuilds: true
 resolutionMode: highest
@@ -8,6 +10,7 @@ minimumReleaseAgeExclude:
   - "@alma-cdk/construct-library"
   - jsii@6.0.9
   - jsii-rosetta@6.0.9
+  - jsii-rosetta@6.0.16
 trustPolicy: no-downgrade
 trustPolicyExclude:
   - jsii@5.9.33
@@ -16,10 +19,12 @@ trustPolicyExclude:
   - jsii@6.0.8
   - jsii@6.0.9
   - jsii-rosetta@6.0.9
-  - jsii@5.9.35
+  - jsii@5.9.3
+  - jsii@6.0.14
 allowBuilds:
   unrs-resolver: true
   lefthook: true
   esbuild: true
+  "@parcel/watcher": true
 blockExoticSubdeps: true
 trustPolicyIgnoreAfter: 20160