cdk-preflight 0.0.34 → 0.0.36

package/.claude/skills/find-preflight-rules/SKILL.md

@@ -87,6 +87,9 @@ EOL ランタイム、廃止インスタンスタイプ、リージョン非対
    console.log(JSON.stringify(r.diagnostics, null, 2));"
    ```
    `ERROR` / `FATAL`（`source` が `SCHEMA` か `CFN_LINT`）が出たら**その候補は捨てる**。`WARN` クラスだけ、あるいは `INFO` だけならグレーゾーンなので、上流に severity の issue を出す候補として記録し、つなぎで実装するなら `upstream: pending-engine` を付ける
+   - **CLI のサービスモデルが API より古いことがある**（2026-09-05、`aws wafv2` は `Monetize` と `PreParseTextTransformations` を知らず ParamValidation で落ちた）。CLI が拒否するフィールドだけスタックを立てる。名前が scope / region 単位で一意なサービス（WAFv2）は、並列 bench のフィクスチャ名にルール ID を混ぜる
+   - **`--cli-input-json` の blob は base64**（`SearchString` を平文で書くとクライアント側で "Invalid base64" になり、サーバに届かないまま全滅する）
+   - **サービス API を直接叩けるものは先に叩く**（2026-09-05、KMS / Secrets Manager / SSM で実測）。CFN ハンドラが CreateKey / CreateAlias / ReplicateKey / GetRandomPassword / RotateSecret / PutParameter / CreateDocument / CreateMaintenanceWindow / CreateAssociation をそのまま呼ぶサービスでは、API の拒否＝スタックイベントの文面で、失敗した呼び出しは何も作らないのでタダ。ハンドラ独自の検査（`SecretString` と `GenerateSecretString` の排他、`HostedRotationLambda` の transform 要否など）だけスタックを立てる
 4. **issue に記録**。生き残った候補をチェックリストに、落ちた候補を理由つきで残す。落選理由を残すのが重要で、これが無いと次の担当が同じ調査を繰り返す
 5. **実装へ引き継ぐ**。採用候補 1 本ごとに `add-preflight-rule` を起動する。実機再現ゲートはそちら側の責務
 

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.34",
-  "fingerprint": "T0jnMaXQ/skxsnPgG4prlhzBEfokgSxAPIJTTjx6B1o="
+  "version": "0.0.36",
+  "fingerprint": "8dI0CJwBXHHN290HYbubn8Iqxzg1WM2YT14NLd2xt20="
 }

package/AGENTS.md

@@ -110,7 +110,7 @@ bench/                      # real-deploy verification (needs an AWS account; no
    - `flatten_list()` returns an **empty list for an absent path** — it cannot distinguish "absent" from "present and empty" (measured 2026-09-02). Use the `input.resources` idiom above when the distinction matters (`pf-ecs-container-definitions-empty`).
    - **Intrinsics inside `input.resources` values are marker objects, never strings** (measured 2026-09-03, 1.7.0-beta): `Fn::GetAtt` appears as `{"__kind": "getatt:Arn", "__ref": "B"}` and `Fn::Sub` as `{"__dynamic": "Sub:..."}` at any nesting depth. A plain `is_string(v)` guard therefore safely mutes rules that judge string shapes (ARN format, prefixes) on values users wired via intrinsics — no logical-ID false positives. Reference implementations: `pf-iam-policy-resource-format`, `pf-iam-policy-action-format`.
    - **Dynamic reference strings are markerized too** (measured 2026-09-03): a literal `{{resolve:ssm:/path}}` property value surfaces as `{"__dynamic": "dynamic reference: {{resolve:ssm:/path}}", "__param_type": "String"}` and `resolve()` is undefined for it. A rule that judges the reference text itself (e.g. the SSM parameter path) must read the raw property with `object.get` and extract the `__dynamic` string. Reference implementation: `pf-ec2-instance-ami-arch`.
-   - **Deploy-region rules**: the enforce plugin injects a generated module defining `deploy_region` whenever the app-level region is concrete (`deployEnvironmentModule` in `src/private/enforce.ts`; the test harness injects `us-east-1` for fixtures). Rules must read it as `data.cdk_preflight.deploy_region` — the data reference is undefined when not injected, so the rule skips; a bare `deploy_region` variable would be a compile error. Consequences: region-dependent rules are silent in warn mode (`enforce: false` hands rules to the CDK built-in plugin, which we cannot inject into) and in region-agnostic apps; say so in `meta.yaml#repro.evidence`. Reference implementations: `pf-dynamodb-global-table-replica-region`, `pf-dynamodb-kinesis-stream-region`.
+   - **Deploy-region rules**: the enforce plugin injects a generated module defining `deploy_region` (and `deploy_account` when the account id is concrete) whenever the app-level region is concrete (`deployEnvironmentModule` in `src/private/enforce.ts`; the test harness injects `us-east-1` for fixtures). Rules must read it as `data.cdk_preflight.deploy_region` — the data reference is undefined when not injected, so the rule skips; a bare `deploy_region` variable would be a compile error. `data.cdk_preflight.deploy_account` works the same way (`pf-kms-key-policy-lockout` treats any account as ours when it is absent, `pf-kms-alias-target` skips its account check). Consequences: region-dependent rules are silent in warn mode (`enforce: false` hands rules to the CDK built-in plugin, which we cannot inject into) and in region-agnostic apps; say so in `meta.yaml#repro.evidence`. Reference implementations: `pf-dynamodb-global-table-replica-region`, `pf-dynamodb-kinesis-stream-region`.
    - Helper rules must use a unique `_pf_<rule>_...` prefix (all rules share one package).
    - A helper several rules of one service need (parsing an opaque DSL, enumerating nested scopes) goes in `rules/_lib/<service>.rego` with a `_pf_<service>lib_` prefix (`rules/_lib/sfn.rego` is the reference: ASL from `DefinitionString` *or* the L1 `Definition` object, nested Parallel/Map scopes to depth 3, effective QueryLanguage). Rules never reference another rule's helpers — `exclude` can unload any rule, a lib is always loaded.
    - **Cheap screen for definition-level constraints**: some services expose their create-time validator as a free API (`aws stepfunctions validate-state-machine-definition --type STANDARD|EXPRESS` is the same validator CreateStateMachine runs). Use it to triage doc hypotheses before spending a CloudFormation deploy on each — 100 Step Functions hypotheses took minutes (2026-09-05). The real-deploy gate stays.
@@ -148,7 +148,20 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **Missing builtins (measured 2026-09-05)**: `walk`, `graph.reachable`, `time.parse_rfc3339_ns`, `glob.match`, and `every` inside a comprehension all fail to evaluate. Reachability has to be approximated (no-incoming-edge, `pf-sfn-asl-unreachable-state`), nesting expanded to a fixed depth (`rules/_lib/sfn.rego`), timestamps matched with a regex. Present and working: `object.keys`, `object.get` with a path array, `regex.find_n`, `numbers.range`, `array.slice`, `json.marshal`, `object.union`, `strings.count`, `indexof`, `substring`.
 - **`resolve()` of a `Fn::Join` / `Fn::Sub` that references another resource is undefined** (measured 2026-09-05); only pseudo-parameter pieces flatten. A CDK `DefinitionBody.fromChainable` definition (Join over GetAtt tokens) is therefore invisible to string-parsing rules — they see `fromString` / `fromFile` / substitutions and the L1 `Definition` object, which is where the unchecked input is anyway.
 - **Tuple destructuring in `some [a, b] in <array literal>` does not schedule** ("statements not scheduled in query", measured 2026-09-04). Iterating a table of pairs inline is not available — a **set literal** of tuples fails the same way (measured 2026-09-05); build a set with one helper rule per case and destructure that set (`some [name, path, v] in _pf_x_bad`), which does work.
+- **Rego source lines are capped at 1024 columns** ("line exceeds maximum column width of 1024", measured 2026-09-05) — the failure surfaces as a parse error that takes the whole custom package down. Wrap long literal tables (the IANA zone list in `pf-ssm-maintenance-window-schedule` is one entry per line).
+- **Template-level `Transform` is exposed as `input.template.transforms`** (always an array of strings, measured 2026-09-05; `input.template` also carries `description`, `formatVersion`, `rawTopLevelKeys`). Reference: `pf-secretsmanager-hosted-rotation`, which requires an `AWS::SecretsManager-*` transform.
+- **Probe scripts that load the engine outside jest never exit on their own** and were found spinning at 100% CPU an hour later (measured 2026-09-05). End ad-hoc `ts-node` probes with `process.exit(0)` and wrap them in `perl -e 'alarm 300; exec @ARGV'`.
+- **Service APIs that the CloudFormation handler calls verbatim are a cheap triage** (KMS CreateKey/CreateAlias/ReplicateKey, Secrets Manager GetRandomPassword/RotateSecret, SSM PutParameter/CreateDocument/CreateMaintenanceWindow/CreateAssociation, measured 2026-09-05): a rejected call is free and its message is what the stack event will show. Handler-only checks (SecretString vs GenerateSecretString, HostedRotationLambda's transform, Automation associations needing AutomationTargetParameterName) still need a stack.
 - **`resolve()` of `Fn::GetAtt <Resource>.<Attr>` also returns the target's logical ID** (measured 2026-09-05), exactly like a `Ref`. So `resolve(sub, "Properties.Endpoint")` on `Fn::GetAtt Queue.Arn` yields `"Queue"`, which can be fed to `resources_of_type(...)` membership and a second `resolve` on the target. When the *kind* of reference matters (a URL-taking property handed an ARN), read the raw document: `Ref` is `{"__kind": "resource", "__ref": "Q"}`, `Fn::GetAtt` is `{"__kind": "getatt:<Attr>", "__ref": "Q"}`; `flatten_list` drops `__kind`. Reference implementations: `pf-sqs-queue-policy-queues`, `pf-sns-topic-policy-topics`.
 - **Cross-resource checks the engine already does on `Ref`/`GetAtt` wiring can be blind to literal ARNs.** `E3502` compares a source queue's type with its dead-letter queue only when `deadLetterTargetArn` is `Fn::GetAtt` of a queue in the template; a literal `.fifo` ARN (an imported queue) passes (measured 2026-09-05). Probe both wirings before deciding a candidate is covered — `pf-sqs-dlq-same-type` exists only for the literal path.
 - **Schema pattern/length coverage is per property, not per resource or per service.** `AWS::EC2::SecurityGroup.GroupDescription` carries a pattern (`F3031`) while the rule-level `SecurityGroupIngress[].Description` on the same resource carries none; DynamoDB's GSI `IndexName` has one while the table's own `TableName` does not. Never generalise "the engine handles names/lengths" from a sample — probe the exact property (measured 2026-09-04 across 57 templates).
