aws-delivlib 13.5.19 → 13.6.2

package/lib/package-integrity/handler/integrity.js

@@ -0,0 +1,238 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.get = exports.download = exports.jsonGet = exports.PyPIArtifactIntegrity = exports.NpmArtifactIntegrity = exports.RepositoryIntegrity = exports.ArtifactIntegrity = void 0;
+const child_process_1 = require("child_process");
+const https = __importStar(require("https"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// eslint-disable-next-line import/no-extraneous-dependencies
+const adm_zip_1 = __importDefault(require("adm-zip"));
+// eslint-disable-next-line import/no-extraneous-dependencies
+const fs = __importStar(require("fs-extra"));
+// eslint-disable-next-line import/no-extraneous-dependencies
+const jstream = __importStar(require("JSONStream"));
+// eslint-disable-next-line import/no-extraneous-dependencies
+const tar = __importStar(require("tar"));
+/**
+ * Integrity class for validating a local artifact against its published counterpart.
+ *
+ * Implementations differ based on the package manager in question.
+ */
+class ArtifactIntegrity {
+    /**
+     * Validate a local artifact against its published counterpart.
+     *
+     * @param localArtifactDir The directory of the local artifact. Must contain exactly one file with the appropriate extenstion.
+     */
+    async validate(localArtifactDir) {
+        const artifactPath = this.findOne(localArtifactDir);
+        const name = this.constructor.name;
+        this.log(`Validating ${artifactPath}`);
+        const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'integrity-check'));
+        try {
+            const downloaded = path.join(workdir, `${name}.downloaded`);
+            const remote = path.join(workdir, `${name}.remote`);
+            const local = path.join(workdir, `${name}.local`);
+            // parse the artifact name into a package.
+            const pkg = this.parseArtifactName(path.basename(artifactPath));
+            fs.mkdirSync(remote);
+            fs.mkdirSync(local);
+            // download the package
+            this.log(`Downloading ${pkg.name}@${pkg.version} to ${downloaded}`);
+            await this.download(pkg, downloaded);
+            // extract the downlaoded package
+            this.log(`Extracting remote artifact from ${downloaded} to ${remote}`);
+            await this.extract(downloaded, remote);
+            // extract the local artfiact
+            this.log(`Extracting local artifact from ${artifactPath} to ${local}`);
+            await this.extract(artifactPath, local);
+            this.log(`Comparing ${local} <> ${remote}`);
+            try {
+                (0, child_process_1.execSync)(`diff ${local} ${remote}`, { stdio: ['ignore', 'inherit', 'inherit'] });
+            }
+            catch (error) {
+                throw new Error(`${name} validation failed`);
+            }
+            this.log('Success');
+        }
+        finally {
+            fs.removeSync(workdir);
+        }
+    }
+    log(message) {
+        console.log(`${this.constructor.name} | ${message} `);
+    }
+    findOne(dir) {
+        const files = fs.readdirSync(dir).filter(f => f.endsWith(this.ext));
+        if (files.length === 0) {
+            throw new Error(`No files found in ${dir} with extension ${this.ext}`);
+        }
+        const [first, ...rest] = files;
+        if (rest.length > 0) {
+            throw new Error(`Multiple files found in ${dir} with extension ${this.ext}: ${first}, ${rest.join(', ')}`);
+        }
+        return path.join(dir, first);
+    }
+}
+exports.ArtifactIntegrity = ArtifactIntegrity;
+/**
+ * Integrity class for validating the artifacts produced by this repository against their published counterparts.
+ */
+class RepositoryIntegrity {
+    constructor(props) {
+        this.props = props;
+    }
+    /**
+     * Validate the artifacts of this repo against its published counterpart.
+     */
+    async validate() {
+        var _a;
+        // note that run 'release' by default to preserve the version number.
+        // this won't do a bump since the commit we are on is already tagged.
+        const artifacts = this.props.repository.pack((_a = this.props.packCommand) !== null && _a !== void 0 ? _a : 'npx projen release');
+        let integrity = undefined;
+        for (const artifact of artifacts) {
+            switch (artifact.lang) {
+                case 'js':
+                    integrity = new NpmArtifactIntegrity();
+                    break;
+                case 'python':
+                    integrity = new PyPIArtifactIntegrity();
+                    break;
+                case 'java':
+                case 'dotnet':
+                case 'go':
+                    // we don't have integrity checks for these
+                    // artifacts yet.
+                    break;
+                default:
+                    throw new Error(`Unsupported artifact language: ${artifact.lang}`);
+            }
+            if (integrity) {
+                await integrity.validate(artifact.directory);
+            }
+        }
+        console.log('Validation done');
+    }
+}
