aws-delivlib 13.5.19 → 13.6.0

package/lib/package-integrity/handler/integrity.ts

@@ -0,0 +1,316 @@
+import { execSync } from 'child_process';
+import type { RequestOptions, IncomingMessage } from 'http';
+import * as https from 'https';
+import * as os from 'os';
+import * as path from 'path';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import AdmZip from 'adm-zip';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as fs from 'fs-extra';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as jstream from 'JSONStream';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as tar from 'tar';
+import { Repository } from './repository';
+
+
+/**
+ * Published package.
+ */
+export interface PublishedPackage {
+
+  /**
+   * Name of the package as stored in the package manager.
+   */
+  readonly name: string;
+
+  /**
+   * Version of the package as stored in the package manager.
+   */
+  readonly version: string;
+}
+
+/**
+ * Integrity class for validating a local artifact against its published counterpart.
+ *
+ * Implementations differ based on the package manager in question.
+ */
+export abstract class ArtifactIntegrity {
+
+  /**
+   * The file extenstion of artifacts produced for this check. (e.g 'whl')
+   */
+  protected abstract readonly ext: string;
+
+  /**
+   * Download a package to the target file.
+   *
+   * @param pkg The package to download.
+   * @param targetFile The file path to download the package to.
+   */
+  protected abstract download(pkg: PublishedPackage, targetFile: string): Promise<void>;
+
+  /**
+   * Extract the artifact into the target directory.
+   *
+   * @param artifact Path to an artifact file.
+   * @param targetDir The directory to extract to. It will exist by the time this method is invoked.
+   */
+  protected abstract extract(artifact: string, targetDir: string): Promise<void>;
+
+  /**
+   * Parse a local artifact file name into a structured package.
+   *
+   * @param artifactName Base name of the local artifact file.
+   * @returns The package this artifact correlates to.
+   */
+  protected abstract parseArtifactName(artifactName: string): PublishedPackage;
+
+  /**
+   * Validate a local artifact against its published counterpart.
+   *
+   * @param localArtifactDir The directory of the local artifact. Must contain exactly one file with the appropriate extenstion.
+   */
+  public async validate(localArtifactDir: string) {
+
+    const artifactPath = this.findOne(localArtifactDir);
+    const name = this.constructor.name;
+
+    this.log(`Validating ${artifactPath}`);
+    const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'integrity-check'));
+
+    try {
+      const downloaded = path.join(workdir, `${name}.downloaded`);
+      const remote = path.join(workdir, `${name}.remote`);
+      const local = path.join(workdir, `${name}.local`);
+
+      // parse the artifact name into a package.
+      const pkg = this.parseArtifactName(path.basename(artifactPath));
+
+      fs.mkdirSync(remote);
+      fs.mkdirSync(local);
+
+      // download the package
+      this.log(`Downloading ${pkg.name}@${pkg.version} to ${downloaded}`);
+      await this.download(pkg, downloaded);
+
+      // extract the downlaoded package
+      this.log(`Extracting remote artifact from ${downloaded} to ${remote}`);
+      await this.extract(downloaded, remote);
+
+      // extract the local artfiact
+      this.log(`Extracting local artifact from ${artifactPath} to ${local}`);
+      await this.extract(artifactPath, local);
+
+      this.log(`Comparing ${local} <> ${remote}`);
+      try {
+        execSync(`diff ${local} ${remote}`, { stdio: ['ignore', 'inherit', 'inherit'] });
+      } catch (error) {
+        throw new Error(`${name} validation failed`);
+      }
+      this.log('Success');
+
+    } finally {
+      fs.removeSync(workdir);
+    }
+
+  }
+
+  protected log(message: string) {
+    console.log(`${this.constructor.name} | ${message} `);
+  }
+
+  private findOne(dir: string): string {
+    const files = fs.readdirSync(dir).filter(f => f.endsWith(this.ext));
+    if (files.length === 0) {
+      throw new Error(`No files found in ${dir} with extension ${this.ext}`);
+    }
+    const [first, ...rest] = files;
+    if (rest.length > 0) {
+      throw new Error(`Multiple files found in ${dir} with extension ${this.ext}: ${first}, ${rest.join(', ')}`);
+    }
+    return path.join(dir, first);
+  }
+
+}
+
+/**
+ * Properties for `RepositoryIntegrity`.
+ */
+export interface RepositoryIntegrityProps {
+  /**
+   * Repository to validate.
+   */
+  readonly repository: Repository;
+
+  /**
+   * The command that produces the local artifacts.