+- **Intrinsics reach Rego as marker objects** (measured 2026-09-05): `{"Fn::GetAtt": ["X", "Arn"]}` is `{"__kind": "getatt:Arn", "__ref": "X"}`, `{"Ref": "X"}` is `{"__kind": "resource", "__ref": "X"}`, and a `Fn::Sub` that still references a resource is `{"__dynamic": "Sub:..."}` (undefined under `resolve()`). `resolve()` turns the first two into the logical id `"X"`, so a "literal string" check must also require `not input.resources[s]` — `rules/_lib/wafv2.rego` has `_pf_waflib_getatt / _ref / _lit` for the three cases. Array elements resolve through dotted paths (`Properties.L.1`), not `L[1]`.
+- **More missing builtins (measured 2026-09-05)**: `net.cidr_is_valid` / `net.cidr_*` and `base64.decode`. CIDR parsing is regex + arithmetic with `bits.and` / `bits.lsh` (present, `pf-wafv2-ipset-addresses`); `ceil`, `floor`, `sum`, `sort`, `max`, `array.concat`, `trim_prefix` / `trim_suffix`, `to_number`, `regex.is_valid` (RE2-like: false for backreferences, lookaround, possessive / atomic groups) all work.
+- **Without `walk`, a recursive statement tree is unrolled level by level**: `rules/_lib/wafv2.rego` expands And / Or / Not / ScopeDown six levels deep into `[container, rule index, path, statement]` tuples that every WAFv2 rule iterates. Rego has no recursion, so the depth is a hard ceiling — say so in a `ponytail:` comment.
+- **A comprehension inside a rule head does not schedule** (`sprintf("%s", [concat(", ", [k | some k in keys])])` → "statements not scheduled" at evaluation, measured 2026-09-05). Bind it to a variable in the body and use the variable in the head.
+- **`some` cannot re-declare a variable that is already bound in the same body or an enclosing one** ("var `name` used before definition below"). Iterating the same tuple set twice needs fresh names plus equality checks (`some [nm, ii, m, l2, c2] in set; nm == name; ii == i`), and a comprehension inside a body must not reuse the body's variable names.
+- **`sprintf` with the wrong arity silently disables the rule**, like a bare `%`: `sprintf("%d %s", [n], extra)` never evaluates and nothing warns (measured 2026-09-05). Keep every argument inside the array.
+- **`meta.fixtureRegion` moves a rule's fixture evaluation off the harness default (us-east-1)**. Needed for rules about the deploy region itself (`pf-wafv2-scope-region`: CLOUDFRONT scope only in us-east-1) whose fail template cannot fire where the harness runs.
+- **WAFv2 names are unique per scope and region, so parallel bench runs collide on fixture names.** The WAFv2 generators suffix every `Name` with the rule id (`uniq()` in the scratch `gen-lib.js`); do the same for any service whose entity names are account-unique.
+- **The CLI's service model can lag the API** (measured 2026-09-05: `aws wafv2` had no `Monetize` action and no `PreParseTextTransformations`). Fields the CLI rejects with ParamValidation need a stack for triage; everything else is cheaper through `create-*` calls whose rejections create nothing (WAF: ~290 calls, 13 stacks for the whole survey). `aws wafv2 check-capacity` is the oracle for the WCU estimate in `pf-wafv2-capacity`.
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.

package/docs/rules.md

@@ -172,6 +172,16 @@
 | `pf-iam-policy-version` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Policy Version must be 2012-10-17 or 2008-10-17 | none |
 | `pf-iam-trust-policy-no-resource` | AWS::IAM::Role | Trust policies cannot carry a Resource field | none |
 | `pf-iam-trust-policy-service-principal` | AWS::IAM::Role | Service principals live under amazonaws.com | none |
+| `pf-kms-alias-name` | AWS::KMS::Alias | AliasName must not start with alias/aws/ (reserved for AWS managed keys) and may not contain a colon (the CloudFormation schema allows it, CreateAlias does not) | none |
+| `pf-kms-alias-target` | AWS::KMS::Alias | TargetKeyId must be a key id or key ARN (not an alias) of a key in the same account and region | none |
+| `pf-kms-key-origin` | AWS::KMS::Key | Origin AWS_CLOUDHSM and EXTERNAL_KEY_STORE cannot be created by CloudFormation, and Origin EXTERNAL does not support ML-DSA key specs | none |
+| `pf-kms-key-policy-charset` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | A KeyPolicy may only contain tab, LF, CR and characters U+0020..U+00FF (no Japanese or other non-Latin-1 text, e.g. in a Sid) | none |
+| `pf-kms-key-policy-lockout` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | A KeyPolicy must let a principal of the deploying account call kms:PutKeyPolicy, unless BypassPolicyLockoutSafetyCheck is true | none |
+| `pf-kms-key-policy-statement` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | Every KeyPolicy statement needs Principal, Action and Resource, the Statement list must not be empty, and AWS principals must be *, an account id or an IAM/STS ARN | none |
+| `pf-kms-key-rotation` | AWS::KMS::Key | EnableKeyRotation is only valid for SYMMETRIC_DEFAULT keys with AWS_KMS key material (not asymmetric, HMAC, or Origin EXTERNAL) | none |
+| `pf-kms-key-spec-region` | AWS::KMS::Key | KeySpec SM2 exists only in China regions | none |
+| `pf-kms-key-spec-usage` | AWS::KMS::Key | KeyUsage must match KeySpec (symmetric: ENCRYPT_DECRYPT, HMAC: GENERATE_VERIFY_MAC, RSA: ENCRYPT_DECRYPT|SIGN_VERIFY, NIST ECC: SIGN_VERIFY|KEY_AGREEMENT, ed25519/secp256k1/ML-DSA: SIGN_VERIFY) and is required for every non-symmetric key | none |
+| `pf-kms-replica-primary-arn` | AWS::KMS::ReplicaKey | ReplicaKey.PrimaryKeyArn must be the ARN of a multi-Region primary key (key/mrk-...) in a different region of the same partition, so a primary key in the same stack can never be replicated by it | none |
 | `pf-lambda-code-s3-pair` | AWS::Lambda::Function | S3-based Code needs both S3Bucket and S3Key | none |
 | `pf-lambda-code-zipfile-exclusive` | AWS::Lambda::Function | Inline ZipFile excludes every other Code parameter | none |
 | `pf-lambda-dlq-region` | AWS::Lambda::Function | The dead letter target must sit in the deploy region | none |
@@ -225,6 +235,16 @@
 | `pf-s3-website-redirect-exclusive` | AWS::S3::Bucket | RedirectAllRequestsTo excludes every other website setting | none |
 | `pf-scheduler-flexible-window` | AWS::Scheduler::Schedule | FLEXIBLE mode needs MaximumWindowInMinutes, OFF forbids it | none |
 | `pf-scheduler-rate-positive` | AWS::Scheduler::Schedule | A Scheduler rate() value must be positive | none |
+| `pf-secretsmanager-generate-secret-string` | AWS::SecretsManager::Secret | GenerateSecretString must leave at least one character type, a PasswordLength (1..4096) that fits every required type, ExcludeCharacters under 4096 chars that does not wipe out a required type, and SecretStringTemplate (a JSON object) together with GenerateStringKey | none |
+| `pf-secretsmanager-hosted-rotation` | AWS::SecretsManager::RotationSchedule | HostedRotationLambda needs the AWS::SecretsManager transform, a known RotationType, MasterSecretArn/SuperuserSecretArn only for *MultiUser types (never both), and no Runtime with the 2024-09-16 transform | none |
+| `pf-secretsmanager-kms-key` | AWS::SecretsManager::Secret | KmsKeyId must be a key in the deploy region, and AWS managed keys of other services (alias/aws/<service>) cannot encrypt a secret | none |
+| `pf-secretsmanager-replica-regions` | AWS::SecretsManager::Secret | ReplicaRegions must name other regions than the one the secret deploys to | none |
+| `pf-secretsmanager-rotation-lambda` | AWS::SecretsManager::RotationSchedule | A RotationSchedule needs exactly one of RotationLambdaARN (a Lambda ARN in the deploy region) or HostedRotationLambda | none |
+| `pf-secretsmanager-rotation-rules` | AWS::SecretsManager::RotationSchedule | RotationRules: AutomaticallyAfterDays (1..1000) or ScheduleExpression, not both; rate() every 4..23 hours or 1..1000 days; cron() with 6 fields, minute 0, year *, one of day-of-month/day-of-week ?, and hours at least 4 apart; Duration Nh in 1..24 that fits the rotation interval and the UTC day | none |
+| `pf-secretsmanager-rotation-schedule-unique` | AWS::SecretsManager::RotationSchedule | A secret can have only one RotationSchedule | none |
+| `pf-secretsmanager-secret-name` | AWS::SecretsManager::Secret | A secret Name may only contain ASCII letters, digits and -/_+=.@! (no spaces, colons, hashes or non-ASCII text) | none |
+| `pf-secretsmanager-secret-string-exclusive` | AWS::SecretsManager::Secret | SecretString and GenerateSecretString cannot both be set on a secret | none |
+| `pf-secretsmanager-target-attachment` | AWS::SecretsManager::SecretTargetAttachment | SecretTargetAttachment needs a TargetType from the documented list and a secret whose value is a JSON object (SecretString JSON or GenerateSecretString with SecretStringTemplate) | none |
 | `pf-sns-delivery-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | HTTP/S DeliveryPolicy retry values: minDelayTarget >= 1, maxDelayTarget <= 3600 and >= minDelayTarget, numRetries 0..100 and at least the sum of the phase retries, phase counts >= 0, backoffFunction one of arithmetic|exponential|geometric|linear, maxReceivesPerSecond >= 1 (subscription DeliveryPolicy and topic DeliveryPolicy.http) | none |
 | `pf-sns-fifo-only-attributes` | AWS::SNS::Topic | ContentBasedDeduplication, ArchivePolicy and FifoThroughputScope are FIFO-only topic attributes, and ArchivePolicy.MessageRetentionPeriod is 1..365 days | none |
 | `pf-sns-fifo-queue-on-standard-topic` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO SQS queue cannot subscribe to a standard topic (a FIFO topic may fan out to standard queues, not the reverse) | none |
@@ -249,6 +269,21 @@
 | `pf-sqs-redrive-arn-region` | AWS::SQS::Queue | The dead-letter target and every RedriveAllowPolicy source queue must sit in the deploy region | none |
 | `pf-sqs-redrive-policy` | AWS::SQS::Queue | RedrivePolicy needs deadLetterTargetArn (an SQS queue ARN) and maxReceiveCount in 1..1000 | none |
 | `pf-sqs-sse-exclusive` | AWS::SQS::Queue | SqsManagedSseEnabled: true and KmsMasterKeyId are mutually exclusive (one SSE type per queue) | none |
+| `pf-ssm-association-document` | AWS::SSM::Association | Association document checks: no DocumentVersion on Amazon-owned documents (a new document in this stack only has version 1), the document must be in the deploy region, Session documents cannot be associated, SyncCompliance MANUAL needs an AssociationId parameter, Automation documents with Targets need AutomationTargetParameterName, and Parameters must match the document declaration | none |
