terraconstructs 0.0.8

package/lib/aws/iam/private/merge-statements.js

@@ -0,0 +1,214 @@
+"use strict";
+// IAM Statement merging
+// copied from https://github.com/aws/aws-cdk/blob/v2.161.1/packages/aws-cdk-lib/aws-iam/lib/private/merge-statements.ts
+//
+// See https://github.com/aws/aws-cdk/blob/v2.161.1/packages/aws-cdk-lib/aws-iam/docs/policy-merging.als
+// for a formal model of the logic implemented here.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeStatements = void 0;
+const comparable_principal_1 = require("./comparable-principal");
+const policy_statement_1 = require("../policy-statement");
+// import { LITERAL_STRING_KEY } from "../util";
+/*
+ * Don't produce any merged statements larger than this.
+ *
+ * They will become impossible to divide across managed policies if we do,
+ * and this is the maximum size for User policies.
+ */
+const MAX_MERGE_SIZE = 2000;
+/**
+ * Merge as many statements as possible to shrink the total policy doc, modifying the input array in place
+ *
+ * We compare and merge all pairs of statements (O(N^2) complexity), opportunistically
+ * merging them. This is not guaranteed to produce the optimal output, but it's probably
+ * Good Enough(tm). If it merges anything, it's at least going to produce a smaller output
+ * than the input.
+ */
+function mergeStatements(statements, options) {
+    const sizeOptions = (0, policy_statement_1.deriveEstimateSizeOptions)(options.scope);
+    const compStatements = statements.map(makeComparable);
+    const mergeFn = (options?.mergeIfCombinable ?? true) ? mergeIfCombinable : mergeIfEqual;
+    // Keep trying until nothing changes anymore
+    while (onePass()) {
+        /* again */
+    }
+    const mergedStatements = new Array();
+    const originsMap = new Map();
+    for (const comp of compStatements) {
+        const statement = renderComparable(comp);
+        mergedStatements.push(statement);
+        originsMap.set(statement, comp.originals);
+    }
+    return { mergedStatements, originsMap };
+    // Do one optimization pass, return 'true' if we merged anything
+    function onePass() {
+        let ret = false;
+        for (let i = 0; i < compStatements.length; i++) {
+            let j = i + 1;
+            while (j < compStatements.length) {
+                const merged = mergeFn(compStatements[i], compStatements[j], !!options.limitSize, sizeOptions);
+                if (merged) {
+                    compStatements[i] = merged;
+                    compStatements.splice(j, 1);
+                    ret = true;
+                }
+                else {
+                    j++;
+                }
+            }
+        }
+        return ret;
+    }
+}
+exports.mergeStatements = mergeStatements;
+/**
+ * Given two statements, return their merging (if possible)
+ *
+ * We can merge two statements if:
+ *
+ * - Their effects are the same
+ * - They don't have Sids (not really a hard requirement, but just a simplification and an escape hatch)
+ * - Their Conditions are the same
+ * - Their NotAction, NotResource and NotPrincipal sets are the same (empty sets is fine).
+ * - From their Action, Resource and Principal sets, 2 are subsets of each other
+ *   (empty sets are fine).
+ */
+function mergeIfCombinable(a, b, limitSize, options) {
+    // Effects must be the same
+    if (a.statement.effect !== b.statement.effect) {
+        return;
+    }
+    // We don't merge Sids (for now)
+    if (a.statement.sid || b.statement.sid) {
+        return;
+    }
+    if (a.conditionString !== b.conditionString) {
+        return;
+    }
+    if (!setEqual(a.statement.notActions, b.statement.notActions) ||
+        !setEqual(a.statement.notResources, b.statement.notResources) ||
+        !setEqualPrincipals(a.statement.notPrincipals, b.statement.notPrincipals)) {
+        return;
+    }
+    // We can merge these statements if 2 out of the 3 sets of Action, Resource, Principal
+    // are the same.
+    const setsEqual = (setEqual(a.statement.actions, b.statement.actions) ? 1 : 0) +
+        (setEqual(a.statement.resources, b.statement.resources) ? 1 : 0) +
+        (setEqualPrincipals(a.statement.principals, b.statement.principals)
+            ? 1
+            : 0);
+    if (setsEqual < 2 || unmergeablePrincipals(a, b)) {
+        return;
+    }
+    const combined = a.statement.copy({
+        actions: setMerge(a.statement.actions, b.statement.actions),
+        resources: setMerge(a.statement.resources, b.statement.resources),
+        principals: setMergePrincipals(a.statement.principals, b.statement.principals),
+    });
+    if (limitSize && combined._estimateSize(options) > MAX_MERGE_SIZE) {
+        return undefined;
+    }
+    return {
+        originals: [...a.originals, ...b.originals],
+        statement: combined,
+        conditionString: a.conditionString,
+    };
+}
+/**
+ * We merge two statements only if they are exactly the same
+ */
+function mergeIfEqual(a, b) {
+    if (a.statement.effect !== b.statement.effect) {
+        return;
+    }
+    if (a.statement.sid !== b.statement.sid) {
+        return;
+    }
+    if (a.conditionString !== b.conditionString) {
+        return;
+    }
+    if (!setEqual(a.statement.notActions, b.statement.notActions) ||
+        !setEqual(a.statement.notResources, b.statement.notResources) ||
+        !setEqualPrincipals(a.statement.notPrincipals, b.statement.notPrincipals)) {
+        return;
+    }
+    if (!setEqual(a.statement.actions, b.statement.actions) ||
+        !setEqual(a.statement.resources, b.statement.resources) ||
+        !setEqualPrincipals(a.statement.principals, b.statement.principals)) {
+        return;
+    }
+    return {
+        originals: [...a.originals, ...b.originals],
+        statement: a.statement,
+        conditionString: a.conditionString,
+    };
+}
+/**
+ * Calculate and return cached string set representation of the statement elements
+ *
+ * This is to be able to do comparisons on these sets quickly.
+ */
+function makeComparable(s) {
+    return {
+        originals: [s],
+        statement: s,
+        ...(s.conditions
+            ? {
+                conditionString: JSON.stringify((0, policy_statement_1.toConditionJson)(...s.conditions)),
+            }
+            : {}),
+    };
+}
+/**
+ * Return 'true' if the two principals are unmergeable
+ *
+ * This only happens if one of them is a literal, untyped principal (typically,
+ * `Principal: '*'`) and the other one is typed.
+ *
+ * `Principal: '*'` behaves subtly different than `Principal: { AWS: '*' }` and must
+ * therefore be preserved.
+ */
+function unmergeablePrincipals(a, b) {
+    const aHasStarPrincipal = a.statement.principals.some((v) => typeof v.policyFragment.principalJson === "string" &&
+        v.policyFragment.principalJson == "*");
+    const bHasLiteral = b.statement.principals.some((v) => typeof v.policyFragment.principalJson === "string" &&
+        v.policyFragment.principalJson == "*");
+    return aHasStarPrincipal !== bHasLiteral;
+}
+/**
+ * Turn a ComparableStatement back into a Statement
+ */
+function renderComparable(s) {
+    return s.statement;
+}
+/**
+ * Whether the given sets are equal
+ */
+function setEqual(a, b) {
+    const bSet = new Set(b);
+    return a.length === b.length && a.every((k) => bSet.has(k));
+}
+/**
+ * Merge two value sets
+ */
+function setMerge(x, y) {
+    return Array.from(new Set([...x, ...y])).sort();
+}
+function setEqualPrincipals(xs, ys) {
+    const xPrincipals = (0, comparable_principal_1.partitionPrincipals)(xs);
+    const yPrincipals = (0, comparable_principal_1.partitionPrincipals)(ys);
+    const nonComp = setEqual(xPrincipals.nonComparable, yPrincipals.nonComparable);
+    const comp = setEqual(Object.keys(xPrincipals.comparable), Object.keys(yPrincipals.comparable));
+    return nonComp && comp;
+}
+function setMergePrincipals(xs, ys) {
+    const xPrincipals = (0, comparable_principal_1.partitionPrincipals)(xs);
+    const yPrincipals = (0, comparable_principal_1.partitionPrincipals)(ys);
+    const comparable = { ...xPrincipals.comparable, ...yPrincipals.comparable };
+    return [
+        ...Object.values(comparable),
+        ...xPrincipals.nonComparable,
+        ...yPrincipals.nonComparable,
+    ];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWVyZ2Utc3RhdGVtZW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hd3MvaWFtL3ByaXZhdGUvbWVyZ2Utc3RhdGVtZW50cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUEsd0JBQXdCO0FBQ3hCLHdIQUF3SDtBQUN4SCxFQUFFO0FBQ0Ysd0dBQXdHO0FBQ3hHLG9EQUFvRDs7O0FBR3BELGlFQUE2RDtBQUM3RCwwREFLNkI7QUFFN0IsZ0RBQWdEO0FBRWhEOzs7OztHQUtHO0FBQ0gsTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDO0FBNEI1Qjs7Ozs7OztHQU9HO0FBQ0gsU0FBZ0IsZUFBZSxDQUM3QixVQUE2QixFQUM3QixPQUE4QjtJQUU5QixNQUFNLFdBQVcsR0FBRyxJQUFBLDRDQUF5QixFQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM3RCxNQUFNLGNBQWMsR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQ3RELE1BQU0sT0FBTyxHQUNYLENBQUMsT0FBTyxFQUFFLGlCQUFpQixJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDO0lBRTFFLDRDQUE0QztJQUM1QyxPQUFPLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDakIsV0FBVztJQUNiLENBQUM7SUFFRCxNQUFNLGdCQUFnQixHQUFHLElBQUksS0FBSyxFQUFtQixDQUFDO0lBQ3RELE1BQU0sVUFBVSxHQUFHLElBQUksR0FBRyxFQUFzQyxDQUFDO0lBQ2pFLEtBQUssTUFBTSxJQUFJLElBQUksY0FBYyxFQUFFLENBQUM7UUFDbEMsTUFBTSxTQUFTLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDekMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pDLFVBQVUsQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBRUQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxDQUFDO0lBRXhDLGdFQUFnRTtJQUNoRSxTQUFTLE9BQU87UUFDZCxJQUFJLEdBQUcsR0FBRyxLQUFLLENBQUM7UUFFaEIsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLGNBQWMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUMvQyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ2QsT0FBTyxDQUFDLEdBQUcsY0FBYyxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNqQyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQ3BCLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFDakIsY0FBYyxDQUFDLENBQUMsQ0FBQyxFQUNqQixDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFDbkIsV0FBVyxDQUNaLENBQUM7Z0JBRUYsSUFBSSxNQUFNLEVBQUUsQ0FBQztvQkFDWCxjQUFjLENBQUMsQ0FBQyxDQUFDLEdBQUcsTUFBTSxDQUFDO29CQUMzQixjQUFjLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztvQkFDNUIsR0FBRyxHQUFHLElBQUksQ0FBQztnQkFDYixDQUFDO3FCQUFNLENBQUM7b0JBQ04sQ0FBQyxFQUFFLENBQUM7Z0JBQ04sQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDO0FBQ0gsQ0FBQztBQWxERCwwQ0FrREM7QUFjRDs7Ozs7Ozs7Ozs7R0FXRztBQUNILFNBQVMsaUJBQWlCLENBQ3hCLENBQXNCLEVBQ3RCLENBQXNCLEVBQ3RCLFNBQWtCLEVBQ2xCLE9BQTRCO0lBRTVCLDJCQUEyQjtJQUMzQixJQUFJLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDOUMsT0FBTztJQUNULENBQUM7SUFDRCxnQ0FBZ0M7SUFDaEMsSUFBSSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3ZDLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxDQUFDLENBQUMsZUFBZSxLQUFLLENBQUMsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUM1QyxPQUFPO0lBQ1QsQ0FBQztJQUNELElBQ0UsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUM7UUFDekQsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDN0QsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUN6RSxDQUFDO1FBQ0QsT0FBTztJQUNULENBQUM7SUFFRCxzRkFBc0Y7SUFDdEYsZ0JBQWdCO0lBQ2hCLE1BQU0sU0FBUyxHQUNiLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzVELENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUM7WUFDakUsQ0FBQyxDQUFDLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFVCxJQUFJLFNBQVMsR0FBRyxDQUFDLElBQUkscUJBQXFCLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDakQsT0FBTztJQUNULENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxDQUFDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQztRQUNoQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDO1FBQzNELFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7UUFDakUsVUFBVSxFQUFFLGtCQUFrQixDQUM1QixDQUFDLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFDdEIsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQ3ZCO0tBQ0YsQ0FBQyxDQUFDO0lBRUgsSUFBSSxTQUFTLElBQUksUUFBUSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsR0FBRyxjQUFjLEVBQUUsQ0FBQztRQUNsRSxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsT0FBTztRQUNMLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDM0MsU0FBUyxFQUFFLFFBQVE7UUFDbkIsZUFBZSxFQUFFLENBQUMsQ0FBQyxlQUFlO0tBQ25DLENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxTQUFTLFlBQVksQ0FDbkIsQ0FBc0IsRUFDdEIsQ0FBc0I7SUFFdEIsSUFBSSxDQUFDLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzlDLE9BQU87SUFDVCxDQUFDO0lBQ0QsSUFBSSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3hDLE9BQU87SUFDVCxDQUFDO0lBQ0QsSUFBSSxDQUFDLENBQUMsZUFBZSxLQUFLLENBQUMsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUM1QyxPQUFPO0lBQ1QsQ0FBQztJQUNELElBQ0UsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUM7UUFDekQsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDN0QsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUN6RSxDQUFDO1FBQ0QsT0FBTztJQUNULENBQUM7SUFDRCxJQUNFLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDO1FBQ25ELENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1FBQ3ZELENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFDbkUsQ0FBQztRQUNELE9BQU87SUFDVCxDQUFDO0lBRUQsT0FBTztRQUNMLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDM0MsU0FBUyxFQUFFLENBQUMsQ0FBQyxTQUFTO1FBQ3RCLGVBQWUsRUFBRSxDQUFDLENBQUMsZUFBZTtLQUNuQyxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFTLGNBQWMsQ0FBQyxDQUFrQjtJQUN4QyxPQUFPO1FBQ0wsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2QsU0FBUyxFQUFFLENBQUM7UUFDWixHQUFHLENBQUMsQ0FBQyxDQUFDLFVBQVU7WUFDZCxDQUFDLENBQUM7Z0JBQ0UsZUFBZSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBQSxrQ0FBZSxFQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO2FBQ2xFO1lBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztLQUNSLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxTQUFTLHFCQUFxQixDQUFDLENBQXNCLEVBQUUsQ0FBc0I7SUFDM0UsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQ25ELENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FDSixPQUFPLENBQUMsQ0FBQyxjQUFjLENBQUMsYUFBYSxLQUFLLFFBQVE7UUFDbEQsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxhQUFhLElBQUksR0FBRyxDQUN4QyxDQUFDO0lBQ0YsTUFBTSxXQUFXLEdBQUcsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUM3QyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQ0osT0FBTyxDQUFDLENBQUMsY0FBYyxDQUFDLGFBQWEsS0FBSyxRQUFRO1FBQ2xELENBQUMsQ0FBQyxjQUFjLENBQUMsYUFBYSxJQUFJLEdBQUcsQ0FDeEMsQ0FBQztJQUNGLE9BQU8saUJBQWlCLEtBQUssV0FBVyxDQUFDO0FBQzNDLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQVMsZ0JBQWdCLENBQUMsQ0FBc0I7SUFDOUMsT0FBTyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ3JCLENBQUM7QUFXRDs7R0FFRztBQUNILFNBQVMsUUFBUSxDQUFJLENBQU0sRUFBRSxDQUFNO0lBQ2pDLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hCLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM5RCxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxTQUFTLFFBQVEsQ0FBSSxDQUFNLEVBQUUsQ0FBTTtJQUNqQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUNsRCxDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxFQUFnQixFQUFFLEVBQWdCO0lBQzVELE1BQU0sV0FBVyxHQUFHLElBQUEsMENBQW1CLEVBQUMsRUFBRSxDQUFDLENBQUM7SUFDNUMsTUFBTSxXQUFXLEdBQUcsSUFBQSwwQ0FBbUIsRUFBQyxFQUFFLENBQUMsQ0FBQztJQUU1QyxNQUFNLE9BQU8sR0FBRyxRQUFRLENBQ3RCLFdBQVcsQ0FBQyxhQUFhLEVBQ3pCLFdBQVcsQ0FBQyxhQUFhLENBQzFCLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxRQUFRLENBQ25CLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxFQUNuQyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FDcEMsQ0FBQztJQUVGLE9BQU8sT0FBTyxJQUFJLElBQUksQ0FBQztBQUN6QixDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxFQUFnQixFQUFFLEVBQWdCO0lBQzVELE1BQU0sV0FBVyxHQUFHLElBQUEsMENBQW1CLEVBQUMsRUFBRSxDQUFDLENBQUM7SUFDNUMsTUFBTSxXQUFXLEdBQUcsSUFBQSwwQ0FBbUIsRUFBQyxFQUFFLENBQUMsQ0FBQztJQUU1QyxNQUFNLFVBQVUsR0FBRyxFQUFFLEdBQUcsV0FBVyxDQUFDLFVBQVUsRUFBRSxHQUFHLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUM1RSxPQUFPO1FBQ0wsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQztRQUM1QixHQUFHLFdBQVcsQ0FBQyxhQUFhO1FBQzVCLEdBQUcsV0FBVyxDQUFDLGFBQWE7S0FDN0IsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBJQU0gU3RhdGVtZW50IG1lcmdpbmdcbi8vIGNvcGllZCBmcm9tIGh0dHBzOi8vZ2l0aHViLmNvbS9hd3MvYXdzLWNkay9ibG9iL3YyLjE2MS4xL3BhY2thZ2VzL2F3cy1jZGstbGliL2F3cy1pYW0vbGliL3ByaXZhdGUvbWVyZ2Utc3RhdGVtZW50cy50c1xuLy9cbi8vIFNlZSBodHRwczovL2dpdGh1Yi5jb20vYXdzL2F3cy1jZGsvYmxvYi92Mi4xNjEuMS9wYWNrYWdlcy9hd3MtY2RrLWxpYi9hd3MtaWFtL2RvY3MvcG9saWN5LW1lcmdpbmcuYWxzXG4vLyBmb3IgYSBmb3JtYWwgbW9kZWwgb2YgdGhlIGxvZ2ljIGltcGxlbWVudGVkIGhlcmUuXG5cbmltcG9ydCB7IElDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiO1xuaW1wb3J0IHsgcGFydGl0aW9uUHJpbmNpcGFscyB9IGZyb20gXCIuL2NvbXBhcmFibGUtcHJpbmNpcGFsXCI7XG5pbXBvcnQge1xuICBQb2xpY3lTdGF0ZW1lbnQsXG4gIEVzdGltYXRlU2l6ZU9wdGlvbnMsXG4gIGRlcml2ZUVzdGltYXRlU2l6ZU9wdGlvbnMsXG4gIHRvQ29uZGl0aW9uSnNvbixcbn0gZnJvbSBcIi4uL3BvbGljeS1zdGF0ZW1lbnRcIjtcbmltcG9ydCB7IElQcmluY2lwYWwgfSBmcm9tIFwiLi4vcHJpbmNpcGFsc1wiO1xuLy8gaW1wb3J0IHsgTElURVJBTF9TVFJJTkdfS0VZIH0gZnJvbSBcIi4uL3V0aWxcIjtcblxuLypcbiAqIERvbid0IHByb2R1Y2UgYW55IG1lcmdlZCBzdGF0ZW1lbnRzIGxhcmdlciB0aGFuIHRoaXMuXG4gKlxuICogVGhleSB3aWxsIGJlY29tZSBpbXBvc3NpYmxlIHRvIGRpdmlkZSBhY3Jvc3MgbWFuYWdlZCBwb2xpY2llcyBpZiB3ZSBkbyxcbiAqIGFuZCB0aGlzIGlzIHRoZSBtYXhpbXVtIHNpemUgZm9yIFVzZXIgcG9saWNpZXMuXG4gKi9cbmNvbnN0IE1BWF9NRVJHRV9TSVpFID0gMjAwMDtcblxuLyoqXG4gKiBPcHRpb25zIGZvciB0aGUgbWVyZ2VTdGF0ZW1lbnQgY29tbWFuZFxuICovXG5leHBvcnQgaW50ZXJmYWNlIE1lcmdlU3RhdGVtZW50T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBTY29wZSB0byBkZXJpdmUgY29uZmlndXJhdGlvbiBmbGFncyBmcm9tXG4gICAqL1xuICByZWFkb25seSBzY29wZTogSUNvbnN0cnVjdDtcblxuICAvKipcbiAgICogRG8gbm90IG1lcmdlIHN0YXRlbWVudHMgaWYgdGhlIHJlc3VsdCB3b3VsZCBiZSBiaWdnZXIgdGhhbiBNQVhfTUVSR0VfU0laRVxuICAgKlxuICAgKiBAZGVmYXVsdCBmYWxzZVxuICAgKi9cbiAgcmVhZG9ubHkgbGltaXRTaXplPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogTWVyZ2Ugc3RhdGVtZW50cyBpZiB0aGV5IGNhbiBiZSBjb21iaW5lZCB0byBwcm9kdWNlIHRoZSBzYW1lIGVmZmVjdHMuXG4gICAqXG4gICAqIElmIGZhbHNlLCBzdGF0ZW1lbnRzIGFyZSBvbmx5IG1lcmdlZCBpZiB0aGV5IGFyZSBleGFjdGx5IGVxdWFsLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBtZXJnZUlmQ29tYmluYWJsZT86IGJvb2xlYW47XG59XG5cbi8qKlxuICogTWVyZ2UgYXMgbWFueSBzdGF0ZW1lbnRzIGFzIHBvc3NpYmxlIHRvIHNocmluayB0aGUgdG90YWwgcG9saWN5IGRvYywgbW9kaWZ5aW5nIHRoZSBpbnB1dCBhcnJheSBpbiBwbGFjZVxuICpcbiAqIFdlIGNvbXBhcmUgYW5kIG1lcmdlIGFsbCBwYWlycyBvZiBzdGF0ZW1lbnRzIChPKE5eMikgY29tcGxleGl0eSksIG9wcG9ydHVuaXN0aWNhbGx5XG4gKiBtZXJnaW5nIHRoZW0uIFRoaXMgaXMgbm90IGd1YXJhbnRlZWQgdG8gcHJvZHVjZSB0aGUgb3B0aW1hbCBvdXRwdXQsIGJ1dCBpdCdzIHByb2JhYmx5XG4gKiBHb29kIEVub3VnaCh0bSkuIElmIGl0IG1lcmdlcyBhbnl0aGluZywgaXQncyBhdCBsZWFzdCBnb2luZyB0byBwcm9kdWNlIGEgc21hbGxlciBvdXRwdXRcbiAqIHRoYW4gdGhlIGlucHV0LlxuICovXG5leHBvcnQgZnVuY3Rpb24gbWVyZ2VTdGF0ZW1lbnRzKFxuICBzdGF0ZW1lbnRzOiBQb2xpY3lTdGF0ZW1lbnRbXSxcbiAgb3B0aW9uczogTWVyZ2VTdGF0ZW1lbnRPcHRpb25zLFxuKTogTWVyZ2VTdGF0ZW1lbnRSZXN1bHQge1xuICBjb25zdCBzaXplT3B0aW9ucyA9IGRlcml2ZUVzdGltYXRlU2l6ZU9wdGlvbnMob3B0aW9ucy5zY29wZSk7XG4gIGNvbnN0IGNvbXBTdGF0ZW1lbnRzID0gc3RhdGVtZW50cy5tYXAobWFrZUNvbXBhcmFibGUpO1xuICBjb25zdCBtZXJnZUZuID1cbiAgICAob3B0aW9ucz8ubWVyZ2VJZkNvbWJpbmFibGUgPz8gdHJ1ZSkgPyBtZXJnZUlmQ29tYmluYWJsZSA6IG1lcmdlSWZFcXVhbDtcblxuICAvLyBLZWVwIHRyeWluZyB1bnRpbCBub3RoaW5nIGNoYW5nZXMgYW55bW9yZVxuICB3aGlsZSAob25lUGFzcygpKSB7XG4gICAgLyogYWdhaW4gKi9cbiAgfVxuXG4gIGNvbnN0IG1lcmdlZFN0YXRlbWVudHMgPSBuZXcgQXJyYXk8UG9saWN5U3RhdGVtZW50PigpO1xuICBjb25zdCBvcmlnaW5zTWFwID0gbmV3IE1hcDxQb2xpY3lTdGF0ZW1lbnQsIFBvbGljeVN0YXRlbWVudFtdPigpO1xuICBmb3IgKGNvbnN0IGNvbXAgb2YgY29tcFN0YXRlbWVudHMpIHtcbiAgICBjb25zdCBzdGF0ZW1lbnQgPSByZW5kZXJDb21wYXJhYmxlKGNvbXApO1xuICAgIG1lcmdlZFN0YXRlbWVudHMucHVzaChzdGF0ZW1lbnQpO1xuICAgIG9yaWdpbnNNYXAuc2V0KHN0YXRlbWVudCwgY29tcC5vcmlnaW5hbHMpO1xuICB9XG5cbiAgcmV0dXJuIHsgbWVyZ2VkU3RhdGVtZW50cywgb3JpZ2luc01hcCB9O1xuXG4gIC8vIERvIG9uZSBvcHRpbWl6YXRpb24gcGFzcywgcmV0dXJuICd0cnVlJyBpZiB3ZSBtZXJnZWQgYW55dGhpbmdcbiAgZnVuY3Rpb24