docs: add changelog for 4.2.0

closes #17246

.bazelrc

@@ -0,0 +1,6 @@
+# Disable sandboxing because it's too slow.
+# https://github.com/bazelbuild/bazel/issues/2424
+build --spawn_strategy=standalone
+
+# Performance: avoid stat'ing input files
+build --watchfs

.circleci/config.yml

@@ -0,0 +1,20 @@
+version: 2
+jobs:
+  build:
+    working_directory: ~/ng
+    docker:
+      - image: alexeagle/ngcontainer
+    steps:
+      - checkout
+      - restore_cache:
+          key: angular-{{ .Branch }}-{{ checksum "npm-shrinkwrap.json" }}
+      - run: npm install
+      - run: npm run postinstall
+      - run: ./node_modules/.bin/gulp lint
+      # Build twice, workaround for
+      # https://github.com/bazelbuild/bazel/issues/3114
+      - run: bazel build ... || bazel build ...
+      - save_cache:
+          key: angular-{{ .Branch }}-{{ checksum "npm-shrinkwrap.json" }}
+          paths:
+            - "node_modules"

.gitignore

@@ -1,6 +1,7 @@
 .DS_STORE
 
 /dist/
+bazel-*
 node_modules
 bower_components
 
@@ -17,16 +18,12 @@ modules/.vscode
 # Don't check in secret files
 *secret.js
 
-# Ignore npm debug log
+# Ignore npm/yarn debug log
 npm-debug.log
+yarn-error.log
 
 # build-analytics
 .build-analytics
 
 # rollup-test output
 /modules/rollup-test/dist/
-
-# angular.io
-/aio/node_modules
-/aio/src/content/docs
-/aio/dist

.pullapprove.yml

@@ -20,6 +20,8 @@
 # tbosch - Tobias Bosch
 # vicb - Victor Berchet
 # vikerman - Vikram Subramanian
+# wardbell - Ward Bell
+# tinayuangao - Tina Gao
 
 version: 2
 
@@ -40,6 +42,7 @@ groups:
           - "aio/*"
           - "integration/*"
           - "modules/*"
+          - "packages/*"
           - "tools/*"
     users:
       - IgorMinar
@@ -87,27 +90,27 @@ groups:
   core:
     conditions:
       files:
-        - "modules/@angular/core/*"
+        - "packages/core/*"
     users:
       - tbosch #primary
       - mhevery
       - vicb
       - IgorMinar #fallback
 
-  compiler/animations:
+  animations:
     conditions:
       files:
-        - "modules/@angular/compiler/src/animation/*"
+        - "packages/animation/*"
+        - "packages/platform-browser/animations/*"
     users:
       - matsko #primary
-      - tbosch
-      - IgorMinar #fallback
       - mhevery #fallback
+      - IgorMinar #fallback
 
   compiler/i18n:
     conditions:
       files:
-        - "modules/@angular/compiler/src/i18n/*"
+        - "packages/compiler/src/i18n/*"
     users:
       - vicb #primary
       - tbosch
@@ -117,7 +120,7 @@ groups:
   compiler:
     conditions:
       files:
-        - "modules/@angular/compiler/*"
+        - "packages/compiler/*"
     users:
       - tbosch #primary
       - vicb
@@ -129,10 +132,11 @@ groups:
     conditions:
       files:
         - "tools/@angular/tsc-wrapped/*"
-        - "modules/@angular/compiler-cli/*"
+        - "packages/compiler-cli/*"
     users:
       - alexeagle
       - chuckjaz
+      - vicb
       - tbosch
       - IgorMinar #fallback
       - mhevery #fallback
@@ -140,7 +144,7 @@ groups:
   common:
     conditions:
       files:
-        - "modules/@angular/common/*"
+        - "packages/common/*"
     users:
       - pkozlowski-opensource #primary
       - vicb
@@ -150,17 +154,17 @@ groups:
   forms:
     conditions:
       files:
-        - "modules/@angular/forms/*"
+        - "packages/forms/*"
     users:
       - kara #primary
-      # needs secondary
+      - tinayuangao #secondary
       - IgorMinar #fallback
       - mhevery #fallback
 
   http:
     conditions:
       files:
-        - "modules/@angular/http/*"
+        - "packages/http/*"
     users:
       - vikerman #primary
       - alxhub
@@ -170,27 +174,28 @@ groups:
   language-service:
     conditions:
       files:
-        - "modules/@angular/language-service/*"
+        - "packages/language-service/*"
     users:
       - chuckjaz #primary
-      # needs secondary
+      - tbosch #secondary
+      - vicb
       - IgorMinar #fallback
       - mhevery #fallback
 
   router:
     conditions:
       files:
-        - "modules/@angular/router/*"
+        - "packages/router/*"
     users:
-      - vicb #primary
-      # needs secondary
+      - jasonaden
+      - vicb
       - IgorMinar #fallback
       - mhevery #fallback
 
   upgrade:
     conditions:
       files:
-        - "modules/@angular/upgrade/*"
+        - "packages/upgrade/*"
     users:
       - petebacondarwin #primary
       - gkalpak
@@ -200,7 +205,7 @@ groups:
   platform-browser:
     conditions:
       files:
-        - "modules/@angular/platform-browser/*"
+        - "packages/platform-browser/*"
     users:
       - tbosch #primary
       - vicb #secondary
@@ -210,7 +215,7 @@ groups:
   platform-server:
     conditions:
       files:
-        - "modules/@angular/platform-server/*"
+        - "packages/platform-server/*"
     users:
       - vikerman #primary
       - alxhub
@@ -222,7 +227,7 @@ groups:
   platform-webworker:
     conditions:
       files:
-        - "modules/@angular/platform-webworker/*"
+        - "packages/platform-webworker/*"
     users:
       - vicb #primary
       - tbosch #secondary
@@ -234,7 +239,7 @@ groups:
   benchpress:
     conditions:
       files:
-        - "modules/@angular/benchpress/*"
+        - "packages/benchpress/*"
     users:
       - tbosch #primary
       # needs secondary
@@ -246,7 +251,8 @@ groups:
       files:
         - "aio/*"
     users:
-      - IgorMinar
-      - robwormald
-      - petebacondarwin
+      - IgorMinar #primary
+      - petebacondarwin #secondary
+      - gkalpak
+      - wardbell
       - mhevery #fallback

.travis.yml

@@ -10,15 +10,16 @@ addons:
       # needed to install g++ that is used by npms's native modules
       - ubuntu-toolchain-r-test
     packages:
+      # needed to install g++ that is used by npms's native modules
       - g++-4.8
   # https://docs.travis-ci.com/user/jwt
   jwt:
-    # NGBUILDS_IO_KEY=<secret in valentine>
-    secure: Z+BZX6qzO4QIk1mOt8hNobltUmrO3Fh8CxKY6eiyBZRqlqVjkhwnvcXylt70luAw7uNU1G8eSUUN/n/o0SnuZ/Okayejj/5gsjzNPwUS5Wzdod+UfsLxZNG9vNVxYyH1pRdANQtnNHV0uj+aR0oSUp3ZsFIlbo9gizcM4Qj01Yc=
-
+    # SAUCE_ACCESS_KEY<=secret for NGBUILDS_IO_KEY to work around travis-ci/travis-ci#7223, unencrypted value in valentine as NGBUILDS_IO_KEY>
+    # we alias NGBUILDS_IO_KEY to $SAUCE_ACCESS_KEY in env.sh and set the SAUCE_ACCESS_KEY there
+    - secure: "L7nrZwkAtFtYrP2DykPXgZvEKjkv0J/TwQ/r2QGxFTaBq4VZn+2Dw0YS7uCxoMqYzDwH0aAOqxoutibVpk8Z/16nE3tNmU5RzltMd6Xmt3qU2f/JDQLMo6PSlBodnjOUsDHJgmtrcbjhqrx/znA237BkNUu6UZRT7mxhXIZpn0U="
 branches:
   except:
-    - g3_v2_0
+    - g3
 
 cache:
   yarn: true
@@ -29,16 +30,17 @@ cache:
 
 env:
   global:
-    # GITHUB_TOKEN_ANGULAR
+    # GITHUB_TOKEN_ANGULAR=<github token, a personal access token of the angular-builds account, account access in valentine>
     # This is needed for the e2e Travis matrix task to publish packages to github for continuous packages delivery.
-    - secure: "fq/U7VDMWO8O8SnAQkdbkoSe2X92PVqg4d044HmRYVmcf6YbO48+xeGJ8yOk0pCBwl3ISO4Q2ot0x546kxfiYBuHkZetlngZxZCtQiFT9kyId8ZKcYdXaIW9OVdw3Gh3tQyUwDucfkVhqcs52D6NZjyE2aWZ4/d1V4kWRO/LMgo="
+    - secure: "aCdHveZuY8AT4Jr1JoJB4LxZsnGWRe/KseZh1YXYe5UtufFCtTVHvUcLn0j2aLBF0KpdyS+hWf0i4np9jthKu2xPKriefoPgCMpisYeC0MFkwbmv+XlgkUbgkgVZMGiVyX7DCYXVahxIoOUjVMEDCbNiHTIrfEuyq24U3ok2tHc="
     # FIREBASE_TOKEN
-    # This is needed for publishing builds to the "aio-staging" firebase site.
-    # TODO(i): the token was generated using the iminar@google account, we should switch to a shared/role-base account.
-    - secure: "MPx3UM77o5IlhT75PKHL0FXoB5tSXDc3vnCXCd1sRy4XUTZ9vjcV6nNuyqEf+SOw659bGbC1FI4mACGx1Q+z7MQDR85b1mcA9uSgHDkh+IR82CnCVdaX9d1RXafdJIArahxfmorbiiPPLyPIKggo7ituRm+2c+iraoCkE/pXxYg="
+    # This is needed for publishing builds to the "aio-staging" and "angular-io" firebase projects.
+    # This token was generated using the aio-deploy@angular.io account using `firebase login:ci` and password from valentine
+    - secure: "L5CyQmpwWtoR4Qi4xlWQh/cL1M6ZeJL4W4QAr4HdKFMgYt9h+Whqkymyh2NxwmCbPvWa7yUd+OiLQUDCY7L2VIg16hTwoe2CgYDyQA0BEwLzxtRrJXl93TfwMlrUx5JSIzAccD6D4sjtz8kSFMomK2Nls33xOXOukwyhVMjd0Cg="
   matrix:
     # Order: a slower build first, so that we don't occupy an idle travis worker waiting for others to complete.
     - CI_MODE=e2e
+    - CI_MODE=e2e_2
     - CI_MODE=js
     - CI_MODE=saucelabs_required
     - CI_MODE=browserstack_required
@@ -46,21 +48,28 @@ env:
     - CI_MODE=browserstack_optional
     - CI_MODE=docs_test
     - CI_MODE=aio
+    - CI_MODE=aio_e2e
 
 matrix:
   fast_finish: true
   allow_failures:
     - env: "CI_MODE=saucelabs_optional"
     - env: "CI_MODE=browserstack_optional"
+    - env: "CI_MODE=aio_e2e"
+
+before_install:
+  # source the env.sh script so that the exported variables are available to other scripts later on
+  - source ./scripts/ci/env.sh print
 
 install:
-  - ./scripts/ci-lite/install.sh
+  - ./scripts/ci/install.sh
 
 script:
-  - ./scripts/ci-lite/build.sh && ./scripts/ci-lite/test.sh
-
-after_success:
-  - ./scripts/ci-lite/deploy_aio_staging.sh
-
-after_script:
-  - ./scripts/ci-lite/cleanup.sh
+  - ./scripts/ci/build.sh
+  - ./scripts/ci/test.sh
+  # deploy is part of 'script' and not 'after_success' so that we fail the build if the deployment fails
+  - ./scripts/ci/deploy.sh
+  - ./scripts/ci/angular.sh
+  # all the scripts under this line will not quickly abort in case ${TRAVIS_TEST_RESULT} is 1 (job failure)
+  - ./scripts/ci/cleanup.sh
+  - ./scripts/ci/print-logs.sh

BUILD

@@ -0,0 +1,18 @@
+package(default_visibility = ["//visibility:public"])
+exports_files(["tsconfig.json"])
+
+# This rule belongs in node_modules/BUILD
+# It's here as a workaround for
+# https://github.com/bazelbuild/bazel/issues/374#issuecomment-296217940
+filegroup(
+    name = "node_modules",
+    srcs = glob([
+        # Performance workaround: list individual files
+        # This won't scale in the general case.
+        # TODO(alexeagle): figure out what to do
+        "node_modules/typescript/lib/**",
+        "node_modules/zone.js/**/*.d.ts",
+        "node_modules/rxjs/**/*.d.ts",
+        "node_modules/@types/**/*.d.ts",
+    ]),
+)

