cdk-preflight 0.0.0

package/lib/index.d.ts

@@ -0,0 +1,64 @@
+import { IConstruct } from 'constructs';
+/**
+ * Options for {@link Preflight.apply}.
+ */
+export interface PreflightOptions {
+    /**
+     * Rule ids to disable (see `Preflight.ruleIds()` or docs/rules.md).
+     *
+     * @default - all bundled rules are enabled
+     */
+    readonly exclude?: string[];
+    /**
+     * Fail synthesis (instead of reporting warnings) when a bundled rule is violated.
+     *
+     * In the default (warn) mode, findings are reported through the CDK built-in
+     * CloudFormation validator and surface as synth warnings with construct traces.
+     * With `enforce: true`, cdk-preflight evaluates its rules with its own
+     * validation plugin and a violation makes `cdk synth` fail.
+     *
+     * @default false
+     */
+    readonly enforce?: boolean;
+    /**
+     * In enforce mode, additionally fail synthesis on error-class findings
+     * (severity ERROR/FATAL) of the built-in validation engine itself, e.g.
+     * schema violations like `F3034`. This is the workaround for the CDK
+     * behavior where all built-in findings are downgraded to warnings.
+     *
+     * Only effective together with `enforce: true`.
+     *
+     * @default false
+     */
+    readonly strict?: boolean;
+    /**
+     * Include rules that are marked `pending-engine` (candidates that have been
+     * proposed to the upstream cloudformation-validate engine but are not merged
+     * yet). Disable this if you run a newer engine that already covers them.
+     *
+     * @default true
+     */
+    readonly includeUpstreamPending?: boolean;
+}
+/**
+ * cdk-preflight: catch deploy-time CloudFormation failures at synth time.
+ *
+ * Injects a curated Rego rule pack (constraints that resource provider schemas
+ * do not express: doc-only value limits, cross-property and cross-resource
+ * rules) into the AWS CDK built-in CloudFormation validator.
+ *
+ * @example
+ * declare const app: App;
+ * Preflight.apply(app);
+ */
+export declare class Preflight {
+    /**
+     * Register the cdk-preflight rules on an App or Stage.
+     */
+    static apply(scope: IConstruct, options?: PreflightOptions): void;
+    /**
+     * The ids of all bundled rules.
+     */
+    static ruleIds(): string[];
+    private constructor();
+}

package/lib/index.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Preflight = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const enforce_1 = require("./private/enforce");
+const rules_generated_1 = require("./rules.generated");
+/**
+ * cdk-preflight: catch deploy-time CloudFormation failures at synth time.
+ *
+ * Injects a curated Rego rule pack (constraints that resource provider schemas
+ * do not express: doc-only value limits, cross-property and cross-resource
+ * rules) into the AWS CDK built-in CloudFormation validator.
+ *
+ * @example
+ * declare const app: App;
+ * Preflight.apply(app);
+ */
+class Preflight {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.0" };
+    /**
+     * Register the cdk-preflight rules on an App or Stage.
+     */
+    static apply(scope, options = {}) {
+        if (!aws_cdk_lib_1.Stage.isStage(scope)) {
+            throw new Error('cdk-preflight: Preflight.apply() must be called on an App or a Stage');
+        }
+        const exclude = options.exclude ?? [];
+        const unknown = exclude.filter((id) => !rules_generated_1.BUNDLED_RULES.some((r) => r.id === id));
+        if (unknown.length > 0) {
+            throw new Error(`cdk-preflight: unknown rule id(s) in exclude: ${unknown.join(', ')}`);
+        }
+        const selected = rules_generated_1.BUNDLED_RULES
+            .filter((r) => (options.includeUpstreamPending ?? true) || r.upstream !== 'pending-engine')
+            .filter((r) => !exclude.includes(r.id));
+        if (options.enforce ?? false) {
+            aws_cdk_lib_1.Validations.of(scope).addPlugins(new enforce_1.PreflightEnforcePlugin(selected, options.strict ?? false));
+        }
+        else {
+            aws_cdk_lib_1.Validations.of(scope).addPlugins(new aws_cdk_lib_1.CloudFormationValidatePlugin({
+                regoRules: selected.map((r) => ({ name: r.id, content: r.rego })),
+            }));
+        }
+    }
+    /**
+     * The ids of all bundled rules.
+     */
+    static ruleIds() {
+        return rules_generated_1.BUNDLED_RULES.map((r) => r.id);
+    }
+    constructor() { }
+}
+exports.Preflight = Preflight;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUErRTtBQUUvRSwrQ0FBMkQ7QUFDM0QsdURBQWtEO0FBK0NsRDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUM3Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7YUFBTSxDQUFDO1lBQ04seUJBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksMENBQTRCLENBQUM7Z0JBQ2hFLFNBQVMsRUFBRSxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO2FBQ2xFLENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxPQUFPO1FBQ25CLE9BQU8sK0JBQWEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBRUQsZ0JBQXVCLENBQUM7O0FBakMxQiw4QkFrQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDbG91ZEZvcm1hdGlvblZhbGlkYXRlUGx1Z2luLCBTdGFnZSwgVmFsaWRhdGlvbnMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBJQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIH0gZnJvbSAnLi9wcml2YXRlL2VuZm9yY2UnO1xuaW1wb3J0IHsgQlVORExFRF9SVUxFUyB9IGZyb20gJy4vcnVsZXMuZ2VuZXJhdGVkJztcblxuLyoqXG4gKiBPcHRpb25zIGZvciB7QGxpbmsgUHJlZmxpZ2h0LmFwcGx5fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQcmVmbGlnaHRPcHRpb25zIHtcbiAgLyoqXG4gICAqIFJ1bGUgaWRzIHRvIGRpc2FibGUgKHNlZSBgUHJlZmxpZ2h0LnJ1bGVJZHMoKWAgb3IgZG9jcy9ydWxlcy5tZCkuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gYWxsIGJ1bmRsZWQgcnVsZXMgYXJlIGVuYWJsZWRcbiAgICovXG4gIHJlYWRvbmx5IGV4Y2x1ZGU/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogRmFpbCBzeW50aGVzaXMgKGluc3RlYWQgb2YgcmVwb3J0aW5nIHdhcm5pbmdzKSB3aGVuIGEgYnVuZGxlZCBydWxlIGlzIHZpb2xhdGVkLlxuICAgKlxuICAgKiBJbiB0aGUgZGVmYXVsdCAod2FybikgbW9kZSwgZmluZGluZ3MgYXJlIHJlcG9ydGVkIHRocm91Z2ggdGhlIENESyBidWlsdC1pblxuICAgKiBDbG91ZEZvcm1hdGlvbiB2YWxpZGF0b3IgYW5kIHN1cmZhY2UgYXMgc3ludGggd2FybmluZ3Mgd2l0aCBjb25zdHJ1Y3QgdHJhY2VzLlxuICAgKiBXaXRoIGBlbmZvcmNlOiB0cnVlYCwgY2RrLXByZWZsaWdodCBldmFsdWF0ZXMgaXRzIHJ1bGVzIHdpdGggaXRzIG93blxuICAgKiB2YWxpZGF0aW9uIHBsdWdpbiBhbmQgYSB2aW9sYXRpb24gbWFrZXMgYGNkayBzeW50aGAgZmFpbC5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIHJlYWRvbmx5IGVuZm9yY2U/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbiBlbmZvcmNlIG1vZGUsIGFkZGl0aW9uYWxseSBmYWlsIHN5bnRoZXNpcyBvbiBlcnJvci1jbGFzcyBmaW5kaW5nc1xuICAgKiAoc2V2ZXJpdHkgRVJST1IvRkFUQUwpIG9mIHRoZSBidWlsdC1pbiB2YWxpZGF0aW9uIGVuZ2luZSBpdHNlbGYsIGUuZy5cbiAgICogc2NoZW1hIHZpb2xhdGlvbnMgbGlrZSBgRjMwMzRgLiBUaGlzIGlzIHRoZSB3b3JrYXJvdW5kIGZvciB0aGUgQ0RLXG4gICAqIGJlaGF2aW9yIHdoZXJlIGFsbCBidWlsdC1pbiBmaW5kaW5ncyBhcmUgZG93bmdyYWRlZCB0byB3YXJuaW5ncy5cbiAgICpcbiAgICogT25seSBlZmZlY3RpdmUgdG9nZXRoZXIgd2l0aCBgZW5mb3JjZTogdHJ1ZWAuXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBzdHJpY3Q/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBJbmNsdWRlIHJ1bGVzIHRoYXQgYXJlIG1hcmtlZCBgcGVuZGluZy1lbmdpbmVgIChjYW5kaWRhdGVzIHRoYXQgaGF2ZSBiZWVuXG4gICAqIHByb3Bvc2VkIHRvIHRoZSB1cHN0cmVhbSBjbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSBlbmdpbmUgYnV0IGFyZSBub3QgbWVyZ2VkXG4gICAqIHlldCkuIERpc2FibGUgdGhpcyBpZiB5b3UgcnVuIGEgbmV3ZXIgZW5naW5lIHRoYXQgYWxyZWFkeSBjb3ZlcnMgdGhlbS5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgaW5jbHVkZVVwc3RyZWFtUGVuZGluZz86IGJvb2xlYW47XG59XG5cbi8qKlxuICogY2RrLXByZWZsaWdodDogY2F0Y2ggZGVwbG95LXRpbWUgQ2xvdWRGb3JtYXRpb24gZmFpbHVyZXMgYXQgc3ludGggdGltZS5cbiAqXG4gKiBJbmplY3RzIGEgY3VyYXRlZCBSZWdvIHJ1bGUgcGFjayAoY29uc3RyYWludHMgdGhhdCByZXNvdXJjZSBwcm92aWRlciBzY2hlbWFzXG4gKiBkbyBub3QgZXhwcmVzczogZG9jLW9ubHkgdmFsdWUgbGltaXRzLCBjcm9zcy1wcm9wZXJ0eSBhbmQgY3Jvc3MtcmVzb3VyY2VcbiAqIHJ1bGVzKSBpbnRvIHRoZSBBV1MgQ0RLIGJ1aWx0LWluIENsb3VkRm9ybWF0aW9uIHZhbGlkYXRvci5cbiAqXG4gKiBAZXhhbXBsZVxuICogZGVjbGFyZSBjb25zdCBhcHA6IEFwcDtcbiAqIFByZWZsaWdodC5hcHBseShhcHApO1xuICovXG5leHBvcnQgY2xhc3MgUHJlZmxpZ2h0IHtcbiAgLyoqXG4gICAqIFJlZ2lzdGVyIHRoZSBjZGstcHJlZmxpZ2h0IHJ1bGVzIG9uIGFuIEFwcCBvciBTdGFnZS5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgYXBwbHkoc2NvcGU6IElDb25zdHJ1Y3QsIG9wdGlvbnM6IFByZWZsaWdodE9wdGlvbnMgPSB7fSk6IHZvaWQge1xuICAgIGlmICghU3RhZ2UuaXNTdGFnZShzY29wZSkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignY2RrLXByZWZsaWdodDogUHJlZmxpZ2h0LmFwcGx5KCkgbXVzdCBiZSBjYWxsZWQgb24gYW4gQXBwIG9yIGEgU3RhZ2UnKTtcbiAgICB9XG4gICAgY29uc3QgZXhjbHVkZSA9IG9wdGlvbnMuZXhjbHVkZSA/PyBbXTtcbiAgICBjb25zdCB1bmtub3duID0gZXhjbHVkZS5maWx0ZXIoKGlkKSA9PiAhQlVORExFRF9SVUxFUy5zb21lKChyKSA9PiByLmlkID09PSBpZCkpO1xuICAgIGlmICh1bmtub3duLmxlbmd0aCA+IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgY2RrLXByZWZsaWdodDogdW5rbm93biBydWxlIGlkKHMpIGluIGV4Y2x1ZGU6ICR7dW5rbm93bi5qb2luKCcsICcpfWApO1xuICAgIH1cbiAgICBjb25zdCBzZWxlY3RlZCA9IEJVTkRMRURfUlVMRVNcbiAgICAgIC5maWx0ZXIoKHIpID0+IChvcHRpb25zLmluY2x1ZGVVcHN0cmVhbVBlbmRpbmcgPz8gdHJ1ZSkgfHwgci51cHN0cmVhbSAhPT0gJ3BlbmRpbmctZW5naW5lJylcbiAgICAgIC5maWx0ZXIoKHIpID0+ICFleGNsdWRlLmluY2x1ZGVzKHIuaWQpKTtcblxuICAgIGlmIChvcHRpb25zLmVuZm9yY2UgPz8gZmFsc2UpIHtcbiAgICAgIFZhbGlkYXRpb25zLm9mKHNjb3BlKS5hZGRQbHVnaW5zKG5ldyBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luKHNlbGVjdGVkLCBvcHRpb25zLnN0cmljdCA/PyBmYWxzZSkpO1xuICAgIH0gZWxzZSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhuZXcgQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbih7XG4gICAgICAgIHJlZ29SdWxlczogc2VsZWN0ZWQubWFwKChyKSA9PiAoeyBuYW1lOiByLmlkLCBjb250ZW50OiByLnJlZ28gfSkpLFxuICAgICAgfSkpO1xuICAgIH1cbiAgfVxuXG4gIC8qKlxuICAgKiBUaGUgaWRzIG9mIGFsbCBidW5kbGVkIHJ1bGVzLlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBydWxlSWRzKCk6IHN0cmluZ1tdIHtcbiAgICByZXR1cm4gQlVORExFRF9SVUxFUy5tYXAoKHIpID0+IHIuaWQpO1xuICB9XG5cbiAgcHJpdmF0ZSBjb25zdHJ1Y3RvcigpIHt9XG59XG4iXX0=

package/lib/private/enforce.d.ts

@@ -0,0 +1,23 @@
+import type { IPolicyValidationContext, IPolicyValidationPlugin, PolicyValidationPluginReport } from 'aws-cdk-lib';
+import type { BundledRuleData } from '../rules.generated';
+/**
+ * enforce モード用の内部プラグイン。
+ *
+ * CDK 組み込みの CloudFormationValidatePlugin は全 finding を warning に丸めるため
+ * （aws-cdk-lib 2.267.0 実測、昇格フラグも無効）、同じエンジンを直接呼び、
+ * cdk-preflight のルール違反（および strict 時はエンジンのエラークラス）を
+ * policy validation の失敗として報告して synth を止める。
+ */
+export declare class PreflightEnforcePlugin implements IPolicyValidationPlugin {
+    private readonly rules;
+    private readonly strict;
+    readonly name = "cdk-preflight";
+    constructor(rules: BundledRuleData[], strict: boolean);
+    validate(context: IPolicyValidationContext): PolicyValidationPluginReport;
+}
+/**
+ * @aws/cloudformation-validate を解決する。
+ * 通常は aws-cdk-lib が bundledDependencies として同梱しているコピーに乗る。
+ * （テストからも利用するため export している）
+ */
+export declare function loadEngine(): any | undefined;

package/lib/private/enforce.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreflightEnforcePlugin = void 0;
+exports.loadEngine = loadEngine;
+const path = __importStar(require("path"));
+/**
+ * enforce モード用の内部プラグイン。
+ *
+ * CDK 組み込みの CloudFormationValidatePlugin は全 finding を warning に丸めるため
+ * （aws-cdk-lib 2.267.0 実測、昇格フラグも無効）、同じエンジンを直接呼び、
+ * cdk-preflight のルール違反（および strict 時はエンジンのエラークラス）を
+ * policy validation の失敗として報告して synth を止める。
+ */
+class PreflightEnforcePlugin {
+    rules;
+    strict;
+    name = 'cdk-preflight';
+    constructor(rules, strict) {
+        this.rules = rules;
+        this.strict = strict;
+    }
+    validate(context) {
+        const engine = loadEngineCached();
+        if (!engine) {
+            // eslint-disable-next-line no-console
+            console.error('cdk-preflight: could not resolve @aws/cloudformation-validate; ' +
+                'enforce mode is unavailable and no preflight checks were run. ' +
+                'Install it as a devDependency or use the default (warn) mode.');
+            return { success: true, violations: [] };
+        }
+        const eng = regoEngineCached(engine, this.rules);
+        const ours = new Set(this.rules.map((r) => r.id));
+        const violations = [];
+        for (const st of context.stackTemplates) {
+            const report = eng.validateDetailed(new engine.TemplateFile(st.templatePath), {
+                pseudoParameterOverrides: {
+                    accountId: context.accountId,
+                    region: context.region,
+                },
+            });
+            for (const d of (report.diagnostics ?? [])) {
+                const isOurs = d.source === 'CUSTOM' && ours.has(d.ruleId);
+                const isStrictHit = this.strict
+                    && d.source !== 'CUSTOM'
+                    && (d.severity === 'ERROR' || d.severity === 'FATAL');
+                if (!isOurs && !isStrictHit)
+                    continue;
+                violations.push({
+                    ruleName: d.ruleId,
+                    description: d.message,
+                    severity: 'error',
+                    violatingResources: [{
+                            resourceLogicalId: d.entity?.logicalId ?? '(unknown)',
+                            templatePath: st.templatePath,
+                            locations: [d.propertyPath ?? '(template)'],
+                        }],
+                    ...(d.documentationUrl ? { ruleMetadata: { DocumentationUrl: d.documentationUrl } } : {}),
+                });
+            }
+        }
+        return { success: violations.length === 0, violations };
+    }
+}
+exports.PreflightEnforcePlugin = PreflightEnforcePlugin;
+// エンジン（WASM）の初期化は重いため、モジュールレベルでキャッシュする
+let cachedEngineModule;
+function loadEngineCached() {
+    if (cachedEngineModule === undefined) {
+        cachedEngineModule = loadEngine() ?? false;
+    }
+    return cachedEngineModule === false ? undefined : cachedEngineModule;
+}
+const regoEngineCache = new Map();
+function regoEngineCached(engineModule, rules) {
+    const key = rules.map((r) => r.id).join(',');
+    if (!regoEngineCache.has(key)) {
+        regoEngineCache.set(key, new engineModule.RegoEngine({
+            customRules: rules.map((r) => ({ name: r.id, content: r.rego })),
+        }));
+    }
+    return regoEngineCache.get(key);
+}
+/**
+ * @aws/cloudformation-validate を解決する。
+ * 通常は aws-cdk-lib が bundledDependencies として同梱しているコピーに乗る。
+ * （テストからも利用するため export している）
+ */
+function loadEngine() {
+    try {
+        return require('@aws/cloudformation-validate');
+    }
+    catch {
+        // fall through
+    }
+    try {
+        const libPkg = require.resolve('aws-cdk-lib/package.json');
+        const engPkg = require.resolve('@aws/cloudformation-validate/package.json', {
+            paths: [path.dirname(libPkg)],
+        });
+        return require(path.dirname(engPkg));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL2VuZm9yY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBNkdBLGdDQWVDO0FBNUhELDJDQUE2QjtBQXFCN0I7Ozs7Ozs7R0FPRztBQUNILE1BQWEsc0JBQXNCO0lBSWQ7SUFDQTtJQUpILElBQUksR0FBRyxlQUFlLENBQUM7SUFFdkMsWUFDbUIsS0FBd0IsRUFDeEIsTUFBZTtRQURmLFVBQUssR0FBTCxLQUFLLENBQW1CO1FBQ3hCLFdBQU0sR0FBTixNQUFNLENBQVM7SUFDL0IsQ0FBQztJQUVHLFFBQVEsQ0FBQyxPQUFpQztRQUMvQyxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLHNDQUFzQztZQUN0QyxPQUFPLENBQUMsS0FBSyxDQUNYLGlFQUFpRTtnQkFDakUsZ0VBQWdFO2dCQUNoRSwrREFBK0QsQ0FDaEUsQ0FBQztZQUNGLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQztRQUMzQyxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNqRCxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbEQsTUFBTSxVQUFVLEdBQXNCLEVBQUUsQ0FBQztRQUV6QyxLQUFLLE1BQU0sRUFBRSxJQUFJLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsRUFBRTtnQkFDNUUsd0JBQXdCLEVBQUU7b0JBQ3hCLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztvQkFDNUIsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO2lCQUN2QjthQUNGLENBQUMsQ0FBQztZQUNILEtBQUssTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxJQUFJLEVBQUUsQ0FBdUIsRUFBRSxDQUFDO2dCQUNqRSxNQUFNLE1BQU0sR0FBRyxDQUFDLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDM0QsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLE1BQU07dUJBQzFCLENBQUMsQ0FBQyxNQUFNLEtBQUssUUFBUTt1QkFDckIsQ0FBQyxDQUFDLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLE9BQU8sQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsV0FBVztvQkFBRSxTQUFTO2dCQUN0QyxVQUFVLENBQUMsSUFBSSxDQUFDO29CQUNkLFFBQVEsRUFBRSxDQUFDLENBQUMsTUFBTTtvQkFDbEIsV0FBVyxFQUFFLENBQUMsQ0FBQyxPQUFPO29CQUN0QixRQUFRLEVBQUUsT0FBTztvQkFDakIsa0JBQWtCLEVBQUUsQ0FBQzs0QkFDbkIsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxTQUFTLElBQUksV0FBVzs0QkFDckQsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZOzRCQUM3QixTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsWUFBWSxJQUFJLFlBQVksQ0FBQzt5QkFDNUMsQ0FBQztvQkFDRixHQUFHLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxFQUFFLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztpQkFDMUYsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQzFELENBQUM7Q0FDRjtBQXJERCx3REFxREM7QUFFRCx1Q0FBdUM7QUFDdkMsSUFBSSxrQkFBMkMsQ0FBQztBQUNoRCxTQUFTLGdCQUFnQjtJQUN2QixJQUFJLGtCQUFrQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3JDLGtCQUFrQixHQUFHLFVBQVUsRUFBRSxJQUFJLEtBQUssQ0FBQztJQUM3QyxDQUFDO0lBQ0QsT0FBTyxrQkFBa0IsS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUM7QUFDdkUsQ0FBQztBQUVELE1BQU0sZUFBZSxHQUFHLElBQUksR0FBRyxFQUFlLENBQUM7QUFDL0MsU0FBUyxnQkFBZ0IsQ0FBQyxZQUFpQixFQUFFLEtBQXdCO0lBQ25FLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDN0MsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QixlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxJQUFJLFlBQVksQ0FBQyxVQUFVLENBQUM7WUFDbkQsV0FBVyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7U0FDakUsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBZ0IsVUFBVTtJQUN4QixJQUFJLENBQUM7UUFDSCxPQUFPLE9BQU8sQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxlQUFlO0lBQ2pCLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDM0QsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQywyQ0FBMkMsRUFBRTtZQUMxRSxLQUFLLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1NBQzlCLENBQUMsQ0FBQztRQUNILE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHR5cGUge1xuICBJUG9saWN5VmFsaWRhdGlvbkNvbnRleHQsXG4gIElQb2xpY3lWYWxpZGF0aW9uUGx1Z2luLFxuICBQb2xpY3lWYWxpZGF0aW9uUGx1Z2luUmVwb3J0LFxuICBQb2xpY3lWaW9sYXRpb24sXG59IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB0eXBlIHsgQnVuZGxlZFJ1bGVEYXRhIH0gZnJvbSAnLi4vcnVsZXMuZ2VuZXJhdGVkJztcblxuLyogZXNsaW50LWRpc2FibGUgQHR5cGVzY3JpcHQtZXNsaW50L25vLXJlcXVpcmUtaW1wb3J0cyAqL1xuXG5pbnRlcmZhY2UgRW5naW5lRGlhZ25vc3RpYyB7XG4gIHJlYWRvbmx5IHJ1bGVJZDogc3RyaW5nO1xuICByZWFkb25seSBzZXZlcml0eTogc3RyaW5nO1xuICByZWFkb25seSBtZXNzYWdlOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHNvdXJjZT86IHN0cmluZztcbiAgcmVhZG9ubHkgZW50aXR5PzogeyByZWFkb25seSBsb2dpY2FsSWQ/OiBzdHJpbmcgfTtcbiAgcmVhZG9ubHkgcHJvcGVydHlQYXRoPzogc3RyaW5nO1xuICByZWFkb25seSBkb2N1bWVudGF0aW9uVXJsPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIGVuZm9yY2Ug44Oi44O844OJ55So44Gu5YaF6YOo44OX44Op44Kw44Kk44Oz44CCXG4gKlxuICogQ0RLIOe1hOOBv+i+vOOBv+OBriBDbG91ZEZvcm1hdGlvblZhbGlkYXRlUGx1Z2luIOOBr+WFqCBmaW5kaW5nIOOCkiB3YXJuaW5nIOOBq+S4uOOCgeOCi+OBn+OCgVxuICog77yIYXdzLWNkay1saWIgMi4yNjcuMCDlrp/muKzjgIHmmIfmoLzjg5Xjg6njgrDjgoLnhKHlirnvvInjgIHlkIzjgZjjgqjjg7Pjgrjjg7PjgpLnm7TmjqXlkbzjgbPjgIFcbiAqIGNkay1wcmVmbGlnaHQg44Gu44Or44O844Or6YGV5Y+N77yI44GK44KI44GzIHN0cmljdCDmmYLjga/jgqjjg7Pjgrjjg7Pjga7jgqjjg6njg7zjgq/jg6njgrnvvInjgpJcbiAqIHBvbGljeSB2YWxpZGF0aW9uIOOBruWkseaVl+OBqOOBl+OBpuWgseWRiuOBl+OBpiBzeW50aCDjgpLmraLjgoHjgovjgIJcbiAqL1xuZXhwb3J0IGNsYXNzIFByZWZsaWdodEVuZm9yY2VQbHVnaW4gaW1wbGVtZW50cyBJUG9saWN5VmFsaWRhdGlvblBsdWdpbiB7XG4gIHB1YmxpYyByZWFkb25seSBuYW1lID0gJ2Nkay1wcmVmbGlnaHQnO1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgc3RyaWN0OiBib29sZWFuLFxuICApIHt9XG5cbiAgcHVibGljIHZhbGlkYXRlKGNvbnRleHQ6IElQb2xpY3lWYWxpZGF0aW9uQ29udGV4dCk6IFBvbGljeVZhbGlkYXRpb25QbHVnaW5SZXBvcnQge1xuICAgIGNvbnN0IGVuZ2luZSA9IGxvYWRFbmdpbmVDYWNoZWQoKTtcbiAgICBpZiAoIWVuZ2luZSkge1xuICAgICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIG5vLWNvbnNvbGVcbiAgICAgIGNvbnNvbGUuZXJyb3IoXG4gICAgICAgICdjZGstcHJlZmxpZ2h0OiBjb3VsZCBub3QgcmVzb2x2ZSBAYXdzL2Nsb3VkZm9ybWF0aW9uLXZhbGlkYXRlOyAnICtcbiAgICAgICAgJ2VuZm9yY2UgbW9kZSBpcyB1bmF2YWlsYWJsZSBhbmQgbm8gcHJlZmxpZ2h0IGNoZWNrcyB3ZXJlIHJ1bi4gJyArXG4gICAgICAgICdJbnN0YWxsIGl0IGFzIGEgZGV2RGVwZW5kZW5jeSBvciB1c2UgdGhlIGRlZmF1bHQgKHdhcm4pIG1vZGUuJyxcbiAgICAgICk7XG4gICAgICByZXR1cm4geyBzdWNjZXNzOiB0cnVlLCB2aW9sYXRpb25zOiBbXSB9O1xuICAgIH1cblxuICAgIGNvbnN0IGVuZyA9IHJlZ29FbmdpbmVDYWNoZWQoZW5naW5lLCB0aGlzLnJ1bGVzKTtcbiAgICBjb25zdCBvdXJzID0gbmV3IFNldCh0aGlzLnJ1bGVzLm1hcCgocikgPT4gci5pZCkpO1xuICAgIGNvbnN0IHZpb2xhdGlvbnM6IFBvbGljeVZpb2xhdGlvbltdID0gW107XG5cbiAgICBmb3IgKGNvbnN0IHN0IG9mIGNvbnRleHQuc3RhY2tUZW1wbGF0ZXMpIHtcbiAgICAgIGNvbnN0IHJlcG9ydCA9IGVuZy52YWxpZGF0ZURldGFpbGVkKG5ldyBlbmdpbmUuVGVtcGxhdGVGaWxlKHN0LnRlbXBsYXRlUGF0aCksIHtcbiAgICAgICAgcHNldWRvUGFyYW1ldGVyT3ZlcnJpZGVzOiB7XG4gICAgICAgICAgYWNjb3VudElkOiBjb250ZXh0LmFjY291bnRJZCxcbiAgICAgICAgICByZWdpb246IGNvbnRleHQucmVnaW9uLFxuICAgICAgICB9LFxuICAgICAgfSk7XG4gICAgICBmb3IgKGNvbnN0IGQgb2YgKHJlcG9ydC5kaWFnbm9zdGljcyA/PyBbXSkgYXMgRW5naW5lRGlhZ25vc3RpY1tdKSB7XG4gICAgICAgIGNvbnN0IGlzT3VycyA9IGQuc291cmNlID09PSAnQ1VTVE9NJyAmJiBvdXJzLmhhcyhkLnJ1bGVJZCk7XG4gICAgICAgIGNvbnN0IGlzU3RyaWN0SGl0ID0gdGhpcy5zdHJpY3RcbiAgICAgICAgICAmJiBkLnNvdXJjZSAhPT0gJ0NVU1RPTSdcbiAgICAgICAgICAmJiAoZC5zZXZlcml0eSA9PT0gJ0VSUk9SJyB8fCBkLnNldmVyaXR5ID09PSAnRkFUQUwnKTtcbiAgICAgICAgaWYgKCFpc091cnMgJiYgIWlzU3RyaWN0SGl0KSBjb250aW51ZTtcbiAgICAgICAgdmlvbGF0aW9ucy5wdXNoKHtcbiAgICAgICAgICBydWxlTmFtZTogZC5ydWxlSWQsXG4gICAgICAgICAgZGVzY3JpcHRpb246IGQubWVzc2FnZSxcbiAgICAgICAgICBzZXZlcml0eTogJ2Vycm9yJyxcbiAgICAgICAgICB2aW9sYXRpbmdSZXNvdXJjZXM6IFt7XG4gICAgICAgICAgICByZXNvdXJjZUxvZ2ljYWxJZDogZC5lbnRpdHk/LmxvZ2ljYWxJZCA/PyAnKHVua25vd24pJyxcbiAgICAgICAgICAgIHRlbXBsYXRlUGF0aDogc3QudGVtcGxhdGVQYXRoLFxuICAgICAgICAgICAgbG9jYXRpb25zOiBbZC5wcm9wZXJ0eVBhdGggPz8gJyh0ZW1wbGF0ZSknXSxcbiAgICAgICAgICB9XSxcbiAgICAgICAgICAuLi4oZC5kb2N1bWVudGF0aW9uVXJsID8geyBydWxlTWV0YWRhdGE6IHsgRG9jdW1lbnRhdGlvblVybDogZC5kb2N1bWVudGF0aW9uVXJsIH0gfSA6IHt9KSxcbiAgICAgICAgfSk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgcmV0dXJuIHsgc3VjY2VzczogdmlvbGF0aW9ucy5sZW5ndGggPT09IDAsIHZpb2xhdGlvbnMgfTtcbiAgfVxufVxuXG4vLyDjgqjjg7Pjgrjjg7PvvIhXQVNN77yJ44Gu5Yid5pyf5YyW44Gv6YeN44GE44Gf44KB44CB44Oi44K444Ol44O844Or44Os44OZ44Or44Gn44Kt44Oj44OD44K344Ol44GZ44KLXG5sZXQgY2FjaGVkRW5naW5lTW9kdWxlOiBhbnkgfCBmYWxzZSB8IHVuZGVmaW5lZDtcbmZ1bmN0aW9uIGxvYWRFbmdpbmVDYWNoZWQoKTogYW55IHwgdW5kZWZpbmVkIHtcbiAgaWYgKGNhY2hlZEVuZ2luZU1vZHVsZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgY2FjaGVkRW5naW5lTW9kdWxlID0gbG9hZEVuZ2luZSgpID8/IGZhbHNlO1xuICB9XG4gIHJldHVybiBjYWNoZWRFbmdpbmVNb2R1bGUgPT09IGZhbHNlID8gdW5kZWZpbmVkIDogY2FjaGVkRW5naW5lTW9kdWxlO1xufVxuXG5jb25zdCByZWdvRW5naW5lQ2FjaGUgPSBuZXcgTWFwPHN0cmluZywgYW55PigpO1xuZnVuY3Rpb24gcmVnb0VuZ2luZUNhY2hlZChlbmdpbmVNb2R1bGU6IGFueSwgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdKTogYW55IHtcbiAgY29uc3Qga2V5ID0gcnVsZXMubWFwKChyKSA9PiByLmlkKS5qb2luKCcsJyk7XG4gIGlmICghcmVnb0VuZ2luZUNhY2hlLmhhcyhrZXkpKSB7XG4gICAgcmVnb0VuZ2luZUNhY2hlLnNldChrZXksIG5ldyBlbmdpbmVNb2R1bGUuUmVnb0VuZ2luZSh7XG4gICAgICBjdXN0b21SdWxlczogcnVsZXMubWFwKChyKSA9PiAoeyBuYW1lOiByLmlkLCBjb250ZW50OiByLnJlZ28gfSkpLFxuICAgIH0pKTtcbiAgfVxuICByZXR1cm4gcmVnb0VuZ2luZUNhY2hlLmdldChrZXkpO1xufVxuXG4vKipcbiAqIEBhd3MvY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUg44KS6Kej5rG644GZ44KL44CCXG4gKiDpgJrluLjjga8gYXdzLWNkay1saWIg44GMIGJ1bmRsZWREZXBlbmRlbmNpZXMg44Go44GX44Gm5ZCM5qKx44GX44Gm44GE44KL44Kz44OU44O844Gr5LmX44KL44CCXG4gKiDvvIjjg4bjgrnjg4jjgYvjgonjgoLliKnnlKjjgZnjgovjgZ/jgoEgZXhwb3J0IOOBl+OBpuOBhOOCi++8iVxuICovXG5leHBvcnQgZnVuY3Rpb24gbG9hZEVuZ2luZSgpOiBhbnkgfCB1bmRlZmluZWQge1xuICB0cnkge1xuICAgIHJldHVybiByZXF1aXJlKCdAYXdzL2Nsb3VkZm9ybWF0aW9uLXZhbGlkYXRlJyk7XG4gIH0gY2F0Y2gge1xuICAgIC8vIGZhbGwgdGhyb3VnaFxuICB9XG4gIHRyeSB7XG4gICAgY29uc3QgbGliUGtnID0gcmVxdWlyZS5yZXNvbHZlKCdhd3MtY2RrLWxpYi9wYWNrYWdlLmpzb24nKTtcbiAgICBjb25zdCBlbmdQa2cgPSByZXF1aXJlLnJlc29sdmUoJ0Bhd3MvY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUvcGFja2FnZS5qc29uJywge1xuICAgICAgcGF0aHM6IFtwYXRoLmRpcm5hbWUobGliUGtnKV0sXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlcXVpcmUocGF0aC5kaXJuYW1lKGVuZ1BrZykpO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gdW5kZWZpbmVkO1xuICB9XG59XG4iXX0=

package/lib/rules.generated.d.ts

@@ -0,0 +1,10 @@
+export interface BundledRuleData {
+    readonly id: string;
+    readonly service: string;
+    readonly severity: string;
+    readonly title: string;
+    readonly upstream: string;
+    readonly resourceTypes: string[];
+    readonly rego: string;
+}
+export declare const BUNDLED_RULES: BundledRuleData[];

package/lib/rules.generated.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUNDLED_RULES = void 0;
+exports.BUNDLED_RULES = [
+    {
+        "id": "pf-cloudfront-acm-cert-region",
+        "service": "cloudfront",
+        "severity": "ERROR",