gb25lUGFzcygpIHtcbiAgICBsZXQgcmV0ID0gZmFsc2U7XG5cbiAgICBmb3IgKGxldCBpID0gMDsgaSA8IGNvbXBTdGF0ZW1lbnRzLmxlbmd0aDsgaSsrKSB7XG4gICAgICBsZXQgaiA9IGkgKyAxO1xuICAgICAgd2hpbGUgKGogPCBjb21wU3RhdGVtZW50cy5sZW5ndGgpIHtcbiAgICAgICAgY29uc3QgbWVyZ2VkID0gbWVyZ2VGbihcbiAgICAgICAgICBjb21wU3RhdGVtZW50c1tpXSxcbiAgICAgICAgICBjb21wU3RhdGVtZW50c1tqXSxcbiAgICAgICAgICAhIW9wdGlvbnMubGltaXRTaXplLFxuICAgICAgICAgIHNpemVPcHRpb25zLFxuICAgICAgICApO1xuXG4gICAgICAgIGlmIChtZXJnZWQpIHtcbiAgICAgICAgICBjb21wU3RhdGVtZW50c1tpXSA9IG1lcmdlZDtcbiAgICAgICAgICBjb21wU3RhdGVtZW50cy5zcGxpY2UoaiwgMSk7XG4gICAgICAgICAgcmV0ID0gdHJ1ZTtcbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICBqKys7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9XG5cbiAgICByZXR1cm4gcmV0O1xuICB9XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgTWVyZ2VTdGF0ZW1lbnRSZXN1bHQge1xuICAvKipcbiAgICogVGhlIGxpc3Qgb2YgbWF4aW1hbGx5IG1lcmdlZCBzdGF0ZW1lbnRzXG4gICAqL1xuICByZWFkb25seSBtZXJnZWRTdGF0ZW1lbnRzOiBQb2xpY3lTdGF0ZW1lbnRbXTtcblxuICAvKipcbiAgICogTWFwcGluZyBvZiBvbGQgdG8gbmV3IHN0YXRlbWVudHNcbiAgICovXG4gIHJlYWRvbmx5IG9yaWdpbnNNYXA6IE1hcDxQb2xpY3lTdGF0ZW1lbnQsIFBvbGljeVN0YXRlbWVudFtdPjtcbn1cblxuLyoqXG4gKiBHaXZlbiB0d28gc3RhdGVtZW50cywgcmV0dXJuIHRoZWlyIG1lcmdpbmcgKGlmIHBvc3NpYmxlKVxuICpcbiAqIFdlIGNhbiBtZXJnZSB0d28gc3RhdGVtZW50cyBpZjpcbiAqXG4gKiAtIFRoZWlyIGVmZmVjdHMgYXJlIHRoZSBzYW1lXG4gKiAtIFRoZXkgZG9uJ3QgaGF2ZSBTaWRzIChub3QgcmVhbGx5IGEgaGFyZCByZXF1aXJlbWVudCwgYnV0IGp1c3QgYSBzaW1wbGlmaWNhdGlvbiBhbmQgYW4gZXNjYXBlIGhhdGNoKVxuICogLSBUaGVpciBDb25kaXRpb25zIGFyZSB0aGUgc2FtZVxuICogLSBUaGVpciBOb3RBY3Rpb24sIE5vdFJlc291cmNlIGFuZCBOb3RQcmluY2lwYWwgc2V0cyBhcmUgdGhlIHNhbWUgKGVtcHR5IHNldHMgaXMgZmluZSkuXG4gKiAtIEZyb20gdGhlaXIgQWN0aW9uLCBSZXNvdXJjZSBhbmQgUHJpbmNpcGFsIHNldHMsIDIgYXJlIHN1YnNldHMgb2YgZWFjaCBvdGhlclxuICogICAoZW1wdHkgc2V0cyBhcmUgZmluZSkuXG4gKi9cbmZ1bmN0aW9uIG1lcmdlSWZDb21iaW5hYmxlKFxuICBhOiBDb21wYXJhYmxlU3RhdGVtZW50LFxuICBiOiBDb21wYXJhYmxlU3RhdGVtZW50LFxuICBsaW1pdFNpemU6IGJvb2xlYW4sXG4gIG9wdGlvbnM6IEVzdGltYXRlU2l6ZU9wdGlvbnMsXG4pOiBDb21wYXJhYmxlU3RhdGVtZW50IHwgdW5kZWZpbmVkIHtcbiAgLy8gRWZmZWN0cyBtdXN0IGJlIHRoZSBzYW1lXG4gIGlmIChhLnN0YXRlbWVudC5lZmZlY3QgIT09IGIuc3RhdGVtZW50LmVmZmVjdCkge1xuICAgIHJldHVybjtcbiAgfVxuICAvLyBXZSBkb24ndCBtZXJnZSBTaWRzIChmb3Igbm93KVxuICBpZiAoYS5zdGF0ZW1lbnQuc2lkIHx8IGIuc3RhdGVtZW50LnNpZCkge1xuICAgIHJldHVybjtcbiAgfVxuXG4gIGlmIChhLmNvbmRpdGlvblN0cmluZyAhPT0gYi5jb25kaXRpb25TdHJpbmcpIHtcbiAgICByZXR1cm47XG4gIH1cbiAgaWYgKFxuICAgICFzZXRFcXVhbChhLnN0YXRlbWVudC5ub3RBY3Rpb25zLCBiLnN0YXRlbWVudC5ub3RBY3Rpb25zKSB8fFxuICAgICFzZXRFcXVhbChhLnN0YXRlbWVudC5ub3RSZXNvdXJjZXMsIGIuc3RhdGVtZW50Lm5vdFJlc291cmNlcykgfHxcbiAgICAhc2V0RXF1YWxQcmluY2lwYWxzKGEuc3RhdGVtZW50Lm5vdFByaW5jaXBhbHMsIGIuc3RhdGVtZW50Lm5vdFByaW5jaXBhbHMpXG4gICkge1xuICAgIHJldHVybjtcbiAgfVxuXG4gIC8vIFdlIGNhbiBtZXJnZSB0aGVzZSBzdGF0ZW1lbnRzIGlmIDIgb3V0IG9mIHRoZSAzIHNldHMgb2YgQWN0aW9uLCBSZXNvdXJjZSwgUHJpbmNpcGFsXG4gIC8vIGFyZSB0aGUgc2FtZS5cbiAgY29uc3Qgc2V0c0VxdWFsID1cbiAgICAoc2V0RXF1YWwoYS5zdGF0ZW1lbnQuYWN0aW9ucywgYi5zdGF0ZW1lbnQuYWN0aW9ucykgPyAxIDogMCkgK1xuICAgIChzZXRFcXVhbChhLnN0YXRlbWVudC5yZXNvdXJjZXMsIGIuc3RhdGVtZW50LnJlc291cmNlcykgPyAxIDogMCkgK1xuICAgIChzZXRFcXVhbFByaW5jaXBhbHMoYS5zdGF0ZW1lbnQucHJpbmNpcGFscywgYi5zdGF0ZW1lbnQucHJpbmNpcGFscylcbiAgICAgID8gMVxuICAgICAgOiAwKTtcblxuICBpZiAoc2V0c0VxdWFsIDwgMiB8fCB1bm1lcmdlYWJsZVByaW5jaXBhbHMoYSwgYikpIHtcbiAgICByZXR1cm47XG4gIH1cblxuICBjb25zdCBjb21iaW5lZCA9IGEuc3RhdGVtZW50LmNvcHkoe1xuICAgIGFjdGlvbnM6IHNldE1lcmdlKGEuc3RhdGVtZW50LmFjdGlvbnMsIGIuc3RhdGVtZW50LmFjdGlvbnMpLFxuICAgIHJlc291cmNlczogc2V0TWVyZ2UoYS5zdGF0ZW1lbnQucmVzb3VyY2VzLCBiLnN0YXRlbWVudC5yZXNvdXJjZXMpLFxuICAgIHByaW5jaXBhbHM6IHNldE1lcmdlUHJpbmNpcGFscyhcbiAgICAgIGEuc3RhdGVtZW50LnByaW5jaXBhbHMsXG4gICAgICBiLnN0YXRlbWVudC5wcmluY2lwYWxzLFxuICAgICksXG4gIH0pO1xuXG4gIGlmIChsaW1pdFNpemUgJiYgY29tYmluZWQuX2VzdGltYXRlU2l6ZShvcHRpb25zKSA+IE1BWF9NRVJHRV9TSVpFKSB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxuXG4gIHJldHVybiB7XG4gICAgb3JpZ2luYWxzOiBbLi4uYS5vcmlnaW5hbHMsIC4uLmIub3JpZ2luYWxzXSxcbiAgICBzdGF0ZW1lbnQ6IGNvbWJpbmVkLFxuICAgIGNvbmRpdGlvblN0cmluZzogYS5jb25kaXRpb25TdHJpbmcsXG4gIH07XG59XG5cbi8qKlxuICogV2UgbWVyZ2UgdHdvIHN0YXRlbWVudHMgb25seSBpZiB0aGV5IGFyZSBleGFjdGx5IHRoZSBzYW1lXG4gKi9cbmZ1bmN0aW9uIG1lcmdlSWZFcXVhbChcbiAgYTogQ29tcGFyYWJsZVN0YXRlbWVudCxcbiAgYjogQ29tcGFyYWJsZVN0YXRlbWVudCxcbik6IENvbXBhcmFibGVTdGF0ZW1lbnQgfCB1bmRlZmluZWQge1xuICBpZiAoYS5zdGF0ZW1lbnQuZWZmZWN0ICE9PSBiLnN0YXRlbWVudC5lZmZlY3QpIHtcbiAgICByZXR1cm47XG4gIH1cbiAgaWYgKGEuc3RhdGVtZW50LnNpZCAhPT0gYi5zdGF0ZW1lbnQuc2lkKSB7XG4gICAgcmV0dXJuO1xuICB9XG4gIGlmIChhLmNvbmRpdGlvblN0cmluZyAhPT0gYi5jb25kaXRpb25TdHJpbmcpIHtcbiAgICByZXR1cm47XG4gIH1cbiAgaWYgKFxuICAgICFzZXRFcXVhbChhLnN0YXRlbWVudC5ub3RBY3Rpb25zLCBiLnN0YXRlbWVudC5ub3RBY3Rpb25zKSB8fFxuICAgICFzZXRFcXVhbChhLnN0YXRlbWVudC5ub3RSZXNvdXJjZXMsIGIuc3RhdGVtZW50Lm5vdFJlc291cmNlcykgfHxcbiAgICAhc2V0RXF1YWxQcmluY2lwYWxzKGEuc3RhdGVtZW50Lm5vdFByaW5jaXBhbHMsIGIuc3RhdGVtZW50Lm5vdFByaW5jaXBhbHMpXG4gICkge1xuICAgIHJldHVybjtcbiAgfVxuICBpZiAoXG4gICAgIXNldEVxdWFsKGEuc3RhdGVtZW50LmFjdGlvbnMsIGIuc3RhdGVtZW50LmFjdGlvbnMpIHx8XG4gICAgIXNldEVxdWFsKGEuc3RhdGVtZW50LnJlc291cmNlcywgYi5zdGF0ZW1lbnQucmVzb3VyY2VzKSB8fFxuICAgICFzZXRFcXVhbFByaW5jaXBhbHMoYS5zdGF0ZW1lbnQucHJpbmNpcGFscywgYi5zdGF0ZW1lbnQucHJpbmNpcGFscylcbiAgKSB7XG4gICAgcmV0dXJuO1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBvcmlnaW5hbHM6IFsuLi5hLm9yaWdpbmFscywgLi4uYi5vcmlnaW5hbHNdLFxuICAgIHN0YXRlbWVudDogYS5zdGF0ZW1lbnQsXG4gICAgY29uZGl0aW9uU3RyaW5nOiBhLmNvbmRpdGlvblN0cmluZyxcbiAgfTtcbn1cblxuLyoqXG4gKiBDYWxjdWxhdGUgYW5kIHJldHVybiBjYWNoZWQgc3RyaW5nIHNldCByZXByZXNlbnRhdGlvbiBvZiB0aGUgc3RhdGVtZW50IGVsZW1lbnRzXG4gKlxuICogVGhpcyBpcyB0byBiZSBhYmxlIHRvIGRvIGNvbXBhcmlzb25zIG9uIHRoZXNlIHNldHMgcXVpY2tseS5cbiAqL1xuZnVuY3Rpb24gbWFrZUNvbXBhcmFibGUoczogUG9saWN5U3RhdGVtZW50KTogQ29tcGFyYWJsZVN0YXRlbWVudCB7XG4gIHJldHVybiB7XG4gICAgb3JpZ2luYWxzOiBbc10sXG4gICAgc3RhdGVtZW50OiBzLFxuICAgIC4uLihzLmNvbmRpdGlvbnNcbiAgICAgID8ge1xuICAgICAgICAgIGNvbmRpdGlvblN0cmluZzogSlNPTi5zdHJpbmdpZnkodG9Db25kaXRpb25Kc29uKC4uLnMuY29uZGl0aW9ucykpLFxuICAgICAgICB9XG4gICAgICA6IHt9KSxcbiAgfTtcbn1cblxuLyoqXG4gKiBSZXR1cm4gJ3RydWUnIGlmIHRoZSB0d28gcHJpbmNpcGFscyBhcmUgdW5tZXJnZWFibGVcbiAqXG4gKiBUaGlzIG9ubHkgaGFwcGVucyBpZiBvbmUgb2YgdGhlbSBpcyBhIGxpdGVyYWwsIHVudHlwZWQgcHJpbmNpcGFsICh0eXBpY2FsbHksXG4gKiBgUHJpbmNpcGFsOiAnKidgKSBhbmQgdGhlIG90aGVyIG9uZSBpcyB0eXBlZC5cbiAqXG4gKiBgUHJpbmNpcGFsOiAnKidgIGJlaGF2ZXMgc3VidGx5IGRpZmZlcmVudCB0aGFuIGBQcmluY2lwYWw6IHsgQVdTOiAnKicgfWAgYW5kIG11c3RcbiAqIHRoZXJlZm9yZSBiZSBwcmVzZXJ2ZWQuXG4gKi9cbmZ1bmN0aW9uIHVubWVyZ2VhYmxlUHJpbmNpcGFscyhhOiBDb21wYXJhYmxlU3RhdGVtZW50LCBiOiBDb21wYXJhYmxlU3RhdGVtZW50KSB7XG4gIGNvbnN0IGFIYXNTdGFyUHJpbmNpcGFsID0gYS5zdGF0ZW1lbnQucHJpbmNpcGFscy5zb21lKFxuICAgICh2KSA9PlxuICAgICAgdHlwZW9mIHYucG9saWN5RnJhZ21lbnQucHJpbmNpcGFsSnNvbiA9PT0gXCJzdHJpbmdcIiAmJlxuICAgICAgdi5wb2xpY3lGcmFnbWVudC5wcmluY2lwYWxKc29uID09IFwiKlwiLFxuICApO1xuICBjb25zdCBiSGFzTGl0ZXJhbCA9IGIuc3RhdGVtZW50LnByaW5jaXBhbHMuc29tZShcbiAgICAodikgPT5cbiAgICAgIHR5cGVvZiB2LnBvbGljeUZyYWdtZW50LnByaW5jaXBhbEpzb24gPT09IFwic3RyaW5nXCIgJiZcbiAgICAgIHYucG9saWN5RnJhZ21lbnQucHJpbmNpcGFsSnNvbiA9PSBcIipcIixcbiAgKTtcbiAgcmV0dXJuIGFIYXNTdGFyUHJpbmNpcGFsICE9PSBiSGFzTGl0ZXJhbDtcbn1cblxuLyoqXG4gKiBUdXJuIGEgQ29tcGFyYWJsZVN0YXRlbWVudCBiYWNrIGludG8gYSBTdGF0ZW1lbnRcbiAqL1xuZnVuY3Rpb24gcmVuZGVyQ29tcGFyYWJsZShzOiBDb21wYXJhYmxlU3RhdGVtZW50KTogUG9saWN5U3RhdGVtZW50IHtcbiAgcmV0dXJuIHMuc3RhdGVtZW50O1xufVxuXG4vKipcbiAqIEFuIGFuYWx5emVkIHZlcnNpb24gb2YgYSBzdGF0ZW1lbnQgdGhhdCBtYWtlcyBpdCBlYXNpZXIgdG8gZG8gY29tcGFyaXNvbnMgYW5kIG1lcmdpbmcgb25cbiAqL1xuaW50ZXJmYWNlIENvbXBhcmFibGVTdGF0ZW1lbnQge1xuICByZWFkb25seSBzdGF0ZW1lbnQ6IFBvbGljeVN0YXRlbWVudDtcbiAgcmVhZG9ubHkgb3JpZ2luYWxzOiBQb2xpY3lTdGF0ZW1lbnRbXTtcbiAgcmVhZG9ubHkgY29uZGl0aW9uU3RyaW5nPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFdoZXRoZXIgdGhlIGdpdmVuIHNldHMgYXJlIGVxdWFsXG4gKi9cbmZ1bmN0aW9uIHNldEVxdWFsPEE+KGE6IEFbXSwgYjogQVtdKSB7XG4gIGNvbnN0IGJTZXQgPSBuZXcgU2V0KGIpO1xuICByZXR1cm4gYS5sZW5ndGggPT09IGIubGVuZ3RoICYmIGEuZXZlcnkoKGspID0+IGJTZXQuaGFzKGspKTtcbn1cblxuLyoqXG4gKiBNZXJnZSB0d28gdmFsdWUgc2V0c1xuICovXG5mdW5jdGlvbiBzZXRNZXJnZTxBPih4OiBBW10sIHk6IEFbXSk6IEFbXSB7XG4gIHJldHVybiBBcnJheS5mcm9tKG5ldyBTZXQoWy4uLngsIC4uLnldKSkuc29ydCgpO1xufVxuXG5mdW5jdGlvbiBzZXRFcXVhbFByaW5jaXBhbHMoeHM6IElQcmluY2lwYWxbXSwgeXM6IElQcmluY2lwYWxbXSk6IGJvb2xlYW4ge1xuICBjb25zdCB4UHJpbmNpcGFscyA9IHBhcnRpdGlvblByaW5jaXBhbHMoeHMpO1xuICBjb25zdCB5UHJpbmNpcGFscyA9IHBhcnRpdGlvblByaW5jaXBhbHMoeXMpO1xuXG4gIGNvbnN0IG5vbkNvbXAgPSBzZXRFcXVhbChcbiAgICB4UHJpbmNpcGFscy5ub25Db21wYXJhYmxlLFxuICAgIHlQcmluY2lwYWxzLm5vbkNvbXBhcmFibGUsXG4gICk7XG4gIGNvbnN0IGNvbXAgPSBzZXRFcXVhbChcbiAgICBPYmplY3Qua2V5cyh4UHJpbmNpcGFscy5jb21wYXJhYmxlKSxcbiAgICBPYmplY3Qua2V5cyh5UHJpbmNpcGFscy5jb21wYXJhYmxlKSxcbiAgKTtcblxuICByZXR1cm4gbm9uQ29tcCAmJiBjb21wO1xufVxuXG5mdW5jdGlvbiBzZXRNZXJnZVByaW5jaXBhbHMoeHM6IElQcmluY2lwYWxbXSwgeXM6IElQcmluY2lwYWxbXSk6IElQcmluY2lwYWxbXSB7XG4gIGNvbnN0IHhQcmluY2lwYWxzID0gcGFydGl0aW9uUHJpbmNpcGFscyh4cyk7XG4gIGNvbnN0IHlQcmluY2lwYWxzID0gcGFydGl0aW9uUHJpbmNpcGFscyh5cyk7XG5cbiAgY29uc3QgY29tcGFyYWJsZSA9IHsgLi4ueFByaW5jaXBhbHMuY29tcGFyYWJsZSwgLi4ueVByaW5jaXBhbHMuY29tcGFyYWJsZSB9O1xuICByZXR1cm4gW1xuICAgIC4uLk9iamVjdC52YWx1ZXMoY29tcGFyYWJsZSksXG4gICAgLi4ueFByaW5jaXBhbHMubm9uQ29tcGFyYWJsZSxcbiAgICAuLi55UHJpbmNpcGFscy5ub25Db21wYXJhYmxlLFxuICBdO1xufVxuIl19

package/lib/aws/iam/private/postprocess-policy-document.d.ts

@@ -0,0 +1,15 @@
+import { IPostProcessor, IResolveContext } from "cdktf";
+/**
+ * A Token postprocesser for policy documents
+ *
+ * Removes duplicate statements, and assign Sids if necessary
+ *
+ * Because policy documents can contain all kinds of crazy things,
+ * we do all the necessary work here after the document has been mostly resolved
+ * into a predictable Terraform form.
+ */
+export declare class PostProcessPolicyDocument implements IPostProcessor {
+    private readonly autoAssignSids;
+    constructor(autoAssignSids: boolean);
+    postProcess(input: any, _context: IResolveContext): any;
+}

package/lib/aws/iam/private/postprocess-policy-document.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostProcessPolicyDocument = void 0;
+/**
+ * A Token postprocesser for policy documents
+ *
+ * Removes duplicate statements, and assign Sids if necessary
+ *
+ * Because policy documents can contain all kinds of crazy things,
+ * we do all the necessary work here after the document has been mostly resolved
+ * into a predictable Terraform form.
+ */
+class PostProcessPolicyDocument {
+    constructor(autoAssignSids) {
+        this.autoAssignSids = autoAssignSids;
+    }
+    // this is called with an array of statements
+    postProcess(input, _context) {
+        if (!input || !Array.isArray(input)) {
+            return input;
+        }
+        // Also remove full-on duplicates (this will not be necessary if
+        // we minimized, but it might still dedupe statements we didn't
+        // minimize like if they contained tokens, and definitely is still necessary
+        // if we didn't minimize)
+        const jsonStatements = new Set();
+        const uniqueStatements = [];
+        for (const statement of input) {
+            const jsonStatement = JSON.stringify(statement);
+            if (!jsonStatements.has(jsonStatement)) {
+                uniqueStatements.push(statement);
+                jsonStatements.add(jsonStatement);
+            }
+        }
+        // assign unique SIDs (the statement index) if `autoAssignSids` is enabled
+        const statements = uniqueStatements.map((s, i) => {
+            if (this.autoAssignSids && !s.sid) {
+                s.sid = i.toString();
+            }
+            // TODO: re-add sorting support
+            // ref: https://github.com/aws/aws-cdk/tree/v2.161.1/packages/aws-cdk-lib/aws-iam/lib/private/postprocess-policy-document.ts
+            // if (this.sort) {
+            //   // Don't act on the values if they are 'undefined'
+            //   s = s.copy({
+            //     sid: s.sid,
+            //     actions: s.actions ? sortByJson(s.actions) : undefined,
+            //     resources: s.resources ? sortByJson(s.resources) : undefined,
+            //     condition: s.conditions,
+            //     effect: s.effect,
+            //     notActions: s.notActions,
+            //     notResources: s.notResources,
+            //     principals: s.principals ? sortPrincipals(s.principals) : undefined,
+            //     notPrincipals: s.notPrincipals,
+            //   }
+            // }
+            return s;
+        });
+        return statements;
+    }
+}
+exports.PostProcessPolicyDocument = PostProcessPolicyDocument;
+// function noUndef(x: any): any {
+//   const ret: any = {};
+//   for (const [key, value] of Object.entries(x)) {
+//     if (value !== undefined) {
+//       ret[key] = value;
+//     }
+//   }
+//   return ret;
+// }
+// function sortPrincipals<A>(
+//   xs?: string | string[] | Record<string, A | A[]>,
+// ): typeof xs {
+//   if (!xs || Array.isArray(xs) || typeof xs !== "object") {
+//     return xs;
+//   }
+//   const ret: NonNullable<typeof xs> = {};
+//   for (const k of Object.keys(xs).sort()) {
+//     ret[k] = sortByJson(xs[k]);
+//   }
+//   return ret;
+// }
+// /**
+//  * Sort the values in the list by the JSON representation, removing duplicates.
+//  *
+//  * Mutates in place AND returns the mutated list.