CHANGELOG.md

@@ -1,3 +1,579 @@
+<a name="4.2.0"></a>
+# [4.2.0](https://github.com/angular/angular/compare/4.2.0-rc.2...4.2.0) salubrious-stratagem (2017-06-08)
+
+
+### Bug Fixes
+
+* **animations:** ensure web-animations understands a numeric CSS perspective value ([819514a](https://github.com/angular/angular/commit/819514a)), closes [#14007](https://github.com/angular/angular/issues/14007)
+* **animations:** evaluate substitutions on option param values ([e9886d7](https://github.com/angular/angular/commit/e9886d7))
+* **forms:** fix min and max validator behavior on non-numbers ([a222c3e](https://github.com/angular/angular/commit/a222c3e))
+* **router:** opening links in new window ([4c32cb9](https://github.com/angular/angular/commit/4c32cb9))
+* **upgrade:** call setInterval outside the Angular zone ([269bbe0](https://github.com/angular/angular/commit/269bbe0))
+
+
+### Features
+
+* **compiler-cli:** introduce synchronous codegen API ([b00b80a](https://github.com/angular/angular/commit/b00b80a))
+
+
+### Performance Improvements
+
+* **animations:** do not create a closure each time a node is removed ([fe6b39d](https://github.com/angular/angular/commit/fe6b39d))
+* **animations:** only apply `:leave` flags if animations are set to run ([b55adee](https://github.com/angular/angular/commit/b55adee))
+
+
+
+<a name="4.2.0-rc.2"></a>
+# [4.2.0-rc.2](https://github.com/angular/angular/compare/4.2.0-rc.1...4.2.0-rc.2) (2017-06-01)
+
+### Bug Fixes
+
+* **animations:** always change to desired animation state even if no transition fires ([#17025](https://github.com/angular/angular/issues/17025)) ([665e707](https://github.com/angular/angular/commit/665e707)), closes [#16947](https://github.com/angular/angular/issues/16947)
+* **animations:** do not retain deleted nodes during an non-removal animation ([#17153](https://github.com/angular/angular/issues/17153)) ([068133e](https://github.com/angular/angular/commit/068133e)), closes [#17086](https://github.com/angular/angular/issues/17086)
+* **common:** always use 'other' case for locales with no plural rules ([#16990](https://github.com/angular/angular/issues/16990)) ([535d9da](https://github.com/angular/angular/commit/535d9da))
+* **compiler:** enableLegacyTemplate should not be ignored ([#17051](https://github.com/angular/angular/issues/17051)) ([8ffa483](https://github.com/angular/angular/commit/8ffa483)), closes [#15555](https://github.com/angular/angular/issues/15555)
+* **router:** make remove trailing slash consistent with URL params ([c20f60b](https://github.com/angular/angular/commit/c20f60b)), closes [#16069](https://github.com/angular/angular/issues/16069)
+
+### Features
+
+* **compiler:** emit typescript nodes from an output ast ([#16823](https://github.com/angular/angular/issues/16823)) ([18bf772](https://github.com/angular/angular/commit/18bf772))
+* **compiler-cli:** produce template diagnostics error messages ([#17125](https://github.com/angular/angular/issues/17125)) ([230255f](https://github.com/angular/angular/commit/230255f))
+* **tsc-wrapped:** always convert shorthand imports ([#16898](https://github.com/angular/angular/issues/16898)) ([ea8a43d](https://github.com/angular/angular/commit/ea8a43d))
+
+### Performance Improvements
+
+* **animations:** do not place enterId values on elements for querying purposes ([#17150](https://github.com/angular/angular/issues/17150)) ([ad6a57e](https://github.com/angular/angular/commit/ad6a57e))
+
+<a name="4.2.0-rc.1"></a>
+# [4.2.0-rc.1](https://github.com/angular/angular/compare/4.2.0-rc.0...4.2.0-rc.1) (2017-05-26)
+
+### Bug Fixes
+
+* **animations:** repair flicker issues with WA polyfill ([#16937](https://github.com/angular/angular/issues/16937)) ([e7d9fd8](https://github.com/angular/angular/commit/e7d9fd8)), closes [#16919](https://github.com/angular/angular/issues/16919) [#16918](https://github.com/angular/angular/issues/16918)
+* **animations:** use a lightweight renderer for non-animation components ([#17003](https://github.com/angular/angular/issues/17003)) ([3ab86bd](https://github.com/angular/angular/commit/3ab86bd))
+* **compiler:** compile `.ngfactory.ts` files even if nobody references them. ([#16899](https://github.com/angular/angular/issues/16899)) ([573b861](https://github.com/angular/angular/commit/573b861)), closes [#16741](https://github.com/angular/angular/issues/16741)
+* **compiler:** do not report type errors for arguments with `@Inject` ([#16222](https://github.com/angular/angular/issues/16222)) ([27761b4](https://github.com/angular/angular/commit/27761b4)), closes [#15424](https://github.com/angular/angular/issues/15424)
+* **core:** make decorators closure safe ([#16905](https://github.com/angular/angular/issues/16905)) ([a80ac0a](https://github.com/angular/angular/commit/a80ac0a)), closes [#16889](https://github.com/angular/angular/issues/16889)
+* **tsc-wrapped:** ignore `|null` and `|undefined` when collecting types ([#16222](https://github.com/angular/angular/issues/16222)) ([1651a8f](https://github.com/angular/angular/commit/1651a8f))
+* **tsc-wrapped:** resolve short-hand literal values to locals ([#16873](https://github.com/angular/angular/issues/16873)) ([11c10b2](https://github.com/angular/angular/commit/11c10b2))
+
+
+### Features
+
+* **compiler:** add location note to extracted xliff2 files ([#16791](https://github.com/angular/angular/issues/16791)) ([08dfe91](https://github.com/angular/angular/commit/08dfe91)), closes [#16531](https://github.com/angular/angular/issues/16531)
+* **core:** update zone.js to 0.8.10 and expose the flush method ([#16860](https://github.com/angular/angular/issues/16860)) ([85d4c4b](https://github.com/angular/angular/commit/85d4c4b))
+* **tsc-wrapped:** support template literals in metadata collection ([#16880](https://github.com/angular/angular/issues/16880)) ([6e41add](https://github.com/angular/angular/commit/6e41add))
+
+
+
+<a name="4.2.0-rc.0"></a>
+# [4.2.0-rc.0](https://github.com/angular/angular/compare/4.2.0-beta.0...4.2.0-rc.0) (2017-05-19)
+
+
+### Bug Fixes
+
+* **animations:** make sure reuseable animation subtitutions work without default params ([#16875](https://github.com/angular/angular/issues/16875)) ([7d9f96a](https://github.com/angular/angular/commit/7d9f96a))
+* **animations:** only require one flushMicrotasks call when testing animations ([6cb93c1](https://github.com/angular/angular/commit/6cb93c1))
+* **compiler:** avoid a `...null` spread in extraction ([#16547](https://github.com/angular/angular/issues/16547)) ([e0a8376](https://github.com/angular/angular/commit/e0a8376))
+* **compiler-cli:** allow '==' to compare nullable types ([#16731](https://github.com/angular/angular/issues/16731)) ([d761059](https://github.com/angular/angular/commit/d761059))
+* **core:** detach projected views when a parent view is destroyed ([#16592](https://github.com/angular/angular/issues/16592)) ([f0f6544](https://github.com/angular/angular/commit/f0f6544)), closes [#15578](https://github.com/angular/angular/issues/15578)
+* **core:** projected views should be dirty checked when the declaring component is dirty checked. ([#16592](https://github.com/angular/angular/issues/16592)) ([fcc91d8](https://github.com/angular/angular/commit/fcc91d8)), closes [#14321](https://github.com/angular/angular/issues/14321)
+* **http:** flatten metadata for [@angular](https://github.com/angular)/http/testing ([9da6340](https://github.com/angular/angular/commit/9da6340)), closes [#15521](https://github.com/angular/angular/issues/15521)
+* **http:** honor RequestArgs.search and RequestArgs.params map type ([aef5245](https://github.com/angular/angular/commit/aef5245)), closes [#15761](https://github.com/angular/angular/issues/15761) [#16392](https://github.com/angular/angular/issues/16392)
+* **http:** introduce encodingHint for text() for better ArrayBuffer support ([7ae7a84](https://github.com/angular/angular/commit/7ae7a84)), closes [#15932](https://github.com/angular/angular/issues/15932) [#16420](https://github.com/angular/angular/issues/16420)
+* **router:** fix redirect to a URL with a param having multiple values ([#16376](https://github.com/angular/angular/issues/16376)) ([5d4b36f](https://github.com/angular/angular/commit/5d4b36f)), closes [#16310](https://github.com/angular/angular/issues/16310)
+
+
+### Features
+
+* **animations:** introduce a wave of new animation features ([16c8167](https://github.com/angular/angular/commit/16c8167))
+* **animations:** introduce routeable animation support ([f1a9e3c](https://github.com/angular/angular/commit/f1a9e3c))
+* add .ngsummary.ts files to support AOT unit tests ([547c363](https://github.com/angular/angular/commit/547c363))
+* introduce `TestBed.overrideProvider` ([#16725](https://github.com/angular/angular/issues/16725)) ([39b92f7](https://github.com/angular/angular/commit/39b92f7))
+* **compiler:** support a non-null postfix assert ([#16672](https://github.com/angular/angular/issues/16672)) ([b9521b5](https://github.com/angular/angular/commit/b9521b5))
+* **core:** introduce fixture.whenRenderingDone for testing ([#16732](https://github.com/angular/angular/issues/16732)) ([38c524d](https://github.com/angular/angular/commit/38c524d))
+
+
+### Performance Improvements
+
+* **animations:** reduce size of animations bundle ([712630c](https://github.com/angular/angular/commit/712630c))
+
+
+
+<a name="4.1.3"></a>
+## [4.1.3](https://github.com/angular/angular/compare/4.1.2...4.1.3) (2017-05-17)
+
+
+### Bug Fixes
+
+* add typescript 2.3.2 typings test ([#16738](https://github.com/angular/angular/issues/16738)) ([a5bdbed](https://github.com/angular/angular/commit/a5bdbed)), closes [#16663](https://github.com/angular/angular/issues/16663)
+* **compiler-cli:** import routing module with forRoot ([#16438](https://github.com/angular/angular/issues/16438)) ([b7f8581](https://github.com/angular/angular/commit/b7f8581))
+* **platform-server:** wait for async app initializers to complete before removing server side styles ([#16712](https://github.com/angular/angular/issues/16712)) ([0a82f7d](https://github.com/angular/angular/commit/0a82f7d)), closes [#15716](https://github.com/angular/angular/issues/15716)
+* **router:** Wrap Promise-like instances in native Promises ([#16759](https://github.com/angular/angular/issues/16759)) ([883ca28](https://github.com/angular/angular/commit/883ca28))
+* **upgrade:** Prevent renaming of $inject property ([#16706](https://github.com/angular/angular/issues/16706)) ([afb7540](https://github.com/angular/angular/commit/afb7540))
+* **upgrade:** use quote to prevent ClossureCompiler obfuscating $event. ([#16724](https://github.com/angular/angular/issues/16724)) ([47df3d6](https://github.com/angular/angular/commit/47df3d6))
+
+
+
+<a name="4.2.0-beta.1"></a>
+# [4.2.0-beta.1](https://github.com/angular/angular/compare/4.2.0-beta.0...4.2.0-beta.1) (2017-05-10)
+
+
+### Features
+
+* add .ngsummary.ts files to support AOT unit tests ([547c363](https://github.com/angular/angular/commit/547c363))
+
+
+
+<a name="4.1.2"></a>
+## [4.1.2](https://github.com/angular/angular/compare/4.1.1...4.1.2) (2017-05-10)
+
+
+### Bug Fixes
+
+* **compiler:** avoid a `...null` spread in extraction ([#16547](https://github.com/angular/angular/issues/16547)) ([d0e1688](https://github.com/angular/angular/commit/d0e1688))
+* **core:** detach projected views when a parent view is destroyed ([#16592](https://github.com/angular/angular/issues/16592)) ([ee6705a](https://github.com/angular/angular/commit/ee6705a)), closes [#15578](https://github.com/angular/angular/issues/15578)
+* **core:** projected views should be dirty checked when the declaring component is dirty checked. ([#16592](https://github.com/angular/angular/issues/16592)) ([9218812](https://github.com/angular/angular/commit/9218812)), closes [#14321](https://github.com/angular/angular/issues/14321)
+* **http:** flatten metadata for [@angular](https://github.com/angular)/http/testing ([9c70a3c](https://github.com/angular/angular/commit/9c70a3c)), closes [#15521](https://github.com/angular/angular/issues/15521)
+* **http:** honor RequestArgs.search and RequestArgs.params map type ([63066f7](https://github.com/angular/angular/commit/63066f7)), closes [#15761](https://github.com/angular/angular/issues/15761) [#16392](https://github.com/angular/angular/issues/16392)
+* **http:** introduce encodingHint for text() for better ArrayBuffer support ([ec3b6e9](https://github.com/angular/angular/commit/ec3b6e9)), closes [#15932](https://github.com/angular/angular/issues/15932) [#16420](https://github.com/angular/angular/issues/16420)
+* **router:** fix redirect to a URL with a param having multiple values ([#16376](https://github.com/angular/angular/issues/16376)) ([915eae5](https://github.com/angular/angular/commit/915eae5)), closes [#16310](https://github.com/angular/angular/issues/16310)
+
+
+
+<a name="4.2.0-beta.0"></a>
+# [4.2.0-beta.0](https://github.com/angular/angular/compare/4.1.0...4.2.0-beta.0) (2017-05-04)
+
+
+### Bug Fixes
+
+* **core**: strictNullCheck support. ([#16389](https://github.com/angular/angular/issues/16389)) ([#16389](https://github.com/angular/angular/issues/16389)) ([8c09d10](https://github.com/angular/angular/commit/8c09d10)), closes [#16357](https://github.com/angular/angular/issues/16357)
+* **core:** allow directives to inject the component’s `ChangeDetectorRef`. ([#16394](https://github.com/angular/angular/issues/16394)) ([392d584](https://github.com/angular/angular/commit/392d584)), closes [#12816](https://github.com/angular/angular/issues/12816)
+* **core:** allow to detach `OnPush` components ([#16394](https://github.com/angular/angular/issues/16394)) ([aa8bba4](https://github.com/angular/angular/commit/aa8bba4)), closes [#9720](https://github.com/angular/angular/issues/9720)
+* **core:** don’t set `ng-version` for dynamically created components ([#16394](https://github.com/angular/angular/issues/16394)) ([a4de214](https://github.com/angular/angular/commit/a4de214)), closes [#15880](https://github.com/angular/angular/issues/15880)
+* **core:** don’t stop change detection because of errors ([e263e19](https://github.com/angular/angular/commit/e263e19)), closes [#9531](https://github.com/angular/angular/issues/9531) [#2413](https://github.com/angular/angular/issues/2413) [#15925](https://github.com/angular/angular/issues/15925)
+* **language-service:** remove asserts for non-null expressions ([#16422](https://github.com/angular/angular/issues/16422)) ([253345c](https://github.com/angular/angular/commit/253345c))
+* **upgrade:** initialize all inputs in time for `ngOnChanges()` ([b3e63c0](https://github.com/angular/angular/commit/b3e63c0)), closes [#16212](https://github.com/angular/angular/issues/16212)
+
+
+### Features
+
+* **compiler-cli:** add param to set MissingTranslationStrategy on ngc ([#15987](https://github.com/angular/angular/issues/15987)) ([6e2abcd](https://github.com/angular/angular/commit/6e2abcd)), closes [#15808](https://github.com/angular/angular/issues/15808)
+* **core:** add `begin` and `end` renderer methods to track change detection ([7f9c589](https://github.com/angular/angular/commit/7f9c589))
+* **core:** allow custom selector when bootstrapping components ([#15668](https://github.com/angular/angular/issues/15668)) ([900a88b](https://github.com/angular/angular/commit/900a88b)), closes [#7136](https://github.com/angular/angular/issues/7136)
+* **core:** upgrade dep on zone.js to 0.8.9 ([#16401](https://github.com/angular/angular/issues/16401)) ([065b76d](https://github.com/angular/angular/commit/065b76d))
+* **forms:** introduce min and max validators ([#15813](https://github.com/angular/angular/issues/15813)) ([81925fa](https://github.com/angular/angular/commit/81925fa))
+* **language-service:** provide external file list to TypeScript ([#16417](https://github.com/angular/angular/issues/16417)) ([f4b771a](https://github.com/angular/angular/commit/f4b771a))
+
+
+
+<a name="4.1.1"></a>
+## [4.1.1](https://github.com/angular/angular/compare/4.1.0...4.1.1) (2017-05-04)
+
+
+### Bug Fixes
+
+* **core**: strictNullCheck support. ([#16389](https://github.com/angular/angular/issues/16389)) ([#16389](https://github.com/angular/angular/issues/16389)) ([427d63a](https://github.com/angular/angular/commit/427d63a)), closes [#16357](https://github.com/angular/angular/issues/16357)
+* **core:** allow directives to inject the component’s `ChangeDetectorRef`. ([#16394](https://github.com/angular/angular/issues/16394)) ([f66e59e](https://github.com/angular/angular/commit/f66e59e)), closes [#12816](https://github.com/angular/angular/issues/12816)
+* **core:** allow to detach `OnPush` components ([#16394](https://github.com/angular/angular/issues/16394)) ([acf83b9](https://github.com/angular/angular/commit/acf83b9)), closes [#9720](https://github.com/angular/angular/issues/9720)
+* **core:** don’t set `ng-version` for dynamically created components ([#16394](https://github.com/angular/angular/issues/16394)) ([85a1b54](https://github.com/angular/angular/commit/85a1b54)), closes [#15880](https://github.com/angular/angular/issues/15880)
+* **core:** don’t stop change detection because of errors ([07cef36](https://github.com/angular/angular/commit/07cef36)), closes [#9531](https://github.com/angular/angular/issues/9531) [#2413](https://github.com/angular/angular/issues/2413) [#15925](https://github.com/angular/angular/issues/15925)
+* **language-service:** remove asserts for non-null expressions ([#16422](https://github.com/angular/angular/issues/16422)) ([c060110](https://github.com/angular/angular/commit/c060110))
+* **upgrade:** initialize all inputs in time for `ngOnChanges()` ([dd4e501](https://github.com/angular/angular/commit/dd4e501)), closes [#16212](https://github.com/angular/angular/issues/16212)
+
+
+
+<a name="4.1.0"></a>
+# [4.1.0](https://github.com/angular/angular/compare/4.1.0-rc.0...4.1.0) (2017-04-26)
+
+
+### Bug Fixes
+
+* **router:** forward the query parameters in the ng1 -> ng2 url sync ([#16249](https://github.com/angular/angular/issues/16249)) ([2f97731](https://github.com/angular/angular/commit/2f97731)), closes [#16067](https://github.com/angular/angular/issues/16067)
+* **upgrade:** use correct attribute name for upgraded component's bindings ([#16128](https://github.com/angular/angular/issues/16128)) ([d1fb066](https://github.com/angular/angular/commit/d1fb066)), closes [#8856](https://github.com/angular/angular/issues/8856)
+
+
+<a name="4.1.0-rc.0"></a>
+# [4.1.0-rc.0](https://github.com/angular/angular/compare/4.1.0-beta.0...4.1.0-rc.0) (2017-04-21)
+
+
+### Bug Fixes
+
+* **benchpress:** chrome - prevent trace buffer overflow ([2f44206](https://github.com/angular/angular/commit/2f44206))
+* **benchpress:** Update types for TypeScript nullability support ([14669f2](https://github.com/angular/angular/commit/14669f2))
+* **common:** Update types for TypeScript nullability support ([d8b73e4](https://github.com/angular/angular/commit/d8b73e4))
+* **compiler:** fix build error in xliff2 ([bd704c9](https://github.com/angular/angular/commit/bd704c9))
+* **compiler:** fix inheritance for AOT with summaries ([#15583](https://github.com/angular/angular/issues/15583)) ([8ef621a](https://github.com/angular/angular/commit/8ef621a))
+* **compiler:** ignore calls to unresolved symbols in metadata ([38a7e0d](https://github.com/angular/angular/commit/38a7e0d)), closes [#15969](https://github.com/angular/angular/issues/15969)
+* **compiler:** ignore calls to unresolved symbols in metadata ([#15970](https://github.com/angular/angular/issues/15970)) ([ce47d33](https://github.com/angular/angular/commit/ce47d33)), closes [#15969](https://github.com/angular/angular/issues/15969)
+* **compiler:** Inform user where Quoted error was thrown ([a77b126](https://github.com/angular/angular/commit/a77b126))
+* **compiler:** make I18NHtmlParser provider AoT-compliant ([#15980](https://github.com/angular/angular/issues/15980)) ([745731e](https://github.com/angular/angular/commit/745731e))
+* **compiler:** support `<ng-container>` whatever the namespace ([5b141fb](https://github.com/angular/angular/commit/5b141fb)), closes [#14257](https://github.com/angular/angular/issues/14257)
+* **compiler:** suppress another closure warning ([#16137](https://github.com/angular/angular/issues/16137)) ([11b0213](https://github.com/angular/angular/commit/11b0213))
+* **compiler:** Update types for TypeScript nullability support ([09d9f5f](https://github.com/angular/angular/commit/09d9f5f))
+* **core:** benchmarks - enable ng1 benchmark again ([bccfaa4](https://github.com/angular/angular/commit/bccfaa4))
+* **core:** distribute externs for testability API ([#16179](https://github.com/angular/angular/issues/16179)) ([da66884](https://github.com/angular/angular/commit/da66884))
+* **core:** key-value differ changes iteration ([#15968](https://github.com/angular/angular/issues/15968)) ([cb5a7ef](https://github.com/angular/angular/commit/cb5a7ef)), closes [#14997](https://github.com/angular/angular/issues/14997)
+* **forms:** Update types for TypeScript nullability support ([6649743](https://github.com/angular/angular/commit/6649743))
+* **forms:** Update types for TypeScript nullability support ([57bc245](https://github.com/angular/angular/commit/57bc245))
+* **forms:** Update types for TypeScript nullability support ([#15859](https://github.com/angular/angular/issues/15859)) ([6a2e08d](https://github.com/angular/angular/commit/6a2e08d))
+* **http:** Update types for TypeScript nullability support ([c36ec9b](https://github.com/angular/angular/commit/c36ec9b))
+* **http:** Update types for TypeScript nullability support ([ec028b8](https://github.com/angular/angular/commit/ec028b8))
+* **language-service:** avoid throwing exceptions when reporting metadata errors ([7764c5c](https://github.com/angular/angular/commit/7764c5c))
+* **language-service:** detect when there isn't a tsconfig.json ([258d539](https://github.com/angular/angular/commit/258d539)), closes [#15874](https://github.com/angular/angular/issues/15874)
+* **language-service:** improve resilience to incomplete information ([71a8627](https://github.com/angular/angular/commit/71a8627))
+* **language-service:** infer correct type of `?.` expressions ([0a3a9af](https://github.com/angular/angular/commit/0a3a9af)), closes [#15885](https://github.com/angular/angular/issues/15885)
+* **language-service:** initialize static reflector correctly ([fe0d02f](https://github.com/angular/angular/commit/fe0d02f)), closes [#15768](https://github.com/angular/angular/issues/15768)
+* **language-service:** look for type constructors on canonical symbol ([2ddf3bc](https://github.com/angular/angular/commit/2ddf3bc))
+* **language-service:** only use canonical symbols ([5a88d2f](https://github.com/angular/angular/commit/5a88d2f))
+* **language-service:** parse extended i18n forms ([bde9771](https://github.com/angular/angular/commit/bde9771))
+* **language-service:** resolve any parameter types to any result ([5fbb0d0](https://github.com/angular/angular/commit/5fbb0d0))
+* **language-service:** respect baseUrl compiler option ([f21ff90](https://github.com/angular/angular/commit/f21ff90)), closes [#15974](https://github.com/angular/angular/issues/15974)
+* **language-service:** Update types for TypeScript nullability support ([540581d](https://github.com/angular/angular/commit/540581d))
+* **packaging:** increased buffer size ([#15840](https://github.com/angular/angular/issues/15840)) ([65af964](https://github.com/angular/angular/commit/65af964))
+* **platform-browser:** Update types for TypeScript nullability support ([728c9d0](https://github.com/angular/angular/commit/728c9d0)), closes [#15898](https://github.com/angular/angular/issues/15898)
+* **platform-server:** handle innerText ([#15818](https://github.com/angular/angular/issues/15818)) ([9394835](https://github.com/angular/angular/commit/9394835))
+* **router:** fix query param parsing ([a487563](https://github.com/angular/angular/commit/a487563))
+* **router:** prevent `RouterLinkActive` from causing an infinite CD loop ([82417b3](https://github.com/angular/angular/commit/82417b3)), closes [#15825](https://github.com/angular/angular/issues/15825)
+* **router:** relax nullability requirements ([a0d124b](https://github.com/angular/angular/commit/a0d124b))
+* turn on nullability in the code base. ([5293794](https://github.com/angular/angular/commit/5293794))
+* Update types for TypeScript nullability support in examples ([6f5fccf](https://github.com/angular/angular/commit/6f5fccf))
+* **router:** the preloader use the module from the loaded config ([6d12aa9](https://github.com/angular/angular/commit/6d12aa9))
+* **router:** Update types for TypeScript nullability support ([56c46d7](https://github.com/angular/angular/commit/56c46d7))
+* **router:** Update types for TypeScript nullability support ([bc43188](https://github.com/angular/angular/commit/bc43188))
+* **tsc-wrapped:** collect new expressions with no arguments ([#15908](https://github.com/angular/angular/issues/15908)) ([70b1d6d](https://github.com/angular/angular/commit/70b1d6d)), closes [#15906](https://github.com/angular/angular/issues/15906)
+* **tsc-wrapped:** ensure valid path separators in metadata ([96aa236](https://github.com/angular/angular/commit/96aa236))
+* **upgrade:** Update types for TypeScript nullability support ([01d93f3](https://github.com/angular/angular/commit/01d93f3)), closes [#15897](https://github.com/angular/angular/issues/15897)
+
+
+### Features
+
+* **animations:** Update types for TypeScript nullability support ([38d75d4](https://github.com/angular/angular/commit/38d75d4)), closes [#15870](https://github.com/angular/angular/issues/15870)
+* **compiler:** add source files to xmb/xliff translations ([#14705](https://github.com/angular/angular/issues/14705)) ([4054055](https://github.com/angular/angular/commit/4054055)), closes [#14190](https://github.com/angular/angular/issues/14190)
+* **compiler:** Implement i18n XLIFF 2.0 serializer ([#14185](https://github.com/angular/angular/issues/14185)) ([09c4cb2](https://github.com/angular/angular/commit/09c4cb2)), closes [#11735](https://github.com/angular/angular/issues/11735)
+* **upgrade:** allow setting the angularjs lib at runtime ([#15168](https://github.com/angular/angular/issues/15168)) ([e927aea](https://github.com/angular/angular/commit/e927aea))
+* **upgrade:** allow setting the angularjs lib at runtime ([#15168](https://github.com/angular/angular/issues/15168)) ([8ad464d](https://github.com/angular/angular/commit/8ad464d))
+* **upgrade:** fixes for allow setting the angularjs lib at runtime ([90814e4](https://github.com/angular/angular/commit/90814e4))
+* add support for TS 2.2 ([3c8a61e](https://github.com/angular/angular/commit/3c8a61e))
+* add support for TS 2.3 ([014594f](https://github.com/angular/angular/commit/014594f))
+
+
+
+<a name="4.0.3"></a>
+## [4.0.3](https://github.com/angular/angular/compare/4.0.2...4.0.3) (2017-04-21)
+
+
+### Bug Fixes
+
+* **benchpress:** chrome - prevent trace buffer overflow ([d216f94](https://github.com/angular/angular/commit/d216f94))
+* **compiler:** fix build error in xliff2 ([1870347](https://github.com/angular/angular/commit/1870347))
+* **compiler:** ignore calls to unresolved symbols in metadata ([d4038ab](https://github.com/angular/angular/commit/d4038ab)), closes [#15969](https://github.com/angular/angular/issues/15969)
+* **compiler:** ignore calls to unresolved symbols in metadata ([#15970](https://github.com/angular/angular/issues/15970)) ([db25f08](https://github.com/angular/angular/commit/db25f08)), closes [#15969](https://github.com/angular/angular/issues/15969)
+* **compiler:** Inform user where Quoted error was thrown ([3184cc5](https://github.com/angular/angular/commit/3184cc5))
+* **compiler:** suppress another closure warning ([#16137](https://github.com/angular/angular/issues/16137)) ([72e240a](https://github.com/angular/angular/commit/72e240a))
+* **core:** benchmarks - enable ng1 benchmark again ([ccac4c6](https://github.com/angular/angular/commit/ccac4c6))
+* **core:** distribute externs for testability API ([#16179](https://github.com/angular/angular/issues/16179)) ([e377d9d](https://github.com/angular/angular/commit/e377d9d))
+* **core:** key-value differ changes iteration ([#15968](https://github.com/angular/angular/issues/15968)) ([a8600dc](https://github.com/angular/angular/commit/a8600dc)), closes [#14997](https://github.com/angular/angular/issues/14997)
+* **language-service:** only use canonical symbols ([786093a](https://github.com/angular/angular/commit/786093a))
+* **packaging:** increased buffer size ([#15840](https://github.com/angular/angular/issues/15840)) ([88ad490](https://github.com/angular/angular/commit/88ad490))
+* **platform-server:** handle innerText ([#15818](https://github.com/angular/angular/issues/15818)) ([7de340d](https://github.com/angular/angular/commit/7de340d))
+* **router:** prevent `RouterLinkActive` from causing an infinite CD loop ([4479c42](https://github.com/angular/angular/commit/4479c42)), closes [#15825](https://github.com/angular/angular/issues/15825)
+* **tsc-wrapped:** collect new expressions with no arguments ([#15908](https://github.com/angular/angular/issues/15908)) ([41cac9e](https://github.com/angular/angular/commit/41cac9e)), closes [#15906](https://github.com/angular/angular/issues/15906)
+
+
+### Features
+
+* **compiler:** Implement i18n XLIFF 2.0 serializer ([#14185](https://github.com/angular/angular/issues/14185)) ([a7d8edd](https://github.com/angular/angular/commit/a7d8edd)), closes [#11735](https://github.com/angular/angular/issues/11735)
+* **upgrade:** allow setting the angularjs lib at runtime ([#15168](https://github.com/angular/angular/issues/15168)) ([a75d056](https://github.com/angular/angular/commit/a75d056))
+* **upgrade:** allow setting the angularjs lib at runtime ([#15168](https://github.com/angular/angular/issues/15168)) ([4f172b0](https://github.com/angular/angular/commit/4f172b0))
+* **upgrade:** fixes for allow setting the angularjs lib at runtime ([bb6932d](https://github.com/angular/angular/commit/bb6932d))
+* add support for TS 2.3 ([5cf101f](https://github.com/angular/angular/commit/5cf101f))
+
+
+
+<a name="4.1.0-beta.1"></a>
+# [4.1.0-beta.1](https://github.com/angular/angular/compare/4.1.0-beta.0...4.1.0-beta.1) (2017-04-12)
+
+
+### Bug Fixes
+
+* **compiler:** fix inheritance for AOT with summaries ([#15583](https://github.com/angular/angular/issues/15583)) ([8ef621a](https://github.com/angular/angular/commit/8ef621a))
+* **language-service:** avoid throwing exceptions when reporting metadata errors ([7764c5c](https://github.com/angular/angular/commit/7764c5c))
+* **language-service:** detect when there isn't a tsconfig.json ([258d539](https://github.com/angular/angular/commit/258d539)), closes [#15874](https://github.com/angular/angular/issues/15874)
+* **language-service:** improve resilience to incomplete information ([71a8627](https://github.com/angular/angular/commit/71a8627))
+* **language-service:** initialize static reflector correctly ([fe0d02f](https://github.com/angular/angular/commit/fe0d02f)), closes [#15768](https://github.com/angular/angular/issues/15768)
+* **language-service:** parse extended i18n forms ([bde9771](https://github.com/angular/angular/commit/bde9771))
+* **language-service:** resolve any parameter types to any result ([5fbb0d0](https://github.com/angular/angular/commit/5fbb0d0))
+* **router:** fix query param parsing ([a487563](https://github.com/angular/angular/commit/a487563))
+* **router:** the preloader use the module from the loaded config ([6d12aa9](https://github.com/angular/angular/commit/6d12aa9))
+* **tsc-wrapped:** ensure valid path separators in metadata ([96aa236](https://github.com/angular/angular/commit/96aa236))
+
+
+### Features
+
+* **animations:** Update types for TypeScript nullability support ([38d75d4](https://github.com/angular/angular/commit/38d75d4)), closes [#15870](https://github.com/angular/angular/issues/15870)
+* **benchpress:** Update types for TypeScript nullability support ([14669f2](https://github.com/angular/angular/commit/14669f2))
+* **common:** Update types for TypeScript nullability support ([d8b73e4](https://github.com/angular/angular/commit/d8b73e4))
+* **compiler:** Update types for TypeScript nullability support ([09d9f5f](https://github.com/angular/angular/commit/09d9f5f))
+* **language-service:** Update types for TypeScript nullability support ([540581d](https://github.com/angular/angular/commit/540581d))
+
+
+
+<a name="4.0.2"></a>
+## [4.0.2](https://github.com/angular/angular/compare/4.0.1...4.0.2) (2017-04-11)
+
+
+### Bug Fixes
+
+* **compiler:** fix inheritance for AOT with summaries ([#15583](https://github.com/angular/angular/issues/15583)) ([1864ccb](https://github.com/angular/angular/commit/1864ccb))
+* **language-service:** avoid throwing exceptions when reporting metadata errors ([0861fda](https://github.com/angular/angular/commit/0861fda))
+* **language-service:** detect when there isn't a tsconfig.json ([168a2eb](https://github.com/angular/angular/commit/168a2eb)), closes [#15874](https://github.com/angular/angular/issues/15874)
+* **language-service:** improve resilience to incomplete information ([e4277a0](https://github.com/angular/angular/commit/e4277a0))
+* **language-service:** initialize static reflector correctly ([5b99533](https://github.com/angular/angular/commit/5b99533)), closes [#15768](https://github.com/angular/angular/issues/15768)
+* **language-service:** parse extended i18n forms ([c9c7acd](https://github.com/angular/angular/commit/c9c7acd))
+* **language-service:** resolve any parameter types to any result ([feae7b6](https://github.com/angular/angular/commit/feae7b6))
+* **router:** fix query param parsing ([2f41b52](https://github.com/angular/angular/commit/2f41b52))
+* **router:** the preloader use the module from the loaded config ([978f809](https://github.com/angular/angular/commit/978f809))
+* **tsc-wrapped:** ensure valid path separators in metadata ([c10e50c](https://github.com/angular/angular/commit/c10e50c))
+
+
+
+<a name="4.1.0-beta.0"></a>
+# [4.1.0-beta.0](https://github.com/angular/angular/compare/4.0.0...4.1.0-beta.0) (2017-03-29)
+
+### Features
+
+* **compiler:** support ICU messages in XLIFF ([b8d5f87](https://github.com/angular/angular/commit/b8d5f87)), closes [#12636](https://github.com/angular/angular/issues/12636) [#15068](https://github.com/angular/angular/issues/15068)
+
+Note: 4.1.0-beta.0 release also contains all the changes present in the 4.0.1 release.
+
+
+<a name="4.0.1"></a>
+## [4.0.1](https://github.com/angular/angular/compare/4.0.0...4.0.1) (2017-03-29)
+
+
+### Bug Fixes
+
+* **animations:** make sure style calculations are not computed too early ([#15540](https://github.com/angular/angular/issues/15540)) ([c828511](https://github.com/angular/angular/commit/c828511)), closes [#15507](https://github.com/angular/angular/issues/15507)
+* **compiler:** allow single quotes into named interpolations ([#15461](https://github.com/angular/angular/issues/15461)) ([a654875](https://github.com/angular/angular/commit/a654875)), closes [#15318](https://github.com/angular/angular/issues/15318)
+* **compiler:** ignore errors when evaluating base classes ([#15560](https://github.com/angular/angular/issues/15560)) ([a88413f](https://github.com/angular/angular/commit/a88413f)), closes [#15536](https://github.com/angular/angular/issues/15536)
+* **compiler:** throw when a component defines both template and templateUrl ([#15572](https://github.com/angular/angular/issues/15572)) ([902bb2f](https://github.com/angular/angular/commit/902bb2f)), closes [#15566](https://github.com/angular/angular/issues/15566)
+* **core:** check for undefined on normalizeDebugBindingValue ([#15503](https://github.com/angular/angular/issues/15503)) ([b8c0a97](https://github.com/angular/angular/commit/b8c0a97)), closes [#15494](https://github.com/angular/angular/issues/15494)
+* **core:** fix inheritance in JIT mode for TS 2.1 ([#15599](https://github.com/angular/angular/issues/15599)) ([ca66530](https://github.com/angular/angular/commit/ca66530)), closes [#15502](https://github.com/angular/angular/issues/15502)
+* **core:** fix the key/value differ ([#15539](https://github.com/angular/angular/issues/15539)) ([e72124c](https://github.com/angular/angular/commit/e72124c)), closes [#15457](https://github.com/angular/angular/issues/15457)
+* **core:** improve error msg for invalid KeyValueDiffer.diff arg ([#15489](https://github.com/angular/angular/issues/15489)) ([d74e4d0](https://github.com/angular/angular/commit/d74e4d0)), closes [#15402](https://github.com/angular/angular/issues/15402)
+* **core:** Update types for TypeScript nullability support ([#15472](https://github.com/angular/angular/issues/15472)) ([8c4b963](https://github.com/angular/angular/commit/8c4b963))
+* **language-service:** be resilient to invalidate ordering ([#15470](https://github.com/angular/angular/issues/15470)) ([a2c2b87](https://github.com/angular/angular/commit/a2c2b87)), closes [#15466](https://github.com/angular/angular/issues/15466)
+* **language-service:** correctly determine base members of types ([#15600](https://github.com/angular/angular/issues/15600)) ([0fe4985](https://github.com/angular/angular/commit/0fe4985)), closes [#15460](https://github.com/angular/angular/issues/15460)
+* **language-service:** don't require `reflect-metadata` module to be provided ([#15569](https://github.com/angular/angular/issues/15569)) ([bfa4f70](https://github.com/angular/angular/commit/bfa4f70)), closes [#15568](https://github.com/angular/angular/issues/15568)
+* **language-service:** guard access to `Symbol.members` ([#15529](https://github.com/angular/angular/issues/15529)) ([bf25e94](https://github.com/angular/angular/commit/bf25e94)), closes [#15528](https://github.com/angular/angular/issues/15528)
+* **language-service:** improve performance of `updateModuleAnalysis()` ([#15543](https://github.com/angular/angular/issues/15543)) ([5597fd3](https://github.com/angular/angular/commit/5597fd3))
+* **router:** should run CanActivate after CanDeactivate guards ([75478b2](https://github.com/angular/angular/commit/75478b2)), closes [#14059](https://github.com/angular/angular/issues/14059) [#15467](https://github.com/angular/angular/issues/15467)
+* **router:** shouldn't execute CanLoad when a route has been loaded ([2360676](https://github.com/angular/angular/commit/2360676)), closes [#14475](https://github.com/angular/angular/issues/14475) [#15438](https://github.com/angular/angular/issues/15438)
+
+
+### Performance Improvements
+
+* **router:** don't create new serializer every time UrlTree.toString is called ([#15565](https://github.com/angular/angular/issues/15565)) ([fd61145](https://github.com/angular/angular/commit/fd61145))
+
+<a name="4.0.0"></a>
+# [4.0.0](https://github.com/angular/angular/compare/4.0.0-rc.6...4.0.0) invisible-makeover (2017-03-23)
+
+
+### Bug Fixes
+
+* **compiler:** assume queries with no matches as static ([#15429](https://github.com/angular/angular/issues/15429)) ([c8ab5cb](https://github.com/angular/angular/commit/c8ab5cb)), closes [#15417](https://github.com/angular/angular/issues/15417)
+* **compiler:** correctly handle when `toString` is exported ([#15430](https://github.com/angular/angular/issues/15430)) ([0dda01e](https://github.com/angular/angular/commit/0dda01e)), closes [#15420](https://github.com/angular/angular/issues/15420)
+* **platform-browser:** setAttribute should work with xmlns namespace ([#14874](https://github.com/angular/angular/issues/14874)) ([92084f2](https://github.com/angular/angular/commit/92084f2)), closes [#14865](https://github.com/angular/angular/issues/14865)
+* **router:** should pass new data to Observable when query params change ([#15387](https://github.com/angular/angular/issues/15387)) ([08f2f08](https://github.com/angular/angular/commit/08f2f08)), closes [#15290](https://github.com/angular/angular/issues/15290)
+* prevent strictNullChecks support until [#15432](https://github.com/angular/angular/issues/15432) is fixed ([#15434](https://github.com/angular/angular/issues/15434)) ([b800a0c](https://github.com/angular/angular/commit/b800a0c))
+
+### BREAKING CHANGES
+
+From 4.0.0 @angular/core uses a [`WeakMap`](https://github.com/angular/angular/commit/52b21275f4c2c26c46627f5648b41a33bb5c8283), a polyfill needs to be included for [browsers that do not support it natively](http://kangax.github.io/compat-table/es6/#test-WeakMap).
+
+<a name="4.0.0-rc.6"></a>
+# [4.0.0-rc.6](https://github.com/angular/angular/compare/4.0.0-rc.5...4.0.0-rc.6) (2017-03-23)
+
+
+### Bug Fixes
+
+* **animations:** correct the main entry path in package.json ([#15300](https://github.com/angular/angular/issues/15300)) ([2489e4b](https://github.com/angular/angular/commit/2489e4b))
+* **animations:** ensure empty animate() steps work at the end of a sequence ([#15328](https://github.com/angular/angular/issues/15328)) ([fbccd5c](https://github.com/angular/angular/commit/fbccd5c)), closes [#15310](https://github.com/angular/angular/issues/15310)
+* **animations:** ensure enter/leave cancellations work ([#15323](https://github.com/angular/angular/issues/15323)) ([9bf2fb4](https://github.com/angular/angular/commit/9bf2fb4)), closes [#15315](https://github.com/angular/angular/issues/15315)
+* **animations:** make sure easing values work with web-animations ([#15195](https://github.com/angular/angular/issues/15195)) ([f925910](https://github.com/angular/angular/commit/f925910)), closes [#15115](https://github.com/angular/angular/issues/15115)
+* **animations:** make sure non-transitioned leave operations cancel existing animations ([#15254](https://github.com/angular/angular/issues/15254)) ([a6fb78e](https://github.com/angular/angular/commit/a6fb78e)), closes [#15213](https://github.com/angular/angular/issues/15213)
+* **animations:** only process element nodes through the animation engine ([#15268](https://github.com/angular/angular/issues/15268)) ([80075af](https://github.com/angular/angular/commit/80075af)), closes [#15267](https://github.com/angular/angular/issues/15267)
+* **animations:** only treat view removals as `void` state transitions ([#15245](https://github.com/angular/angular/issues/15245)) ([c66437f](https://github.com/angular/angular/commit/c66437f)), closes [#15223](https://github.com/angular/angular/issues/15223)
+* **animations:** stringify boolean values as `1` and `0` ([#15311](https://github.com/angular/angular/issues/15311)) ([94da801](https://github.com/angular/angular/commit/94da801)), closes [#15247](https://github.com/angular/angular/issues/15247)
+* **compiler:** add an empty content for source file of non mapped code. ([#15246](https://github.com/angular/angular/issues/15246)) ([8415910](https://github.com/angular/angular/commit/8415910))
+* **compiler:** don’t call `check` if we don’t need to ([#15322](https://github.com/angular/angular/issues/15322)) ([764e90f](https://github.com/angular/angular/commit/764e90f))
+* **compiler:** look for flat module resources using declaration module path ([#15367](https://github.com/angular/angular/issues/15367)) ([90d2518](https://github.com/angular/angular/commit/90d2518)), closes [#15221](https://github.com/angular/angular/issues/15221)
+* **compiler:** only log template deprecation warning once ([#15364](https://github.com/angular/angular/issues/15364)) ([08d8675](https://github.com/angular/angular/commit/08d8675))
+* **compiler:** use attribute id to merge translations ([#15302](https://github.com/angular/angular/issues/15302)) ([1d7693c](https://github.com/angular/angular/commit/1d7693c)), closes [#15234](https://github.com/angular/angular/issues/15234)
+* **compiler-cli:** adding missing format xliff for the extractor ([#15386](https://github.com/angular/angular/issues/15386)) ([a50d79d](https://github.com/angular/angular/commit/a50d79d))
+* **core:** allow tree shaking of component factories and styles ([#15214](https://github.com/angular/angular/issues/15214)) ([2a0e55f](https://github.com/angular/angular/commit/2a0e55f)), closes [#15181](https://github.com/angular/angular/issues/15181)
+* **core:** don’t create a comment for components with empty template. ([#15260](https://github.com/angular/angular/issues/15260)) ([f8c075a](https://github.com/angular/angular/commit/f8c075a)), closes [#15143](https://github.com/angular/angular/issues/15143)
+* **core:** mark components for check when host events trigger. ([#15359](https://github.com/angular/angular/issues/15359)) ([64beae9](https://github.com/angular/angular/commit/64beae9)), closes [#15352](https://github.com/angular/angular/issues/15352)
+* **core:** only apply `WrappedValue` to the binding of the pipe ([#15257](https://github.com/angular/angular/issues/15257)) ([0c43535](https://github.com/angular/angular/commit/0c43535)), closes [#15116](https://github.com/angular/angular/issues/15116)
+* **core:** provide `NgModuleRef` in `ViewContainerRef.createComponent`. ([#15350](https://github.com/angular/angular/issues/15350)) ([431eb30](https://github.com/angular/angular/commit/431eb30)), closes [#15241](https://github.com/angular/angular/issues/15241)
+* **core:** stringify shouldn't throw when toString returns null/undefined ([#14975](https://github.com/angular/angular/issues/14975)) ([8e6995c](https://github.com/angular/angular/commit/8e6995c)), closes [#14948](https://github.com/angular/angular/issues/14948)
+* **core:** trigger host animations for elements that are removed. ([#15251](https://github.com/angular/angular/issues/15251)) ([0d3e314](https://github.com/angular/angular/commit/0d3e314)), closes [#14813](https://github.com/angular/angular/issues/14813) [#15193](https://github.com/angular/angular/issues/15193)
+* **core:** update peer dep on zone.js to ^0.8.5 ([#15365](https://github.com/angular/angular/issues/15365)) ([97149f9](https://github.com/angular/angular/commit/97149f9)), closes [#15185](https://github.com/angular/angular/issues/15185)
+* **forms:** make composition event buffering configurable ([#15256](https://github.com/angular/angular/issues/15256)) ([5efc860](https://github.com/angular/angular/commit/5efc860)), closes [#15079](https://github.com/angular/angular/issues/15079)
+* **platform-server:** interpret Native view encapsulation as Emulated on the server ([#15155](https://github.com/angular/angular/issues/15155)) ([de3d2ee](https://github.com/angular/angular/commit/de3d2ee))
+* **platform-server:** setup NoopAnimationsModule in ServerModule by default ([#15131](https://github.com/angular/angular/issues/15131)) ([5c5c2ae](https://github.com/angular/angular/commit/5c5c2ae)), closes [#15098](https://github.com/angular/angular/issues/15098) [#14784](https://github.com/angular/angular/issues/14784)
+* **platform-server:** throw a better error message for relative URLs ([#15357](https://github.com/angular/angular/issues/15357)) ([15a082c](https://github.com/angular/angular/commit/15a082c)), closes [#15349](https://github.com/angular/angular/issues/15349)
+* **tsc-wrapped:** emit flat module format correctly on Windows ([#15215](https://github.com/angular/angular/issues/15215)) ([6e9264a](https://github.com/angular/angular/commit/6e9264a)), closes [#15192](https://github.com/angular/angular/issues/15192)
+* **tsc-wrapped:** use windows friendly path normalization in bundler ([#15374](https://github.com/angular/angular/issues/15374)) ([c584997](https://github.com/angular/angular/commit/c584997)), closes [#15289](https://github.com/angular/angular/issues/15289)
+* **upgrade:** component injectors should not link the module injector tree ([#15385](https://github.com/angular/angular/issues/15385)) ([ea49a95](https://github.com/angular/angular/commit/ea49a95))
+
+
+### Features
+
+* **core:** expose `inputs`, `outputs` and `ngContentSelectors` on `ComponentFactory`. ([#15214](https://github.com/angular/angular/issues/15214)) ([791534f](https://github.com/angular/angular/commit/791534f))
+* **router:** add `ParamMap.keys` to get a list of parameters ([d3eda7a](https://github.com/angular/angular/commit/d3eda7a))
+* **router:** introduce `ParamMap` to access parameters ([a755b71](https://github.com/angular/angular/commit/a755b71))
+* **tsc-wrapped:** record original location of flattened symbols ([#15367](https://github.com/angular/angular/issues/15367)) ([7354949](https://github.com/angular/angular/commit/7354949))
+* **upgrade:** use `ComponentFactory.inputs/outputs/ngContentSelectors` ([#15214](https://github.com/angular/angular/issues/15214)) ([9429032](https://github.com/angular/angular/commit/9429032))
+
+
+
+<a name="4.0.0-rc.5"></a>
+# [4.0.0-rc.5](https://github.com/angular/angular/compare/4.0.0-rc.4...4.0.0-rc.5) (2017-03-17)
+
+
+### Bug Fixes
+
+* **compiler-cli:** update the tsc-wrapped dependency version ([#15226](https://github.com/angular/angular/issues/15226)) ([7fb4528](https://github.com/angular/angular/commit/7fb4528))
+
+
+
+<a name="4.0.0-rc.4"></a>
+# [4.0.0-rc.4](https://github.com/angular/angular/compare/4.0.0-rc.3...4.0.0-rc.4) (2017-03-17)
+
+
+### Bug Fixes
+
+* **animations:** always fire callbacks even for noop animations ([#15170](https://github.com/angular/angular/issues/15170)) ([3f38c6f](https://github.com/angular/angular/commit/3f38c6f))
+* **animations:** make sure easing values are applied to an empty animate() step ([#15174](https://github.com/angular/angular/issues/15174)) ([62d5543](https://github.com/angular/angular/commit/62d5543)), closes [#15115](https://github.com/angular/angular/issues/15115)
+* **animations:** support multiple state names per state() call ([#15147](https://github.com/angular/angular/issues/15147)) ([36ce0af](https://github.com/angular/angular/commit/36ce0af)), closes [#14732](https://github.com/angular/angular/issues/14732)
+* **compiler:** always use `ng://` prefix for sourcemap urls ([#15218](https://github.com/angular/angular/issues/15218)) ([994089d](https://github.com/angular/angular/commit/994089d))
+* **compiler:** fix utf8encode, move to sharted utils, add tests ([#15076](https://github.com/angular/angular/issues/15076)) ([959a03a](https://github.com/angular/angular/commit/959a03a))
+* **compiler:** generated code should pass `noUnusedLocals` check ([50ab06e](https://github.com/angular/angular/commit/50ab06e)), closes [#14797](https://github.com/angular/angular/issues/14797)
+* **compiler:** Improve error message for missing annotations ([#14724](https://github.com/angular/angular/issues/14724)) ([3c15916](https://github.com/angular/angular/commit/3c15916))
+* **compiler:** improve error msg for unexpected closing tags ([#14747](https://github.com/angular/angular/issues/14747)) ([5f9fb91](https://github.com/angular/angular/commit/5f9fb91)), closes [#6652](https://github.com/angular/angular/issues/6652)
+* **compiler:** make sourcemaps work in AOT mode ([492153a](https://github.com/angular/angular/commit/492153a))
+* **compiler:** only warn for `[@Injectable](https://github.com/Injectable)` classes with invalid args. ([5c34066](https://github.com/angular/angular/commit/5c34066)), closes [#15003](https://github.com/angular/angular/issues/15003)
+* **compiler:** shouldn't throw when Symbol is used as DI token ([#13701](https://github.com/angular/angular/issues/13701)) ([8b5c6b2](https://github.com/angular/angular/commit/8b5c6b2)), closes [#13314](https://github.com/angular/angular/issues/13314)
+* **compiler:** support interface types in injectable constuctors ([#14894](https://github.com/angular/angular/issues/14894)) ([b00fe20](https://github.com/angular/angular/commit/b00fe20)), closes [#12631](https://github.com/angular/angular/issues/12631)
+* **compiler:** warning prints "WARNING" instead of "ERROR" ([#15125](https://github.com/angular/angular/issues/15125)) ([3b1956b](https://github.com/angular/angular/commit/3b1956b))
+* **core:** don’t recreate `TemplateRef` when used as a reference. ([#15066](https://github.com/angular/angular/issues/15066)) ([df914ef](https://github.com/angular/angular/commit/df914ef)), closes [#14873](https://github.com/angular/angular/issues/14873)
+* **core:** don’t throw if queries change during change detection. ([06fc42b](https://github.com/angular/angular/commit/06fc42b)), closes [#14925](https://github.com/angular/angular/issues/14925)
+* **core:** ErrorHandler should not rethrow an error by default ([#15077](https://github.com/angular/angular/issues/15077)) ([#15208](https://github.com/angular/angular/issues/15208)) ([77fd91d](https://github.com/angular/angular/commit/77fd91d)), closes [#14949](https://github.com/angular/angular/issues/14949) [#15182](https://github.com/angular/angular/issues/15182) [#14316](https://github.com/angular/angular/issues/14316)
+* **core:** update peer dep on zone.js to ^0.8.4 ([#15209](https://github.com/angular/angular/issues/15209)) ([d2fbbb4](https://github.com/angular/angular/commit/d2fbbb4)), closes [#15180](https://github.com/angular/angular/issues/15180) [#15185](https://github.com/angular/angular/issues/15185)
+* **core:** use presence of .subscribe to detect observables rather then Symbol.observable ([#15171](https://github.com/angular/angular/issues/15171)) ([6e98757](https://github.com/angular/angular/commit/6e98757)), closes [#14298](https://github.com/angular/angular/issues/14298) [#14473](https://github.com/angular/angular/issues/14473) [#14926](https://github.com/angular/angular/issues/14926)
+* **forms:** ensure observable validators are properly canceled ([#15132](https://github.com/angular/angular/issues/15132)) ([26d4ce2](https://github.com/angular/angular/commit/26d4ce2))
+* **forms:** remove equalsTo validator ([#15050](https://github.com/angular/angular/issues/15050)) ([778f7d6](https://github.com/angular/angular/commit/778f7d6))
+* element injector vs module injector ([#15044](https://github.com/angular/angular/issues/15044)) ([13686bb](https://github.com/angular/angular/commit/13686bb)), closes [#12869](https://github.com/angular/angular/issues/12869) [#12889](https://github.com/angular/angular/issues/12889) [#13885](https://github.com/angular/angular/issues/13885) [#13870](https://github.com/angular/angular/issues/13870)
+* **http:** Make ResponseOptionsArgs an interface ([#14607](https://github.com/angular/angular/issues/14607)) ([#14623](https://github.com/angular/angular/issues/14623)) ([f1b33ab](https://github.com/angular/angular/commit/f1b33ab)), closes [#13708](https://github.com/angular/angular/issues/13708)
+* **platform-browser:** prevent clobbered elements from freezing the browser ([a4076c7](https://github.com/angular/angular/commit/a4076c7))
+* **platform-server:** correctly implement get href in parse5 adapter ([#15022](https://github.com/angular/angular/issues/15022)) ([80649ea](https://github.com/angular/angular/commit/80649ea))
+* **platform-server:** fix an exception when HostListener('window:scroll') is used on the server ([#15019](https://github.com/angular/angular/issues/15019)) ([4f7d62a](https://github.com/angular/angular/commit/4f7d62a))
+* correct UMD resolutions for platform-browser_animations ([#15190](https://github.com/angular/angular/issues/15190)) ([923d0c5](https://github.com/angular/angular/commit/923d0c5)), closes [#15114](https://github.com/angular/angular/issues/15114)
+* don't instantiate providers with ngOnDestroy eagerly. ([#15070](https://github.com/angular/angular/issues/15070)) ([2c5a671](https://github.com/angular/angular/commit/2c5a671)), closes [#14552](https://github.com/angular/angular/issues/14552)
+* fix path locally to empty.js ([#15073](https://github.com/angular/angular/issues/15073)) ([80112a9](https://github.com/angular/angular/commit/80112a9))
+* **platform-server:** fix get/set title in parse5 adapter ([#14965](https://github.com/angular/angular/issues/14965)) ([018e5c9](https://github.com/angular/angular/commit/018e5c9))
+* **platform-server:** handle styles with extra ':'s correctly ([#15189](https://github.com/angular/angular/issues/15189)) ([013d806](https://github.com/angular/angular/commit/013d806))
+* **platform-server:** support svg elements with namespaced attributes ([#15101](https://github.com/angular/angular/issues/15101)) ([f093501](https://github.com/angular/angular/commit/f093501))
+* **router:** fix query parameters with multiple values ([#15129](https://github.com/angular/angular/issues/15129)) ([029d0f2](https://github.com/angular/angular/commit/029d0f2)), closes [#14796](https://github.com/angular/angular/issues/14796)
+* **tsc-wrapped:** emit js files in all cases ([c0e05e6](https://github.com/angular/angular/commit/c0e05e6))
+
+
+### Code Refactoring
+
+* **core:** use flags in `Renderer2.setStyle` instead of booleans ([#15045](https://github.com/angular/angular/issues/15045)) ([ff71eff](https://github.com/angular/angular/commit/ff71eff))
+
+### Features
+
+* **common:** support `as` syntax in template/* bindings ([#15025](https://github.com/angular/angular/issues/15025)) ([c10c060](https://github.com/angular/angular/commit/c10c060)), closes [#15020](https://github.com/angular/angular/issues/15020)
+* **compiler-cli:** support metadata file aliases ([0ab49d4](https://github.com/angular/angular/commit/0ab49d4))
+* **core:** allow to provide multiple default testing modules ([#15054](https://github.com/angular/angular/issues/15054)) ([6c8638c](https://github.com/angular/angular/commit/6c8638c))
+* **core:** expose `inputs`, `outputs` and `ngContentSelectors` on `ComponentFactory`. ([1171f91](https://github.com/angular/angular/commit/1171f91))
+* **upgrade:** support multi-slot projection in upgrade/static ([#14282](https://github.com/angular/angular/issues/14282)) ([914797a](https://github.com/angular/angular/commit/914797a)), closes [#14261](https://github.com/angular/angular/issues/14261)
+* **upgrade:** use `ComponentFactory.inputs/outputs/ngContentSelectors` ([a3e32fb](https://github.com/angular/angular/commit/a3e32fb))
+* introduce source maps for templates ([#15011](https://github.com/angular/angular/issues/15011)) ([cdc882b](https://github.com/angular/angular/commit/cdc882b))
+
+### BREAKING CHANGES
+
+* Perviously, any provider that had an ngOnDestroy lifecycle hook would be created eagerly.
+
+  Now, only classes that are annotated with @Component, @Directive, @Pipe, @NgModule are eager. Providers only become eager if they are either directly or transitively injected into one of the above.
+
+  This also makes all `useValue` providers eager, which
+  should have no observable impact other than code size.
+
+  **EXPECTED IMPACT**:
+  Making providers eager was an incorrect behavior and never documented.
+  Also, providers that are used by a directive / pipe / ngModule stay eager.
+  So the impact should be rather small.
+
+* DebugNode.source no longer returns the source location of a node.
+
+  Closes 14013
+
+* core: (since v4 rc.1)
+  - `Renderer2.setStyle` no longer takes booleans but rather a
+     bit mask of flags.
+
+
+
+<a name="2.4.10"></a>
+## [2.4.10](https://github.com/angular/angular/compare/2.4.9...2.4.10) (2017-03-17)
+
+### Bug Fixes
+
+* **compiler:** fix decoding surrogate pairs ([#15154](https://github.com/angular/angular/issues/15154)) ([e5c9bbc](https://github.com/angular/angular/commit/e5c9bbc))
+* **router:** do not finish bootstrap until all the routes are resolved ([#15121](https://github.com/angular/angular/issues/15121)) ([34403cd](https://github.com/angular/angular/commit/34403cd))
+
+
+<a name="4.0.0-rc.3"></a>
+# [4.0.0-rc.3](https://github.com/angular/angular/compare/4.0.0-rc.2...4.0.0-rc.3) (2017-03-10)
+
+
+### Bug Fixes
+
+* **compiler:** don’t throw for empty array literal in assignments ([#14878](https://github.com/angular/angular/issues/14878)) ([6cd3326](https://github.com/angular/angular/commit/6cd3326)), closes [#14782](https://github.com/angular/angular/issues/14782)
+* **compiler:** improve error message when a module imports itself ([#14646](https://github.com/angular/angular/issues/14646)) ([6bc6482](https://github.com/angular/angular/commit/6bc6482)), closes [#14644](https://github.com/angular/angular/issues/14644)
+* **core:** allow to use the `Renderer` outside of views. ([#14882](https://github.com/angular/angular/issues/14882)) ([ba4b6f5](https://github.com/angular/angular/commit/ba4b6f5)), closes [#14872](https://github.com/angular/angular/issues/14872)
+* **router:** do not finish bootstrap until all the routes are resolved ([#14762](https://github.com/angular/angular/issues/14762)) ([5df998d](https://github.com/angular/angular/commit/5df998d))
+* **upgrade:** populate upgraded component's view before creating the controller ([#14289](https://github.com/angular/angular/issues/14289)) ([07122f0](https://github.com/angular/angular/commit/07122f0)), closes [#13912](https://github.com/angular/angular/issues/13912)
+* throw for synthetic properties / listeners by default ([#14880](https://github.com/angular/angular/issues/14880)) ([3651d8d](https://github.com/angular/angular/commit/3651d8d))
+
+
+### BREAKING CHANGES
+
+#### since 4.0 rc.1:
+- rename `RendererV2` to `Renderer2`
+- rename `RendererTypeV2` to `RendererType2`
+- rename `RendererFactoryV2` to `RendererFactory2`
+
+<a name="2.4.9"></a>
+## [2.4.9](https://github.com/angular/angular/compare/2.4.8...2.4.9) (2017-03-02)
+
+
+### Bug Fixes
+
+* **http:** Make ResponseOptionsArgs an interface ([b658fa9](https://github.com/angular/angular/commit/b658fa9)), closes [#13708](https://github.com/angular/angular/issues/13708)
+* **router:** improve robustness ([#14602](https://github.com/angular/angular/issues/14602)) ([2a12346](https://github.com/angular/angular/commit/2a12346))
+
+
+### Reverts
+
+* fix(router): do not finish bootstrap until all the routes are resolved ([#14327](https://github.com/angular/angular/issues/14327)) ([de36f8a](https://github.com/angular/angular/commit/de36f8a)), closes [#14681](https://github.com/angular/angular/issues/14681) [#14588](https://github.com/angular/angular/issues/14588)
+
+
+
 <a name="4.0.0-rc.2"></a>
 ## [4.0.0-rc.2](https://github.com/angular/angular/compare/4.0.0-rc.1...4.0.0-rc.2) (2017-03-02)
 