+        "title": "CloudFront viewer certificates must live in us-east-1",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::CloudFront::Distribution"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\nviolation contains make_diag_full(\"pf-cloudfront-acm-cert-region\", \"ERROR\", name,\n\t\"Properties.DistributionConfig.ViewerCertificate.AcmCertificateArn\",\n\tsprintf(\"CloudFront requires the ACM certificate to be in us-east-1, but the certificate is in %s\", [region]),\n\t\"Issue or import the certificate in us-east-1 (e.g. a dedicated us-east-1 stack) and reference that ARN\",\n\t\"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html#https-requirements-certificate-issuer\") if {\n\tsome name in resources_of_type(\"AWS::CloudFront::Distribution\")\n\tarn := resolve(name, \"Properties.DistributionConfig.ViewerCertificate.AcmCertificateArn\")\n\tis_string(arn)\n\tstartswith(arn, \"arn:\")\n\tparts := split(arn, \":\")\n\tcount(parts) >= 6\n\tparts[2] == \"acm\"\n\tregion := parts[3]\n\tregion != \"\"\n\tregion != \"us-east-1\"\n}\n"
+    },
+    {
+        "id": "pf-cloudfront-ttl-order",
+        "service": "cloudfront",
+        "severity": "ERROR",
+        "title": "Cache behavior TTLs must satisfy MinTTL <= DefaultTTL <= MaxTTL",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::CloudFront::Distribution"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_cf_ttl_fix := \"Order the TTLs as MinTTL <= DefaultTTL <= MaxTTL\"\n\n_pf_cf_ttl_url := \"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html\"\n\n_pf_cf_behaviors(name) := array.concat(\n\t[{\"path\": \"Properties.DistributionConfig.DefaultCacheBehavior\", \"value\": it.value} |\n\t\tsome it in flatten_list(name, \"Properties.DistributionConfig.DefaultCacheBehavior\")],\n\t[{\"path\": sprintf(\"Properties.DistributionConfig.CacheBehaviors.%d\", [it.index]), \"value\": it.value} |\n\t\tsome it in flatten_list(name, \"Properties.DistributionConfig.CacheBehaviors\")],\n)\n\nviolation contains make_diag_full(\"pf-cloudfront-ttl-order\", \"ERROR\", name, b.path,\n\tsprintf(\"MinTTL (%v) must be less than or equal to MaxTTL (%v)\", [mn, mx]),\n\t_pf_cf_ttl_fix, _pf_cf_ttl_url) if {\n\tsome name in resources_of_type(\"AWS::CloudFront::Distribution\")\n\tsome b in _pf_cf_behaviors(name)\n\tis_object(b.value)\n\tmn := to_number(object.get(b.value, \"MinTTL\", null))\n\tmx := to_number(object.get(b.value, \"MaxTTL\", null))\n\tmn > mx\n}\n\nviolation contains make_diag_full(\"pf-cloudfront-ttl-order\", \"ERROR\", name, b.path,\n\tsprintf(\"MinTTL (%v) must be less than or equal to DefaultTTL (%v)\", [mn, df]),\n\t_pf_cf_ttl_fix, _pf_cf_ttl_url) if {\n\tsome name in resources_of_type(\"AWS::CloudFront::Distribution\")\n\tsome b in _pf_cf_behaviors(name)\n\tis_object(b.value)\n\tmn := to_number(object.get(b.value, \"MinTTL\", null))\n\tdf := to_number(object.get(b.value, \"DefaultTTL\", null))\n\tmn > df\n}\n\nviolation contains make_diag_full(\"pf-cloudfront-ttl-order\", \"ERROR\", name, b.path,\n\tsprintf(\"DefaultTTL (%v) must be less than or equal to MaxTTL (%v)\", [df, mx]),\n\t_pf_cf_ttl_fix, _pf_cf_ttl_url) if {\n\tsome name in resources_of_type(\"AWS::CloudFront::Distribution\")\n\tsome b in _pf_cf_behaviors(name)\n\tis_object(b.value)\n\tdf := to_number(object.get(b.value, \"DefaultTTL\", null))\n\tmx := to_number(object.get(b.value, \"MaxTTL\", null))\n\tdf > mx\n}\n"
+    },
+    {
+        "id": "pf-ec2-sg-port-range",
+        "service": "ec2",
+        "severity": "ERROR",
+        "title": "Security group TCP/UDP ports must be within 0-65535 and FromPort <= ToPort",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::EC2::SecurityGroup",
+            "AWS::EC2::SecurityGroupIngress",
+            "AWS::EC2::SecurityGroupEgress"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_sg_fix := \"Use a port between 0 and 65535 with FromPort <= ToPort\"\n\n_pf_sg_url := \"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html\"\n\n_pf_port_out(n) if n < 0\n\n_pf_port_out(n) if n > 65535\n\n_pf_tcp_udp(p) if p in {\"tcp\", \"udp\", \"6\", \"17\", 6, 17}\n\nviolation contains make_diag_full(\"pf-ec2-sg-port-range\", \"ERROR\", name,\n\tsprintf(\"Properties.%s.%d.%s\", [dir, item.index, pname]),\n\tsprintf(\"%s %v is outside the valid TCP/UDP port range 0-65535\", [pname, n]),\n\t_pf_sg_fix, _pf_sg_url) if {\n\tsome name in resources_of_type(\"AWS::EC2::SecurityGroup\")\n\tsome dir in {\"SecurityGroupIngress\", \"SecurityGroupEgress\"}\n\tsome item in flatten_list(name, sprintf(\"Properties.%s\", [dir]))\n\tentry := item.value\n\tis_object(entry)\n\t_pf_tcp_udp(object.get(entry, \"IpProtocol\", null))\n\tsome pname in {\"FromPort\", \"ToPort\"}\n\tn := to_number(object.get(entry, pname, null))\n\t_pf_port_out(n)\n}\n\nviolation contains make_diag_full(\"pf-ec2-sg-port-range\", \"ERROR\", name,\n\tsprintf(\"Properties.%s.%d.FromPort\", [dir, item.index]),\n\tsprintf(\"FromPort (%v) must be less than or equal to ToPort (%v)\", [f, t]),\n\t_pf_sg_fix, _pf_sg_url) if {\n\tsome name in resources_of_type(\"AWS::EC2::SecurityGroup\")\n\tsome dir in {\"SecurityGroupIngress\", \"SecurityGroupEgress\"}\n\tsome item in flatten_list(name, sprintf(\"Properties.%s\", [dir]))\n\tentry := item.value\n\tis_object(entry)\n\t_pf_tcp_udp(object.get(entry, \"IpProtocol\", null))\n\tf := to_number(object.get(entry, \"FromPort\", null))\n\tt := to_number(object.get(entry, \"ToPort\", null))\n\tf >= 0\n\tt <= 65535\n\tf > t\n}\n\nviolation contains make_diag_full(\"pf-ec2-sg-port-range\", \"ERROR\", name,\n\tsprintf(\"Properties.%s\", [pname]),\n\tsprintf(\"%s %v is outside the valid TCP/UDP port range 0-65535\", [pname, n]),\n\t_pf_sg_fix, _pf_sg_url) if {\n\tsome rtype in {\"AWS::EC2::SecurityGroupIngress\", \"AWS::EC2::SecurityGroupEgress\"}\n\tsome name in resources_of_type(rtype)\n\t_pf_tcp_udp(resolve(name, \"Properties.IpProtocol\"))\n\tsome pname in {\"FromPort\", \"ToPort\"}\n\tn := to_number(resolve(name, sprintf(\"Properties.%s\", [pname])))\n\t_pf_port_out(n)\n}\n\nviolation contains make_diag_full(\"pf-ec2-sg-port-range\", \"ERROR\", name,\n\t\"Properties.FromPort\",\n\tsprintf(\"FromPort (%v) must be less than or equal to ToPort (%v)\", [f, t]),\n\t_pf_sg_fix, _pf_sg_url) if {\n\tsome rtype in {\"AWS::EC2::SecurityGroupIngress\", \"AWS::EC2::SecurityGroupEgress\"}\n\tsome name in resources_of_type(rtype)\n\t_pf_tcp_udp(resolve(name, \"Properties.IpProtocol\"))\n\tf := to_number(resolve(name, \"Properties.FromPort\"))\n\tt := to_number(resolve(name, \"Properties.ToPort\"))\n\tf >= 0\n\tt <= 65535\n\tf > t\n}\n"
+    },
+    {
+        "id": "pf-elbv2-lb-idle-timeout-range",
+        "service": "elbv2",
+        "severity": "ERROR",
+        "title": "ALB idle_timeout.timeout_seconds must be between 1 and 4000",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::ElasticLoadBalancingV2::LoadBalancer"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_idle_timeout_out(n) if n < 1\n\n_pf_idle_timeout_out(n) if n > 4000\n\n_pf_non_alb(name) if {\n\tt := resolve(name, \"Properties.Type\")\n\tt != \"application\"\n}\n\nviolation contains make_diag_full(\"pf-elbv2-lb-idle-timeout-range\", \"ERROR\", name,\n\tsprintf(\"Properties.LoadBalancerAttributes.%d.Value\", [item.index]),\n\tsprintf(\"idle_timeout.timeout_seconds is %v but must be between 1 and 4000 seconds\", [num]),\n\t\"Set idle_timeout.timeout_seconds to a value between 1 and 4000\",\n\t\"https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#connection-idle-timeout\") if {\n\tsome name in resources_of_type(\"AWS::ElasticLoadBalancingV2::LoadBalancer\")\n\tnot _pf_non_alb(name)\n\tsome item in flatten_list(name, \"Properties.LoadBalancerAttributes\")\n\tattr := item.value\n\tis_object(attr)\n\tobject.get(attr, \"Key\", \"\") == \"idle_timeout.timeout_seconds\"\n\tnum := to_number(object.get(attr, \"Value\", null))\n\t_pf_idle_timeout_out(num)\n}\n"
+    },
+    {
+        "id": "pf-elbv2-tg-deregistration-delay-range",
+        "service": "elbv2",
+        "severity": "ERROR",
+        "title": "Target group deregistration_delay.timeout_seconds must be between 0 and 3600",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::ElasticLoadBalancingV2::TargetGroup"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_dereg_delay_out(n) if n < 0\n\n_pf_dereg_delay_out(n) if n > 3600\n\nviolation contains make_diag_full(\"pf-elbv2-tg-deregistration-delay-range\", \"ERROR\", name,\n\tsprintf(\"Properties.TargetGroupAttributes.%d.Value\", [item.index]),\n\tsprintf(\"deregistration_delay.timeout_seconds is %v but must be between 0 and 3600 seconds\", [num]),\n\t\"Set deregistration_delay.timeout_seconds to a value between 0 and 3600\",\n\t\"https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#deregistration-delay\") if {\n\tsome name in resources_of_type(\"AWS::ElasticLoadBalancingV2::TargetGroup\")\n\tsome item in flatten_list(name, \"Properties.TargetGroupAttributes\")\n\tattr := item.value\n\tis_object(attr)\n\tobject.get(attr, \"Key\", \"\") == \"deregistration_delay.timeout_seconds\"\n\tnum := to_number(object.get(attr, \"Value\", null))\n\t_pf_dereg_delay_out(num)\n}\n"