+| `pf-ssm-association-schedule` | AWS::SSM::Association | Association schedules: rate() of at least 30 minutes with matching singular/plural unit; cron() only in the accepted forms (every 30 minutes, every 1/2/4/8/12 hours, a time every day or on one weekday, nth or last weekday of the month); at() only with ApplyOnlyAtCronInterval; ApplyOnlyAtCronInterval not with rate(); ScheduleOffset only with ApplyOnlyAtCronInterval and a #n/L weekday cron | none |
+| `pf-ssm-association-targets` | AWS::SSM::Association | An association needs InstanceId or Targets; target keys are InstanceIds, aws:NoOpAutomationTag, resource-groups:Name, tag-key or tag:<key>, with non-empty values and well-formed instance ids | none |
+| `pf-ssm-document-content` | AWS::SSM::Document | Document Content must be JSON for DocumentFormat JSON, have mainSteps (2.x/0.3) or runtimeConfig (1.2), name every step uniquely with a known plugin/action, declare typed parameters that every {{ ref }} resolves to, and keep Automation step links (nextStep, onFailure, isEnd, outputs) consistent | none |
+| `pf-ssm-document-name` | AWS::SSM::Document | Document Name must not start with aws-, amazon or amzn (case-insensitive) | none |
+| `pf-ssm-document-schema` | AWS::SSM::Document | schemaVersion must match DocumentType (Command 1.0/1.2/2.0/2.2, Automation 0.3, Session 1.0, Policy 2.0/2.2), 2.2 needs an explicit DocumentType, ChangeCalendar needs DocumentFormat TEXT (and TEXT only ChangeCalendar), and ApplicationConfiguration needs Requires | none |
+| `pf-ssm-maintenance-window-cutoff` | AWS::SSM::MaintenanceWindow | Cutoff must be smaller than Duration | none |
+| `pf-ssm-maintenance-window-schedule` | AWS::SSM::MaintenanceWindow | Schedule must be rate(N minutes|hours|days), a 6/7-field cron() with in-range fields and one of day-of-month/day-of-week as ?, or at(yyyy-MM-ddTHH:mm:ss); ScheduleOffset only with an nth-/last-weekday cron; StartDate/EndDate need a UTC offset with Start before End; ScheduleTimezone is an IANA name or ±HH:MM | none |
+| `pf-ssm-maintenance-window-target` | AWS::SSM::MaintenanceWindowTarget | MaintenanceWindowTarget with ResourceType INSTANCE takes either a single InstanceIds target or up to five tag:/tag-key targets; RESOURCE_GROUP takes a resource-groups:Name target | none |
+| `pf-ssm-maintenance-window-task` | AWS::SSM::MaintenanceWindowTask | RUN_COMMAND tasks need Targets; tasks with Targets need MaxConcurrency and MaxErrors (and targetless tasks must not set them); TaskInvocationParameters may only hold the block for the TaskType; target keys are InstanceIds or WindowTargetIds; a NotificationConfig needs ServiceRoleArn | none |
+| `pf-ssm-parameter-allowed-pattern` | AWS::SSM::Parameter | Value (each item of a StringList) must match AllowedPattern | none |
+| `pf-ssm-parameter-name` | AWS::SSM::Parameter | Parameter Name must not start with aws or ssm (case-insensitive), must not end with / or contain empty segments, uses only [A-Za-z0-9_.-] per segment, and with the ARN prefix must stay within 1011 characters | none |
+| `pf-ssm-parameter-policies` | AWS::SSM::Parameter | Policies is a JSON array of at most 10 {Type, Version "1.0", Attributes} entries: one Expiration with an ISO-8601 Timestamp, ExpirationNotification (Before + Unit) only alongside it, NoChangeNotification (After + Unit), Unit Days or Hours | none |
+| `pf-ssm-parameter-tier` | AWS::SSM::Parameter | Standard-tier parameters (Tier omitted uses the account default, normally Standard) hold at most 4096 characters and no Policies; Advanced and Intelligent-Tiering hold at most 8192 | none |
+| `pf-ssm-parameter-value` | AWS::SSM::Parameter | Value must be non-empty and must not contain {{ }}; DataType is text, aws:ec2:image or aws:ssm:integration (lowercase), and aws:ec2:image needs Type String with an ami-... value | none |
 | `pf-sfn-asl-branch-shape` | AWS::StepFunctions::StateMachine | Parallel Branches is a non-empty array and every branch / Map ItemProcessor / Iterator carries both StartAt and States | none |
 | `pf-sfn-asl-choice-rules` | AWS::StepFunctions::StateMachine | Choice rules: Choices is non-empty, each top-level rule has Next and exactly one selector (Variable / And / Or / Not / Condition), a Variable rule has exactly one comparator, and Next never sits inside And/Or/Not | none |
 | `pf-sfn-asl-credentials` | AWS::StepFunctions::StateMachine | A Task Credentials object needs RoleArn, and Credentials is not accepted on an Activity resource | none |
@@ -277,3 +312,32 @@
 | `pf-sfn-name-charset` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | StateMachineName and Activity Name may not contain whitespace, brackets (< > { } [ ]), wildcards (? *), the special characters " # % \ ^ | ~ ` $ & , ; : / or control characters (non-ASCII letters are accepted) | none |
 | `pf-tags-aws-prefix` | * | Tag keys may not use the reserved aws: prefix | none |
 | `pf-tags-count-max` | * | A resource may carry at most 50 tags | none |
+| `pf-wafv2-association-config-scope` | AWS::WAFv2::WebACL | AssociationConfig.RequestBody keys must match the web ACL Scope | none |
+| `pf-wafv2-association-resource-arn` | AWS::WAFv2::WebACLAssociation | ResourceArn must be a supported protected-resource ARN in the deploy account and region | none |
+| `pf-wafv2-association-webacl-arn` | AWS::WAFv2::WebACLAssociation | WebACLArn must be the ARN of a web ACL in the deploy region | none |
+| `pf-wafv2-byte-match` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | ByteMatchStatement: exactly one of SearchString / SearchStringBase64, at most 200 bytes, non-blank, and CONTAINS_WORD only with [A-Za-z0-9_] | none |
+| `pf-wafv2-capacity` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group Capacity must be 1..5000 and cover the WCUs of its rules; a web ACL is limited to 5000 WCUs | none |
+| `pf-wafv2-challenge-immunity-time` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Challenge immunity time must be at least 300 seconds | none |
+| `pf-wafv2-cloudfront-only-features` | AWS::WAFv2::WebACL | ResponseInspection and the Monetize action only work in CLOUDFRONT-scoped web ACLs (Monetize also needs MonetizationConfig) | none |
+| `pf-wafv2-custom-request-handling` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Inserted request headers: unique names, at most 10 per action and 100 per web ACL / rule group | none |
+| `pf-wafv2-custom-response` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Custom responses: no content-type or duplicate headers, at most 10 headers, body keys must exist, bodies within 4 KB / 50 entries / 50 KB total | none |
+| `pf-wafv2-data-protection` | AWS::WAFv2::WebACL | Data protection fields: FieldKeys required for single-key types, forbidden for QUERY_STRING / BODY, one entry per field type | none |
+| `pf-wafv2-ipset-addresses` | AWS::WAFv2::IPSet | IP set addresses must be CIDR blocks of the declared version with a 1..32 / 1..128 prefix and no host bits set | none |
+| `pf-wafv2-label-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule labels and label match keys must follow the label syntax (no reserved words, no empty components, at most 8 components of 128 chars, no labels on rule group references) | none |
+| `pf-wafv2-logging-destination` | AWS::WAFv2::LoggingConfiguration | Exactly one log destination whose name starts with aws-waf-logs-, in the web ACL account and region | none |
+| `pf-wafv2-logging-filter-condition` | AWS::WAFv2::LoggingConfiguration | Each logging filter condition is exactly one of ActionCondition / LabelNameCondition | none |
+| `pf-wafv2-logging-unique` | AWS::WAFv2::LoggingConfiguration | One LoggingConfiguration per web ACL in a template | none |
+| `pf-wafv2-managed-rule-group` | AWS::WAFv2::WebACL | Managed rule group statements: known AWS group names, matching and complete ManagedRuleGroupConfigs, consistent overrides and response inspection | none |
+| `pf-wafv2-metric-name-reserved` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | MetricName Default_Action is reserved | none |
+| `pf-wafv2-name-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Two WAFv2 entities of the same type, Scope and Name in one template | none |
+| `pf-wafv2-rate-based-statement` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rate-based statement aggregation settings must be consistent (keys, forwarded IP config, scope-down, counts) | none |
+| `pf-wafv2-reference-arn` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | IP set / regex pattern set / rule group references must match the web ACL scope, region and account | none |
+| `pf-wafv2-regex-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::RegexPatternSet | Regular expressions must stay within the supported PCRE subset (no backreferences, lookaround, possessive / atomic groups, conditionals, recursion, \K, \R, control verbs), at most 10 per pattern set | none |
+| `pf-wafv2-rule-action` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group references take OverrideAction, every other rule takes Action; each action object names exactly one action | none |
+| `pf-wafv2-rule-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule priorities and names must be unique within a web ACL / rule group | none |
+| `pf-wafv2-scope-region` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Scope CLOUDFRONT is only accepted in us-east-1 | none |
+| `pf-wafv2-statement-exactly-one` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement, FieldToMatch, MatchPattern and custom-key objects name exactly one alternative | none |
+| `pf-wafv2-statement-limits` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement limits: 50 country codes, 30-character query argument names, 50 reference statements per web ACL / rule group, unique header and cookie filters | none |
+| `pf-wafv2-statement-nesting` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | And/Or need two nested statements; managed rule group, rule group reference and rate-based statements cannot be nested | none |
+| `pf-wafv2-text-transformations` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Text transformations: unique priorities, at most 10, and pre-parse transformations only on query-argument components with pre-parse types | none |
+| `pf-wafv2-token-domains` | AWS::WAFv2::WebACL | Token domains must be registrable domains (no bare labels, TLDs or public suffixes), at most 10 | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.34" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.36" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/lib/private/enforce.d.ts

@@ -15,10 +15,12 @@ export declare const DEPLOY_ENV_MODULE_NAME = "_pf_deploy_environment";
  * region is concrete; the warn mode (CDK built-in plugin) never injects it,
  * so region-dependent rules only fire in enforce mode.