@@ -2004,7 +2580,7 @@ prefix using `animate-` must now be preixed using `bind-animate-`.
 
 ### ROUTER CHANGE LOG
 
-[You can find the router changelog here.](https://github.com/angular/angular/blob/master/modules/@angular/router/CHANGELOG.md)
+[You can find the router changelog here.](https://github.com/angular/angular/blob/master/packages/router/CHANGELOG.md)
 
 <a name="2.0.0-rc.4"></a>
 # [2.0.0-rc.4](https://github.com/angular/angular/compare/2.0.0-rc.3...2.0.0-rc.4) (2016-06-30)

CONTRIBUTING.md

@@ -147,7 +147,7 @@ To ensure consistency throughout the source code, keep these rules in mind as yo
 * All public API methods **must be documented**. (Details TBC).
 * We follow [Google's JavaScript Style Guide][js-style-guide], but wrap all code at
   **100 characters**. An automated formatter is available, see
-  [DEVELOPER.md](DEVELOPER.md#clang-format).
+  [DEVELOPER.md](docs/DEVELOPER.md#clang-format).
 
 ## <a name="commit"></a> Commit Message Guidelines
 
@@ -263,7 +263,7 @@ changes to be accepted, the CLA must be signed. It's a quick process, we promise
 [coc]: https://github.com/angular/code-of-conduct/blob/master/CODE_OF_CONDUCT.md
 [commit-message-format]: https://docs.google.com/document/d/1QrDFcIiPjSLDn3EL15IJygNPiHORgU1_OOAqWjiDU5Y/edit#
 [corporate-cla]: http://code.google.com/legal/corporate-cla-v1.0.html
-[dev-doc]: https://github.com/angular/angular/blob/master/DEVELOPER.md
+[dev-doc]: https://github.com/angular/angular/blob/master/docs/DEVELOPER.md
 [github]: https://github.com/angular/angular
 [gitter]: https://gitter.im/angular/angular
 [individual-cla]: http://code.google.com/legal/individual-cla-v1.0.html

WORKSPACE

@@ -0,0 +1,12 @@
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+
+git_repository(
+    name = "io_bazel_rules_typescript",
+    remote = "https://github.com/bazelbuild/rules_typescript.git",
+    tag = "0.0.3",
+)
+
+load("@io_bazel_rules_typescript//:defs.bzl", "node_repositories", "yarn_install")
+
+node_repositories()
+yarn_install(package_json = "//:package.json")

aio/.angular-cli.json

@@ -1,6 +1,6 @@
 {
+  "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
   "project": {
-    "version": "1.0.0-beta.32.3",
     "name": "site"
   },
   "apps": [
@@ -9,20 +9,24 @@
       "outDir": "dist",
       "assets": [
         "assets",
-        "content",
-        "favicon.ico"
+        "generated",
+        "app/search/search-worker.js",
+        "favicon.ico",
+        "pwa-manifest.json",
+        "google385281288605d160.html"
       ],
       "index": "index.html",
       "main": "main.ts",
       "polyfills": "polyfills.ts",
       "test": "test.ts",
-      "tsconfig": "tsconfig.json",
+      "tsconfig": "tsconfig.app.json",
+      "testTsconfig": "tsconfig.spec.json",
       "prefix": "aio",
+      "serviceWorker": false,
       "styles": [
         "styles.scss"
       ],
       "scripts": [
-
       ],
       "environmentSource": "environments/environment.ts",
       "environments": {
@@ -38,12 +42,13 @@
   },
   "lint": [
     {
-      "files": "src/**/*.ts",
-      "project": "src/tsconfig.json"
+      "project": "src/tsconfig.app.json"
     },
     {
-      "files": "e2e/**/*.ts",
-      "project": "e2e/tsconfig.json"
+      "project": "src/tsconfig.spec.json"
+    },
+    {
+      "project": "e2e/tsconfig.e2e.json"
     }
   ],
   "test": {
@@ -53,19 +58,8 @@
   },
   "defaults": {
     "styleExt": "scss",
-    "component": {},
-    "prefixInterfaces": false,
-    "inline": {
-      "style": false,
-      "template": false
-    },
-    "spec": {
-      "class": false,
-      "component": true,
-      "directive": true,
-      "module": false,
-      "pipe": true,
-      "service": true
+    "component": {
+      "inlineStyle": true
     }
   }
 }

aio/.gitignore

@@ -0,0 +1,45 @@
+# See http://help.github.com/ignore-files/ for more about ignoring files.
+
+# compiled output
+/dist
+/out-tsc
+/src/generated
+/tmp
+
+# dependencies
+/node_modules
+
+# IDEs and editors
+/.idea
+.project
+.classpath
+.c9/
+*.launch
+.settings/
+*.sublime-workspace
+
+# IDE - VSCode
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+
+# misc
+/.sass-cache
+/connect.lock
+/coverage
+/libpeerconnection.log
+npm-debug.log
+testem.log
+/typings
+yarn-error.log
+
+# e2e
+/e2e/*.js
+/e2e/*.map
+protractor-results*.txt
+
+# System Files
+.DS_Store
+Thumbs.db

aio/README.md

@@ -1,31 +1,105 @@
-# Site
+# Angular documentation project (https://angular.io)
 
-This project was generated with [angular-cli](https://github.com/angular/angular-cli) version 1.0.0-beta.26.
+Everything in this folder is part of the documentation project. This includes
 
-## Development server
-Run `ng serve` for a dev server. Navigate to `http://localhost:4200/`. The app will automatically reload if you change any of the source files.
+* the web site for displaying the documentation
+* the dgeni configuration for converting source files to rendered files that can be viewed in the web site.
+* the tooling for setting up examples for development; and generating plunkers and zip files from the examples.
 
-## Code scaffolding
+## Developer tasks
 
-Run `ng generate component component-name` to generate a new component. You can also use `ng generate directive/pipe/service/class/module`.
+We use `yarn` to manage the dependencies and to run build tasks.
+You should run all these tasks from the `angular/aio` folder.
+Here are the most important tasks you might need to use:
 
-## Build
+* `yarn` - install all the dependencies.
+* `yarn setup` - Install all the dependencies, boilerplate, plunkers, zips and runs dgeni on the docs.
 
-Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory. Use the `--prod` flag for a production build.
+* `yarn start` - run a development web server that watches the files; then builds the doc-viewer and reloads the page, as necessary.
+* `yarn lint` - check that the doc-viewer code follows our style rules.
+* `yarn test` - watch all the source files, for the doc-viewer, and run all the unit tests when any change.
+* `yarn e2e` - run all the e2e tests for the doc-viewer.
 
-## Running unit tests
+* `yarn docs` - generate all the docs from the source files.
+* `yarn docs-watch` - watch the Angular source and the docs files and run a short-circuited doc-gen for the docs that changed.
+* `yarn docs-lint` - check that the doc gen code follows our style rules.
+* `yarn docs-test` - run the unit tests for the doc generation code.
 
-Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.io).
+* `yarn boilerplate:add` - generate all the boilerplate code for the examples, so that they can be run locally.
+* `yarn boilerplate:remove` - remove all the boilerplate code that was added via `yarn boilerplate:add`.
+* `yarn generate-plunkers` - generate the plunker files that are used by the `live-example` tags in the docs.
+* `yarn generate-zips` - generate the zip files from the examples. Zip available via the `live-example` tags in the docs.
 
-## Running end-to-end tests
+* `yarn build-ie-polyfills` - generates a js file of polyfills that can be loaded in Internet Explorer.
 
-Run `ng e2e` to execute the end-to-end tests via [Protractor](http://www.protractortest.org/).
-Before running the tests make sure you are serving the app via `ng serve`.
+## Using ServiceWorker locally
 
-## Deploying to GitHub Pages
+Since abb36e3cb, running `yarn start -- --prod` will no longer set up the ServiceWorker, which
+would require manually running `yarn sw-manifest` and `yarn sw-copy` (something that is not possible
+with webpack serving the files from memory).
 
-Run `ng github-pages:deploy` to deploy to GitHub Pages.
+If you want to test ServiceWorker locally, you can use `yarn build` and serve the files in `dist/`
+with `yarn http-server -- dist -p 4200`.
 
-## Further help
+For more details see #16745.
 
-To get more help on the `angular-cli` use `ng help` or go check out the [Angular-CLI README](https://github.com/angular/angular-cli/blob/master/README.md).
+
+## Guide to authoring
+
+There are two types of content in the documentatation:
+
+* **API docs**: descriptions of the modules, classes, interfaces, decorators, etc that make up the Angular platform.
+API docs are generated directly from the source code.
+The source code is contained in TypeScript files, located in the `angular/packages` folder.
+Each API item may have a preceding comment, which contains JSDoc style tags and content.
+The content is written in markdown.
+
+* **Other content**: guides, tutorials, and other marketing material.
+All other content is written using markdown in text files, located in the `angular/aio/content` folder.
+More specifically, there are sub-folders that contain particular types of content: guides, tutorial and marketing.
+
+We use the [dgeni](https://github.com/angular/dgeni) tool to convert these files into docs that can be viewed in the doc-viewer.
+
+### Generating the complete docs
+
+The main task for generating the docs is `yarn docs`. This will process all the source files (API and other),
+extracting the documentation and generating JSON files that can be consumed by the doc-viewer.
+
+### Partial doc generation for editors
+
+Full doc generation can take up to one minute. That's too slow for efficient document creation and editing.
+
+You can make small changes in a smart editor that displays formatted markdown:
+>In VS Code, _Cmd-K, V_ opens markdown preview in side pane; _Cmd-B_ toggles left sidebar
+
+You also want to see those changes displayed properly in the doc viewer
+with a quick, edit/view cycle time.
+
+For this purpose, use the `yarn docs-watch` task, which watches for changes to source files and only
+re-processes the the files necessary to generate the docs that are related to the file that has changed.
+Since this task takes shortcuts, it is much faster (often less than 1 second) but it won't produce full
+fidelity content. For example, links to other docs and code examples may not render correctly. This is
+most particularly noticed in links to other docs and in the embedded examples, which may not always render
+correctly.
+
+The general setup is as follows:
+
+* Open a terminal, ensure the dependencies are installed; run an initial doc generation; then start the doc-viewer:
+
+```bash
+yarn
+yarn docs
+yarn start
+```
+
+* Open a second terminal and start watching the docs
+
+```bash
+yarn docs-watch
+```
+
+* Open a browser at https://localhost:4200/ and navigate to the document on which you want to work.
+You can automatically open the browser by using `yarn start -- -o` in the first terminal.
+
+* Make changes to the page's associated doc or example files. Every time a file is saved, the doc will
+be regenerated, the app will rebuild and the page will reload.

aio/aio-builds-setup/dockerbuild/.dockerignore

@@ -0,0 +1,3 @@
+scripts-js/lib
+scripts-js/node_modules
+scripts-js/**/test

aio/aio-builds-setup/dockerbuild/Dockerfile

@@ -0,0 +1,165 @@
+# Image metadata and config
+FROM debian:jessie
+
+LABEL name="angular.io PR preview" \
+      description="This image implements the PR preview functionality for angular.io." \
+      vendor="Angular" \
+      version="1.0"
+
+VOLUME /aio-secrets
+VOLUME /var/www/aio-builds
+
+EXPOSE 80 443
+
+
+# Build-time args and env vars
+ARG      AIO_BUILDS_DIR=/var/www/aio-builds
+ARG TEST_AIO_BUILDS_DIR=/tmp/aio-builds
+ARG      AIO_DOMAIN_NAME=ngbuilds.io
+ARG TEST_AIO_DOMAIN_NAME=$AIO_DOMAIN_NAME.localhost
+ARG      AIO_GITHUB_ORGANIZATION=angular
+ARG TEST_AIO_GITHUB_ORGANIZATION=angular
+ARG      AIO_GITHUB_TEAM_SLUGS=angular-core,aio-contributors
+ARG TEST_AIO_GITHUB_TEAM_SLUGS=angular-core,aio-contributors
+ARG      AIO_NGINX_HOSTNAME=$AIO_DOMAIN_NAME
+ARG TEST_AIO_NGINX_HOSTNAME=$TEST_AIO_DOMAIN_NAME
+ARG      AIO_NGINX_PORT_HTTP=80
+ARG TEST_AIO_NGINX_PORT_HTTP=8080
+ARG      AIO_NGINX_PORT_HTTPS=443
+ARG TEST_AIO_NGINX_PORT_HTTPS=4433
+ARG      AIO_REPO_SLUG=angular/angular
+ARG TEST_AIO_REPO_SLUG=test-repo/test-slug
+ARG      AIO_UPLOAD_HOSTNAME=upload.localhost
+ARG TEST_AIO_UPLOAD_HOSTNAME=upload.localhost
+ARG      AIO_UPLOAD_MAX_SIZE=20971520
+ARG TEST_AIO_UPLOAD_MAX_SIZE=20971520
+ARG      AIO_UPLOAD_PORT=3000
+ARG TEST_AIO_UPLOAD_PORT=3001
+
+ENV AIO_BUILDS_DIR=$AIO_BUILDS_DIR                     TEST_AIO_BUILDS_DIR=$TEST_AIO_BUILDS_DIR                     \
+    AIO_DOMAIN_NAME=$AIO_DOMAIN_NAME                   TEST_AIO_DOMAIN_NAME=$TEST_AIO_DOMAIN_NAME                   \
+    AIO_GITHUB_ORGANIZATION=$AIO_GITHUB_ORGANIZATION   TEST_AIO_GITHUB_ORGANIZATION=$TEST_AIO_GITHUB_ORGANIZATION   \
+    AIO_GITHUB_TEAM_SLUGS=$AIO_GITHUB_TEAM_SLUGS       TEST_AIO_GITHUB_TEAM_SLUGS=$TEST_AIO_GITHUB_TEAM_SLUGS       \
+    AIO_LOCALCERTS_DIR=/etc/ssl/localcerts             TEST_AIO_LOCALCERTS_DIR=/etc/ssl/localcerts-test             \
+    AIO_NGINX_HOSTNAME=$AIO_NGINX_HOSTNAME             TEST_AIO_NGINX_HOSTNAME=$TEST_AIO_NGINX_HOSTNAME             \
+    AIO_NGINX_LOGS_DIR=/var/log/aio/nginx              TEST_AIO_NGINX_LOGS_DIR=/var/log/aio/nginx-test              \
+    AIO_NGINX_PORT_HTTP=$AIO_NGINX_PORT_HTTP           TEST_AIO_NGINX_PORT_HTTP=$TEST_AIO_NGINX_PORT_HTTP           \
+    AIO_NGINX_PORT_HTTPS=$AIO_NGINX_PORT_HTTPS         TEST_AIO_NGINX_PORT_HTTPS=$TEST_AIO_NGINX_PORT_HTTPS         \
+    AIO_REPO_SLUG=$AIO_REPO_SLUG                       TEST_AIO_REPO_SLUG=$TEST_AIO_REPO_SLUG                       \
+    AIO_SCRIPTS_JS_DIR=/usr/share/aio-scripts-js                                                                    \
+    AIO_SCRIPTS_SH_DIR=/usr/share/aio-scripts-sh                                                                    \
+    AIO_UPLOAD_HOSTNAME=$AIO_UPLOAD_HOSTNAME           TEST_AIO_UPLOAD_HOSTNAME=$TEST_AIO_UPLOAD_HOSTNAME           \
+    AIO_UPLOAD_MAX_SIZE=$AIO_UPLOAD_MAX_SIZE           TEST_AIO_UPLOAD_MAX_SIZE=$TEST_AIO_UPLOAD_MAX_SIZE           \
+    AIO_UPLOAD_PORT=$AIO_UPLOAD_PORT                   TEST_AIO_UPLOAD_PORT=$TEST_AIO_UPLOAD_PORT                   \
+    AIO_WWW_USER=www-data                                                                                           \
+    NODE_ENV=production
+
+
+# Create directory for logs
+RUN mkdir /var/log/aio
+
+
+# Add extra package sources
+RUN apt-get update -y && apt-get install -y curl
+RUN curl --silent --show-error --location https://deb.nodesource.com/setup_6.x | bash -
+RUN curl --silent --show-error https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
+RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
+RUN echo "deb http://ftp.debian.org/debian jessie-backports main" | tee /etc/apt/sources.list.d/backports.list
+
+
+# Install packages
+RUN apt-get update -y && apt-get install -y \
+    chkconfig \
+    cron \
+    dnsmasq \
+    nano \
+    nodejs \
+    openssl \
+    rsyslog \
+    yarn
+RUN apt-get install -t jessie-backports -y nginx
+RUN yarn global add pm2@2
+
+
+# Set up log rotation
+COPY logrotate/* /etc/logrotate.d/
+RUN chmod 0644 /etc/logrotate.d/*
+
+
+# Set up cronjobs
+COPY cronjobs/aio-builds-cleanup /etc/cron.d/
+RUN chmod 0744 /etc/cron.d/aio-builds-cleanup
+RUN crontab /etc/cron.d/aio-builds-cleanup
+RUN printenv | grep AIO_ >> /etc/environment
+
+
+# Set up dnsmasq
+COPY dnsmasq/dnsmasq.conf /etc/
+RUN sed -i "s|{{\$AIO_NGINX_HOSTNAME}}|$AIO_NGINX_HOSTNAME|g" /etc/dnsmasq.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_HOSTNAME}}|$AIO_UPLOAD_HOSTNAME|g" /etc/dnsmasq.conf
+RUN sed -i "s|{{\$TEST_AIO_NGINX_HOSTNAME}}|$TEST_AIO_NGINX_HOSTNAME|g" /etc/dnsmasq.conf
+RUN sed -i "s|{{\$TEST_AIO_UPLOAD_HOSTNAME}}|$TEST_AIO_UPLOAD_HOSTNAME|g" /etc/dnsmasq.conf
+
+
+# Set up SSL/TLS certificates
+COPY nginx/create-selfsigned-cert.sh /tmp/
+RUN chmod a+x /tmp/create-selfsigned-cert.sh
+RUN /tmp/create-selfsigned-cert.sh "selfcert-prod" "$AIO_NGINX_HOSTNAME" "$AIO_LOCALCERTS_DIR"
+RUN /tmp/create-selfsigned-cert.sh "selfcert-test" "$TEST_AIO_NGINX_HOSTNAME" "$TEST_AIO_LOCALCERTS_DIR"
+RUN rm /tmp/create-selfsigned-cert.sh
+RUN update-ca-certificates
+
+
+# Set up nginx (for production and testing)
+RUN sed -i -E "s|^user\s+\S+;|user $AIO_WWW_USER;|" /etc/nginx/nginx.conf
+RUN rm -f /etc/nginx/conf.d/*
+RUN rm -f /etc/nginx/sites-enabled/*
+
+COPY nginx/aio-builds.conf /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_BUILDS_DIR}}|$AIO_BUILDS_DIR|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_DOMAIN_NAME}}|$AIO_DOMAIN_NAME|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_LOCALCERTS_DIR}}|$AIO_LOCALCERTS_DIR|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_NGINX_LOGS_DIR}}|$AIO_NGINX_LOGS_DIR|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTP}}|$AIO_NGINX_PORT_HTTP|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTPS}}|$AIO_NGINX_PORT_HTTPS|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_HOSTNAME}}|$AIO_UPLOAD_HOSTNAME|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_MAX_SIZE}}|$AIO_UPLOAD_MAX_SIZE|g" /etc/nginx/conf.d/aio-builds-prod.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_PORT}}|$AIO_UPLOAD_PORT|g" /etc/nginx/conf.d/aio-builds-prod.conf
+
+COPY nginx/aio-builds.conf /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_BUILDS_DIR}}|$TEST_AIO_BUILDS_DIR|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_DOMAIN_NAME}}|$TEST_AIO_DOMAIN_NAME|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_LOCALCERTS_DIR}}|$TEST_AIO_LOCALCERTS_DIR|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_NGINX_LOGS_DIR}}|$TEST_AIO_NGINX_LOGS_DIR|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTP}}|$TEST_AIO_NGINX_PORT_HTTP|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_NGINX_PORT_HTTPS}}|$TEST_AIO_NGINX_PORT_HTTPS|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_HOSTNAME}}|$TEST_AIO_UPLOAD_HOSTNAME|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_MAX_SIZE}}|$TEST_AIO_UPLOAD_MAX_SIZE|g" /etc/nginx/conf.d/aio-builds-test.conf
+RUN sed -i "s|{{\$AIO_UPLOAD_PORT}}|$TEST_AIO_UPLOAD_PORT|g" /etc/nginx/conf.d/aio-builds-test.conf
+
+
+# Set up pm2
+RUN pm2 startup systemv -u root > /dev/null
+RUN chkconfig pm2-root on
+
+
+# Set up the shell scripts
+COPY scripts-sh/ $AIO_SCRIPTS_SH_DIR/
+RUN chmod a+x $AIO_SCRIPTS_SH_DIR/*
+RUN find $AIO_SCRIPTS_SH_DIR -maxdepth 1 -type f -printf "%P\n" \
+    | while read file; do ln -s $AIO_SCRIPTS_SH_DIR/$file /usr/local/bin/aio-${file%.*}; done
+
+
+# Set up the Node.js scripts
+COPY scripts-js/ $AIO_SCRIPTS_JS_DIR/
+WORKDIR $AIO_SCRIPTS_JS_DIR/
+RUN yarn install --production
+
+
+# Set up health check
+HEALTHCHECK --interval=5m CMD /usr/local/bin/aio-health-check
+
+
+# Go!
+WORKDIR /
+CMD aio-init && tail -f /dev/null

aio/aio-builds-setup/dockerbuild/cronjobs/aio-builds-cleanup

@@ -0,0 +1,2 @@
+# Periodically clean up builds that do not correspond to currently open PRs
+0 12 * * * root /usr/local/bin/aio-clean-up >> /var/log/cron.log 2>&1

aio/aio-builds-setup/dockerbuild/dnsmasq/dnsmasq.conf

@@ -0,0 +1,16 @@
+# Do not read /etc/resolv.conf. Get servers from this file instead.
+no-resolv
+server=8.8.8.8
+server=8.8.4.4
+
+# Listen for DHCP and DNS requests only on this address.
+listen-address=127.0.0.1
+
+# Force an IP addres for these domains.
+address=/{{$AIO_NGINX_HOSTNAME}}/127.0.0.1
+address=/{{$AIO_UPLOAD_HOSTNAME}}/127.0.0.1
+address=/{{$TEST_AIO_NGINX_HOSTNAME}}/127.0.0.1
+address=/{{$TEST_AIO_UPLOAD_HOSTNAME}}/127.0.0.1
+
+# Run as root (required from inside docker container).
+user=root

aio/aio-builds-setup/dockerbuild/logrotate/aio-misc

@@ -0,0 +1,9 @@
+/var/log/aio/clean-up.log /var/log/aio/init.log /var/log/aio/verify-setup.log {
+  compress
+  create
+  delaycompress
+  missingok
+  monthly
+  notifempty
+  rotate 6
+}

aio/aio-builds-setup/dockerbuild/logrotate/aio-nginx

@@ -0,0 +1,13 @@
+/var/log/aio/nginx/*.log /var/log/aio/nginx-test/*.log {
+  compress
+  create
+  delaycompress
+  missingok
+  monthly
+  notifempty
+  rotate 6
+  sharedscripts
+  postrotate
+    service nginx rotate >/dev/null 2>&1
+  endscript
+}

aio/aio-builds-setup/dockerbuild/logrotate/aio-upload-server

@@ -0,0 +1,9 @@
+/var/log/aio/upload-server-*.log {
+  compress
+  copytruncate
+  delaycompress
+  missingok
+  monthly
+  notifempty
+  rotate 6
+}

aio/aio-builds-setup/dockerbuild/nginx/aio-builds.conf

@@ -0,0 +1,95 @@
+# Redirect all HTTP traffic to HTTPS
+server {
+  server_name _;
+
+  listen {{$AIO_NGINX_PORT_HTTP}} default_server;
+  listen [::]:{{$AIO_NGINX_PORT_HTTP}};
+
+  access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
+  error_log  {{$AIO_NGINX_LOGS_DIR}}/error.log;
+
+  # Ideally we want 308 (permanent + keep original method),
+  # but it is relatively new and not supported by some clients (e.g. cURL).
+  return 307 https://$host:{{$AIO_NGINX_PORT_HTTPS}}$request_uri;
+}
+
+# Serve PR-preview requests
+server {
+  server_name "~^pr(?<pr>[1-9][0-9]*)-(?<sha>[0-9a-f]{40})\.";
+
+  listen {{$AIO_NGINX_PORT_HTTPS}} ssl http2;
+  listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl http2;
+
+  ssl_certificate           {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
+  ssl_certificate_key       {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers               EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+
+  root             {{$AIO_BUILDS_DIR}}/$pr/$sha;
+  disable_symlinks on from=$document_root;
+  index            index.html;
+
+  gzip            on;
+  gzip_comp_level 7;
+  gzip_types      *;
+
+  access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
+  error_log  {{$AIO_NGINX_LOGS_DIR}}/error.log;
+
+  location "~/[^/]+\.[^/]+$" {
+    try_files $uri $uri/ =404;
+  }
+
+  location / {
+    try_files $uri $uri/ /index.html =404;
+  }
+}
+
+# Handle all other requests
+server {
+  server_name _;
+
+  listen {{$AIO_NGINX_PORT_HTTPS}} ssl http2 default_server;
+  listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl http2;
+
+  ssl_certificate           {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
+  ssl_certificate_key       {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers               EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+
+  access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
+  error_log  {{$AIO_NGINX_LOGS_DIR}}/error.log;
+
+  # Health check
+  location "~^/health-check/?$" {
+    add_header Content-Type text/plain;
+    return 200 '';
+  }
+
+  # Upload builds
+  location "~^/create-build/(?<pr>[1-9][0-9]*)/(?<sha>[0-9a-f]{40})/?$" {
+    if ($request_method != "POST") {
+      add_header Allow "POST";
+      return 405;
+    }
+
+    client_body_temp_path    /tmp/aio-create-builds;
+    client_body_buffer_size  128K;
+    client_max_body_size     {{$AIO_UPLOAD_MAX_SIZE}};
+    client_body_in_file_only on;
+
+    proxy_pass_request_headers on;
+    proxy_set_header           X-FILE $request_body_file;
+    proxy_set_body             off;
+    proxy_redirect             off;
+    proxy_method               GET;
+    proxy_pass                 http://{{$AIO_UPLOAD_HOSTNAME}}:{{$AIO_UPLOAD_PORT}}$request_uri;
+
+    resolver 127.0.0.1;
+  }
+
+  # Everything else
+  location / {
+    return 404;
+  }
+}

aio/aio-builds-setup/dockerbuild/nginx/create-selfsigned-cert.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -eu -o pipefail
+
+
+# Variables
+confFile=/tmp/$1.conf
+domainName=$2
+outDir=$3
+
+
+# Create certificate
+cp /etc/ssl/openssl.cnf "$confFile"
+echo "[subjectAltName]" >> "$confFile"
+echo "subjectAltName = DNS:$domainName, DNS:*.$domainName" >> "$confFile"
+mkdir -p $outDir
+openssl req -days 365 -newkey rsa:2048 -nodes -sha256 -x509 \
+            -config "$confFile" -extensions subjectAltName -subj "/CN=$domainName" \
+            -out "$outDir/$domainName.crt" -keyout "$outDir/$domainName.key"
+chmod -R 400 "$outDir"
+cp "$outDir/$domainName.crt" /usr/local/share/ca-certificates

aio/aio-builds-setup/dockerbuild/scripts-js/.gitignore

@@ -0,0 +1,2 @@
+/dist
+/node_modules

aio/aio-builds-setup/dockerbuild/scripts-js/lib/clean-up/build-cleaner.ts

@@ -0,0 +1,71 @@
+// Imports
+import * as fs from 'fs';
+import * as path from 'path';
+import * as shell from 'shelljs';
+import {GithubPullRequests} from '../common/github-pull-requests';
+import {assertNotMissingOrEmpty} from '../common/utils';
+
+// Classes
+export class BuildCleaner {
+  // Constructor
+  constructor(protected buildsDir: string, protected repoSlug: string, protected githubToken: string) {
+    assertNotMissingOrEmpty('buildsDir', buildsDir);
+    assertNotMissingOrEmpty('repoSlug', repoSlug);
+    assertNotMissingOrEmpty('githubToken', githubToken);
+  }
+
+  // Methods - Public
+  public cleanUp(): Promise<void> {
+    return Promise.all([
+      this.getExistingBuildNumbers(),
+      this.getOpenPrNumbers(),
+    ]).then(([existingBuilds, openPrs]) => this.removeUnnecessaryBuilds(existingBuilds, openPrs));
+  }
+
+  // Methods - Protected
+  protected getExistingBuildNumbers(): Promise<number[]> {
+    return new Promise((resolve, reject) => {
+      fs.readdir(this.buildsDir, (err, files) => {
+        if (err) {
+          return reject(err);
+        }
+
+        const buildNumbers = files.
+          map(Number).       // Convert string to number
+          filter(Boolean);   // Ignore NaN (or 0), because they are not builds
+
+        resolve(buildNumbers);
+      });
+    });
+  }
+
+  protected getOpenPrNumbers(): Promise<number[]> {
+    const githubPullRequests = new GithubPullRequests(this.githubToken, this.repoSlug);
+
+    return githubPullRequests.
+      fetchAll('open').
+      then(prs => prs.map(pr => pr.number));
+  }
+
+  protected removeDir(dir: string) {
+    try {
+      // Undocumented signature (see https://github.com/shelljs/shelljs/pull/663).
+      (shell as any).chmod('-R', 'a+w', dir);
+      shell.rm('-rf', dir);
+    } catch (err) {
+      console.error(`ERROR: Unable to remove '${dir}' due to:`, err);
+    }
+  }
+
+  protected removeUnnecessaryBuilds(existingBuildNumbers: number[], openPrNumbers: number[]) {
+    const toRemove = existingBuildNumbers.filter(num => !openPrNumbers.includes(num));
+
+    console.log(`Existing builds: ${existingBuildNumbers.length}`);
+    console.log(`Open pull requests: ${openPrNumbers.length}`);
+    console.log(`Removing ${toRemove.length} build(s): ${toRemove.join(', ')}`);
+
+    toRemove.
+      map(num => path.join(this.buildsDir, String(num))).
+      forEach(dir => this.removeDir(dir));
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/clean-up/index.ts