+   *
+   * @default 'npx projen release'
+   */
+  readonly packCommand?: string;
+}
+
+/**
+ * Integrity class for validating the artifacts produced by this repository against their published counterparts.
+ */
+export class RepositoryIntegrity {
+
+  public constructor(private readonly props: RepositoryIntegrityProps) {}
+
+  /**
+   * Validate the artifacts of this repo against its published counterpart.
+   */
+  public async validate() {
+
+    // note that run 'release' by default to preserve the version number.
+    // this won't do a bump since the commit we are on is already tagged.
+    const artifacts = this.props.repository.pack(this.props.packCommand ?? 'npx projen release');
+
+    let integrity = undefined;
+    for (const artifact of artifacts) {
+      switch (artifact.lang) {
+        case 'js':
+          integrity = new NpmArtifactIntegrity();
+          break;
+        case 'python':
+          integrity = new PyPIArtifactIntegrity();
+          break;
+        case 'java':
+        case 'dotnet':
+        case 'go':
+          // we don't have integrity checks for these
+          // artifacts yet.
+          break;
+        default:
+          throw new Error(`Unsupported artifact language: ${artifact.lang}`);
+      }
+      if (integrity) {
+        await integrity.validate(artifact.directory);
+      }
+    }
+    console.log('Validation done');
+  }
+
+}
+
+/**
+ * NpmIntegiry is able to perform integiry checks against packages stored on npmjs.com
+ */
+export class NpmArtifactIntegrity extends ArtifactIntegrity {
+
+  protected readonly ext = 'tgz';
+
+  protected async download(pkg: PublishedPackage, target: string): Promise<void> {
+    const tarballUrl = await jsonGet(`https://registry.npmjs.org/${encodeURIComponent(pkg.name)}/${encodeURIComponent(pkg.version)}`, ['dist', 'tarball']);
+    await download(tarballUrl, target);
+  }
+
+  public async extract(file: string, targetDir: string): Promise<void> {
+    return tar.x({ cwd: targetDir, file: file, strip: 1 });
+  }
+
+  protected parseArtifactName(artifactName: string): PublishedPackage {
+
+    // cdk8s@1.0.0-beta.59.jsii.tgz
+    const jsiiArtifact = /(.*)@(.*)\.jsii./;
+
+    // npm artifact: cdk8s-cli-1.0.0-beta59.tgz
+    // yarn artifact: cdk8s-cli-v1.0.0-beta59.tgz (add a 'v' before the version)
+    const npmOrYarnArtifact = /(.*)-v?(\d.*).(tgz|tar.gz)/;
+
+    const regex = artifactName.includes('.jsii.') ? jsiiArtifact : npmOrYarnArtifact;
+
+    const match = artifactName.match(regex);
+    if (!match) {
+      throw new Error(`Unable to parse artifact: ${artifactName}`);
+    }
+
+    return { name: match[1], version: match[2] };
+
+  }
+
+}
+
+/**
+ * PyPIIntegiry is able to perform integiry checks against packages stored on pypi.org
+ */
+export class PyPIArtifactIntegrity extends ArtifactIntegrity {
+
+  protected readonly ext = 'whl';
+
+  protected async download(pkg: PublishedPackage, target: string): Promise<void> {
+
+    const files = await jsonGet(`https://pypi.org/pypi/${encodeURIComponent(pkg.name)}/json`, ['releases', pkg.version]);
+    const wheels: string[] = files.filter((f: any) => f.url.endsWith('whl')).map((f: any) => f.url);
+
+    if (wheels.length === 0) {
+      throw new Error(`No wheels found for package ${pkg.name}-${pkg.version}`);
+    }
+
+    if (wheels.length > 1) {
+      throw new Error(`Multiple wheels found for package ${pkg.name}-${pkg.version}: ${wheels.join(',')}`);
+    }
+
+    await download(wheels[0], target);
+  }
+
+  public async extract(artifact: string, target: string): Promise<void> {
+    const zip = new AdmZip(artifact);
+    return zip.extractAllTo(target);
+  }
+
+  protected parseArtifactName(artifactName: string): PublishedPackage {
+
+    // cdk8s-1.0.0b63-py3-none-any.whl
+    const regex = /(.*)-v?(\d.*)-py.*.whl/;
+
+    const match = artifactName.match(regex);
+    if (!match) {
+      throw new Error(`Unable to parse artifact: ${artifactName}`);
+    }
+
+    return { name: match[1], version: match[2] };
+
+  }
+
+}
+
+export function jsonGet(url: string, jsonPath?: string[]): Promise<any> {
+  return get(url, (res, ok, ko) => {
+    const json = jstream.parse(jsonPath);
+    json.once('data', ok);
+    json.once('error', ko);
+
+    res.pipe(json, { end: true });
+  }, { headers: { 'Accept': 'application/json', 'Accept-Encoding': 'identity' } });
+}
+
+export async function download(url: string, targetFile: string): Promise<any> {
+  return get(url, (res, ok, ko) => {
+    const file = fs.createWriteStream(targetFile);
+    file.on('finish', ok);
+    file.on('error', ko);
+    res.pipe(file, { end: true });
+  });
+}
+
+export async function get(
+  url: string,
+  handler: (res: IncomingMessage, ok: (value: unknown) => void, ko: (err: Error) => void) => void,
+  options: RequestOptions = {}) {
+
+  return new Promise((ok, ko) => {
+    const request = https.get(url, options, (res: IncomingMessage) => {
+      if (res.statusCode !== 200) {
+        const error = new Error(`GET ${url} - HTTP ${res.statusCode} (${res.statusMessage})`);
+        Error.captureStackTrace(error);
+        return ko(error);
+      }
+      res.once('error', ko);
+      handler(res, ok, ko);
+    });
+    request.on('error', ko);
+  });
+
+}

package/lib/package-integrity/handler/repository.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Properties for `Repository`.
