raindancers-cloudfront 0.0.38 → 0.0.40

package/lib/cloudfront/cloudfront-functions/auth-check.js

@@ -142,11 +142,53 @@ function getOriginalPath(request) {
     return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath, host) {
+// A live PKCE sign-in is represented by the pair of cookies (oauth_state +
+// code_verifier) minted on the redirect that started it. The browser drops both
+// at Max-Age=600, so their PRESENCE (with a well-formed, decodable state) is the
+// practical "unexpired flow" signal available to a CloudFront Function — it has
+// no way to read a cookie's own expiry. Reusing an existing pair instead of
+// minting a new one is what stops a redirect provoked mid-sign-in (e.g. a
+// background notification poll from a sibling panel on the shared cookie domain)
+// from overwriting the state the in-flight sign-in carries, which the callback
+// compares strictly and rejects with "400 Invalid state parameter".
+function inflightAuthFlow(cookies) {
+    if (!cookies) { return null; }
+    var stateCookie = cookies.oauth_state;
+    var verifierCookie = cookies.code_verifier;
+    if (!stateCookie || !stateCookie.value || !verifierCookie || !verifierCookie.value) {
+        return null;
+    }
+    try {
+        JSON.parse(base64urlDecode(stateCookie.value));
+    } catch (e) {
+        return null;
+    }
+    return { state: stateCookie.value, codeVerifier: verifierCookie.value };
+}
+
+function redirectToAuth(originalPath, host, cookies) {
+    var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
+
+    // If a sign-in is already in flight, reissue the redirect REUSING its state
+    // and verifier, and set NO cookies — do not clobber the live flow. The
+    // challenge is re-derived from the stored verifier so the authorize URL stays
+    // consistent with the PKCE exchange the callback performs for whichever flow
+    // completes.
+    var inflight = inflightAuthFlow(cookies);
+    if (inflight) {
+        var reusedChallenge = generateCodeChallenge(inflight.codeVerifier);
+        return {
+            statusCode: 302,
+            headers: {
+                location: { value: buildAzureAuthUrl(inflight.state, reusedChallenge, host) },
+                'cache-control': { value: 'no-store' }
+            }
+        };
+    }
+
     var state = generateState(originalPath, host);
     var codeVerifier = generateCodeVerifier();
     var codeChallenge = generateCodeChallenge(codeVerifier);
-    var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
     return {
         statusCode: 302,
         headers: {
@@ -203,13 +245,13 @@ async function handler(event) {
     // Check for session cookie (supports both __Secure- with domain and __Host- without)
     var sessionCookie = cookies['__Secure-auth_session'] || cookies['__Host-auth_session'];
     if (!sessionCookie) {
-        return redirectToAuth(getOriginalPath(request), host);
+        return redirectToAuth(getOriginalPath(request), host, request.cookies);
     }
     
     var token = sessionCookie.value;
     
     if (!token || token.length === 0) {
-        return redirectToAuth(getOriginalPath(request), host);
+        return redirectToAuth(getOriginalPath(request), host, request.cookies);
     }
     
     try {
@@ -217,12 +259,12 @@ async function handler(event) {
         var parts = token.split('.');
         
         if (parts.length !== 3) {
-            return redirectToAuth(originalPath, host);
+            return redirectToAuth(originalPath, host, request.cookies);
         }
         
         var isValid = await validateHmacSignature(token);
         if (!isValid) {
-            return redirectToAuth(originalPath, host);
+            return redirectToAuth(originalPath, host, request.cookies);
         }
         
         var payload = JSON.parse(base64urlDecode(parts[1]));
@@ -232,7 +274,7 @@ async function handler(event) {
             if (ENABLE_REFRESH) {
                 return redirectToRefresh(originalPath, host);
             }
-            return redirectToAuth(originalPath, host);
+            return redirectToAuth(originalPath, host, request.cookies);
         }
         
         // Check if session is revoked (denylist approach)
@@ -242,7 +284,7 @@ async function handler(event) {
                 var isRevoked = await kvsHandle.get('revoked:' + jti);
                 if (isRevoked) {
                     console.log('Session revoked: ' + jti);
-                    return redirectToAuth(originalPath, host);
+                    return redirectToAuth(originalPath, host, request.cookies);
                 }
             } catch (e) {
                 console.log('KVS error checking revocation: ' + e);
@@ -265,6 +307,6 @@ async function handler(event) {
         
         return request;
     } catch (e) {
-        return redirectToAuth(getOriginalPath(request), host);
+        return redirectToAuth(getOriginalPath(request), host, request.cookies);
     }
 }

package/lib/cloudfront/cloudfront-functions/function-composer.d.ts

@@ -19,6 +19,24 @@ export interface ComposerConfig {
      */
     readonly loginRedirectPath?: string;
 }
+/**
+ * Minify CloudFront Function source with terser.
+ *
+ * CloudFront Functions have a hard 10KB code-size limit. Both the composed
+ * (multi-module) path and the standalone auth-check path must minify, using
+ * the SAME options, so a function that fits in one path fits in the other.
+ *
+ * `minify_sync` throws on a parse error and, in its documented failure mode,
+ * can return `{ error }` with no `code`. An earlier `minified.code || assembled`
+ * fallback caught that second case and silently shipped the UN-minified source,
+ * which is how an 11KB function reached CloudFront and 413'd at deploy. This
+ * helper never falls back: a thrown error propagates, and a missing `code` is
+ * turned into a thrown error too — a minify failure is always a build error.
+ *
+ * The `reserved` names are the CloudFront-required top-level identifiers that
+ * must survive mangling.
+ */
+export declare function minifyFunctionCode(source: string): string;
 /**
  * Generates a combined CloudFront Function from modular check functions
  * based on requested extensions