@@ -0,0 +1,23 @@
+// Imports
+import {getEnvVar} from '../common/utils';
+import {BuildCleaner} from './build-cleaner';
+
+// Constants
+const AIO_BUILDS_DIR = getEnvVar('AIO_BUILDS_DIR');
+const AIO_GITHUB_TOKEN = getEnvVar('AIO_GITHUB_TOKEN', true);
+const AIO_REPO_SLUG = getEnvVar('AIO_REPO_SLUG');
+
+// Run
+_main();
+
+// Functions
+function _main() {
+  console.log(`[${new Date()}] - Cleaning up builds...`);
+
+  const buildCleaner = new BuildCleaner(AIO_BUILDS_DIR, AIO_REPO_SLUG, AIO_GITHUB_TOKEN);
+
+  buildCleaner.cleanUp().catch(err => {
+    console.error('ERROR:', err);
+    process.exit(1);
+  });
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/github-api.ts

@@ -0,0 +1,110 @@
+// Imports
+import {IncomingMessage} from 'http';
+import * as https from 'https';
+import {assertNotMissingOrEmpty} from './utils';
+
+// Constants
+const GITHUB_HOSTNAME = 'api.github.com';
+
+// Interfaces - Types
+interface RequestParams {
+  [key: string]: string | number;
+}
+
+type RequestParamsOrNull = RequestParams | null;
+
+// Classes
+export class GithubApi {
+  protected requestHeaders: {[key: string]: string};
+
+  // Constructor
+  constructor(githubToken: string) {
+    assertNotMissingOrEmpty('githubToken', githubToken);
+
+    this.requestHeaders = {
+      'Authorization': `token ${githubToken}`,
+      'User-Agent': `Node/${process.versions.node}`,
+    };
+  }
+
+  // Methods - Public
+  public get<T>(pathname: string, params?: RequestParamsOrNull): Promise<T> {
+    const path = this.buildPath(pathname, params);
+    return this.request<T>('get', path);
+  }
+
+  public post<T>(pathname: string, params?: RequestParamsOrNull, data?: any): Promise<T> {
+    const path = this.buildPath(pathname, params);
+    return this.request<T>('post', path, data);
+  }
+
+  // Methods - Protected
+  protected buildPath(pathname: string, params?: RequestParamsOrNull): string {
+    if (params == null) {
+      return pathname;
+    }
+
+    const search = (params === null) ? '' : this.serializeSearchParams(params);
+    const joiner = search && '?';
+
+    return `${pathname}${joiner}${search}`;
+  }
+
+  protected getPaginated<T>(pathname: string, baseParams: RequestParams = {}, currentPage: number = 0): Promise<T[]> {
+    const perPage = 100;
+    const params = {
+      ...baseParams,
+      page: currentPage,
+      per_page: perPage,
+    };
+
+    return this.get<T[]>(pathname, params).then(items => {
+      if (items.length < perPage) {
+        return items;
+      }
+
+      return this.getPaginated(pathname, baseParams, currentPage + 1).then(moreItems => [...items, ...moreItems]);
+    });
+  }
+
+  protected request<T>(method: string, path: string, data: any = null): Promise<T> {
+    return new Promise<T>((resolve, reject) => {
+      const options = {
+        headers: {...this.requestHeaders},
+        host: GITHUB_HOSTNAME,
+        method,
+        path,
+      };
+
+      const onError = (statusCode: number, responseText: string) => {
+        const url = `https://${GITHUB_HOSTNAME}${path}`;
+        reject(`Request to '${url}' failed (status: ${statusCode}): ${responseText}`);
+      };
+      const onSuccess = (responseText: string) => {
+        try { resolve(JSON.parse(responseText)); } catch (err) { reject(err); }
+      };
+      const onResponse = (res: IncomingMessage) => {
+        const statusCode = res.statusCode || -1;
+        const isSuccess = (200 <= statusCode) && (statusCode < 400);
+        let responseText = '';
+
+        res.
+          on('data', d => responseText += d).
+          on('end', () => isSuccess ? onSuccess(responseText) : onError(statusCode, responseText)).
+          on('error', reject);
+      };
+
+      https.
+        request(options, onResponse).
+        on('error', reject).
+        end(data && JSON.stringify(data));
+    });
+  }
+
+  protected serializeSearchParams(params: RequestParams): string {
+    return Object.keys(params).
+      filter(key => params[key] != null).
+      map(key => `${key}=${encodeURIComponent(String(params[key]))}`).
+      join('&');
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/github-pull-requests.ts

@@ -0,0 +1,44 @@
+// Imports
+import {assertNotMissingOrEmpty} from '../common/utils';
+import {GithubApi} from './github-api';
+
+// Interfaces - Types
+export interface PullRequest  {
+  number: number;
+  user: {login: string};
+}
+
+export type PullRequestState = 'all' | 'closed' | 'open';
+
+// Classes
+export class GithubPullRequests extends GithubApi {
+  // Constructor
+  constructor(githubToken: string, protected repoSlug: string) {
+    super(githubToken);
+    assertNotMissingOrEmpty('repoSlug', repoSlug);
+  }
+
+  // Methods - Public
+  public addComment(pr: number, body: string): Promise<void> {
+    if (!(pr > 0)) {
+      throw new Error(`Invalid PR number: ${pr}`);
+    } else if (!body) {
+      throw new Error(`Invalid or empty comment body: ${body}`);
+    }
+
+    return this.post<void>(`/repos/${this.repoSlug}/issues/${pr}/comments`, null, {body});
+  }
+
+  public fetch(pr: number): Promise<PullRequest> {
+    return this.get<PullRequest>(`/repos/${this.repoSlug}/pulls/${pr}`);
+  }
+
+  public fetchAll(state: PullRequestState = 'all'): Promise<PullRequest[]> {
+    console.log(`Fetching ${state} pull requests...`);
+
+    const pathname = `/repos/${this.repoSlug}/pulls`;
+    const params = {state};
+
+    return this.getPaginated<PullRequest>(pathname, params);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/github-teams.ts

@@ -0,0 +1,45 @@
+// Imports
+import {assertNotMissingOrEmpty} from '../common/utils';
+import {GithubApi} from './github-api';
+
+// Interfaces - Types
+interface Team {
+  id: number;
+  slug: string;
+}
+
+interface TeamMembership {
+  state: string;
+}
+
+// Classes
+export class GithubTeams extends GithubApi {
+  // Constructor
+  constructor(githubToken: string, protected organization: string) {
+    super(githubToken);
+    assertNotMissingOrEmpty('organization', organization);
+  }
+
+  // Methods - Public
+  public fetchAll(): Promise<Team[]> {
+    return this.getPaginated<Team>(`/orgs/${this.organization}/teams`);
+  }
+
+  public isMemberById(username: string, teamIds: number[]): Promise<boolean> {
+    const getMembership = (teamId: number) =>
+      this.get<TeamMembership>(`/teams/${teamId}/memberships/${username}`).
+        then(membership => membership.state === 'active').
+        catch(() => false);
+    const reduceFn = (promise: Promise<boolean>, teamId: number) =>
+      promise.then(isMember => isMember || getMembership(teamId));
+
+    return teamIds.reduce(reduceFn, Promise.resolve(false));
+  }
+
+  public isMemberBySlug(username: string, teamSlugs: string[]): Promise<boolean> {
+    return this.fetchAll().
+      then(teams => teams.filter(team => teamSlugs.includes(team.slug)).map(team => team.id)).
+      then(teamIds => this.isMemberById(username, teamIds)).
+      catch(() => false);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/run-tests.ts

@@ -0,0 +1,23 @@
+export const runTests = (specFiles: string[], helpers?: string[]) => {
+  // We can't use `import` here, because of the following mess:
+  // - GitHub project `jasmine/jasmine` is `jasmine-core` on npm and its typings `@types/jasmine`.
+  // - GitHub project `jasmine/jasmine-npm` is `jasmine` on npm and has no typings.
+  //
+  // Using `import...from 'jasmine'` here, would import from `@types/jasmine` (which refers to the
+  // `jasmine-core` module and the `jasmine` module).
+  // tslint:disable-next-line: no-var-requires variable-name
+  const Jasmine = require('jasmine');
+  const config = {
+    helpers,
+    random: true,
+    spec_files: specFiles,
+    stopSpecOnExpectationFailure: true,
+  };
+
+  process.on('unhandledRejection', (reason: any) => console.log('Unhandled rejection:', reason));
+
+  const runner = new Jasmine();
+  runner.loadConfig(config);
+  runner.onComplete((passed: boolean) => process.exit(passed ? 0 : 1));
+  runner.execute();
+};

aio/aio-builds-setup/dockerbuild/scripts-js/lib/common/utils.ts

@@ -0,0 +1,17 @@
+// Functions
+export const assertNotMissingOrEmpty = (name: string, value: string | null | undefined) => {
+  if (!value) {
+    throw new Error(`Missing or empty required parameter '${name}'!`);
+  }
+};
+
+export const getEnvVar = (name: string, isOptional = false): string => {
+  const value = process.env[name];
+
+  if (!isOptional && !value) {
+    console.error(`ERROR: Missing required environment variable '${name}'!`);
+    process.exit(1);
+  }
+
+  return value || '';
+};

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/build-creator.ts

@@ -0,0 +1,81 @@
+// Imports
+import * as cp from 'child_process';
+import {EventEmitter} from 'events';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as shell from 'shelljs';
+import {assertNotMissingOrEmpty} from '../common/utils';
+import {CreatedBuildEvent} from './build-events';
+import {UploadError} from './upload-error';
+
+// Classes
+export class BuildCreator extends EventEmitter {
+  // Constructor
+  constructor(protected buildsDir: string) {
+    super();
+    assertNotMissingOrEmpty('buildsDir', buildsDir);
+  }
+
+  // Methods - Public
+  public create(pr: string, sha: string, archivePath: string): Promise<any> {
+    const prDir = path.join(this.buildsDir, pr);
+    const shaDir = path.join(prDir, sha);
+    let dirToRemoveOnError: string;
+
+    return Promise.
+      all([this.exists(prDir), this.exists(shaDir)]).
+      then(([prDirExisted, shaDirExisted]) => {
+        if (shaDirExisted) {
+          throw new UploadError(409, `Request to overwrite existing directory: ${shaDir}`);
+        }
+
+        dirToRemoveOnError = prDirExisted ? shaDir : prDir;
+
+        return Promise.resolve().
+          then(() => shell.mkdir('-p', shaDir)).
+          then(() => this.extractArchive(archivePath, shaDir)).
+          then(() => this.emit(CreatedBuildEvent.type, new CreatedBuildEvent(+pr, sha)));
+      }).
+      catch(err => {
+        if (dirToRemoveOnError) {
+          shell.rm('-rf', dirToRemoveOnError);
+        }
+
+        if (!(err instanceof UploadError)) {
+          err = new UploadError(500, `Error while uploading to directory: ${shaDir}\n${err}`);
+        }
+
+        throw err;
+      });
+  }
+
+  // Methods - Protected
+  protected exists(fileOrDir: string): Promise<boolean> {
+    return new Promise(resolve => fs.access(fileOrDir, err => resolve(!err)));
+  }
+
+  protected extractArchive(inputFile: string, outputDir: string): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      const cmd = `tar --extract --gzip --directory "${outputDir}" --file "${inputFile}"`;
+
+      cp.exec(cmd, (err, _stdout, stderr) => {
+        if (err) {
+          return reject(err);
+        }
+
+        if (stderr) {
+          console.warn(stderr);
+        }
+
+        try {
+          // Undocumented signature (see https://github.com/shelljs/shelljs/pull/663).
+          (shell as any).chmod('-R', 'a-w', outputDir);
+          shell.rm('-f', inputFile);
+          resolve();
+        } catch (err) {
+          reject(err);
+        }
+      });
+    });
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/build-events.ts

@@ -0,0 +1,15 @@
+// Classes
+export class BuildEvent {
+  // Constructor
+  constructor(public type: string, public pr: number, public sha: string) {}
+}
+
+export class CreatedBuildEvent extends BuildEvent {
+  // Properties - Public, Static
+  public static type = 'build.created';
+
+  // Constructor
+  constructor(pr: number, sha: string) {
+    super(CreatedBuildEvent.type, pr, sha);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/build-verifier.ts

@@ -0,0 +1,78 @@
+// Imports
+import * as jwt from 'jsonwebtoken';
+import {GithubPullRequests} from '../common/github-pull-requests';
+import {GithubTeams} from '../common/github-teams';
+import {assertNotMissingOrEmpty} from '../common/utils';
+import {UploadError} from './upload-error';
+
+// Interfaces - Types
+interface JwtPayload {
+  slug: string;
+  'pull-request': number;
+}
+
+// Classes
+export class BuildVerifier {
+  // Properties - Protected
+  protected githubPullRequests: GithubPullRequests;
+  protected githubTeams: GithubTeams;
+
+  // Constructor
+  constructor(protected secret: string, githubToken: string, protected repoSlug: string, organization: string,
+              protected allowedTeamSlugs: string[]) {
+    assertNotMissingOrEmpty('secret', secret);
+    assertNotMissingOrEmpty('githubToken', githubToken);
+    assertNotMissingOrEmpty('repoSlug', repoSlug);
+    assertNotMissingOrEmpty('organization', organization);
+    assertNotMissingOrEmpty('allowedTeamSlugs', allowedTeamSlugs && allowedTeamSlugs.join(''));
+
+    this.githubPullRequests = new GithubPullRequests(githubToken, repoSlug);
+    this.githubTeams = new GithubTeams(githubToken, organization);
+  }
+
+  // Methods - Public
+  public getPrAuthorTeamMembership(pr: number): Promise<{author: string, isMember: boolean}> {
+    return Promise.resolve().
+      then(() => this.githubPullRequests.fetch(pr)).
+      then(prInfo => prInfo.user.login).
+      then(author => this.githubTeams.isMemberBySlug(author, this.allowedTeamSlugs).
+        then(isMember => ({author, isMember})));
+  }
+
+  public verify(expectedPr: number, authHeader: string): Promise<void> {
+    return Promise.resolve().
+      then(() => this.extractJwtString(authHeader)).
+      then(jwtString => this.verifyJwt(expectedPr, jwtString)).
+      then(jwtPayload => this.verifyPr(jwtPayload['pull-request'])).
+      catch(err => { throw new UploadError(403, `Error while verifying upload for PR ${expectedPr}: ${err}`); });
+  }
+
+  // Methods - Protected
+  protected extractJwtString(input: string): string {
+    return input.replace(/^token +/i, '');
+  }
+
+  protected verifyJwt(expectedPr: number, token: string): Promise<JwtPayload> {
+    return new Promise((resolve, reject) => {
+      jwt.verify(token, this.secret, {issuer: 'Travis CI, GmbH'}, (err, payload) => {
+        if (err) {
+          reject(err.message || err);
+        } else if (payload.slug !== this.repoSlug) {
+          reject(`jwt slug invalid. expected: ${this.repoSlug}`);
+        } else if (payload['pull-request'] !== expectedPr) {
+          reject(`jwt pull-request invalid. expected: ${expectedPr}`);
+        } else {
+          resolve(payload);
+        }
+      });
+    });
+  }
+
+  protected verifyPr(pr: number): Promise<void> {
+    return this.getPrAuthorTeamMembership(pr).
+      then(({author, isMember}) => isMember ? Promise.resolve() : Promise.reject(
+        `User '${author}' is not an active member of any of the following teams: ` +
+        `${this.allowedTeamSlugs.join(', ')}`,
+      ));
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/index-preverify-pr.ts

@@ -0,0 +1,39 @@
+// Imports
+import {getEnvVar} from '../common/utils';
+import {BuildVerifier} from './build-verifier';
+
+// Run
+_main();
+
+// Functions
+function _main() {
+  const secret = 'unused';
+  const githubToken = getEnvVar('AIO_GITHUB_TOKEN');
+  const repoSlug = getEnvVar('AIO_REPO_SLUG');
+  const organization = getEnvVar('AIO_GITHUB_ORGANIZATION');
+  const allowedTeamSlugs = getEnvVar('AIO_GITHUB_TEAM_SLUGS').split(',');
+  const pr = +getEnvVar('AIO_PREVERIFY_PR');
+
+  const buildVerifier = new BuildVerifier(secret, githubToken, repoSlug, organization, allowedTeamSlugs);
+
+  // Exit codes:
+  // - 0: The PR author is a member.
+  // - 1: An error occurred.
+  // - 2: The PR author is not a member.
+  buildVerifier.getPrAuthorTeamMembership(pr).
+    then(({author, isMember}) => {
+      if (isMember) {
+        process.exit(0);
+      } else {
+        const errorMessage = `User '${author}' is not an active member of any of the following teams: ` +
+                             `${allowedTeamSlugs.join(', ')}`;
+        onError(errorMessage, 2);
+      }
+    }).
+    catch(err => onError(err, 1));
+}
+
+function onError(err: string, exitCode: number) {
+  console.error(err);
+  process.exit(exitCode || 1);
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/index-test.ts

@@ -0,0 +1,10 @@
+// Imports
+import {GithubPullRequests} from '../common/github-pull-requests';
+import {BuildVerifier} from './build-verifier';
+
+// Run
+// TODO(gkalpak): Add e2e tests to cover these interactions as well.
+GithubPullRequests.prototype.addComment = () => Promise.resolve();
+BuildVerifier.prototype.verify = () => Promise.resolve();
+// tslint:disable-next-line: no-var-requires
+require('./index');

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/index.ts

@@ -0,0 +1,34 @@
+// Imports
+import {getEnvVar} from '../common/utils';
+import {uploadServerFactory} from './upload-server-factory';
+
+// Constants
+const AIO_BUILDS_DIR = getEnvVar('AIO_BUILDS_DIR');
+const AIO_DOMAIN_NAME = getEnvVar('AIO_DOMAIN_NAME');
+const AIO_GITHUB_ORGANIZATION = getEnvVar('AIO_GITHUB_ORGANIZATION');
+const AIO_GITHUB_TEAM_SLUGS = getEnvVar('AIO_GITHUB_TEAM_SLUGS');
+const AIO_GITHUB_TOKEN = getEnvVar('AIO_GITHUB_TOKEN');
+const AIO_PREVIEW_DEPLOYMENT_TOKEN = getEnvVar('AIO_PREVIEW_DEPLOYMENT_TOKEN');
+const AIO_REPO_SLUG = getEnvVar('AIO_REPO_SLUG');
+const AIO_UPLOAD_HOSTNAME = getEnvVar('AIO_UPLOAD_HOSTNAME');
+const AIO_UPLOAD_PORT = +getEnvVar('AIO_UPLOAD_PORT');
+const AIO_WWW_USER = getEnvVar('AIO_WWW_USER');
+
+// Run
+process.setuid(AIO_WWW_USER);   // TODO(gkalpak): Find more suitable way to run as `www-data`.
+_main();
+
+// Functions
+function _main() {
+  uploadServerFactory.
+    create({
+      buildsDir: AIO_BUILDS_DIR,
+      domainName: AIO_DOMAIN_NAME,
+      githubOrganization: AIO_GITHUB_ORGANIZATION,
+      githubTeamSlugs: AIO_GITHUB_TEAM_SLUGS.split(','),
+      githubToken: AIO_GITHUB_TOKEN,
+      repoSlug: AIO_REPO_SLUG,
+      secret: AIO_PREVIEW_DEPLOYMENT_TOKEN,
+    }).
+    listen(AIO_UPLOAD_PORT, AIO_UPLOAD_HOSTNAME);
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/upload-error.ts

@@ -0,0 +1,8 @@
+// Classes
+export class UploadError extends Error {
+  // Constructor
+  constructor(public status: number = 500, message?: string) {
+    super(message);
+    Object.setPrototypeOf(this, UploadError.prototype);
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/lib/upload-server/upload-server-factory.ts

@@ -0,0 +1,117 @@
+// Imports
+import * as express from 'express';
+import * as http from 'http';
+import {GithubPullRequests} from '../common/github-pull-requests';
+import {assertNotMissingOrEmpty} from '../common/utils';
+import {BuildCreator} from './build-creator';
+import {CreatedBuildEvent} from './build-events';
+import {BuildVerifier} from './build-verifier';
+import {UploadError} from './upload-error';
+
+// Constants
+const AUTHORIZATION_HEADER = 'AUTHORIZATION';
+const X_FILE_HEADER = 'X-FILE';
+
+// Interfaces - Types
+interface UploadServerConfig {
+  buildsDir: string;
+  domainName: string;
+  githubOrganization: string;
+  githubTeamSlugs: string[];
+  githubToken: string;
+  repoSlug: string;
+  secret: string;
+}
+
+// Classes
+class UploadServerFactory {
+  // Methods - Public
+  public create({
+    buildsDir,
+    domainName,
+    githubOrganization,
+    githubTeamSlugs,
+    githubToken,
+    repoSlug,
+    secret,
+  }: UploadServerConfig): http.Server {
+    assertNotMissingOrEmpty('domainName', domainName);
+
+    const buildVerifier = new BuildVerifier(secret, githubToken, repoSlug, githubOrganization, githubTeamSlugs);
+    const buildCreator = this.createBuildCreator(buildsDir, githubToken, repoSlug, domainName);
+
+    const middleware = this.createMiddleware(buildVerifier, buildCreator);
+    const httpServer = http.createServer(middleware);
+
+    httpServer.on('listening', () => {
+      const info = httpServer.address();
+      console.info(`Up and running (and listening on ${info.address}:${info.port})...`);
+    });
+
+    return httpServer;
+  }
+
+  // Methods - Protected
+  protected createBuildCreator(buildsDir: string, githubToken: string, repoSlug: string,
+                               domainName: string): BuildCreator {
+    const buildCreator = new BuildCreator(buildsDir);
+    const githubPullRequests = new GithubPullRequests(githubToken, repoSlug);
+
+    buildCreator.on(CreatedBuildEvent.type, ({pr, sha}: CreatedBuildEvent) => {
+      const body = `The angular.io preview for ${sha} is available [here][1].\n\n` +
+                   `[1]: https://pr${pr}-${sha}.${domainName}/`;
+
+      githubPullRequests.addComment(pr, body);
+    });
+
+    return buildCreator;
+  }
+
+  protected createMiddleware(buildVerifier: BuildVerifier, buildCreator: BuildCreator): express.Express {
+    const middleware = express();
+
+    middleware.get(/^\/create-build\/([1-9][0-9]*)\/([0-9a-f]{40})\/?$/, (req, res) => {
+      const pr = req.params[0];
+      const sha = req.params[1];
+      const archive = req.header(X_FILE_HEADER);
+      const authHeader = req.header(AUTHORIZATION_HEADER);
+
+      if (!authHeader) {
+        this.throwRequestError(401, `Missing or empty '${AUTHORIZATION_HEADER}' header`, req);
+      } else if (!archive) {
+        this.throwRequestError(400, `Missing or empty '${X_FILE_HEADER}' header`, req);
+      }
+
+      buildVerifier.
+        verify(+pr, authHeader).
+        then(() => buildCreator.create(pr, sha, archive)).
+        then(() => res.sendStatus(201)).
+        catch(err => this.respondWithError(res, err));
+    });
+    middleware.get(/^\/health-check\/?$/, (_req, res) => res.sendStatus(200));
+    middleware.get('*', req => this.throwRequestError(404, 'Unknown resource', req));
+    middleware.all('*', req => this.throwRequestError(405, 'Unsupported method', req));
+    middleware.use((err: any, _req: any, res: express.Response, _next: any) => this.respondWithError(res, err));
+
+    return middleware;
+  }
+
+  protected respondWithError(res: express.Response, err: any) {
+    if (!(err instanceof UploadError)) {
+      err = new UploadError(500, String((err && err.message) || err));
+    }
+
+    const statusText = http.STATUS_CODES[err.status] || '???';
+    console.error(`Upload error: ${err.status} - ${statusText}`);
+    console.error(err.message);
+
+    res.status(err.status).end(err.message);
+  }
+
+  protected throwRequestError(status: number, error: string, req: express.Request) {
+    throw new UploadError(status, `${error} in request: ${req.method} ${req.originalUrl}`);
+  }
+}
+
+// Exports
+export const uploadServerFactory = new UploadServerFactory();

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/helper.ts

@@ -0,0 +1,191 @@
+// Imports
+import * as cp from 'child_process';
+import * as fs from 'fs';
+import * as http from 'http';
+import * as path from 'path';
+import * as shell from 'shelljs';
+import {getEnvVar} from '../common/utils';
+
+// Constans
+const TEST_AIO_BUILDS_DIR = getEnvVar('TEST_AIO_BUILDS_DIR');
+const TEST_AIO_NGINX_HOSTNAME = getEnvVar('TEST_AIO_NGINX_HOSTNAME');
+const TEST_AIO_NGINX_PORT_HTTP = +getEnvVar('TEST_AIO_NGINX_PORT_HTTP');
+const TEST_AIO_NGINX_PORT_HTTPS = +getEnvVar('TEST_AIO_NGINX_PORT_HTTPS');
+const TEST_AIO_UPLOAD_HOSTNAME = getEnvVar('TEST_AIO_UPLOAD_HOSTNAME');
+const TEST_AIO_UPLOAD_MAX_SIZE = +getEnvVar('TEST_AIO_UPLOAD_MAX_SIZE');
+const TEST_AIO_UPLOAD_PORT = +getEnvVar('TEST_AIO_UPLOAD_PORT');
+const WWW_USER = getEnvVar('AIO_WWW_USER');
+
+// Interfaces - Types
+export interface CmdResult { success: boolean; err: Error; stdout: string; stderr: string; }
+export interface FileSpecs { content?: string; size?: number; }
+
+export type CleanUpFn = () => void;
+export type TestSuiteFactory = (scheme: string, port: number) => void;
+export type VerifyCmdResultFn = (result: CmdResult) => void;
+
+// Classes
+class Helper {
+  // Properties - Public
+  public get buildsDir() { return TEST_AIO_BUILDS_DIR; }
+  public get nginxHostname() { return TEST_AIO_NGINX_HOSTNAME; }
+  public get nginxPortHttp() { return TEST_AIO_NGINX_PORT_HTTP; }
+  public get nginxPortHttps() { return TEST_AIO_NGINX_PORT_HTTPS; }
+  public get wwwUser() { return WWW_USER; }
+  public get uploadHostname() { return TEST_AIO_UPLOAD_HOSTNAME; }
+  public get uploadPort() { return TEST_AIO_UPLOAD_PORT; }
+  public get uploadMaxSize() { return TEST_AIO_UPLOAD_MAX_SIZE; }
+
+  // Properties - Protected
+  protected cleanUpFns: CleanUpFn[] = [];
+  protected portPerScheme: {[scheme: string]: number} = {
+    http: this.nginxPortHttp,
+    https: this.nginxPortHttps,
+  };
+
+  // Constructor
+  constructor() {
+    shell.mkdir('-p', this.buildsDir);
+    shell.exec(`chown -R ${this.wwwUser} ${this.buildsDir}`);
+  }
+
+  // Methods - Public
+  public cleanUp() {
+    while (this.cleanUpFns.length) {
+      // Clean-up fns remove themselves from the list.
+      this.cleanUpFns[0]();
+    }
+
+    if (fs.readdirSync(this.buildsDir).length) {
+      throw new Error(`Directory '${this.buildsDir}' is not empty after clean-up.`);
+    }
+  }
+
+  public createDummyArchive(pr: string, sha: string, archivePath: string): CleanUpFn {
+    const inputDir = path.join(this.buildsDir, 'uploaded', pr, sha);
+    const cmd1 = `tar --create --gzip --directory "${inputDir}" --file "${archivePath}" .`;
+    const cmd2 = `chown ${this.wwwUser} ${archivePath}`;
+
+    const cleanUpTemp = this.createDummyBuild(`uploaded/${pr}`, sha, true);
+    shell.exec(cmd1);
+    shell.exec(cmd2);
+    cleanUpTemp();
+
+    return this.createCleanUpFn(() => shell.rm('-rf', archivePath));
+  }
+
+  public createDummyBuild(pr: string, sha: string, force = false): CleanUpFn {
+    const prDir = path.join(this.buildsDir, pr);
+    const shaDir = path.join(prDir, sha);
+    const idxPath = path.join(shaDir, 'index.html');
+    const barPath = path.join(shaDir, 'foo', 'bar.js');
+
+    this.writeFile(idxPath, {content: `PR: ${pr} | SHA: ${sha} | File: /index.html`}, force);
+    this.writeFile(barPath, {content: `PR: ${pr} | SHA: ${sha} | File: /foo/bar.js`}, force);
+    shell.exec(`chown -R ${this.wwwUser} ${prDir}`);
+
+    return this.createCleanUpFn(() => shell.rm('-rf', prDir));
+  }
+
+  public deletePrDir(pr: string) {
+    const prDir = path.join(this.buildsDir, pr);
+
+    if (fs.existsSync(prDir)) {
+      // Undocumented signature (see https://github.com/shelljs/shelljs/pull/663).
+      (shell as any).chmod('-R', 'a+w', prDir);
+      shell.rm('-rf', prDir);
+    }
+  }
+
+  public readBuildFile(pr: string, sha: string, relFilePath: string): string {
+    const absFilePath = path.join(this.buildsDir, pr, sha, relFilePath);
+    return fs.readFileSync(absFilePath, 'utf8');
+  }
+
+  public runCmd(cmd: string, opts: cp.ExecFileOptions = {}): Promise<CmdResult> {
+    return new Promise(resolve => {
+      const proc = cp.exec(cmd, opts, (err, stdout, stderr) => resolve({success: !err, err, stdout, stderr}));
+      this.createCleanUpFn(() => proc.kill());
+    });
+  }
+
+  public runForAllSupportedSchemes(suiteFactory: TestSuiteFactory) {
+    Object.keys(this.portPerScheme).forEach(scheme => suiteFactory(scheme, this.portPerScheme[scheme]));
+  }
+
+  public verifyResponse(status: number | [number, string], regex = /^/): VerifyCmdResultFn {
+    let statusCode: number;
+    let statusText: string;
+
+    if (Array.isArray(status)) {
+      statusCode = status[0];
+      statusText = status[1];
+    } else {
+      statusCode = status;
+      statusText = http.STATUS_CODES[statusCode];
+    }
+
+    return (result: CmdResult) => {
+      const [headers, body] = result.stdout.
+        split(/(?:\r?\n){2,}/).
+        map(s => s.trim()).
+        slice(-2);
+
+      if (!result.success) {
+        console.log('Stdout:', result.stdout);
+        console.log('Stderr:', result.stderr);
+        console.log('Error:', result.err);
+      }
+
+      expect(result.success).toBe(true);
+      expect(headers).toContain(`${statusCode} ${statusText}`);
+      expect(body).toMatch(regex);
+    };
+  }
+
+  public writeBuildFile(pr: string, sha: string, relFilePath: string, content: string): CleanUpFn {
+    const absFilePath = path.join(this.buildsDir, pr, sha, relFilePath);
+    return this.writeFile(absFilePath, {content}, true);
+  }
+
+  public writeFile(filePath: string, {content, size}: FileSpecs, force = false): CleanUpFn {
+    if (!force && fs.existsSync(filePath)) {
+      throw new Error(`Refusing to overwrite existing file '${filePath}'.`);
+    }
+
+    let cleanUpTarget = filePath;
+    while (!fs.existsSync(path.dirname(cleanUpTarget))) {
+      cleanUpTarget = path.dirname(cleanUpTarget);
+    }
+
+    shell.mkdir('-p', path.dirname(filePath));
+    if (size) {
+      // Create a file of the specified size.
+      cp.execSync(`fallocate -l ${size} ${filePath}`);
+    } else {
+      // Create a file with the specified content.
+      fs.writeFileSync(filePath, content || '');
+    }
+    shell.exec(`chown ${this.wwwUser} ${filePath}`);
+
+    return this.createCleanUpFn(() => shell.rm('-rf', cleanUpTarget));
+  }
+
+  // Methods - Protected
+  protected createCleanUpFn(fn: Function): CleanUpFn {
+    const cleanUpFn = () => {
+      const idx = this.cleanUpFns.indexOf(cleanUpFn);
+      if (idx !== -1) {
+        this.cleanUpFns.splice(idx, 1);
+        fn();
+      }
+    };
+
+    this.cleanUpFns.push(cleanUpFn);
+
+    return cleanUpFn;
+  }
+}
+
+// Exports
+export const helper = new Helper();

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/index.ts

@@ -0,0 +1,6 @@
+// Imports
+import {runTests} from '../common/run-tests';
+
+// Run
+const specFiles = [`${__dirname}/**/*.e2e.js`];
+runTests(specFiles);