+//  */
+// function sortByJson<B, A extends B | B[] | undefined>(xs: A): A {
+//   if (!Array.isArray(xs)) {
+//     return xs;
+//   }
+//   const intermediate = new Map<string, A>();
+//   for (const x of xs) {
+//     intermediate.set(JSON.stringify(x), x);
+//   }
+//   const sorted = Array.from(intermediate.keys())
+//     .sort()
+//     .map((k) => intermediate.get(k)!);
+//   xs.splice(0, xs.length, ...sorted);
+//   return xs.length !== 1 ? xs : xs[0];
+// }
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9zdHByb2Nlc3MtcG9saWN5LWRvY3VtZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2F3cy9pYW0vcHJpdmF0ZS9wb3N0cHJvY2Vzcy1wb2xpY3ktZG9jdW1lbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBTUE7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFhLHlCQUF5QjtJQUNwQyxZQUNtQixjQUF1QjtRQUF2QixtQkFBYyxHQUFkLGNBQWMsQ0FBUztJQUV2QyxDQUFDO0lBRUosNkNBQTZDO0lBQ3RDLFdBQVcsQ0FBQyxLQUFVLEVBQUUsUUFBeUI7UUFDdEQsSUFBSSxDQUFDLEtBQUssSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFFRCxnRUFBZ0U7UUFDaEUsK0RBQStEO1FBQy9ELDRFQUE0RTtRQUM1RSx5QkFBeUI7UUFDekIsTUFBTSxjQUFjLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUN6QyxNQUFNLGdCQUFnQixHQUFzQixFQUFFLENBQUM7UUFFL0MsS0FBSyxNQUFNLFNBQVMsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUM5QixNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2hELElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDakMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUNwQyxDQUFDO1FBQ0gsQ0FBQztRQUVELDBFQUEwRTtRQUMxRSxNQUFNLFVBQVUsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUU7WUFDL0MsSUFBSSxJQUFJLENBQUMsY0FBYyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUNsQyxDQUFDLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2QixDQUFDO1lBRUQsK0JBQStCO1lBQy9CLDRIQUE0SDtZQUM1SCxtQkFBbUI7WUFDbkIsdURBQXVEO1lBQ3ZELGlCQUFpQjtZQUNqQixrQkFBa0I7WUFDbEIsOERBQThEO1lBQzlELG9FQUFvRTtZQUNwRSwrQkFBK0I7WUFDL0Isd0JBQXdCO1lBQ3hCLGdDQUFnQztZQUNoQyxvQ0FBb0M7WUFDcEMsMkVBQTJFO1lBQzNFLHNDQUFzQztZQUN0QyxNQUFNO1lBQ04sSUFBSTtZQUVKLE9BQU8sQ0FBQyxDQUFDO1FBQ1gsQ0FBQyxDQUFDLENBQUM7UUFFSCxPQUFPLFVBQVUsQ0FBQztJQUNwQixDQUFDO0NBQ0Y7QUF2REQsOERBdURDO0FBRUQsa0NBQWtDO0FBQ2xDLHlCQUF5QjtBQUN6QixvREFBb0Q7QUFDcEQsaUNBQWlDO0FBQ2pDLDBCQUEwQjtBQUMxQixRQUFRO0FBQ1IsTUFBTTtBQUNOLGdCQUFnQjtBQUNoQixJQUFJO0FBRUosOEJBQThCO0FBQzlCLHNEQUFzRDtBQUN0RCxpQkFBaUI7QUFDakIsOERBQThEO0FBQzlELGlCQUFpQjtBQUNqQixNQUFNO0FBRU4sNENBQTRDO0FBQzVDLDhDQUE4QztBQUM5QyxrQ0FBa0M7QUFDbEMsTUFBTTtBQUVOLGdCQUFnQjtBQUNoQixJQUFJO0FBRUosTUFBTTtBQUNOLGtGQUFrRjtBQUNsRixLQUFLO0FBQ0wsb0RBQW9EO0FBQ3BELE1BQU07QUFDTixvRUFBb0U7QUFDcEUsOEJBQThCO0FBQzlCLGlCQUFpQjtBQUNqQixNQUFNO0FBRU4sK0NBQStDO0FBQy9DLDBCQUEwQjtBQUMxQiw4Q0FBOEM7QUFDOUMsTUFBTTtBQUVOLG1EQUFtRDtBQUNuRCxjQUFjO0FBQ2QseUNBQXlDO0FBQ3pDLHdDQUF3QztBQUN4Qyx5Q0FBeUM7QUFDekMsSUFBSSIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7XG4gIElQb3N0UHJvY2Vzc29yLFxuICBJUmVzb2x2ZUNvbnRleHQsXG4gIC8vVG9rZW5cbn0gZnJvbSBcImNka3RmXCI7XG5pbXBvcnQgeyBQb2xpY3lTdGF0ZW1lbnQgfSBmcm9tIFwiLi4vcG9saWN5LXN0YXRlbWVudFwiO1xuLyoqXG4gKiBBIFRva2VuIHBvc3Rwcm9jZXNzZXIgZm9yIHBvbGljeSBkb2N1bWVudHNcbiAqXG4gKiBSZW1vdmVzIGR1cGxpY2F0ZSBzdGF0ZW1lbnRzLCBhbmQgYXNzaWduIFNpZHMgaWYgbmVjZXNzYXJ5XG4gKlxuICogQmVjYXVzZSBwb2xpY3kgZG9jdW1lbnRzIGNhbiBjb250YWluIGFsbCBraW5kcyBvZiBjcmF6eSB0aGluZ3MsXG4gKiB3ZSBkbyBhbGwgdGhlIG5lY2Vzc2FyeSB3b3JrIGhlcmUgYWZ0ZXIgdGhlIGRvY3VtZW50IGhhcyBiZWVuIG1vc3RseSByZXNvbHZlZFxuICogaW50byBhIHByZWRpY3RhYmxlIFRlcnJhZm9ybSBmb3JtLlxuICovXG5leHBvcnQgY2xhc3MgUG9zdFByb2Nlc3NQb2xpY3lEb2N1bWVudCBpbXBsZW1lbnRzIElQb3N0UHJvY2Vzc29yIHtcbiAgY29uc3RydWN0b3IoXG4gICAgcHJpdmF0ZSByZWFkb25seSBhdXRvQXNzaWduU2lkczogYm9vbGVhbixcbiAgICAvLyBwcml2YXRlIHJlYWRvbmx5IHNvcnQ6IGJvb2xlYW4sXG4gICkge31cblxuICAvLyB0aGlzIGlzIGNhbGxlZCB3aXRoIGFuIGFycmF5IG9mIHN0YXRlbWVudHNcbiAgcHVibGljIHBvc3RQcm9jZXNzKGlucHV0OiBhbnksIF9jb250ZXh0OiBJUmVzb2x2ZUNvbnRleHQpOiBhbnkge1xuICAgIGlmICghaW5wdXQgfHwgIUFycmF5LmlzQXJyYXkoaW5wdXQpKSB7XG4gICAgICByZXR1cm4gaW5wdXQ7XG4gICAgfVxuXG4gICAgLy8gQWxzbyByZW1vdmUgZnVsbC1vbiBkdXBsaWNhdGVzICh0aGlzIHdpbGwgbm90IGJlIG5lY2Vzc2FyeSBpZlxuICAgIC8vIHdlIG1pbmltaXplZCwgYnV0IGl0IG1pZ2h0IHN0aWxsIGRlZHVwZSBzdGF0ZW1lbnRzIHdlIGRpZG4ndFxuICAgIC8vIG1pbmltaXplIGxpa2UgaWYgdGhleSBjb250YWluZWQgdG9rZW5zLCBhbmQgZGVmaW5pdGVseSBpcyBzdGlsbCBuZWNlc3NhcnlcbiAgICAvLyBpZiB3ZSBkaWRuJ3QgbWluaW1pemUpXG4gICAgY29uc3QganNvblN0YXRlbWVudHMgPSBuZXcgU2V0PHN0cmluZz4oKTtcbiAgICBjb25zdCB1bmlxdWVTdGF0ZW1lbnRzOiBQb2xpY3lTdGF0ZW1lbnRbXSA9IFtdO1xuXG4gICAgZm9yIChjb25zdCBzdGF0ZW1lbnQgb2YgaW5wdXQpIHtcbiAgICAgIGNvbnN0IGpzb25TdGF0ZW1lbnQgPSBKU09OLnN0cmluZ2lmeShzdGF0ZW1lbnQpO1xuICAgICAgaWYgKCFqc29uU3RhdGVtZW50cy5oYXMoanNvblN0YXRlbWVudCkpIHtcbiAgICAgICAgdW5pcXVlU3RhdGVtZW50cy5wdXNoKHN0YXRlbWVudCk7XG4gICAgICAgIGpzb25TdGF0ZW1lbnRzLmFkZChqc29uU3RhdGVtZW50KTtcbiAgICAgIH1cbiAgICB9XG5cbiAgICAvLyBhc3NpZ24gdW5pcXVlIFNJRHMgKHRoZSBzdGF0ZW1lbnQgaW5kZXgpIGlmIGBhdXRvQXNzaWduU2lkc2AgaXMgZW5hYmxlZFxuICAgIGNvbnN0IHN0YXRlbWVudHMgPSB1bmlxdWVTdGF0ZW1lbnRzLm1hcCgocywgaSkgPT4ge1xuICAgICAgaWYgKHRoaXMuYXV0b0Fzc2lnblNpZHMgJiYgIXMuc2lkKSB7XG4gICAgICAgIHMuc2lkID0gaS50b1N0cmluZygpO1xuICAgICAgfVxuXG4gICAgICAvLyBUT0RPOiByZS1hZGQgc29ydGluZyBzdXBwb3J0XG4gICAgICAvLyByZWY6IGh0dHBzOi8vZ2l0aHViLmNvbS9hd3MvYXdzLWNkay90cmVlL3YyLjE2MS4xL3BhY2thZ2VzL2F3cy1jZGstbGliL2F3cy1pYW0vbGliL3ByaXZhdGUvcG9zdHByb2Nlc3MtcG9saWN5LWRvY3VtZW50LnRzXG4gICAgICAvLyBpZiAodGhpcy5zb3J0KSB7XG4gICAgICAvLyAgIC8vIERvbid0IGFjdCBvbiB0aGUgdmFsdWVzIGlmIHRoZXkgYXJlICd1bmRlZmluZWQnXG4gICAgICAvLyAgIHMgPSBzLmNvcHkoe1xuICAgICAgLy8gICAgIHNpZDogcy5zaWQsXG4gICAgICAvLyAgICAgYWN0aW9uczogcy5hY3Rpb25zID8gc29ydEJ5SnNvbihzLmFjdGlvbnMpIDogdW5kZWZpbmVkLFxuICAgICAgLy8gICAgIHJlc291cmNlczogcy5yZXNvdXJjZXMgPyBzb3J0QnlKc29uKHMucmVzb3VyY2VzKSA6IHVuZGVmaW5lZCxcbiAgICAgIC8vICAgICBjb25kaXRpb246IHMuY29uZGl0aW9ucyxcbiAgICAgIC8vICAgICBlZmZlY3Q6IHMuZWZmZWN0LFxuICAgICAgLy8gICAgIG5vdEFjdGlvbnM6IHMubm90QWN0aW9ucyxcbiAgICAgIC8vICAgICBub3RSZXNvdXJjZXM6IHMubm90UmVzb3VyY2VzLFxuICAgICAgLy8gICAgIHByaW5jaXBhbHM6IHMucHJpbmNpcGFscyA/IHNvcnRQcmluY2lwYWxzKHMucHJpbmNpcGFscykgOiB1bmRlZmluZWQsXG4gICAgICAvLyAgICAgbm90UHJpbmNpcGFsczogcy5ub3RQcmluY2lwYWxzLFxuICAgICAgLy8gICB9XG4gICAgICAvLyB9XG5cbiAgICAgIHJldHVybiBzO1xuICAgIH0pO1xuXG4gICAgcmV0dXJuIHN0YXRlbWVudHM7XG4gIH1cbn1cblxuLy8gZnVuY3Rpb24gbm9VbmRlZih4OiBhbnkpOiBhbnkge1xuLy8gICBjb25zdCByZXQ6IGFueSA9IHt9O1xuLy8gICBmb3IgKGNvbnN0IFtrZXksIHZhbHVlXSBvZiBPYmplY3QuZW50cmllcyh4KSkge1xuLy8gICAgIGlmICh2YWx1ZSAhPT0gdW5kZWZpbmVkKSB7XG4vLyAgICAgICByZXRba2V5XSA9IHZhbHVlO1xuLy8gICAgIH1cbi8vICAgfVxuLy8gICByZXR1cm4gcmV0O1xuLy8gfVxuXG4vLyBmdW5jdGlvbiBzb3J0UHJpbmNpcGFsczxBPihcbi8vICAgeHM/OiBzdHJpbmcgfCBzdHJpbmdbXSB8IFJlY29yZDxzdHJpbmcsIEEgfCBBW10+LFxuLy8gKTogdHlwZW9mIHhzIHtcbi8vICAgaWYgKCF4cyB8fCBBcnJheS5pc0FycmF5KHhzKSB8fCB0eXBlb2YgeHMgIT09IFwib2JqZWN0XCIpIHtcbi8vICAgICByZXR1cm4geHM7XG4vLyAgIH1cblxuLy8gICBjb25zdCByZXQ6IE5vbk51bGxhYmxlPHR5cGVvZiB4cz4gPSB7fTtcbi8vICAgZm9yIChjb25zdCBrIG9mIE9iamVjdC5rZXlzKHhzKS5zb3J0KCkpIHtcbi8vICAgICByZXRba10gPSBzb3J0QnlKc29uKHhzW2tdKTtcbi8vICAgfVxuXG4vLyAgIHJldHVybiByZXQ7XG4vLyB9XG5cbi8vIC8qKlxuLy8gICogU29ydCB0aGUgdmFsdWVzIGluIHRoZSBsaXN0IGJ5IHRoZSBKU09OIHJlcHJlc2VudGF0aW9uLCByZW1vdmluZyBkdXBsaWNhdGVzLlxuLy8gICpcbi8vICAqIE11dGF0ZXMgaW4gcGxhY2UgQU5EIHJldHVybnMgdGhlIG11dGF0ZWQgbGlzdC5cbi8vICAqL1xuLy8gZnVuY3Rpb24gc29ydEJ5SnNvbjxCLCBBIGV4dGVuZHMgQiB8IEJbXSB8IHVuZGVmaW5lZD4oeHM6IEEpOiBBIHtcbi8vICAgaWYgKCFBcnJheS5pc0FycmF5KHhzKSkge1xuLy8gICAgIHJldHVybiB4cztcbi8vICAgfVxuXG4vLyAgIGNvbnN0IGludGVybWVkaWF0ZSA9IG5ldyBNYXA8c3RyaW5nLCBBPigpO1xuLy8gICBmb3IgKGNvbnN0IHggb2YgeHMpIHtcbi8vICAgICBpbnRlcm1lZGlhdGUuc2V0KEpTT04uc3RyaW5naWZ5KHgpLCB4KTtcbi8vICAgfVxuXG4vLyAgIGNvbnN0IHNvcnRlZCA9IEFycmF5LmZyb20oaW50ZXJtZWRpYXRlLmtleXMoKSlcbi8vICAgICAuc29ydCgpXG4vLyAgICAgLm1hcCgoaykgPT4gaW50ZXJtZWRpYXRlLmdldChrKSEpO1xuLy8gICB4cy5zcGxpY2UoMCwgeHMubGVuZ3RoLCAuLi5zb3J0ZWQpO1xuLy8gICByZXR1cm4geHMubGVuZ3RoICE9PSAxID8geHMgOiB4c1swXTtcbi8vIH1cbiJdfQ==

package/lib/aws/iam/private/util.d.ts

@@ -0,0 +1,37 @@
+import { IPostProcessor, IResolvable, IResolveContext } from "cdktf";
+import { IPolicy } from "../policy";
+export declare const MAX_POLICY_NAME_LEN = 128;
+export declare function undefinedIfEmpty(f: () => string[]): string[];
+/**
+ * Helper class that maintains the set of attached policies for a principal.
+ */
+export declare class AttachedPolicies {
+    private policies;
+    /**
+     * Adds a policy to the list of attached policies.
+     *
+     * If this policy is already, attached, returns false.
+     * If there is another policy attached with the same name, throws an exception.
+     */
+    attach(policy: IPolicy): void;
+}
+/**
+ * Lazy string set token that dedupes entries
+ *
+ * Needs to operate post-resolve, because the inputs could be
+ * `[ '${Token[TOKEN.9]}', '${Token[TOKEN.10]}', '${Token[TOKEN.20]}' ]`, which
+ * still all resolve to the same string value.
+ *
+ * Needs to JSON.stringify() results because strings could resolve to literal
+ * strings but could also resolve to `${index(...)}`.
+ */
+export declare class UniqueStringSet implements IResolvable, IPostProcessor {
+    private readonly fn;
+    static from(fn: () => string[]): string[];
+    readonly creationStack: string[];
+    private constructor();
+    resolve(context: IResolveContext): string[];
+    postProcess(input: any, _context: IResolveContext): any;
+    toString(): string;
+}
+export declare function sum(xs: number[]): number;

package/lib/aws/iam/private/util.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sum = exports.UniqueStringSet = exports.AttachedPolicies = exports.undefinedIfEmpty = exports.MAX_POLICY_NAME_LEN = void 0;
+const cdktf_1 = require("cdktf");
+exports.MAX_POLICY_NAME_LEN = 128;
+function undefinedIfEmpty(f) {
+    return cdktf_1.Lazy.listValue({
+        produce: () => {
+            const array = f();
+            return array && array.length > 0 ? array : undefined;
+        },
+    });
+}
+exports.undefinedIfEmpty = undefinedIfEmpty;
+/**
+ * Helper class that maintains the set of attached policies for a principal.
+ */
+class AttachedPolicies {
+    constructor() {
+        this.policies = new Array();
+    }
+    /**
+     * Adds a policy to the list of attached policies.
+     *
+     * If this policy is already, attached, returns false.
+     * If there is another policy attached with the same name, throws an exception.
+     */
+    attach(policy) {
+        if (this.policies.find((p) => p === policy)) {
+            return; // already attached
+        }
+        if (this.policies.find((p) => p.policyName === policy.policyName)) {
+            throw new Error(`A policy named "${policy.policyName}" is already attached`);
+        }
+        this.policies.push(policy);
+    }
+}
+exports.AttachedPolicies = AttachedPolicies;
+/**
+ * Lazy string set token that dedupes entries
+ *
+ * Needs to operate post-resolve, because the inputs could be
+ * `[ '${Token[TOKEN.9]}', '${Token[TOKEN.10]}', '${Token[TOKEN.20]}' ]`, which
+ * still all resolve to the same string value.
+ *
+ * Needs to JSON.stringify() results because strings could resolve to literal
+ * strings but could also resolve to `${index(...)}`.