+exports.RepositoryIntegrity = RepositoryIntegrity;
+/**
+ * NpmIntegiry is able to perform integiry checks against packages stored on npmjs.com
+ */
+class NpmArtifactIntegrity extends ArtifactIntegrity {
+    constructor() {
+        super(...arguments);
+        this.ext = 'tgz';
+    }
+    async download(pkg, target) {
+        const tarballUrl = await jsonGet(`https://registry.npmjs.org/${encodeURIComponent(pkg.name)}/${encodeURIComponent(pkg.version)}`, ['dist', 'tarball']);
+        await download(tarballUrl, target);
+    }
+    async extract(file, targetDir) {
+        return tar.x({ cwd: targetDir, file: file, strip: 1 });
+    }
+    parseArtifactName(artifactName) {
+        // cdk8s@1.0.0-beta.59.jsii.tgz
+        const jsiiArtifact = /(.*)@(.*)\.jsii./;
+        // npm artifact: cdk8s-cli-1.0.0-beta59.tgz
+        // yarn artifact: cdk8s-cli-v1.0.0-beta59.tgz (add a 'v' before the version)
+        const npmOrYarnArtifact = /(.*)-v?(\d.*).(tgz|tar.gz)/;
+        const regex = artifactName.includes('.jsii.') ? jsiiArtifact : npmOrYarnArtifact;
+        const match = artifactName.match(regex);
+        if (!match) {
+            throw new Error(`Unable to parse artifact: ${artifactName}`);
+        }
+        return { name: match[1], version: match[2] };
+    }
+}
+exports.NpmArtifactIntegrity = NpmArtifactIntegrity;
+/**
+ * PyPIIntegiry is able to perform integiry checks against packages stored on pypi.org
+ */
+class PyPIArtifactIntegrity extends ArtifactIntegrity {
+    constructor() {
+        super(...arguments);
+        this.ext = 'whl';
+    }
+    async download(pkg, target) {
+        const files = await jsonGet(`https://pypi.org/pypi/${encodeURIComponent(pkg.name)}/json`, ['releases', pkg.version]);
+        const wheels = files.filter((f) => f.url.endsWith('whl')).map((f) => f.url);
+        if (wheels.length === 0) {
+            throw new Error(`No wheels found for package ${pkg.name}-${pkg.version}`);
+        }
+        if (wheels.length > 1) {
+            throw new Error(`Multiple wheels found for package ${pkg.name}-${pkg.version}: ${wheels.join(',')}`);
+        }
+        await download(wheels[0], target);
+    }
+    async extract(artifact, target) {
+        const zip = new adm_zip_1.default(artifact);
+        return zip.extractAllTo(target);
+    }
+    parseArtifactName(artifactName) {
+        // cdk8s-1.0.0b63-py3-none-any.whl
+        const regex = /(.*)-v?(\d.*)-py.*.whl/;
+        const match = artifactName.match(regex);
+        if (!match) {
+            throw new Error(`Unable to parse artifact: ${artifactName}`);
+        }
+        return { name: match[1], version: match[2] };
+    }
+}
+exports.PyPIArtifactIntegrity = PyPIArtifactIntegrity;
+function jsonGet(url, jsonPath) {
+    return get(url, (res, ok, ko) => {
+        const json = jstream.parse(jsonPath);
+        json.once('data', ok);
+        json.once('error', ko);
+        res.pipe(json, { end: true });
+    }, { headers: { 'Accept': 'application/json', 'Accept-Encoding': 'identity' } });
+}
+exports.jsonGet = jsonGet;
+async function download(url, targetFile) {
+    return get(url, (res, ok, ko) => {
+        const file = fs.createWriteStream(targetFile);
+        file.on('finish', ok);
+        file.on('error', ko);
+        res.pipe(file, { end: true });
+    });
+}
+exports.download = download;
+async function get(url, handler, options = {}) {
+    return new Promise((ok, ko) => {
+        const request = https.get(url, options, (res) => {
+            if (res.statusCode !== 200) {
+                const error = new Error(`GET ${url} - HTTP ${res.statusCode} (${res.statusMessage})`);
+                Error.captureStackTrace(error);
+                return ko(error);
+            }
+            res.once('error', ko);
+            handler(res, ok, ko);
+        });
+        request.on('error', ko);
+    });
+}
+exports.get = get;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZWdyaXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiaW50ZWdyaXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxpREFBeUM7QUFFekMsNkNBQStCO0FBQy9CLHVDQUF5QjtBQUN6QiwyQ0FBNkI7QUFDN0IsNkRBQTZEO0FBQzdELHNEQUE2QjtBQUM3Qiw2REFBNkQ7QUFDN0QsNkNBQStCO0FBQy9CLDZEQUE2RDtBQUM3RCxvREFBc0M7QUFDdEMsNkRBQTZEO0FBQzdELHlDQUEyQjtBQW9CM0I7Ozs7R0FJRztBQUNILE1BQXNCLGlCQUFpQjtJQStCckM7Ozs7T0FJRztJQUNJLEtBQUssQ0FBQyxRQUFRLENBQUMsZ0JBQXdCO1FBRTVDLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUNwRCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQztRQUVuQyxJQUFJLENBQUMsR0FBRyxDQUFDLGNBQWMsWUFBWSxFQUFFLENBQUMsQ0FBQztRQUN2QyxNQUFNLE9BQU8sR0FBRyxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQztRQUUxRSxJQUFJO1lBQ0YsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLGFBQWEsQ0FBQyxDQUFDO1lBQzVELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEdBQUcsSUFBSSxTQUFTLENBQUMsQ0FBQztZQUNwRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxHQUFHLElBQUksUUFBUSxDQUFDLENBQUM7WUFFbEQsMENBQTBDO1lBQzFDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7WUFFaEUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNyQixFQUFFLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBRXBCLHVCQUF1QjtZQUN2QixJQUFJLENBQUMsR0FBRyxDQUFDLGVBQWUsR0FBRyxDQUFDLElBQUksSUFBSSxHQUFHLENBQUMsT0FBTyxPQUFPLFVBQVUsRUFBRSxDQUFDLENBQUM7WUFDcEUsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsQ0FBQztZQUVyQyxpQ0FBaUM7WUFDakMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxtQ0FBbUMsVUFBVSxPQUFPLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDdkUsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUV2Qyw2QkFBNkI7WUFDN0IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxrQ0FBa0MsWUFBWSxPQUFPLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDdkUsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxLQUFLLENBQUMsQ0FBQztZQUV4QyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsS0FBSyxPQUFPLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDNUMsSUFBSTtnQkFDRixJQUFBLHdCQUFRLEVBQUMsUUFBUSxLQUFLLElBQUksTUFBTSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQzthQUNsRjtZQUFDLE9BQU8sS0FBSyxFQUFFO2dCQUNkLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxJQUFJLG9CQUFvQixDQUFDLENBQUM7YUFDOUM7WUFDRCxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1NBRXJCO2dCQUFTO1lBQ1IsRUFBRSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztTQUN4QjtJQUVILENBQUM7SUFFUyxHQUFHLENBQUMsT0FBZTtRQUMzQixPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLE1BQU0sT0FBTyxHQUFHLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBRU8sT0FBTyxDQUFDLEdBQVc7UUFDekIsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUU7WUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsR0FBRyxtQkFBbUIsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7U0FDeEU7UUFDRCxNQUFNLENBQUMsS0FBSyxFQUFFLEdBQUcsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDO1FBQy9CLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUU7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsR0FBRyxtQkFBbUIsSUFBSSxDQUFDLEdBQUcsS0FBSyxLQUFLLEtBQUssSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDNUc7UUFDRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQy9CLENBQUM7Q0FFRjtBQWpHRCw4Q0FpR0M7QUFtQkQ7O0dBRUc7QUFDSCxNQUFhLG1CQUFtQjtJQUU5QixZQUFvQyxLQUErQjtRQUEvQixVQUFLLEdBQUwsS0FBSyxDQUEwQjtJQUFHLENBQUM7SUFFdkU7O09BRUc7SUFDSSxLQUFLLENBQUMsUUFBUTs7UUFFbkIscUVBQXFFO1FBQ3JFLHFFQUFxRTtRQUNyRSxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBQSxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsbUNBQUksb0JBQW9CLENBQUMsQ0FBQztRQUU3RixJQUFJLFNBQVMsR0FBRyxTQUFTLENBQUM7UUFDMUIsS0FBSyxNQUFNLFFBQVEsSUFBSSxTQUFTLEVBQUU7WUFDaEMsUUFBUSxRQUFRLENBQUMsSUFBSSxFQUFFO2dCQUNyQixLQUFLLElBQUk7b0JBQ1AsU0FBUyxHQUFHLElBQUksb0JBQW9CLEVBQUUsQ0FBQztvQkFDdkMsTUFBTTtnQkFDUixLQUFLLFFBQVE7b0JBQ1gsU0FBUyxHQUFHLElBQUkscUJBQXFCLEVBQUUsQ0FBQztvQkFDeEMsTUFBTTtnQkFDUixLQUFLLE1BQU0sQ0FBQztnQkFDWixLQUFLLFFBQVEsQ0FBQztnQkFDZCxLQUFLLElBQUk7b0JBQ1AsMkNBQTJDO29CQUMzQyxpQkFBaUI7b0JBQ2pCLE1BQU07Z0JBQ1I7b0JBQ0UsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7YUFDdEU7WUFDRCxJQUFJLFNBQVMsRUFBRTtnQkFDYixNQUFNLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2FBQzlDO1NBQ0Y7UUFDRCxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDakMsQ0FBQztDQUVGO0FBdENELGtEQXNDQztBQUVEOztHQUVHO0FBQ0gsTUFBYSxvQkFBcUIsU0FBUSxpQkFBaUI7SUFBM0Q7O1FBRXFCLFFBQUcsR0FBRyxLQUFLLENBQUM7SUErQmpDLENBQUM7SUE3QlcsS0FBSyxDQUFDLFFBQVEsQ0FBQyxHQUFxQixFQUFFLE1BQWM7UUFDNUQsTUFBTSxVQUFVLEdBQUcsTUFBTSxPQUFPLENBQUMsOEJBQThCLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZKLE1BQU0sUUFBUSxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFZLEVBQUUsU0FBaUI7UUFDbEQsT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFUyxpQkFBaUIsQ0FBQyxZQUFvQjtRQUU5QywrQkFBK0I7UUFDL0IsTUFBTSxZQUFZLEdBQUcsa0JBQWtCLENBQUM7UUFFeEMsMkNBQTJDO1FBQzNDLDRFQUE0RTtRQUM1RSxNQUFNLGlCQUFpQixHQUFHLDRCQUE0QixDQUFDO1FBRXZELE1BQU0sS0FBSyxHQUFHLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUM7UUFFakYsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN4QyxJQUFJLENBQUMsS0FBSyxFQUFFO1lBQ1YsTUFBTSxJQUFJLEtBQUssQ0FBQyw2QkFBNkIsWUFBWSxFQUFFLENBQUMsQ0FBQztTQUM5RDtRQUVELE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUUvQyxDQUFDO0NBRUY7QUFqQ0Qsb0RBaUNDO0FBRUQ7O0dBRUc7QUFDSCxNQUFhLHFCQUFzQixTQUFRLGlCQUFpQjtJQUE1RDs7UUFFcUIsUUFBRyxHQUFHLEtBQUssQ0FBQztJQXFDakMsQ0FBQztJQW5DVyxLQUFLLENBQUMsUUFBUSxDQUFDLEdBQXFCLEVBQUUsTUFBYztRQUU1RCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyx5QkFBeUIsa0JBQWtCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxVQUFVLEVBQUUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDckgsTUFBTSxNQUFNLEdBQWEsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUVoRyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLEdBQUcsQ0FBQyxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7U0FDM0U7UUFFRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFO1lBQ3JCLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLEdBQUcsQ0FBQyxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sS0FBSyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztTQUN0RztRQUVELE1BQU0sUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNwQyxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFnQixFQUFFLE1BQWM7UUFDbkQsTUFBTSxHQUFHLEdBQUcsSUFBSSxpQkFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2pDLE9BQU8sR0FBRyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsQyxDQUFDO0lBRVMsaUJBQWlCLENBQUMsWUFBb0I7UUFFOUMsa0