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/nginx.e2e.ts

@@ -0,0 +1,271 @@
+// Imports
+import * as path from 'path';
+import {helper as h} from './helper';
+
+// Tests
+describe(`nginx`, () => {
+
+  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 10000);
+  afterEach(() => h.cleanUp());
+
+
+  it('should redirect HTTP to HTTPS', done => {
+    const httpHost = `${h.nginxHostname}:${h.nginxPortHttp}`;
+    const httpsHost = `${h.nginxHostname}:${h.nginxPortHttps}`;
+    const urlMap = {
+      [`http://${httpHost}/`]: `https://${httpsHost}/`,
+      [`http://${httpHost}/foo`]: `https://${httpsHost}/foo`,
+      [`http://foo.${httpHost}/`]: `https://foo.${httpsHost}/`,
+    };
+
+    const verifyRedirection = (httpUrl: string) => h.runCmd(`curl -i ${httpUrl}`).then(result => {
+      h.verifyResponse(307)(result);
+
+      const headers = result.stdout.split(/(?:\r?\n){2,}/)[0];
+      expect(headers).toContain(`Location: ${urlMap[httpUrl]}`);
+    });
+
+    Promise.
+      all(Object.keys(urlMap).map(verifyRedirection)).
+      then(done);
+  });
+
+
+  h.runForAllSupportedSchemes((scheme, port) => describe(`nginx (on ${scheme.toUpperCase()})`, () => {
+    const hostname = h.nginxHostname;
+    const host = `${hostname}:${port}`;
+    const pr = '9';
+    const sha9 = '9'.repeat(40);
+    const sha0 = '0'.repeat(40);
+
+
+    describe(`pr<pr>-<sha>.${host}/*`, () => {
+
+      beforeEach(() => {
+        h.createDummyBuild(pr, sha9);
+        h.createDummyBuild(pr, sha0);
+      });
+
+
+      it('should return /index.html', done => {
+        const origin = `${scheme}://pr${pr}-${sha9}.${host}`;
+        const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+
+        Promise.all([
+          h.runCmd(`curl -iL ${origin}/index.html`).then(h.verifyResponse(200, bodyRegex)),
+          h.runCmd(`curl -iL ${origin}/`).then(h.verifyResponse(200, bodyRegex)),
+          h.runCmd(`curl -iL ${origin}`).then(h.verifyResponse(200, bodyRegex)),
+        ]).then(done);
+      });
+
+
+      it('should return /foo/bar.js', done => {
+        const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /foo/bar\\.js$`);
+
+        h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/bar.js`).
+          then(h.verifyResponse(200, bodyRegex)).
+          then(done);
+      });
+
+
+      it('should respond with 403 for directories', done => {
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/`).then(h.verifyResponse(403)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo`).then(h.verifyResponse(403)),
+        ]).then(done);
+      });
+
+
+      it('should respond with 404 for unknown paths to files', done => {
+        h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/baz.css`).
+          then(h.verifyResponse(404)).
+          then(done);
+      });
+
+
+      it('should rewrite to \'index.html\' for unknown paths that don\'t look like files', done => {
+        const bodyRegex = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/baz`).then(h.verifyResponse(200, bodyRegex)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}/foo/baz/`).then(h.verifyResponse(200, bodyRegex)),
+        ]).then(done);
+      });
+
+
+      it('should respond with 404 for unknown PRs/SHAs', done => {
+        const otherPr = 54321;
+        const otherSha = '8'.repeat(40);
+
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://pr${pr}9-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://pr${otherPr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}9.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${otherSha}.${host}`).then(h.verifyResponse(404)),
+        ]).then(done);
+      });
+
+
+      it('should respond with 404 if the subdomain format is wrong', done => {
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://xpr${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://prx${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://xx${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://p${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://r${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${pr}-${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}_${sha9}.${host}`).then(h.verifyResponse(404)),
+        ]).then(done);
+      });
+
+
+      it('should reject PRs with leading zeros', done => {
+        h.runCmd(`curl -iL ${scheme}://pr0${pr}-${sha9}.${host}`).
+          then(h.verifyResponse(404)).
+          then(done);
+      });
+
+
+      it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
+        const bodyRegex9 = new RegExp(`^PR: ${pr} | SHA: ${sha9} | File: /index\\.html$`);
+        const bodyRegex0 = new RegExp(`^PR: ${pr} | SHA: ${sha0} | File: /index\\.html$`);
+
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-0${sha9}.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha9}.${host}`).then(h.verifyResponse(200, bodyRegex9)),
+          h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha0}.${host}`).then(h.verifyResponse(200, bodyRegex0)),
+        ]).then(done);
+      });
+
+    });
+
+
+    describe(`${host}/health-check`, () => {
+
+      it('should respond with 200', done => {
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://${host}/health-check`).then(h.verifyResponse(200)),
+          h.runCmd(`curl -iL ${scheme}://${host}/health-check/`).then(h.verifyResponse(200)),
+        ]).then(done);
+      });
+
+
+      it('should respond with 404 if the path does not match exactly', done => {
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://${host}/health-check/foo`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/health-check-foo`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/health-checknfoo`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/foo/health-check`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/foo-health-check`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/foonhealth-check`).then(h.verifyResponse(404)),
+        ]).then(done);
+      });
+
+    });
+
+
+    describe(`${host}/create-build/<pr>/<sha>`, () => {
+
+      it('should disallow non-POST requests', done => {
+        const url = `${scheme}://${host}/create-build/${pr}/${sha9}`;
+
+        Promise.all([
+          h.runCmd(`curl -iLX GET ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX PUT ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX PATCH ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+          h.runCmd(`curl -iLX DELETE ${url}`).then(h.verifyResponse([405, 'Not Allowed'])),
+        ]).then(done);
+      });
+
+
+      it(`should reject files larger than ${h.uploadMaxSize}B (according to header)`, done => {
+        const headers = `--header "Content-Length: ${1.5 * h.uploadMaxSize}"`;
+        const url = `${scheme}://${host}/create-build/${pr}/${sha9}`;
+
+        h.runCmd(`curl -iLX POST ${headers} ${url}`).
+          then(h.verifyResponse([413, 'Request Entity Too Large'])).
+          then(done);
+      });
+
+
+      it(`should reject files larger than ${h.uploadMaxSize}B (without header)`, done => {
+        const filePath = path.join(h.buildsDir, 'snapshot.tar.gz');
+        const url = `${scheme}://${host}/create-build/${pr}/${sha9}`;
+
+        h.writeFile(filePath, {size: 1.5 * h.uploadMaxSize});
+
+        h.runCmd(`curl -iLX POST --data-binary "@${filePath}" ${url}`).
+          then(h.verifyResponse([413, 'Request Entity Too Large'])).
+          then(done);
+      });
+
+
+      it('should pass requests through to the upload server', done => {
+        h.runCmd(`curl -iLX POST ${scheme}://${host}/create-build/${pr}/${sha9}`).
+          then(h.verifyResponse(401, /Missing or empty 'AUTHORIZATION' header/)).
+          then(done);
+      });
+
+
+      it('should respond with 404 for unknown paths', done => {
+        const cmdPrefix = `curl -iLX POST ${scheme}://${host}`;
+
+        Promise.all([
+          h.runCmd(`${cmdPrefix}/foo/create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/foo-create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/fooncreate-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/create-build/foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/create-build-foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/create-buildnfoo/${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/create-build/pr${pr}/${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/create-build/${pr}/${sha9}42`).then(h.verifyResponse(404)),
+        ]).then(done);
+      });
+
+
+      it('should reject PRs with leading zeros', done => {
+        h.runCmd(`curl -iLX POST ${scheme}://${host}/create-build/0${pr}/${sha9}`).
+          then(h.verifyResponse(404)).
+          then(done);
+      });
+
+
+      it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
+        const cmdPrefix = `curl -iLX POST  ${scheme}://${host}/create-build/${pr}`;
+        const bodyRegex = /Missing or empty 'AUTHORIZATION' header/;
+
+        Promise.all([
+          h.runCmd(`${cmdPrefix}/0${sha9}`).then(h.verifyResponse(404)),
+          h.runCmd(`${cmdPrefix}/${sha0}`).then(h.verifyResponse(401, bodyRegex)),
+        ]).then(done);
+      });
+
+    });
+
+
+    describe(`${host}/*`, () => {
+
+      it('should respond with 404 for unkown URLs (even if the resource exists)', done => {
+        ['index.html', 'foo.js', 'foo/index.html'].forEach(relFilePath => {
+          const absFilePath = path.join(h.buildsDir, relFilePath);
+          h.writeFile(absFilePath, {content: `File: /${relFilePath}`});
+        });
+
+        Promise.all([
+          h.runCmd(`curl -iL ${scheme}://${host}/index.html`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://foo.${host}/index.html`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://foo.${host}/`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://foo.${host}`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/foo.js`).then(h.verifyResponse(404)),
+          h.runCmd(`curl -iL ${scheme}://${host}/foo/index.html`).then(h.verifyResponse(404)),
+        ]).then(done);
+      });
+
+    });
+
+  }));
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/server-integration.e2e.ts

@@ -0,0 +1,84 @@
+// Imports
+import * as path from 'path';
+import {helper as h} from './helper';
+
+// Tests
+h.runForAllSupportedSchemes((scheme, port) => describe(`integration (on ${scheme.toUpperCase()})`, () => {
+  const hostname = h.nginxHostname;
+  const host = `${hostname}:${port}`;
+  const pr9 = '9';
+  const sha9 = '9'.repeat(40);
+  const sha0 = '0'.repeat(40);
+  const archivePath = path.join(h.buildsDir, 'snapshot.tar.gz');
+
+  const getFile = (pr: string, sha: string, file: string) =>
+    h.runCmd(`curl -iL ${scheme}://pr${pr}-${sha}.${host}/${file}`);
+  const uploadBuild = (pr: string, sha: string, archive: string) => {
+    const curlPost = 'curl -iLX POST --header "Authorization: Token FOO"';
+    return h.runCmd(`${curlPost} --data-binary "@${archive}" ${scheme}://${host}/create-build/${pr}/${sha}`);
+  };
+
+  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 10000);
+  afterEach(() => {
+    h.deletePrDir(pr9);
+    h.cleanUp();
+  });
+
+
+  it('should be able to upload and serve a build for a new PR', done => {
+    const regexPrefix9 = `^PR: uploaded\\/${pr9} \\| SHA: ${sha9} \\| File:`;
+    const idxContentRegex9 = new RegExp(`${regexPrefix9} \\/index\\.html$`);
+    const barContentRegex9 = new RegExp(`${regexPrefix9} \\/foo\\/bar\\.js$`);
+
+    h.createDummyArchive(pr9, sha9, archivePath);
+
+    uploadBuild(pr9, sha9, archivePath).
+      then(() => Promise.all([
+        getFile(pr9, sha9, 'index.html').then(h.verifyResponse(200, idxContentRegex9)),
+        getFile(pr9, sha9, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex9)),
+      ])).
+      then(done);
+  });
+
+
+  it('should be able to upload and serve a build for an existing PR', done => {
+    const regexPrefix0 = `^PR: ${pr9} \\| SHA: ${sha0} \\| File:`;
+    const idxContentRegex0 = new RegExp(`${regexPrefix0} \\/index\\.html$`);
+    const barContentRegex0 = new RegExp(`${regexPrefix0} \\/foo\\/bar\\.js$`);
+
+    const regexPrefix9 = `^PR: uploaded\\/${pr9} \\| SHA: ${sha9} \\| File:`;
+    const idxContentRegex9 = new RegExp(`${regexPrefix9} \\/index\\.html$`);
+    const barContentRegex9 = new RegExp(`${regexPrefix9} \\/foo\\/bar\\.js$`);
+
+    h.createDummyBuild(pr9, sha0);
+    h.createDummyArchive(pr9, sha9, archivePath);
+
+    uploadBuild(pr9, sha9, archivePath).
+      then(() => Promise.all([
+        getFile(pr9, sha0, 'index.html').then(h.verifyResponse(200, idxContentRegex0)),
+        getFile(pr9, sha0, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex0)),
+        getFile(pr9, sha9, 'index.html').then(h.verifyResponse(200, idxContentRegex9)),
+        getFile(pr9, sha9, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex9)),
+      ])).
+      then(done);
+  });
+
+
+  it('should not be able to overwrite a build', done => {
+    const regexPrefix9 = `^PR: ${pr9} \\| SHA: ${sha9} \\| File:`;
+    const idxContentRegex9 = new RegExp(`${regexPrefix9} \\/index\\.html$`);
+    const barContentRegex9 = new RegExp(`${regexPrefix9} \\/foo\\/bar\\.js$`);
+
+    h.createDummyBuild(pr9, sha9);
+    h.createDummyArchive(pr9, sha9, archivePath);
+
+    uploadBuild(pr9, sha9, archivePath).
+      then(h.verifyResponse(409)).
+      then(() => Promise.all([
+        getFile(pr9, sha9, 'index.html').then(h.verifyResponse(200, idxContentRegex9)),
+        getFile(pr9, sha9, 'foo/bar.js').then(h.verifyResponse(200, barContentRegex9)),
+      ])).
+      then(done);
+  });
+
+}));

aio/aio-builds-setup/dockerbuild/scripts-js/lib/verify-setup/upload-server.e2e.ts

@@ -0,0 +1,266 @@
+// Imports
+import * as fs from 'fs';
+import * as path from 'path';
+import {CmdResult, helper as h} from './helper';
+
+// Tests
+describe('upload-server (on HTTP)', () => {
+  const hostname = h.uploadHostname;
+  const port = h.uploadPort;
+  const host = `${hostname}:${port}`;
+  const pr = '9';
+  const sha9 = '9'.repeat(40);
+  const sha0 = '0'.repeat(40);
+
+  beforeEach(() => jasmine.DEFAULT_TIMEOUT_INTERVAL = 10000);
+  afterEach(() => h.cleanUp());
+
+
+  describe(`${host}/create-build/<pr>/<sha>`, () => {
+    const authorizationHeader = `--header "Authorization: Token FOO"`;
+    const xFileHeader = `--header "X-File: ${h.buildsDir}/snapshot.tar.gz"`;
+    const curl = `curl -iL ${authorizationHeader} ${xFileHeader}`;
+
+
+    it('should disallow non-GET requests', done => {
+      const url = `http://${host}/create-build/${pr}/${sha9}`;
+      const bodyRegex = /^Unsupported method/;
+
+      Promise.all([
+        h.runCmd(`curl -iLX PUT ${url}`).then(h.verifyResponse(405, bodyRegex)),
+        h.runCmd(`curl -iLX POST ${url}`).then(h.verifyResponse(405, bodyRegex)),
+        h.runCmd(`curl -iLX PATCH ${url}`).then(h.verifyResponse(405, bodyRegex)),
+        h.runCmd(`curl -iLX DELETE ${url}`).then(h.verifyResponse(405, bodyRegex)),
+      ]).then(done);
+    });
+
+
+    it('should reject requests without an \'AUTHORIZATION\' header', done => {
+      const headers1 = '';
+      const headers2 = '--header "AUTHORIXATION: "';
+      const url = `http://${host}/create-build/${pr}/${sha9}`;
+      const bodyRegex = /^Missing or empty 'AUTHORIZATION' header/;
+
+      Promise.all([
+        h.runCmd(`curl -iL ${headers1} ${url}`).then(h.verifyResponse(401, bodyRegex)),
+        h.runCmd(`curl -iL  ${headers2} ${url}`).then(h.verifyResponse(401, bodyRegex)),
+      ]).then(done);
+    });
+
+
+    it('should reject requests without an \'X-FILE\' header', done => {
+      const headers1 = authorizationHeader;
+      const headers2 = `${authorizationHeader} --header "X-FILE: "`;
+      const url = `http://${host}/create-build/${pr}/${sha9}`;
+      const bodyRegex = /^Missing or empty 'X-FILE' header/;
+
+      Promise.all([
+        h.runCmd(`curl -iL ${headers1} ${url}`).then(h.verifyResponse(400, bodyRegex)),
+        h.runCmd(`curl -iL ${headers2} ${url}`).then(h.verifyResponse(400, bodyRegex)),
+      ]).then(done);
+    });
+
+
+    it('should respond with 404 for unknown paths', done => {
+      const cmdPrefix = `${curl} http://${host}`;
+
+      Promise.all([
+        h.runCmd(`${cmdPrefix}/foo/create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/foo-create-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/fooncreate-build/${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/create-build/foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/create-build-foo/${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/create-buildnfoo/${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/create-build/pr${pr}/${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${cmdPrefix}/create-build/${pr}/${sha9}42`).then(h.verifyResponse(404)),
+      ]).then(done);
+    });
+
+
+    it('should reject PRs with leading zeros', done => {
+      h.runCmd(`${curl} http://${host}/create-build/0${pr}/${sha9}`).
+        then(h.verifyResponse(404)).
+        then(done);
+    });
+
+
+    it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
+      Promise.all([
+        h.runCmd(`${curl} http://${host}/create-build/${pr}/0${sha9}`).then(h.verifyResponse(404)),
+        h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).then(h.verifyResponse(500)),
+        h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha0}`).then(h.verifyResponse(500)),
+      ]).then(done);
+    });
+
+
+    it('should not overwrite existing builds', done => {
+      h.createDummyBuild(pr, sha9);
+      expect(h.readBuildFile(pr, sha9, 'index.html')).toContain('index.html');
+
+      h.writeBuildFile(pr, sha9, 'index.html', 'My content');
+      expect(h.readBuildFile(pr, sha9, 'index.html')).toBe('My content');
+
+      h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).
+        then(h.verifyResponse(409, /^Request to overwrite existing directory/)).
+        then(() => expect(h.readBuildFile(pr, sha9, 'index.html')).toBe('My content')).
+        then(done);
+    });
+
+
+    it('should delete the PR directory on error (for new PR)', done => {
+      const prDir = path.join(h.buildsDir, pr);
+
+      h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).
+        then(h.verifyResponse(500)).
+        then(() => expect(fs.existsSync(prDir)).toBe(false)).
+        then(done);
+    });
+
+
+    it('should only delete the SHA directory on error (for existing PR)', done => {
+      const prDir = path.join(h.buildsDir, pr);
+      const shaDir = path.join(prDir, sha9);
+
+      h.createDummyBuild(pr, sha0);
+
+      h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`).
+        then(h.verifyResponse(500)).
+        then(() => {
+          expect(fs.existsSync(shaDir)).toBe(false);
+          expect(fs.existsSync(prDir)).toBe(true);
+        }).
+        then(done);
+    });
+
+
+    describe('on successful upload', () => {
+      const archivePath = path.join(h.buildsDir, 'snapshot.tar.gz');
+      let uploadPromise: Promise<CmdResult>;
+
+      beforeEach(() => {
+        h.createDummyArchive(pr, sha9, archivePath);
+        uploadPromise = h.runCmd(`${curl} http://${host}/create-build/${pr}/${sha9}`);
+      });
+      afterEach(() => h.deletePrDir(pr));
+
+
+      it('should respond with 201', done => {
+        uploadPromise.then(h.verifyResponse(201)).then(done);
+      });
+
+
+      it('should extract the contents of the uploaded file', done => {
+        uploadPromise.
+          then(() => {
+            expect(h.readBuildFile(pr, sha9, 'index.html')).toContain(`uploaded/${pr}`);
+            expect(h.readBuildFile(pr, sha9, 'foo/bar.js')).toContain(`uploaded/${pr}`);
+          }).
+          then(done);
+      });
+
+
+      it(`should create files/directories owned by '${h.wwwUser}'`, done => {
+        const shaDir = path.join(h.buildsDir, pr, sha9);
+        const idxPath = path.join(shaDir, 'index.html');
+        const barPath = path.join(shaDir, 'foo', 'bar.js');
+
+        uploadPromise.
+          then(() => Promise.all([
+            h.runCmd(`find ${shaDir}`),
+            h.runCmd(`find ${shaDir} -user ${h.wwwUser}`),
+          ])).
+          then(([{stdout: allFiles}, {stdout: userFiles}]) => {
+            expect(userFiles).toBe(allFiles);
+            expect(userFiles).toContain(shaDir);
+            expect(userFiles).toContain(idxPath);
+            expect(userFiles).toContain(barPath);
+          }).
+          then(done);
+      });
+
+
+      it('should delete the uploaded file', done => {
+        expect(fs.existsSync(archivePath)).toBe(true);
+        uploadPromise.
+          then(() => expect(fs.existsSync(archivePath)).toBe(false)).
+          then(done);
+      });
+
+
+      it('should make the build directory non-writable', done => {
+        const shaDir = path.join(h.buildsDir, pr, sha9);
+        const idxPath = path.join(shaDir, 'index.html');
+        const barPath = path.join(shaDir, 'foo', 'bar.js');
+
+        // See https://github.com/nodejs/node-v0.x-archive/issues/3045#issuecomment-4862588.
+        const isNotWritable = (fileOrDir: string) => {
+          const mode = fs.statSync(fileOrDir).mode;
+          // tslint:disable-next-line: no-bitwise
+          return !(mode & parseInt('222', 8));
+        };
+
+        uploadPromise.
+          then(() => {
+            expect(isNotWritable(shaDir)).toBe(true);
+            expect(isNotWritable(idxPath)).toBe(true);
+            expect(isNotWritable(barPath)).toBe(true);
+          }).
+          then(done);
+      });
+
+    });
+
+  });
+
+
+  describe(`${host}/health-check`, () => {
+
+    it('should respond with 200', done => {
+      Promise.all([
+        h.runCmd(`curl -iL http://${host}/health-check`).then(h.verifyResponse(200)),
+        h.runCmd(`curl -iL http://${host}/health-check/`).then(h.verifyResponse(200)),
+      ]).then(done);
+    });
+
+
+    it('should respond with 404 if the path does not match exactly', done => {
+      Promise.all([
+        h.runCmd(`curl -iL http://${host}/health-check/foo`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL http://${host}/health-check-foo`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL http://${host}/health-checknfoo`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL http://${host}/foo/health-check`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL http://${host}/foo-health-check`).then(h.verifyResponse(404)),
+        h.runCmd(`curl -iL http://${host}/foonhealth-check`).then(h.verifyResponse(404)),
+      ]).then(done);
+    });
+
+  });
+
+
+  describe(`${host}/*`, () => {
+
+    it('should respond with 404 for GET requests to unknown URLs', done => {
+      const bodyRegex = /^Unknown resource/;
+
+      Promise.all([
+        h.runCmd(`curl -iL http://${host}/index.html`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iL http://${host}/`).then(h.verifyResponse(404, bodyRegex)),
+        h.runCmd(`curl -iL http://${host}`).then(h.verifyResponse(404, bodyRegex)),
+      ]).then(done);
+    });
+
+
+    it('should respond with 405 for non-GET requests to any URL', done => {
+      const bodyRegex = /^Unsupported method/;
+
+      Promise.all([
+        h.runCmd(`curl -iLX PUT http://${host}`).then(h.verifyResponse(405, bodyRegex)),
+        h.runCmd(`curl -iLX POST http://${host}`).then(h.verifyResponse(405, bodyRegex)),
+        h.runCmd(`curl -iLX PATCH http://${host}`).then(h.verifyResponse(405, bodyRegex)),
+        h.runCmd(`curl -iLX DELETE http://${host}`).then(h.verifyResponse(405, bodyRegex)),
+      ]).then(done);
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "aio-scripts-js",
+  "version": "1.0.0",
+  "description": "Performing various tasks on PR build artifacts for angular.io.",
+  "repository": "https://github.com/angular/angular.git",
+  "author": "Angular",
+  "license": "MIT",
+  "scripts": {
+    "prebuild": "yarn clean-dist",
+    "build": "tsc",
+    "build-watch": "yarn tsc -- --watch",
+    "clean-dist": "node --eval \"require('shelljs').rm('-rf', 'dist')\"",
+    "dev": "concurrently --kill-others --raw --success first \"yarn build-watch\" \"yarn test-watch\"",
+    "lint": "tslint --project tsconfig.json",
+    "pre~~test-only": "yarn lint",
+    "~~test-only": "node dist/test",
+    "pretest": "yarn build",
+    "test": "yarn ~~test-only",
+    "pretest-watch": "yarn build",
+    "test-watch": "nodemon --exec \"yarn ~~test-only\" --watch dist"
+  },
+  "dependencies": {
+    "express": "^4.14.1",
+    "jasmine": "^2.5.3",
+    "jsonwebtoken": "^7.3.0",
+    "shelljs": "^0.7.6"
+  },
+  "devDependencies": {
+    "@types/express": "^4.0.35",
+    "@types/jasmine": "^2.5.43",
+    "@types/jsonwebtoken": "^7.2.0",
+    "@types/node": "^7.0.5",
+    "@types/shelljs": "^0.7.0",
+    "@types/supertest": "^2.0.0",
+    "concurrently": "^3.3.0",
+    "eslint": "^3.15.0",
+    "eslint-plugin-jasmine": "^2.2.0",
+    "nodemon": "^1.11.0",
+    "supertest": "^3.0.0",
+    "tslint": "^4.4.2",
+    "typescript": "^2.1.6"
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/test/clean-up/build-cleaner.spec.ts

@@ -0,0 +1,318 @@
+// Imports
+import * as fs from 'fs';
+import * as shell from 'shelljs';
+import {BuildCleaner} from '../../lib/clean-up/build-cleaner';
+import {GithubPullRequests} from '../../lib/common/github-pull-requests';
+
+// Tests
+describe('BuildCleaner', () => {
+  let cleaner: BuildCleaner;
+
+  beforeEach(() => cleaner = new BuildCleaner('/foo/bar', 'baz/qux', '12345'));
+
+
+  describe('constructor()', () => {
+
+    it('should throw if \'buildsDir\' is empty', () => {
+      expect(() => new BuildCleaner('', '/baz/qux', '12345')).
+        toThrowError('Missing or empty required parameter \'buildsDir\'!');
+    });
+
+
+    it('should throw if \'repoSlug\' is empty', () => {
+      expect(() => new BuildCleaner('/foo/bar', '', '12345')).
+        toThrowError('Missing or empty required parameter \'repoSlug\'!');
+    });
+
+
+    it('should throw if \'githubToken\' is empty', () => {
+      expect(() => new BuildCleaner('/foo/bar', 'baz/qux', '')).
+        toThrowError('Missing or empty required parameter \'githubToken\'!');
+    });
+
+  });
+
+
+  describe('cleanUp()', () => {
+    let cleanerGetExistingBuildNumbersSpy: jasmine.Spy;
+    let cleanerGetOpenPrNumbersSpy: jasmine.Spy;
+    let cleanerRemoveUnnecessaryBuildsSpy: jasmine.Spy;
+    let existingBuildsDeferred: {resolve: Function, reject: Function};
+    let openPrsDeferred: {resolve: Function, reject: Function};
+    let promise: Promise<void>;
+
+    beforeEach(() => {
+      cleanerGetExistingBuildNumbersSpy = spyOn(cleaner as any, 'getExistingBuildNumbers').and.callFake(() => {
+        return new Promise((resolve, reject) => existingBuildsDeferred = {resolve, reject});
+      });
+      cleanerGetOpenPrNumbersSpy = spyOn(cleaner as any, 'getOpenPrNumbers').and.callFake(() => {
+        return new Promise((resolve, reject) => openPrsDeferred = {resolve, reject});
+      });
+      cleanerRemoveUnnecessaryBuildsSpy = spyOn(cleaner as any, 'removeUnnecessaryBuilds');
+
+      promise = cleaner.cleanUp();
+    });
+
+
+    it('should return a promise', () => {
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should get the existing builds', () => {
+      expect(cleanerGetExistingBuildNumbersSpy).toHaveBeenCalled();
+    });
+
+
+    it('should get the open PRs', () => {
+      expect(cleanerGetOpenPrNumbersSpy).toHaveBeenCalled();
+    });
+
+
+    it('should reject if \'getExistingBuildNumbers()\' rejects', done => {
+      promise.catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      existingBuildsDeferred.reject('Test');
+    });
+
+
+    it('should reject if \'getOpenPrNumbers()\' rejects', done => {
+      promise.catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      openPrsDeferred.reject('Test');
+    });
+
+
+    it('should reject if \'removeUnnecessaryBuilds()\' rejects', done => {
+      promise.catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      cleanerRemoveUnnecessaryBuildsSpy.and.returnValue(Promise.reject('Test'));
+      existingBuildsDeferred.resolve();
+      openPrsDeferred.resolve();
+    });
+
+
+    it('should pass existing builds and open PRs to \'removeUnnecessaryBuilds()\'', done => {
+      promise.then(() => {
+        expect(cleanerRemoveUnnecessaryBuildsSpy).toHaveBeenCalledWith('foo', 'bar');
+        done();
+      });
+
+      existingBuildsDeferred.resolve('foo');
+      openPrsDeferred.resolve('bar');
+    });
+
+
+    it('should resolve with the value returned by \'removeUnnecessaryBuilds()\'', done => {
+      promise.then(result => {
+        expect(result).toBe('Test');
+        done();
+      });
+
+      cleanerRemoveUnnecessaryBuildsSpy.and.returnValue(Promise.resolve('Test'));
+      existingBuildsDeferred.resolve();
+      openPrsDeferred.resolve();
+    });
+
+  });
+
+
+  // Protected methods
+
+  describe('getExistingBuildNumbers()', () => {
+    let fsReaddirSpy: jasmine.Spy;
+    let readdirCb: (err: any, files?: string[]) => void;
+    let promise: Promise<number[]>;
+
+    beforeEach(() => {
+      fsReaddirSpy = spyOn(fs, 'readdir').and.callFake((_: string, cb: typeof readdirCb) => readdirCb = cb);
+      promise = (cleaner as any).getExistingBuildNumbers();
+    });
+
+
+    it('should return a promise', () => {
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should get the contents of the builds directory', () => {
+      expect(fsReaddirSpy).toHaveBeenCalled();
+      expect(fsReaddirSpy.calls.argsFor(0)[0]).toBe('/foo/bar');
+    });
+
+
+    it('should reject if an error occurs while getting the files', done => {
+      promise.catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      readdirCb('Test');
+    });
+
+
+    it('should resolve with the returned files (as numbers)', done => {
+      promise.then(result => {
+        expect(result).toEqual([12, 34, 56]);
+        done();
+      });
+
+      readdirCb(null, ['12', '34', '56']);
+    });
+
+
+    it('should ignore files with non-numeric (or zero) names', done => {
+      promise.then(result => {
+        expect(result).toEqual([12, 34, 56]);
+        done();
+      });
+
+      readdirCb(null, ['12', 'foo', '34', 'bar', '56', '000']);
+    });
+
+  });
+
+
+  describe('getOpenPrNumbers()', () => {
+    let prDeferred: {resolve: Function, reject: Function};
+    let promise: Promise<number[]>;
+
+    beforeEach(() => {
+      spyOn(GithubPullRequests.prototype, 'fetchAll').and.callFake(() => {
+        return new Promise((resolve, reject) => prDeferred = {resolve, reject});
+      });
+
+      promise = (cleaner as any).getOpenPrNumbers();
+    });
+
+
+    it('should return a promise', () => {
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should fetch open PRs via \'GithubPullRequests\'', () => {
+      expect(GithubPullRequests.prototype.fetchAll).toHaveBeenCalledWith('open');
+    });
+
+
+    it('should reject if an error occurs while fetching PRs', done => {
+      promise.catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      prDeferred.reject('Test');
+    });
+
+
+    it('should resolve with the numbers of the fetched PRs', done => {
+      promise.then(prNumbers => {
+        expect(prNumbers).toEqual([1, 2, 3]);
+        done();
+      });
+
+      prDeferred.resolve([{id: 0, number: 1}, {id: 1, number: 2}, {id: 2, number: 3}]);
+    });
+
+  });
+
+
+  describe('removeDir()', () => {
+    let shellChmodSpy: jasmine.Spy;
+    let shellRmSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      shellChmodSpy = spyOn(shell, 'chmod');
+      shellRmSpy = spyOn(shell, 'rm');
+    });
+
+
+    it('should remove the specified directory and its content', () => {
+      (cleaner as any).removeDir('/foo/bar');
+      expect(shellRmSpy).toHaveBeenCalledWith('-rf', '/foo/bar');
+    });
+
+
+    it('should make the directory and its content writable before removing', () => {
+      shellRmSpy.and.callFake(() => expect(shellChmodSpy).toHaveBeenCalledWith('-R', 'a+w', '/foo/bar'));
+      (cleaner as any).removeDir('/foo/bar');
+
+      expect(shellRmSpy).toHaveBeenCalled();
+    });
+
+
+    it('should catch errors and log them', () => {
+      const consoleErrorSpy = spyOn(console, 'error');
+      shellRmSpy.and.callFake(() => { throw 'Test'; });
+
+      (cleaner as any).removeDir('/foo/bar');
+
+      expect(consoleErrorSpy).toHaveBeenCalled();
+      expect(consoleErrorSpy.calls.argsFor(0)[0]).toContain('Unable to remove \'/foo/bar\'');
+      expect(consoleErrorSpy.calls.argsFor(0)[1]).toBe('Test');
+    });
+
+  });
+
+
+  describe('removeUnnecessaryBuilds()', () => {
+    let consoleLogSpy: jasmine.Spy;
+    let cleanerRemoveDirSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      consoleLogSpy = spyOn(console, 'log');
+      cleanerRemoveDirSpy = spyOn(cleaner as any, 'removeDir');
+    });
+
+
+    it('should log the number of existing builds, open PRs and builds to be removed', () => {
+      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3], [3, 4, 5, 6]);
+
+      expect(console.log).toHaveBeenCalledWith('Existing builds: 3');
+      expect(console.log).toHaveBeenCalledWith('Open pull requests: 4');
+      expect(console.log).toHaveBeenCalledWith('Removing 2 build(s): 1, 2');
+    });
+
+
+    it('should construct full paths to directories (by prepending \'buildsDir\')', () => {
+      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3], []);
+
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/1');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/2');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/3');
+    });
+
+
+    it('should remove the builds that do not correspond to open PRs', () => {
+      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3, 4], [2, 4]);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(2);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/1');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/3');
+      cleanerRemoveDirSpy.calls.reset();
+
+      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3, 4], [1, 2, 3, 4]);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(0);
+      cleanerRemoveDirSpy.calls.reset();
+
+      (cleaner as any).removeUnnecessaryBuilds([1, 2, 3, 4], []);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledTimes(4);
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/1');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/2');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/3');
+      expect(cleanerRemoveDirSpy).toHaveBeenCalledWith('/foo/bar/4');
+      cleanerRemoveDirSpy.calls.reset();
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/github-api.spec.ts

@@ -0,0 +1,410 @@
+// Imports
+import {EventEmitter} from 'events';
+import {ClientRequest, IncomingMessage} from 'http';
+import * as https from 'https';
+import {GithubApi} from '../../lib/common/github-api';
+
+// Tests
+describe('GithubApi', () => {
+  let api: GithubApi;
+
+  beforeEach(() => api = new GithubApi('12345'));
+
+
+  describe('constructor()', () => {
+
+    it('should throw if \'githubToken\' is missing or empty', () => {
+      expect(() => new GithubApi('')).toThrowError('Missing or empty required parameter \'githubToken\'!');
+    });
+
+  });
+
+
+  describe('get()', () => {
+    let apiBuildPathSpy: jasmine.Spy;
+    let apiRequestSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      apiBuildPathSpy = spyOn(api as any, 'buildPath');
+      apiRequestSpy = spyOn(api as any, 'request');
+    });
+
+
+    it('should call \'buildPath()\' with the pathname and params', () => {
+      api.get('/foo', {bar: 'baz'});
+
+      expect(apiBuildPathSpy).toHaveBeenCalled();
+      expect(apiBuildPathSpy.calls.argsFor(0)).toEqual(['/foo', {bar: 'baz'}]);
+    });
+
+
+    it('should call \'request()\' with the correct method', () => {
+      api.get('/foo');
+
+      expect(apiRequestSpy).toHaveBeenCalled();
+      expect(apiRequestSpy.calls.argsFor(0)[0]).toBe('get');
+    });
+
+
+    it('should call \'request()\' with the correct path', () => {
+      apiBuildPathSpy.and.returnValue('/foo/bar');
+      api.get('foo');
+
+      expect(apiRequestSpy).toHaveBeenCalled();
+      expect(apiRequestSpy.calls.argsFor(0)[1]).toBe('/foo/bar');
+    });
+
+
+    it('should not pass data to \'request()\'', () => {
+      (api.get as Function)('foo', {}, {});
+
+      expect(apiRequestSpy).toHaveBeenCalled();
+      expect(apiRequestSpy.calls.argsFor(0)[2]).toBeUndefined();
+    });
+
+  });
+
+
+  describe('post()', () => {
+    let apiBuildPathSpy: jasmine.Spy;
+    let apiRequestSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      apiBuildPathSpy = spyOn(api as any, 'buildPath');
+      apiRequestSpy = spyOn(api as any, 'request');
+    });
+
+
+    it('should call \'buildPath()\' with the pathname and params', () => {
+      api.post('/foo', {bar: 'baz'});
+
+      expect(apiBuildPathSpy).toHaveBeenCalled();
+      expect(apiBuildPathSpy.calls.argsFor(0)).toEqual(['/foo', {bar: 'baz'}]);
+    });
+
+
+    it('should call \'request()\' with the correct method', () => {
+      api.post('/foo');
+
+      expect(apiRequestSpy).toHaveBeenCalled();
+      expect(apiRequestSpy.calls.argsFor(0)[0]).toBe('post');
+    });
+
+
+    it('should call \'request()\' with the correct path', () => {
+      apiBuildPathSpy.and.returnValue('/foo/bar');
+      api.post('/foo');
+
+      expect(apiRequestSpy).toHaveBeenCalled();
+      expect(apiRequestSpy.calls.argsFor(0)[1]).toBe('/foo/bar');
+    });
+
+
+    it('should pass the data to \'request()\'', () => {
+      api.post('/foo', {}, {bar: 'baz'});
+
+      expect(apiRequestSpy).toHaveBeenCalled();
+      expect(apiRequestSpy.calls.argsFor(0)[2]).toEqual({bar: 'baz'});
+    });
+
+  });
+
+
+  // Protected methods
+
+  describe('buildPath()', () => {
+
+    it('should return the pathname if no params', () => {
+      expect((api as any).buildPath('/foo')).toBe('/foo');
+      expect((api as any).buildPath('/foo', undefined)).toBe('/foo');
+      expect((api as any).buildPath('/foo', null)).toBe('/foo');
+    });
+
+
+    it('should append the params to the pathname', () => {
+      expect((api as any).buildPath('/foo', {bar: 'baz'})).toBe('/foo?bar=baz');
+    });
+
+
+    it('should join the params with \'&\'', () => {
+      expect((api as any).buildPath('/foo', {bar: 1, baz: 2})).toBe('/foo?bar=1&baz=2');
+    });
+
+
+    it('should ignore undefined/null params', () => {
+      expect((api as any).buildPath('/foo', {bar: undefined, baz: null})).toBe('/foo');
+    });
+
+
+    it('should encode param values as URI components', () => {
+      expect((api as any).buildPath('/foo', {bar: 'b a&z'})).toBe('/foo?bar=b%20a%26z');
+    });
+
+  });
+
+
+  describe('getPaginated()', () => {
+    let deferreds: {resolve: Function, reject: Function}[];
+
+    beforeEach(() => {
+      deferreds = [];
+      spyOn(api, 'get').and.callFake(() => new Promise((resolve, reject) => deferreds.push({resolve, reject})));
+    });
+
+
+    it('should return a promise', () => {
+      expect((api as any).getPaginated()).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should call \'get()\' with the correct pathname and params', () => {
+      (api as any).getPaginated('/foo/bar');
+      (api as any).getPaginated('/foo/bar', {baz: 'qux'});
+
+      expect(api.get).toHaveBeenCalledWith('/foo/bar', {page: 0, per_page: 100});
+      expect(api.get).toHaveBeenCalledWith('/foo/bar', {baz: 'qux', page: 0, per_page: 100});
+    });
+
+
+    it('should reject if the request fails', done => {
+      (api as any).getPaginated('/foo/bar').catch((err: any) => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      deferreds[0].reject('Test');
+    });
+
+
+    it('should resolve with the returned items', done => {
+      const items = [{id: 1}, {id: 2}];
+
+      (api as any).getPaginated('/foo/bar').then((data: any) => {
+        expect(data).toEqual(items);
+        done();
+      });
+
+      deferreds[0].resolve(items);
+    });
+
+
+    it('should iteratively call \'get()\' to fetch all items', done => {
+      // Create an array or 250 objects.
+      const allItems = '.'.repeat(250).split('').map((_, i) => ({id: i}));
+      const apiGetSpy = api.get as jasmine.Spy;
+
+      (api as any).getPaginated('/foo/bar', {baz: 'qux'}).then((data: any) => {
+        const paramsForPage = (page: number) => ({baz: 'qux', page, per_page: 100});
+
+        expect(apiGetSpy).toHaveBeenCalledTimes(3);
+        expect(apiGetSpy.calls.argsFor(0)).toEqual(['/foo/bar', paramsForPage(0)]);
+        expect(apiGetSpy.calls.argsFor(1)).toEqual(['/foo/bar', paramsForPage(1)]);
+        expect(apiGetSpy.calls.argsFor(2)).toEqual(['/foo/bar', paramsForPage(2)]);
+
+        expect(data).toEqual(allItems);
+
+        done();
+      });
+
+      deferreds[0].resolve(allItems.slice(0, 100));
+      setTimeout(() => {
+        deferreds[1].resolve(allItems.slice(100, 200));
+        setTimeout(() => {
+          deferreds[2].resolve(allItems.slice(200));
+        }, 0);
+      }, 0);
+    });
+
+  });
+
+
+  describe('request()', () => {
+    let httpsRequestSpy: jasmine.Spy;
+    let latestRequest: ClientRequest;
+
+    beforeEach(() => {
+      const originalRequest = https.request;
+
+      httpsRequestSpy = spyOn(https, 'request').and.callFake((...args: any[]) => {
+        latestRequest = originalRequest.apply(https, args);
+
+        spyOn(latestRequest, 'on').and.callThrough();
+        spyOn(latestRequest, 'end');
+
+        return latestRequest;
+      });
+    });
+
+
+    it('should return a promise', () => {
+      expect((api as any).request()).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should call \'https.request()\' with the correct options', () => {
+      (api as any).request('method', 'path');
+
+      expect(httpsRequestSpy).toHaveBeenCalled();
+      expect(httpsRequestSpy.calls.argsFor(0)[0]).toEqual(jasmine.objectContaining({
+        headers: jasmine.objectContaining({
+          'User-Agent': `Node/${process.versions.node}`,
+        }),
+        host: 'api.github.com',
+        method: 'method',
+        path: 'path',
+      }));
+    });
+
+
+    it('should call specify an \'Authorization\' header if \'githubToken\' is present', () => {
+      (api as any).request('method', 'path');
+
+      expect(httpsRequestSpy).toHaveBeenCalled();
+      expect(httpsRequestSpy.calls.argsFor(0)[0].headers).toEqual(jasmine.objectContaining({
+        Authorization: 'token 12345',
+      }));
+    });
+
+
+    it('should reject on request error', done => {
+      (api as any).request('method', 'path').catch((err: any) => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      latestRequest.emit('error', 'Test');
+    });
+
+
+    it('should send the request (i.e. call \'end()\')', () => {
+      (api as any).request('method', 'path');
+      expect(latestRequest.end).toHaveBeenCalled();
+    });
+
+
+    it('should \'JSON.stringify\' and send the data along with the request', () => {
+      (api as any).request('method', 'path');
+      expect(latestRequest.end).toHaveBeenCalledWith(null);
+
+      (api as any).request('method', 'path', {key: 'value'});
+      expect(latestRequest.end).toHaveBeenCalledWith('{"key":"value"}');
+    });
+
+
+    describe('onResponse', () => {
+      let promise: Promise<void>;
+      let respond: (statusCode: number) => IncomingMessage;
+
+      beforeEach(() => {
+        promise = (api as any).request('method', 'path');
+
+        respond = (statusCode: number) => {
+          const mockResponse = new EventEmitter() as IncomingMessage;
+          mockResponse.statusCode = statusCode;
+
+          const onResponse = httpsRequestSpy.calls.argsFor(0)[1];
+          onResponse(mockResponse);
+
+          return mockResponse;
+        };
+      });
+
+
+      it('should reject on response error', done => {
+        promise.catch(err => {
+          expect(err).toBe('Test');
+          done();
+        });
+
+        const res = respond(200);
+        res.emit('error', 'Test');
+      });
+
+
+      it('should reject if returned statusCode is <200', done => {
+        promise.catch(err => {
+          expect(err).toContain('failed');
+          expect(err).toContain('status: 199');
+          done();
+        });
+
+        const res = respond(199);
+        res.emit('end');
+      });
+
+
+      it('should reject if returned statusCode is >=400', done => {
+        promise.catch(err => {
+          expect(err).toContain('failed');
+          expect(err).toContain('status: 400');
+          done();
+        });
+
+        const res = respond(400);
+        res.emit('end');
+      });
+
+
+      it('should include the response text in the rejection message', done => {
+        promise.catch(err => {
+          expect(err).toContain('Test');
+          done();
+        });
+
+        const res = respond(500);
+        res.emit('data', 'Test');
+        res.emit('end');
+      });
+
+
+      it('should resolve if returned statusCode is <=200 <400', done => {
+        promise.then(done);
+
+        const res = respond(200);
+        res.emit('data', '{}');
+        res.emit('end');
+      });
+
+
+      it('should resolve with the response text \'JSON.parsed\'', done => {
+        promise.then(data => {
+          expect(data).toEqual({foo: 'bar'});
+          done();
+        });
+
+        const res = respond(300);
+        res.emit('data', '{"foo":"bar"}');
+        res.emit('end');
+      });
+
+
+      it('should collect and concatenate the whole response text', done => {
+        promise.then(data => {
+          expect(data).toEqual({foo: 'bar', baz: 'qux'});
+          done();
+        });
+
+        const res = respond(300);
+        res.emit('data', '{"foo":');
+        res.emit('data', '"bar","baz"');
+        res.emit('data', ':"qux"}');
+        res.emit('end');
+      });
+
+
+      it('should reject if the response text is malformed JSON', done => {
+        promise.catch(err => {
+          expect(err).toEqual(jasmine.any(SyntaxError));
+          done();
+        });
+
+        const res = respond(300);
+        res.emit('data', '}');
+        res.emit('end');
+      });
+
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/github-pull-requests.spec.ts

@@ -0,0 +1,117 @@
+// Imports
+import {GithubPullRequests} from '../../lib/common/github-pull-requests';
+
+// Tests
+describe('GithubPullRequests', () => {
+
+  describe('constructor()', () => {
+
+    it('should throw if \'githubToken\' is missing or empty', () => {
+      expect(() => new GithubPullRequests('', 'foo/bar')).
+        toThrowError('Missing or empty required parameter \'githubToken\'!');
+    });
+
+
+    it('should throw if \'repoSlug\' is missing or empty', () => {
+      expect(() => new GithubPullRequests('12345', '')).
+        toThrowError('Missing or empty required parameter \'repoSlug\'!');
+    });
+
+  });
+
+
+  describe('addComment()', () => {
+    let prs: GithubPullRequests;
+    let deferred: {resolve: Function, reject: Function};
+
+    beforeEach(() => {
+      prs = new GithubPullRequests('12345', 'foo/bar');
+
+      spyOn(prs, 'post').and.callFake(() => new Promise((resolve, reject) => deferred = {resolve, reject}));
+    });
+
+
+    it('should return a promise', () => {
+      expect(prs.addComment(42, 'body')).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should throw if the PR number is invalid', () => {
+      expect(() => prs.addComment(-1337, 'body')).toThrowError(`Invalid PR number: -1337`);
+      expect(() => prs.addComment(NaN, 'body')).toThrowError(`Invalid PR number: NaN`);
+    });
+
+
+    it('should throw if the comment body is invalid or empty', () => {
+      expect(() => prs.addComment(42, '')).toThrowError(`Invalid or empty comment body: `);
+    });
+
+
+    it('should call \'post()\' with the correct pathname, params and data', () => {
+      prs.addComment(42, 'body');
+
+      expect(prs.post).toHaveBeenCalledWith('/repos/foo/bar/issues/42/comments', null, {body: 'body'});
+    });
+
+
+    it('should reject if the request fails', done => {
+      prs.addComment(42, 'body').catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+
+      deferred.reject('Test');
+    });
+
+
+    it('should resolve with the returned response', done => {
+      prs.addComment(42, 'body').then(data => {
+        expect(data).toEqual('Test');
+        done();
+      });
+
+      deferred.resolve('Test');
+    });
+
+  });
+
+
+  describe('fetchAll()', () => {
+    let prs: GithubPullRequests;
+    let prsGetPaginatedSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      prs = new GithubPullRequests('12345', 'foo/bar');
+      prsGetPaginatedSpy = spyOn(prs as any, 'getPaginated');
+      spyOn(console, 'log');
+    });
+
+
+    it('should call \'getPaginated()\' with the correct pathname and params', () => {
+      const expectedPathname = '/repos/foo/bar/pulls';
+
+      prs.fetchAll('all');
+      prs.fetchAll('closed');
+      prs.fetchAll('open');
+
+      expect(prsGetPaginatedSpy).toHaveBeenCalledTimes(3);
+      expect(prsGetPaginatedSpy.calls.argsFor(0)).toEqual([expectedPathname, {state: 'all'}]);
+      expect(prsGetPaginatedSpy.calls.argsFor(1)).toEqual([expectedPathname, {state: 'closed'}]);
+      expect(prsGetPaginatedSpy.calls.argsFor(2)).toEqual([expectedPathname, {state: 'open'}]);
+    });
+
+
+    it('should default to \'all\' if no state is specified', () => {
+      prs.fetchAll();
+      expect(prsGetPaginatedSpy).toHaveBeenCalledWith('/repos/foo/bar/pulls', {state: 'all'});
+    });
+
+
+    it('should forward the value returned by \'getPaginated()\'', () => {
+      prsGetPaginatedSpy.and.returnValue('Test');
+      expect(prs.fetchAll()).toBe('Test');
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/github-teams.spec.ts

@@ -0,0 +1,232 @@
+// Imports
+import {GithubTeams} from '../../lib/common/github-teams';
+
+// Tests
+describe('GithubTeams', () => {
+
+  describe('constructor()', () => {
+
+    it('should throw if \'githubToken\' is missing or empty', () => {
+      expect(() => new GithubTeams('', 'org')).
+        toThrowError('Missing or empty required parameter \'githubToken\'!');
+    });
+
+
+    it('should throw if \'organization\' is missing or empty', () => {
+      expect(() => new GithubTeams('12345', '')).
+        toThrowError('Missing or empty required parameter \'organization\'!');
+    });
+
+  });
+
+
+  describe('fetchAll()', () => {
+    let teams: GithubTeams;
+    let teamsGetPaginatedSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      teams = new GithubTeams('12345', 'foo');
+      teamsGetPaginatedSpy = spyOn(teams as any, 'getPaginated');
+    });
+
+
+    it('should call \'getPaginated()\' with the correct pathname and params', () => {
+      teams.fetchAll();
+      expect(teamsGetPaginatedSpy).toHaveBeenCalledWith('/orgs/foo/teams');
+    });
+
+
+    it('should forward the value returned by \'getPaginated()\'', () => {
+      teamsGetPaginatedSpy.and.returnValue('Test');
+      expect(teams.fetchAll()).toBe('Test');
+    });
+
+  });
+
+
+  describe('isMemberById()', () => {
+    let teams: GithubTeams;
+    let teamsGetSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      teams = new GithubTeams('12345', 'foo');
+      teamsGetSpy = spyOn(teams, 'get');
+    });
+
+
+    it('should return a promise', () => {
+      expect(teams.isMemberById('user', [1])).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should resolve with false if called with an empty array', done => {
+      teams.isMemberById('user', []).then(isMember => {
+        expect(isMember).toBe(false);
+        expect(teamsGetSpy).not.toHaveBeenCalled();
+        done();
+      });
+    });
+
+
+    it('should call \'get()\' with the correct pathname', done => {
+      teamsGetSpy.and.returnValue(Promise.resolve(null));
+      teams.isMemberById('user', [1]).then(() => {
+        expect(teamsGetSpy).toHaveBeenCalledWith('/teams/1/memberships/user');
+        done();
+      });
+    });
+
+
+    it('should resolve with false if \'get()\' rejects', done => {
+      teamsGetSpy.and.returnValue(Promise.reject(null));
+      teams.isMemberById('user', [1]).then(isMember => {
+        expect(isMember).toBe(false);
+        expect(teamsGetSpy).toHaveBeenCalled();
+        done();
+      });
+    });
+
+
+    it('should resolve with false if the membership is not active', done => {
+      teamsGetSpy.and.returnValue(Promise.resolve({state: 'pending'}));
+      teams.isMemberById('user', [1]).then(isMember => {
+        expect(isMember).toBe(false);
+        expect(teamsGetSpy).toHaveBeenCalled();
+        done();
+      });
+    });
+
+
+    it('should resolve with true if the membership is active', done => {
+      teamsGetSpy.and.returnValue(Promise.resolve({state: 'active'}));
+      teams.isMemberById('user', [1]).then(isMember => {
+        expect(isMember).toBe(true);
+        done();
+      });
+    });
+
+
+    it('should sequentially call \'get()\' until an active membership is found', done => {
+      const trainedResponses: {[pathname: string]: Promise<{state: string}>} = {
+        '/teams/1/memberships/user': Promise.resolve({state: 'pending'}),
+        '/teams/2/memberships/user': Promise.reject(null),
+        '/teams/3/memberships/user': Promise.resolve({state: 'active'}),
+      };
+      teamsGetSpy.and.callFake((pathname: string) => trainedResponses[pathname]);
+
+      teams.isMemberById('user', [1, 2, 3, 4]).then(isMember => {
+        expect(isMember).toBe(true);
+
+        expect(teamsGetSpy).toHaveBeenCalledTimes(3);
+        expect(teamsGetSpy.calls.argsFor(0)[0]).toBe('/teams/1/memberships/user');
+        expect(teamsGetSpy.calls.argsFor(1)[0]).toBe('/teams/2/memberships/user');
+        expect(teamsGetSpy.calls.argsFor(2)[0]).toBe('/teams/3/memberships/user');
+
+        done();
+      });
+    });
+
+
+    it('should resolve with false if no active membership is found', done => {
+      const trainedResponses: {[pathname: string]: Promise<{state: string}>} = {
+        '/teams/1/memberships/user': Promise.resolve({state: 'pending'}),
+        '/teams/2/memberships/user':  Promise.reject(null),
+        '/teams/3/memberships/user': Promise.resolve({state: 'not active'}),
+        '/teams/4/memberships/user':  Promise.reject(null),
+      };
+      teamsGetSpy.and.callFake((pathname: string) => trainedResponses[pathname]);
+
+      teams.isMemberById('user', [1, 2, 3, 4]).then(isMember => {
+        expect(isMember).toBe(false);
+
+        expect(teamsGetSpy).toHaveBeenCalledTimes(4);
+        expect(teamsGetSpy.calls.argsFor(0)[0]).toBe('/teams/1/memberships/user');
+        expect(teamsGetSpy.calls.argsFor(1)[0]).toBe('/teams/2/memberships/user');
+        expect(teamsGetSpy.calls.argsFor(2)[0]).toBe('/teams/3/memberships/user');
+        expect(teamsGetSpy.calls.argsFor(3)[0]).toBe('/teams/4/memberships/user');
+
+        done();
+      });
+    });
+
+  });
+
+
+  describe('isMemberBySlug()', () => {
+    let teams: GithubTeams;
+    let teamsFetchAllSpy: jasmine.Spy;
+    let teamsIsMemberByIdSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      teams = new GithubTeams('12345', 'foo');
+
+      const mockResponse = Promise.resolve([{id: 1, slug: 'team1'}, {id: 2, slug: 'team2'}]);
+      teamsFetchAllSpy = spyOn(teams, 'fetchAll').and.returnValue(mockResponse);
+      teamsIsMemberByIdSpy = spyOn(teams, 'isMemberById');
+    });
+
+
+    it('should return a promise', () => {
+      expect(teams.isMemberBySlug('user', ['team-slug'])).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should call \'fetchAll()\'', () => {
+      teams.isMemberBySlug('user', ['team-slug']);
+      expect(teamsFetchAllSpy).toHaveBeenCalled();
+    });
+
+
+    it('should resolve with false if \'fetchAll()\' rejects', done => {
+      teamsFetchAllSpy.and.returnValue(Promise.reject(null));
+      teams.isMemberBySlug('user', ['team-slug']).then(isMember => {
+        expect(isMember).toBe(false);
+        done();
+      });
+    });
+
+
+    it('should call \'isMemberById()\' with the correct params if no team is found', done => {
+      teams.isMemberBySlug('user', ['no-match']).then(() => {
+        expect(teamsIsMemberByIdSpy).toHaveBeenCalledWith('user', []);
+        done();
+      });
+    });
+
+
+    it('should call \'isMemberById()\' with the correct params if teams are found', done => {
+      const spy = teamsIsMemberByIdSpy;
+
+      Promise.all([
+        teams.isMemberBySlug('user', ['team1']).then(() => expect(spy).toHaveBeenCalledWith('user', [1])),
+        teams.isMemberBySlug('user', ['team2']).then(() => expect(spy).toHaveBeenCalledWith('user', [2])),
+        teams.isMemberBySlug('user', ['team1', 'team2']).then(() => expect(spy).toHaveBeenCalledWith('user', [1, 2])),
+      ]).then(done);
+    });
+
+
+    it('should resolve with false if \'isMemberById()\' rejects', done => {
+      teamsIsMemberByIdSpy.and.returnValue(Promise.reject(null));
+      teams.isMemberBySlug('user', ['team1']).then(isMember => {
+        expect(isMember).toBe(false);
+        expect(teamsIsMemberByIdSpy).toHaveBeenCalled();
+        done();
+      });
+    });
+
+
+    it('should resolve with the value \'isMemberById()\' resolves with', done => {
+      teamsIsMemberByIdSpy.and.returnValues(Promise.resolve(false), Promise.resolve(true));
+
+      Promise.all([
+        teams.isMemberBySlug('user', ['team1']).then(isMember => expect(isMember).toBe(false)),
+        teams.isMemberBySlug('user', ['team1']).then(isMember => expect(isMember).toBe(true)),
+      ]).then(() => {
+        expect(teamsIsMemberByIdSpy).toHaveBeenCalledTimes(2);
+        done();
+      });
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/common/utils.spec.ts

@@ -0,0 +1,81 @@
+// Imports
+import {assertNotMissingOrEmpty, getEnvVar} from '../../lib/common/utils';
+
+// Tests
+describe('utils', () => {
+
+  describe('assertNotMissingOrEmpty()', () => {
+
+    it('should throw if passed an empty value', () => {
+      expect(() => assertNotMissingOrEmpty('foo', undefined)).
+        toThrowError('Missing or empty required parameter \'foo\'!');
+      expect(() => assertNotMissingOrEmpty('bar', null)).toThrowError('Missing or empty required parameter \'bar\'!');
+      expect(() => assertNotMissingOrEmpty('baz', '')).toThrowError('Missing or empty required parameter \'baz\'!');
+    });
+
+
+    it('should not throw if passed a non-empty value', () => {
+      expect(() => assertNotMissingOrEmpty('foo', ' ')).not.toThrow();
+      expect(() => assertNotMissingOrEmpty('bar', 'bar')).not.toThrow();
+      expect(() => assertNotMissingOrEmpty('baz', 'b a z')).not.toThrow();
+    });
+
+  });
+
+
+  describe('getEnvVar()', () => {
+    const emptyVar = '$$test_utils_getEnvVar_empty$$';
+    const nonEmptyVar = '$$test_utils_getEnvVar_nonEmpty$$';
+    const undefinedVar = '$$test_utils_getEnvVar_undefined$$';
+
+    beforeEach(() => {
+      process.env[emptyVar] = '';
+      process.env[nonEmptyVar] = 'foo';
+    });
+    afterEach(() => {
+      delete process.env[emptyVar];
+      delete process.env[nonEmptyVar];
+    });
+
+
+    it('should return an environment variable', () => {
+      expect(getEnvVar(nonEmptyVar)).toBe('foo');
+    });
+
+
+    it('should exit with an error if the environment variable is not defined', () => {
+      const consoleErrorSpy = spyOn(console, 'error');
+      const processExitSpy = spyOn(process, 'exit');
+
+      getEnvVar(undefinedVar);
+
+      expect(consoleErrorSpy).toHaveBeenCalled();
+      expect(consoleErrorSpy.calls.argsFor(0)[0]).toContain(undefinedVar);
+      expect(processExitSpy).toHaveBeenCalledWith(1);
+    });
+
+
+    it('should exit with an error if the environment variable is empty', () => {
+      const consoleErrorSpy = spyOn(console, 'error');
+      const processExitSpy = spyOn(process, 'exit');
+
+      getEnvVar(emptyVar);
+
+      expect(consoleErrorSpy).toHaveBeenCalled();
+      expect(consoleErrorSpy.calls.argsFor(0)[0]).toContain(emptyVar);
+      expect(processExitSpy).toHaveBeenCalledWith(1);
+    });
+
+
+    it('should return an empty string if an undefined variable is optional', () => {
+      expect(getEnvVar(undefinedVar, true)).toBe('');
+    });
+
+
+    it('should return an empty string if an empty variable is optional', () => {
+      expect(getEnvVar(emptyVar, true)).toBe('');
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/helpers.ts

@@ -0,0 +1,6 @@
+declare namespace jasmine {
+  export interface DoneFn extends Function {
+    (): void;
+    fail: (message: Error | string) => void;
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-js/test/index.ts

@@ -0,0 +1,7 @@
+// Imports
+import {runTests} from '../lib/common/run-tests';
+
+// Run
+const specFiles = [`${__dirname}/**/*.spec.js`];
+const helpers = [`${__dirname}/helpers.js`];
+runTests(specFiles, helpers);

aio/aio-builds-setup/dockerbuild/scripts-js/test/upload-server/build-creator.spec.ts

@@ -0,0 +1,320 @@
+// Imports
+import * as cp from 'child_process';
+import {EventEmitter} from 'events';
+import * as fs from 'fs';
+import * as shell from 'shelljs';
+import {BuildCreator} from '../../lib/upload-server/build-creator';
+import {CreatedBuildEvent} from '../../lib/upload-server/build-events';
+import {UploadError} from '../../lib/upload-server/upload-error';
+import {expectToBeUploadError} from './helpers';
+
+// Tests
+describe('BuildCreator', () => {
+  const pr = '9';
+  const sha = '9'.repeat(40);
+  const archive = 'snapshot.tar.gz';
+  const buildsDir = 'builds/dir';
+  const prDir = `${buildsDir}/${pr}`;
+  const shaDir = `${prDir}/${sha}`;
+  let bc: BuildCreator;
+
+  beforeEach(() => bc = new BuildCreator(buildsDir));
+
+
+  describe('constructor()', () => {
+
+    it('should throw if \'buildsDir\' is missing or empty', () => {
+      expect(() => new BuildCreator('')).toThrowError('Missing or empty required parameter \'buildsDir\'!');
+    });
+
+
+    it('should extend EventEmitter', () => {
+      expect(bc).toEqual(jasmine.any(BuildCreator));
+      expect(bc).toEqual(jasmine.any(EventEmitter));
+
+      expect(Object.getPrototypeOf(bc)).toBe(BuildCreator.prototype);
+    });
+
+  });
+
+
+  describe('create()', () => {
+    let bcEmitSpy: jasmine.Spy;
+    let bcExistsSpy: jasmine.Spy;
+    let bcExtractArchiveSpy: jasmine.Spy;
+    let shellMkdirSpy: jasmine.Spy;
+    let shellRmSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      bcEmitSpy = spyOn(bc, 'emit');
+      bcExistsSpy = spyOn(bc as any, 'exists');
+      bcExtractArchiveSpy = spyOn(bc as any, 'extractArchive');
+      shellMkdirSpy = spyOn(shell, 'mkdir');
+      shellRmSpy = spyOn(shell, 'rm');
+    });
+
+
+    it('should return a promise', done => {
+      const promise = bc.create(pr, sha, archive);
+      promise.then(done);   // Do not complete the test (and release the spies) synchronously
+                            // to avoid running the actual `extractArchive()`.
+
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should throw if the build does already exist', done => {
+      bcExistsSpy.and.returnValue(true);
+      bc.create(pr, sha, archive).catch(err => {
+        expectToBeUploadError(err, 409, `Request to overwrite existing directory: ${shaDir}`);
+        done();
+      });
+    });
+
+
+    it('should create the build directory (and any parent directories)', done => {
+      bc.create(pr, sha, archive).
+        then(() => expect(shellMkdirSpy).toHaveBeenCalledWith('-p', shaDir)).
+        then(done);
+    });
+
+
+    it('should extract the archive contents into the build directory', done => {
+      bc.create(pr, sha, archive).
+        then(() => expect(bcExtractArchiveSpy).toHaveBeenCalledWith(archive, shaDir)).
+        then(done);
+    });
+
+
+    it('should emit a CreatedBuildEvent on success', done => {
+      let emitted = false;
+
+      bcEmitSpy.and.callFake((type: string, evt: CreatedBuildEvent) => {
+        expect(type).toBe(CreatedBuildEvent.type);
+        expect(evt).toEqual(jasmine.any(CreatedBuildEvent));
+        expect(evt.pr).toBe(+pr);
+        expect(evt.sha).toBe(sha);
+
+        emitted = true;
+      });
+
+      bc.create(pr, sha, archive).
+        then(() => expect(emitted).toBe(true)).
+        then(done);
+    });
+
+
+    describe('on error', () => {
+
+      it('should abort and skip further operations if it fails to create the directories', done => {
+        shellMkdirSpy.and.throwError('');
+        bc.create(pr, sha, archive).catch(() => {
+          expect(shellMkdirSpy).toHaveBeenCalled();
+          expect(bcExtractArchiveSpy).not.toHaveBeenCalled();
+          expect(bcEmitSpy).not.toHaveBeenCalled();
+          done();
+        });
+      });
+
+
+      it('should abort and skip further operations if it fails to extract the archive', done => {
+        bcExtractArchiveSpy.and.throwError('');
+        bc.create(pr, sha, archive).catch(() => {
+          expect(shellMkdirSpy).toHaveBeenCalled();
+          expect(bcExtractArchiveSpy).toHaveBeenCalled();
+          expect(bcEmitSpy).not.toHaveBeenCalled();
+          done();
+        });
+      });
+
+
+      it('should delete the PR directory (for new PR)', done => {
+        bcExtractArchiveSpy.and.throwError('');
+        bc.create(pr, sha, archive).catch(() => {
+          expect(shellRmSpy).toHaveBeenCalledWith('-rf', prDir);
+          done();
+        });
+      });
+
+
+      it('should delete the SHA directory (for existing PR)', done => {
+        bcExistsSpy.and.callFake((path: string) => path !== shaDir);
+        bcExtractArchiveSpy.and.throwError('');
+
+        bc.create(pr, sha, archive).catch(() => {
+          expect(shellRmSpy).toHaveBeenCalledWith('-rf', shaDir);
+          done();
+        });
+      });
+
+
+      it('should reject with an UploadError', done => {
+        shellMkdirSpy.and.callFake(() => {throw 'Test'; });
+        bc.create(pr, sha, archive).catch(err => {
+          expectToBeUploadError(err, 500, `Error while uploading to directory: ${shaDir}\nTest`);
+          done();
+        });
+      });
+
+
+      it('should pass UploadError instances unmodified', done => {
+        shellMkdirSpy.and.callFake(() => { throw new UploadError(543, 'Test'); });
+        bc.create(pr, sha, archive).catch(err => {
+          expectToBeUploadError(err, 543, 'Test');
+          done();
+        });
+      });
+
+    });
+
+  });
+
+
+  // Protected methods
+
+  describe('exists()', () => {
+    let fsAccessSpy: jasmine.Spy;
+    let fsAccessCbs: Function[];
+
+    beforeEach(() => {
+      fsAccessCbs = [];
+      fsAccessSpy = spyOn(fs, 'access').and.callFake((_: string, cb: Function) => fsAccessCbs.push(cb));
+    });
+
+
+    it('should return a promise', () => {
+      expect((bc as any).exists('foo')).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should call \'fs.access()\' with the specified argument', () => {
+      (bc as any).exists('foo');
+      expect(fs.access).toHaveBeenCalledWith('foo', jasmine.any(Function));
+    });
+
+
+    it('should resolve with \'true\' if \'fs.access()\' succeeds', done => {
+      Promise.
+        all([(bc as any).exists('foo'), (bc as any).exists('bar')]).
+        then(results => expect(results).toEqual([true, true])).
+        then(done);
+
+      fsAccessCbs[0]();
+      fsAccessCbs[1](null);
+    });
+
+
+    it('should resolve with \'false\' if \'fs.access()\' errors', done => {
+      Promise.
+        all([(bc as any).exists('foo'), (bc as any).exists('bar')]).
+        then(results => expect(results).toEqual([false, false])).
+        then(done);
+
+      fsAccessCbs[0]('Error');
+      fsAccessCbs[1](new Error());
+    });
+
+  });
+
+
+  describe('extractArchive()', () => {
+    let consoleWarnSpy: jasmine.Spy;
+    let shellChmodSpy: jasmine.Spy;
+    let shellRmSpy: jasmine.Spy;
+    let cpExecSpy: jasmine.Spy;
+    let cpExecCbs: Function[];
+
+    beforeEach(() => {
+      cpExecCbs = [];
+
+      consoleWarnSpy = spyOn(console, 'warn');
+      shellChmodSpy = spyOn(shell, 'chmod');
+      shellRmSpy = spyOn(shell, 'rm');
+      cpExecSpy = spyOn(cp, 'exec').and.callFake((_: string, cb: Function) => cpExecCbs.push(cb));
+    });
+
+
+    it('should return a promise', () => {
+      expect((bc as any).extractArchive('foo', 'bar')).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should "gunzip" and "untar" the input file into the output directory', () => {
+      const cmd = 'tar --extract --gzip --directory "output/dir" --file "input/file"';
+
+      (bc as any).extractArchive('input/file', 'output/dir');
+      expect(cpExecSpy).toHaveBeenCalledWith(cmd, jasmine.any(Function));
+    });
+
+
+    it('should log (as a warning) any stderr output if extracting succeeded', done => {
+      (bc as any).extractArchive('foo', 'bar').
+        then(() => expect(consoleWarnSpy).toHaveBeenCalledWith('This is stderr')).
+        then(done);
+
+      cpExecCbs[0](null, 'This is stdout', 'This is stderr');
+    });
+
+
+    it('should make the build directory non-writable', done => {
+      (bc as any).extractArchive('foo', 'bar').
+        then(() => expect(shellChmodSpy).toHaveBeenCalledWith('-R', 'a-w', 'bar')).
+        then(done);
+
+      cpExecCbs[0]();
+    });
+
+
+    it('should delete the uploaded file on success', done => {
+      (bc as any).extractArchive('input/file', 'output/dir').
+        then(() => expect(shellRmSpy).toHaveBeenCalledWith('-f', 'input/file')).
+        then(done);
+
+      cpExecCbs[0]();
+    });
+
+
+    describe('on error', () => {
+
+      it('should abort and skip further operations if it fails to extract the archive', done => {
+        (bc as any).extractArchive('foo', 'bar').catch((err: any) => {
+          expect(shellChmodSpy).not.toHaveBeenCalled();
+          expect(shellRmSpy).not.toHaveBeenCalled();
+          expect(err).toBe('Test');
+          done();
+        });
+
+        cpExecCbs[0]('Test');
+      });
+
+
+      it('should abort and skip further operations if it fails to make non-writable', done => {
+        (bc as any).extractArchive('foo', 'bar').catch((err: any) => {
+          expect(shellChmodSpy).toHaveBeenCalled();
+          expect(shellRmSpy).not.toHaveBeenCalled();
+          expect(err).toBe('Test');
+          done();
+        });
+
+        shellChmodSpy.and.callFake(() => { throw 'Test'; });
+        cpExecCbs[0]();
+      });
+
+
+      it('should abort and reject if it fails to remove the uploaded file', done => {
+        (bc as any).extractArchive('foo', 'bar').catch((err: any) => {
+          expect(shellChmodSpy).toHaveBeenCalled();
+          expect(shellRmSpy).toHaveBeenCalled();
+          expect(err).toBe('Test');
+          done();
+        });
+
+        shellRmSpy.and.callFake(() => { throw 'Test'; });
+        cpExecCbs[0]();
+      });
+
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/upload-server/build-events.spec.ts