package/lib/cloudfront/cloudfront-functions/function-composer.js

@@ -34,10 +34,51 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FunctionComposer = void 0;
+exports.minifyFunctionCode = minifyFunctionCode;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const terser_1 = require("terser");
 const securedCloudFront_1 = require("../patterns/securedCloudFront");
+/**
+ * Minify CloudFront Function source with terser.
+ *
+ * CloudFront Functions have a hard 10KB code-size limit. Both the composed
+ * (multi-module) path and the standalone auth-check path must minify, using
+ * the SAME options, so a function that fits in one path fits in the other.
+ *
+ * `minify_sync` throws on a parse error and, in its documented failure mode,
+ * can return `{ error }` with no `code`. An earlier `minified.code || assembled`
+ * fallback caught that second case and silently shipped the UN-minified source,
+ * which is how an 11KB function reached CloudFront and 413'd at deploy. This
+ * helper never falls back: a thrown error propagates, and a missing `code` is
+ * turned into a thrown error too — a minify failure is always a build error.
+ *
+ * The `reserved` names are the CloudFront-required top-level identifiers that
+ * must survive mangling.
+ */
+function minifyFunctionCode(source) {
+    const result = (0, terser_1.minify_sync)(source, {
+        compress: {
+            dead_code: true,
+            drop_console: false,
+            passes: 2,
+        },
+        mangle: {
+            reserved: ['handler', 'event', 'kvsHandle'],
+        },
+        format: {
+            comments: false,
+        },
+    });
+    // `minify_sync` returns `{ error }` (not typed by @types/terser) instead of
+    // throwing; `code` is undefined on failure. Treat a missing `code` as the
+    // failure signal and surface the runtime error if terser attached one.
+    if (result.code === undefined) {
+        const err = result.error;
+        throw new Error(`CloudFront Function minification failed: ${err ?? 'terser produced no output'}`);
+    }
+    return result.code;
+}
 /**
  * Generates a combined CloudFront Function from modular check functions
  * based on requested extensions
@@ -122,21 +163,9 @@ class FunctionComposer {
         const kvsDecl = 'const kvsHandle = cf.kvs();\n';
         assembled = assembled.replace(/const kvsHandle = cf\.kvs\(\);\s*/g, '');
         // Minify with terser to stay well under the 10KB CloudFront Function limit.
-        const minified = (0, terser_1.minify_sync)(assembled, {
-            compress: {
-                dead_code: true,
-                drop_console: false,
-                passes: 2,
-            },
-            mangle: {
-                reserved: ['handler', 'event', 'kvsHandle'],
-            },
-            format: {
-                comments: false,
-            },
-        });
+        const minified = minifyFunctionCode(assembled);
         // Prepend the CloudFront-specific preamble back
-        const code = cfImport + cryptoRequire + kvsDecl + (minified.code || assembled);
+        const code = cfImport + cryptoRequire + kvsDecl + minified;
         const sizeKB = Buffer.byteLength(code, 'utf-8') / 1024;
         if (sizeKB > 10) {
             throw new Error(`CloudFront Function exceeds 10KB limit: ${sizeKB.toFixed(2)}KB (extensions: ${extensions.join(', ')})`);
@@ -186,4 +215,4 @@ class FunctionComposer {
     }
 }
 exports.FunctionComposer = FunctionComposer;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb24tY29tcG9zZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY2xvdWRmcm9udC9jbG91ZGZyb250LWZ1bmN0aW9ucy9mdW5jdGlvbi1jb21wb3Nlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1Q0FBeUI7QUFDekIsMkNBQTZCO0FBQzdCLG1DQUFxQztBQUNyQyxxRUFBMEY7QUF1QjFGOzs7R0FHRztBQUNILE1BQWEsZ0JBQWdCO0lBRzNCO1FBQ0UsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxPQUFPLENBQUMsVUFBdUIsRUFBRSxNQUF3QixFQUFFLGNBQStCO1FBQy9GLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztRQUUzQixrQ0FBa0M7UUFDbEMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQztRQUUvQyxpQ0FBaUM7UUFDakMsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBRTVCLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyw2QkFBUyxDQUFDLHFCQUFxQixDQUFDLEVBQUUsQ0FBQztZQUN6RCxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO1lBQzlDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDekIsQ0FBQztRQUVELElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyw2QkFBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7WUFDbEQsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyQixDQUFDO1FBRUQsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLDZCQUFTLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNoRCx1RUFBdUU7WUFDdkUsdUVBQXVFO1lBQ3ZFLGdDQUFnQztZQUNoQyxNQUFNLFVBQVUsR0FBRyxjQUFjLEVBQUUsaUJBQWlCLEtBQUssU0FBUyxJQUFJLGNBQWMsQ0FBQyxpQkFBaUIsS0FBSyxFQUFFLENBQUM7WUFDOUcsTUFBTSxTQUFTLEdBQUcsY0FBYyxFQUFFLGFBQWEsS0FBSyxTQUFTLElBQUksQ0FBQyxVQUFVLENBQUM7WUFDN0UsSUFBSSxVQUFVLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUN4RixJQUFJLGNBQWMsRUFBRSxDQUFDO2dCQUNuQixJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsQ0FBQztvQkFDakMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsNkJBQTZCLEVBQUUsY0FBYyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2dCQUMvRixDQUFDO2dCQUNELElBQUksY0FBYyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUM1QixVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyx3QkFBd0IsRUFBRSxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQ3JGLENBQUM7Z0JBQ0QsSUFBSSxjQUFjLENBQUMsUUFBUSxFQUFFLENBQUM7b0JBQzVCLFVBQVUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLHdCQUF3QixFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztnQkFDckYsQ0FBQztnQkFDRCxJQUFJLGNBQWMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDL0IsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsMkJBQTJCLEVBQUUsY0FBYyxDQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUMzRixDQUFDO2dCQUNELElBQUksY0FBYyxDQUFDLFlBQVksS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDOUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsY0FBYyxDQUFDLFlBQVksQ0FBQyxDQUFDO2dCQUM3RixDQUFDO2dCQUVELGdDQUFnQztnQkFDaEMsTUFBTSxxQkFBcUIsR0FBRyxjQUFjLENBQUMscUJBQXFCLElBQUksS0FBSyxDQUFDO2dCQUM1RSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxzQ0FBc0MsRUFBRSxNQUFNLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDO2dCQUV2RyxJQUFJLHFCQUFxQixJQUFJLGNBQWMsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO29CQUNsRSxNQUFNLEdBQUcsR0FBRyxjQUFjLENBQUMscUJBQXFCLENBQUM7b0JBQ2pELFVBQVUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLG1DQUFtQyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztvQkFDMUYsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsb0NBQW9DLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDMUcsQ0FBQztxQkFBTSxDQUFDO29CQUNOLFVBQVUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLG1DQUFtQyxFQUFFLElBQUksQ0FBQyxDQUFDO29CQUMzRSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxvQ0FBb0MsRUFBRSxJQUFJLENBQUMsQ0FBQztnQkFDOUUsQ0FBQztnQkFFRCwrQkFBK0I7Z0JBQy9CLE1BQU0sYUFBYSxHQUFHLGNBQWMsQ0FBQyxhQUFhLElBQUksS0FBSyxDQUFDO2dCQUM1RCxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyw2QkFBNkIsRUFBRSxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztnQkFFdEYsMkVBQTJFO2dCQUMzRSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxrQ0FBa0MsRUFBRSxjQUFjLENBQUMsaUJBQWlCLElBQUksRUFBRSxDQUFDLENBQUM7WUFDOUcsQ0FBQztZQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN0QixDQUFDO1FBRUQsNEJBQTRCO1FBQzVCLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFFakUsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUVuQyxnR0FBZ0c7UUFDaEcsNENBQTRDO1FBQzVDLE1BQU0sUUFBUSxHQUFHLGdDQUFnQyxDQUFDO1FBQ2xELFNBQVMsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLGtDQUFrQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRXRFLDhFQUE4RTtRQUM5RSxpREFBaUQ7UUFDakQsTUFBTSxhQUFhLEdBQUcsbUNBQW1DLENBQUM7UUFDMUQsU0FBUyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsdUNBQXVDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFM0Usd0RBQXdEO1FBQ3hELE