NBQWtDO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLHdCQUF3QixDQUFDO1FBRXZDLE1BQU0sS0FBSyxHQUFHLFlBQVksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDeEMsSUFBSSxDQUFDLEtBQUssRUFBRTtZQUNWLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLFlBQVksRUFBRSxDQUFDLENBQUM7U0FDOUQ7UUFFRCxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFFL0MsQ0FBQztDQUVGO0FBdkNELHNEQXVDQztBQUVELFNBQWdCLE9BQU8sQ0FBQyxHQUFXLEVBQUUsUUFBbUI7SUFDdEQsT0FBTyxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRTtRQUM5QixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3RCLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRXZCLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDaEMsQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLGtCQUFrQixFQUFFLGlCQUFpQixFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQztBQUNuRixDQUFDO0FBUkQsMEJBUUM7QUFFTSxLQUFLLFVBQVUsUUFBUSxDQUFDLEdBQVcsRUFBRSxVQUFrQjtJQUM1RCxPQUFPLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFO1FBQzlCLE1BQU0sSUFBSSxHQUFHLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM5QyxJQUFJLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN0QixJQUFJLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNyQixHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ2hDLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQVBELDRCQU9DO0FBRU0sS0FBSyxVQUFVLEdBQUcsQ0FDdkIsR0FBVyxFQUNYLE9BQStGLEVBQy9GLFVBQTBCLEVBQUU7SUFFNUIsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRTtRQUM1QixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQyxHQUFvQixFQUFFLEVBQUU7WUFDL0QsSUFBSSxHQUFHLENBQUMsVUFBVSxLQUFLLEdBQUcsRUFBRTtnQkFDMUIsTUFBTSxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsT0FBTyxHQUFHLFdBQVcsR0FBRyxDQUFDLFVBQVUsS0FBSyxHQUFHLENBQUMsYUFBYSxHQUFHLENBQUMsQ0FBQztnQkFDdEYsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUMvQixPQUFPLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQzthQUNsQjtZQUNELEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ3RCLE9BQU8sQ0FBQyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDMUIsQ0FBQyxDQUFDLENBQUM7QUFFTCxDQUFDO0FBbEJELGtCQWtCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGV4ZWNTeW5jIH0gZnJvbSAnY2hpbGRfcHJvY2Vzcyc7XG5pbXBvcnQgdHlwZSB7IFJlcXVlc3RPcHRpb25zLCBJbmNvbWluZ01lc3NhZ2UgfSBmcm9tICdodHRwJztcbmltcG9ydCAqIGFzIGh0dHBzIGZyb20gJ2h0dHBzJztcbmltcG9ydCAqIGFzIG9zIGZyb20gJ29zJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG4vLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgaW1wb3J0L25vLWV4dHJhbmVvdXMtZGVwZW5kZW5jaWVzXG5pbXBvcnQgQWRtWmlwIGZyb20gJ2FkbS16aXAnO1xuLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIGltcG9ydC9uby1leHRyYW5lb3VzLWRlcGVuZGVuY2llc1xuaW1wb3J0ICogYXMgZnMgZnJvbSAnZnMtZXh0cmEnO1xuLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIGltcG9ydC9uby1leHRyYW5lb3VzLWRlcGVuZGVuY2llc1xuaW1wb3J0ICogYXMganN0cmVhbSBmcm9tICdKU09OU3RyZWFtJztcbi8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBpbXBvcnQvbm8tZXh0cmFuZW91cy1kZXBlbmRlbmNpZXNcbmltcG9ydCAqIGFzIHRhciBmcm9tICd0YXInO1xuaW1wb3J0IHsgUmVwb3NpdG9yeSB9IGZyb20gJy4vcmVwb3NpdG9yeSc7XG5cblxuLyoqXG4gKiBQdWJsaXNoZWQgcGFja2FnZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQdWJsaXNoZWRQYWNrYWdlIHtcblxuICAvKipcbiAgICogTmFtZSBvZiB0aGUgcGFja2FnZSBhcyBzdG9yZWQgaW4gdGhlIHBhY2thZ2UgbWFuYWdlci5cbiAgICovXG4gIHJlYWRvbmx5IG5hbWU6IHN0cmluZztcblxuICAvKipcbiAgICogVmVyc2lvbiBvZiB0aGUgcGFja2FnZSBhcyBzdG9yZWQgaW4gdGhlIHBhY2thZ2UgbWFuYWdlci5cbiAgICovXG4gIHJlYWRvbmx5IHZlcnNpb246IHN0cmluZztcbn1cblxuLyoqXG4gKiBJbnRlZ3JpdHkgY2xhc3MgZm9yIHZhbGlkYXRpbmcgYSBsb2NhbCBhcnRpZmFjdCBhZ2FpbnN0IGl0cyBwdWJsaXNoZWQgY291bnRlcnBhcnQuXG4gKlxuICogSW1wbGVtZW50YXRpb25zIGRpZmZlciBiYXNlZCBvbiB0aGUgcGFja2FnZSBtYW5hZ2VyIGluIHF1ZXN0aW9uLlxuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgQXJ0aWZhY3RJbnRlZ3JpdHkge1xuXG4gIC8qKlxuICAgKiBUaGUgZmlsZSBleHRlbnN0aW9uIG9mIGFydGlmYWN0cyBwcm9kdWNlZCBmb3IgdGhpcyBjaGVjay4gKGUuZyAnd2hsJylcbiAgICovXG4gIHByb3RlY3RlZCBhYnN0cmFjdCByZWFkb25seSBleHQ6IHN0cmluZztcblxuICAvKipcbiAgICogRG93bmxvYWQgYSBwYWNrYWdlIHRvIHRoZSB0YXJnZXQgZmlsZS5cbiAgICpcbiAgICogQHBhcmFtIHBrZyBUaGUgcGFja2FnZSB0byBkb3dubG9hZC5cbiAgICogQHBhcmFtIHRhcmdldEZpbGUgVGhlIGZpbGUgcGF0aCB0byBkb3dubG9hZCB0aGUgcGFja2FnZSB0by5cbiAgICovXG4gIHByb3RlY3RlZCBhYnN0cmFjdCBkb3dubG9hZChwa2c6IFB1Ymxpc2hlZFBhY2thZ2UsIHRhcmdldEZpbGU6IHN0cmluZyk6IFByb21pc2U8dm9pZD47XG5cbiAgLyoqXG4gICAqIEV4dHJhY3QgdGhlIGFydGlmYWN0IGludG8gdGhlIHRhcmdldCBkaXJlY3RvcnkuXG4gICAqXG4gICAqIEBwYXJhbSBhcnRpZmFjdCBQYXRoIHRvIGFuIGFydGlmYWN0IGZpbGUuXG4gICAqIEBwYXJhbSB0YXJnZXREaXIgVGhlIGRpcmVjdG9yeSB0byBleHRyYWN0IHRvLiBJdCB3aWxsIGV4aXN0IGJ5IHRoZSB0aW1lIHRoaXMgbWV0aG9kIGlzIGludm9rZWQuXG4gICAqL1xuICBwcm90ZWN0ZWQgYWJzdHJhY3QgZXh0cmFjdChhcnRpZmFjdDogc3RyaW5nLCB0YXJnZXREaXI6IHN0cmluZyk6IFByb21pc2U8dm9pZD47XG5cbiAgLyoqXG4gICAqIFBhcnNlIGEgbG9jYWwgYXJ0aWZhY3QgZmlsZSBuYW1lIGludG8gYSBzdHJ1Y3R1cmVkIHBhY2thZ2UuXG4gICAqXG4gICAqIEBwYXJhbSBhcnRpZmFjdE5hbWUgQmFzZSBuYW1lIG9mIHRoZSBsb2NhbCBhcnRpZmFjdCBmaWxlLlxuICAgKiBAcmV0dXJucyBUaGUgcGFja2FnZSB0aGlzIGFydGlmYWN0IGNvcnJlbGF0ZXMgdG8uXG4gICAqL1xuICBwcm90ZWN0ZWQgYWJzdHJhY3QgcGFyc2VBcnRpZmFjdE5hbWUoYXJ0aWZhY3ROYW1lOiBzdHJpbmcpOiBQdWJsaXNoZWRQYWNrYWdlO1xuXG4gIC8qKlxuICAgKiBWYWxpZGF0ZSBhIGxvY2FsIGFydGlmYWN0IGFnYWluc3QgaXRzIHB1Ymxpc2hlZCBjb3VudGVycGFydC5cbiAgICpcbiAgICogQHBhcmFtIGxvY2FsQXJ0aWZhY3REaXIgVGhlIGRpcmVjdG9yeSBvZiB0aGUgbG9jYWwgYXJ0aWZhY3QuIE11c3QgY29udGFpbiBleGFjdGx5IG9uZSBmaWxlIHdpdGggdGhlIGFwcHJvcHJpYXRlIGV4dGVuc3Rpb24uXG4gICAqL1xuICBwdWJsaWMgYXN5bmMgdmFsaWRhdGUobG9jYWxBcnRpZmFjdERpcjogc3RyaW5nKSB7XG5cbiAgICBjb25zdCBhcnRpZmFjdFBhdGggPSB0aGlzLmZpbmRPbmUobG9jYWxBcnRpZmFjdERpcik7XG4gICAgY29uc3QgbmFtZSA9IHRoaXMuY29uc3RydWN0b3IubmFtZTtcblxuICAgIHRoaXMubG9nKGBWYWxpZGF0aW5nICR7YXJ0aWZhY3RQYXRofWApO1xuICAgIGNvbnN0IHdvcmtkaXIgPSBmcy5ta2R0ZW1wU3luYyhwYXRoLmpvaW4ob3MudG1wZGlyKCksICdpbnRlZ3JpdHktY2hlY2snKSk7XG5cbiAgICB0cnkge1xuICAgICAgY29uc3QgZG93bmxvYWRlZCA9IHBhdGguam9pbih3b3JrZGlyLCBgJHtuYW1lfS5kb3dubG9hZGVkYCk7XG4gICAgICBjb25zdCByZW1vdGUgPSBwYXRoLmpvaW4od29ya2RpciwgYCR7bmFtZX0ucmVtb3RlYCk7XG4gICAgICBjb25zdCBsb2NhbCA9IHBhdGguam9pbih3b3JrZGlyLCBgJHtuYW1lfS5sb2NhbGApO1xuXG4gICAgICAvLyBwYXJzZSB0aGUgYXJ0aWZhY3QgbmFtZSBpbnRvIGEgcGFja2FnZS5cbiAgICAgIGNvbnN0IHBrZyA9IHRoaXMucGFyc2VBcnRpZmFjdE5hbWUocGF0aC5iYXNlbmFtZShhcnRpZmFjdFBhdGgpKTtcblxuICAgICAgZnMubWtkaXJTeW5jKHJlbW90ZSk7XG4gICAgICBmcy5ta2RpclN5bmMobG9jYWwpO1xuXG4gICAgICAvLyBkb3dubG9hZCB0aGUgcGFja2FnZVxuICAgICAgdGhpcy5sb2coYERvd25sb2FkaW5nICR7cGtnLm5hbWV9QCR7cGtnLnZlcnNpb259IHRvICR7ZG93bmxvYWRlZH1gKTtcbiAgICAgIGF3YWl0IHRoaXMuZG93bmxvYWQocGtnLCBkb3dubG9hZGVkKTtcblxuICAgICAgLy8gZXh0cmFjdCB0aGUgZG93bmxhb2RlZCBwYWNrYWdlXG4gICAgICB0aGlzLmxvZyhgRXh0cmFjdGluZyByZW1vdGUgYXJ0aWZhY3QgZnJvbSAke2Rvd25sb2FkZWR9IHRvICR7cmVtb3RlfWApO1xuICAgICAgYXdhaXQgdGhpcy5leHRyYWN0KGRvd25sb2FkZWQsIHJlbW90ZSk7XG5cbiAgICAgIC8vIGV4dHJhY3QgdGhlIGxvY2FsIGFydGZpYWN0XG4gICAgICB0aGlzLmxvZyhgRXh0cmFjdGluZyBsb2NhbCBhcnRpZmFjdCBmcm9tICR7YXJ0aWZhY3RQYXRofSB0byAke2xvY2FsfWApO1xuICAgICAgYXdhaXQgdGhpcy5leHRyYWN0KGFydGlmYWN0UGF0aCwgbG9jYWwpO1xuXG4gICAgICB0aGlzLmxvZyhgQ29tcGFyaW5nICR7bG9jYWx9IDw+ICR7cmVtb3RlfWApO1xuICAgICAgdHJ5IHtcbiAgICAgICAgZXhlY1N5bmMoYGRpZmYgJHtsb2NhbH0gJHtyZW1vdGV9YCwgeyBzdGRpbzogWydpZ25vcmUnLCAnaW5oZXJpdCcsICdpbmhlcml0J10gfSk7XG4gICAgICB9IGNhdGNoIChlcnJvcikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7bmFtZX0gdmFsaWRhdGlvbiBmYWlsZWRgKTtcbiAgICAgIH1cbiAgICAgIHRoaXMubG9nKCdTdWNjZXNzJyk7XG5cbiAgICB9IGZpbmFsbHkge1xuICAgICAgZnMucmVtb3ZlU3luYyh3b3JrZGlyKTtcbiAgICB9XG5cbiAgfVxuXG4gIHByb3RlY3RlZCBsb2cobWVzc2FnZTogc3RyaW5nKSB7XG4gICAgY29uc29sZS5sb2coYCR7dGhpcy5jb25zdHJ1Y3Rvci5uYW1lfSB8ICR7bWVzc2FnZX0gYCk7XG4gIH1cblxuICBwcml2YXRlIGZpbmRPbmUoZGlyOiBzdHJpbmcpOiBzdHJpbmcge1xuICAgIGNvbnN0IGZpbGVzID0gZnMucmVhZGRpclN5bmMoZGlyKS5maWx0ZXIoZiA9PiBmLmVuZHNXaXRoKHRoaXMuZXh0KSk7XG4gICAgaWYgKGZpbGVzLmxlbmd0aCA9PT0gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBObyBmaWxlcyBmb3VuZCBpbiAke2Rpcn0gd2l0aCBleHRlbnNpb24gJHt0aGlzLmV4dH1gKTtcbiAgICB9XG4gICAgY29uc3QgW2ZpcnN0LCAuLi5yZXN0XSA9IGZpbGVzO1xuICAgIGlmIChyZXN0Lmxlbmd0aCA+IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgTXVsdGlwbGUgZmlsZXMgZm91bmQgaW4gJHtkaXJ9IHdpdGggZXh0ZW5zaW9uICR7dGhpcy5leHR9OiAke2ZpcnN0fSwgJHtyZXN0LmpvaW4oJywgJyl9YCk7XG4gICAgfVxuICAgIHJldHVybiBwYXRoLmpvaW4oZGlyLCBmaXJzdCk7XG4gIH1cblxufVxuXG4vKipcbiAqIFByb3BlcnRpZXMgZm9yIGBSZXBvc2l0b3J5SW50ZWdyaXR5YC5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBSZXBvc2l0b3J5SW50ZWdyaXR5UHJvcHMge1xuICAvKipcbiAgICogUmVwb3NpdG9yeSB0byB2YWxpZGF0ZS5cbiAgICovXG4gIHJlYWRvbmx5IHJlcG9zaXRvcnk6IFJlcG9zaXRvcnk7XG5cbiAgLyoqXG4gICAqIFRoZSBjb21tYW5kIHRoYXQgcHJvZHVjZXMgdGhlIGxvY2FsIGFydGlmYWN0cy5cbiAgICpcbiAgICogQGRlZmF1bHQgJ25weCBwcm9qZW4gcmVsZWFzZSdcbiAgICovXG4gIHJlYWRvbmx5IHBhY2tDb21tYW5kPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIEludGVncml0eSBjbGFzcyBmb3IgdmFsaWRhdGluZyB0aGUgYXJ0aWZhY3RzIHByb2R1Y2VkIGJ5IHRoaXMgcmVwb3NpdG9yeSBhZ2FpbnN0IHRoZWlyIHB1Ymxpc2hlZCBjb3VudGVycGFydHMuXG4gKi9cbmV4cG9ydCBjbGFzcyBSZXBvc2l0b3J5SW50ZWdyaXR5IHtcblxuICBwdWJsaWMgY29uc3RydWN0b3IocHJpdmF0ZSByZWFkb25seSBwcm9wczogUmVwb3NpdG9yeUludGVncml0eVByb3BzKSB7fVxuXG4gIC8qKlxuICAgKiBWYWxpZGF0ZSB0aGUgYXJ0aWZhY3RzIG9mIHRoaXMgcmVwbyBhZ2FpbnN0IGl0cyBwdWJsaXNoZWQgY291bnRlcnBhcnQuXG4gICAqL1xuICBwdWJsaWMgYXN5bmMgdmFsaWRhdGUoKSB7XG5cbiAgICAvLyBub3RlIHRoYXQgcnVuICdyZWxlYXNlJyBieSBkZWZhdWx0IHRvIHByZXNlcnZlIHRoZSB2ZXJzaW9uIG51bWJlci5cbiAgICAvLyB0aGlzIHdvbid0IGRvIGEgYnVtcCBzaW5jZSB0aGUgY29tbWl0IHdlIGFyZSBvbiBpcyBhbHJlYWR5IHRhZ2dlZC5cbiAgICBjb25zdCBhcnRpZmFjdHMgPSB0aGlzLnByb3BzLnJlcG9zaXRvcnkucGFjayh0aGlzLnByb3BzLnBhY2tDb21tYW5kID8/ICducHggcHJvamVuIHJlbGVhc2UnKTtcblxuICAgIGxldCBpbnRlZ3JpdHkgPSB1bmRlZmluZWQ7XG4gICAgZm9yIChjb25zdCBhcnRpZmFjdCBvZiBhcnRpZmFjdHMpIHtcbiAgICAgIHN3aXRjaCAoYXJ0aWZhY3QubGFuZykge1xuICAgICAgICBjYXNlICdqcyc6XG4gICAgICAgICAgaW50ZWdyaXR5ID0gbmV3IE5wbUFydGlmYWN0SW50ZWdyaXR5KCk7XG4gICAgICAgICAgYnJlYWs7XG4gICAgICAgIGNhc2UgJ3B5dGhvbic6XG4gICAgICAgICAgaW50ZWdyaXR5ID0gbmV3IFB5UElBcnRpZmFjdEludGVncml0eSgpO1xuICAgICAgICAgIGJyZWFrO1xuICAgICAgICBjYXNlICdqYXZhJzpcbiAgICAgICAgY2FzZSAnZG90bmV0JzpcbiAgICAgICAgY2FzZSAnZ28nOlxuICAgICAgICAgIC8vIHdlIGRvbid0IGhhdmUgaW50ZWdyaXR5IGNoZWNrcyBmb3IgdGhlc2VcbiAgICAgICAgICAvLyBhcnRpZmFjdHMgeWV0LlxuICAgICAgICAgIGJyZWFrO1xuICAgICAgICBkZWZhdWx0OlxuICAgICAgICAgIHRocm93IG5ldyBFcnJvcihgVW5zdXBwb3J0ZWQgYXJ0aWZhY3QgbGFuZ3VhZ2U6ICR7YXJ0aWZhY3QubGFuZ31gKTtcbiAgICAgIH1cbiAgICAgIGlmIChpbnRlZ3JpdHkpIHtcbiAgICAgICAgYXdhaXQgaW50ZWdyaXR5LnZhbGlkYXRlKGFydGlmYWN0LmRpcmVjdG9yeSk7XG4gICAgICB9XG4gICAgfVxuICAgIGNvbnNvbGUubG9nKCdWYWxpZGF0aW9uIGRvbmUnKTtcbiAgfVxuXG59XG5cbi8qKlxuICogTnBtSW50ZWdpcnkgaXMgYWJsZSB0byBwZXJmb3JtIGludGVnaXJ5IGNoZWNrcyBhZ2FpbnN0IHBhY2thZ2VzIHN0b3JlZCBvbiBucG1qcy5jb21cbiAqL1xuZXhwb3J0IGNsYXNzIE5wbUFydGlmYWN0SW50ZWdyaXR5IGV4dGVuZHMgQXJ0aWZhY3RJbnRlZ3JpdHkge1xuXG4gIHByb3RlY3RlZCByZWFkb25seSBleHQgPSAndGd6JztcblxuICBwcm90ZWN0ZWQgYXN5bmMgZG93bmxvYWQocGtnOiBQdWJsaXNoZWRQYWNrYWdlLCB0YXJnZXQ6IHN0cmluZyk6IFByb21pc2U8dm9pZD4ge1xuICAgIGNvbnN0IHRhcmJhbGxVcmwgPSBhd2FpdCBqc29uR2V0KGBodHRwczovL3JlZ2lzdHJ5Lm5wbWpzLm9yZy8ke2VuY29kZVVSSUNvbXBvbmVudChwa2cubmFtZSl9LyR7ZW5jb2RlVVJJQ29tcG9uZW50KHBrZy52ZXJzaW9uKX1gLCBbJ2Rpc3QnLCAndGFyYmFsbCddKTtcbiAgICBhd2FpdCBkb3dubG9hZCh0YXJiYWxsVXJsLCB0YXJnZXQpO1xuICB9XG5cbiAgcHVibGljIGFzeW5jIGV4dHJhY3QoZmlsZTogc3RyaW5nLCB0YXJnZXREaXI6IHN0cmluZyk6IFByb21pc2U8dm9pZD4ge1xuICAgIHJldHVybiB0YXIueCh7IGN3ZDogdGFyZ2V0RGlyLCBmaWxlOiBmaWxlLCBzdHJpcDogMSB9KTtcbiAgfVxuXG4gIHByb3RlY3RlZCBwYXJzZUFydGlmYWN0TmFtZShhcnRpZmFjdE5hbWU6IHN0cmluZyk6IFB1Ymxpc2hlZFBhY2thZ2Uge1xuXG4gICAgLy8gY2RrOHNAMS4wLjAtYmV0YS41OS5qc2lpLnRnelxuICAgIGNvbnN0IGpzaWlBcnRpZmFjdCA9IC8oLiopQCguKilcXC5qc2lpLi87XG5cbiAgICAvLyBucG0gYXJ0aWZhY3Q6IGNkazhzLWNsaS0xLjAuMC1iZXRhNTkudGd6XG4gICAgLy8geWFybiBhcnRpZmFjdDogY2RrOHMtY2xpLXYxLjAuMC1iZXRhNTkudGd6IChhZGQgYSAndicgYmVmb3JlIHRoZSB2ZXJzaW9uKVxuICAgIGNvbnN0IG5wbU9yWWFybkFydGlmYWN0ID0gLyguKiktdj8oXFxkLiopLih0Z3p8dGFyLmd6KS87XG5cbiAgICBjb25zdCByZWdleCA9IGFydGlmYWN0TmFtZS5pbmNsdWRlcygnLmpzaWkuJykgPyBqc2lpQXJ0aWZhY3QgOiBucG1Pcllhcm5BcnRpZmFjdDtcblxuICAgIGNvbnN0IG1hdGNoID0gYXJ0aWZhY3ROYW1lLm1hdGNoKHJlZ2V4KTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYFVuYWJsZSB0byBwYXJzZSBhcnRpZmFjdDogJHthcnRpZmFjdE5hbWV9YCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIHsgbmFtZTogbWF0Y2hbMV0sIHZlcnNpb246IG1hdGNoWzJdIH07XG5cbiAgfVxuXG59XG5cbi8qKlxuICogUHlQSUludGVnaXJ5IGlzIGFibGUgdG8gcGVyZm9ybSBpbnRlZ2lyeSBjaGVja3MgYWdhaW5zdCBwYWNrYWdlcyBzdG9yZWQgb24gcHlwaS5vcmdcbiAqL1xuZXhwb3J0IGNsYXNzIFB5UElBcnRpZmFjdEludGVncml0eSBleHRlbmRzIEFydGlmYWN0SW50ZWdyaXR5IHtcblxuICBwcm90ZWN0ZWQgcmVhZG9ubHkgZXh0ID0gJ3dobCc7XG5cbiAgcHJvdGVjdGVkIGFzeW5jIGRvd25sb2FkKHBrZzogUHVibGlzaGVkUGFja2FnZSwgdGFyZ2V0OiBzdHJpbmcpOiBQcm9taXNlPHZvaWQ+IHtcblxuICAgIGNvbnN0IGZpbGVzID0gYXdhaXQganNvbkdldChgaHR0cHM6Ly9weXBpLm9yZy9weXBpLyR7ZW5jb2RlVVJJQ29tcG9uZW50KHBrZy5uYW1lKX0vanNvbmAsIFsncmVsZWFzZXMnLCBwa2cudmVyc2lvbl0pO1xuICAgIGNvbnN0IHdoZWVsczogc3RyaW5nW10gPSBmaWxlcy5maWx0ZXIoKGY6IGFueSkgPT4gZi51cmwuZW5kc1dpdGgoJ3dobCcpKS5tYXAoKGY6IGFueSkgPT4gZi51cmwpO1xuXG4gICAgaWYgKHdoZWVscy5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgTm8gd2hlZWxzIGZvdW5kIGZvciBwYWNrYWdlICR7cGtnLm5hbWV9LSR7cGtnLnZlcnNpb259YCk7XG4gICAgfVxuXG4gICAgaWYgKHdoZWVscy5sZW5ndGggPiAxKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYE11bHRpcGxlIHdoZWVscyBmb3VuZCBmb3IgcGFja2FnZSAke3BrZy5uYW1lfS0ke3BrZy52ZXJzaW9ufTogJHt3aGVlbHMuam9pbignLCcpfWApO1xuICAgIH1cblxuICAgIGF3YWl0IGRvd25sb2FkKHdoZWVsc1swXSwgdGFyZ2V0KTtcbiAgfVxuXG4gIHB1YmxpYyBhc3luYyBleHRyYWN0KGFydGlmYWN0OiBzdHJpbmcsIHRhcmdldDogc3RyaW5nKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgY29uc3QgemlwID0gbmV3IEFkbVppcChhcnRpZmFjdCk7XG4gICAgcmV0dXJuIHppcC5leHRyYWN0QWxsVG8odGFyZ2V0KTtcbiAgfVxuXG4gIHByb3RlY3RlZCBwYXJzZUFydGlmYWN0TmFtZShhcnRpZmFjdE5hbWU6IHN0cmluZyk6IFB1Ymxpc2hlZFBhY2thZ2Uge1xuXG4gICAgLy8gY2RrOHMtMS4wLjBiNjMtcHkzLW5vbmUtYW55LndobFxuICAgIGNvbnN0IHJlZ2V4ID0gLyguKiktdj8oXFxkLiopLXB5Lioud2hsLztcblxuICAgIGNvbnN0IG1hdGNoID0gYXJ0aWZhY3ROYW1lLm1hdGNoKHJlZ2V4KTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYFVuYWJsZSB0byBwYXJzZSBhcnRpZmFjdDogJHthcnRpZmFjdE5hbWV9YCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIHsgbmFtZTogbWF0Y2hbMV0sIHZlcnNpb246IG1hdGNoWzJdIH07XG5cbiAgfVxuXG59XG5cbmV4cG9ydCBmdW5jdGlvbiBqc29uR2V0KHVybDogc3RyaW5nLCBqc29uUGF0aD86IHN0cmluZ1tdKTogUHJvbWlzZTxhbnk+IHtcbiAgcmV0dXJuIGdldCh1cmwsIChyZXMsIG9rLCBrbykgPT4ge1xuICAgIGNvbnN0IGpzb24gPSBqc3RyZWFtLnBhcnNlKGpzb25QYXRoKTtcbiAgICBqc29uLm9uY2UoJ2RhdGEnLCBvayk7XG4gICAganNvbi5vbmNlKCdlcnJvcicsIGtvKTtcblxuICAgIHJlcy5waXBlKGpzb24sIHsgZW5kOiB0cnVlIH0pO1xuICB9LCB7IGhlYWRlcnM6IHsgJ0FjY2VwdCc6ICdhcHBsaWNhdGlvbi9qc29uJywgJ0FjY2VwdC1FbmNvZGluZyc6ICdpZGVudGl0eScgfSB9KTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRvd25sb2FkKHVybDogc3RyaW5nLCB0YXJnZXRGaWxlOiBzdHJpbmcpOiBQcm9taXNlPGFueT4ge1xuICByZXR1cm4gZ2V0KHVybCwgKHJlcywgb2ssIGtvKSA9PiB7XG4gICAgY29uc3QgZmlsZSA9IGZzLmNyZWF0ZVdyaXRlU3RyZWFtKHRhcmdldEZpbGUpO1xuICAgIGZpbGUub24oJ2ZpbmlzaCcsIG9rKTtcbiAgICBmaWxlLm9uKCdlcnJvcicsIGtvKTtcbiAgICByZXMucGlwZShmaWxlLCB7IGVuZDogdHJ1ZSB9KTtcbiAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBnZXQoXG4gIHVybDogc3RyaW5nLFxuICBoYW5kbGVyOiAocmVzOiBJbmNvbWluZ01lc3NhZ2UsIG9rOiAodmFsdWU6IHVua25vd24pID0+IHZvaWQsIGtvOiAoZXJyOiBFcnJvcikgPT4gdm9pZCkgPT4gdm9pZCxcbiAgb3B0aW9uczogUmVxdWVzdE9wdGlvbnMgPSB7fSkge1xuXG4gIHJldHVybiBuZXcgUHJvbWlzZSgob2ssIGtvKSA9PiB7XG4gICAgY29uc3QgcmVxdWVzdCA9IGh0dHBzLmdldCh1cmwsIG9wdGlvbnMsIChyZXM6IEluY29taW5nTWVzc2FnZSkgPT4ge1xuICAgICAgaWYgKHJlcy5zdGF0dXNDb2RlICE9PSAyMDApIHtcbiAgICAgICAgY29uc3QgZXJyb3IgPSBuZXcgRXJyb3IoYEdFVCAke3VybH0gLSBIVFRQICR7cmVzLnN0YXR1c0NvZGV9ICgke3Jlcy5zdGF0dXNNZXNzYWdlfSlgKTtcbiAgICAgICAgRXJyb3IuY2FwdHVyZVN0YWNrVHJhY2UoZXJyb3IpO1xuICAgICAgICByZXR1cm4ga28oZXJyb3IpO1xuICAgICAgfVxuICAgICAgcmVzLm9uY2UoJ2Vycm9yJywga28pO1xuICAgICAgaGFuZGxlcihyZXMsIG9rLCBrbyk7XG4gICAgfSk7XG4gICAgcmVxdWVzdC5vbignZXJyb3InLCBrbyk7XG4gIH0pO1xuXG59XG4iXX0=