+ */
+export interface RepositoryProps {
+    /**
+     * Local directory where the repository was cloned to.
+     */
+    readonly repoDir: string;
+}
+/**
+ * Artifact produced by this repository.
+ */
+export interface Artifact {
+    /**
+     * Language of the artifact.
+     */
+    readonly lang: string;
+    /**
+     * Directory containing the artifact.
+     */
+    readonly directory: string;
+}
+/**
+ * Options for `Repository.fromGitHub`
+ */
+export interface RepositoryFromGitHubOptions {
+    /**
+     * Repository slug (e.g cdk8s-team/cdk8s-core)
+     */
+    readonly slug: string;
+    /**
+     * Repository tag.
+     *
+     * @default - latest tag based on creation date.
+     */
+    readonly tag?: string;
+    /**
+      * Prefix for detecting the latest tag of the repo. Only applies if `tag` isn't specified.
+      * This is useful for repositories that produce multiple packages, and hence multiple tags
+      * for example: https://github.com/cdk8s-team/cdk8s-plus/tags.
+      */
+    readonly tagPrefix?: string;
+    /**
+     * ARN of an AWS secrets manager secret containing a GitHub token.
+     * Required for private repositories. Recommended for public ones, to avoid throtlling issues.
+     *
+     * @default - the repository is cloned without credentials.
+     */
+    readonly githubTokenSecretArn?: string;
+}
+/**
+ * Options for `Repository.fromDir`
+ */
+export interface RepositoryFromDirOptions {
+    /**
+     * The directory of the repo.
+     */
+    readonly repoDir: string;
+}
+/**
+ * Repository containing a node project.
+ */
+export declare class Repository {
+    readonly repoDir: string;
+    /**
+     * Create a repository from a local directory.
+     */
+    static fromDir(options: RepositoryFromDirOptions): Promise<Repository>;
+    /**
+     * Create a repository from a GitHub repository.
+     */
+    static fromGitHub(options: RepositoryFromGitHubOptions): Promise<Repository>;
+    private readonly isJsii;
+    private readonly manifest;
+    private constructor();
+    /**
+     * Pack the repository to produce the artifacts.
+     */
+    pack(command: string): Artifact[];
+    private _shell;
+}

package/lib/package-integrity/handler/repository.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Repository = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// eslint-disable-next-line import/no-extraneous-dependencies
+const AWS = __importStar(require("aws-sdk"));
+/**
+ * Repository containing a node project.
+ */
+class Repository {
+    constructor(repoDir) {
+        this.repoDir = repoDir;
+        const manifestPath = path.join(repoDir, 'package.json');
+        this.manifest = JSON.parse(fs.readFileSync(manifestPath, { encoding: 'utf-8' }));
+        const isProjen = fs.existsSync(path.join(repoDir, '.projen'));
+        const isYarn = fs.existsSync(path.join(repoDir, 'yarn.lock'));
+        if (!isProjen) {
+            // this makes packing much simpler since projen standrardizes it.
+            // for now it will suffice, re-evaluate if a use-case arrises.
+            throw new Error('Only projen managed repositories are supported at this time');
+        }
+        if (!isYarn) {
+            // the projen version we use has to match the one in the repo since otherwise
+            // synthesis may result in a diff. so we use and enforce a yarn.lock file
+            // to make it simpler and not have to worry about other package managers.