+    },
+    {
+        "id": "pf-elbv2-tg-slow-start-range",
+        "service": "elbv2",
+        "severity": "ERROR",
+        "title": "Target group slow_start.duration_seconds must be 0 or between 30 and 900",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::ElasticLoadBalancingV2::TargetGroup"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_slow_start_out(n) if n < 0\n\n_pf_slow_start_out(n) if {\n\tn > 0\n\tn < 30\n}\n\n_pf_slow_start_out(n) if n > 900\n\nviolation contains make_diag_full(\"pf-elbv2-tg-slow-start-range\", \"ERROR\", name,\n\tsprintf(\"Properties.TargetGroupAttributes.%d.Value\", [item.index]),\n\tsprintf(\"slow_start.duration_seconds is %v but must be 0 (disabled) or between 30 and 900 seconds\", [num]),\n\t\"Set slow_start.duration_seconds to 0 or a value between 30 and 900\",\n\t\"https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#slow-start-mode\") if {\n\tsome name in resources_of_type(\"AWS::ElasticLoadBalancingV2::TargetGroup\")\n\tsome item in flatten_list(name, \"Properties.TargetGroupAttributes\")\n\tattr := item.value\n\tis_object(attr)\n\tobject.get(attr, \"Key\", \"\") == \"slow_start.duration_seconds\"\n\tnum := to_number(object.get(attr, \"Value\", null))\n\t_pf_slow_start_out(num)\n}\n"
+    },
+    {
+        "id": "pf-iam-inline-policy-size",
+        "service": "iam",
+        "severity": "ERROR",
+        "title": "Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters)",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::IAM::Policy",
+            "AWS::IAM::RolePolicy",
+            "AWS::IAM::UserPolicy",
+            "AWS::IAM::GroupPolicy"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_inline_policy_limits := {\n\t\"AWS::IAM::Policy\": 10240,\n\t\"AWS::IAM::RolePolicy\": 10240,\n\t\"AWS::IAM::UserPolicy\": 2048,\n\t\"AWS::IAM::GroupPolicy\": 5120,\n}\n\nviolation contains make_diag_full(\"pf-iam-inline-policy-size\", \"ERROR\", name,\n\t\"Properties.PolicyDocument\",\n\tsprintf(\"PolicyDocument is %d characters (JSON without whitespace) but the inline policy limit for %s is %d (role: 10240, group: 5120, user: 2048)\", [size, rtype, limit]),\n\t\"Move statements into managed policies or shorten the document\",\n\t\"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html\") if {\n\tsome rtype, limit in _pf_inline_policy_limits\n\tsome name in resources_of_type(rtype)\n\tdoc := resolve(name, \"Properties.PolicyDocument\")\n\tis_object(doc)\n\tsize := count(json.marshal(doc))\n\tsize > limit\n}\n"
+    },
+    {
+        "id": "pf-iam-managed-policy-size",
+        "service": "iam",
+        "severity": "ERROR",
+        "title": "Managed policy documents are limited to 6144 characters (whitespace excluded)",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::IAM::ManagedPolicy"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\nviolation contains make_diag_full(\"pf-iam-managed-policy-size\", \"ERROR\", name,\n\t\"Properties.PolicyDocument\",\n\tsprintf(\"PolicyDocument is %d characters (JSON without whitespace) but the managed policy limit is 6144\", [size]),\n\t\"Split the document into multiple managed policies or shorten it\",\n\t\"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html\") if {\n\tsome name in resources_of_type(\"AWS::IAM::ManagedPolicy\")\n\tdoc := resolve(name, \"Properties.PolicyDocument\")\n\tis_object(doc)\n\tsize := count(json.marshal(doc))\n\tsize > 6144\n}\n"
+    },
+    {
+        "id": "pf-sfn-asl-missing-state",
+        "service": "stepfunctions",
+        "severity": "ERROR",
+        "title": "ASL StartAt/Next/Default/Choices must reference a defined state (top-level states)",
+        "upstream": "none",
+        "resourceTypes": [
+            "AWS::StepFunctions::StateMachine"
+        ],
+        "rego": "package cdk_preflight\n\nimport rego.v1\n\n_pf_sfn_fix := \"Point StartAt/Next/Default at an existing state name\"\n\n_pf_sfn_url := \"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-states.html\"\n\n_pf_sfn_asl(name) := asl if {\n\tdef := resolve(name, \"Properties.DefinitionString\")\n\tis_string(def)\n\tasl := json.unmarshal(def)\n\tis_object(asl)\n}\n\n_pf_sfn_defined(asl) := {sn | some sn, _ in object.get(asl, \"States\", {})}\n\nviolation contains make_diag_full(\"pf-sfn-asl-missing-state\", \"ERROR\", name,\n\t\"Properties.DefinitionString\",\n\tsprintf(\"state machine definition references state '%s' via StartAt, but no state with that name is defined\", [target]),\n\t_pf_sfn_fix, _pf_sfn_url) if {\n\tsome name in resources_of_type(\"AWS::StepFunctions::StateMachine\")\n\tasl := _pf_sfn_asl(name)\n\ttarget := object.get(asl, \"StartAt\", null)\n\tis_string(target)\n\tnot target in _pf_sfn_defined(asl)\n}\n\nviolation contains make_diag_full(\"pf-sfn-asl-missing-state\", \"ERROR\", name,\n\t\"Properties.DefinitionString\",\n\tsprintf(\"state '%s' references state '%s' via %s, but no state with that name is defined\", [sname, target, key]),\n\t_pf_sfn_fix, _pf_sfn_url) if {\n\tsome name in resources_of_type(\"AWS::StepFunctions::StateMachine\")\n\tasl := _pf_sfn_asl(name)\n\tsome sname, st in object.get(asl, \"States\", {})\n\tis_object(st)\n\tsome key in {\"Next\", \"Default\"}\n\ttarget := object.get(st, key, null)\n\tis_string(target)\n\tnot target in _pf_sfn_defined(asl)\n}\n\nviolation contains make_diag_full(\"pf-sfn-asl-missing-state\", \"ERROR\", name,\n\t\"Properties.DefinitionString\",\n\tsprintf(\"state '%s' has a Choice rule referencing state '%s', but no state with that name is defined\", [sname, target]),\n\t_pf_sfn_fix, _pf_sfn_url) if {\n\tsome name in resources_of_type(\"AWS::StepFunctions::StateMachine\")\n\tasl := _pf_sfn_asl(name)\n\tsome sname, st in object.get(asl, \"States\", {})\n\tis_object(st)\n\tchoices := object.get(st, \"Choices\", [])\n\tis_array(choices)\n\tsome c in choices\n\tis_object(c)\n\ttarget := object.get(c, \"Next\", null)\n\tis_string(target)\n\tnot target in _pf_sfn_defined(asl)\n}\n"
+    }
+];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVsZXMuZ2VuZXJhdGVkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3J1bGVzLmdlbmVyYXRlZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFhYSxRQUFBLGFBQWEsR0FBc0I7SUFDOUM7UUFDRSxJQUFJLEVBQUUsK0JBQStCO1FBQ3JDLFNBQVMsRUFBRSxZQUFZO1FBQ3ZCLFVBQVUsRUFBRSxPQUFPO1FBQ25CLE9BQU8sRUFBRSx1REFBdUQ7UUFDaEUsVUFBVSxFQUFFLE1BQU07UUFDbEIsZUFBZSxFQUFFO1lBQ2YsK0JBQStCO1NBQ2hDO1FBQ0QsTUFBTSxFQUFFLDY2QkFBNjZCO0tBQ3Q3QjtJQUNEO1FBQ0UsSUFBSSxFQUFFLHlCQUF5QjtRQUMvQixTQUFTLEVBQUUsWUFBWTtRQUN2QixVQUFVLEVBQUUsT0FBTztRQUNuQixPQUFPLEVBQUUsaUVBQWlFO1FBQzFFLFVBQVUsRUFBRSxNQUFNO1FBQ2xCLGVBQWUsRUFBRTtZQUNmLCtCQUErQjtTQUNoQztRQUNELE1BQU0sRUFBRSxnaUVBQWdpRTtLQUN6aUU7SUFDRDtRQUNFLElBQUksRUFBRSxzQkFBc0I7UUFDNUIsU0FBUyxFQUFFLEtBQUs7UUFDaEIsVUFBVSxFQUFFLE9BQU87UUFDbkIsT0FBTyxFQUFFLDRFQUE0RTtRQUNyRixVQUFVLEVBQUUsTUFBTTtRQUNsQixlQUFlLEVBQUU7WUFDZix5QkFBeUI7WUFDekIsZ0NBQWdDO1lBQ2hDLCtCQUErQjtTQUNoQztRQUNELE1BQU0sRUFBRSxveUZBQW95RjtLQUM3eUY7SUFDRDtRQUNFLElBQUksRUFBRSxnQ0FBZ0M7UUFDdEMsU0FBUyxFQUFFLE9BQU87UUFDbEIsVUFBVSxFQUFFLE9BQU87UUFDbkIsT0FBTyxFQUFFLDZEQUE2RDtRQUN0RSxVQUFVLEVBQUUsTUFBTTtRQUNsQixlQUFlLEVBQUU7WUFDZiwyQ0FBMkM7U0FDNUM7UUFDRCxNQUFNLEVBQUUsdWlDQUF1aUM7S0FDaGpDO0lBQ0Q7UUFDRSxJQUFJLEVBQUUsd0NBQXdDO1FBQzlDLFNBQVMsRUFBRSxPQUFPO1FBQ2xCLFVBQVUsRUFBRSxPQUFPO1FBQ25CLE9BQU8sRUFBRSw4RUFBOEU7UUFDdkYsVUFBVSxFQUFFLE1BQU07UUFDbEIsZUFBZSxFQUFFO1lBQ2YsMENBQTBDO1NBQzNDO1FBQ0QsTUFBTSxFQUFFLHU4QkFBdThCO0tBQ2g5QjtJQUNEO1FBQ0UsSUFBSSxFQUFFLDhCQUE4QjtRQUNwQyxTQUFTLEVBQUUsT0FBTztRQUNsQixVQUFVLEVBQUUsT0FBTztRQUNuQixPQUFPLEVBQUUsMEVBQTBFO1FBQ25GLFVBQVUsRUFBRSxNQUFNO1FBQ2xCLGVBQWUsRUFBRTtZQUNmLDBDQUEwQztTQUMzQztRQUNELE1BQU0sRUFBRSxrK0JBQWsrQjtLQUMzK0I7SUFDRDtRQUNFLElBQUksRUFBRSwyQkFBMkI7UUFDakMsU0FBUyxFQUFFLEtBQUs7UUFDaEIsVUFBVSxFQUFFLE9BQU87UUFDbkIsT0FBTyxFQUFFLG1HQUFtRztRQUM1RyxVQUFVLEVBQUUsTUFBTTtRQUNsQixlQUFlLEVBQUU7WUFDZixrQkFBa0I7WUFDbEIsc0JBQXNCO1lBQ3RCLHNCQUFzQjtZQUN0Qix1QkFBdUI7U0FDeEI7UUFDRCxNQUFNLEVBQUUsMDNCQUEwM0I7S0FDbjRCO0lBQ0Q7UUFDRSxJQUFJLEVBQUUsNEJBQTRCO1FBQ2xDLFNBQVMsRUFBRSxLQUFLO1FBQ2hCLFVBQVUsRUFBRSxPQUFPO1FBQ25CLE9BQU8sRUFBRSwrRUFBK0U7UUFDeEYsVUFBVSxFQUFFLE1BQU07UUFDbEIsZUFBZSxFQUFFO1lBQ2YseUJBQXlCO1NBQzFCO1FBQ0QsTUFBTSxFQUFFLHluQkFBeW5CO0tBQ2xvQjtJQUNEO1FBQ0UsSUFBSSxFQUFFLDBCQUEwQjtRQUNoQyxTQUFTLEVBQUUsZUFBZTtRQUMxQixVQUFVLEVBQUUsT0FBTztRQUNuQixPQUFPLEVBQUUsb0ZBQW9GO1FBQzdGLFVBQVUsRUFBRSxNQUFNO1FBQ2xCLGVBQWUsRUFBRTtZQUNmLGtDQUFrQztTQUNuQztRQUNELE1BQU0sRUFBRSx1cEVBQXVwRTtLQUNocUU7Q0FDRixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gfn4gR2VuZXJhdGVkIGJ5IHNjcmlwdHMvYnVuZGxlLXJ1bGVzLnRzIGZyb20gcnVsZXMvKiouIERvIG5vdCBlZGl0IGJ5IGhhbmQuXG4vLyB+fiBSZWdlbmVyYXRlIHdpdGg6IG5weCBwcm9qZW4gYnVuZGxlLXJ1bGVzXG4vKiBlc2xpbnQtZGlzYWJsZSAqL1xuZXhwb3J0IGludGVyZmFjZSBCdW5kbGVkUnVsZURhdGEge1xuICByZWFkb25seSBpZDogc3RyaW5nO1xuICByZWFkb25seSBzZXJ2aWNlOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHNldmVyaXR5OiBzdHJpbmc7XG4gIHJlYWRvbmx5IHRpdGxlOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHVwc3RyZWFtOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHJlc291cmNlVHlwZXM6IHN0cmluZ1tdO1xuICByZWFkb25seSByZWdvOiBzdHJpbmc7XG59XG5cbmV4cG9ydCBjb25zdCBCVU5ETEVEX1JVTEVTOiBCdW5kbGVkUnVsZURhdGFbXSA9IFtcbiAge1xuICAgIFwiaWRcIjogXCJwZi1jbG91ZGZyb250LWFjbS1jZXJ0LXJlZ2lvblwiLFxuICAgIFwic2VydmljZVwiOiBcImNsb3VkZnJvbnRcIixcbiAgICBcInNldmVyaXR5XCI6IFwiRVJST1JcIixcbiAgICBcInRpdGxlXCI6IFwiQ2xvdWRGcm9udCB2aWV3ZXIgY2VydGlmaWNhdGVzIG11c3QgbGl2ZSBpbiB1cy1lYXN0LTFcIixcbiAgICBcInVwc3RyZWFtXCI6IFwibm9uZVwiLFxuICAgIFwicmVzb3VyY2VUeXBlc1wiOiBbXG4gICAgICBcIkFXUzo6Q2xvdWRGcm9udDo6RGlzdHJpYnV0aW9uXCJcbiAgICBdLFxuICAgIFwicmVnb1wiOiBcInBhY2thZ2UgY2RrX3ByZWZsaWdodFxcblxcbmltcG9ydCByZWdvLnYxXFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1jbG91ZGZyb250LWFjbS1jZXJ0LXJlZ2lvblxcXCIsIFxcXCJFUlJPUlxcXCIsIG5hbWUsXFxuXFx0XFxcIlByb3BlcnRpZXMuRGlzdHJpYnV0aW9uQ29uZmlnLlZpZXdlckNlcnRpZmljYXRlLkFjbUNlcnRpZmljYXRlQXJuXFxcIixcXG5cXHRzcHJpbnRmKFxcXCJDbG91ZEZyb250IHJlcXVpcmVzIHRoZSBBQ00gY2VydGlmaWNhdGUgdG8gYmUgaW4gdXMtZWFzdC0xLCBidXQgdGhlIGNlcnRpZmljYXRlIGlzIGluICVzXFxcIiwgW3JlZ2lvbl0pLFxcblxcdFxcXCJJc3N1ZSBvciBpbXBvcnQgdGhlIGNlcnRpZmljYXRlIGluIHVzLWVhc3QtMSAoZS5nLiBhIGRlZGljYXRlZCB1cy1lYXN0LTEgc3RhY2spIGFuZCByZWZlcmVuY2UgdGhhdCBBUk5cXFwiLFxcblxcdFxcXCJodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQW1hem9uQ2xvdWRGcm9udC9sYXRlc3QvRGV2ZWxvcGVyR3VpZGUvY25hbWVzLWFuZC1odHRwcy1yZXF1aXJlbWVudHMuaHRtbCNodHRwcy1yZXF1aXJlbWVudHMtY2VydGlmaWNhdGUtaXNzdWVyXFxcIikgaWYge1xcblxcdHNvbWUgbmFtZSBpbiByZXNvdXJjZXNfb2ZfdHlwZShcXFwiQVdTOjpDbG91ZEZyb250OjpEaXN0cmlidXRpb25cXFwiKVxcblxcdGFybiA6PSByZXNvbHZlKG5hbWUsIFxcXCJQcm9wZXJ0aWVzLkRpc3RyaWJ1dGlvbkNvbmZpZy5WaWV3ZXJDZXJ0aWZpY2F0ZS5BY21DZXJ0aWZpY2F0ZUFyblxcXCIpXFxuXFx0aXNfc3RyaW5nKGFybilcXG5cXHRzdGFydHN3aXRoKGFybiwgXFxcImFybjpcXFwiKVxcblxcdHBhcnRzIDo9IHNwbGl0KGFybiwgXFxcIjpcXFwiKVxcblxcdGNvdW50KHBhcnRzKSA+PSA2XFxuXFx0cGFydHNbMl0gPT0gXFxcImFjbVxcXCJcXG5cXHRyZWdpb24gOj0gcGFydHNbM11cXG5cXHRyZWdpb24gIT0gXFxcIlxcXCJcXG5cXHRyZWdpb24gIT0gXFxcInVzLWVhc3QtMVxcXCJcXG59XFxuXCJcbiAgfSxcbiAge1xuICAgIFwiaWRcIjogXCJwZi1jbG91ZGZyb250LXR0bC1vcmRlclwiLFxuICAgIFwic2VydmljZVwiOiBcImNsb3VkZnJvbnRcIixcbiAgICBcInNldmVyaXR5XCI6IFwiRVJST1JcIixcbiAgICBcInRpdGxlXCI6IFwiQ2FjaGUgYmVoYXZpb3IgVFRMcyBtdXN0IHNhdGlzZnkgTWluVFRMIDw9IERlZmF1bHRUVEwgPD0gTWF4VFRMXCIsXG4gICAgXCJ1cHN0cmVhbVwiOiBcIm5vbmVcIixcbiAgICBcInJlc291cmNlVHlwZXNcIjogW1xuICAgICAgXCJBV1M6OkNsb3VkRnJvbnQ6OkRpc3RyaWJ1dGlvblwiXG4gICAgXSxcbiAgICBcInJlZ29cIjogXCJwYWNrYWdlIGNka19wcmVmbGlnaHRcXG5cXG5pbXBvcnQgcmVnby52MVxcblxcbl9wZl9jZl90dGxfZml4IDo9IFxcXCJPcmRlciB0aGUgVFRMcyBhcyBNaW5UVEwgPD0gRGVmYXVsdFRUTCA8PSBNYXhUVExcXFwiXFxuXFxuX3BmX2NmX3R0bF91cmwgOj0gXFxcImh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9BbWF6b25DbG91ZEZyb250L2xhdGVzdC9EZXZlbG9wZXJHdWlkZS9FeHBpcmF0aW9uLmh0bWxcXFwiXFxuXFxuX3BmX2NmX2JlaGF2aW9ycyhuYW1lKSA6PSBhcnJheS5jb25jYXQoXFxuXFx0W3tcXFwicGF0aFxcXCI6IFxcXCJQcm9wZXJ0aWVzLkRpc3RyaWJ1dGlvbkNvbmZpZy5EZWZhdWx0Q2FjaGVCZWhhdmlvclxcXCIsIFxcXCJ2YWx1ZVxcXCI6IGl0LnZhbHVlfSB8XFxuXFx0XFx0c29tZSBpdCBpbiBmbGF0dGVuX2xpc3QobmFtZSwgXFxcIlByb3BlcnRpZXMuRGlzdHJpYnV0aW9uQ29uZmlnLkRlZmF1bHRDYWNoZUJlaGF2aW9yXFxcIildLFxcblxcdFt7XFxcInBhdGhcXFwiOiBzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLkRpc3RyaWJ1dGlvbkNvbmZpZy5DYWNoZUJlaGF2aW9ycy4lZFxcXCIsIFtpdC5pbmRleF0pLCBcXFwidmFsdWVcXFwiOiBpdC52YWx1ZX0gfFxcblxcdFxcdHNvbWUgaXQgaW4gZmxhdHRlbl9saXN0KG5hbWUsIFxcXCJQcm9wZXJ0aWVzLkRpc3RyaWJ1dGlvbkNvbmZpZy5DYWNoZUJlaGF2aW9yc1xcXCIpXSxcXG4pXFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1jbG91ZGZyb250LXR0bC1vcmRlclxcXCIsIFxcXCJFUlJPUlxcXCIsIG5hbWUsIGIucGF0aCxcXG5cXHRzcHJpbnRmKFxcXCJNaW5UVEwgKCV2KSBtdXN0IGJlIGxlc3MgdGhhbiBvciBlcXVhbCB0byBNYXhUVEwgKCV2KVxcXCIsIFttbiwgbXhdKSxcXG5cXHRfcGZfY2ZfdHRsX2ZpeCwgX3BmX2NmX3R0bF91cmwpIGlmIHtcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUoXFxcIkFXUzo6Q2xvdWRGcm9udDo6RGlzdHJpYnV0aW9uXFxcIilcXG5cXHRzb21lIGIgaW4gX3BmX2NmX2JlaGF2aW9ycyhuYW1lKVxcblxcdGlzX29iamVjdChiLnZhbHVlKVxcblxcdG1uIDo9IHRvX251bWJlcihvYmplY3QuZ2V0KGIudmFsdWUsIFxcXCJNaW5UVExcXFwiLCBudWxsKSlcXG5cXHRteCA6PSB0b19udW1iZXIob2JqZWN0LmdldChiLnZhbHVlLCBcXFwiTWF4VFRMXFxcIiwgbnVsbCkpXFxuXFx0bW4gPiBteFxcbn1cXG5cXG52aW9sYXRpb24gY29udGFpbnMgbWFrZV9kaWFnX2Z1bGwoXFxcInBmLWNsb3VkZnJvbnQtdHRsLW9yZGVyXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSwgYi5wYXRoLFxcblxcdHNwcmludGYoXFxcIk1pblRUTCAoJXYpIG11c3QgYmUgbGVzcyB0aGFuIG9yIGVxdWFsIHRvIERlZmF1bHRUVEwgKCV2KVxcXCIsIFttbiwgZGZdKSxcXG5cXHRfcGZfY2ZfdHRsX2ZpeCwgX3BmX2NmX3R0bF91cmwpIGlmIHtcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUoXFxcIkFXUzo6Q2xvdWRGcm9udDo6RGlzdHJpYnV0aW9uXFxcIilcXG5cXHRzb21lIGIgaW4gX3BmX2NmX2JlaGF2aW9ycyhuYW1lKVxcblxcdGlzX29iamVjdChiLnZhbHVlKVxcblxcdG1uIDo9IHRvX251bWJlcihvYmplY3QuZ2V0KGIudmFsdWUsIFxcXCJNaW5UVExcXFwiLCBudWxsKSlcXG5cXHRkZiA6PSB0b19udW1iZXIob2JqZWN0LmdldChiLnZhbHVlLCBcXFwiRGVmYXVsdFRUTFxcXCIsIG51bGwpKVxcblxcdG1uID4gZGZcXG59XFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1jbG91ZGZyb250LXR0bC1vcmRlclxcXCIsIFxcXCJFUlJPUlxcXCIsIG5hbWUsIGIucGF0aCxcXG5cXHRzcHJpbnRmKFxcXCJEZWZhdWx0VFRMICgldikgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gTWF4VFRMICgldilcXFwiLCBbZGYsIG14XSksXFxuXFx0X3BmX2NmX3R0bF9maXgsIF9wZl9jZl90dGxfdXJsKSBpZiB7XFxuXFx0c29tZSBuYW1lIGluIHJlc291cmNlc19vZl90eXBlKFxcXCJBV1M6OkNsb3VkRnJvbnQ6OkRpc3RyaWJ1dGlvblxcXCIpXFxuXFx0c29tZSBiIGluIF9wZl9jZl9iZWhhdmlvcnMobmFtZSlcXG5cXHRpc19vYmplY3QoYi52YWx1ZSlcXG5cXHRkZiA6PSB0b19udW1iZXIob2JqZWN0LmdldChiLnZhbHVlLCBcXFwiRGVmYXVsdFRUTFxcXCIsIG51bGwpKVxcblxcdG14IDo9IHRvX251bWJlcihvYmplY3QuZ2V0KGIudmFsdWUsIFxcXCJNYXhUVExcXFwiLCBudWxsKSlcXG5cXHRkZiA+IG14XFxufVxcblwiXG4gIH0sXG4gIHtcbiAgICBcImlkXCI6IFwicGYtZWMyLXNnLXBvcnQtcmFuZ2VcIixcbiAgICBcInNlcnZpY2VcIjogXCJlYzJcIixcbiAgICBcInNldmVyaXR5XCI6IFwiRVJST1JcIixcbiAgICBcInRpdGxlXCI6IFwiU2VjdXJpdHkgZ3JvdXAgVENQL1VEUCBwb3J0cyBtdXN0IGJlIHdpdGhpbiAwLTY1NTM1IGFuZCBGcm9tUG9ydCA8PSBUb1BvcnRcIixcbiAgICBcInVwc3RyZWFtXCI6IFwibm9uZVwiLFxuICAgIFwicmVzb3VyY2VUeXBlc1wiOiBbXG4gICAgICBcIkFXUzo6RUMyOjpTZWN1cml0eUdyb3VwXCIsXG4gICAgICBcIkFXUzo6RUMyOjpTZWN1cml0eUdyb3VwSW5ncmVzc1wiLFxuICAgICAgXCJBV1M6OkVDMjo6U2VjdXJpdHlHcm91cEVncmVzc1wiXG4gICAgXSxcbiAgICBcInJlZ29cIjogXCJwYWNrYWdlIGNka19wcmVmbGlnaHRcXG5cXG5pbXBvcnQgcmVnby52MVxcblxcbl9wZl9zZ19maXggOj0gXFxcIlVzZSBhIHBvcnQgYmV0d2VlbiAwIGFuZCA2NTUzNSB3aXRoIEZyb21Qb3J0IDw9IFRvUG9ydFxcXCJcXG5cXG5fcGZfc2dfdXJsIDo9IFxcXCJodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQVdTRUMyL2xhdGVzdC9BUElSZWZlcmVuY2UvQVBJX0F1dGhvcml6ZVNlY3VyaXR5R3JvdXBJbmdyZXNzLmh0bWxcXFwiXFxuXFxuX3BmX3BvcnRfb3V0KG4pIGlmIG4gPCAwXFxuXFxuX3BmX3BvcnRfb3V0KG4pIGlmIG4gPiA2NTUzNVxcblxcbl9wZl90Y3BfdWRwKHApIGlmIHAgaW4ge1xcXCJ0Y3BcXFwiLCBcXFwidWRwXFxcIiwgXFxcIjZcXFwiLCBcXFwiMTdcXFwiLCA2LCAxN31cXG5cXG52aW9sYXRpb24gY29udGFpbnMgbWFrZV9kaWFnX2Z1bGwoXFxcInBmLWVjMi1zZy1wb3J0LXJhbmdlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLiVzLiVkLiVzXFxcIiwgW2RpciwgaXRlbS5pbmRleCwgcG5hbWVdKSxcXG5cXHRzcHJpbnRmKFxcXCIlcyAldiBpcyBvdXRzaWRlIHRoZSB2YWxpZCBUQ1AvVURQIHBvcnQgcmFuZ2UgMC02NTUzNVxcXCIsIFtwbmFtZSwgbl0pLFxcblxcdF9wZl9zZ19maXgsIF9wZl9zZ191cmwpIGlmIHtcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUoXFxcIkFXUzo6RUMyOjpTZWN1cml0eUdyb3VwXFxcIilcXG5cXHRzb21lIGRpciBpbiB7XFxcIlNlY3VyaXR5R3JvdXBJbmdyZXNzXFxcIiwgXFxcIlNlY3VyaXR5R3JvdXBFZ3Jlc3NcXFwifVxcblxcdHNvbWUgaXRlbSBpbiBmbGF0dGVuX2xpc3QobmFtZSwgc3ByaW50ZihcXFwiUHJvcGVydGllcy4lc1xcXCIsIFtkaXJdKSlcXG5cXHRlbnRyeSA6PSBpdGVtLnZhbHVlXFxuXFx0aXNfb2JqZWN0KGVudHJ5KVxcblxcdF9wZl90Y3BfdWRwKG9iamVjdC5nZXQoZW50cnksIFxcXCJJcFByb3RvY29sXFxcIiwgbnVsbCkpXFxuXFx0c29tZSBwbmFtZSBpbiB7XFxcIkZyb21Qb3J0XFxcIiwgXFxcIlRvUG9ydFxcXCJ9XFxuXFx0biA6PSB0b19udW1iZXIob2JqZWN0LmdldChlbnRyeSwgcG5hbWUsIG51bGwpKVxcblxcdF9wZl9wb3J0X291dChuKVxcbn1cXG5cXG52aW9sYXRpb24gY29udGFpbnMgbWFrZV9kaWFnX2Z1bGwoXFxcInBmLWVjMi1zZy1wb3J0LXJhbmdlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLiVzLiVkLkZyb21Qb3J0XFxcIiwgW2RpciwgaXRlbS5pbmRleF0pLFxcblxcdHNwcmludGYoXFxcIkZyb21Qb3J0ICgldikgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gVG9Qb3J0ICgldilcXFwiLCBbZiwgdF0pLFxcblxcdF9wZl9zZ19maXgsIF9wZl9zZ191cmwpIGlmIHtcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUoXFxcIkFXUzo6RUMyOjpTZWN1cml0eUdyb3VwXFxcIilcXG5cXHRzb21lIGRpciBpbiB7XFxcIlNlY3VyaXR5R3JvdXBJbmdyZXNzXFxcIiwgXFxcIlNlY3VyaXR5R3JvdXBFZ3Jlc3NcXFwifVxcblxcdHNvbWUgaXRlbSBpbiBmbGF0dGVuX2xpc3QobmFtZSwgc3ByaW50ZihcXFwiUHJvcGVydGllcy4lc1xcXCIsIFtkaXJdKSlcXG5cXHRlbnRyeSA6PSBpdGVtLnZhbHVlXFxuXFx0aXNfb2JqZWN0KGVudHJ5KVxcblxcdF9wZl90Y3BfdWRwKG9iamVjdC5nZXQoZW50cnksIFxcXCJJcFByb3RvY29sXFxcIiwgbnVsbCkpXFxuXFx0ZiA6PSB0b19udW1iZXIob2JqZWN0LmdldChlbnRyeSwgXFxcIkZyb21Qb3J0XFxcIiwgbnVsbCkpXFxuXFx0dCA6PSB0b19udW1iZXIob2JqZWN0LmdldChlbnRyeSwgXFxcIlRvUG9ydFxcXCIsIG51bGwpKVxcblxcdGYgPj0gMFxcblxcdHQgPD0gNjU1MzVcXG5cXHRmID4gdFxcbn1cXG5cXG52aW9sYXRpb24gY29udGFpbnMgbWFrZV9kaWFnX2Z1bGwoXFxcInBmLWVjMi1zZy1wb3J0LXJhbmdlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLiVzXFxcIiwgW3BuYW1lXSksXFxuXFx0c3ByaW50ZihcXFwiJXMgJXYgaXMgb3V0c2lkZSB0aGUgdmFsaWQgVENQL1VEUCBwb3J0IHJhbmdlIDAtNjU1MzVcXFwiLCBbcG5hbWUsIG5dKSxcXG5cXHRfcGZfc2dfZml4LCBfcGZfc2dfdXJsKSBpZiB7XFxuXFx0c29tZSBydHlwZSBpbiB7XFxcIkFXUzo6RUMyOjpTZWN1cml0eUdyb3VwSW5ncmVzc1xcXCIsIFxcXCJBV1M6OkVDMjo6U2VjdXJpdHlHcm91cEVncmVzc1xcXCJ9XFxuXFx0c29tZSBuYW1lIGluIHJlc291cmNlc19vZl90eXBlKHJ0eXBlKVxcblxcdF9wZl90Y3BfdWRwKHJlc29sdmUobmFtZSwgXFxcIlByb3BlcnRpZXMuSXBQcm90b2NvbFxcXCIpKVxcblxcdHNvbWUgcG5hbWUgaW4ge1xcXCJGcm9tUG9ydFxcXCIsIFxcXCJUb1BvcnRcXFwifVxcblxcdG4gOj0gdG9fbnVtYmVyKHJlc29sdmUobmFtZSwgc3ByaW50ZihcXFwiUHJvcGVydGllcy4lc1xcXCIsIFtwbmFtZV0pKSlcXG5cXHRfcGZfcG9ydF9vdXQobilcXG59XFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1lYzItc2ctcG9ydC1yYW5nZVxcXCIsIFxcXCJFUlJPUlxcXCIsIG5hbWUsXFxuXFx0XFxcIlByb3BlcnRpZXMuRnJvbVBvcnRcXFwiLFxcblxcdHNwcmludGYoXFxcIkZyb21Qb3J0ICgldikgbXVzdCBiZSBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gVG9Qb3J0ICgldilcXFwiLCBbZiwgdF0pLFxcblxcdF9wZl9zZ19maXgsIF9wZl9zZ191cmwpIGlmIHtcXG5cXHRzb21lIHJ0eXBlIGluIHtcXFwiQVdTOjpFQzI6OlNlY3VyaXR5R3JvdXBJbmdyZXNzXFxcIiwgXFxcIkFXUzo6RUMyOjpTZWN1cml0eUdyb3VwRWdyZXNzXFxcIn1cXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUocnR5cGUpXFxuXFx0X3BmX3RjcF91ZHAocmVzb2x2ZShuYW1lLCBcXFwiUHJvcGVydGllcy5JcFByb3RvY29sXFxcIikpXFxuXFx0ZiA6PSB0b19udW1iZXIocmVzb2x2ZShuYW1lLCBcXFwiUHJvcGVydGllcy5Gcm9tUG9ydFxcXCIpKVxcblxcdHQgOj0gdG9fbnVtYmVyKHJlc29sdmUobmFtZSwgXFxcIlByb3BlcnRpZXMuVG9Qb3J0XFxcIikpXFxuXFx0ZiA+PSAwXFxuXFx0dCA8PSA2NTUzNVxcblxcdGYgPiB0XFxufVxcblwiXG4gIH0sXG4gIHtcbiAgICBcImlkXCI6IFwicGYtZWxidjItbGItaWRsZS10aW1lb3V0LXJhbmdlXCIsXG4gICAgXCJzZXJ2aWNlXCI6IFwiZWxidjJcIixcbiAgICBcInNldmVyaXR5XCI6IFwiRVJST1JcIixcbiAgICBcInRpdGxlXCI6IFwiQUxCIGlkbGVfdGltZW91dC50aW1lb3V0X3NlY29uZHMgbXVzdCBiZSBiZXR3ZWVuIDEgYW5kIDQwMDBcIixcbiAgICBcInVwc3RyZWFtXCI6IFwibm9uZVwiLFxuICAgIFwicmVzb3VyY2VUeXBlc1wiOiBbXG4gICAgICBcIkFXUzo6RWxhc3RpY0xvYWRCYWxhbmNpbmdWMjo6TG9hZEJhbGFuY2VyXCJcbiAgICBdLFxuICAgIFwicmVnb1wiOiBcInBhY2thZ2UgY2RrX3ByZWZsaWdodFxcblxcbmltcG9ydCByZWdvLnYxXFxuXFxuX3BmX2lkbGVfdGltZW91dF9vdXQobikgaWYgbiA8IDFcXG5cXG5fcGZfaWRsZV90aW1lb3V0X291dChuKSBpZiBuID4gNDAwMFxcblxcbl9wZl9ub25fYWxiKG5hbWUpIGlmIHtcXG5cXHR0IDo9IHJlc29sdmUobmFtZSwgXFxcIlByb3BlcnRpZXMuVHlwZVxcXCIpXFxuXFx0dCAhPSBcXFwiYXBwbGljYXRpb25cXFwiXFxufVxcblxcbnZpb2xhdGlvbiBjb250YWlucyBtYWtlX2RpYWdfZnVsbChcXFwicGYtZWxidjItbGItaWRsZS10aW1lb3V0LXJhbmdlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLkxvYWRCYWxhbmNlckF0dHJpYnV0ZXMuJWQuVmFsdWVcXFwiLCBbaXRlbS5pbmRleF0pLFxcblxcdHNwcmludGYoXFxcImlkbGVfdGltZW91dC50aW1lb3V0X3NlY29uZHMgaXMgJXYgYnV0IG11c3QgYmUgYmV0d2VlbiAxIGFuZCA0MDAwIHNlY29uZHNcXFwiLCBbbnVtXSksXFxuXFx0XFxcIlNldCBpZGxlX3RpbWVvdXQudGltZW91dF9zZWNvbmRzIHRvIGEgdmFsdWUgYmV0d2VlbiAxIGFuZCA0MDAwXFxcIixcXG5cXHRcXFwiaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL2VsYXN0aWNsb2FkYmFsYW5jaW5nL2xhdGVzdC9hcHBsaWNhdGlvbi9hcHBsaWNhdGlvbi1sb2FkLWJhbGFuY2Vycy5odG1sI2Nvbm5lY3Rpb24taWRsZS10aW1lb3V0XFxcIikgaWYge1xcblxcdHNvbWUgbmFtZSBpbiByZXNvdXJjZXNfb2ZfdHlwZShcXFwiQVdTOjpFbGFzdGljTG9hZEJhbGFuY2luZ1YyOjpMb2FkQmFsYW5jZXJcXFwiKVxcblxcdG5vdCBfcGZfbm9uX2FsYihuYW1lKVxcblxcdHNvbWUgaXRlbSBpbiBmbGF0dGVuX2xpc3QobmFtZSwgXFxcIlByb3BlcnRpZXMuTG9hZEJhbGFuY2VyQXR0cmlidXRlc1xcXCIpXFxuXFx0YXR0ciA6PSBpdGVtLnZhbHVlXFxuXFx0aXNfb2JqZWN0KGF0dHIpXFxuXFx0b2JqZWN0LmdldChhdHRyLCBcXFwiS2V5XFxcIiwgXFxcIlxcXCIpID09IFxcXCJpZGxlX3RpbWVvdXQudGltZW91dF9zZWNvbmRzXFxcIlxcblxcdG51bSA6PSB0b19udW1iZXIob2JqZWN0LmdldChhdHRyLCBcXFwiVmFsdWVcXFwiLCBudWxsKSlcXG5cXHRfcGZfaWRsZV90aW1lb3V0X291dChudW0pXFxufVxcblwiXG4gIH0sXG4gIHtcbiAgICBcImlkXCI6IFwicGYtZWxidjItdGctZGVyZWdpc3RyYXRpb24tZGVsYXktcmFuZ2VcIixcbiAgICBcInNlcnZpY2VcIjogXCJlbGJ2MlwiLFxuICAgIFwic2V2ZXJpdHlcIjogXCJFUlJPUlwiLFxuICAgIFwidGl0bGVcIjogXCJUYXJnZXQgZ3JvdXAgZGVyZWdpc3RyYXRpb25fZGVsYXkudGltZW91dF9zZWNvbmRzIG11c3QgYmUgYmV0d2VlbiAwIGFuZCAzNjAwXCIsXG4gICAgXCJ1cHN0cmVhbVwiOiBcIm5vbmVcIixcbiAgICBcInJlc291cmNlVHlwZXNcIjogW1xuICAgICAgXCJBV1M6OkVsYXN0aWNMb2FkQmFsYW5jaW5nVjI6OlRhcmdldEdyb3VwXCJcbiAgICBdLFxuICAgIFwicmVnb1wiOiBcInBhY2thZ2UgY2RrX3ByZWZsaWdodFxcblxcbmltcG9ydCByZWdvLnYxXFxuXFxuX3BmX2RlcmVnX2RlbGF5X291dChuKSBpZiBuIDwgMFxcblxcbl9wZl9kZXJlZ19kZWxheV9vdXQobikgaWYgbiA+IDM2MDBcXG5cXG52aW9sYXRpb24gY29udGFpbnMgbWFrZV9kaWFnX2Z1bGwoXFxcInBmLWVsYnYyLXRnLWRlcmVnaXN0cmF0aW9uLWRlbGF5LXJhbmdlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLlRhcmdldEdyb3VwQXR0cmlidXRlcy4lZC5WYWx1ZVxcXCIsIFtpdGVtLmluZGV4XSksXFxuXFx0c3ByaW50ZihcXFwiZGVyZWdpc3RyYXRpb25fZGVsYXkudGltZW91dF9zZWNvbmRzIGlzICV2IGJ1dCBtdXN0IGJlIGJldHdlZW4gMCBhbmQgMzYwMCBzZWNvbmRzXFxcIiwgW251bV0pLFxcblxcdFxcXCJTZXQgZGVyZWdpc3RyYXRpb25fZGVsYXkudGltZW91dF9zZWNvbmRzIHRvIGEgdmFsdWUgYmV0d2VlbiAwIGFuZCAzNjAwXFxcIixcXG5cXHRcXFwiaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL2VsYXN0aWNsb2FkYmFsYW5jaW5nL2xhdGVzdC9hcHBsaWNhdGlvbi9lZGl0LXRhcmdldC1ncm91cC1hdHRyaWJ1dGVzLmh0bWwjZGVyZWdpc3RyYXRpb24tZGVsYXlcXFwiKSBpZiB7XFxuXFx0c29tZSBuYW1lIGluIHJlc291cmNlc19vZl90eXBlKFxcXCJBV1M6OkVsYXN0aWNMb2FkQmFsYW5jaW5nVjI6OlRhcmdldEdyb3VwXFxcIilcXG5cXHRzb21lIGl0ZW0gaW4gZmxhdHRlbl9saXN0KG5hbWUsIFxcXCJQcm9wZXJ0aWVzLlRhcmdldEdyb3VwQXR0cmlidXRlc1xcXCIpXFxuXFx0YXR0ciA6PSBpdGVtLnZhbHVlXFxuXFx0aXNfb2JqZWN0KGF0dHIpXFxuXFx0b2JqZWN0LmdldChhdHRyLCBcXFwiS2V5XFxcIiwgXFxcIlxcXCIpID09IFxcXCJkZXJlZ2lzdHJhdGlvbl9kZWxheS50aW1lb3V0X3NlY29uZHNcXFwiXFxuXFx0bnVtIDo9IHRvX251bWJlcihvYmplY3QuZ2V0KGF0dHIsIFxcXCJWYWx1ZVxcXCIsIG51bGwpKVxcblxcdF9wZl9kZXJlZ19kZWxheV9vdXQobnVtKVxcbn1cXG5cIlxuICB9LFxuICB7XG4gICAgXCJpZFwiOiBcInBmLWVsYnYyLXRnLXNsb3ctc3RhcnQtcmFuZ2VcIixcbiAgICBcInNlcnZpY2VcIjogXCJlbGJ2MlwiLFxuICAgIFwic2V2ZXJpdHlcIjogXCJFUlJPUlwiLFxuICAgIFwidGl0bGVcIjogXCJUYXJnZXQgZ3JvdXAgc2xvd19zdGFydC5kdXJhdGlvbl9zZWNvbmRzIG11c3QgYmUgMCBvciBiZXR3ZWVuIDMwIGFuZCA5MDBcIixcbiAgICBcInVwc3RyZWFtXCI6IFwibm9uZVwiLFxuICAgIFwicmVzb3VyY2VUeXBlc1wiOiBbXG4gICAgICBcIkFXUzo6RWxhc3RpY0xvYWRCYWxhbmNpbmdWMjo6VGFyZ2V0R3JvdXBcIlxuICAgIF0sXG4gICAgXCJyZWdvXCI6IFwicGFja2FnZSBjZGtfcHJlZmxpZ2h0XFxuXFxuaW1wb3J0IHJlZ28udjFcXG5cXG5fcGZfc2xvd19zdGFydF9vdXQobikgaWYgbiA8IDBcXG5cXG5fcGZfc2xvd19zdGFydF9vdXQobikgaWYge1xcblxcdG4gPiAwXFxuXFx0biA8IDMwXFxufVxcblxcbl9wZl9zbG93X3N0YXJ0X291dChuKSBpZiBuID4gOTAwXFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1lbGJ2Mi10Zy1zbG93LXN0YXJ0LXJhbmdlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRzcHJpbnRmKFxcXCJQcm9wZXJ0aWVzLlRhcmdldEdyb3VwQXR0cmlidXRlcy4lZC5WYWx1ZVxcXCIsIFtpdGVtLmluZGV4XSksXFxuXFx0c3ByaW50ZihcXFwic2xvd19zdGFydC5kdXJhdGlvbl9zZWNvbmRzIGlzICV2IGJ1dCBtdXN0IGJlIDAgKGRpc2FibGVkKSBvciBiZXR3ZWVuIDMwIGFuZCA5MDAgc2Vjb25kc1xcXCIsIFtudW1dKSxcXG5cXHRcXFwiU2V0IHNsb3dfc3RhcnQuZHVyYXRpb25fc2Vjb25kcyB0byAwIG9yIGEgdmFsdWUgYmV0d2VlbiAzMCBhbmQgOTAwXFxcIixcXG5cXHRcXFwiaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL2VsYXN0aWNsb2FkYmFsYW5jaW5nL2xhdGVzdC9hcHBsaWNhdGlvbi9lZGl0LXRhcmdldC1ncm91cC1hdHRyaWJ1dGVzLmh0bWwjc2xvdy1zdGFydC1tb2RlXFxcIikgaWYge1xcblxcdHNvbWUgbmFtZSBpbiByZXNvdXJjZXNfb2ZfdHlwZShcXFwiQVdTOjpFbGFzdGljTG9hZEJhbGFuY2luZ1YyOjpUYXJnZXRHcm91cFxcXCIpXFxuXFx0c29tZSBpdGVtIGluIGZsYXR0ZW5fbGlzdChuYW1lLCBcXFwiUHJvcGVydGllcy5UYXJnZXRHcm91cEF0dHJpYnV0ZXNcXFwiKVxcblxcdGF0dHIgOj0gaXRlbS52YWx1ZVxcblxcdGlzX29iamVjdChhdHRyKVxcblxcdG9iamVjdC5nZXQoYXR0ciwgXFxcIktleVxcXCIsIFxcXCJcXFwiKSA9PSBcXFwic2xvd19zdGFydC5kdXJhdGlvbl9zZWNvbmRzXFxcIlxcblxcdG51bSA6PSB0b19udW1iZXIob2JqZWN0LmdldChhdHRyLCBcXFwiVmFsdWVcXFwiLCBudWxsKSlcXG5cXHRfcGZfc2xvd19zdGFydF9vdXQobnVtKVxcbn1cXG5cIlxuICB9LFxuICB7XG4gICAgXCJpZFwiOiBcInBmLWlhbS1pbmxpbmUtcG9saWN5LXNpemVcIixcbiAgICBcInNlcnZpY2VcIjogXCJpYW1cIixcbiAgICBcInNldmVyaXR5XCI6IFwiRVJST1JcIixcbiAgICBcInRpdGxlXCI6IFwiSW5saW5lIHBvbGljeSBkb2N1bWVudHMgYXJlIGxpbWl0ZWQgcGVyIGlkZW50aXR5IChyb2xlIDEwMjQwIC8gZ3JvdXAgNTEyMCAvIHVzZXIgMjA0OCBjaGFyYWN0ZXJzKVwiLFxuICAgIFwidXBzdHJlYW1cIjogXCJub25lXCIsXG4gICAgXCJyZXNvdXJjZVR5cGVzXCI6IFtcbiAgICAgIFwiQVdTOjpJQU06OlBvbGljeVwiLFxuICAgICAgXCJBV1M6OklBTTo6Um9sZVBvbGljeVwiLFxuICAgICAgXCJBV1M6OklBTTo6VXNlclBvbGljeVwiLFxuICAgICAgXCJBV1M6OklBTTo6R3JvdXBQb2xpY3lcIlxuICAgIF0sXG4gICAgXCJyZWdvXCI6IFwicGFja2FnZSBjZGtfcHJlZmxpZ2h0XFxuXFxuaW1wb3J0IHJlZ28udjFcXG5cXG5fcGZfaW5saW5lX3BvbGljeV9saW1pdHMgOj0ge1xcblxcdFxcXCJBV1M6OklBTTo6UG9saWN5XFxcIjogMTAyNDAsXFxuXFx0XFxcIkFXUzo6SUFNOjpSb2xlUG9saWN5XFxcIjogMTAyNDAsXFxuXFx0XFxcIkFXUzo6SUFNOjpVc2VyUG9saWN5XFxcIjogMjA0OCxcXG5cXHRcXFwiQVdTOjpJQU06Okdyb3VwUG9saWN5XFxcIjogNTEyMCxcXG59XFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1pYW0taW5saW5lLXBvbGljeS1zaXplXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRcXFwiUHJvcGVydGllcy5Qb2xpY3lEb2N1bWVudFxcXCIsXFxuXFx0c3ByaW50ZihcXFwiUG9saWN5RG9jdW1lbnQgaXMgJWQgY2hhcmFjdGVycyAoSlNPTiB3aXRob3V0IHdoaXRlc3BhY2UpIGJ1dCB0aGUgaW5saW5lIHBvbGljeSBsaW1pdCBmb3IgJXMgaXMgJWQgKHJvbGU6IDEwMjQwLCBncm91cDogNTEyMCwgdXNlcjogMjA0OClcXFwiLCBbc2l6ZSwgcnR5cGUsIGxpbWl0XSksXFxuXFx0XFxcIk1vdmUgc3RhdGVtZW50cyBpbnRvIG1hbmFnZWQgcG9saWNpZXMgb3Igc2hvcnRlbiB0aGUgZG9jdW1lbnRcXFwiLFxcblxcdFxcXCJodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vSUFNL2xhdGVzdC9Vc2VyR3VpZGUvcmVmZXJlbmNlX2lhbS1xdW90YXMuaHRtbFxcXCIpIGlmIHtcXG5cXHRzb21lIHJ0eXBlLCBsaW1pdCBpbiBfcGZfaW5saW5lX3BvbGljeV9saW1pdHNcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUocnR5cGUpXFxuXFx0ZG9jIDo9IHJlc29sdmUobmFtZSwgXFxcIlByb3BlcnRpZXMuUG9saWN5RG9jdW1lbnRcXFwiKVxcblxcdGlzX29iamVjdChkb2MpXFxuXFx0c2l6ZSA6PSBjb3VudChqc29uLm1hcnNoYWwoZG9jKSlcXG5cXHRzaXplID4gbGltaXRcXG59XFxuXCJcbiAgfSxcbiAge1xuICAgIFwiaWRcIjogXCJwZi1pYW0tbWFuYWdlZC1wb2xpY3ktc2l6ZVwiLFxuICAgIFwic2VydmljZVwiOiBcImlhbVwiLFxuICAgIFwic2V2ZXJpdHlcIjogXCJFUlJPUlwiLFxuICAgIFwidGl0bGVcIjogXCJNYW5hZ2VkIHBvbGljeSBkb2N1bWVudHMgYXJlIGxpbWl0ZWQgdG8gNjE0NCBjaGFyYWN0ZXJzICh3aGl0ZXNwYWNlIGV4Y2x1ZGVkKVwiLFxuICAgIFwidXBzdHJlYW1cIjogXCJub25lXCIsXG4gICAgXCJyZXNvdXJjZVR5cGVzXCI6IFtcbiAgICAgIFwiQVdTOjpJQU06Ok1hbmFnZWRQb2xpY3lcIlxuICAgIF0sXG4gICAgXCJyZWdvXCI6IFwicGFja2FnZSBjZGtfcHJlZmxpZ2h0XFxuXFxuaW1wb3J0IHJlZ28udjFcXG5cXG52aW9sYXRpb24gY29udGFpbnMgbWFrZV9kaWFnX2Z1bGwoXFxcInBmLWlhbS1tYW5hZ2VkLXBvbGljeS1zaXplXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRcXFwiUHJvcGVydGllcy5Qb2xpY3lEb2N1bWVudFxcXCIsXFxuXFx0c3ByaW50ZihcXFwiUG9saWN5RG9jdW1lbnQgaXMgJWQgY2hhcmFjdGVycyAoSlNPTiB3aXRob3V0IHdoaXRlc3BhY2UpIGJ1dCB0aGUgbWFuYWdlZCBwb2xpY3kgbGltaXQgaXMgNjE0NFxcXCIsIFtzaXplXSksXFxuXFx0XFxcIlNwbGl0IHRoZSBkb2N1bWVudCBpbnRvIG11bHRpcGxlIG1hbmFnZWQgcG9saWNpZXMgb3Igc2hvcnRlbiBpdFxcXCIsXFxuXFx0XFxcImh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9JQU0vbGF0ZXN0L1VzZXJHdWlkZS9yZWZlcmVuY2VfaWFtLXF1b3Rhcy5odG1sXFxcIikgaWYge1xcblxcdHNvbWUgbmFtZSBpbiByZXNvdXJjZXNfb2ZfdHlwZShcXFwiQVdTOjpJQU06Ok1hbmFnZWRQb2xpY3lcXFwiKVxcblxcdGRvYyA6PSByZXNvbHZlKG5hbWUsIFxcXCJQcm9wZXJ0aWVzLlBvbGljeURvY3VtZW50XFxcIilcXG5cXHRpc19vYmplY3QoZG9jKVxcblxcdHNpemUgOj0gY291bnQoanNvbi5tYXJzaGFsKGRvYykpXFxuXFx0c2l6ZSA+IDYxNDRcXG59XFxuXCJcbiAgfSxcbiAge1xuICAgIFwiaWRcIjogXCJwZi1zZm4tYXNsLW1pc3Npbmctc3RhdGVcIixcbiAgICBcInNlcnZpY2VcIjogXCJzdGVwZnVuY3Rpb25zXCIsXG4gICAgXCJzZXZlcml0eVwiOiBcIkVSUk9SXCIsXG4gICAgXCJ0aXRsZVwiOiBcIkFTTCBTdGFydEF0L05leHQvRGVmYXVsdC9DaG9pY2VzIG11c3QgcmVmZXJlbmNlIGEgZGVmaW5lZCBzdGF0ZSAodG9wLWxldmVsIHN0YXRlcylcIixcbiAgICBcInVwc3RyZWFtXCI6IFwibm9uZVwiLFxuICAgIFwicmVzb3VyY2VUeXBlc1wiOiBbXG4gICAgICBcIkFXUzo6U3RlcEZ1bmN0aW9uczo6U3RhdGVNYWNoaW5lXCJcbiAgICBdLFxuICAgIFwicmVnb1wiOiBcInBhY2thZ2UgY2RrX3ByZWZsaWdodFxcblxcbmltcG9ydCByZWdvLnYxXFxuXFxuX3BmX3Nmbl9maXggOj0gXFxcIlBvaW50IFN0YXJ0QXQvTmV4dC9EZWZhdWx0IGF0IGFuIGV4aXN0aW5nIHN0YXRlIG5hbWVcXFwiXFxuXFxuX3BmX3Nmbl91cmwgOj0gXFxcImh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9zdGVwLWZ1bmN0aW9ucy9sYXRlc3QvZGcvYW1hem9uLXN0YXRlcy1sYW5ndWFnZS1zdGF0ZXMuaHRtbFxcXCJcXG5cXG5fcGZfc2ZuX2FzbChuYW1lKSA6PSBhc2wgaWYge1xcblxcdGRlZiA6PSByZXNvbHZlKG5hbWUsIFxcXCJQcm9wZXJ0aWVzLkRlZmluaXRpb25TdHJpbmdcXFwiKVxcblxcdGlzX3N0cmluZyhkZWYpXFxuXFx0YXNsIDo9IGpzb24udW5tYXJzaGFsKGRlZilcXG5cXHRpc19vYmplY3QoYXNsKVxcbn1cXG5cXG5fcGZfc2ZuX2RlZmluZWQoYXNsKSA6PSB7c24gfCBzb21lIHNuLCBfIGluIG9iamVjdC5nZXQoYXNsLCBcXFwiU3RhdGVzXFxcIiwge30pfVxcblxcbnZpb2xhdGlvbiBjb250YWlucyBtYWtlX2RpYWdfZnVsbChcXFwicGYtc2ZuLWFzbC1taXNzaW5nLXN0YXRlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRcXFwiUHJvcGVydGllcy5EZWZpbml0aW9uU3RyaW5nXFxcIixcXG5cXHRzcHJpbnRmKFxcXCJzdGF0ZSBtYWNoaW5lIGRlZmluaXRpb24gcmVmZXJlbmNlcyBzdGF0ZSAnJXMnIHZpYSBTdGFydEF0LCBidXQgbm8gc3RhdGUgd2l0aCB0aGF0IG5hbWUgaXMgZGVmaW5lZFxcXCIsIFt0YXJnZXRdKSxcXG5cXHRfcGZfc2ZuX2ZpeCwgX3BmX3Nmbl91cmwpIGlmIHtcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUoXFxcIkFXUzo6U3RlcEZ1bmN0aW9uczo6U3RhdGVNYWNoaW5lXFxcIilcXG5cXHRhc2wgOj0gX3BmX3Nmbl9hc2wobmFtZSlcXG5cXHR0YXJnZXQgOj0gb2JqZWN0LmdldChhc2wsIFxcXCJTdGFydEF0XFxcIiwgbnVsbClcXG5cXHRpc19zdHJpbmcodGFyZ2V0KVxcblxcdG5vdCB0YXJnZXQgaW4gX3BmX3Nmbl9kZWZpbmVkKGFzbClcXG59XFxuXFxudmlvbGF0aW9uIGNvbnRhaW5zIG1ha2VfZGlhZ19mdWxsKFxcXCJwZi1zZm4tYXNsLW1pc3Npbmctc3RhdGVcXFwiLCBcXFwiRVJST1JcXFwiLCBuYW1lLFxcblxcdFxcXCJQcm9wZXJ0aWVzLkRlZmluaXRpb25TdHJpbmdcXFwiLFxcblxcdHNwcmludGYoXFxcInN0YXRlICclcycgcmVmZXJlbmNlcyBzdGF0ZSAnJXMnIHZpYSAlcywgYnV0IG5vIHN0YXRlIHdpdGggdGhhdCBuYW1lIGlzIGRlZmluZWRcXFwiLCBbc25hbWUsIHRhcmdldCwga2V5XSksXFxuXFx0X3BmX3Nmbl9maXgsIF9wZl9zZm5fdXJsKSBpZiB7XFxuXFx0c29tZSBuYW1lIGluIHJlc291cmNlc19vZl90eXBlKFxcXCJBV1M6OlN0ZXBGdW5jdGlvbnM6OlN0YXRlTWFjaGluZVxcXCIpXFxuXFx0YXNsIDo9IF9wZl9zZm5fYXNsKG5hbWUpXFxuXFx0c29tZSBzbmFtZSwgc3QgaW4gb2JqZWN0LmdldChhc2wsIFxcXCJTdGF0ZXNcXFwiLCB7fSlcXG5cXHRpc19vYmplY3Qoc3QpXFxuXFx0c29tZSBrZXkgaW4ge1xcXCJOZXh0XFxcIiwgXFxcIkRlZmF1bHRcXFwifVxcblxcdHRhcmdldCA6PSBvYmplY3QuZ2V0KHN0LCBrZXksIG51bGwpXFxuXFx0aXNfc3RyaW5nKHRhcmdldClcXG5cXHRub3QgdGFyZ2V0IGluIF9wZl9zZm5fZGVmaW5lZChhc2wpXFxufVxcblxcbnZpb2xhdGlvbiBjb250YWlucyBtYWtlX2RpYWdfZnVsbChcXFwicGYtc2ZuLWFzbC1taXNzaW5nLXN0YXRlXFxcIiwgXFxcIkVSUk9SXFxcIiwgbmFtZSxcXG5cXHRcXFwiUHJvcGVydGllcy5EZWZpbml0aW9uU3RyaW5nXFxcIixcXG5cXHRzcHJpbnRmKFxcXCJzdGF0ZSAnJXMnIGhhcyBhIENob2ljZSBydWxlIHJlZmVyZW5jaW5nIHN0YXRlICclcycsIGJ1dCBubyBzdGF0ZSB3aXRoIHRoYXQgbmFtZSBpcyBkZWZpbmVkXFxcIiwgW3NuYW1lLCB0YXJnZXRdKSxcXG5cXHRfcGZfc2ZuX2ZpeCwgX3BmX3Nmbl91cmwpIGlmIHtcXG5cXHRzb21lIG5hbWUgaW4gcmVzb3VyY2VzX29mX3R5cGUoXFxcIkFXUzo6U3RlcEZ1bmN0aW9uczo6U3RhdGVNYWNoaW5lXFxcIilcXG5cXHRhc2wgOj0gX3BmX3Nmbl9hc2wobmFtZSlcXG5cXHRzb21lIHNuYW1lLCBzdCBpbiBvYmplY3QuZ2V0KGFzbCwgXFxcIlN0YXRlc1xcXCIsIHt9KVxcblxcdGlzX29iamVjdChzdClcXG5cXHRjaG9pY2VzIDo9IG9iamVjdC5nZXQoc3QsIFxcXCJDaG9pY2VzXFxcIiwgW10pXFxuXFx0aXNfYXJyYXkoY2hvaWNlcylcXG5cXHRzb21lIGMgaW4gY2hvaWNlc1xcblxcdGlzX29iamVjdChjKVxcblxcdHRhcmdldCA6PSBvYmplY3QuZ2V0KGMsIFxcXCJOZXh0XFxcIiwgbnVsbClcXG5cXHRpc19zdHJpbmcodGFyZ2V0KVxcblxcdG5vdCB0YXJnZXQgaW4gX3BmX3Nmbl9kZWZpbmVkKGFzbClcXG59XFxuXCJcbiAgfVxuXTtcbiJdfQ==

package/llms.txt

@@ -0,0 +1,23 @@
+# cdk-preflight
+
+> A Rego rule pack that catches deploy-time CloudFormation failures at `cdk synth` time, by injecting rules for schema-invisible constraints (doc-only limits, cross-property rules) into the AWS CDK built-in validator (aws-cdk-lib >= 2.267.0).
+
+## Install into a CDK app (agent playbook)
+
+1. `npm i -D cdk-preflight`
+2. `npx cdk-preflight init` — locates the app entry via cdk.json and inserts `Preflight.apply(app)`. `--dry-run` previews, `--dir <path>` targets another directory. Idempotent.
+3. `cdk synth` — violations appear as warnings with rule id, actual value, suggested fix, and construct trace.
+4. To fail the build on violations: `Preflight.apply(app, { enforce: true })`. Add `strict: true` to also fail on the engine's own error-class findings (F-/E-prefixed) that CDK otherwise downgrades to warnings.
+5. Machine-readable findings: synth with `-c @aws-cdk/core:validationReportJson=true`, then read `cdk.out/validation-report.json`.
+
+## Key files
+
+- README.md: usage and options
+- docs/rules.md: generated table of bundled rules
+- AGENTS.md: how to author a rule (fail/pass fixtures, duplication guard, real-deploy gate)
+- rules/<service>/<rule-id>/: rule.rego + meta.yaml + templates
+
+## API
+
+- `Preflight.apply(scope: App | Stage, options?: { exclude?: string[]; enforce?: boolean; strict?: boolean; includeUpstreamPending?: boolean })`
+- `Preflight.ruleIds(): string[]`