package/lib/package-integrity/handler/integrity.ts

@@ -0,0 +1,316 @@
+import { execSync } from 'child_process';
+import type { RequestOptions, IncomingMessage } from 'http';
+import * as https from 'https';
+import * as os from 'os';
+import * as path from 'path';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import AdmZip from 'adm-zip';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as fs from 'fs-extra';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as jstream from 'JSONStream';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as tar from 'tar';
+import { Repository } from './repository';
+
+
+/**
+ * Published package.
+ */
+export interface PublishedPackage {
+
+  /**
+   * Name of the package as stored in the package manager.
+   */
+  readonly name: string;
+
+  /**
+   * Version of the package as stored in the package manager.
+   */
+  readonly version: string;
+}
+
+/**
+ * Integrity class for validating a local artifact against its published counterpart.
+ *
+ * Implementations differ based on the package manager in question.
+ */
+export abstract class ArtifactIntegrity {
+
+  /**
+   * The file extenstion of artifacts produced for this check. (e.g 'whl')
+   */
+  protected abstract readonly ext: string;
+
+  /**
+   * Download a package to the target file.
+   *
+   * @param pkg The package to download.
+   * @param targetFile The file path to download the package to.
+   */
+  protected abstract download(pkg: PublishedPackage, targetFile: string): Promise<void>;
+
+  /**
+   * Extract the artifact into the target directory.
+   *
+   * @param artifact Path to an artifact file.
+   * @param targetDir The directory to extract to. It will exist by the time this method is invoked.
+   */
+  protected abstract extract(artifact: string, targetDir: string): Promise<void>;
+
+  /**
+   * Parse a local artifact file name into a structured package.
+   *
+   * @param artifactName Base name of the local artifact file.
+   * @returns The package this artifact correlates to.
+   */
+  protected abstract parseArtifactName(artifactName: string): PublishedPackage;
+
+  /**
+   * Validate a local artifact against its published counterpart.
+   *
+   * @param localArtifactDir The directory of the local artifact. Must contain exactly one file with the appropriate extenstion.
+   */
+  public async validate(localArtifactDir: string) {
+
+    const artifactPath = this.findOne(localArtifactDir);
+    const name = this.constructor.name;
+
+    this.log(`Validating ${artifactPath}`);
+    const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'integrity-check'));
+
+    try {
+      const downloaded = path.join(workdir, `${name}.downloaded`);
+      const remote = path.join(workdir, `${name}.remote`);
+      const local = path.join(workdir, `${name}.local`);
+
+      // parse the artifact name into a package.
+      const pkg = this.parseArtifactName(path.basename(artifactPath));
+
+      fs.mkdirSync(remote);
+      fs.mkdirSync(local);
+
+      // download the package
+      this.log(`Downloading ${pkg.name}@${pkg.version} to ${downloaded}`);
+      await this.download(pkg, downloaded);
+
+      // extract the downlaoded package
+      this.log(`Extracting remote artifact from ${downloaded} to ${remote}`);
+      await this.extract(downloaded, remote);
+
+      // extract the local artfiact
+      this.log(`Extracting local artifact from ${artifactPath} to ${local}`);
+      await this.extract(artifactPath, local);
+
+      this.log(`Comparing ${local} <> ${remote}`);
+      try {
+        execSync(`diff ${local} ${remote}`, { stdio: ['ignore', 'inherit', 'inherit'] });
+      } catch (error) {
+        throw new Error(`${name} validation failed`);
+      }
+      this.log('Success');
+
+    } finally {
+      fs.removeSync(workdir);
+    }
+
+  }
+
+  protected log(message: string) {
+    console.log(`${this.constructor.name} | ${message} `);
+  }
+
+  private findOne(dir: string): string {
+    const files = fs.readdirSync(dir).filter(f => f.endsWith(this.ext));
+    if (files.length === 0) {
+      throw new Error(`No files found in ${dir} with extension ${this.ext}`);
+    }
+    const [first, ...rest] = files;
+    if (rest.length > 0) {
+      throw new Error(`Multiple files found in ${dir} with extension ${this.ext}: ${first}, ${rest.join(', ')}`);
+    }
+    return path.join(dir, first);
+  }
+
+}
+
+/**
+ * Properties for `RepositoryIntegrity`.
+ */
+export interface RepositoryIntegrityProps {
+  /**
+   * Repository to validate.
+   */
+  readonly repository: Repository;
+
+  /**
+   * The command that produces the local artifacts.
+   *
+   * @default 'npx projen release'
+   */
+  readonly packCommand?: string;
+}
+
+/**
+ * Integrity class for validating the artifacts produced by this repository against their published counterparts.
+ */
+export class RepositoryIntegrity {
+
+  public constructor(private readonly props: RepositoryIntegrityProps) {}
+
+  /**
+   * Validate the artifacts of this repo against its published counterpart.
+   */
+  public async validate() {
+
+    // note that run 'release' by default to preserve the version number.
+    // this won't do a bump since the commit we are on is already tagged.
+    const artifacts = this.props.repository.pack(this.props.packCommand ?? 'npx projen release');
+
+    let integrity = undefined;
+    for (const artifact of artifacts) {
+      switch (artifact.lang) {
+        case 'js':
+          integrity = new NpmArtifactIntegrity();
+          break;
+        case 'python':
+          integrity = new PyPIArtifactIntegrity();
+          break;
+        case 'java':
+        case 'dotnet':
+        case 'go':
+          // we don't have integrity checks for these
+          // artifacts yet.
+          break;
+        default:
+          throw new Error(`Unsupported artifact language: ${artifact.lang}`);
+      }
+      if (integrity) {
+        await integrity.validate(artifact.directory);
+      }
+    }
+    console.log('Validation done');
+  }
+
+}
+
+/**
+ * NpmIntegiry is able to perform integiry checks against packages stored on npmjs.com
+ */
+export class NpmArtifactIntegrity extends ArtifactIntegrity {
+
+  protected readonly ext = 'tgz';
+
+  protected async download(pkg: PublishedPackage, target: string): Promise<void> {
+    const tarballUrl = await jsonGet(`https://registry.npmjs.org/${encodeURIComponent(pkg.name)}/${encodeURIComponent(pkg.version)}`, ['dist', 'tarball']);
+    await download(tarballUrl, target);
+  }
+
+  public async extract(file: string, targetDir: string): Promise<void> {
+    return tar.x({ cwd: targetDir, file: file, strip: 1 });
+  }
+
+  protected parseArtifactName(artifactName: string): PublishedPackage {
+
+    // cdk8s@1.0.0-beta.59.jsii.tgz
+    const jsiiArtifact = /(.*)@(.*)\.jsii./;
+
+    // npm artifact: cdk8s-cli-1.0.0-beta59.tgz
+    // yarn artifact: cdk8s-cli-v1.0.0-beta59.tgz (add a 'v' before the version)
+    const npmOrYarnArtifact = /(.*)-v?(\d.*).(tgz|tar.gz)/;
+
+    const regex = artifactName.includes('.jsii.') ? jsiiArtifact : npmOrYarnArtifact;
+
+    const match = artifactName.match(regex);
+    if (!match) {
+      throw new Error(`Unable to parse artifact: ${artifactName}`);
+    }
+
+    return { name: match[1], version: match[2] };
+
+  }
+
+}
+
+/**
+ * PyPIIntegiry is able to perform integiry checks against packages stored on pypi.org
+ */
+export class PyPIArtifactIntegrity extends ArtifactIntegrity {
+
+  protected readonly ext = 'whl';
+
+  protected async download(pkg: PublishedPackage, target: string): Promise<void> {
+
+    const files = await jsonGet(`https://pypi.org/pypi/${encodeURIComponent(pkg.name)}/json`, ['releases', pkg.version]);
+    const wheels: string[] = files.filter((f: any) => f.url.endsWith('whl')).map((f: any) => f.url);
+
+    if (wheels.length === 0) {
+      throw new Error(`No wheels found for package ${pkg.name}-${pkg.version}`);
+    }
+
+    if (wheels.length > 1) {
+      throw new Error(`Multiple wheels found for package ${pkg.name}-${pkg.version}: ${wheels.join(',')}`);
+    }
+
+    await download(wheels[0], target);
+  }
+
+  public async extract(artifact: string, target: string): Promise<void> {
+    const zip = new AdmZip(artifact);
+    return zip.extractAllTo(target);
+  }
+
+  protected parseArtifactName(artifactName: string): PublishedPackage {
+
+    // cdk8s-1.0.0b63-py3-none-any.whl
+    const regex = /(.*)-v?(\d.*)-py.*.whl/;
+
+    const match = artifactName.match(regex);
+    if (!match) {
+      throw new Error(`Unable to parse artifact: ${artifactName}`);
+    }
+
+    return { name: match[1], version: match[2] };
+
+  }
+
+}
+
+export function jsonGet(url: string, jsonPath?: string[]): Promise<any> {
+  return get(url, (res, ok, ko) => {
+    const json = jstream.parse(jsonPath);
+    json.once('data', ok);
+    json.once('error', ko);
+
+    res.pipe(json, { end: true });
+  }, { headers: { 'Accept': 'application/json', 'Accept-Encoding': 'identity' } });
+}
+
+export async function download(url: string, targetFile: string): Promise<any> {
+  return get(url, (res, ok, ko) => {
+    const file = fs.createWriteStream(targetFile);
+    file.on('finish', ok);
+    file.on('error', ko);
+    res.pipe(file, { end: true });
+  });
+}
+
+export async function get(
+  url: string,
+  handler: (res: IncomingMessage, ok: (value: unknown) => void, ko: (err: Error) => void) => void,
+  options: RequestOptions = {}) {
+
+  return new Promise((ok, ko) => {
+    const request = https.get(url, options, (res: IncomingMessage) => {
+      if (res.statusCode !== 200) {
+        const error = new Error(`GET ${url} - HTTP ${res.statusCode} (${res.statusMessage})`);
+        Error.captureStackTrace(error);
+        return ko(error);
+      }
+      res.once('error', ko);
+      handler(res, ok, ko);
+    });
+    request.on('error', ko);
+  });
+
+}

package/lib/package-integrity/handler/repository.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Properties for `Repository`.
+ */
+export interface RepositoryProps {
+    /**
+     * Local directory where the repository was cloned to.
+     */
+    readonly repoDir: string;
+}
+/**
+ * Artifact produced by this repository.
+ */
+export interface Artifact {
+    /**
+     * Language of the artifact.
+     */
+    readonly lang: string;
+    /**
+     * Directory containing the artifact.
+     */
+    readonly directory: string;
+}
+/**
+ * Options for `Repository.fromGitHub`
+ */
+export interface RepositoryFromGitHubOptions {
+    /**
+     * Repository slug (e.g cdk8s-team/cdk8s-core)
+     */
+    readonly slug: string;
+    /**
+     * Repository tag.
+     *
+     * @default - latest tag based on creation date.
+     */
+    readonly tag?: string;
+    /**
+      * Prefix for detecting the latest tag of the repo. Only applies if `tag` isn't specified.
+      * This is useful for repositories that produce multiple packages, and hence multiple tags
+      * for example: https://github.com/cdk8s-team/cdk8s-plus/tags.
+      */
+    readonly tagPrefix?: string;
+    /**
+     * ARN of an AWS secrets manager secret containing a GitHub token.
+     * Required for private repositories. Recommended for public ones, to avoid throtlling issues.
+     *
+     * @default - the repository is cloned without credentials.
+     */
+    readonly githubTokenSecretArn?: string;
+}
+/**
+ * Options for `Repository.fromDir`
+ */
+export interface RepositoryFromDirOptions {
+    /**
+     * The directory of the repo.
+     */
+    readonly repoDir: string;
+}
+/**
+ * Repository containing a node project.
+ */
+export declare class Repository {
+    readonly repoDir: string;
+    /**
+     * Create a repository from a local directory.
+     */
+    static fromDir(options: RepositoryFromDirOptions): Promise<Repository>;
+    /**
+     * Create a repository from a GitHub repository.
+     */
+    static fromGitHub(options: RepositoryFromGitHubOptions): Promise<Repository>;
+    private readonly isJsii;
+    private readonly manifest;
+    private constructor();
+    /**
+     * Pack the repository to produce the artifacts.
+     */
+    pack(command: string): Artifact[];
+    private _shell;
+}