+            // for now it will suffice, re-evaluate if a use-case arrises.
+            throw new Error('Only yarn managed repositories are supported at this time');
+        }
+        this.isJsii = !!this.manifest.jsii;
+    }
+    /**
+     * Create a repository from a local directory.
+     */
+    static async fromDir(options) {
+        return new Repository(options.repoDir);
+    }
+    /**
+     * Create a repository from a GitHub repository.
+     */
+    static async fromGitHub(options) {
+        const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'work'));
+        const sm = new AWS.SecretsManager();
+        let token = undefined;
+        if (options.githubTokenSecretArn) {
+            const secret = await sm.getSecretValue({ SecretId: options.githubTokenSecretArn }).promise();
+            token = secret.SecretString;
+        }
+        const repoDir = fs.mkdtempSync(path.join(workdir, 'repo'));
+        console.log(`Cloning ${options.slug} into ${repoDir}`);
+        (0, child_process_1.execSync)(`git clone https://${token ? `${token}@` : ''}github.com/${options.slug}.git ${repoDir}`);
+        const latestTag = findLatestTag(repoDir, options.tagPrefix);
+        (0, child_process_1.execSync)(`git checkout ${latestTag}`, { cwd: repoDir });
+        return new Repository(repoDir);
+    }
+    /**
+     * Pack the repository to produce the artifacts.
+     */
+    pack(command) {
+        var _a;
+        const installCommand = 'yarn install --frozen-lockfile';
+        console.log(`Installing | ${installCommand}`);
+        this._shell(installCommand);
+        const dist = this.isJsii ? (_a = this.manifest.jsii.outdir) !== null && _a !== void 0 ? _a : 'dist' : 'dist';
+        const outdir = path.join(this.repoDir, dist);
+        console.log(`Packing | ${command}`);
+        // crapy: https://github.com/projen/projen/pull/1631
+        this._shell(this.isJsii ? `unset CI && ${command}` : command);
+        const artifacts = [];
+        for (const lang of fs.readdirSync(outdir)) {
+            const langDir = path.join(outdir, lang);
+            if (!fs.lstatSync(langDir).isDirectory()) {
+                // dist folder may contain files such as changelog.md
+                // so we ignore these
+                continue;
+            }
+            artifacts.push({ lang, directory: path.join(outdir, lang) });
+        }
+        return artifacts;
+    }
+    _shell(command) {
+        (0, child_process_1.execSync)(command, { cwd: this.repoDir, stdio: ['ignore', 'inherit', 'inherit'] });
+    }
+}
+exports.Repository = Repository;
+function findLatestTag(repoDir, prefix) {
+    const tags = (0, child_process_1.execSync)(`git tag -l --sort=-creatordate "${prefix !== null && prefix !== void 0 ? prefix : ''}*"`, { cwd: repoDir }).toString();