@@ -0,0 +1,61 @@
+// Imports
+import {BuildEvent, CreatedBuildEvent} from '../../lib/upload-server/build-events';
+
+// Tests
+describe('BuildEvent', () => {
+  let evt: BuildEvent;
+
+  beforeEach(() => evt = new BuildEvent('foo', 42, 'bar'));
+
+
+  it('should have a \'type\' property', () => {
+    expect(evt.type).toBe('foo');
+  });
+
+
+  it('should have a \'pr\' property', () => {
+    expect(evt.pr).toBe(42);
+  });
+
+
+  it('should have a \'sha\' property', () => {
+    expect(evt.sha).toBe('bar');
+  });
+
+});
+
+
+describe('CreatedBuildEvent', () => {
+  let evt: CreatedBuildEvent;
+
+  beforeEach(() => evt = new CreatedBuildEvent(42, 'bar'));
+
+
+  it('should have a static \'type\' property', () => {
+    expect(CreatedBuildEvent.type).toBe('build.created');
+  });
+
+
+  it('should extend BuildEvent', () => {
+    expect(evt).toEqual(jasmine.any(CreatedBuildEvent));
+    expect(evt).toEqual(jasmine.any(BuildEvent));
+
+    expect(Object.getPrototypeOf(evt)).toBe(CreatedBuildEvent.prototype);
+  });
+
+
+  it('should automatically set the \'type\'', () => {
+    expect(evt.type).toBe(CreatedBuildEvent.type);
+  });
+
+
+  it('should have a \'pr\' property', () => {
+    expect(evt.pr).toBe(42);
+  });
+
+
+  it('should have a \'sha\' property', () => {
+    expect(evt.sha).toBe('bar');
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/upload-server/build-verifier.spec.ts

@@ -0,0 +1,261 @@
+// Imports
+import * as jwt from 'jsonwebtoken';
+import {GithubPullRequests} from '../../lib/common/github-pull-requests';
+import {GithubTeams} from '../../lib/common/github-teams';
+import {BuildVerifier} from '../../lib/upload-server/build-verifier';
+import {expectToBeUploadError} from './helpers';
+
+// Tests
+describe('BuildVerifier', () => {
+  const defaultConfig = {
+    allowedTeamSlugs: ['team1', 'team2'],
+    githubToken: 'githubToken',
+    organization: 'organization',
+    repoSlug: 'repo/slug',
+    secret: 'secret',
+  };
+  let bv: BuildVerifier;
+
+  // Helpers
+  const createBuildVerifier = (partialConfig: Partial<typeof defaultConfig> = {}) => {
+    const cfg = {...defaultConfig, ...partialConfig};
+    return new BuildVerifier(cfg.secret, cfg.githubToken, cfg.repoSlug, cfg.organization,
+                             cfg.allowedTeamSlugs);
+  };
+
+  beforeEach(() => bv = createBuildVerifier());
+
+
+  describe('constructor()', () => {
+
+    ['secret', 'githubToken', 'repoSlug', 'organization', 'allowedTeamSlugs'].forEach(param => {
+      it(`should throw if '${param}' is missing or empty`, () => {
+        expect(() => createBuildVerifier({[param]: ''})).
+          toThrowError(`Missing or empty required parameter '${param}'!`);
+      });
+    });
+
+
+    it('should throw if \'allowedTeamSlugs\' is an empty array', () => {
+      expect(() => createBuildVerifier({allowedTeamSlugs: []})).
+        toThrowError('Missing or empty required parameter \'allowedTeamSlugs\'!');
+    });
+
+  });
+
+
+  describe('verify()', () => {
+    const pr = 9;
+    const defaultJwt = {
+      'exp': Math.floor(Date.now() / 1000) + 30,
+      'iat': Math.floor(Date.now() / 1000) - 30,
+      'iss': 'Travis CI, GmbH',
+      'pull-request': pr,
+      'slug': defaultConfig.repoSlug,
+    };
+    let bvGetPrAuthorTeamMembership: jasmine.Spy;
+
+    // Heleprs
+    const createAuthHeader = (partialJwt: Partial<typeof defaultJwt> = {}, secret: string = defaultConfig.secret) =>
+      `Token ${jwt.sign({...defaultJwt, ...partialJwt}, secret)}`;
+
+    beforeEach(() => {
+      bvGetPrAuthorTeamMembership = spyOn(bv, 'getPrAuthorTeamMembership').
+        and.returnValue(Promise.resolve({author: 'some-author', isMember: true}));
+    });
+
+
+    it('should return a promise', done => {
+      const promise = bv.verify(pr, createAuthHeader());
+      promise.then(done);   // Do not complete the test (and release the spies) synchronously
+                            // to avoid running the actual `bvGetPrAuthorTeamMembership()`.
+
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should fail if the authorization header is invalid', done => {
+      bv.verify(pr, 'foo').catch(err => {
+        const errorMessage = 'Error while verifying upload for PR 9: jwt malformed';
+
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should fail if the secret is invalid', done => {
+      bv.verify(pr, createAuthHeader({}, 'foo')).catch(err => {
+        const errorMessage = 'Error while verifying upload for PR 9: invalid signature';
+
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should fail if the issuer is invalid', done => {
+      bv.verify(pr, createAuthHeader({iss: 'not valid'})).catch(err => {
+        const errorMessage = 'Error while verifying upload for PR 9: ' +
+                             `jwt issuer invalid. expected: ${defaultJwt.iss}`;
+
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should fail if the token has expired', done => {
+      bv.verify(pr, createAuthHeader({exp: 0})).catch(err => {
+        const errorMessage = 'Error while verifying upload for PR 9: jwt expired';
+
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should fail if the repo slug does not match', done => {
+      bv.verify(pr, createAuthHeader({slug: 'foo/bar'})).catch(err => {
+        const errorMessage = 'Error while verifying upload for PR 9: ' +
+                             `jwt slug invalid. expected: ${defaultConfig.repoSlug}`;
+
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should fail if the PR does not match', done => {
+      bv.verify(pr, createAuthHeader({'pull-request': 1337})).catch(err => {
+        const errorMessage = 'Error while verifying upload for PR 9: ' +
+                             `jwt pull-request invalid. expected: ${pr}`;
+
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should not fail if the token is valid', done => {
+      bv.verify(pr, createAuthHeader()).then(done);
+    });
+
+
+    it('should not fail even if the token has been issued in the future', done => {
+      const in30s = Math.floor(Date.now() / 1000) + 30;
+      bv.verify(pr, createAuthHeader({iat: in30s})).then(done);
+    });
+
+
+    it('should call \'getPrAuthorTeamMembership()\' if the token is valid', done => {
+      bv.verify(pr, createAuthHeader()).then(() => {
+        expect(bvGetPrAuthorTeamMembership).toHaveBeenCalledWith(pr);
+        done();
+      });
+    });
+
+
+    it('should fail if \'getPrAuthorTeamMembership()\' rejects', done => {
+      bvGetPrAuthorTeamMembership.and.callFake(() => Promise.reject('Test'));
+      bv.verify(pr, createAuthHeader()).catch(err => {
+        expectToBeUploadError(err, 403, `Error while verifying upload for PR ${pr}: Test`);
+        done();
+      });
+    });
+
+
+    it('should fail if \'getPrAuthorTeamMembership()\' reports no membership', done => {
+      const errorMessage = `Error while verifying upload for PR ${pr}: User 'test' is not an active member of any of ` +
+                           'the following teams: team1, team2';
+
+      bvGetPrAuthorTeamMembership.and.returnValue(Promise.resolve({author: 'test', isMember: false}));
+      bv.verify(pr, createAuthHeader()).catch(err => {
+        expectToBeUploadError(err, 403, errorMessage);
+        done();
+      });
+    });
+
+
+    it('should succeed if everything checks outs', done => {
+      bv.verify(pr, createAuthHeader()).then(done);
+    });
+
+  });
+
+
+  describe('getPrAuthorTeamMembership()', () => {
+    const pr = 9;
+    let prsFetchSpy: jasmine.Spy;
+    let teamsIsMemberBySlugSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      prsFetchSpy = spyOn(GithubPullRequests.prototype, 'fetch').
+        and.returnValue(Promise.resolve({user: {login: 'username'}}));
+
+      teamsIsMemberBySlugSpy = spyOn(GithubTeams.prototype, 'isMemberBySlug').
+        and.returnValue(Promise.resolve(true));
+    });
+
+
+    it('should return a promise', done => {
+      const promise = bv.getPrAuthorTeamMembership(pr);
+      promise.then(done);   // Do not complete the test (and release the spies) synchronously
+                            // to avoid running the actual `GithubTeams#isMemberBySlug()`.
+
+      expect(promise).toEqual(jasmine.any(Promise));
+    });
+
+
+    it('should fetch the corresponding PR', done => {
+      bv.getPrAuthorTeamMembership(pr).then(() => {
+        expect(prsFetchSpy).toHaveBeenCalledWith(pr);
+        done();
+      });
+    });
+
+
+    it('should fail if fetching the PR errors', done => {
+      prsFetchSpy.and.callFake(() => Promise.reject('Test'));
+      bv.getPrAuthorTeamMembership(pr).catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+    });
+
+
+    it('should verify the PR author\'s membership in the specified teams', done => {
+      bv.getPrAuthorTeamMembership(pr).then(() => {
+        expect(teamsIsMemberBySlugSpy).toHaveBeenCalledWith('username', ['team1', 'team2']);
+        done();
+      });
+    });
+
+
+    it('should fail if verifying membership errors', done => {
+      teamsIsMemberBySlugSpy.and.callFake(() => Promise.reject('Test'));
+      bv.getPrAuthorTeamMembership(pr).catch(err => {
+        expect(err).toBe('Test');
+        done();
+      });
+    });
+
+
+    it('should return the PR\'s author and whether they are members', done => {
+      teamsIsMemberBySlugSpy.and.returnValues(Promise.resolve(true), Promise.resolve(false));
+
+      Promise.all([
+        bv.getPrAuthorTeamMembership(pr).then(({author, isMember}) => {
+          expect(author).toBe('username');
+          expect(isMember).toBe(true);
+        }),
+        bv.getPrAuthorTeamMembership(pr).then(({author, isMember}) => {
+          expect(author).toBe('username');
+          expect(isMember).toBe(false);
+        }),
+      ]).then(done);
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/upload-server/helpers.ts

@@ -0,0 +1,11 @@
+import {UploadError} from '../../lib/upload-server/upload-error';
+
+export const expectToBeUploadError = (actual: UploadError, status?: number, message?: string) => {
+  expect(actual).toEqual(jasmine.any(UploadError));
+  if (status != null) {
+    expect(actual.status).toBe(status);
+  }
+  if (message != null) {
+    expect(actual.message).toBe(message);
+  }
+};

aio/aio-builds-setup/dockerbuild/scripts-js/test/upload-server/upload-error.spec.ts

@@ -0,0 +1,39 @@
+// Imports
+import {UploadError} from '../../lib/upload-server/upload-error';
+
+// Tests
+describe('UploadError', () => {
+  let err: UploadError;
+
+  beforeEach(() => err = new UploadError(999, 'message'));
+
+
+  it('should extend Error', () => {
+    expect(err).toEqual(jasmine.any(UploadError));
+    expect(err).toEqual(jasmine.any(Error));
+
+    expect(Object.getPrototypeOf(err)).toBe(UploadError.prototype);
+  });
+
+
+  it('should have a \'status\' property', () => {
+    expect(err.status).toBe(999);
+  });
+
+
+  it('should have a \'message\' property', () => {
+    expect(err.message).toBe('message');
+  });
+
+
+  it('should have a 500 \'status\' by default', () => {
+    expect(new UploadError().status).toBe(500);
+  });
+
+
+  it('should have an empty \'message\' by default', () => {
+    expect(new UploadError().message).toBe('');
+    expect(new UploadError(999).message).toBe('');
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/test/upload-server/upload-server-factory.spec.ts

@@ -0,0 +1,403 @@
+// Imports
+import * as express from 'express';
+import * as http from 'http';
+import * as supertest from 'supertest';
+import {GithubPullRequests} from '../../lib/common/github-pull-requests';
+import {BuildCreator} from '../../lib/upload-server/build-creator';
+import {CreatedBuildEvent} from '../../lib/upload-server/build-events';
+import {BuildVerifier} from '../../lib/upload-server/build-verifier';
+import {uploadServerFactory as usf} from '../../lib/upload-server/upload-server-factory';
+
+// Tests
+describe('uploadServerFactory', () => {
+  const defaultConfig = {
+    buildsDir: 'builds/dir',
+    domainName: 'domain.name',
+    githubOrganization: 'organization',
+    githubTeamSlugs: ['team1', 'team2'],
+    githubToken: '12345',
+    repoSlug: 'repo/slug',
+    secret: 'secret',
+  };
+
+  // Helpers
+  const createUploadServer = (partialConfig: Partial<typeof defaultConfig> = {}) =>
+    usf.create({...defaultConfig, ...partialConfig});
+
+
+  describe('create()', () => {
+    let usfCreateMiddlewareSpy: jasmine.Spy;
+
+    beforeEach(() => {
+      usfCreateMiddlewareSpy = spyOn(usf as any, 'createMiddleware').and.callThrough();
+    });
+
+
+    it('should throw if \'buildsDir\' is missing or empty', () => {
+      expect(() => createUploadServer({buildsDir: ''})).
+        toThrowError('Missing or empty required parameter \'buildsDir\'!');
+    });
+
+
+    it('should throw if \'domainName\' is missing or empty', () => {
+      expect(() => createUploadServer({domainName: ''})).
+        toThrowError('Missing or empty required parameter \'domainName\'!');
+    });
+
+
+    it('should throw if \'githubToken\' is missing or empty', () => {
+      expect(() => createUploadServer({githubToken: ''})).
+        toThrowError('Missing or empty required parameter \'githubToken\'!');
+    });
+
+
+    it('should throw if \'githubOrganization\' is missing or empty', () => {
+      expect(() => createUploadServer({githubOrganization: ''})).
+        toThrowError('Missing or empty required parameter \'organization\'!');
+    });
+
+
+    it('should throw if \'githubTeamSlugs\' is missing or empty', () => {
+      expect(() => createUploadServer({githubTeamSlugs: []})).
+        toThrowError('Missing or empty required parameter \'allowedTeamSlugs\'!');
+    });
+
+
+    it('should throw if \'repoSlug\' is missing or empty', () => {
+      expect(() => createUploadServer({repoSlug: ''})).
+        toThrowError('Missing or empty required parameter \'repoSlug\'!');
+    });
+
+
+    it('should throw if \'secret\' is missing or empty', () => {
+      expect(() => createUploadServer({secret: ''})).
+        toThrowError('Missing or empty required parameter \'secret\'!');
+    });
+
+
+    it('should return an http.Server', () => {
+      const httpCreateServerSpy = spyOn(http, 'createServer').and.callThrough();
+      const server = createUploadServer();
+
+      expect(server).toBe(httpCreateServerSpy.calls.mostRecent().returnValue);
+    });
+
+
+    it('should create and use an appropriate BuildCreator', () => {
+      const usfCreateBuildCreatorSpy = spyOn(usf as any, 'createBuildCreator').and.callThrough();
+
+      createUploadServer();
+      const buildCreator: BuildCreator = usfCreateBuildCreatorSpy.calls.mostRecent().returnValue;
+
+      expect(usfCreateMiddlewareSpy).toHaveBeenCalledWith(jasmine.any(BuildVerifier), buildCreator);
+      expect(usfCreateBuildCreatorSpy).toHaveBeenCalledWith('builds/dir', '12345', 'repo/slug', 'domain.name');
+    });
+
+
+    it('should create and use an appropriate middleware', () => {
+      const httpCreateServerSpy = spyOn(http, 'createServer').and.callThrough();
+
+      createUploadServer();
+      const middleware: express.Express = usfCreateMiddlewareSpy.calls.mostRecent().returnValue;
+      const buildVerifier = jasmine.any(BuildVerifier);
+      const buildCreator = jasmine.any(BuildCreator);
+
+      expect(httpCreateServerSpy).toHaveBeenCalledWith(middleware);
+      expect(usfCreateMiddlewareSpy).toHaveBeenCalledWith(buildVerifier, buildCreator);
+    });
+
+
+    it('should log the server address info on \'listening\'', () => {
+      const consoleInfoSpy = spyOn(console, 'info');
+      const server = createUploadServer('builds/dir');
+      server.address = () => ({address: 'foo', family: '', port: 1337});
+
+      expect(consoleInfoSpy).not.toHaveBeenCalled();
+
+      server.emit('listening');
+      expect(consoleInfoSpy).toHaveBeenCalledWith('Up and running (and listening on foo:1337)...');
+    });
+
+  });
+
+
+  // Protected methods
+
+  describe('createBuildCreator()', () => {
+    let buildCreator: BuildCreator;
+
+    beforeEach(() => {
+      buildCreator = (usf as any).createBuildCreator(
+        defaultConfig.buildsDir,
+        defaultConfig.githubToken,
+        defaultConfig.repoSlug,
+        defaultConfig.domainName,
+      );
+    });
+
+
+    it('should pass the \'buildsDir\' to the BuildCreator', () => {
+      expect((buildCreator as any).buildsDir).toBe('builds/dir');
+    });
+
+
+    it('should post a comment on GitHub on \'build.created\'', () => {
+      const prsAddCommentSpy = spyOn(GithubPullRequests.prototype, 'addComment');
+      const commentBody = 'The angular.io preview for 1234567890 is available [here][1].\n\n' +
+                          '[1]: https://pr42-1234567890.domain.name/';
+
+      buildCreator.emit(CreatedBuildEvent.type, {pr: 42, sha: '1234567890'});
+
+      expect(prsAddCommentSpy).toHaveBeenCalledWith(42, commentBody);
+    });
+
+
+    it('should pass the correct \'githubToken\' and \'repoSlug\' to GithubPullRequests', () => {
+      const prsAddCommentSpy = spyOn(GithubPullRequests.prototype, 'addComment');
+
+      buildCreator.emit(CreatedBuildEvent.type, {pr: 42, sha: '1234567890'});
+      const prs = prsAddCommentSpy.calls.mostRecent().object;
+
+      expect(prs).toEqual(jasmine.any(GithubPullRequests));
+      expect((prs as any).repoSlug).toBe('repo/slug');
+      expect((prs as any).requestHeaders.Authorization).toContain('12345');
+    });
+
+  });
+
+
+  describe('createMiddleware()', () => {
+    let buildVerifier: BuildVerifier;
+    let buildCreator: BuildCreator;
+    let agent: supertest.SuperTest<supertest.Test>;
+
+    // Helpers
+    const promisifyRequest = (req: supertest.Request) =>
+      new Promise((resolve, reject) => req.end(err => err ? reject(err) : resolve()));
+    const verifyRequests = (reqs: supertest.Request[], done: jasmine.DoneFn) =>
+      Promise.all(reqs.map(promisifyRequest)).then(done, done.fail);
+
+    beforeEach(() => {
+      buildVerifier = new BuildVerifier(
+        defaultConfig.secret,
+        defaultConfig.githubToken,
+        defaultConfig.repoSlug,
+        defaultConfig.githubOrganization,
+        defaultConfig.githubTeamSlugs,
+      );
+      buildCreator = new BuildCreator(defaultConfig.buildsDir);
+      agent = supertest.agent((usf as any).createMiddleware(buildVerifier, buildCreator));
+
+      spyOn(console, 'error');
+    });
+
+
+    describe('GET /create-build/<pr>/<sha>', () => {
+      const pr = '9';
+      const sha = '9'.repeat(40);
+      let buildVerifierVerifySpy: jasmine.Spy;
+      let buildCreatorCreateSpy: jasmine.Spy;
+
+      beforeEach(() => {
+        buildVerifierVerifySpy = spyOn(buildVerifier, 'verify').and.returnValue(Promise.resolve());
+        buildCreatorCreateSpy = spyOn(buildCreator, 'create').and.returnValue(Promise.resolve());
+      });
+
+
+      it('should respond with 405 for non-GET requests', done => {
+        verifyRequests([
+          agent.put(`/create-build/${pr}/${sha}`).expect(405),
+          agent.post(`/create-build/${pr}/${sha}`).expect(405),
+          agent.patch(`/create-build/${pr}/${sha}`).expect(405),
+          agent.delete(`/create-build/${pr}/${sha}`).expect(405),
+        ], done);
+      });
+
+
+      it('should respond with 401 for requests without an \'AUTHORIZATION\' header', done => {
+        const url = `/create-build/${pr}/${sha}`;
+        const responseBody = `Missing or empty 'AUTHORIZATION' header in request: GET ${url}`;
+
+        verifyRequests([
+          agent.get(url).expect(401, responseBody),
+          agent.get(url).set('AUTHORIZATION', '').expect(401, responseBody),
+        ], done);
+      });
+
+
+      it('should respond with 400 for requests without an \'X-FILE\' header', done => {
+        const url = `/create-build/${pr}/${sha}`;
+        const responseBody = `Missing or empty 'X-FILE' header in request: GET ${url}`;
+
+        const request1 = agent.get(url).set('AUTHORIZATION', 'foo');
+        const request2 = agent.get(url).set('AUTHORIZATION', 'foo').set('X-FILE', '');
+
+        verifyRequests([
+          request1.expect(400, responseBody),
+          request2.expect(400, responseBody),
+        ], done);
+      });
+
+
+      it('should respond with 404 for unknown paths', done => {
+        verifyRequests([
+          agent.get(`/foo/create-build/${pr}/${sha}`).expect(404),
+          agent.get(`/foo-create-build/${pr}/${sha}`).expect(404),
+          agent.get(`/fooncreate-build/${pr}/${sha}`).expect(404),
+          agent.get(`/create-build/foo/${pr}/${sha}`).expect(404),
+          agent.get(`/create-build-foo/${pr}/${sha}`).expect(404),
+          agent.get(`/create-buildnfoo/${pr}/${sha}`).expect(404),
+          agent.get(`/create-build/pr${pr}/${sha}`).expect(404),
+          agent.get(`/create-build/${pr}/${sha}42`).expect(404),
+        ], done);
+      });
+
+
+      it('should call \'BuildVerifier#verify()\' with the correct arguments', done => {
+        const req = agent.
+          get(`/create-build/${pr}/${sha}`).
+          set('AUTHORIZATION', 'foo').
+          set('X-FILE', 'bar');
+
+        promisifyRequest(req).
+          then(() => expect(buildVerifierVerifySpy).toHaveBeenCalledWith(9, 'foo')).
+          then(done, done.fail);
+      });
+
+
+      it('should propagate errors from BuildVerifier', done => {
+        buildVerifierVerifySpy.and.callFake(() => Promise.reject('Test'));
+
+        const req = agent.
+          get(`/create-build/${pr}/${sha}`).
+          set('AUTHORIZATION', 'foo').
+          set('X-FILE', 'bar').
+          expect(500, 'Test');
+
+        promisifyRequest(req).
+          then(() => {
+            expect(buildVerifierVerifySpy).toHaveBeenCalledWith(9, 'foo');
+            expect(buildCreatorCreateSpy).not.toHaveBeenCalled();
+          }).
+          then(done, done.fail);
+      });
+
+
+      it('should call \'BuildCreator#create()\' with the correct arguments', done => {
+        const req = agent.
+          get(`/create-build/${pr}/${sha}`).
+          set('AUTHORIZATION', 'foo').
+          set('X-FILE', 'bar');
+
+        promisifyRequest(req).
+          then(() => expect(buildCreatorCreateSpy).toHaveBeenCalledWith(pr, sha, 'bar')).
+          then(done, done.fail);
+      });
+
+
+      it('should propagate errors from BuildCreator', done => {
+        buildCreatorCreateSpy.and.callFake(() => Promise.reject('Test'));
+        const req = agent.
+          get(`/create-build/${pr}/${sha}`).
+          set('AUTHORIZATION', 'foo').
+          set('X-FILE', 'bar').
+          expect(500, 'Test');
+
+        verifyRequests([req], done);
+      });
+
+
+      it('should respond with 201 on successful upload', done => {
+        const req = agent.
+          get(`/create-build/${pr}/${sha}`).
+          set('AUTHORIZATION', 'foo').
+          set('X-FILE', 'bar').
+          expect(201, http.STATUS_CODES[201]);
+
+        verifyRequests([req], done);
+      });
+
+
+      it('should reject PRs with leading zeros', done => {
+        verifyRequests([agent.get(`/create-build/0${pr}/${sha}`).expect(404)], done);
+      });
+
+
+      it('should accept SHAs with leading zeros (but not trim the zeros)', done => {
+        const sha40 = '0'.repeat(40);
+        const sha41 = `0${sha40}`;
+
+        const request40 = agent.get(`/create-build/${pr}/${sha40}`).set('AUTHORIZATION', 'foo').set('X-FILE', 'bar');
+        const request41 = agent.get(`/create-build/${pr}/${sha41}`).set('AUTHORIZATION', 'baz').set('X-FILE', 'qux');
+
+        Promise.all([
+          promisifyRequest(request40.expect(201)),
+          promisifyRequest(request41.expect(404)),
+        ]).then(done, done.fail);
+      });
+
+    });
+
+
+    describe('GET /health-check', () => {
+
+      it('should respond with 200', done => {
+        verifyRequests([
+          agent.get('/health-check').expect(200),
+          agent.get('/health-check/').expect(200),
+         ], done);
+      });
+
+
+      it('should respond with 405 for non-GET requests', done => {
+        verifyRequests([
+          agent.put('/health-check').expect(405),
+          agent.post('/health-check').expect(405),
+          agent.patch('/health-check').expect(405),
+          agent.delete('/health-check').expect(405),
+        ], done);
+      });
+
+
+      it('should respond with 404 if the path does not match exactly', done => {
+        verifyRequests([
+          agent.get('/health-check/foo').expect(404),
+          agent.get('/health-check-foo').expect(404),
+          agent.get('/health-checknfoo').expect(404),
+          agent.get('/foo/health-check').expect(404),
+          agent.get('/foo-health-check').expect(404),
+          agent.get('/foonhealth-check').expect(404),
+        ], done);
+      });
+
+    });
+
+
+    describe('GET *', () => {
+
+      it('should respond with 404', done => {
+        const responseBody = 'Unknown resource in request: GET /some/url';
+        verifyRequests([agent.get('/some/url').expect(404, responseBody)], done);
+      });
+
+    });
+
+
+    describe('ALL *', () => {
+
+      it('should respond with 405', done => {
+        const responseFor = (method: string) => `Unsupported method in request: ${method.toUpperCase()} /some/url`;
+
+        verifyRequests([
+          agent.put('/some/url').expect(405, responseFor('put')),
+          agent.post('/some/url').expect(405, responseFor('post')),
+          agent.patch('/some/url').expect(405, responseFor('patch')),
+          agent.delete('/some/url').expect(405, responseFor('delete')),
+        ], done);
+      });
+
+    });
+
+  });
+
+});

aio/aio-builds-setup/dockerbuild/scripts-js/tsconfig.json

@@ -0,0 +1,28 @@
+{
+  "compilerOptions": {
+    "alwaysStrict": true,
+    "forceConsistentCasingInFileNames": true,
+    "inlineSourceMap": true,
+    "lib": [
+      "es2016"
+    ],
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "outDir": "dist",
+    "pretty": true,
+    "rootDir": ".",
+    "skipLibCheck": true,
+    "strictNullChecks": true,
+    "target": "es5",
+    "typeRoots": [
+      "node_modules/@types"
+    ]
+  },
+  "include": [
+    "lib/**/*",
+    "test/**/*"
+  ]
+}

aio/aio-builds-setup/dockerbuild/scripts-js/tslint.json

@@ -0,0 +1,15 @@
+{
+  "extends": "tslint:recommended",
+  "rules": {
+    "array-type": [true, "array"],
+    "arrow-parens": [true, "ban-single-arg-parens"],
+    "interface-name": [true, "never-prefix"],
+    "max-classes-per-file": [true, 4],
+    "no-consecutive-blank-lines": [true, 2],
+    "no-console": false,
+    "no-namespace": [true, "allow-declarations"],
+    "no-string-literal": false,
+    "quotemark": [true, "single"],
+    "variable-name": [true, "ban-keywords", "check-format", "allow-leading-underscore"]
+  }
+}

aio/aio-builds-setup/dockerbuild/scripts-sh/clean-up.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+set -e -o pipefail
+
+# Set up env variables
+export AIO_GITHUB_TOKEN=$(head -c -1 /aio-secrets/GITHUB_TOKEN 2>/dev/null)
+
+# Run the clean-up
+node $AIO_SCRIPTS_JS_DIR/dist/lib/clean-up >> /var/log/aio/clean-up.log 2>&1

aio/aio-builds-setup/dockerbuild/scripts-sh/health-check.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+set +e -o pipefail
+
+
+# Variables
+exitCode=0
+
+
+# Helpers
+function reportStatus {
+  local lastExitCode=$?
+  echo "$1: $([[ $lastExitCode -eq 0 ]] && echo OK || echo NOT OK)"
+  [[ $lastExitCode -eq 0 ]] || exitCode=1
+}
+
+
+# Check services
+services=(
+  rsyslog
+  cron
+  nginx
+  pm2-root
+)
+for s in ${services[@]}; do
+  service $s status > /dev/null
+  reportStatus "Service '$s'"
+done
+
+
+# Check servers
+origins=(
+  http://$AIO_UPLOAD_HOSTNAME:$AIO_UPLOAD_PORT
+  http://$AIO_NGINX_HOSTNAME:$AIO_NGINX_PORT_HTTP
+  https://$AIO_NGINX_HOSTNAME:$AIO_NGINX_PORT_HTTPS
+)
+for o in ${origins[@]}; do
+  curl --fail --silent $o/health-check > /dev/null
+  reportStatus "Server '$o'"
+done
+
+
+# Check resolution of external URLs
+origins=(
+  https://google.com
+)
+for o in ${origins[@]}; do
+  curl --fail --silent $o > /dev/null
+  reportStatus "External URL '$o'"
+done
+
+
+# Exit
+exit $exitCode

aio/aio-builds-setup/dockerbuild/scripts-sh/init.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+set -e -o pipefail
+
+exec >> /var/log/aio/init.log
+exec 2>&1
+
+# Start the services
+echo [`date`] - Starting services...
+mkdir -p $AIO_NGINX_LOGS_DIR
+mkdir -p $TEST_AIO_NGINX_LOGS_DIR
+
+service rsyslog start
+service cron start
+service dnsmasq start
+service nginx start
+service pm2-root start
+aio-upload-server-prod start
+echo [`date`] - Services started successfully.

aio/aio-builds-setup/dockerbuild/scripts-sh/upload-server-prod.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e -o pipefail
+
+# Set up env variables for production
+export AIO_GITHUB_TOKEN=$(head -c -1 /aio-secrets/GITHUB_TOKEN 2>/dev/null)
+export AIO_PREVIEW_DEPLOYMENT_TOKEN=$(head -c -1 /aio-secrets/PREVIEW_DEPLOYMENT_TOKEN 2>/dev/null)
+
+# Start the upload-server instance
+# TODO(gkalpak): Ideally, the upload server should be run as a non-privileged user.
+#                (Currently, there doesn't seem to be a straight forward way.)
+action=$([ "$1" == "stop" ] && echo "stop" || echo "start")
+pm2 $action $AIO_SCRIPTS_JS_DIR/dist/lib/upload-server \
+  --log /var/log/aio/upload-server-prod.log \
+  --name aio-upload-server-prod \
+  ${@:2}

aio/aio-builds-setup/dockerbuild/scripts-sh/upload-server-test.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -e -o pipefail
+
+# Set up env variables for testing
+export AIO_BUILDS_DIR=$TEST_AIO_BUILDS_DIR
+export AIO_DOMAIN_NAME=$TEST_AIO_DOMAIN_NAME
+export AIO_GITHUB_ORGANIZATION=$TEST_AIO_GITHUB_ORGANIZATION
+export AIO_GITHUB_TEAM_SLUGS=$TEST_AIO_GITHUB_TEAM_SLUGS
+export AIO_PREVIEW_DEPLOYMENT_TOKEN=$TEST_AIO_PREVIEW_DEPLOYMENT_TOKEN
+export AIO_REPO_SLUG=$TEST_AIO_REPO_SLUG
+export AIO_UPLOAD_HOSTNAME=$TEST_AIO_UPLOAD_HOSTNAME
+export AIO_UPLOAD_PORT=$TEST_AIO_UPLOAD_PORT
+
+export AIO_GITHUB_TOKEN=$(head -c -1 /aio-secrets/TEST_GITHUB_TOKEN 2>/dev/null || echo "TEST_GITHUB_TOKEN")
+export AIO_PREVIEW_DEPLOYMENT_TOKEN=$(head -c -1 /aio-secrets/TEST_PREVIEW_DEPLOYMENT_TOKEN 2>/dev/null || echo "TEST_PREVIEW_DEPLOYMENT_TOKEN")
+
+# Start the upload-server instance
+# TODO(gkalpak): Ideally, the upload server should be run as a non-privileged user.
+#                (Currently, there doesn't seem to be a straight forward way.)
+appName=aio-upload-server-test
+if [[ "$1" == "stop" ]]; then
+  pm2 delete $appName
+else
+  pm2 start $AIO_SCRIPTS_JS_DIR/dist/lib/upload-server/index-test.js \
+    --log /var/log/aio/upload-server-test.log \
+    --name $appName \
+    --no-autorestart \
+    ${@:2}
+fi

aio/aio-builds-setup/dockerbuild/scripts-sh/verify-setup.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -e -o pipefail
+
+logFile=/var/log/aio/verify-setup.log
+uploadServerLogFile=/var/log/aio/upload-server-verify-setup.log
+
+exec 3>&1
+exec >> $logFile
+exec 2>&1
+
+echo "[`date`] - Starting verification..."
+
+# Helpers
+function countdown {
+  message=$1
+  secs=$2
+  while [ $secs -gt 0 ]; do
+    echo -ne "$message in $secs...\033[0K\r"
+    sleep 1
+    : $((secs--))
+  done
+  echo -ne "\033[0K\r"
+}
+
+function onExit {
+  aio-upload-server-test stop
+  echo -e "Full logs in '$logFile'.\n" > /dev/fd/3
+}
+
+# Setup EXIT trap
+trap 'onExit' EXIT
+
+# Start an upload-server instance for testing
+aio-upload-server-test start --log $uploadServerLogFile
+
+# Give the upload-server some time to start :(
+countdown "Starting" 5 > /dev/fd/3
+
+# Run the tests
+node $AIO_SCRIPTS_JS_DIR/dist/lib/verify-setup | tee /dev/fd/3

aio/aio-builds-setup/docs/_TOC.md

@@ -0,0 +1,32 @@
+# VM Setup Instructions
+
+
+## Overview
+- [General overview](overview--general.md)
+- [Security model](overview--security-model.md)
+- [Available Commands](overview--scripts-and-commands.md)
+
+
+## Setting up the VM
+- [Set up secrets](vm-setup--set-up-secrets.md)
+- [Set up docker](vm-setup--set-up-docker.md)
+- [Attach persistent disk](vm-setup--attach-persistent-disk.md)
+- [Create host directories and files](vm-setup--create-host-dirs-and-files.md)
+- [Create docker image](vm-setup--create-docker-image.md)
+
+
+## Configuring the docker image
+- [Available environment variables](image-config--environment-variables.md)
+
+
+## Starting the docker container
+- [Start docker container](vm-setup--start-docker-container.md)
+
+
+## Updating the docker container
+- [Update docker container](vm-setup--update-docker-container.md)
+
+
+## Miscellaneous
+- [Debug docker container](misc--debug-docker-container.md)
+- [Integrate with CI](misc--integrate-with-ci.md)

aio/aio-builds-setup/docs/image-config--environment-variables.md

@@ -0,0 +1,52 @@
+# Image config - Environment variables
+
+
+Below is a list of environment variables that can be configured when creating the docker image (as
+described [here](vm-setup--create-docker-image.md)). An up-to-date list of the configurable
+environment variables and their default values can be found in the
+[Dockerfile](../dockerbuild/Dockerfile).
+
+**Note:**
+Each variable has a `TEST_` prefixed counterpart, which is used for testing purposes. In most cases
+you don't need to specify values for those.
+
+- `AIO_BUILDS_DIR`:
+  The directory (inside the container) where the uploaded build artifacts are kept.
+
+- `AIO_DOMAIN_NAME`:
+  The domain name of the server.
+
+- `AIO_GITHUB_ORGANIZATION`:
+  The GitHub organization whose teams arew whitelisted for accepting uploads.
+  See also `AIO_GITHUB_TEAM_SLUGS`.
+
+- `AIO_GITHUB_TEAM_SLUGS`:
+  A comma-separated list of teams, whose authors are allowed to upload PRs.
+  See also `AIO_GITHUB_ORGANIZATION`.
+
+- `AIO_NGINX_HOSTNAME`:
+  The internal hostname for accessing the nginx server. This is mostly used for performing a
+  periodic health-check.
+
+- `AIO_NGINX_PORT_HTTP`:
+  The port number on which nginx listens for HTTP connections. This should be mapped to the
+  corresponding port on the host VM (as described [here](vm-setup--start-docker-container.md)).
+
+- `AIO_NGINX_PORT_HTTPS`:
+  The port number on which nginx listens for HTTPS connections. This should be mapped to the
+  corresponding port on the host VM (as described [here](vm-setup--start-docker-container.md)).
+
+- `AIO_REPO_SLUG`:
+  The repository slug (in the form `<user>/<repo>`) for which PRs will be uploaded.
+
+- `AIO_UPLOAD_HOSTNAME`:
+  The internal hostname for accessing the Node.js upload-server. This is used by nginx for
+  delegating upload requests and also for performing a periodic health-check.
+
+- `AIO_UPLOAD_MAX_SIZE`:
+  The maximum allowed size for the uploaded gzip archive containing the build artifacts. Files
+  larger than this will be rejected.
+
+- `AIO_UPLOAD_PORT`:
+  The port number on which the Node.js upload-server listens for HTTP connections. This is used by
+  nginx for delegating upload requests and also for performing a periodic health-check.