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDO1FBQ2hELFNBQVMsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLG9DQUFvQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRXhFLDRFQUE0RTtRQUM1RSxNQUFNLFFBQVEsR0FBRyxJQUFBLG9CQUFXLEVBQUMsU0FBUyxFQUFFO1lBQ3RDLFFBQVEsRUFBRTtnQkFDUixTQUFTLEVBQUUsSUFBSTtnQkFDZixZQUFZLEVBQUUsS0FBSztnQkFDbkIsTUFBTSxFQUFFLENBQUM7YUFDVjtZQUNELE1BQU0sRUFBRTtnQkFDTixRQUFRLEVBQUUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFdBQVcsQ0FBQzthQUM1QztZQUNELE1BQU0sRUFBRTtnQkFDTixRQUFRLEVBQUUsS0FBSzthQUNoQjtTQUNGLENBQUMsQ0FBQztRQUVILGdEQUFnRDtRQUNoRCxNQUFNLElBQUksR0FBRyxRQUFRLEdBQUcsYUFBYSxHQUFHLE9BQU8sR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLElBQUksU0FBUyxDQUFDLENBQUM7UUFDL0UsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDO1FBRXZELElBQUksTUFBTSxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ2hCLE1BQU0sSUFBSSxLQUFLLENBQUMsMkNBQTJDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLG1CQUFtQixVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMzSCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sVUFBVSxDQUFDLFFBQWdCO1FBQ2pDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUN0RCxNQUFNLE9BQU8sR0FBRyxFQUFFLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUVuRCxPQUFPLE9BQU87YUFDWCxPQUFPLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxDQUFDLENBQUMsaUJBQWlCO2FBQ2xELE9BQU8sQ0FBQyxlQUFlLEVBQUUsRUFBRSxDQUFDLENBQUMsa0NBQWtDO2FBQy9ELE9BQU8sQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsY0FBYzthQUN0QyxPQUFPLENBQUMsMkNBQTJDLEVBQUUsRUFBRSxDQUFDO2FBQ3hELE9BQU8sQ0FBQyxpREFBaUQsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBRU8sZUFBZSxDQUFDLE1BQWdCLEVBQUUsTUFBd0IsRUFBRSxjQUErQjtRQUNqRyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3hDLE1BQU0sVUFBVSxHQUFHLGNBQWMsRUFBRSxVQUFVLElBQUksS0FBSyxDQUFDO1FBQ3ZELE1BQU0sS0FBSyxHQUFhO1lBQ3RCLCtCQUErQjtZQUMvQixPQUFPLENBQUMsQ0FBQyxDQUFDLGlDQUFpQyxDQUFDLENBQUMsQ0FBQywyQkFBMkI7WUFDekUsOEJBQThCO1lBQzlCLEVBQUU7U0FDSCxDQUFDO1FBRUYsZ0JBQWdCO1FBQ2hCLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzNCLEtBQUssQ0FBQyxJQUFJLENBQ1IsMEJBQTBCLEVBQzFCLG9DQUFvQyxFQUNwQyxvQ0FBb0MsRUFDcEMsRUFBRSxDQUNILENBQUM7UUFDSixDQUFDO1FBRUQsd0RBQXdEO1FBQ3hELElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixNQUFNLGFBQWEsR0FBRyxNQUFNLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDeEUsTUFBTSxTQUFTLEdBQUcsTUFBTSxFQUFFLGFBQWEsSUFBSSxpQ0FBYSxDQUFDLEVBQUUsQ0FBQztZQUM1RCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBRWhELEtBQUssQ0FBQyxJQUFJLENBQ1IsMkJBQTJCLEVBQzNCLHlCQUF5QixTQUFTLEdBQUcsRUFDckMsc0JBQXNCLFNBQVMsSUFBSSxFQUNuQyxzRkFBc0YsRUFDdEYscURBQXFELEVBQ3JELHdDQUF3QyxFQUN4QyxFQUFFLEVBQ0YscUVBQXFFLEVBQ3JFLG1EQUFtRCxFQUNuRCw2RUFBNkUsRUFDN0UsS0FBSyxFQUNMLEVBQUUsRUFDRixrRUFBa0UsRUFDbEUsc0RBQXNELEVBQ3RELHlFQUF5RSxFQUN6RSxLQUFLLEVBQ0wsRUFBRSxDQUNILENBQUM7WUFFRixxQ0FBcUM7WUFDckMsSUFBSSxVQUFVLEVBQUUsQ0FBQztnQkFDZixLQUFLLENBQUMsSUFBSSxDQUNSLHNCQUFzQixFQUN0Qix5QkFBeUIsRUFDekIseUNBQXlDLEVBQ3pDLHdDQUF3QyxFQUN4QyxnQkFBZ0IsRUFDaEIsMEJBQTBCLEVBQzFCLDJDQUEyQyxFQUMzQywrQ0FBK0MsRUFDL0MsVUFBVSxFQUNWLE9BQU8sRUFDUCxLQUFLLEVBQ0wsRUFBRSxDQUNILENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztRQUVELGdFQUFnRTtRQUNoRSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUMvQixLQUFLLENBQUMsSUFBSSxDQUNSLDBCQUEwQixFQUMxQixFQUFFLENBQ0gsQ0FBQztRQUNKLENBQUM7UUFFRCxLQUFLLENBQUMsSUFBSSxDQUNSLHdCQUF3QixFQUN4Qix5QkFBeUIsRUFDekIsR0FBRyxDQUNKLENBQUM7UUFFRixPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDMUIsQ0FBQztDQUNGO0FBdk5ELDRDQXVOQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG5pbXBvcnQgeyBtaW5pZnlfc3luYyB9IGZyb20gJ3RlcnNlcic7XG5pbXBvcnQgeyBFeHRlbnNpb24sIEV4dGVuc2lvbkNvbmZpZywgUm9sZU1hdGNoTW9kZSB9IGZyb20gJy4uL3BhdHRlcm5zL3NlY3VyZWRDbG91ZEZyb250JztcblxuZXhwb3J0IGludGVyZmFjZSBDb21wb3NlckNvbmZpZyB7XG4gIHJlYWRvbmx5IHRlbmFudElkPzogc3RyaW5nO1xuICByZWFkb25seSBjb2duaXRvRG9tYWluPzogc3RyaW5nO1xuICByZWFkb25seSBjbGllbnRJZD86IHN0cmluZztcbiAgcmVhZG9ubHkgcmVkaXJlY3RVcmk/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGNvb2tpZURvbWFpbj86IHN0cmluZztcbiAgcmVhZG9ubHkgcmVxdWlyZU1mYT86IGJvb2xlYW47XG4gIC8qKiBFbmFibGUgaGVhZGVyIHN0cmlwcGluZyBhbmQgaW5qZWN0aW9uIGZyb20gSldUIGNsYWltcy4gQGRlZmF1bHQgZmFsc2UgKi9cbiAgcmVhZG9ubHkgZW5hYmxlSGVhZGVySW5qZWN0aW9uPzogYm9vbGVhbjtcbiAgLyoqIE1hcCBvZiBoZWFkZXIgbmFtZSDihpIgSldUIGNsYWltIGtleS4gZS5nLiB7ICd4LWN1c3RvbWVyLWlkJzogJ2N1c3RvbWVyX2lkJyB9ICovXG4gIHJlYWRvbmx5IGhlYWRlckluamVjdGlvbkNsYWltcz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG4gIC8qKiBFbmFibGUgcmVmcmVzaCByZWRpcmVjdCBmb3IgZXhwaXJlZC1idXQtdmFsaWQgdG9rZW5zLiBAZGVmYXVsdCBmYWxzZSAqL1xuICByZWFkb25seSBlbmFibGVSZWZyZXNoPzogYm9vbGVhbjtcbiAgLyoqXG4gICAqIEN1c3RvbS1VSSBtb2RlOiBmaXJzdC1wYXJ0eSBwYXRoIHRvIHJlZGlyZWN0IHVuYXV0aGVudGljYXRlZCB1c2VycyB0b1xuICAgKiAoZS5nLiAnL2xvZ2luJykuIFdoZW4gc2V0LCB0aGUgc2hhcmVkIGF1dGgtY2hlY2sgbW9kdWxlIGlzIHVzZWQgd2l0aCBhXG4gICAqIHJlbGF0aXZlIHJlZGlyZWN0IGluc3RlYWQgb2YgYW4gZXh0ZXJuYWwgSWRQIGF1dGhvcml6ZSBVUkwuXG4gICAqL1xuICByZWFkb25seSBsb2dpblJlZGlyZWN0UGF0aD86IHN0cmluZztcbn1cblxuLyoqXG4gKiBHZW5lcmF0ZXMgYSBjb21iaW5lZCBDbG91ZEZyb250IEZ1bmN0aW9uIGZyb20gbW9kdWxhciBjaGVjayBmdW5jdGlvbnNcbiAqIGJhc2VkIG9uIHJlcXVlc3RlZCBleHRlbnNpb25zXG4gKi9cbmV4cG9ydCBjbGFzcyBGdW5jdGlvbkNvbXBvc2VyIHtcbiAgcHJpdmF0ZSByZWFkb25seSBtb2R1bGVzRGlyOiBzdHJpbmc7XG5cbiAgY29uc3RydWN0b3IoKSB7XG4gICAgdGhpcy5tb2R1bGVzRGlyID0gcGF0aC5qb2luKF9fZGlybmFtZSwgJ21vZHVsZXMnKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHZW5lcmF0ZSBjb21iaW5lZCBmdW5jdGlvbiBjb2RlIGJhc2VkIG9uIHJlcXVlc3RlZCBleHRlbnNpb25zXG4gICAqL1xuICBwdWJsaWMgY29tcG9zZShleHRlbnNpb25zOiBFeHRlbnNpb25bXSwgY29uZmlnPzogRXh0ZW5zaW9uQ29uZmlnLCBjb21wb3NlckNvbmZpZz86IENvbXBvc2VyQ29uZmlnKTogc3RyaW5nIHtcbiAgICBjb25zdCBwYXJ0czogc3RyaW5nW10gPSBbXTtcblxuICAgIC8vIEFsd2F5cyBpbmNsdWRlIHNoYXJlZCB1dGlsaXRpZXNcbiAgICBwYXJ0cy5wdXNoKHRoaXMubG9hZE1vZHVsZSgnc2hhcmVkLXV0aWxzLmpzJykpO1xuXG4gICAgLy8gSW5jbHVkZSByZXF1aXJlZCBjaGVjayBtb2R1bGVzXG4gICAgY29uc3QgY2hlY2tzOiBzdHJpbmdbXSA9IFtdO1xuXG4gICAgaWYgKGV4dGVuc2lvbnMuaW5jbHVkZXMoRXh0ZW5zaW9uLlJFV1JJVEVfVE9fSU5ERVhfSFRNTCkpIHtcbiAgICAgIHBhcnRzLnB1c2godGhpcy5sb2FkTW9kdWxlKCd1cmwtcmV3cml0ZS5qcycpKTtcbiAgICAgIGNoZWNrcy5wdXNoKCdyZXdyaXRlJyk7XG4gICAgfVxuXG4gICAgaWYgKGV4dGVuc2lvbnMuaW5jbHVkZXMoRXh0ZW5zaW9uLlJFUVVJUkVfVExTXzEzKSkge1xuICAgICAgcGFydHMucHVzaCh0aGlzLmxvYWRNb2R1bGUoJ3Rscy1jaGVjay5qcycpKTtcbiAgICAgIGNoZWNrcy5wdXNoKCd0bHMnKTtcbiAgICB9XG5cbiAgICBpZiAoZXh0ZW5zaW9ucy5pbmNsdWRlcyhFeHRlbnNpb24uUkVRVUlSRV9BVVRIKSkge1xuICAgICAgLy8gQ3VzdG9tLVVJIG1vZGUgdXNlcyB0aGUgc2hhcmVkIGF1dGgtY2hlY2sgbW9kdWxlIChoZWFkZXIgaW5qZWN0aW9uICtcbiAgICAgIC8vIHJlZnJlc2ggY2FwYWJsZSkgd2l0aCBhIGZpcnN0LXBhcnR5IC9sb2dpbiByZWRpcmVjdCwgZXZlbiB0aG91Z2ggdGhlXG4gICAgICAvLyBpZGVudGl0eSBwcm92aWRlciBpcyBDb2duaXRvLlxuICAgICAgY29uc3QgaXNDdXN0b21VaSA9IGNvbXBvc2VyQ29uZmlnPy5sb2dpblJlZGlyZWN0UGF0aCAhPT0gdW5kZWZpbmVkICYmIGNvbXBvc2VyQ29uZmlnLmxvZ2luUmVkaXJlY3RQYXRoICE9PSAnJztcbiAgICAgIGNvbnN0IGlzQ29nbml0byA9IGNvbXBvc2VyQ29uZmlnPy5jb2duaXRvRG9tYWluICE9PSB1bmRlZmluZWQgJiYgIWlzQ3VzdG9tVWk7XG4gICAgICBsZXQgYXV0aE1vZHVsZSA9IHRoaXMubG9hZE1vZHVsZShpc0NvZ25pdG8gPyAnY29nbml0by1hdXRoLWNoZWNrLmpzJyA6ICdhdXRoLWNoZWNrLmpzJyk7XG4gICAgICBpZiAoY29tcG9zZXJDb25maWcpIHtcbiAgICAgICAgaWYgKGNvbXBvc2VyQ29uZmlnLmNvZ25pdG9Eb21haW4pIHtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9DT0dOSVRPX0RPTUFJTl9QTEFDRUhPTERFUi9nLCBjb21wb3NlckNvbmZpZy5jb2duaXRvRG9tYWluKTtcbiAgICAgICAgfVxuICAgICAgICBpZiAoY29tcG9zZXJDb25maWcudGVuYW50SWQpIHtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9URU5BTlRfSURfUExBQ0VIT0xERVIvZywgY29tcG9zZXJDb25maWcudGVuYW50SWQpO1xuICAgICAgICB9XG4gICAgICAgIGlmIChjb21wb3NlckNvbmZpZy5jbGllbnRJZCkge1xuICAgICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL0NMSUVOVF9JRF9QTEFDRUhPTERFUi9nLCBjb21wb3NlckNvbmZpZy5jbGllbnRJZCk7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKGNvbXBvc2VyQ29uZmlnLnJlZGlyZWN0VXJpKSB7XG4gICAgICAgICAgYXV0aE1vZHVsZSA9IGF1dGhNb2R1bGUucmVwbGFjZSgvUkVESVJFQ1RfVVJJX1BMQUNFSE9MREVSL2csIGNvbXBvc2VyQ29uZmlnLnJlZGlyZWN0VXJpKTtcbiAgICAgICAgfVxuICAgICAgICBpZiAoY29tcG9zZXJDb25maWcuY29va2llRG9tYWluICE9PSB1bmRlZmluZWQpIHtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9DT09LSUVfRE9NQUlOX1BMQUNFSE9MREVSL2csIGNvbXBvc2VyQ29uZmlnLmNvb2tpZURvbWFpbik7XG4gICAgICAgIH1cblxuICAgICAgICAvLyBIZWFkZXIgaW5qZWN0aW9uIHBsYWNlaG9sZGVyc1xuICAgICAgICBjb25zdCBlbmFibGVIZWFkZXJJbmplY3Rpb24gPSBjb21wb3NlckNvbmZpZy5lbmFibGVIZWFkZXJJbmplY3Rpb24gPz8gZmFsc2U7XG4gICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL0VOQUJMRV9IRUFERVJfSU5KRUNUSU9OX1BMQUNFSE9MREVSL2csIFN0cmluZyhlbmFibGVIZWFkZXJJbmplY3Rpb24pKTtcblxuICAgICAgICBpZiAoZW5hYmxlSGVhZGVySW5qZWN0aW9uICYmIGNvbXBvc2VyQ29uZmlnLmhlYWRlckluamVjdGlvbkNsYWltcykge1xuICAgICAgICAgIGNvbnN0IG1hcCA9IGNvbXBvc2VyQ29uZmlnLmhlYWRlckluamVjdGlvbkNsYWltcztcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9IRUFERVJfSU5KRUNUSU9OX01BUF9QTEFDRUhPTERFUi9nLCBKU09OLnN0cmluZ2lmeShtYXApKTtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9IRUFERVJfSU5KRUNUSU9OX0tFWVNfUExBQ0VIT0xERVIvZywgSlNPTi5zdHJpbmdpZnkoT2JqZWN0LmtleXMobWFwKSkpO1xuICAgICAgICB9IGVsc2Uge1xuICAgICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL0hFQURFUl9JTkpFQ1RJT05fTUFQX1BMQUNFSE9MREVSL2csICd7fScpO1xuICAgICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL0hFQURFUl9JTkpFQ1RJT05fS0VZU19QTEFDRUhPTERFUi9nLCAnW10nKTtcbiAgICAgICAgfVxuXG4gICAgICAgIC8vIFJlZnJlc2ggcmVkaXJlY3QgcGxhY2Vob2xkZXJcbiAgICAgICAgY29uc3QgZW5hYmxlUmVmcmVzaCA9IGNvbXBvc2VyQ29uZmlnLmVuYWJsZVJlZnJlc2ggPz8gZmFsc2U7XG4gICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL0VOQUJMRV9SRUZSRVNIX1BMQUNFSE9MREVSL2csIFN0cmluZyhlbmFibGVSZWZyZXNoKSk7XG5cbiAgICAgICAgLy8gQ3VzdG9tLVVJIGxvZ2luLXJlZGlyZWN0IHBsYWNlaG9sZGVyIChlbXB0eSBzdHJpbmcgPT4gSWRQLXJlZGlyZWN0IG1vZGUpXG4gICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL0xPR0lOX1JFRElSRUNUX1BBVEhfUExBQ0VIT0xERVIvZywgY29tcG9zZXJDb25maWcubG9naW5SZWRpcmVjdFBhdGggPz8gJycpO1xuICAgICAgfVxuICAgICAgcGFydHMucHVzaChhdXRoTW9kdWxlKTtcbiAgICAgIGNoZWNrcy5wdXNoKCdhdXRoJyk7XG4gICAgfVxuXG4gICAgLy8gR2VuZXJhdGUgaGFuZGxlciBmdW5jdGlvblxuICAgIHBhcnRzLnB1c2godGhpcy5nZW5lcmF0ZUhhbmRsZXIoY2hlY2tzLCBjb25maWcsIGNvbXBvc2VyQ29uZmlnKSk7XG5cbiAgICBsZXQgYXNzZW1ibGVkID0gcGFydHMuam9pbignXFxuXFxuJyk7XG5cbiAgICAvLyBFeHRyYWN0IHRoZSBDbG91ZEZyb250LXNwZWNpZmljIGltcG9ydCAodGVyc2VyIGNhbid0IHBhcnNlIEVTIG1vZHVsZSBpbXBvcnRzIGluIHNjcmlwdCBtb2RlKS5cbiAgICAvLyBXZSdsbCBwcmVwZW5kIGl0IGJhY2sgYWZ0ZXIgbWluaWZpY2F0aW9uLlxuICAgIGNvbnN0IGNmSW1wb3J0ID0gXCJpbXBvcnQgY2YgZnJvbSAnY2xvdWRmcm9udCc7XFxuXCI7XG4gICAgYXNzZW1ibGVkID0gYXNzZW1ibGVkLnJlcGxhY2UoL2ltcG9ydCBjZiBmcm9tICdjbG91ZGZyb250JztcXHMqL2csICcnKTtcblxuICAgIC8vIEFsc28gZXh0cmFjdCBgdmFyIGNyeXB0byA9IHJlcXVpcmUoJ2NyeXB0bycpO2Ag4oCUIHRlcnNlciBoYW5kbGVzIGl0IGZpbmUgYnV0XG4gICAgLy8gQ2xvdWRGcm9udCBGdW5jdGlvbnMgbmVlZCBpdCBhdCB0aGUgdG9wIGxldmVsLlxuICAgIGNvbnN0IGNyeXB0b1JlcXVpcmUgPSBcInZhciBjcnlwdG8gPSByZXF1aXJlKCdjcnlwdG8nKTtcXG5cIjtcbiAgICBhc3NlbWJsZWQgPSBhc3NlbWJsZWQucmVwbGFjZSgvdmFyIGNyeXB0byA9IHJlcXVpcmVcXCgnY3J5cHRvJ1xcKTtcXHMqL2csICcnKTtcblxuICAgIC8vIEV4dHJhY3QgS1ZTIGhhbmRsZSBkZWNsYXJhdGlvbiAoZGVwZW5kcyBvbiBjZiBpbXBvcnQpXG4gICAgY29uc3Qga3ZzRGVjbCA9ICdjb25zdCBrdnNIYW5kbGUgPSBjZi5rdnMoKTtcXG4nO1xuICAgIGFzc2VtYmxlZCA9IGFzc2VtYmxlZC5yZXBsYWNlKC9jb25zdCBrdnNIYW5kbGUgPSBjZlxcLmt2c1xcKFxcKTtcXHMqL2csICcnKTtcblxuICAgIC8vIE1pbmlmeSB3aXRoIHRlcnNlciB0byBzdGF5IHdlbGwgdW5kZXIgdGhlIDEwS0IgQ2xvdWRGcm9udCBGdW5jdGlvbiBsaW1pdC5cbiAgICBjb25zdCBtaW5pZmllZCA9IG1pbmlmeV9zeW5jKGFzc2VtYmxlZCwge1xuICAgICAgY29tcHJlc3M6IHtcbiAgICAgICAgZGVhZF9jb2RlOiB0cnVlLFxuICAgICAgICBkcm9wX2NvbnNvbGU6IGZhbHNlLFxuICAgICAgICBwYXNzZXM6IDIsXG4gICAgICB9LFxuICAgICAgbWFuZ2xlOiB7XG4gICAgICAgIHJlc2VydmVkOiBbJ2hhbmRsZXInLCAnZXZlbnQnLCAna3ZzSGFuZGxlJ10sXG4gICAgICB9LFxuICAgICAgZm9ybWF0OiB7XG4gICAgICAgIGNvbW1lbnRzOiBmYWxzZSxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICAvLyBQcmVwZW5kIHRoZSBDbG91ZEZyb250LXNwZWNpZmljIHByZWFtYmxlIGJhY2tcbiAgICBjb25zdCBjb2RlID0gY2ZJbXBvcnQgKyBjcnlwdG9SZXF1aXJlICsga3ZzRGVjbCArIChtaW5pZmllZC5jb2RlIHx8IGFzc2VtYmxlZCk7XG4gICAgY29uc3Qgc2l6ZUtCID0gQnVmZmVyLmJ5dGVMZW5ndGgoY29kZSwgJ3V0Zi04JykgLyAxMDI0O1xuXG4gICAgaWYgKHNpemVLQiA+IDEwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYENsb3VkRnJvbnQgRnVuY3Rpb24gZXhjZWVkcyAxMEtCIGxpbWl0OiAke3NpemVLQi50b0ZpeGVkKDIpfUtCIChleHRlbnNpb25zOiAke2V4dGVuc2lvbnMuam9pbignLCAnKX0pYCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIGNvZGU7XG4gIH1cblxuICBwcml2YXRlIGxvYWRNb2R1bGUoZmlsZW5hbWU6IHN0cmluZyk6IHN0cmluZyB7XG4gICAgY29uc3QgZmlsZVBhdGggPSBwYXRoLmpvaW4odGhpcy5tb2R1bGVzRGlyLCBmaWxlbmFtZSk7XG4gICAgY29uc3QgY29udGVudCA9IGZzLnJlYWRGaWxlU3luYyhmaWxlUGF0aCwgJ3V0Zi04Jyk7XG5cbiAgICByZXR1cm4gY29udGVudFxuICAgICAgLnJlcGxhY2UoL1xcL1xcKltcXHNcXFNdKj9cXCpcXC8vZywgJycpIC8vIGJsb2NrIGNvbW1lbnRzXG4gICAgICAucmVwbGFjZSgvXlxccypcXC9cXC8uKiQvZ20sICcnKSAvLyBsaW5lIGNvbW1lbnRzICh3aG9sZS1saW5lIG9ubHkpXG4gICAgICAucmVwbGFjZSgvXlxccypcXG4vZ20sICcnKSAvLyBibGFuayBsaW5lc1xuICAgICAgLnJlcGxhY2UoL2Z1bmN0aW9uIGhhbmRsZXJcXChldmVudFxcKSBcXHtbXFxzXFxTXSo/XFxuXFx9L2csICcnKVxuICAgICAgLnJlcGxhY2UoL2FzeW5jIGZ1bmN0aW9uIGhhbmRsZXJcXChldmVudFxcKSBcXHtbXFxzXFxTXSo/XFxuXFx9L2csICcnKTtcbiAgfVxuXG4gIHByaXZhdGUgZ2VuZXJhdGVIYW5kbGVyKGNoZWNrczogc3RyaW5nW10sIGNvbmZpZz86IEV4dGVuc2lvbkNvbmZpZywgY29tcG9zZXJDb25maWc/OiBDb21wb3NlckNvbmZpZyk6IHN0cmluZyB7XG4gICAgY29uc3QgaGFzQXV0aCA9IGNoZWNrcy5pbmNsdWRlcygnYXV0aCcpO1xuICAgIGNvbnN0IHJlcXVpcmVNZmEgPSBjb21wb3NlckNvbmZpZz8ucmVxdWlyZU1mYSA/PyBmYWxzZTtcbiAgICBjb25zdCBsaW5lczogc3RyaW5nW10gPSBbXG4gICAgICAnLy8gR2VuZXJhdGVkIGhhbmRsZXIgZnVuY3Rpb24nLFxuICAgICAgaGFzQXV0aCA/ICdhc3luYyBmdW5jdGlvbiBoYW5kbGVyKGV2ZW50KSB7JyA6ICdmdW5jdGlvbiBoYW5kbGVyKGV2ZW50KSB7JyxcbiAgICAgICcgIHZhciBkZWNvZGVkUGF5bG9hZCA9IG51bGw7JyxcbiAgICAgICcnLFxuICAgIF07XG5cbiAgICAvLyBBZGQgVExTIGNoZWNrXG4gICAgaWYgKGNoZWNrcy5pbmNsdWRlcygndGxzJykpIHtcbiAgICAgIGxpbmVzLnB1c2goXG4gICAgICAgICcgIC8vIFRMUyAxLjMgZW5mb3JjZW1lbnQnLFxuICAgICAgICAnICB2YXIgdGxzUmVzdWx0ID0gY2hlY2tUTFMoZXZlbnQpOycsXG4gICAgICAgICcgIGlmICh0bHNSZXN1bHQpIHJldHVybiB0bHNSZXN1bHQ7JyxcbiAgICAgICAgJycsXG4gICAgICApO1xuICAgIH1cblxuICAgIC8vIEFkZCBhdXRoIGNoZWNrICh3aXRoIG9wdGlvbmFsIHJvbGUgY2hlY2tpbmcgYnVpbHQtaW4pXG4gICAgaWYgKGhhc0F1dGgpIHtcbiAgICAgIGNvbnN0IHJlcXVpcmVkUm9sZXMgPSBjb25maWc/LnJlcXVpcmVkUm9sZXMgPyBjb25maWcucmVxdWlyZWRSb2xlcyA6IFtdO1xuICAgICAgY29uc3QgbWF0Y2hNb2RlID0gY29uZmlnPy5yb2xlTWF0Y2hNb2RlIHx8IFJvbGVNYXRjaE1vZGUuT1I7XG4gICAgICBjb25zdCByb2xlc0pzb24gPSBKU09OLnN0cmluZ2lmeShyZXF1aXJlZFJvbGVzKTtcblxuICAgICAgbGluZXMucHVzaChcbiAgICAgICAgJyAgLy8gQXV0aGVudGljYXRpb24gY2hlY2snLFxuICAgICAgICBgICB2YXIgcmVxdWlyZWRSb2xlcyA9ICR7cm9sZXNKc29ufTtgLFxuICAgICAgICBgICB2YXIgbWF0Y2hNb2RlID0gJyR7bWF0Y2hNb2RlfSc7YCxcbiAgICAgICAgJyAgdmFyIGF1dGhSZXN1bHQgPSBhd2FpdCBjaGVja0F1dGgoZXZlbnQsIGRlY29kZWRQYXlsb2FkLCByZXF1aXJlZFJvbGVzLCBtYXRjaE1vZGUpOycsXG4gICAgICAgICcgIGlmICghYXV0aFJlc3VsdC5wYXNzKSByZXR1cm4gYXV0aFJlc3VsdC5yZXNwb25zZTsnLFxuICAgICAgICAnICBkZWNvZGVkUGF5bG9hZCA9IGF1dGhSZXN1bHQucGF5bG9hZDsnLFxuICAgICAgICAnJyxcbiAgICAgICAgJyAgLy8gSW5qZWN0IEF6dXJlIEFEIEpXVCBmb3IgQXNzdW1lUm9sZVdpdGhXZWJJZGVudGl0eSAoQXp1cmUgb25seSknLFxuICAgICAgICAnICBpZiAodHlwZW9mIGluamVjdEF6dXJlVG9rZW4gPT09IFxcJ2Z1bmN0aW9uXFwnKSB7JyxcbiAgICAgICAgJyAgICBldmVudC5yZXF1ZXN0ID0gaW5qZWN0QXp1cmVUb2tlbihldmVudC5yZXF1ZXN0LCBldmVudC5yZXF1ZXN0LmNvb2tpZXMpOycsXG4gICAgICAgICcgIH0nLFxuICAgICAgICAnJyxcbiAgICAgICAgJyAgLy8gSW5qZWN0IGlkZW50aXR5IGNsYWltcyBhcyBoZWFkZXJzIGZvciBvcmlnaW4gKHdoZW4gZW5hYmxlZCknLFxuICAgICAgICAnICBpZiAodHlwZW9mIGluamVjdENsYWltc0hlYWRlcnMgPT09IFxcJ2Z1bmN0aW9uXFwnKSB7JyxcbiAgICAgICAgJyAgICBldmVudC5yZXF1ZXN0ID0gaW5qZWN0Q2xhaW1zSGVhZGVycyhldmVudC5yZXF1ZXN0LCBkZWNvZGVkUGF5bG9hZCk7JyxcbiAgICAgICAgJyAgfScsXG4gICAgICAgICcnLFxuICAgICAgKTtcblxuICAgICAgLy8gTUZBIGVuZm9yY2VtZW50IChkZWZlbmNlIGluIGRlcHRoKVxuICAgICAgaWYgKHJlcXVpcmVNZmEpIHtcbiAgICAgICAgbGluZXMucHVzaChcbiAgICAgICAgICAnICAvLyBNRkEgZW5mb3JjZW1lbnQnLFxuICAgICAgICAgICcgIGlmIChkZWNvZGVkUGF5bG9hZCkgeycsXG4gICAgICAgICAgJyAgICB2YXIgYW1yID0gZGVjb2RlZFBheWxvYWQuYW1yIHx8IFtdOycsXG4gICAgICAgICAgJyAgICBpZiAoYW1yLmluZGV4T2YoXFwnbWZhXFwnKSA9PT0gLTEpIHsnLFxuICAgICAgICAgICcgICAgICByZXR1cm4geycsXG4gICAgICAgICAgJyAgICAgICAgc3RhdHVzQ29kZTogNDAzLCcsXG4gICAgICAgICAgJyAgICAgICAgc3RhdHVzRGVzY3JpcHRpb246IFxcJ0ZvcmJpZGRlblxcJywnLFxuICAgICAgICAgICcgICAgICAgIGJvZHk6IFxcJ0FjY2VzcyBkZW5pZWQ6IE1GQSByZXF1aXJlZFxcJycsXG4gICAgICAgICAgJyAgICAgIH07JyxcbiAgICAgICAgICAnICAgIH0nLFxuICAgICAgICAgICcgIH0nLFxuICAgICAgICAgICcnLFxuICAgICAgICApO1xuICAgICAgfVxuICAgIH1cblxuICAgIC8vIEFkZCBVUkwgcmV3cml0ZSBhZnRlciBhdXRoIHNvIG9yaWdpbmFsUGF0aCBpcyBzYXZlZCBjb3JyZWN0bHlcbiAgICBpZiAoY2hlY2tzLmluY2x1ZGVzKCdyZXdyaXRlJykpIHtcbiAgICAgIGxpbmVzLnB1c2goXG4gICAgICAgICcgIHJld3JpdGVUb0luZGV4KGV2ZW50KTsnLFxuICAgICAgICAnJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgbGluZXMucHVzaChcbiAgICAgICcgIC8vIEFsbCBjaGVja3MgcGFzc2VkJyxcbiAgICAgICcgIHJldHVybiBldmVudC5yZXF1ZXN0OycsXG4gICAgICAnfScsXG4gICAgKTtcblxuICAgIHJldHVybiBsaW5lcy5qb2luKCdcXG4nKTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb24tY29tcG9zZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY2xvdWRmcm9udC9jbG91ZGZyb250LWZ1bmN0aW9ucy9mdW5jdGlvbi1jb21wb3Nlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUEyQ0EsZ0RBd0JDO0FBbkVELHVDQUF5QjtBQUN6QiwyQ0FBNkI7QUFDN0IsbUNBQXFDO0FBQ3JDLHFFQUEwRjtBQXVCMUY7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSCxTQUFnQixrQkFBa0IsQ0FBQyxNQUFjO0lBQy9DLE1BQU0sTUFBTSxHQUFHLElBQUEsb0JBQVcsRUFBQyxNQUFNLEVBQUU7UUFDakMsUUFBUSxFQUFFO1lBQ1IsU0FBUyxFQUFFLElBQUk7WUFDZixZQUFZLEVBQUUsS0FBSztZQUNuQixNQUFNLEVBQUUsQ0FBQztTQUNWO1FBQ0QsTUFBTSxFQUFFO1lBQ04sUUFBUSxFQUFFLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUM7U0FDNUM7UUFDRCxNQUFNLEVBQUU7WUFDTixRQUFRLEVBQUUsS0FBSztTQUNoQjtLQUNGLENBQUMsQ0FBQztJQUVILDRFQUE0RTtJQUM1RSwwRUFBMEU7SUFDMUUsdUVBQXVFO0lBQ3ZFLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM5QixNQUFNLEdBQUcsR0FBSSxNQUE0QixDQUFDLEtBQUssQ0FBQztRQUNoRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxHQUFHLElBQUksMkJBQTJCLEVBQUUsQ0FBQyxDQUFDO0lBQ3BHLENBQUM7SUFFRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUM7QUFDckIsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQWEsZ0JBQWdCO0lBRzNCO1FBQ0UsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxPQUFPLENBQUMsVUFBdUIsRUFBRSxNQUF3QixFQUFFLGNBQStCO1FBQy9GLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztRQUUzQixrQ0FBa0M7UUFDbEMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQztRQUUvQyxpQ0FBaUM7UUFDakMsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBRTVCLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyw2QkFBUyxDQUFDLHFCQUFxQixDQUFDLEVBQUUsQ0FBQztZQUN6RCxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO1lBQzlDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDekIsQ0FBQztRQUVELElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyw2QkFBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7WUFDbEQsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyQixDQUFDO1FBRUQsSUFBSSxVQUFVLENBQUMsUUFBUSxDQUFDLDZCQUFTLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNoRCx1RUFBdUU7WUFDdkUsdUVBQXVFO1lBQ3ZFLGdDQUFnQztZQUNoQyxNQUFNLFVBQVUsR0FBRyxjQUFjLEVBQUUsaUJBQWlCLEtBQUssU0FBUyxJQUFJLGNBQWMsQ0FBQyxpQkFBaUIsS0FBSyxFQUFFLENBQUM7WUFDOUcsTUFBTSxTQUFTLEdBQUcsY0FBYyxFQUFFLGFBQWEsS0FBSyxTQUFTLElBQUksQ0FBQyxVQUFVLENBQUM7WUFDN0UsSUFBSSxVQUFVLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUN4RixJQUFJLGNBQWMsRUFBRSxDQUFDO2dCQUNuQixJQUFJLGNBQWMsQ0FBQyxhQUFhLEVBQUUsQ0FBQztvQkFDakMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsNkJBQTZCLEVBQUUsY0FBYyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2dCQUMvRixDQUFDO2dCQUNELElBQUksY0FBYyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUM1QixVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyx3QkFBd0IsRUFBRSxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQ3JGLENBQUM7Z0JBQ0QsSUFBSSxjQUFjLENBQUMsUUFBUSxFQUFFLENBQUM7b0JBQzVCLFVBQVUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLHdCQUF3QixFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztnQkFDckYsQ0FBQztnQkFDRCxJQUFJLGNBQWMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDL0IsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsMkJBQTJCLEVBQUUsY0FBYyxDQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUMzRixDQUFDO2dCQUNELElBQUksY0FBYyxDQUFDLFlBQVksS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDOUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsY0FBYyxDQUFDLFlBQVksQ0FBQyxDQUFDO2dCQUM3RixDQUFDO2dCQUVELGdDQUFnQztnQkFDaEMsTUFBTSxxQkFBcUIsR0FBRyxjQUFjLENBQUMscUJBQXFCLElBQUksS0FBSyxDQUFDO2dCQUM1RSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxzQ0FBc0MsRUFBRSxNQUFNLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDO2dCQUV2RyxJQUFJLHFCQUFxQixJQUFJLGNBQWMsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO29CQUNsRSxNQUFNLEdBQUcsR0FBRyxjQUFjLENBQUMscUJBQXFCLENBQUM7b0JBQ2pELFVBQVUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLG1DQUFtQyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztvQkFDMUYsVUFBVSxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsb0NBQW9DLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDMUcsQ0FBQztxQkFBTSxDQUFDO29CQUNOLFVBQVUsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLG1DQUFtQyxFQUFFLElBQUksQ0FBQyxDQUFDO29CQUMzRSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxvQ0FBb0MsRUFBRSxJQUFJLENBQUMsQ0FBQztnQkFDOUUsQ0FBQztnQkFFRCwrQkFBK0I7Z0JBQy9CLE1BQU0sYUFBYSxHQUFHLGNBQWMsQ0FBQyxhQUFhLElBQUksS0FBSyxDQUFDO2dCQUM1RCxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyw2QkFBNkIsRUFBRSxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztnQkFFdEYsMkVBQTJFO2dCQUMzRSxVQUFVLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxrQ0FBa0MsRUFBRSxjQUFjLENBQUMsaUJBQWlCLElBQUksRUFBRSxDQUFDLENBQUM7WUFDOUcsQ0FBQztZQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN0QixDQUFDO1FBRUQsNEJBQTRCO1FBQzVCLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFFakUsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUVuQyxnR0FBZ0c7UUFDaEcsNENBQTRDO1FBQzVDLE1BQU0sUUFBUSxHQUFHLGdDQUFnQyxDQUFDO1FBQ2xELFNBQVMsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLGtDQUFrQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRXRFLDhFQUE4RTtRQUM5RSxpREFBaUQ7UUFDakQsTUFBTSxhQUFhLEdBQUcsbUNBQW1DLENBQUM7UUFDMUQsU0FBUyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsdUNBQXVDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFM0Usd0RBQXdEO1FBQ3hELE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDO1FBQ2hELFNBQVMsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLG9DQUFvQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRXhFLDRFQUE0RTtRQUM1RSxNQUFNLFFBQVEsR0FBRyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUUvQyxnREFBZ0Q7UUFDaEQsTUFBTSxJQUFJLEdBQUcsUUFBUSxHQUFHLGFBQWEsR0FBRyxPQUFPLEdBQUcsUUFBUSxDQUFDO1FBQzNELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQztRQUV2RCxJQUFJLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUNoQixNQUFNLElBQUksS0FBSyxDQUFDLDJDQUEyQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDM0gsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVPLFVBQVUsQ0FBQyxRQUFnQjtRQUNqQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDdEQsTUFBTSxPQUFPLEdBQUcsRUFBRSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFbkQsT0FBTyxPQUFPO2FBQ1gsT0FBTyxDQUFDLG1CQUFtQixFQUFFLEVBQUUsQ0FBQyxDQUFDLGlCQUFpQjthQUNsRCxPQUFPLENBQUMsZUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLGtDQUFrQzthQUMvRCxPQUFPLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDLGNBQWM7YUFDdEMsT0FBTyxDQUFDLDJDQUEyQyxFQUFFLEVBQUUsQ0FBQzthQUN4RCxPQUFPLENBQUMsaURBQWlELEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUVPLGVBQWUsQ0FBQyxNQUFnQixFQUFFLE1BQXdCLEVBQUUsY0FBK0I7UUFDakcsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN4QyxNQUFNLFVBQVUsR0FBRyxjQUFjLEVBQUUsVUFBVSxJQUFJLEtBQUssQ0FBQztRQUN2RCxNQUFNLEtBQUssR0FBYTtZQUN0QiwrQkFBK0I7WUFDL0IsT0FBTyxDQUFDLENBQUMsQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDLENBQUMsMkJBQTJCO1lBQ3pFLDhCQUE4QjtZQUM5QixFQUFFO1NBQ0gsQ0FBQztRQUVGLGdCQUFnQjtRQUNoQixJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMzQixLQUFLLENBQUMsSUFBSSxDQUNSLDBCQUEwQixFQUMxQixvQ0FBb0MsRUFDcEMsb0NBQW9DLEVBQ3BDLEVBQUUsQ0FDSCxDQUFDO1FBQ0osQ0FBQztRQUVELHdEQUF3RDtRQUN4RCxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ1osTUFBTSxhQUFhLEdBQUcsTUFBTSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE1BQU0sU0FBUyxHQUFHLE1BQU0sRUFBRSxhQUFhLElBQUksaUNBQWEsQ0FBQyxFQUFFLENBQUM7WUFDNUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUVoRCxLQUFLLENBQUMsSUFBSSxDQUNSLDJCQUEyQixFQUMzQix5QkFBeUIsU0FBUyxHQUFHLEVBQ3JDLHNCQUFzQixTQUFTLElBQUksRUFDbkMsc0ZBQXNGLEVBQ3RGLHFEQUFxRCxFQUNyRCx3Q0FBd0MsRUFDeEMsRUFBRSxFQUNGLHFFQUFxRSxFQUNyRSxtREFBbUQsRUFDbkQsNkVBQTZFLEVBQzdFLEtBQUssRUFDTCxFQUFFLEVBQ0Ysa0VBQWtFLEVBQ2xFLHNEQUFzRCxFQUN0RCx5RUFBeUUsRUFDekUsS0FBSyxFQUNMLEVBQUUsQ0FDSCxDQUFDO1lBRUYscUNBQXFDO1lBQ3JDLElBQUksVUFBVSxFQUFFLENBQUM7Z0JBQ2YsS0FBSyxDQUFDLElBQUksQ0FDUixzQkFBc0IsRUFDdEIseUJBQXlCLEVBQ3pCLHlDQUF5QyxFQUN6Qyx3Q0FBd0MsRUFDeEMsZ0JBQWdCLEVBQ2hCLDBCQUEwQixFQUMxQiwyQ0FBMkMsRUFDM0MsK0NBQStDLEVBQy9DLFVBQVUsRUFDVixPQUFPLEVBQ1AsS0FBSyxFQUNMLEVBQUUsQ0FDSCxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7UUFFRCxnRUFBZ0U7UUFDaEUsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDL0IsS0FBSyxDQUFDLElBQUksQ0FDUiwwQkFBMEIsRUFDMUIsRUFBRSxDQUNILENBQUM7UUFDSixDQUFDO1FBRUQsS0FBSyxDQUFDLElBQUksQ0FDUix3QkFBd0IsRUFDeEIseUJBQXlCLEVBQ3pCLEdBQUcsQ0FDSixDQUFDO1FBRUYsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzFCLENBQUM7Q0FDRjtBQTNNRCw0Q0EyTUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBmcyBmcm9tICdmcyc7XG5pbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHsgbWluaWZ5X3N5bmMgfSBmcm9tICd0ZXJzZXInO1xuaW1wb3J0IHsgRXh0ZW5zaW9uLCBFeHRlbnNpb25Db25maWcsIFJvbGVNYXRjaE1vZGUgfSBmcm9tICcuLi9wYXR0ZXJucy9zZWN1cmVkQ2xvdWRGcm9udCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ29tcG9zZXJDb25maWcge1xuICByZWFkb25seSB0ZW5hbnRJZD86IHN0cmluZztcbiAgcmVhZG9ubHkgY29nbml0b0RvbWFpbj86IHN0cmluZztcbiAgcmVhZG9ubHkgY2xpZW50SWQ/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IHJlZGlyZWN0VXJpPzogc3RyaW5nO1xuICByZWFkb25seSBjb29raWVEb21haW4/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IHJlcXVpcmVNZmE/OiBib29sZWFuO1xuICAvKiogRW5hYmxlIGhlYWRlciBzdHJpcHBpbmcgYW5kIGluamVjdGlvbiBmcm9tIEpXVCBjbGFpbXMuIEBkZWZhdWx0IGZhbHNlICovXG4gIHJlYWRvbmx5IGVuYWJsZUhlYWRlckluamVjdGlvbj86IGJvb2xlYW47XG4gIC8qKiBNYXAgb2YgaGVhZGVyIG5hbWUg4oaSIEpXVCBjbGFpbSBrZXkuIGUuZy4geyAneC1jdXN0b21lci1pZCc6ICdjdXN0b21lcl9pZCcgfSAqL1xuICByZWFkb25seSBoZWFkZXJJbmplY3Rpb25DbGFpbXM/OiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+O1xuICAvKiogRW5hYmxlIHJlZnJlc2ggcmVkaXJlY3QgZm9yIGV4cGlyZWQtYnV0LXZhbGlkIHRva2Vucy4gQGRlZmF1bHQgZmFsc2UgKi9cbiAgcmVhZG9ubHkgZW5hYmxlUmVmcmVzaD86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBDdXN0b20tVUkgbW9kZTogZmlyc3QtcGFydHkgcGF0aCB0byByZWRpcmVjdCB1bmF1dGhlbnRpY2F0ZWQgdXNlcnMgdG9cbiAgICogKGUuZy4gJy9sb2dpbicpLiBXaGVuIHNldCwgdGhlIHNoYXJlZCBhdXRoLWNoZWNrIG1vZHVsZSBpcyB1c2VkIHdpdGggYVxuICAgKiByZWxhdGl2ZSByZWRpcmVjdCBpbnN0ZWFkIG9mIGFuIGV4dGVybmFsIElkUCBhdXRob3JpemUgVVJMLlxuICAgKi9cbiAgcmVhZG9ubHkgbG9naW5SZWRpcmVjdFBhdGg/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogTWluaWZ5IENsb3VkRnJvbnQgRnVuY3Rpb24gc291cmNlIHdpdGggdGVyc2VyLlxuICpcbiAqIENsb3VkRnJvbnQgRnVuY3Rpb25zIGhhdmUgYSBoYXJkIDEwS0IgY29kZS1zaXplIGxpbWl0LiBCb3RoIHRoZSBjb21wb3NlZFxuICogKG11bHRpLW1vZHVsZSkgcGF0aCBhbmQgdGhlIHN0YW5kYWxvbmUgYXV0aC1jaGVjayBwYXRoIG11c3QgbWluaWZ5LCB1c2luZ1xuICogdGhlIFNBTUUgb3B0aW9ucywgc28gYSBmdW5jdGlvbiB0aGF0IGZpdHMgaW4gb25lIHBhdGggZml0cyBpbiB0aGUgb3RoZXIuXG4gKlxuICogYG1pbmlmeV9zeW5jYCB0aHJvd3Mgb24gYSBwYXJzZSBlcnJvciBhbmQsIGluIGl0cyBkb2N1bWVudGVkIGZhaWx1cmUgbW9kZSxcbiAqIGNhbiByZXR1cm4gYHsgZXJyb3IgfWAgd2l0aCBubyBgY29kZWAuIEFuIGVhcmxpZXIgYG1pbmlmaWVkLmNvZGUgfHwgYXNzZW1ibGVkYFxuICogZmFsbGJhY2sgY2F1Z2h0IHRoYXQgc2Vjb25kIGNhc2UgYW5kIHNpbGVudGx5IHNoaXBwZWQgdGhlIFVOLW1pbmlmaWVkIHNvdXJjZSxcbiAqIHdoaWNoIGlzIGhvdyBhbiAxMUtCIGZ1bmN0aW9uIHJlYWNoZWQgQ2xvdWRGcm9udCBhbmQgNDEzJ2QgYXQgZGVwbG95LiBUaGlzXG4gKiBoZWxwZXIgbmV2ZXIgZmFsbHMgYmFjazogYSB0aHJvd24gZXJyb3IgcHJvcGFnYXRlcywgYW5kIGEgbWlzc2luZyBgY29kZWAgaXNcbiAqIHR1cm5lZCBpbnRvIGEgdGhyb3duIGVycm9yIHRvbyDigJQgYSBtaW5pZnkgZmFpbHVyZSBpcyBhbHdheXMgYSBidWlsZCBlcnJvci5cbiAqXG4gKiBUaGUgYHJlc2VydmVkYCBuYW1lcyBhcmUgdGhlIENsb3VkRnJvbnQtcmVxdWlyZWQgdG9wLWxldmVsIGlkZW50aWZpZXJzIHRoYXRcbiAqIG11c3Qgc3Vydml2ZSBtYW5nbGluZy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIG1pbmlmeUZ1bmN0aW9uQ29kZShzb3VyY2U6IHN0cmluZyk6IHN0cmluZyB7XG4gIGNvbnN0IHJlc3VsdCA9IG1pbmlmeV9zeW5jKHNvdXJjZSwge1xuICAgIGNvbXByZXNzOiB7XG4gICAgICBkZWFkX2NvZGU6IHRydWUsXG4gICAgICBkcm9wX2NvbnNvbGU6IGZhbHNlLFxuICAgICAgcGFzc2VzOiAyLFxuICAgIH0sXG4gICAgbWFuZ2xlOiB7XG4gICAgICByZXNlcnZlZDogWydoYW5kbGVyJywgJ2V2ZW50JywgJ2t2c0hhbmRsZSddLFxuICAgIH0sXG4gICAgZm9ybWF0OiB7XG4gICAgICBjb21tZW50czogZmFsc2UsXG4gICAgfSxcbiAgfSk7XG5cbiAgLy8gYG1pbmlmeV9zeW5jYCByZXR1cm5zIGB7IGVycm9yIH1gIChub3QgdHlwZWQgYnkgQHR5cGVzL3RlcnNlcikgaW5zdGVhZCBvZlxuICAvLyB0aHJvd2luZzsgYGNvZGVgIGlzIHVuZGVmaW5lZCBvbiBmYWlsdXJlLiBUcmVhdCBhIG1pc3NpbmcgYGNvZGVgIGFzIHRoZVxuICAvLyBmYWlsdXJlIHNpZ25hbCBhbmQgc3VyZmFjZSB0aGUgcnVudGltZSBlcnJvciBpZiB0ZXJzZXIgYXR0YWNoZWQgb25lLlxuICBpZiAocmVzdWx0LmNvZGUgPT09IHVuZGVmaW5lZCkge1xuICAgIGNvbnN0IGVyciA9IChyZXN1bHQgYXMgeyBlcnJvcj86IEVycm9yIH0pLmVycm9yO1xuICAgIHRocm93IG5ldyBFcnJvcihgQ2xvdWRGcm9udCBGdW5jdGlvbiBtaW5pZmljYXRpb24gZmFpbGVkOiAke2VyciA/PyAndGVyc2VyIHByb2R1Y2VkIG5vIG91dHB1dCd9YCk7XG4gIH1cblxuICByZXR1cm4gcmVzdWx0LmNvZGU7XG59XG5cbi8qKlxuICogR2VuZXJhdGVzIGEgY29tYmluZWQgQ2xvdWRGcm9udCBGdW5jdGlvbiBmcm9tIG1vZHVsYXIgY2hlY2sgZnVuY3Rpb25zXG4gKiBiYXNlZCBvbiByZXF1ZXN0ZWQgZXh0ZW5zaW9uc1xuICovXG5leHBvcnQgY2xhc3MgRnVuY3Rpb25Db21wb3NlciB7XG4gIHByaXZhdGUgcmVhZG9ubHkgbW9kdWxlc0Rpcjogc3RyaW5nO1xuXG4gIGNvbnN0cnVjdG9yKCkge1xuICAgIHRoaXMubW9kdWxlc0RpciA9IHBhdGguam9pbihfX2Rpcm5hbWUsICdtb2R1bGVzJyk7XG4gIH1cblxuICAvKipcbiAgICogR2VuZXJhdGUgY29tYmluZWQgZnVuY3Rpb24gY29kZSBiYXNlZCBvbiByZXF1ZXN0ZWQgZXh0ZW5zaW9uc1xuICAgKi9cbiAgcHVibGljIGNvbXBvc2UoZXh0ZW5zaW9uczogRXh0ZW5zaW9uW10sIGNvbmZpZz86IEV4dGVuc2lvbkNvbmZpZywgY29tcG9zZXJDb25maWc/OiBDb21wb3NlckNvbmZpZyk6IHN0cmluZyB7XG4gICAgY29uc3QgcGFydHM6IHN0cmluZ1tdID0gW107XG5cbiAgICAvLyBBbHdheXMgaW5jbHVkZSBzaGFyZWQgdXRpbGl0aWVzXG4gICAgcGFydHMucHVzaCh0aGlzLmxvYWRNb2R1bGUoJ3NoYXJlZC11dGlscy5qcycpKTtcblxuICAgIC8vIEluY2x1ZGUgcmVxdWlyZWQgY2hlY2sgbW9kdWxlc1xuICAgIGNvbnN0IGNoZWNrczogc3RyaW5nW10gPSBbXTtcblxuICAgIGlmIChleHRlbnNpb25zLmluY2x1ZGVzKEV4dGVuc2lvbi5SRVdSSVRFX1RPX0lOREVYX0hUTUwpKSB7XG4gICAgICBwYXJ0cy5wdXNoKHRoaXMubG9hZE1vZHVsZSgndXJsLXJld3JpdGUuanMnKSk7XG4gICAgICBjaGVja3MucHVzaCgncmV3cml0ZScpO1xuICAgIH1cblxuICAgIGlmIChleHRlbnNpb25zLmluY2x1ZGVzKEV4dGVuc2lvbi5SRVFVSVJFX1RMU18xMykpIHtcbiAgICAgIHBhcnRzLnB1c2godGhpcy5sb2FkTW9kdWxlKCd0bHMtY2hlY2suanMnKSk7XG4gICAgICBjaGVja3MucHVzaCgndGxzJyk7XG4gICAgfVxuXG4gICAgaWYgKGV4dGVuc2lvbnMuaW5jbHVkZXMoRXh0ZW5zaW9uLlJFUVVJUkVfQVVUSCkpIHtcbiAgICAgIC8vIEN1c3RvbS1VSSBtb2RlIHVzZXMgdGhlIHNoYXJlZCBhdXRoLWNoZWNrIG1vZHVsZSAoaGVhZGVyIGluamVjdGlvbiArXG4gICAgICAvLyByZWZyZXNoIGNhcGFibGUpIHdpdGggYSBmaXJzdC1wYXJ0eSAvbG9naW4gcmVkaXJlY3QsIGV2ZW4gdGhvdWdoIHRoZVxuICAgICAgLy8gaWRlbnRpdHkgcHJvdmlkZXIgaXMgQ29nbml0by5cbiAgICAgIGNvbnN0IGlzQ3VzdG9tVWkgPSBjb21wb3NlckNvbmZpZz8ubG9naW5SZWRpcmVjdFBhdGggIT09IHVuZGVmaW5lZCAmJiBjb21wb3NlckNvbmZpZy5sb2dpblJlZGlyZWN0UGF0aCAhPT0gJyc7XG4gICAgICBjb25zdCBpc0NvZ25pdG8gPSBjb21wb3NlckNvbmZpZz8uY29nbml0b0RvbWFpbiAhPT0gdW5kZWZpbmVkICYmICFpc0N1c3RvbVVpO1xuICAgICAgbGV0IGF1dGhNb2R1bGUgPSB0aGlzLmxvYWRNb2R1bGUoaXNDb2duaXRvID8gJ2NvZ25pdG8tYXV0aC1jaGVjay5qcycgOiAnYXV0aC1jaGVjay5qcycpO1xuICAgICAgaWYgKGNvbXBvc2VyQ29uZmlnKSB7XG4gICAgICAgIGlmIChjb21wb3NlckNvbmZpZy5jb2duaXRvRG9tYWluKSB7XG4gICAgICAgICAgYXV0aE1vZHVsZSA9IGF1dGhNb2R1bGUucmVwbGFjZSgvQ09HTklUT19ET01BSU5fUExBQ0VIT0xERVIvZywgY29tcG9zZXJDb25maWcuY29nbml0b0RvbWFpbik7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKGNvbXBvc2VyQ29uZmlnLnRlbmFudElkKSB7XG4gICAgICAgICAgYXV0aE1vZHVsZSA9IGF1dGhNb2R1bGUucmVwbGFjZSgvVEVOQU5UX0lEX1BMQUNFSE9MREVSL2csIGNvbXBvc2VyQ29uZmlnLnRlbmFudElkKTtcbiAgICAgICAgfVxuICAgICAgICBpZiAoY29tcG9zZXJDb25maWcuY2xpZW50SWQpIHtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9DTElFTlRfSURfUExBQ0VIT0xERVIvZywgY29tcG9zZXJDb25maWcuY2xpZW50SWQpO1xuICAgICAgICB9XG4gICAgICAgIGlmIChjb21wb3NlckNvbmZpZy5yZWRpcmVjdFVyaSkge1xuICAgICAgICAgIGF1dGhNb2R1bGUgPSBhdXRoTW9kdWxlLnJlcGxhY2UoL1JFRElSRUNUX1VSSV9QTEFDRUhPTERFUi9nLCBjb21wb3NlckNvbmZpZy5yZWRpcmVjdFVyaSk7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKGNvbXBvc2VyQ29uZmlnLmNvb2tpZURvbWFpbiAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICAgICAgYXV0aE1vZHVsZSA9IGF1dGhNb2R1bGUucmVwbGFjZSgvQ09PS0lFX0RPTUFJTl9QTEFDRUhPTERFUi9nLCBjb21wb3NlckNvbmZpZy5jb29raWVEb21haW4pO1xuICAgICAgICB9XG5cbiAgICAgICAgLy8gSGVhZGVyIGluamVjdGlvbiBwbGFjZWhvbGRlcnNcbiAgICAgICAgY29uc3QgZW5hYmxlSGVhZGVySW5qZWN0aW9uID0gY29tcG9zZXJDb25maWcuZW5hYmxlSGVhZGVySW5qZWN0aW9uID8/IGZhbHNlO1xuICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9FTkFCTEVfSEVBREVSX0lOSkVDVElPTl9QTEFDRUhPTERFUi9nLCBTdHJpbmcoZW5hYmxlSGVhZGVySW5qZWN0aW9uKSk7XG5cbiAgICAgICAgaWYgKGVuYWJsZUhlYWRlckluamVjdGlvbiAmJiBjb21wb3NlckNvbmZpZy5oZWFkZXJJbmplY3Rpb25DbGFpbXMpIHtcbiAgICAgICAgICBjb25zdCBtYXAgPSBjb21wb3NlckNvbmZpZy5oZWFkZXJJbmplY3Rpb25DbGFpbXM7XG4gICAgICAgICAgYXV0aE1vZHVsZSA9IGF1dGhNb2R1bGUucmVwbGFjZSgvSEVBREVSX0lOSkVDVElPTl9NQVBfUExBQ0VIT0xERVIvZywgSlNPTi5zdHJpbmdpZnkobWFwKSk7XG4gICAgICAgICAgYXV0aE1vZHVsZSA9IGF1dGhNb2R1bGUucmVwbGFjZSgvSEVBREVSX0lOSkVDVElPTl9LRVlTX1BMQUNFSE9MREVSL2csIEpTT04uc3RyaW5naWZ5KE9iamVjdC5rZXlzKG1hcCkpKTtcbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9IRUFERVJfSU5KRUNUSU9OX01BUF9QTEFDRUhPTERFUi9nLCAne30nKTtcbiAgICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9IRUFERVJfSU5KRUNUSU9OX0tFWVNfUExBQ0VIT0xERVIvZywgJ1tdJyk7XG4gICAgICAgIH1cblxuICAgICAgICAvLyBSZWZyZXNoIHJlZGlyZWN0IHBsYWNlaG9sZGVyXG4gICAgICAgIGNvbnN0IGVuYWJsZVJlZnJlc2ggPSBjb21wb3NlckNvbmZpZy5lbmFibGVSZWZyZXNoID8/IGZhbHNlO1xuICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9FTkFCTEVfUkVGUkVTSF9QTEFDRUhPTERFUi9nLCBTdHJpbmcoZW5hYmxlUmVmcmVzaCkpO1xuXG4gICAgICAgIC8vIEN1c3RvbS1VSSBsb2dpbi1yZWRpcmVjdCBwbGFjZWhvbGRlciAoZW1wdHkgc3RyaW5nID0+IElkUC1yZWRpcmVjdCBtb2RlKVxuICAgICAgICBhdXRoTW9kdWxlID0gYXV0aE1vZHVsZS5yZXBsYWNlKC9MT0dJTl9SRURJUkVDVF9QQVRIX1BMQUNFSE9MREVSL2csIGNvbXBvc2VyQ29uZmlnLmxvZ2luUmVkaXJlY3RQYXRoID8/ICcnKTtcbiAgICAgIH1cbiAgICAgIHBhcnRzLnB1c2goYXV0aE1vZHVsZSk7XG4gICAgICBjaGVja3MucHVzaCgnYXV0aCcpO1xuICAgIH1cblxuICAgIC8vIEdlbmVyYXRlIGhhbmRsZXIgZnVuY3Rpb25cbiAgICBwYXJ0cy5wdXNoKHRoaXMuZ2VuZXJhdGVIYW5kbGVyKGNoZWNrcywgY29uZmlnLCBjb21wb3NlckNvbmZpZykpO1xuXG4gICAgbGV0IGFzc2VtYmxlZCA9IHBhcnRzLmpvaW4oJ1xcblxcbicpO1xuXG4gICAgLy8gRXh0cmFjdCB0aGUgQ2xvdWRGcm9udC1zcGVjaWZpYyBpbXBvcnQgKHRlcnNlciBjYW4ndCBwYXJzZSBFUyBtb2R1bGUgaW1wb3J0cyBpbiBzY3JpcHQgbW9kZSkuXG4gICAgLy8gV2UnbGwgcHJlcGVuZCBpdCBiYWNrIGFmdGVyIG1pbmlmaWNhdGlvbi5cbiAgICBjb25zdCBjZkltcG9ydCA9IFwiaW1wb3J0IGNmIGZyb20gJ2Nsb3VkZnJvbnQnO1xcblwiO1xuICAgIGFzc2VtYmxlZCA9IGFzc2VtYmxlZC5yZXBsYWNlKC9pbXBvcnQgY2YgZnJvbSAnY2xvdWRmcm9udCc7XFxzKi9nLCAnJyk7XG5cbiAgICAvLyBBbHNvIGV4dHJhY3QgYHZhciBjcnlwdG8gPSByZXF1aXJlKCdjcnlwdG8nKTtgIOKAlCB0ZXJzZXIgaGFuZGxlcyBpdCBmaW5lIGJ1dFxuICAgIC8vIENsb3VkRnJvbnQgRnVuY3Rpb25zIG5lZWQgaXQgYXQgdGhlIHRvcCBsZXZlbC5cbiAgICBjb25zdCBjcnlwdG9SZXF1aXJlID0gXCJ2YXIgY3J5cHRvID0gcmVxdWlyZSgnY3J5cHRvJyk7XFxuXCI7XG4gICAgYXNzZW1ibGVkID0gYXNzZW1ibGVkLnJlcGxhY2UoL3ZhciBjcnlwdG8gPSByZXF1aXJlXFwoJ2NyeXB0bydcXCk7XFxzKi9nLCAnJyk7XG5cbiAgICAvLyBFeHRyYWN0IEtWUyBoYW5kbGUgZGVjbGFyYXRpb24gKGRlcGVuZHMgb24gY2YgaW1wb3J0KVxuICAgIGNvbnN0IGt2c0RlY2wgPSAnY29uc3Qga3ZzSGFuZGxlID0gY2Yua3ZzKCk7XFxuJztcbiAgICBhc3NlbWJsZWQgPSBhc3NlbWJsZWQucmVwbGFjZSgvY29uc3Qga3ZzSGFuZGxlID0gY2ZcXC5rdnNcXChcXCk7XFxzKi9nLCAnJyk7XG5cbiAgICAvLyBNaW5pZnkgd2l0aCB0ZXJzZXIgdG8gc3RheSB3ZWxsIHVuZGVyIHRoZSAxMEtCIENsb3VkRnJvbnQgRnVuY3Rpb24gbGltaXQuXG4gICAgY29uc3QgbWluaWZpZWQgPSBtaW5pZnlGdW5jdGlvbkNvZGUoYXNzZW1ibGVkKTtcblxuICAgIC8vIFByZXBlbmQgdGhlIENsb3VkRnJvbnQtc3BlY2lmaWMgcHJlYW1ibGUgYmFja1xuICAgIGNvbnN0IGNvZGUgPSBjZkltcG9ydCArIGNyeXB0b1JlcXVpcmUgKyBrdnNEZWNsICsgbWluaWZpZWQ7XG4gICAgY29uc3Qgc2l6ZUtCID0gQnVmZmVyLmJ5dGVMZW5ndGgoY29kZSwgJ3V0Zi04JykgLyAxMDI0O1xuXG4gICAgaWYgKHNpemVLQiA+IDEwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYENsb3VkRnJvbnQgRnVuY3Rpb24gZXhjZWVkcyAxMEtCIGxpbWl0OiAke3NpemVLQi50b0ZpeGVkKDIpfUtCIChleHRlbnNpb25zOiAke2V4dGVuc2lvbnMuam9pbignLCAnKX0pYCk7XG4gICAgfVxuXG4gICAgcmV0dXJuIGNvZGU7XG4gIH1cblxuICBwcml2YXRlIGxvYWRNb2R1bGUoZmlsZW5hbWU6IHN0cmluZyk6IHN0cmluZyB7XG4gICAgY29uc3QgZmlsZVBhdGggPSBwYXRoLmpvaW4odGhpcy5tb2R1bGVzRGlyLCBmaWxlbmFtZSk7XG4gICAgY29uc3QgY29udGVudCA9IGZzLnJlYWRGaWxlU3luYyhmaWxlUGF0aCwgJ3V0Zi04Jyk7XG5cbiAgICByZXR1cm4gY29udGVudFxuICAgICAgLnJlcGxhY2UoL1xcL1xcKltcXHNcXFNdKj9cXCpcXC8vZywgJycpIC8vIGJsb2NrIGNvbW1lbnRzXG4gICAgICAucmVwbGFjZSgvXlxccypcXC9cXC8uKiQvZ20sICcnKSAvLyBsaW5lIGNvbW1lbnRzICh3aG9sZS1saW5lIG9ubHkpXG4gICAgICAucmVwbGFjZSgvXlxccypcXG4vZ20sICcnKSAvLyBibGFuayBsaW5lc1xuICAgICAgLnJlcGxhY2UoL2Z1bmN0aW9uIGhhbmRsZXJcXChldmVudFxcKSBcXHtbXFxzXFxTXSo/XFxuXFx9L2csICcnKVxuICAgICAgLnJlcGxhY2UoL2FzeW5jIGZ1bmN0aW9uIGhhbmRsZXJcXChldmVudFxcKSBcXHtbXFxzXFxTXSo/XFxuXFx9L2csICcnKTtcbiAgfVxuXG4gIHByaXZhdGUgZ2VuZXJhdGVIYW5kbGVyKGNoZWNrczogc3RyaW5nW10sIGNvbmZpZz86IEV4dGVuc2lvbkNvbmZpZywgY29tcG9zZXJDb25maWc/OiBDb21wb3NlckNvbmZpZyk6IHN0cmluZyB7XG4gICAgY29uc3QgaGFzQXV0aCA9IGNoZWNrcy5pbmNsdWRlcygnYXV0aCcpO1xuICAgIGNvbnN0IHJlcXVpcmVNZmEgPSBjb21wb3NlckNvbmZpZz8ucmVxdWlyZU1mYSA/PyBmYWxzZTtcbiAgICBjb25zdCBsaW5lczogc3RyaW5nW10gPSBbXG4gICAgICAnLy8gR2VuZXJhdGVkIGhhbmRsZXIgZnVuY3Rpb24nLFxuICAgICAgaGFzQXV0aCA/ICdhc3luYyBmdW5jdGlvbiBoYW5kbGVyKGV2ZW50KSB7JyA6ICdmdW5jdGlvbiBoYW5kbGVyKGV2ZW50KSB7JyxcbiAgICAgICcgIHZhciBkZWNvZGVkUGF5bG9hZCA9IG51bGw7JyxcbiAgICAgICcnLFxuICAgIF07XG5cbiAgICAvLyBBZGQgVExTIGNoZWNrXG4gICAgaWYgKGNoZWNrcy5pbmNsdWRlcygndGxzJykpIHtcbiAgICAgIGxpbmVzLnB1c2goXG4gICAgICAgICcgIC8vIFRMUyAxLjMgZW5mb3JjZW1lbnQnLFxuICAgICAgICAnICB2YXIgdGxzUmVzdWx0ID0gY2hlY2tUTFMoZXZlbnQpOycsXG4gICAgICAgICcgIGlmICh0bHNSZXN1bHQpIHJldHVybiB0bHNSZXN1bHQ7JyxcbiAgICAgICAgJycsXG4gICAgICApO1xuICAgIH1cblxuICAgIC8vIEFkZCBhdXRoIGNoZWNrICh3aXRoIG9wdGlvbmFsIHJvbGUgY2hlY2tpbmcgYnVpbHQtaW4pXG4gICAgaWYgKGhhc0F1dGgpIHtcbiAgICAgIGNvbnN0IHJlcXVpcmVkUm9sZXMgPSBjb25maWc/LnJlcXVpcmVkUm9sZXMgPyBjb25maWcucmVxdWlyZWRSb2xlcyA6IFtdO1xuICAgICAgY29uc3QgbWF0Y2hNb2RlID0gY29uZmlnPy5yb2xlTWF0Y2hNb2RlIHx8IFJvbGVNYXRjaE1vZGUuT1I7XG4gICAgICBjb25zdCByb2xlc0pzb24gPSBKU09OLnN0cmluZ2lmeShyZXF1aXJlZFJvbGVzKTtcblxuICAgICAgbGluZXMucHVzaChcbiAgICAgICAgJyAgLy8gQXV0aGVudGljYXRpb24gY2hlY2snLFxuICAgICAgICBgICB2YXIgcmVxdWlyZWRSb2xlcyA9ICR7cm9sZXNKc29ufTtgLFxuICAgICAgICBgICB2YXIgbWF0Y2hNb2RlID0gJyR7bWF0Y2hNb2RlfSc7YCxcbiAgICAgICAgJyAgdmFyIGF1dGhSZXN1bHQgPSBhd2FpdCBjaGVja0F1dGgoZXZlbnQsIGRlY29kZWRQYXlsb2FkLCByZXF1aXJlZFJvbGVzLCBtYXRjaE1vZGUpOycsXG4gICAgICAgICcgIGlmICghYXV0aFJlc3VsdC5wYXNzKSByZXR1cm4gYXV0aFJlc3VsdC5yZXNwb25zZTsnLFxuICAgICAgICAnICBkZWNvZGVkUGF5bG9hZCA9IGF1dGhSZXN1bHQucGF5bG9hZDsnLFxuICAgICAgICAnJyxcbiAgICAgICAgJyAgLy8gSW5qZWN0IEF6dXJlIEFEIEpXVCBmb3IgQXNzdW1lUm9sZVdpdGhXZWJJZGVudGl0eSAoQXp1cmUgb25seSknLFxuICAgICAgICAnICBpZiAodHlwZW9mIGluamVjdEF6dXJlVG9rZW4gPT09IFxcJ2Z1bmN0aW9uXFwnKSB7JyxcbiAgICAgICAgJyAgICBldmVudC5yZXF1ZXN0ID0gaW5qZWN0QXp1cmVUb2tlbihldmVudC5yZXF1ZXN0LCBldmVudC5yZXF1ZXN0LmNvb2tpZXMpOycsXG4gICAgICAgICcgIH0nLFxuICAgICAgICAnJyxcbiAgICAgICAgJyAgLy8gSW5qZWN0IGlkZW50aXR5IGNsYWltcyBhcyBoZWFkZXJzIGZvciBvcmlnaW4gKHdoZW4gZW5hYmxlZCknLFxuICAgICAgICAnICBpZiAodHlwZW9mIGluamVjdENsYWltc0hlYWRlcnMgPT09IFxcJ2Z1bmN0aW9uXFwnKSB7JyxcbiAgICAgICAgJyAgICBldmVudC5yZXF1ZXN0ID0gaW5qZWN0Q2xhaW1zSGVhZGVycyhldmVudC5yZXF1ZXN0LCBkZWNvZGVkUGF5bG9hZCk7JyxcbiAgICAgICAgJyAgfScsXG4gICAgICAgICcnLFxuICAgICAgKTtcblxuICAgICAgLy8gTUZBIGVuZm9yY2VtZW50IChkZWZlbmNlIGluIGRlcHRoKVxuICAgICAgaWYgKHJlcXVpcmVNZmEpIHtcbiAgICAgICAgbGluZXMucHVzaChcbiAgICAgICAgICAnICAvLyBNRkEgZW5mb3JjZW1lbnQnLFxuICAgICAgICAgICcgIGlmIChkZWNvZGVkUGF5bG9hZCkgeycsXG4gICAgICAgICAgJyAgICB2YXIgYW1yID0gZGVjb2RlZFBheWxvYWQuYW1yIHx8IFtdOycsXG4gICAgICAgICAgJyAgICBpZiAoYW1yLmluZGV4T2YoXFwnbWZhXFwnKSA9PT0gLTEpIHsnLFxuICAgICAgICAgICcgICAgICByZXR1cm4geycsXG4gICAgICAgICAgJyAgICAgICAgc3RhdHVzQ29kZTogNDAzLCcsXG4gICAgICAgICAgJyAgICAgICAgc3RhdHVzRGVzY3JpcHRpb246IFxcJ0ZvcmJpZGRlblxcJywnLFxuICAgICAgICAgICcgICAgICAgIGJvZHk6IFxcJ0FjY2VzcyBkZW5pZWQ6IE1GQSByZXF1aXJlZFxcJycsXG4gICAgICAgICAgJyAgICAgIH07JyxcbiAgICAgICAgICAnICAgIH0nLFxuICAgICAgICAgICcgIH0nLFxuICAgICAgICAgICcnLFxuICAgICAgICApO1xuICAgICAgfVxuICAgIH1cblxuICAgIC8vIEFkZCBVUkwgcmV3cml0ZSBhZnRlciBhdXRoIHNvIG9yaWdpbmFsUGF0aCBpcyBzYXZlZCBjb3JyZWN0bHlcbiAgICBpZiAoY2hlY2tzLmluY2x1ZGVzKCdyZXdyaXRlJykpIHtcbiAgICAgIGxpbmVzLnB1c2goXG4gICAgICAgICcgIHJld3JpdGVUb0luZGV4KGV2ZW50KTsnLFxuICAgICAgICAnJyxcbiAgICAgICk7XG4gICAgfVxuXG4gICAgbGluZXMucHVzaChcbiAgICAgICcgIC8vIEFsbCBjaGVja3MgcGFzc2VkJyxcbiAgICAgICcgIHJldHVybiBldmVudC5yZXF1ZXN0OycsXG4gICAgICAnfScsXG4gICAgKTtcblxuICAgIHJldHVybiBsaW5lcy5qb2luKCdcXG4nKTtcbiAgfVxufVxuIl19