  */
-export declare function deployEnvironmentModule(region: string): {
+export declare function deployEnvironmentModule(region: string, accountId?: string): {
     name: string;
     content: string;
 };
+/** Whether the account from the validation context is a concrete 12-digit account id. */
+export declare function isConcreteAccount(accountId: string | undefined): accountId is string;
 /**
  * Whether the region from the validation context is a concrete region name
  * (as opposed to undefined, an unresolved token, or a placeholder).

package/lib/private/enforce.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PreflightEnforcePlugin = exports.DEPLOY_ENV_MODULE_NAME = void 0;
 exports.deployEnvironmentModule = deployEnvironmentModule;
+exports.isConcreteAccount = isConcreteAccount;
 exports.isConcreteRegion = isConcreteRegion;
 exports.loadEngine = loadEngine;
 const path = __importStar(require("path"));
@@ -57,12 +58,17 @@ exports.DEPLOY_ENV_MODULE_NAME = '_pf_deploy_environment';
  * region is concrete; the warn mode (CDK built-in plugin) never injects it,
  * so region-dependent rules only fire in enforce mode.
  */
-function deployEnvironmentModule(region) {
+function deployEnvironmentModule(region, accountId) {
+    const account = isConcreteAccount(accountId) ? `deploy_account := ${JSON.stringify(accountId)}\n` : '';
     return {
         name: exports.DEPLOY_ENV_MODULE_NAME,
-        content: `package cdk_preflight\n\nimport rego.v1\n\ndeploy_region := ${JSON.stringify(region)}\n`,
+        content: `package cdk_preflight\n\nimport rego.v1\n\ndeploy_region := ${JSON.stringify(region)}\n${account}`,
     };
 }
+/** Whether the account from the validation context is a concrete 12-digit account id. */
+function isConcreteAccount(accountId) {
+    return typeof accountId === 'string' && /^\d{12}$/.test(accountId);
+}
 /**
  * Whether the region from the validation context is a concrete region name
  * (as opposed to undefined, an unresolved token, or a placeholder).
@@ -96,7 +102,8 @@ class PreflightEnforcePlugin {
             return { success: true, violations: [] };
         }
         const region = isConcreteRegion(context.region) ? context.region : undefined;
-        const eng = regoEngineCached(engine, this.rules, region);
+        const account = isConcreteAccount(context.accountId) ? context.accountId : undefined;
+        const eng = regoEngineCached(engine, this.rules, region, account);
         const ours = new Set(this.rules.map((r) => r.id));
         const violations = [];
         for (const st of context.stackTemplates) {
@@ -139,15 +146,15 @@ function loadEngineCached() {
     return cachedEngineModule === false ? undefined : cachedEngineModule;
 }
 const regoEngineCache = new Map();
-function regoEngineCached(engineModule, rules, region) {
-    const key = `${region ?? ''}|${rules.map((r) => r.id).join(',')}`;
+function regoEngineCached(engineModule, rules, region, account) {
+    const key = `${region ?? ''}|${account ?? ''}|${rules.map((r) => r.id).join(',')}`;
     if (!regoEngineCache.has(key)) {
         const customRules = [
             ...rules_generated_1.BUNDLED_LIBS.map((l) => ({ name: l.name, content: l.rego })),
             ...rules.map((r) => ({ name: r.id, content: r.rego })),
         ];
         if (region !== undefined) {
-            customRules.push(deployEnvironmentModule(region));
+            customRules.push(deployEnvironmentModule(region, account));
         }
         regoEngineCache.set(key, new engineModule.RegoEngine({ customRules }));
     }
@@ -176,4 +183,4 @@ function loadEngine() {
         return undefined;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL2VuZm9yY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBNkJBLDBEQUtDO0FBTUQsNENBRUM7QUEwR0QsZ0NBZUM7QUFuS0QsMkNBQTZCO0FBTzdCLHdEQUF3RTtBQUV4RSwwREFBMEQ7QUFDMUQ7OERBQzhEO0FBRTlEOzs7R0FHRztBQUNVLFFBQUEsc0JBQXNCLEdBQUcsd0JBQXdCLENBQUM7QUFFL0Q7Ozs7Ozs7OztHQVNHO0FBQ0gsU0FBZ0IsdUJBQXVCLENBQUMsTUFBYztJQUNwRCxPQUFPO1FBQ0wsSUFBSSxFQUFFLDhCQUFzQjtRQUM1QixPQUFPLEVBQUUsK0RBQStELElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUk7S0FDbkcsQ0FBQztBQUNKLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixnQkFBZ0IsQ0FBQyxNQUEwQjtJQUN6RCxPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSwwQkFBMEIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDL0UsQ0FBQztBQVlEOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLHNCQUFzQjtJQUlkO0lBQ0E7SUFKSCxJQUFJLEdBQUcsZUFBZSxDQUFDO0lBRXZDLFlBQ21CLEtBQXdCLEVBQ3hCLE1BQWU7UUFEZixVQUFLLEdBQUwsS0FBSyxDQUFtQjtRQUN4QixXQUFNLEdBQU4sTUFBTSxDQUFTO0lBQy9CLENBQUM7SUFFRyxRQUFRLENBQUMsT0FBaUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixzQ0FBc0M7WUFDdEMsT0FBTyxDQUFDLEtBQUssQ0FDWCxpRUFBaUU7Z0JBQ2pFLGdFQUFnRTtnQkFDaEUsK0RBQStELENBQ2hFLENBQUM7WUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDM0MsQ0FBQztRQUVELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzdFLE1BQU0sR0FBRyxHQUFHLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3pELE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNsRCxNQUFNLFVBQVUsR0FBc0IsRUFBRSxDQUFDO1FBRXpDLEtBQUssTUFBTSxFQUFFLElBQUksT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxFQUFFO2dCQUM1RSx3QkFBd0IsRUFBRTtvQkFDeEIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO29CQUM1QixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU07aUJBQ3ZCO2FBQ0YsQ0FBQyxDQUFDO1lBQ0gsS0FBSyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLElBQUksRUFBRSxDQUF1QixFQUFFLENBQUM7Z0JBQ2pFLE1BQU0sTUFBTSxHQUFHLENBQUMsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUMzRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsTUFBTTt1QkFDMUIsQ0FBQyxDQUFDLE1BQU0sS0FBSyxRQUFRO3VCQUNyQixDQUFDLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLENBQUM7Z0JBQ3hELElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxXQUFXO29CQUFFLFNBQVM7Z0JBQ3RDLFVBQVUsQ0FBQyxJQUFJLENBQUM7b0JBQ2QsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNO29CQUNsQixXQUFXLEVBQUUsQ0FBQyxDQUFDLE9BQU87b0JBQ3RCLFFBQVEsRUFBRSxPQUFPO29CQUNqQixrQkFBa0IsRUFBRSxDQUFDOzRCQUNuQixpQkFBaUIsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLFNBQVMsSUFBSSxXQUFXOzRCQUNyRCxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVk7NEJBQzdCLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDO3lCQUM1QyxDQUFDO29CQUNGLEdBQUcsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2lCQUMxRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDMUQsQ0FBQztDQUNGO0FBdERELHdEQXNEQztBQUVELHVDQUF1QztBQUN2QyxJQUFJLGtCQUEyQyxDQUFDO0FBQ2hELFNBQVMsZ0JBQWdCO0lBQ3ZCLElBQUksa0JBQWtCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDckMsa0JBQWtCLEdBQUcsVUFBVSxFQUFFLElBQUksS0FBSyxDQUFDO0lBQzdDLENBQUM7SUFDRCxPQUFPLGtCQUFrQixLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQztBQUN2RSxDQUFDO0FBRUQsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQWUsQ0FBQztBQUMvQyxTQUFTLGdCQUFnQixDQUFDLFlBQWlCLEVBQUUsS0FBd0IsRUFBRSxNQUFlO0lBQ3BGLE1BQU0sR0FBRyxHQUFHLEdBQUcsTUFBTSxJQUFJLEVBQUUsSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7SUFDbEUsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QixNQUFNLFdBQVcsR0FBRztZQUNsQixHQUFHLDhCQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQy9ELEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztTQUN2RCxDQUFDO1FBQ0YsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekIsV0FBVyxDQUFDLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxJQUFJLFlBQVksQ0FBQyxVQUFVLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE9BQU8sZUFBZSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNsQyxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQWdCLFVBQVU7SUFDeEIsSUFBSSxDQUFDO1FBQ0gsT0FBTyxPQUFPLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsZUFBZTtJQUNqQixDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1FBQzNELE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsMkNBQTJDLEVBQUU7WUFDMUUsS0FBSyxFQUFFLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztTQUM5QixDQUFDLENBQUM7UUFDSCxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDdkMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgcGF0aCBmcm9tICdwYXRoJztcbmltcG9ydCB0eXBlIHtcbiAgSVBvbGljeVZhbGlkYXRpb25Db250ZXh0LFxuICBJUG9saWN5VmFsaWRhdGlvblBsdWdpbixcbiAgUG9saWN5VmFsaWRhdGlvblBsdWdpblJlcG9ydCxcbiAgUG9saWN5VmlvbGF0aW9uLFxufSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBCVU5ETEVEX0xJQlMsIHR5cGUgQnVuZGxlZFJ1bGVEYXRhIH0gZnJvbSAnLi4vcnVsZXMuZ2VuZXJhdGVkJztcblxuLyogZXNsaW50LWRpc2FibGUgQHR5cGVzY3JpcHQtZXNsaW50L25vLXJlcXVpcmUtaW1wb3J0cyAqL1xuLyogZXNsaW50LWRpc2FibGUgaW1wb3J0L25vLWV4dHJhbmVvdXMtZGVwZW5kZW5jaWVzIC0tIEBhd3MvY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUg44GvXG4gICBhd3MtY2RrLWxpYiDlkIzmorHjgrPjg5Tjg7zjgpLli5XnmoTop6PmsbrjgZnjgovoqK3oqIjvvIjkvp3lrZjjgavjga/ovInjgZvjgarjgYTvvInjgIJSRUFETUUvQUdFTlRTLm1kIOWPgueFpyAqL1xuXG4vKipcbiAqIFRoZSBuYW1lIG9mIHRoZSBnZW5lcmF0ZWQgUmVnbyBtb2R1bGUgdGhhdCBjYXJyaWVzIHRoZSBkZXBsb3ltZW50XG4gKiBlbnZpcm9ubWVudCBpbnRvIHJ1bGUgZXZhbHVhdGlvbi5cbiAqL1xuZXhwb3J0IGNvbnN0IERFUExPWV9FTlZfTU9EVUxFX05BTUUgPSAnX3BmX2RlcGxveV9lbnZpcm9ubWVudCc7XG5cbi8qKlxuICogQnVpbGQgdGhlIGdlbmVyYXRlZCBtb2R1bGUgZGVmaW5pbmcgYGRlcGxveV9yZWdpb25gIGZvciB0aGUgcnVsZSBwYWNrYWdlLlxuICpcbiAqIFJ1bGVzIG11c3QgcmVhZCBpdCBhcyBgZGF0YS5jZGtfcHJlZmxpZ2h0LmRlcGxveV9yZWdpb25gIChuZXZlciBhcyBhIGJhcmVcbiAqIHZhcmlhYmxlKTogdGhlIGRhdGEgcmVmZXJlbmNlIGlzIHNpbXBseSB1bmRlZmluZWQgd2hlbiB0aGUgbW9kdWxlIGlzIG5vdFxuICogaW5qZWN0ZWQg4oCUIHRoZSBydWxlIGJvZHkgZmFpbHMgYW5kIHRoZSBydWxlIHNraXBzIOKAlCB3aGlsZSBhIGJhcmUgdmFyaWFibGVcbiAqIHdvdWxkIGJlIGEgY29tcGlsZSBlcnJvci4gSW5qZWN0ZWQgYnkgdGhlIGVuZm9yY2UgcGx1Z2luIHdoZW4gdGhlIGFwcC1sZXZlbFxuICogcmVnaW9uIGlzIGNvbmNyZXRlOyB0aGUgd2FybiBtb2RlIChDREsgYnVpbHQtaW4gcGx1Z2luKSBuZXZlciBpbmplY3RzIGl0LFxuICogc28gcmVnaW9uLWRlcGVuZGVudCBydWxlcyBvbmx5IGZpcmUgaW4gZW5mb3JjZSBtb2RlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZGVwbG95RW52aXJvbm1lbnRNb2R1bGUocmVnaW9uOiBzdHJpbmcpOiB7IG5hbWU6IHN0cmluZzsgY29udGVudDogc3RyaW5nIH0ge1xuICByZXR1cm4ge1xuICAgIG5hbWU6IERFUExPWV9FTlZfTU9EVUxFX05BTUUsXG4gICAgY29udGVudDogYHBhY2thZ2UgY2RrX3ByZWZsaWdodFxcblxcbmltcG9ydCByZWdvLnYxXFxuXFxuZGVwbG95X3JlZ2lvbiA6PSAke0pTT04uc3RyaW5naWZ5KHJlZ2lvbil9XFxuYCxcbiAgfTtcbn1cblxuLyoqXG4gKiBXaGV0aGVyIHRoZSByZWdpb24gZnJvbSB0aGUgdmFsaWRhdGlvbiBjb250ZXh0IGlzIGEgY29uY3JldGUgcmVnaW9uIG5hbWVcbiAqIChhcyBvcHBvc2VkIHRvIHVuZGVmaW5lZCwgYW4gdW5yZXNvbHZlZCB0b2tlbiwgb3IgYSBwbGFjZWhvbGRlcikuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc0NvbmNyZXRlUmVnaW9uKHJlZ2lvbjogc3RyaW5nIHwgdW5kZWZpbmVkKTogcmVnaW9uIGlzIHN0cmluZyB7XG4gIHJldHVybiB0eXBlb2YgcmVnaW9uID09PSAnc3RyaW5nJyAmJiAvXlthLXpdezJ9KC1bYS16XSspKy1cXGQrJC8udGVzdChyZWdpb24pO1xufVxuXG5pbnRlcmZhY2UgRW5naW5lRGlhZ25vc3RpYyB7XG4gIHJlYWRvbmx5IHJ1bGVJZDogc3RyaW5nO1xuICByZWFkb25seSBzZXZlcml0eTogc3RyaW5nO1xuICByZWFkb25seSBtZXNzYWdlOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHNvdXJjZT86IHN0cmluZztcbiAgcmVhZG9ubHkgZW50aXR5PzogeyByZWFkb25seSBsb2dpY2FsSWQ/OiBzdHJpbmcgfTtcbiAgcmVhZG9ubHkgcHJvcGVydHlQYXRoPzogc3RyaW5nO1xuICByZWFkb25seSBkb2N1bWVudGF0aW9uVXJsPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIGVuZm9yY2Ug44Oi44O844OJ55So44Gu5YaF6YOo44OX44Op44Kw44Kk44Oz44CCXG4gKlxuICogQ0RLIOe1hOOBv+i+vOOBv+OBriBDbG91ZEZvcm1hdGlvblZhbGlkYXRlUGx1Z2luIOOBr+WFqCBmaW5kaW5nIOOCkiB3YXJuaW5nIOOBq+S4uOOCgeOCi+OBn+OCgVxuICog77yIYXdzLWNkay1saWIgMi4yNjcuMCDlrp/muKzjgIHmmIfmoLzjg5Xjg6njgrDjgoLnhKHlirnvvInjgIHlkIzjgZjjgqjjg7Pjgrjjg7PjgpLnm7TmjqXlkbzjgbPjgIFcbiAqIGNkay1wcmVmbGlnaHQg44Gu44Or44O844Or6YGV5Y+N77yI44GK44KI44GzIHN0cmljdCDmmYLjga/jgqjjg7Pjgrjjg7Pjga7jgqjjg6njg7zjgq/jg6njgrnvvInjgpJcbiAqIHBvbGljeSB2YWxpZGF0aW9uIOOBruWkseaVl+OBqOOBl+OBpuWgseWRiuOBl+OBpiBzeW50aCDjgpLmraLjgoHjgovjgIJcbiAqL1xuZXhwb3J0IGNsYXNzIFByZWZsaWdodEVuZm9yY2VQbHVnaW4gaW1wbGVtZW50cyBJUG9saWN5VmFsaWRhdGlvblBsdWdpbiB7XG4gIHB1YmxpYyByZWFkb25seSBuYW1lID0gJ2Nkay1wcmVmbGlnaHQnO1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgc3RyaWN0OiBib29sZWFuLFxuICApIHt9XG5cbiAgcHVibGljIHZhbGlkYXRlKGNvbnRleHQ6IElQb2xpY3lWYWxpZGF0aW9uQ29udGV4dCk6IFBvbGljeVZhbGlkYXRpb25QbHVnaW5SZXBvcnQge1xuICAgIGNvbnN0IGVuZ2luZSA9IGxvYWRFbmdpbmVDYWNoZWQoKTtcbiAgICBpZiAoIWVuZ2luZSkge1xuICAgICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIG5vLWNvbnNvbGVcbiAgICAgIGNvbnNvbGUuZXJyb3IoXG4gICAgICAgICdjZGstcHJlZmxpZ2h0OiBjb3VsZCBub3QgcmVzb2x2ZSBAYXdzL2Nsb3VkZm9ybWF0aW9uLXZhbGlkYXRlOyAnICtcbiAgICAgICAgJ2VuZm9yY2UgbW9kZSBpcyB1bmF2YWlsYWJsZSBhbmQgbm8gcHJlZmxpZ2h0IGNoZWNrcyB3ZXJlIHJ1bi4gJyArXG4gICAgICAgICdJbnN0YWxsIGl0IGFzIGEgZGV2RGVwZW5kZW5jeSBvciB1c2UgdGhlIGRlZmF1bHQgKHdhcm4