+ */
+class UniqueStringSet {
+    static from(fn) {
+        return cdktf_1.Token.asList(new UniqueStringSet(fn));
+    }
+    constructor(fn) {
+        this.fn = fn;
+        // TODO: Implement stack traces
+        // ref: https://github.com/hashicorp/terraform-cdk/blob/v0.20.7/packages/cdktf/lib/app.ts#L111
+        // ref: https://github.com/hashicorp/terraform-cdk/blob/v0.20.9/packages/cdktf/lib/tokens/private/stack-trace.ts#L9
+        // ref: https://github.com/aws/aws-cdk/blob/v2.143.0/packages/aws-cdk-lib/core/lib/stack-trace.ts#L22
+        this.creationStack = ["stack traces disabled"];
+    }
+    resolve(context) {
+        context.registerPostProcessor(this);
+        return this.fn();
+    }
+    postProcess(input, _context) {
+        if (!Array.isArray(input)) {
+            return input;
+        }
+        if (input.length === 0) {
+            return undefined;
+        }
+        const uniq = {};
+        for (const el of input) {
+            uniq[JSON.stringify(el)] = el;
+        }
+        return Object.values(uniq);
+    }
+    toString() {
+        return cdktf_1.Token.asString(this);
+    }
+}
+exports.UniqueStringSet = UniqueStringSet;
+function sum(xs) {
+    return xs.reduce((a, b) => a + b, 0);
+}
+exports.sum = sum;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXRpbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hd3MvaWFtL3ByaXZhdGUvdXRpbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpQ0FNZTtBQUdGLFFBQUEsbUJBQW1CLEdBQUcsR0FBRyxDQUFDO0FBRXZDLFNBQWdCLGdCQUFnQixDQUFDLENBQWlCO0lBQ2hELE9BQU8sWUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNwQixPQUFPLEVBQUUsR0FBRyxFQUFFO1lBQ1osTUFBTSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbEIsT0FBTyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3ZELENBQUM7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDO0FBUEQsNENBT0M7QUFFRDs7R0FFRztBQUNILE1BQWEsZ0JBQWdCO0lBQTdCO1FBQ1UsYUFBUSxHQUFHLElBQUksS0FBSyxFQUFXLENBQUM7SUFxQjFDLENBQUM7SUFuQkM7Ozs7O09BS0c7SUFDSSxNQUFNLENBQUMsTUFBZTtRQUMzQixJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEtBQUssTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1QyxPQUFPLENBQUMsbUJBQW1CO1FBQzdCLENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsVUFBVSxLQUFLLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQ2IsbUJBQW1CLE1BQU0sQ0FBQyxVQUFVLHVCQUF1QixDQUM1RCxDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQXRCRCw0Q0FzQkM7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFhLGVBQWU7SUFDbkIsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFrQjtRQUNuQyxPQUFPLGFBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxlQUFlLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBSUQsWUFBcUMsRUFBa0I7UUFBbEIsT0FBRSxHQUFGLEVBQUUsQ0FBZ0I7UUFDckQsK0JBQStCO1FBQy9CLDhGQUE4RjtRQUM5RixtSEFBbUg7UUFDbkgscUdBQXFHO1FBQ3JHLElBQUksQ0FBQyxhQUFhLEdBQUcsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFFTSxPQUFPLENBQUMsT0FBd0I7UUFDckMsT0FBTyxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3BDLE9BQU8sSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO0lBQ25CLENBQUM7SUFFTSxXQUFXLENBQUMsS0FBVSxFQUFFLFFBQXlCO1FBQ3RELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFFRCxNQUFNLElBQUksR0FBd0IsRUFBRSxDQUFDO1FBQ3JDLEtBQUssTUFBTSxFQUFFLElBQUksS0FBSyxFQUFFLENBQUM7WUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDaEMsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM3QixDQUFDO0lBRU0sUUFBUTtRQUNiLE9BQU8sYUFBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM5QixDQUFDO0NBQ0Y7QUF0Q0QsMENBc0NDO0FBRUQsU0FBZ0IsR0FBRyxDQUFDLEVBQVk7SUFDOUIsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztBQUN2QyxDQUFDO0FBRkQsa0JBRUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge1xuICBJUG9zdFByb2Nlc3NvcixcbiAgSVJlc29sdmFibGUsXG4gIElSZXNvbHZlQ29udGV4dCxcbiAgTGF6eSxcbiAgVG9rZW4sXG59IGZyb20gXCJjZGt0ZlwiO1xuaW1wb3J0IHsgSVBvbGljeSB9IGZyb20gXCIuLi9wb2xpY3lcIjtcblxuZXhwb3J0IGNvbnN0IE1BWF9QT0xJQ1lfTkFNRV9MRU4gPSAxMjg7XG5cbmV4cG9ydCBmdW5jdGlvbiB1bmRlZmluZWRJZkVtcHR5KGY6ICgpID0+IHN0cmluZ1tdKTogc3RyaW5nW10ge1xuICByZXR1cm4gTGF6eS5saXN0VmFsdWUoe1xuICAgIHByb2R1Y2U6ICgpID0+IHtcbiAgICAgIGNvbnN0IGFycmF5ID0gZigpO1xuICAgICAgcmV0dXJuIGFycmF5ICYmIGFycmF5Lmxlbmd0aCA+IDAgPyBhcnJheSA6IHVuZGVmaW5lZDtcbiAgICB9LFxuICB9KTtcbn1cblxuLyoqXG4gKiBIZWxwZXIgY2xhc3MgdGhhdCBtYWludGFpbnMgdGhlIHNldCBvZiBhdHRhY2hlZCBwb2xpY2llcyBmb3IgYSBwcmluY2lwYWwuXG4gKi9cbmV4cG9ydCBjbGFzcyBBdHRhY2hlZFBvbGljaWVzIHtcbiAgcHJpdmF0ZSBwb2xpY2llcyA9IG5ldyBBcnJheTxJUG9saWN5PigpO1xuXG4gIC8qKlxuICAgKiBBZGRzIGEgcG9saWN5IHRvIHRoZSBsaXN0IG9mIGF0dGFjaGVkIHBvbGljaWVzLlxuICAgKlxuICAgKiBJZiB0aGlzIHBvbGljeSBpcyBhbHJlYWR5LCBhdHRhY2hlZCwgcmV0dXJucyBmYWxzZS5cbiAgICogSWYgdGhlcmUgaXMgYW5vdGhlciBwb2xpY3kgYXR0YWNoZWQgd2l0aCB0aGUgc2FtZSBuYW1lLCB0aHJvd3MgYW4gZXhjZXB0aW9uLlxuICAgKi9cbiAgcHVibGljIGF0dGFjaChwb2xpY3k6IElQb2xpY3kpIHtcbiAgICBpZiAodGhpcy5wb2xpY2llcy5maW5kKChwKSA9PiBwID09PSBwb2xpY3kpKSB7XG4gICAgICByZXR1cm47IC8vIGFscmVhZHkgYXR0YWNoZWRcbiAgICB9XG5cbiAgICBpZiAodGhpcy5wb2xpY2llcy5maW5kKChwKSA9PiBwLnBvbGljeU5hbWUgPT09IHBvbGljeS5wb2xpY3lOYW1lKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICBgQSBwb2xpY3kgbmFtZWQgXCIke3BvbGljeS5wb2xpY3lOYW1lfVwiIGlzIGFscmVhZHkgYXR0YWNoZWRgLFxuICAgICAgKTtcbiAgICB9XG5cbiAgICB0aGlzLnBvbGljaWVzLnB1c2gocG9saWN5KTtcbiAgfVxufVxuXG4vKipcbiAqIExhenkgc3RyaW5nIHNldCB0b2tlbiB0aGF0IGRlZHVwZXMgZW50cmllc1xuICpcbiAqIE5lZWRzIHRvIG9wZXJhdGUgcG9zdC1yZXNvbHZlLCBiZWNhdXNlIHRoZSBpbnB1dHMgY291bGQgYmVcbiAqIGBbICcke1Rva2VuW1RPS0VOLjldfScsICcke1Rva2VuW1RPS0VOLjEwXX0nLCAnJHtUb2tlbltUT0tFTi4yMF19JyBdYCwgd2hpY2hcbiAqIHN0aWxsIGFsbCByZXNvbHZlIHRvIHRoZSBzYW1lIHN0cmluZyB2YWx1ZS5cbiAqXG4gKiBOZWVkcyB0byBKU09OLnN0cmluZ2lmeSgpIHJlc3VsdHMgYmVjYXVzZSBzdHJpbmdzIGNvdWxkIHJlc29sdmUgdG8gbGl0ZXJhbFxuICogc3RyaW5ncyBidXQgY291bGQgYWxzbyByZXNvbHZlIHRvIGAke2luZGV4KC4uLil9YC5cbiAqL1xuZXhwb3J0IGNsYXNzIFVuaXF1ZVN0cmluZ1NldCBpbXBsZW1lbnRzIElSZXNvbHZhYmxlLCBJUG9zdFByb2Nlc3NvciB7XG4gIHB1YmxpYyBzdGF0aWMgZnJvbShmbjogKCkgPT4gc3RyaW5nW10pIHtcbiAgICByZXR1cm4gVG9rZW4uYXNMaXN0KG5ldyBVbmlxdWVTdHJpbmdTZXQoZm4pKTtcbiAgfVxuXG4gIHB1YmxpYyByZWFkb25seSBjcmVhdGlvblN0YWNrOiBzdHJpbmdbXTtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgZm46ICgpID0+IHN0cmluZ1tdKSB7XG4gICAgLy8gVE9ETzogSW1wbGVtZW50IHN0YWNrIHRyYWNlc1xuICAgIC8vIHJlZjogaHR0cHM6Ly9naXRodWIuY29tL2hhc2hpY29ycC90ZXJyYWZvcm0tY2RrL2Jsb2IvdjAuMjAuNy9wYWNrYWdlcy9jZGt0Zi9saWIvYXBwLnRzI0wxMTFcbiAgICAvLyByZWY6IGh0dHBzOi8vZ2l0aHViLmNvbS9oYXNoaWNvcnAvdGVycmFmb3JtLWNkay9ibG9iL3YwLjIwLjkvcGFja2FnZXMvY2RrdGYvbGliL3Rva2Vucy9wcml2YXRlL3N0YWNrLXRyYWNlLnRzI0w5XG4gICAgLy8gcmVmOiBodHRwczovL2dpdGh1Yi5jb20vYXdzL2F3cy1jZGsvYmxvYi92Mi4xNDMuMC9wYWNrYWdlcy9hd3MtY2RrLWxpYi9jb3JlL2xpYi9zdGFjay10cmFjZS50cyNMMjJcbiAgICB0aGlzLmNyZWF0aW9uU3RhY2sgPSBbXCJzdGFjayB0cmFjZXMgZGlzYWJsZWRcIl07XG4gIH1cblxuICBwdWJsaWMgcmVzb2x2ZShjb250ZXh0OiBJUmVzb2x2ZUNvbnRleHQpIHtcbiAgICBjb250ZXh0LnJlZ2lzdGVyUG9zdFByb2Nlc3Nvcih0aGlzKTtcbiAgICByZXR1cm4gdGhpcy5mbigpO1xuICB9XG5cbiAgcHVibGljIHBvc3RQcm9jZXNzKGlucHV0OiBhbnksIF9jb250ZXh0OiBJUmVzb2x2ZUNvbnRleHQpIHtcbiAgICBpZiAoIUFycmF5LmlzQXJyYXkoaW5wdXQpKSB7XG4gICAgICByZXR1cm4gaW5wdXQ7XG4gICAgfVxuICAgIGlmIChpbnB1dC5sZW5ndGggPT09IDApIHtcbiAgICAgIHJldHVybiB1bmRlZmluZWQ7XG4gICAgfVxuXG4gICAgY29uc3QgdW5pcTogUmVjb3JkPHN0cmluZywgYW55PiA9IHt9O1xuICAgIGZvciAoY29uc3QgZWwgb2YgaW5wdXQpIHtcbiAgICAgIHVuaXFbSlNPTi5zdHJpbmdpZnkoZWwpXSA9IGVsO1xuICAgIH1cbiAgICByZXR1cm4gT2JqZWN0LnZhbHVlcyh1bmlxKTtcbiAgfVxuXG4gIHB1YmxpYyB0b1N0cmluZygpOiBzdHJpbmcge1xuICAgIHJldHVybiBUb2tlbi5hc1N0cmluZyh0aGlzKTtcbiAgfVxufVxuXG5leHBvcnQgZnVuY3Rpb24gc3VtKHhzOiBudW1iZXJbXSkge1xuICByZXR1cm4geHMucmVkdWNlKChhLCBiKSA9PiBhICsgYiwgMCk7XG59XG4iXX0=