package/lib/cloudfront/cloudfront-functions/modules/auth-check.js

@@ -140,7 +140,33 @@ function getOriginalPath(request) {
   return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath, host) {
+// A live PKCE sign-in is represented by the pair of cookies (oauth_state +
+// code_verifier) minted on the redirect that started it. The browser drops both
+// at Max-Age=600, so their PRESENCE (with a well-formed, decodable state) is the
+// practical "unexpired flow" signal available to a CloudFront Function — it has
+// no way to read a cookie's own expiry. Reusing an existing pair instead of
+// minting a new one is what stops a redirect provoked mid-sign-in (e.g. a
+// background notification poll from a sibling panel on the shared cookie domain)
+// from overwriting the state the in-flight sign-in carries, which the callback
+// compares strictly and rejects with "400 Invalid state parameter".
+function inflightAuthFlow(cookies) {
+  if (!cookies) { return null; }
+  var stateCookie = cookies.oauth_state;
+  var verifierCookie = cookies.code_verifier;
+  if (!stateCookie || !stateCookie.value || !verifierCookie || !verifierCookie.value) {
+    return null;
+  }
+  // Require the state to be decodable — a malformed value is not a flow we can
+  // reissue against, so fall through to minting a fresh one.
+  try {
+    JSON.parse(base64urlDecode(stateCookie.value));
+  } catch (e) {
+    return null;
+  }
+  return { state: stateCookie.value, codeVerifier: verifierCookie.value };
+}
+
+function redirectToAuth(originalPath, host, cookies) {
   // Custom-UI mode: redirect to a first-party login page. No IdP redirect and
   // no PKCE state/verifier cookies — the login page performs SRP client-side and
   // POSTs the resulting tokens to the session-issuance endpoint.
@@ -153,10 +179,27 @@ function redirectToAuth(originalPath, host) {
       }
     };
   }
+  var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
+
+  // If a sign-in is already in flight, reissue the redirect REUSING its state and
+  // verifier, and set NO cookies — do not clobber the live flow. The challenge is
+  // re-derived from the stored verifier so the authorize URL stays consistent with
+  // the PKCE exchange the callback will perform for whichever flow completes.
+  var inflight = inflightAuthFlow(cookies);
+  if (inflight) {
+    var reusedChallenge = generateCodeChallenge(inflight.codeVerifier);
+    return {
+      statusCode: 302,
+      headers: {
+        location: { value: buildAzureAuthUrl(inflight.state, reusedChallenge, host) },
+        'cache-control': { value: 'no-store' }
+      }
+    };
+  }
+
   var state = generateState(originalPath, host);
   var codeVerifier = generateCodeVerifier();
   var codeChallenge = generateCodeChallenge(codeVerifier);
-  var domainAttr = COOKIE_DOMAIN ? '; Domain=' + COOKIE_DOMAIN : '';
   return {
     statusCode: 302,
     headers: {
@@ -213,14 +256,14 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   if (!sessionCookie) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath, host)
+      response: redirectToAuth(originalPath, host, request.cookies)
     };
   }
   var token = sessionCookie.value;
   if (!token || token.length === 0) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath, host)
+      response: redirectToAuth(originalPath, host, request.cookies)
     };
   }
   try {
@@ -228,14 +271,14 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
     if (parts.length !== 3) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath, host)
+        response: redirectToAuth(originalPath, host, request.cookies)
       };
     }
     var isValid = await validateHmacSignature(token);
     if (!isValid) {
       return {
         pass: false,
-        response: redirectToAuth(originalPath, host)
+        response: redirectToAuth(originalPath, host, request.cookies)
       };
     }
     var payload = JSON.parse(base64urlDecode(parts[1]));
@@ -250,7 +293,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
       }
       return {
         pass: false,
-        response: redirectToAuth(originalPath, host)
+        response: redirectToAuth(originalPath, host, request.cookies)
       };
     }
     var jti = payload.jti;
@@ -260,7 +303,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
         if (isRevoked) {
           return {
             pass: false,
-            response: redirectToAuth(originalPath, host)
+            response: redirectToAuth(originalPath, host, request.cookies)
           };
         }
       } catch (e) {}
@@ -304,7 +347,7 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   } catch (e) {
     return {
       pass: false,
-      response: redirectToAuth(originalPath, host)
+      response: redirectToAuth(originalPath, host, request.cookies)
     };
   }
 }

package/lib/cloudfront/cloudfront-functions/modules/cognito-auth-check.js

@@ -121,7 +121,47 @@ function getOriginalPath(request) {
   return request.uri + '?' + qs;
 }
 
-function redirectToAuth(originalPath) {
+// A live PKCE sign-in is represented by the pair of cookies (oauth_state +
+// code_verifier) minted on the redirect that started it. The browser drops both
+// at Max-Age=600, so their PRESENCE (with a well-formed, decodable state) is the
+// practical "unexpired flow" signal available to a CloudFront Function — it has
+// no way to read a cookie's own expiry. Reusing an existing pair instead of
+// minting a new one is what stops a redirect provoked mid-sign-in (e.g. a
+// background notification poll from a sibling panel on the shared cookie domain)
+// from overwriting the state the in-flight sign-in carries, which the callback
+// compares strictly and rejects with "400 Invalid state parameter".
+function inflightAuthFlow(cookies) {
+  if (!cookies) { return null; }
+  var stateCookie = cookies.oauth_state;
+  var verifierCookie = cookies.code_verifier;
+  if (!stateCookie || !stateCookie.value || !verifierCookie || !verifierCookie.value) {
+    return null;
+  }
+  try {
+    JSON.parse(base64urlDecode(stateCookie.value));
+  } catch (e) {
+    return null;
+  }
+  return { state: stateCookie.value, codeVerifier: verifierCookie.value };
+}
+
+function redirectToAuth(originalPath, cookies) {
+  // If a sign-in is already in flight, reissue the redirect REUSING its state and
+  // verifier, and set NO cookies — do not clobber the live flow. The challenge is
+  // re-derived from the stored verifier so the authorize URL stays consistent with
+  // the PKCE exchange the callback performs for whichever flow completes.
+  var inflight = inflightAuthFlow(cookies);
+  if (inflight) {
+    var reusedChallenge = generateCodeChallenge(inflight.codeVerifier);
+    return {
+      statusCode: 302,
+      headers: {
+        location: { value: buildCognitoAuthUrl(inflight.state, reusedChallenge) },
+        'cache-control': { value: 'no-store' }
+      }
+    };
+  }
+
   var state = generateState(originalPath);
   var codeVerifier = generateCodeVerifier();
   var codeChallenge = generateCodeChallenge(codeVerifier);
@@ -155,32 +195,32 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
   var cookies = request.cookies;
   var originalPath = getOriginalPath(request);
   if (!cookies['__Host-auth_session']) {
-    return { pass: false, response: redirectToAuth(originalPath) };
+    return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
   }
   var token = cookies['__Host-auth_session'].value;
   if (!token || token.length === 0) {
-    return { pass: false, response: redirectToAuth(originalPath) };
+    return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
   }
   try {
     var parts = token.split('.');
     if (parts.length !== 3) {
-      return { pass: false, response: redirectToAuth(originalPath) };
+      return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
     }
     var isValid = await validateHmacSignature(token);
     if (!isValid) {
-      return { pass: false, response: redirectToAuth(originalPath) };
+      return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
     }
     var payload = JSON.parse(base64urlDecode(parts[1]));
     var now = Math.floor(Date.now() / 1000);
     if (payload.exp && payload.exp < now) {
-      return { pass: false, response: redirectToAuth(originalPath) };
+      return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
     }
     var jti = payload.jti;
     if (jti) {
       try {
         var isRevoked = await kvsHandle.get('revoked:' + jti);
         if (isRevoked) {
-          return { pass: false, response: redirectToAuth(originalPath) };
+          return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
         }
       } catch (e) {}
     }
@@ -218,6 +258,6 @@ async function checkAuth(event, decodedPayload, requiredRoles, roleMatchMode) {
 
     return { pass: true, payload: payload };
   } catch (e) {
-    return { pass: false, response: redirectToAuth(originalPath) };
+    return { pass: false, response: redirectToAuth(originalPath, request.cookies) };
   }
 }