pIG1vZGUuJyxcbiAgICAgICk7XG4gICAgICByZXR1cm4geyBzdWNjZXNzOiB0cnVlLCB2aW9sYXRpb25zOiBbXSB9O1xuICAgIH1cblxuICAgIGNvbnN0IHJlZ2lvbiA9IGlzQ29uY3JldGVSZWdpb24oY29udGV4dC5yZWdpb24pID8gY29udGV4dC5yZWdpb24gOiB1bmRlZmluZWQ7XG4gICAgY29uc3QgZW5nID0gcmVnb0VuZ2luZUNhY2hlZChlbmdpbmUsIHRoaXMucnVsZXMsIHJlZ2lvbik7XG4gICAgY29uc3Qgb3VycyA9IG5ldyBTZXQodGhpcy5ydWxlcy5tYXAoKHIpID0+IHIuaWQpKTtcbiAgICBjb25zdCB2aW9sYXRpb25zOiBQb2xpY3lWaW9sYXRpb25bXSA9IFtdO1xuXG4gICAgZm9yIChjb25zdCBzdCBvZiBjb250ZXh0LnN0YWNrVGVtcGxhdGVzKSB7XG4gICAgICBjb25zdCByZXBvcnQgPSBlbmcudmFsaWRhdGVEZXRhaWxlZChuZXcgZW5naW5lLlRlbXBsYXRlRmlsZShzdC50ZW1wbGF0ZVBhdGgpLCB7XG4gICAgICAgIHBzZXVkb1BhcmFtZXRlck92ZXJyaWRlczoge1xuICAgICAgICAgIGFjY291bnRJZDogY29udGV4dC5hY2NvdW50SWQsXG4gICAgICAgICAgcmVnaW9uOiBjb250ZXh0LnJlZ2lvbixcbiAgICAgICAgfSxcbiAgICAgIH0pO1xuICAgICAgZm9yIChjb25zdCBkIG9mIChyZXBvcnQuZGlhZ25vc3RpY3MgPz8gW10pIGFzIEVuZ2luZURpYWdub3N0aWNbXSkge1xuICAgICAgICBjb25zdCBpc091cnMgPSBkLnNvdXJjZSA9PT0gJ0NVU1RPTScgJiYgb3Vycy5oYXMoZC5ydWxlSWQpO1xuICAgICAgICBjb25zdCBpc1N0cmljdEhpdCA9IHRoaXMuc3RyaWN0XG4gICAgICAgICAgJiYgZC5zb3VyY2UgIT09ICdDVVNUT00nXG4gICAgICAgICAgJiYgKGQuc2V2ZXJpdHkgPT09ICdFUlJPUicgfHwgZC5zZXZlcml0eSA9PT0gJ0ZBVEFMJyk7XG4gICAgICAgIGlmICghaXNPdXJzICYmICFpc1N0cmljdEhpdCkgY29udGludWU7XG4gICAgICAgIHZpb2xhdGlvbnMucHVzaCh7XG4gICAgICAgICAgcnVsZU5hbWU6IGQucnVsZUlkLFxuICAgICAgICAgIGRlc2NyaXB0aW9uOiBkLm1lc3NhZ2UsXG4gICAgICAgICAgc2V2ZXJpdHk6ICdlcnJvcicsXG4gICAgICAgICAgdmlvbGF0aW5nUmVzb3VyY2VzOiBbe1xuICAgICAgICAgICAgcmVzb3VyY2VMb2dpY2FsSWQ6IGQuZW50aXR5Py5sb2dpY2FsSWQgPz8gJyh1bmtub3duKScsXG4gICAgICAgICAgICB0ZW1wbGF0ZVBhdGg6IHN0LnRlbXBsYXRlUGF0aCxcbiAgICAgICAgICAgIGxvY2F0aW9uczogW2QucHJvcGVydHlQYXRoID8/ICcodGVtcGxhdGUpJ10sXG4gICAgICAgICAgfV0sXG4gICAgICAgICAgLi4uKGQuZG9jdW1lbnRhdGlvblVybCA/IHsgcnVsZU1ldGFkYXRhOiB7IERvY3VtZW50YXRpb25Vcmw6IGQuZG9jdW1lbnRhdGlvblVybCB9IH0gOiB7fSksXG4gICAgICAgIH0pO1xuICAgICAgfVxuICAgIH1cblxuICAgIHJldHVybiB7IHN1Y2Nlc3M6IHZpb2xhdGlvbnMubGVuZ3RoID09PSAwLCB2aW9sYXRpb25zIH07XG4gIH1cbn1cblxuLy8g44Ko44Oz44K444Oz77yIV0FTTe+8ieOBruWIneacn+WMluOBr+mHjeOBhOOBn+OCgeOAgeODouOCuOODpeODvOODq+ODrOODmeODq+OBp+OCreODo+ODg+OCt+ODpeOBmeOCi1xubGV0IGNhY2hlZEVuZ2luZU1vZHVsZTogYW55IHwgZmFsc2UgfCB1bmRlZmluZWQ7XG5mdW5jdGlvbiBsb2FkRW5naW5lQ2FjaGVkKCk6IGFueSB8IHVuZGVmaW5lZCB7XG4gIGlmIChjYWNoZWRFbmdpbmVNb2R1bGUgPT09IHVuZGVmaW5lZCkge1xuICAgIGNhY2hlZEVuZ2luZU1vZHVsZSA9IGxvYWRFbmdpbmUoKSA/PyBmYWxzZTtcbiAgfVxuICByZXR1cm4gY2FjaGVkRW5naW5lTW9kdWxlID09PSBmYWxzZSA/IHVuZGVmaW5lZCA6IGNhY2hlZEVuZ2luZU1vZHVsZTtcbn1cblxuY29uc3QgcmVnb0VuZ2luZUNhY2hlID0gbmV3IE1hcDxzdHJpbmcsIGFueT4oKTtcbmZ1bmN0aW9uIHJlZ29FbmdpbmVDYWNoZWQoZW5naW5lTW9kdWxlOiBhbnksIHJ1bGVzOiBCdW5kbGVkUnVsZURhdGFbXSwgcmVnaW9uPzogc3RyaW5nKTogYW55IHtcbiAgY29uc3Qga2V5ID0gYCR7cmVnaW9uID8/ICcnfXwke3J1bGVzLm1hcCgocikgPT4gci5pZCkuam9pbignLCcpfWA7XG4gIGlmICghcmVnb0VuZ2luZUNhY2hlLmhhcyhrZXkpKSB7XG4gICAgY29uc3QgY3VzdG9tUnVsZXMgPSBbXG4gICAgICAuLi5CVU5ETEVEX0xJQlMubWFwKChsKSA9PiAoeyBuYW1lOiBsLm5hbWUsIGNvbnRlbnQ6IGwucmVnbyB9KSksXG4gICAgICAuLi5ydWxlcy5tYXAoKHIpID0+ICh7IG5hbWU6IHIuaWQsIGNvbnRlbnQ6IHIucmVnbyB9KSksXG4gICAgXTtcbiAgICBpZiAocmVnaW9uICE9PSB1bmRlZmluZWQpIHtcbiAgICAgIGN1c3RvbVJ1bGVzLnB1c2goZGVwbG95RW52aXJvbm1lbnRNb2R1bGUocmVnaW9uKSk7XG4gICAgfVxuICAgIHJlZ29FbmdpbmVDYWNoZS5zZXQoa2V5LCBuZXcgZW5naW5lTW9kdWxlLlJlZ29FbmdpbmUoeyBjdXN0b21SdWxlcyB9KSk7XG4gIH1cbiAgcmV0dXJuIHJlZ29FbmdpbmVDYWNoZS5nZXQoa2V5KTtcbn1cblxuLyoqXG4gKiBAYXdzL2Nsb3VkZm9ybWF0aW9uLXZhbGlkYXRlIOOCkuino+axuuOBmeOCi+OAglxuICog6YCa5bi444GvIGF3cy1jZGstbGliIOOBjCBidW5kbGVkRGVwZW5kZW5jaWVzIOOBqOOBl+OBpuWQjOaiseOBl+OBpuOBhOOCi+OCs+ODlOODvOOBq+S5l+OCi+OAglxuICog77yI44OG44K544OI44GL44KJ44KC5Yip55So44GZ44KL44Gf44KBIGV4cG9ydCDjgZfjgabjgYTjgovvvIlcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGxvYWRFbmdpbmUoKTogYW55IHwgdW5kZWZpbmVkIHtcbiAgdHJ5IHtcbiAgICByZXR1cm4gcmVxdWlyZSgnQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZScpO1xuICB9IGNhdGNoIHtcbiAgICAvLyBmYWxsIHRocm91Z2hcbiAgfVxuICB0cnkge1xuICAgIGNvbnN0IGxpYlBrZyA9IHJlcXVpcmUucmVzb2x2ZSgnYXdzLWNkay1saWIvcGFja2FnZS5qc29uJyk7XG4gICAgY29uc3QgZW5nUGtnID0gcmVxdWlyZS5yZXNvbHZlKCdAYXdzL2Nsb3VkZm9ybWF0aW9uLXZhbGlkYXRlL3BhY2thZ2UuanNvbicsIHtcbiAgICAgIHBhdGhzOiBbcGF0aC5kaXJuYW1lKGxpYlBrZyldLFxuICAgIH0pO1xuICAgIHJldHVybiByZXF1aXJlKHBhdGguZGlybmFtZShlbmdQa2cpKTtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL2VuZm9yY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBNkJBLDBEQU1DO0FBR0QsOENBRUM7QUFNRCw0Q0FFQztBQTJHRCxnQ0FlQztBQTFLRCwyQ0FBNkI7QUFPN0Isd0RBQXdFO0FBRXhFLDBEQUEwRDtBQUMxRDs4REFDOEQ7QUFFOUQ7OztHQUdHO0FBQ1UsUUFBQSxzQkFBc0IsR0FBRyx3QkFBd0IsQ0FBQztBQUUvRDs7Ozs7Ozs7O0dBU0c7QUFDSCxTQUFnQix1QkFBdUIsQ0FBQyxNQUFjLEVBQUUsU0FBa0I7SUFDeEUsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUN2RyxPQUFPO1FBQ0wsSUFBSSxFQUFFLDhCQUFzQjtRQUM1QixPQUFPLEVBQUUsK0RBQStELElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssT0FBTyxFQUFFO0tBQzdHLENBQUM7QUFDSixDQUFDO0FBRUQseUZBQXlGO0FBQ3pGLFNBQWdCLGlCQUFpQixDQUFDLFNBQTZCO0lBQzdELE9BQU8sT0FBTyxTQUFTLEtBQUssUUFBUSxJQUFJLFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQWdCLGdCQUFnQixDQUFDLE1BQTBCO0lBQ3pELE9BQU8sT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLDBCQUEwQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUMvRSxDQUFDO0FBWUQ7Ozs7Ozs7R0FPRztBQUNILE1BQWEsc0JBQXNCO0lBSWQ7SUFDQTtJQUpILElBQUksR0FBRyxlQUFlLENBQUM7SUFFdkMsWUFDbUIsS0FBd0IsRUFDeEIsTUFBZTtRQURmLFVBQUssR0FBTCxLQUFLLENBQW1CO1FBQ3hCLFdBQU0sR0FBTixNQUFNLENBQVM7SUFDL0IsQ0FBQztJQUVHLFFBQVEsQ0FBQyxPQUFpQztRQUMvQyxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLHNDQUFzQztZQUN0QyxPQUFPLENBQUMsS0FBSyxDQUNYLGlFQUFpRTtnQkFDakUsZ0VBQWdFO2dCQUNoRSwrREFBK0QsQ0FDaEUsQ0FBQztZQUNGLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQztRQUMzQyxDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDN0UsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDckYsTUFBTSxHQUFHLEdBQUcsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNsRCxNQUFNLFVBQVUsR0FBc0IsRUFBRSxDQUFDO1FBRXpDLEtBQUssTUFBTSxFQUFFLElBQUksT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxFQUFFO2dCQUM1RSx3QkFBd0IsRUFBRTtvQkFDeEIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO29CQUM1QixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU07aUJBQ3ZCO2FBQ0YsQ0FBQyxDQUFDO1lBQ0gsS0FBSyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLElBQUksRUFBRSxDQUF1QixFQUFFLENBQUM7Z0JBQ2pFLE1BQU0sTUFBTSxHQUFHLENBQUMsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUMzRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsTUFBTTt1QkFDMUIsQ0FBQyxDQUFDLE1BQU0sS0FBSyxRQUFRO3VCQUNyQixDQUFDLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLENBQUM7Z0JBQ3hELElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxXQUFXO29CQUFFLFNBQVM7Z0JBQ3RDLFVBQVUsQ0FBQyxJQUFJLENBQUM7b0JBQ2QsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNO29CQUNsQixXQUFXLEVBQUUsQ0FBQyxDQUFDLE9BQU87b0JBQ3RCLFFBQVEsRUFBRSxPQUFPO29CQUNqQixrQkFBa0IsRUFBRSxDQUFDOzRCQUNuQixpQkFBaUIsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLFNBQVMsSUFBSSxXQUFXOzRCQUNyRCxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVk7NEJBQzdCLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDO3lCQUM1QyxDQUFDO29CQUNGLEdBQUcsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2lCQUMxRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDMUQsQ0FBQztDQUNGO0FBdkRELHdEQXVEQztBQUVELHVDQUF1QztBQUN2QyxJQUFJLGtCQUEyQyxDQUFDO0FBQ2hELFNBQVMsZ0JBQWdCO0lBQ3ZCLElBQUksa0JBQWtCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDckMsa0JBQWtCLEdBQUcsVUFBVSxFQUFFLElBQUksS0FBSyxDQUFDO0lBQzdDLENBQUM7SUFDRCxPQUFPLGtCQUFrQixLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQztBQUN2RSxDQUFDO0FBRUQsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQWUsQ0FBQztBQUMvQyxTQUFTLGdCQUFnQixDQUFDLFlBQWlCLEVBQUUsS0FBd0IsRUFBRSxNQUFlLEVBQUUsT0FBZ0I7SUFDdEcsTUFBTSxHQUFHLEdBQUcsR0FBRyxNQUFNLElBQUksRUFBRSxJQUFJLE9BQU8sSUFBSSxFQUFFLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ25GLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDOUIsTUFBTSxXQUFXLEdBQUc7WUFDbEIsR0FBRyw4QkFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUMvRCxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7U0FDdkQsQ0FBQztRQUNGLElBQUksTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pCLFdBQVcsQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUNELGVBQWUsQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksWUFBWSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBZ0IsVUFBVTtJQUN4QixJQUFJLENBQUM7UUFDSCxPQUFPLE9BQU8sQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxlQUFlO0lBQ2pCLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDM0QsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQywyQ0FBMkMsRUFBRTtZQUMxRSxLQUFLLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1NBQzlCLENBQUMsQ0FBQztRQUNILE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHR5cGUge1xuICBJUG9saWN5VmFsaWRhdGlvbkNvbnRleHQsXG4gIElQb2xpY3lWYWxpZGF0aW9uUGx1Z2luLFxuICBQb2xpY3lWYWxpZGF0aW9uUGx1Z2luUmVwb3J0LFxuICBQb2xpY3lWaW9sYXRpb24sXG59IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IEJVTkRMRURfTElCUywgdHlwZSBCdW5kbGVkUnVsZURhdGEgfSBmcm9tICcuLi9ydWxlcy5nZW5lcmF0ZWQnO1xuXG4vKiBlc2xpbnQtZGlzYWJsZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzICovXG4vKiBlc2xpbnQtZGlzYWJsZSBpbXBvcnQvbm8tZXh0cmFuZW91cy1kZXBlbmRlbmNpZXMgLS0gQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSDjga9cbiAgIGF3cy1jZGstbGliIOWQjOaiseOCs+ODlOODvOOCkuWLleeahOino+axuuOBmeOCi+ioreioiO+8iOS+neWtmOOBq+OBr+i8ieOBm+OBquOBhO+8ieOAglJFQURNRS9BR0VOVFMubWQg5Y+C54WnICovXG5cbi8qKlxuICogVGhlIG5hbWUgb2YgdGhlIGdlbmVyYXRlZCBSZWdvIG1vZHVsZSB0aGF0IGNhcnJpZXMgdGhlIGRlcGxveW1lbnRcbiAqIGVudmlyb25tZW50IGludG8gcnVsZSBldmFsdWF0aW9uLlxuICovXG5leHBvcnQgY29uc3QgREVQTE9ZX0VOVl9NT0RVTEVfTkFNRSA9ICdfcGZfZGVwbG95X2Vudmlyb25tZW50JztcblxuLyoqXG4gKiBCdWlsZCB0aGUgZ2VuZXJhdGVkIG1vZHVsZSBkZWZpbmluZyBgZGVwbG95X3JlZ2lvbmAgZm9yIHRoZSBydWxlIHBhY2thZ2UuXG4gKlxuICogUnVsZXMgbXVzdCByZWFkIGl0IGFzIGBkYXRhLmNka19wcmVmbGlnaHQuZGVwbG95X3JlZ2lvbmAgKG5ldmVyIGFzIGEgYmFyZVxuICogdmFyaWFibGUpOiB0aGUgZGF0YSByZWZlcmVuY2UgaXMgc2ltcGx5IHVuZGVmaW5lZCB3aGVuIHRoZSBtb2R1bGUgaXMgbm90XG4gKiBpbmplY3RlZCDigJQgdGhlIHJ1bGUgYm9keSBmYWlscyBhbmQgdGhlIHJ1bGUgc2tpcHMg4oCUIHdoaWxlIGEgYmFyZSB2YXJpYWJsZVxuICogd291bGQgYmUgYSBjb21waWxlIGVycm9yLiBJbmplY3RlZCBieSB0aGUgZW5mb3JjZSBwbHVnaW4gd2hlbiB0aGUgYXBwLWxldmVsXG4gKiByZWdpb24gaXMgY29uY3JldGU7IHRoZSB3YXJuIG1vZGUgKENESyBidWlsdC1pbiBwbHVnaW4pIG5ldmVyIGluamVjdHMgaXQsXG4gKiBzbyByZWdpb24tZGVwZW5kZW50IHJ1bGVzIG9ubHkgZmlyZSBpbiBlbmZvcmNlIG1vZGUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXBsb3lFbnZpcm9ubWVudE1vZHVsZShyZWdpb246IHN0cmluZywgYWNjb3VudElkPzogc3RyaW5nKTogeyBuYW1lOiBzdHJpbmc7IGNvbnRlbnQ6IHN0cmluZyB9IHtcbiAgY29uc3QgYWNjb3VudCA9IGlzQ29uY3JldGVBY2NvdW50KGFjY291bnRJZCkgPyBgZGVwbG95X2FjY291bnQgOj0gJHtKU09OLnN0cmluZ2lmeShhY2NvdW50SWQpfVxcbmAgOiAnJztcbiAgcmV0dXJuIHtcbiAgICBuYW1lOiBERVBMT1lfRU5WX01PRFVMRV9OQU1FLFxuICAgIGNvbnRlbnQ6IGBwYWNrYWdlIGNka19wcmVmbGlnaHRcXG5cXG5pbXBvcnQgcmVnby52MVxcblxcbmRlcGxveV9yZWdpb24gOj0gJHtKU09OLnN0cmluZ2lmeShyZWdpb24pfVxcbiR7YWNjb3VudH1gLFxuICB9O1xufVxuXG4vKiogV2hldGhlciB0aGUgYWNjb3VudCBmcm9tIHRoZSB2YWxpZGF0aW9uIGNvbnRleHQgaXMgYSBjb25jcmV0ZSAxMi1kaWdpdCBhY2NvdW50IGlkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzQ29uY3JldGVBY2NvdW50KGFjY291bnRJZDogc3RyaW5nIHwgdW5kZWZpbmVkKTogYWNjb3VudElkIGlzIHN0cmluZyB7XG4gIHJldHVybiB0eXBlb2YgYWNjb3VudElkID09PSAnc3RyaW5nJyAmJiAvXlxcZHsxMn0kLy50ZXN0KGFjY291bnRJZCk7XG59XG5cbi8qKlxuICogV2hldGhlciB0aGUgcmVnaW9uIGZyb20gdGhlIHZhbGlkYXRpb24gY29udGV4dCBpcyBhIGNvbmNyZXRlIHJlZ2lvbiBuYW1lXG4gKiAoYXMgb3Bwb3NlZCB0byB1bmRlZmluZWQsIGFuIHVucmVzb2x2ZWQgdG9rZW4sIG9yIGEgcGxhY2Vob2xkZXIpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNDb25jcmV0ZVJlZ2lvbihyZWdpb246IHN0cmluZyB8IHVuZGVmaW5lZCk6IHJlZ2lvbiBpcyBzdHJpbmcge1xuICByZXR1cm4gdHlwZW9mIHJlZ2lvbiA9PT0gJ3N0cmluZycgJiYgL15bYS16XXsyfSgtW2Etel0rKSstXFxkKyQvLnRlc3QocmVnaW9uKTtcbn1cblxuaW50ZXJmYWNlIEVuZ2luZURpYWdub3N0aWMge1xuICByZWFkb25seSBydWxlSWQ6IHN0cmluZztcbiAgcmVhZG9ubHkgc2V2ZXJpdHk6IHN0cmluZztcbiAgcmVhZG9ubHkgbWVzc2FnZTogc3RyaW5nO1xuICByZWFkb25seSBzb3VyY2U/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGVudGl0eT86IHsgcmVhZG9ubHkgbG9naWNhbElkPzogc3RyaW5nIH07XG4gIHJlYWRvbmx5IHByb3BlcnR5UGF0aD86IHN0cmluZztcbiAgcmVhZG9ubHkgZG9jdW1lbnRhdGlvblVybD86IHN0cmluZztcbn1cblxuLyoqXG4gKiBlbmZvcmNlIOODouODvOODieeUqOOBruWGhemDqOODl+ODqeOCsOOCpOODs+OAglxuICpcbiAqIENESyDntYTjgb/ovrzjgb/jga4gQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbiDjga/lhaggZmluZGluZyDjgpIgd2FybmluZyDjgavkuLjjgoHjgovjgZ/jgoFcbiAqIO+8iGF3cy1jZGstbGliIDIuMjY3LjAg5a6f5ris44