+    return tags.split(os.EOL)[0].trim();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVwb3NpdG9yeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInJlcG9zaXRvcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGlEQUF5QztBQUN6Qyx1Q0FBeUI7QUFDekIsdUNBQXlCO0FBQ3pCLDJDQUE2QjtBQUM3Qiw2REFBNkQ7QUFDN0QsNkNBQStCO0FBeUUvQjs7R0FFRztBQUNILE1BQWEsVUFBVTtJQXFDckIsWUFBb0MsT0FBZTtRQUFmLFlBQU8sR0FBUCxPQUFPLENBQVE7UUFDakQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFFeEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQztRQUVqRixNQUFNLFFBQVEsR0FBRyxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDOUQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO1FBRTlELElBQUksQ0FBQyxRQUFRLEVBQUU7WUFDYixpRUFBaUU7WUFDakUsOERBQThEO1lBQzlELE1BQU0sSUFBSSxLQUFLLENBQUMsNkRBQTZELENBQUMsQ0FBQztTQUNoRjtRQUVELElBQUksQ0FBQyxNQUFNLEVBQUU7WUFDWCw2RUFBNkU7WUFDN0UseUVBQXlFO1lBQ3pFLHlFQUF5RTtZQUN6RSw4REFBOEQ7WUFDOUQsTUFBTSxJQUFJLEtBQUssQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1NBQzlFO1FBRUQsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDckMsQ0FBQztJQTFERDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQWlDO1FBQzNELE9BQU8sSUFBSSxVQUFVLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLE9BQW9DO1FBRWpFLE1BQU0sT0FBTyxHQUFHLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvRCxNQUFNLEVBQUUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUVwQyxJQUFJLEtBQUssR0FBRyxTQUFTLENBQUM7UUFDdEIsSUFBSSxPQUFPLENBQUMsb0JBQW9CLEVBQUU7WUFDaEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxFQUFFLENBQUMsY0FBYyxDQUFDLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDN0YsS0FBSyxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUM7U0FDN0I7UUFDRCxNQUFNLE9BQU8sR0FBRyxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFFM0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLE9BQU8sQ0FBQyxJQUFJLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUN2RCxJQUFBLHdCQUFRLEVBQUMscUJBQXFCLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLE9BQU8sQ0FBQyxJQUFJLFFBQVEsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUVuRyxNQUFNLFNBQVMsR0FBRyxhQUFhLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM1RCxJQUFBLHdCQUFRLEVBQUMsZ0JBQWdCLFNBQVMsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFFeEQsT0FBTyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUVqQyxDQUFDO0lBOEJEOztPQUVHO0lBQ0ksSUFBSSxDQUFDLE9BQWU7O1FBRXpCLE1BQU0sY0FBYyxHQUFHLGdDQUFnQyxDQUFDO1FBQ3hELE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUU1QixNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFBLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sbUNBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFDeEUsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRTdDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBRXBDLG9EQUFvRDtRQUNwRCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLGVBQWUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRTlELE1BQU0sU0FBUyxHQUFlLEVBQUUsQ0FBQztRQUNqQyxLQUFLLE1BQU0sSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDekMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDeEMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUU7Z0JBQ3hDLHFEQUFxRDtnQkFDckQscUJBQXFCO2dCQUNyQixTQUFTO2FBQ1Y7WUFDRCxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDOUQ7UUFFRCxPQUFPLFNBQVMsQ0FBQztJQUVuQixDQUFDO0lBRU8sTUFBTSxDQUFDLE9BQWU7UUFDNUIsSUFBQSx3QkFBUSxFQUFDLE9BQU8sRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7Q0FFRjtBQWxHRCxnQ0FrR0M7QUFFRCxTQUFTLGFBQWEsQ0FBQyxPQUFlLEVBQUUsTUFBZTtJQUNyRCxNQUFNLElBQUksR0FBRyxJQUFBLHdCQUFRLEVBQUMsbUNBQW1DLE1BQU0sYUFBTixNQUFNLGNBQU4sTUFBTSxHQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDeEcsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUN0QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZXhlY1N5bmMgfSBmcm9tICdjaGlsZF9wcm9jZXNzJztcbmltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIG9zIGZyb20gJ29zJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG4vLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgaW1wb3J0L25vLWV4dHJhbmVvdXMtZGVwZW5kZW5jaWVzXG5pbXBvcnQgKiBhcyBBV1MgZnJvbSAnYXdzLXNkayc7XG5cbi8qKlxuICogUHJvcGVydGllcyBmb3IgYFJlcG9zaXRvcnlgLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlcG9zaXRvcnlQcm9wcyB7XG4gIC8qKlxuICAgKiBMb2NhbCBkaXJlY3Rvcnkgd2hlcmUgdGhlIHJlcG9zaXRvcnkgd2FzIGNsb25lZCB0by5cbiAgICovXG4gIHJlYWRvbmx5IHJlcG9EaXI6IHN0cmluZztcbn1cblxuLyoqXG4gKiBBcnRpZmFjdCBwcm9kdWNlZCBieSB0aGlzIHJlcG9zaXRvcnkuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXJ0aWZhY3Qge1xuICAvKipcbiAgICogTGFuZ3VhZ2Ugb2YgdGhlIGFydGlmYWN0LlxuICAgKi9cbiAgcmVhZG9ubHkgbGFuZzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBEaXJlY3RvcnkgY29udGFpbmluZyB0aGUgYXJ0aWZhY3QuXG4gICAqL1xuICByZWFkb25seSBkaXJlY3Rvcnk6IHN0cmluZztcbn1cblxuLyoqXG4gKiBPcHRpb25zIGZvciBgUmVwb3NpdG9yeS5mcm9tR2l0SHViYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlcG9zaXRvcnlGcm9tR2l0SHViT3B0aW9ucyB7XG5cbiAgLyoqXG4gICAqIFJlcG9zaXRvcnkgc2x1ZyAoZS5nIGNkazhzLXRlYW0vY2RrOHMtY29yZSlcbiAgICovXG4gIHJlYWRvbmx5IHNsdWc6IHN0cmluZztcblxuICAvKipcbiAgICogUmVwb3NpdG9yeSB0YWcuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbGF0ZXN0IHRhZyBiYXNlZCBvbiBjcmVhdGlvbiBkYXRlLlxuICAgKi9cbiAgcmVhZG9ubHkgdGFnPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgICogUHJlZml4IGZvciBkZXRlY3RpbmcgdGhlIGxhdGVzdCB0YWcgb2YgdGhlIHJlcG8uIE9ubHkgYXBwbGllcyBpZiBgdGFnYCBpc24ndCBzcGVjaWZpZWQuXG4gICAgKiBUaGlzIGlzIHVzZWZ1bCBmb3IgcmVwb3NpdG9yaWVzIHRoYXQgcHJvZHVjZSBtdWx0aXBsZSBwYWNrYWdlcywgYW5kIGhlbmNlIG11bHRpcGxlIHRhZ3NcbiAgICAqIGZvciBleGFtcGxlOiBodHRwczovL2dpdGh1Yi5jb20vY2RrOHMtdGVhbS9jZGs4cy1wbHVzL3RhZ3MuXG4gICAgKi9cbiAgcmVhZG9ubHkgdGFnUHJlZml4Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBBUk4gb2YgYW4gQVdTIHNlY3JldHMgbWFuYWdlciBzZWNyZXQgY29udGFpbmluZyBhIEdpdEh1YiB0b2tlbi5cbiAgICogUmVxdWlyZWQgZm9yIHByaXZhdGUgcmVwb3NpdG9yaWVzLiBSZWNvbW1lbmRlZCBmb3IgcHVibGljIG9uZXMsIHRvIGF2b2lkIHRocm90bGxpbmcgaXNzdWVzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIHRoZSByZXBvc2l0b3J5IGlzIGNsb25lZCB3aXRob3V0IGNyZWRlbnRpYWxzLlxuICAgKi9cbiAgcmVhZG9ubHkgZ2l0aHViVG9rZW5TZWNyZXRBcm4/OiBzdHJpbmc7XG5cbn1cblxuLyoqXG4gKiBPcHRpb25zIGZvciBgUmVwb3NpdG9yeS5mcm9tRGlyYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlcG9zaXRvcnlGcm9tRGlyT3B0aW9ucyB7XG5cbiAgLyoqXG4gICAqIFRoZSBkaXJlY3Rvcnkgb2YgdGhlIHJlcG8uXG4gICAqL1xuICByZWFkb25seSByZXBvRGlyOiBzdHJpbmc7XG5cbn1cblxuLyoqXG4gKiBSZXBvc2l0b3J5IGNvbnRhaW5pbmcgYSBub2RlIHByb2plY3QuXG4gKi9cbmV4cG9ydCBjbGFzcyBSZXBvc2l0b3J5IHtcblxuICAvKipcbiAgICogQ3JlYXRlIGEgcmVwb3NpdG9yeSBmcm9tIGEgbG9jYWwgZGlyZWN0b3J5LlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhc3luYyBmcm9tRGlyKG9wdGlvbnM6IFJlcG9zaXRvcnlGcm9tRGlyT3B0aW9ucyk6IFByb21pc2U8UmVwb3NpdG9yeT4ge1xuICAgIHJldHVybiBuZXcgUmVwb3NpdG9yeShvcHRpb25zLnJlcG9EaXIpO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIHJlcG9zaXRvcnkgZnJvbSBhIEdpdEh1YiByZXBvc2l0b3J5LlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhc3luYyBmcm9tR2l0SHViKG9wdGlvbnM6IFJlcG9zaXRvcnlGcm9tR2l0SHViT3B0aW9ucyk6IFByb21pc2U8UmVwb3NpdG9yeT4ge1xuXG4gICAgY29uc3Qgd29ya2RpciA9IGZzLm1rZHRlbXBTeW5jKHBhdGguam9pbihvcy50bXBkaXIoKSwgJ3dvcmsnKSk7XG4gICAgY29uc3Qgc20gPSBuZXcgQVdTLlNlY3JldHNNYW5hZ2VyKCk7XG5cbiAgICBsZXQgdG9rZW4gPSB1bmRlZmluZWQ7XG4gICAgaWYgKG9wdGlvbnMuZ2l0aHViVG9rZW5TZWNyZXRBcm4pIHtcbiAgICAgIGNvbnN0IHNlY3JldCA9IGF3YWl0IHNtLmdldFNlY3JldFZhbHVlKHsgU2VjcmV0SWQ6IG9wdGlvbnMuZ2l0aHViVG9rZW5TZWNyZXRBcm4gfSkucHJvbWlzZSgpO1xuICAgICAgdG9rZW4gPSBzZWNyZXQuU2VjcmV0U3RyaW5nO1xuICAgIH1cbiAgICBjb25zdCByZXBvRGlyID0gZnMubWtkdGVtcFN5bmMocGF0aC5qb2luKHdvcmtkaXIsICdyZXBvJykpO1xuXG4gICAgY29uc29sZS5sb2coYENsb25pbmcgJHtvcHRpb25zLnNsdWd9IGludG8gJHtyZXBvRGlyfWApO1xuICAgIGV4ZWNTeW5jKGBnaXQgY2xvbmUgaHR0cHM6Ly8ke3Rva2VuID8gYCR7dG9rZW59QGAgOiAnJ31naXRodWIuY29tLyR7b3B0aW9ucy5zbHVnfS5naXQgJHtyZXBvRGlyfWApO1xuXG4gICAgY29uc3QgbGF0ZXN0VGFnID0gZmluZExhdGVzdFRhZyhyZXBvRGlyLCBvcHRpb25zLnRhZ1ByZWZpeCk7XG4gICAgZXhlY1N5bmMoYGdpdCBjaGVja291dCAke2xhdGVzdFRhZ31gLCB7IGN3ZDogcmVwb0RpciB9KTtcblxuICAgIHJldHVybiBuZXcgUmVwb3NpdG9yeShyZXBvRGlyKTtcblxuICB9XG5cbiAgcHJpdmF0ZSByZWFkb25seSBpc0pzaWk6IGJvb2xlYW47XG4gIHByaXZhdGUgcmVhZG9ubHkgbWFuaWZlc3Q6IGFueTtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKHB1YmxpYyByZWFkb25seSByZXBvRGlyOiBzdHJpbmcpIHtcbiAgICBjb25zdCBtYW5pZmVzdFBhdGggPSBwYXRoLmpvaW4ocmVwb0RpciwgJ3BhY2thZ2UuanNvbicpO1xuXG4gICAgdGhpcy5tYW5pZmVzdCA9IEpTT04ucGFyc2UoZnMucmVhZEZpbGVTeW5jKG1hbmlmZXN0UGF0aCwgeyBlbmNvZGluZzogJ3V0Zi04JyB9KSk7XG5cbiAgICBjb25zdCBpc1Byb2plbiA9IGZzLmV4aXN0c1N5bmMocGF0aC5qb2luKHJlcG9EaXIsICcucHJvamVuJykpO1xuICAgIGNvbnN0IGlzWWFybiA9IGZzLmV4aXN0c1N5bmMocGF0aC5qb2luKHJlcG9EaXIsICd5YXJuLmxvY2snKSk7XG5cbiAgICBpZiAoIWlzUHJvamVuKSB7XG4gICAgICAvLyB0aGlzIG1ha2VzIHBhY2tpbmcgbXVjaCBzaW1wbGVyIHNpbmNlIHByb2plbiBzdGFuZHJhcmRpemVzIGl0LlxuICAgICAgLy8gZm9yIG5vdyBpdCB3aWxsIHN1ZmZpY2UsIHJlLWV2YWx1YXRlIGlmIGEgdXNlLWNhc2UgYXJyaXNlcy5cbiAgICAgIHRocm93IG5ldyBFcnJvcignT25seSBwcm9qZW4gbWFuYWdlZCByZXBvc2l0b3JpZXMgYXJlIHN1cHBvcnRlZCBhdCB0aGlzIHRpbWUnKTtcbiAgICB9XG5cbiAgICBpZiAoIWlzWWFybikge1xuICAgICAgLy8gdGhlIHByb2plbiB2ZXJzaW9uIHdlIHVzZSBoYXMgdG8gbWF0Y2ggdGhlIG9uZSBpbiB0aGUgcmVwbyBzaW5jZSBvdGhlcndpc2VcbiAgICAgIC8vIHN5bnRoZXNpcyBtYXkgcmVzdWx0IGluIGEgZGlmZi4gc28gd2UgdXNlIGFuZCBlbmZvcmNlIGEgeWFybi5sb2NrIGZpbGVcbiAgICAgIC8vIHRvIG1ha2UgaXQgc2ltcGxlciBhbmQgbm90IGhhdmUgdG8gd29ycnkgYWJvdXQgb3RoZXIgcGFja2FnZSBtYW5hZ2Vycy5cbiAgICAgIC8vIGZvciBub3cgaXQgd2lsbCBzdWZmaWNlLCByZS1ldmFsdWF0ZSBpZiBhIHVzZS1jYXNlIGFycmlzZXMuXG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ09ubHkgeWFybiBtYW5hZ2VkIHJlcG9zaXRvcmllcyBhcmUgc3VwcG9ydGVkIGF0IHRoaXMgdGltZScpO1xuICAgIH1cblxuICAgIHRoaXMuaXNKc2lpID0gISF0aGlzLm1hbmlmZXN0LmpzaWk7XG4gIH1cblxuICAvKipcbiAgICogUGFjayB0aGUgcmVwb3NpdG9yeSB0byBwcm9kdWNlIHRoZSBhcnRpZmFjdHMuXG4gICAqL1xuICBwdWJsaWMgcGFjayhjb21tYW5kOiBzdHJpbmcpOiBBcnRpZmFjdFtdIHtcblxuICAgIGNvbnN0IGluc3RhbGxDb21tYW5kID0gJ3lhcm4gaW5zdGFsbCAtLWZyb3plbi1sb2NrZmlsZSc7XG4gICAgY29uc29sZS5sb2coYEluc3RhbGxpbmcgfCAke2luc3RhbGxDb21tYW5kfWApO1xuICAgIHRoaXMuX3NoZWxsKGluc3RhbGxDb21tYW5kKTtcblxuICAgIGNvbnN0IGRpc3QgPSB0aGlzLmlzSnNpaSA/IHRoaXMubWFuaWZlc3QuanNpaS5vdXRkaXIgPz8gJ2Rpc3QnIDogJ2Rpc3QnO1xuICAgIGNvbnN0IG91dGRpciA9IHBhdGguam9pbih0aGlzLnJlcG9EaXIsIGRpc3QpO1xuXG4gICAgY29uc29sZS5sb2coYFBhY2tpbmcgfCAke2NvbW1hbmR9YCk7XG5cbiAgICAvLyBjcmFweTogaHR0cHM6Ly9naXRodWIuY29tL3Byb2plbi9wcm9qZW4vcHVsbC8xNjMxXG4gICAgdGhpcy5fc2hlbGwodGhpcy5pc0pzaWkgPyBgdW5zZXQgQ0kgJiYgJHtjb21tYW5kfWAgOiBjb21tYW5kKTtcblxuICAgIGNvbnN0IGFydGlmYWN0czogQXJ0aWZhY3RbXSA9IFtdO1xuICAgIGZvciAoY29uc3QgbGFuZyBvZiBmcy5yZWFkZGlyU3luYyhvdXRkaXIpKSB7XG4gICAgICBjb25zdCBsYW5nRGlyID0gcGF0aC5qb2luKG91dGRpciwgbGFuZyk7XG4gICAgICBpZiAoIWZzLmxzdGF0U3luYyhsYW5nRGlyKS5pc0RpcmVjdG9yeSgpKSB7XG4gICAgICAgIC8vIGRpc3QgZm9sZGVyIG1heSBjb250YWluIGZpbGVzIHN1Y2ggYXMgY2hhbmdlbG9nLm1kXG4gICAgICAgIC8vIHNvIHdlIGlnbm9yZSB0aGVzZVxuICAgICAgICBjb250aW51ZTtcbiAgICAgIH1cbiAgICAgIGFydGlmYWN0cy5wdXNoKHsgbGFuZywgZGlyZWN0b3J5OiBwYXRoLmpvaW4ob3V0ZGlyLCBsYW5nKSB9KTtcbiAgICB9XG5cbiAgICByZXR1cm4gYXJ0aWZhY3RzO1xuXG4gIH1cblxuICBwcml2YXRlIF9zaGVsbChjb21tYW5kOiBzdHJpbmcpIHtcbiAgICBleGVjU3luYyhjb21tYW5kLCB7IGN3ZDogdGhpcy5yZXBvRGlyLCBzdGRpbzogWydpZ25vcmUnLCAnaW5oZXJpdCcsICdpbmhlcml0J10gfSk7XG4gIH1cblxufVxuXG5mdW5jdGlvbiBmaW5kTGF0ZXN0VGFnKHJlcG9EaXI6IHN0cmluZywgcHJlZml4Pzogc3RyaW5nKSB7XG4gIGNvbnN0IHRhZ3MgPSBleGVjU3luYyhgZ2l0IHRhZyAtbCAtLXNvcnQ9LWNyZWF0b3JkYXRlIFwiJHtwcmVmaXggPz8gJyd9KlwiYCwgeyBjd2Q6IHJlcG9EaXIgfSkudG9TdHJpbmcoKTtcbiAgcmV0dXJuIHRhZ3Muc3BsaXQob3MuRU9MKVswXS50cmltKCk7XG59XG4iXX0=