CB5piH5qC844OV44Op44Kw44KC54Sh5Yq577yJ44CB5ZCM44GY44Ko44Oz44K444Oz44KS55u05o6l5ZG844Gz44CBXG4gKiBjZGstcHJlZmxpZ2h0IOOBruODq+ODvOODq+mBleWPje+8iOOBiuOCiOOBsyBzdHJpY3Qg5pmC44Gv44Ko44Oz44K444Oz44Gu44Ko44Op44O844Kv44Op44K577yJ44KSXG4gKiBwb2xpY3kgdmFsaWRhdGlvbiDjga7lpLHmlZfjgajjgZfjgabloLHlkYrjgZfjgaYgc3ludGgg44KS5q2i44KB44KL44CCXG4gKi9cbmV4cG9ydCBjbGFzcyBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIGltcGxlbWVudHMgSVBvbGljeVZhbGlkYXRpb25QbHVnaW4ge1xuICBwdWJsaWMgcmVhZG9ubHkgbmFtZSA9ICdjZGstcHJlZmxpZ2h0JztcblxuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IHJ1bGVzOiBCdW5kbGVkUnVsZURhdGFbXSxcbiAgICBwcml2YXRlIHJlYWRvbmx5IHN0cmljdDogYm9vbGVhbixcbiAgKSB7fVxuXG4gIHB1YmxpYyB2YWxpZGF0ZShjb250ZXh0OiBJUG9saWN5VmFsaWRhdGlvbkNvbnRleHQpOiBQb2xpY3lWYWxpZGF0aW9uUGx1Z2luUmVwb3J0IHtcbiAgICBjb25zdCBlbmdpbmUgPSBsb2FkRW5naW5lQ2FjaGVkKCk7XG4gICAgaWYgKCFlbmdpbmUpIHtcbiAgICAgIC8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBuby1jb25zb2xlXG4gICAgICBjb25zb2xlLmVycm9yKFxuICAgICAgICAnY2RrLXByZWZsaWdodDogY291bGQgbm90IHJlc29sdmUgQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZTsgJyArXG4gICAgICAgICdlbmZvcmNlIG1vZGUgaXMgdW5hdmFpbGFibGUgYW5kIG5vIHByZWZsaWdodCBjaGVja3Mgd2VyZSBydW4uICcgK1xuICAgICAgICAnSW5zdGFsbCBpdCBhcyBhIGRldkRlcGVuZGVuY3kgb3IgdXNlIHRoZSBkZWZhdWx0ICh3YXJuKSBtb2RlLicsXG4gICAgICApO1xuICAgICAgcmV0dXJuIHsgc3VjY2VzczogdHJ1ZSwgdmlvbGF0aW9uczogW10gfTtcbiAgICB9XG5cbiAgICBjb25zdCByZWdpb24gPSBpc0NvbmNyZXRlUmVnaW9uKGNvbnRleHQucmVnaW9uKSA/IGNvbnRleHQucmVnaW9uIDogdW5kZWZpbmVkO1xuICAgIGNvbnN0IGFjY291bnQgPSBpc0NvbmNyZXRlQWNjb3VudChjb250ZXh0LmFjY291bnRJZCkgPyBjb250ZXh0LmFjY291bnRJZCA6IHVuZGVmaW5lZDtcbiAgICBjb25zdCBlbmcgPSByZWdvRW5naW5lQ2FjaGVkKGVuZ2luZSwgdGhpcy5ydWxlcywgcmVnaW9uLCBhY2NvdW50KTtcbiAgICBjb25zdCBvdXJzID0gbmV3IFNldCh0aGlzLnJ1bGVzLm1hcCgocikgPT4gci5pZCkpO1xuICAgIGNvbnN0IHZpb2xhdGlvbnM6IFBvbGljeVZpb2xhdGlvbltdID0gW107XG5cbiAgICBmb3IgKGNvbnN0IHN0IG9mIGNvbnRleHQuc3RhY2tUZW1wbGF0ZXMpIHtcbiAgICAgIGNvbnN0IHJlcG9ydCA9IGVuZy52YWxpZGF0ZURldGFpbGVkKG5ldyBlbmdpbmUuVGVtcGxhdGVGaWxlKHN0LnRlbXBsYXRlUGF0aCksIHtcbiAgICAgICAgcHNldWRvUGFyYW1ldGVyT3ZlcnJpZGVzOiB7XG4gICAgICAgICAgYWNjb3VudElkOiBjb250ZXh0LmFjY291bnRJZCxcbiAgICAgICAgICByZWdpb246IGNvbnRleHQucmVnaW9uLFxuICAgICAgICB9LFxuICAgICAgfSk7XG4gICAgICBmb3IgKGNvbnN0IGQgb2YgKHJlcG9ydC5kaWFnbm9zdGljcyA/PyBbXSkgYXMgRW5naW5lRGlhZ25vc3RpY1tdKSB7XG4gICAgICAgIGNvbnN0IGlzT3VycyA9IGQuc291cmNlID09PSAnQ1VTVE9NJyAmJiBvdXJzLmhhcyhkLnJ1bGVJZCk7XG4gICAgICAgIGNvbnN0IGlzU3RyaWN0SGl0ID0gdGhpcy5zdHJpY3RcbiAgICAgICAgICAmJiBkLnNvdXJjZSAhPT0gJ0NVU1RPTSdcbiAgICAgICAgICAmJiAoZC5zZXZlcml0eSA9PT0gJ0VSUk9SJyB8fCBkLnNldmVyaXR5ID09PSAnRkFUQUwnKTtcbiAgICAgICAgaWYgKCFpc091cnMgJiYgIWlzU3RyaWN0SGl0KSBjb250aW51ZTtcbiAgICAgICAgdmlvbGF0aW9ucy5wdXNoKHtcbiAgICAgICAgICBydWxlTmFtZTogZC5ydWxlSWQsXG4gICAgICAgICAgZGVzY3JpcHRpb246IGQubWVzc2FnZSxcbiAgICAgICAgICBzZXZlcml0eTogJ2Vycm9yJyxcbiAgICAgICAgICB2aW9sYXRpbmdSZXNvdXJjZXM6IFt7XG4gICAgICAgICAgICByZXNvdXJjZUxvZ2ljYWxJZDogZC5lbnRpdHk/LmxvZ2ljYWxJZCA/PyAnKHVua25vd24pJyxcbiAgICAgICAgICAgIHRlbXBsYXRlUGF0aDogc3QudGVtcGxhdGVQYXRoLFxuICAgICAgICAgICAgbG9jYXRpb25zOiBbZC5wcm9wZXJ0eVBhdGggPz8gJyh0ZW1wbGF0ZSknXSxcbiAgICAgICAgICB9XSxcbiAgICAgICAgICAuLi4oZC5kb2N1bWVudGF0aW9uVXJsID8geyBydWxlTWV0YWRhdGE6IHsgRG9jdW1lbnRhdGlvblVybDogZC5kb2N1bWVudGF0aW9uVXJsIH0gfSA6IHt9KSxcbiAgICAgICAgfSk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgcmV0dXJuIHsgc3VjY2VzczogdmlvbGF0aW9ucy5sZW5ndGggPT09IDAsIHZpb2xhdGlvbnMgfTtcbiAgfVxufVxuXG4vLyDjgqjjg7Pjgrjjg7PvvIhXQVNN77yJ44Gu5Yid5pyf5YyW44Gv6YeN44GE44Gf44KB44CB44Oi44K444Ol44O844Or44Os44OZ44Or44Gn44Kt44Oj44OD44K344Ol44GZ44KLXG5sZXQgY2FjaGVkRW5naW5lTW9kdWxlOiBhbnkgfCBmYWxzZSB8IHVuZGVmaW5lZDtcbmZ1bmN0aW9uIGxvYWRFbmdpbmVDYWNoZWQoKTogYW55IHwgdW5kZWZpbmVkIHtcbiAgaWYgKGNhY2hlZEVuZ2luZU1vZHVsZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgY2FjaGVkRW5naW5lTW9kdWxlID0gbG9hZEVuZ2luZSgpID8/IGZhbHNlO1xuICB9XG4gIHJldHVybiBjYWNoZWRFbmdpbmVNb2R1bGUgPT09IGZhbHNlID8gdW5kZWZpbmVkIDogY2FjaGVkRW5naW5lTW9kdWxlO1xufVxuXG5jb25zdCByZWdvRW5naW5lQ2FjaGUgPSBuZXcgTWFwPHN0cmluZywgYW55PigpO1xuZnVuY3Rpb24gcmVnb0VuZ2luZUNhY2hlZChlbmdpbmVNb2R1bGU6IGFueSwgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdLCByZWdpb24/OiBzdHJpbmcsIGFjY291bnQ/OiBzdHJpbmcpOiBhbnkge1xuICBjb25zdCBrZXkgPSBgJHtyZWdpb24gPz8gJyd9fCR7YWNjb3VudCA/PyAnJ318JHtydWxlcy5tYXAoKHIpID0+IHIuaWQpLmpvaW4oJywnKX1gO1xuICBpZiAoIXJlZ29FbmdpbmVDYWNoZS5oYXMoa2V5KSkge1xuICAgIGNvbnN0IGN1c3RvbVJ1bGVzID0gW1xuICAgICAgLi4uQlVORExFRF9MSUJTLm1hcCgobCkgPT4gKHsgbmFtZTogbC5uYW1lLCBjb250ZW50OiBsLnJlZ28gfSkpLFxuICAgICAgLi4ucnVsZXMubWFwKChyKSA9PiAoeyBuYW1lOiByLmlkLCBjb250ZW50OiByLnJlZ28gfSkpLFxuICAgIF07XG4gICAgaWYgKHJlZ2lvbiAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICBjdXN0b21SdWxlcy5wdXNoKGRlcGxveUVudmlyb25tZW50TW9kdWxlKHJlZ2lvbiwgYWNjb3VudCkpO1xuICAgIH1cbiAgICByZWdvRW5naW5lQ2FjaGUuc2V0KGtleSwgbmV3IGVuZ2luZU1vZHVsZS5SZWdvRW5naW5lKHsgY3VzdG9tUnVsZXMgfSkpO1xuICB9XG4gIHJldHVybiByZWdvRW5naW5lQ2FjaGUuZ2V0KGtleSk7XG59XG5cbi8qKlxuICogQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSDjgpLop6PmsbrjgZnjgovjgIJcbiAqIOmAmuW4uOOBryBhd3MtY2RrLWxpYiDjgYwgYnVuZGxlZERlcGVuZGVuY2llcyDjgajjgZfjgablkIzmorHjgZfjgabjgYTjgovjgrPjg5Tjg7zjgavkuZfjgovjgIJcbiAqIO+8iOODhuOCueODiOOBi+OCieOCguWIqeeUqOOBmeOCi+OBn+OCgSBleHBvcnQg44GX44Gm44GE44KL77yJXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkRW5naW5lKCk6IGFueSB8IHVuZGVmaW5lZCB7XG4gIHRyeSB7XG4gICAgcmV0dXJuIHJlcXVpcmUoJ0Bhd3MvY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUnKTtcbiAgfSBjYXRjaCB7XG4gICAgLy8gZmFsbCB0aHJvdWdoXG4gIH1cbiAgdHJ5IHtcbiAgICBjb25zdCBsaWJQa2cgPSByZXF1aXJlLnJlc29sdmUoJ2F3cy1jZGstbGliL3BhY2thZ2UuanNvbicpO1xuICAgIGNvbnN0IGVuZ1BrZyA9IHJlcXVpcmUucmVzb2x2ZSgnQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZS9wYWNrYWdlLmpzb24nLCB7XG4gICAgICBwYXRoczogW3BhdGguZGlybmFtZShsaWJQa2cpXSxcbiAgICB9KTtcbiAgICByZXR1cm4gcmVxdWlyZShwYXRoLmRpcm5hbWUoZW5nUGtnKSk7XG4gIH0gY2F0Y2gge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==

package/lib/rules.generated.d.ts

@@ -5,6 +5,7 @@ export interface BundledRuleData {
     readonly title: string;
     readonly upstream: string;
     readonly resourceTypes: string[];
+    readonly fixtureRegion?: string;
     readonly rego: string;
 }
 export declare const BUNDLED_RULES: BundledRuleData[];