aio/aio-builds-setup/docs/misc--debug-docker-container.md

@@ -0,0 +1,12 @@
+# Miscellaneous - Debug docker container
+
+
+TODO (gkalpak): Add docs. Mention:
+- `aio-health-check`
+- `aio-verify-setup`
+- Test nginx accessible at:
+  - `http://$TEST_AIO_NGINX_HOTNAME:$TEST_AIO_NGINX_PORT_HTTP`
+  - `https://$TEST_AIO_NGINX_HOTNAME:$TEST_AIO_NGINX_PORT_HTTPS`
+- Test upload-server accessible at:
+  - `http://$TEST_AIO_UPLOAD_HOTNAME:$TEST_AIO_UPLOAD_PORT`
+- Local DNS (via dnsmasq) maps the above hostnames to 127.0.0.1

aio/aio-builds-setup/docs/misc--integrate-with-ci.md

@@ -0,0 +1,12 @@
+# Miscellaneous - Integrate with CI
+
+
+TODO (gkalpak): Add docs. Mention:
+- Travis' JWT addon (+ limitations).
+  Relevant files: `.travis.yml`
+- Testing on CI.
+  Relevant files: `ci/test-aio.sh`, `aio/aio-builds-setup/scripts/test.sh`
+- Preverifying on CI.
+  Relevant files: `ci/deploy.sh`, `aio/aio-builds-setup/scripts/travis-preverify-pr.sh`
+- Deploying from CI.
+  Relevant files: `ci/deploy.sh`, `aio/scripts/deploy-preview.sh`

aio/aio-builds-setup/docs/overview--general.md

@@ -0,0 +1,84 @@
+# Overview - General
+
+
+## Objective
+Whenever a PR job is run on Travis, we want to build `angular.io` and upload the build artifacts to
+a publicly accessible server so that collaborators (developers, designers, authors, etc) can preview
+the changes without having to checkout and build the app locally.
+
+
+## Source code
+In order to make it easier to administer the server and version-control the setup, we are using
+[docker](https://www.docker.com) to run a container on a VM. The Dockerfile and all other files
+necessary for creating the docker container are stored (and versioned) along with the angular.io
+project's source code (currently part of the angular/angular repo) in the `aio-builds-setup/`
+directory.
+
+
+## Setup
+The VM is hosted on [Google Compute Engine](https://cloud.google.com/compute/). The host OS is
+debian:jessie. For more info how to set up the host VM take a look at the "Setting up the VM"
+section in [TOC](_TOC.md).
+
+
+## Security model
+Since we are managing a public server, it is important to take appropriate measures in order to
+prevent abuse. For more details on the challenges and the chosen approach take a look at the
+[security model](overview--security-model.md).
+
+
+## The 10000 feet view
+This section gives a brief summary of the several operations performed on CI and by the docker
+container:
+
+
+### On CI (Travis)
+- Build job completes successfully (i.e. build succeeds and tests pass).
+- The CI script checks whether the build job was initiated by a PR against the angular/angular
+  master branch.
+- The CI script checks whether the PR has touched any files inside the angular.io project directory
+  (currently `aio/`).
+- The CI script checks whether the author of the PR is a member of one of the whitelisted GitHub
+  teams (and therefore allowed to upload).
+  **Note:**
+  For security reasons, the same checks will be performed on the server as well. This is an optional
+  step with the purpose of:
+  1. Avoiding the wasted overhead associated with uploads that are going to be rejected (e.g.
+     building the artifacts, sending them to the server, running checks on the server, etc).
+  2. Avoiding failing the build (due to an error response from the server) or requiring additional
+     logic for detecting the reasons of the failure.
+- The CI script gzip and upload the build artifacts to the server.
+
+More info on how to set things up on CI can be found [here](misc--integrate-with-ci.md).
+
+
+### Uploading build artifacts
+- nginx receives upload request.
+- nginx checks that the uploaded gzip archive does not exceed the specified max file size, stores it
+  in a temporary location and passes the filepath to the Node.js upload-server.
+- The upload-server verifies that the uploaded file is not trying to overwrite an existing build,
+  and runs several checks to determine whether the request should be accepted (more details can be
+  found [here](overview--security-model.md)).
+- The upload-server deploys the artifacts to a sub-directory named after the PR number and SHA:
+  `<PR>/<SHA>/`
+- The upload-server posts a comment on the corresponding PR on GitHub mentioning the SHA and the
+  the link where the preview can be found.
+
+
+### Serving build artifacts
+- nginx receives a request for an uploaded resource on a subdomain corresponding to the PR and SHA.
+  E.g.: `pr<PR>-<SHA>.ngbuilds.io/path/to/resource`
+- nginx maps the subdomain to the correct sub-directory and serves the resource.
+  E.g.: `/<PR>/<SHA>/path/to/resource`
+
+
+### Removing obsolete artifacts
+In order to avoid flooding the disk with unnecessary build artifacts, there is a cronjob that runs a
+clean-up tasks once a day. The task retrieves all open PRs from GitHub and removes all directories
+that do not correspond with an open PR.
+
+
+### Health-check
+The docker service runs a periodic health-check that verifies the running conditions of the
+container. This includes verifying the status of specific system services, the responsiveness of
+nginx and the upload-server and internet connectivity.

aio/aio-builds-setup/docs/overview--scripts-and-commands.md

@@ -0,0 +1,58 @@
+# Overview - Scripts and Commands
+
+
+This is an overview of the available scripts and commands.
+
+
+## Scripts
+The scripts are located inside `<aio-builds-setup-dir>/scripts/`. The following scripts are
+available:
+
+- `create-image.sh`:
+  Can be used for creating a preconfigured docker image.
+  See [here](vm-setup--create-docker-image.md) for more info.
+
+- `test.sh`
+  Can be used for running the tests for `<aio-builds-setup-dir>/dockerbuild/scripts-js/`. This is
+  useful for CI integration. See [here](misc--integrate-with-ci.md) for more info.
+
+- `travis-preverify-pr.sh`
+  Can be used for "preverifying" a PR before uploading the artifacts to the server. It checks that
+  the author of the PR is a member of one of the specified GitHub teams and therefore allowed to
+  upload build artifacts. This is useful for CI integration. See [here](misc--integrate-with-ci.md)
+  for more info.
+
+- `update-preview-server.sh`
+  Can be used for updating the docker container (and image) based on the latest changes checked out
+  from a git repository. See [here](vm-setup--update-docker-container.md) for more info.
+
+## Commands
+The following commands are available globally from inside the docker container. They are either used
+by the container to perform its various operations or can be used ad-hoc, mainly for testing
+purposes. Each command is backed by a corresponding script inside
+`<aio-builds-setup-dir>/dockerbuild/scripts-sh/`.
+
+- `aio-clean-up`:
+  Cleans up the builds directory by removing the artifacts that do not correspond to an open PR.
+  _It is run as a daily cronjob._
+
+- `aio-health-check`:
+  Runs a basic health-check, verifying that the necessary services are running, the servers are
+  responding and there is a working internet connection.
+  _It is used periodically by docker for determining the container's health status._
+
+- `aio-init`:
+  Initializes the container (mainly by starting the necessary services).
+  _It is run (by default) when starting the container._
+
+- `aio-upload-server-prod`:
+  Spins up a Node.js upload-server instance.
+  _It is used in `aio-init` (see above) during initialization._
+
+- `aio-upload-server-test`:
+  Spins up a Node.js upload-server instance for tests.
+  _It is used in `aio-verify-setup` (see below) for running tests._
+
+- `aio-verify-setup`:
+  Runs a suite of e2e-like tests, mainly verifying the correct (inter)operation of nginx and the
+  Node.js upload-server.

aio/aio-builds-setup/docs/overview--security-model.md

@@ -0,0 +1,116 @@
+# Overview - Security model
+
+
+Whenever a PR job is run on Travis, we want to build `angular.io` and upload the build artifacts to
+a publicly accessible server so that collaborators (developers, designers, authors, etc) can preview
+the changes without having to checkout and build the app locally.
+
+This document discusses the security considerations associated with uploading build artifacts as
+part of the CI setup and serving them publicly.
+
+
+## Security objectives
+
+- **Prevent uploading arbitrary content to our servers.**
+  Since there is no restriction on who can submit a PR, we cannot allow any PR's build artifacts to
+  be uploaded.
+
+- **Prevent overwriting other peoples uploaded content.**
+  There needs to be a mechanism in place to ensure that the uploaded content does indeed correspond
+  to the PR indicated by its URL.
+
+- **Prevent arbitrary access on the server.**
+  Since the PR author has full access over the build artifacts that would be uploaded, we must
+  ensure that the uploaded files will not enable arbitrary access to the server or expose sensitive
+  info.
+
+
+## Issues / Caveats
+
+- Because the PR author can change the scripts run on CI, any security mechanisms must be immune to
+  such changes.
+
+- For security reasons, encrypted Travis variables are not available to PRs, so we can't rely on
+  them to implement security.
+
+
+## Implemented approach
+
+
+### In a nutshell
+The implemented approach can be broken up to the following sub-tasks:
+
+1. Verify which PR the uploaded artifacts correspond to.
+2. Determine the author of the PR.
+3. Check whether the PR author is a member of some whitelisted GitHub team.
+4. Deploy the artifacts to the corresponding PR's directory.
+5. Prevent overwriting previously deployed artifacts (which ensures that the guarantees established
+   during deployment will remain valid until the artifacts are removed).
+6. Prevent uploaded files from accessing anything outside their directory.
+
+
+### Implementation details
+This section describes how each of the aforementioned sub-tasks is accomplished:
+
+1. **Verify which PR the uploaded artifacts correspond to.**
+
+   We are taking advantage of Travis' [JWT addon](https://docs.travis-ci.com/user/jwt). By sharing
+   a secret between Travis (which keeps it private but uses it to sign a JWT) and the server (which
+   uses it to verify the authenticity of the JWT), we can accomplish the following:
+   a. Verify that the upload request comes from Travis.
+   b. Determine the PR that these artifacts correspond to (since Travis puts that information into
+      the JWT, without the PR author being able to modify it).
+
+   _Note:_
+   _There are currently certain limitation in the implementation of the JWT addon._
+   _See the next section for more details._
+
+2. **Determine the author of the PR.**
+
+   Once we have securely associated the uploaded artifaacts to a PR, we retrieve the PR's metadata -
+   including the author's username - using the [GitHub API](https://developer.github.com/v3/).
+   To avoid rate-limit restrictions, we use a Personal Access Token (issued by
+   [@mary-poppins](https://github.com/mary-poppins)).
+
+3. **Check whether the PR author is a member of some whitelisted GitHub team.**
+
+   Again using the GitHub API, we can verify the author's membership in one of the
+   whitelisted/trusted GitHub teams. For this operation, we need a PErsonal Access Token with the
+   `read:org` scope issued by a user that can "see" the specified GitHub organization.
+   Here too, we use token by @mary-poppins.
+
+4. **Deploy the artifacts to the corresponding PR's directory.**
+
+   With the preceeding steps, we have verified that the uploaded artifacts have been uploaded by
+   Travis and correspond to a PR whose author is a member of a trusted team. Essentially, as long as
+   sub-tasks 1, 2 and 3 can be securely accomplished, it is possible to "project" the trust we have
+   in a team's members through the PR and Travis to the build artifacts.
+
+5. **Prevent overwriting previously deployed artifacts**.
+
+   In order to enforce this restriction (and ensure that the deployed artifacts validity is
+   preserved throughout their "lifetime"), the server that handles the upload (currently a Node.js
+   Express server) rejects uploads that target an existing directory.
+   _Note: A PR can contain multiple uploads; one for each SHA that was built on Travis._
+
+6. **Prevent uploaded files from accessing anything outside their directory.**
+
+   Nginx (which is used to serve the uploaded artifacts) has been configured to not follow symlinks
+   outside of the directory where the build artifacts are stored.
+
+
+## Assumptions / Things to keep in mind
+
+- Each trusted PR author has full control over the content that is uploaded for their PRs. Part of
+  the security model relies on the trustworthiness of these authors.
+
+- If anyone gets access to the `PREVIEW_DEPLOYMENT_TOKEN` (a.k.a. `NGBUILDS_IO_KEY` on
+  angular/angular) variable generated for each Travis job, they will be able to impersonate the
+  corresponding PR's author on the preview server for as long as the token is valid (currently 90
+  mins). Because of this, the value of the `PREVIEW_DEPLOYMENT_TOKEN` should not be made publicly
+  accessible (e.g. by printing it on the Travis job log).
+
+- Travis does only allow specific whitelisted property names to be used with the JWT addon. The only
+  known such property at the time is `SAUCE_ACCESS_KEY` (used for integration with SauceLabs). In
+  order to be able to actually use the JWT addon we had to name the encrypted variable
+  `SAUCE_ACCESS_KEY` (which we later re-assign to `NGBUILDS_IO_KEY`).

aio/aio-builds-setup/docs/vm-setup--attach-persistent-disk.md

@@ -0,0 +1,20 @@
+# VM setup - Attach persistent disk
+
+
+## Create `aio-builds` persistent disk (if not already exists)
+- Follow instructions [here](https://cloud.google.com/compute/docs/disks/add-persistent-disk#create_disk).
+- `sudo mkfs.ext4 -F -E lazy_itable_init=0,lazy_journal_init=0,discard /dev/disk/by-id/google-aio-builds`
+
+
+## Mount disk
+- `sudo mkdir -p /mnt/disks/aio-builds`
+- `sudo mount -o discard,defaults /dev/disk/by-id/google-aio-builds /mnt/disks/aio-builds`
+- `sudo chmod a+w /mnt/disks/aio-builds`
+
+
+## Mount disk on boot
+- Run:
+  ```
+  echo UUID=`sudo blkid -s UUID -o value /dev/disk/by-id/google-aio-builds` \
+    /mnt/disks/aio-builds ext4 discard,defaults,nofail 0 2 | sudo tee -a /etc/fstab
+  ```

aio/aio-builds-setup/docs/vm-setup--create-docker-image.md

@@ -0,0 +1,32 @@
+# VM setup - Create docker image
+
+
+## Checkout repository
+- `git clone <repo-url>`
+
+
+## Build docker image
+- `<aio-builds-setup-dir>/scripts/create-image.sh [<name>[:<tag>] [--build-arg <NAME>=<value> ...]]`
+- You can overwrite the default environment variables inside the image, by passing new values using
+  `--build-arg`.
+
+**Note:** The script has to execute docker commands with `sudo`.
+
+
+## Example
+The following commands would create a docker image from GitHub repo `foo/bar` to be deployed on the
+`foobar-builds.io` domain and accepting PR deployments from authors that are members of the
+`bar-core` and `bar-docs-authors` teams of organization `foo`:
+
+- `git clone https://github.com/foo/bar.git foobar`
+- Run:
+  ```
+  ./foobar/aio-builds-setup/scripts/build.sh foobar-builds \
+    --build-arg AIO_REPO_SLUG=foo/bar \
+    --build-arg AIO_DOMAIN_NAME=foobar-builds.io \
+    --build-arg AIO_GITHUB_ORGANIZATION=foo \
+    --build-arg AIO_GITHUB_TEMA_SLUGS=bar-core,bar-docs-authors
+  ```
+
+A full list of the available environment variables can be found
+[here](image-config--environment-variables.md).

aio/aio-builds-setup/docs/vm-setup--create-host-dirs-and-files.md

@@ -0,0 +1,75 @@
+# VM setup - Create host directories and files
+
+
+## Create directory with secrets
+For security reasons, sensitive info (such as tokens and passwords) are not hardcoded into the
+docker image, nor passed as environment variables at runtime. They are passed to the docker
+container from the host VM as files inside a directory. Each file's name is the name of the variable
+and the file content is the value. These are read from inside the running container when necessary.
+
+More info on how to create `secrets` directory and files can be found
+[here](vm-setup--set-up-secrets.md).
+
+
+## Create directory for build artifacts
+The uploaded build artifacts should be kept on a directory outside the docker container, so it is
+easier to replace the container without losing the uploaded builds. For portability across VMs a
+persistent disk can be used (as described [here](vm-setup--attach-persistent-disk.md)).
+
+**Note:** The directories created inside that directory will be owned by user `www-data`.
+
+
+## Create SSL certificates (Optional for dev)
+The host VM can attach a directory containing the SSL certificate and key to be used by the nginx
+server for serving the uploaded build artifacts. More info on how to attach the directory when
+starting the container can be found [here](vm-setup--start-docker-container.md).
+
+In order for the container to be able to find the certificate and key, they should be named
+`<DOMAIN_NAME>.crt` and `<DOMAIN_NAME>.key` respectively. For example, for a domain name
+`ngbuild.io`, nginx will look for files `ngbuilds.io.crt` and `ngbuilds.io.key`. More info on how to
+specify the domain name see [here](vm-setup--create-docker-image.md).
+
+If no directory is attached, nginx will use an internal self-signed certificate. This is convenient
+during development, but is not suitable for production.
+
+**Note:**
+Since nginx needs to be able to serve requests for both the main domain as well as any subdomain
+(e.g. `ngbuilds.io/` and `foo-bar.ngbuilds.io/`), the provided certificate needs to be a wildcard
+certificate covering both the domain and subdomains.
+
+
+## Create directory for logs (Optional)
+Optionally, a logs directory can pe passed to the docker container for storing non-system-related
+logs. If not provided, the logs are kept locally on the container and will be lost whenever the
+container is replaced (e.g. when updating to use a newer version of the docker image). Log files are
+rotated and retained for 6 months.
+
+The following log files are kept in this directory:
+
+- `clean-up.log`:
+  Output of the `aio-clean-up` command, run as a cronjob for cleaning up the build artifacts of
+  closed PRs.
+
+- `init.log`:
+  Output of the `aio-init` command, run (by default) when starting the container.
+
+- `nginx/{access,error}.log`:
+  The access and error logs produced by the nginx server while serving "production" files.
+
+- `nginx-test/{access,error}.log`:
+  The access and error logs produced by the nginx server while serving "test" files. This is only
+  used when running tests locally from inside the container, e.g. with the `aio-verify-setup`
+  command. (See [here](overview--scripts-and-commands.md) for more info.)
+
+- `upload-server-{prod,test,verify-setup}-*.log`:
+  The logs produced by the Node.js upload-server while serving either:
+  - `-prod`: "Production" files (g.g during normal operation).
+  - `-test`: "Test" files (e.g. when a test instance is started with the `aio-upload-server-test`
+             command).
+  - `-verify-setup`: "Test" files, but while running `aio-verify-setup`.
+
+  (See [here](overview--scripts-and-commands.md) for more info the commands mentioned above.)
+
+- `verify-setup.log`:
+  The output of the `aio-verify-setup` command (e.g. Jasmine output), except for upload-server
+  output which is logged to `upload-server-verify-setup-*.log` (see above).

aio/aio-builds-setup/docs/vm-setup--set-up-docker.md

@@ -0,0 +1,35 @@
+# VM Setup - Set up docker
+
+
+## Install docker
+
+_Debian (jessie):_
+- `sudo apt-get update`
+- `sudo apt-get install -y apt-transport-https ca-certificates curl git software-properties-common`
+- `curl -fsSL https://apt.dockerproject.org/gpg | sudo apt-key add -`
+- `apt-key fingerprint 58118E89F3A912897C070ADBF76221572C52609D`
+- `sudo add-apt-repository "deb https://apt.dockerproject.org/repo/ debian-$(lsb_release -cs) main"`
+- `sudo apt-get update`
+- `sudo apt-get -y install docker-engine`
+
+_Ubuntu (16.04):_
+- `sudo apt-get update`
+- `sudo apt-get install -y curl git linux-image-extra-$(uname -r) linux-image-extra-virtual`
+- `sudo apt-get install -y apt-transport-https ca-certificates`
+- `curl -fsSL https://yum.dockerproject.org/gpg | sudo apt-key add -`
+- `apt-key fingerprint 58118E89F3A912897C070ADBF76221572C52609D`
+- `sudo add-apt-repository "deb https://apt.dockerproject.org/repo/ ubuntu-$(lsb_release -cs) main"`
+- `sudo apt-get update`
+- `sudo apt-get -y install docker-engine`
+
+
+## Start the docker
+- `sudo service docker start`
+
+
+## Test docker
+- `sudo docker run hello-world`
+
+
+## Start docker on boot
+- `sudo systemctl enable docker`

aio/aio-builds-setup/docs/vm-setup--set-up-secrets.md

@@ -0,0 +1,52 @@
+# VM Setup - Set up secrets
+
+
+## Overview
+
+Necessary secrets:
+
+1. `GITHUB_TOKEN`
+   - Used for:
+     - Retrieving open PRs without rate-limiting.
+     - Retrieving PR author.
+     - Retrieving members of the `angular-core` team.
+     - Posting comments with preview links on PRs.
+
+2. `PREVIEW_DEPLOYMENT_TOKEN`
+   - Used for:
+     - Decoding the JWT tokens received with `/create-build` requests.
+
+**Note:**
+`TEST_GITHUB_TOKEN` and `TEST_PREVIEW_DEPLOYMENT_TOKEN` can also be created similar to their
+non-TEST counterparts and they will be loaded when running `aio-verify-setup`, but it is currently
+not clear if/how they can be used in tests.
+
+
+## Create secrets
+
+1. `GITHUB_TOKEN`
+   - Visit https://github.com/settings/tokens.
+   - Generate new token with the `public_repo` scope.
+
+2. `PREVIEW_DEPLOYMENT_TOKEN`
+   - Just generate a hard-to-guess character sequence.
+   - Add it to `.travis.yml` under `addons -> jwt -> secure`.
+     Can be added automatically with: `travis encrypt --add addons.jwt PREVIEW_DEPLOYMENT_TOKEN=<access-key>`
+
+**Note:**
+Due to [travis-ci/travis-ci#7223](https://github.com/travis-ci/travis-ci/issues/7223) it is not
+currently possible to use the JWT addon (as described above) for anything other than the
+`SAUCE_ACCESS_KEY` variable. You can get creative, though...
+
+**WARNING**
+TO avoid arbitrary uploads, make sure the `PREVIEW_DEPLOYMENT_TOKEN` is NOT printed in the Travis log.
+
+
+## Save secrets on the VM
+
+- `sudo mkdir /aio-secrets`
+- `sudo touch /aio-secrets/GITHUB_TOKEN`
+- Insert `<github-token>` into `/aio-secrets/GITHUB_TOKEN`.
+- `sudo touch /aio-secrets/PREVIEW_DEPLOYMENT_TOKEN`
+- Insert `<access-token>` into `/aio-secrets/PREVIEW_DEPLOYMENT_TOKEN`.
+- `sudo chmod 400 /aio-secrets/*`

aio/aio-builds-setup/docs/vm-setup--start-docker-container.md

@@ -0,0 +1,92 @@
+# VM setup - Start docker container
+
+
+## The `docker run` command
+Once everything has been setup and configured, a docker container can be started with the following
+command:
+
+```
+sudo docker run \
+  --detach \
+  --dns 127.0.0.1 \
+  --name <instance-name> \
+  --publish 80:80 \
+  --publish 443:443 \
+  --restart unless-stopped \
+ [--volume <host-cert-dir>:/etc/ssl/localcerts:ro] \
+  --volume <host-secrets-dir>:/aio-secrets:ro \
+  --volume <host-builds-dir>:/var/www/aio-builds \
+ [--volume <host-logs-dir>:/var/log/aio] \
+  <name>[:<tag>]
+```
+
+Below is the same command with inline comments explaining each option. The aPI docs for `docker run`
+can be found [here](https://docs.docker.com/engine/reference/run/).
+
+```
+sudo docker run \
+
+  # Start as a daemon.
+  --detach \
+
+  # Use the local DNS server.
+  # (This is necessary for mapping internal URLs, e.g. for the Node.js upload-server.)
+  --dns 127.0.0.1 \
+
+  # USe `<instance-name>` as an alias for the container.
+  # Useful for running `docker` commands, e.g.: `docker stop <instance-name>`
+  --name <instance-name> \
+
+  # Map ports of the host VM (left) to ports of the docker container (right)
+  --publish 80:80 \
+  --publish 443:443 \
+
+  # Automatically restart the container (unless it was explicitly stopped by the user).
+  # (This ensures that the container will be automatically started on boot.)
+  --restart unless-stopped \
+
+  # The directory the contains the SSL certificates.
+  # (See [here](vm-setup--create-host-dirs-and-files.md) for more info.)
+  # If not provided, the container will use self-signed certificates.
+ [--volume <host-cert-dir>:/etc/ssl/localcerts:ro] \
+
+  # The directory the contains the secrets (e.g. GitHub token, JWT secret, etc).
+  # (See [here](vm-setup--set-up-secrets.md) for more info.)
+  --volume <host-secrets-dir>:/aio-secrets:ro \
+
+  # The uploaded build artifacts will stored to and served from this directory.
+  # (If you are using a persistent disk - as described [here](vm-setup--attach-persistent-disk.md) -
+  #  this will be a directory inside the disk.)
+  --volume <host-builds-dir>:/var/www/aio-builds \
+
+  # The directory where the logs are being kept.
+  # (See [here](vm-setup--create-host-dirs-and-files.md) for more info.)
+  # If not provided, the logs will be kept inside the container, which means they will be lost
+  # whenever a new container is created.
+ [--volume <host-logs-dir>:/var/log/aio] \
+
+  # The name of the docker image to use (and an optional tag; defaults to `latest`).
+  # (See [here](vm-setup--create-docker-image.md) for instructions on how to create the iamge.)
+  <name>[:<tag>]
+```
+
+
+## Example
+The following command would start a docker container based on the previously created `foobar-builds`
+docker image, alias it as 'foobar-builds-1' and map predefined directories on the host VM to be used
+by the container for accesing secrets and SSL certificates and keeping the build artifacts and logs.
+
+```
+sudo docker run \
+  --detach \
+  --dns 127.0.0.1 \
+  --name foobar-builds-1 \
+  --publish 80:80 \
+  --publish 443:443 \
+  --restart unless-stopped \
+  --volume /etc/ssl/localcerts:/etc/ssl/localcerts:ro \
+  --volume /foobar-secrets:/aio-secrets:ro \
+  --volume /mnt/disks/foobar-builds:/var/www/aio-builds \
+  --volume /foobar-logs:/var/log/aio \
+  foobar-builds
+```

aio/aio-builds-setup/docs/vm-setup--update-docker-container.md

@@ -0,0 +1,52 @@
+# VM setup - Update docker container
+
+
+## Overview
+Assuming you have cloned the repository containing the preview server code (as described
+[here](vm-setup--create-docker-image.md)), you can use the `update-preview-server.sh` script on the
+VM host to update the preview server based on changes in the source code.
+
+The script will pull the latest changes from the origin's master branch and examine if there have
+been any changes in files inside the preview server source code directory (see below). If there are,
+it will create a new image and verify that is works as expected. Finally, it will stop and remove
+the old docker container and image, create and new container based on the new image and start it.
+
+The script assumes that the preview server source code is in the repository's
+`aio/aio-builds-setup/` directory and expects the following inputs:
+
+- **$1**: `HOST_REPO_DIR`
+- **$2**: `HOST_LOCALCERTS_DIR`
+- **$3**: `HOST_SECRETS_DIR`
+- **$4**: `HOST_BUILDS_DIR`
+- **$5**: `HOST_LOGS_DIR`
+
+See [here](vm-setup--create-host-dirs-and-files.md) for more info on what each input directory is
+used for.
+
+**Note 1:** The script has to execute docker commands with `sudo`.
+
+**Note 2:** Make sure the user that executes the script has access to update the repository
+
+
+## Run the script manually
+You may choose to manually run the script, when necessary. Example:
+
+```
+update-preview-server.sh \
+    /path/to/repo \
+    /path/to/localcerts \
+    /path/to/secrets \
+    /path/to/builds \
+    /path/to/logs
+```
+
+
+## Run the script automatically
+You may choose to automatically trigger the script, e.g. using a cronjob. For example, the following
+cronjob entry would run the script every hour and update the preview server (assuming the user has
+the necessary permissions):
+
+```
+# Periodically check for changes and update the preview server (if necessary)
+*/30 *  * * *   /path/to/update-preview-server.sh /path/to/repo /path/to/localcerts /path/to/secrets /path/to/builds /path/to/logs
+```

aio/aio-builds-setup/scripts/_env.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+readonly THIS_DIR=$(cd $(dirname $0); pwd)
+readonly DOCKERBUILD_DIR="$THIS_DIR/../dockerbuild"
+readonly SCRIPTS_JS_DIR="$DOCKERBUILD_DIR/scripts-js"

aio/aio-builds-setup/scripts/create-image.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eux -o pipefail
+
+# Set up env
+source "`dirname $0`/_env.sh"
+readonly defaultImageNameAndTag="aio-builds:latest"
+
+# Create docker image
+readonly nameAndOptionalTag=${1:-$defaultImageNameAndTag}
+sudo docker build --tag $nameAndOptionalTag ${@:2} $DOCKERBUILD_DIR

aio/aio-builds-setup/scripts/test.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -eux -o pipefail
+
+# Set up env
+source "`dirname $0`/_env.sh"
+
+# Test `scripts-js/`
+(
+  cd "$SCRIPTS_JS_DIR"
+  yarn install
+  yarn test
+)

aio/aio-builds-setup/scripts/travis-preverify-pr.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -eux -o pipefail
+
+# Set up env
+source "`dirname $0`/_env.sh"
+
+# Build `scripts-js/`
+(
+  cd "$SCRIPTS_JS_DIR"
+  yarn install
+  yarn build
+)
+
+# Preverify PR
+AIO_GITHUB_ORGANIZATION="angular" \
+AIO_GITHUB_TEAM_SLUGS="angular-core,aio-contributors" \
+AIO_GITHUB_TOKEN=$(echo ${GITHUB_TEAM_MEMBERSHIP_CHECK_KEY} | rev) \
+AIO_REPO_SLUG=$TRAVIS_REPO_SLUG \
+AIO_PREVERIFY_PR=$TRAVIS_PULL_REQUEST \
+node "$SCRIPTS_JS_DIR/dist/lib/upload-server/index-preverify-pr"

aio/aio-builds-setup/scripts/update-preview-server.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+set -eux -o pipefail
+exec 3>&1
+
+echo "[`date`] - Updating the preview server..."
+
+# Input
+readonly HOST_REPO_DIR=$1
+readonly HOST_LOCALCERTS_DIR=$2
+readonly HOST_SECRETS_DIR=$3
+readonly HOST_BUILDS_DIR=$4
+readonly HOST_LOGS_DIR=$5
+
+# Constants
+readonly PROVISIONAL_IMAGE_NAME=aio-builds:provisional
+readonly LATEST_IMAGE_NAME=aio-builds:latest
+readonly CONTAINER_NAME=aio
+
+# Run
+(
+  cd "$HOST_REPO_DIR"
+
+  readonly lastDeployedCommit=$(git rev-parse HEAD)
+  echo "Currently at commit $lastDeployedCommit."
+
+  # Pull latest master from origin.
+  git pull origin master
+
+  # Do not update the server unless files inside `aio-builds-setup/` have changed
+  # or the last attempt failed (identified by the provisional image still being around).
+  readonly relevantChangedFilesCount=$(git diff --name-only $lastDeployedCommit...HEAD | grep -P "^aio/aio-builds-setup/" | wc -l)
+  readonly lastAttemptFailed=$(sudo docker rmi "$PROVISIONAL_IMAGE_NAME" >> /dev/fd/3 && echo "true" || echo "false")
+  if [[ $relevantChangedFilesCount -eq 0 ]] && [[ "$lastAttemptFailed" != "true" ]]; then
+    echo "Skipping update because no relevant files have been touched."
+    exit 0
+  fi
+
+  # Create and verify a new docker image.
+  aio/aio-builds-setup/scripts/create-image.sh "$PROVISIONAL_IMAGE_NAME"
+  readonly imageVerified=$(sudo docker run --dns 127.0.0.1 --rm --volume $HOST_SECRETS_DIR:/aio-secrets:ro "$PROVISIONAL_IMAGE_NAME" /bin/bash -c "aio-init && aio-health-check && aio-verify-setup" >> /dev/fd/3 && echo "true" || echo "false")
+
+  if [[ "$imageVerified" != "true" ]]; then
+    echo "Failed to verify new docker image. Aborting update!"
+    exit 1
+  fi
+
+  # Remove the old container and replace the docker image.
+  sudo docker stop "$CONTAINER_NAME" || true
+  sudo docker rm "$CONTAINER_NAME" || true
+  sudo docker rmi "$LATEST_IMAGE_NAME" || true
+  sudo docker tag "$PROVISIONAL_IMAGE_NAME" "$LATEST_IMAGE_NAME"
+  sudo docker rmi "$PROVISIONAL_IMAGE_NAME"
+
+  # Create and start a docker container based on the new image.
+  sudo docker run \
+      --detach \
+      --dns 127.0.0.1 \
+      --name "$CONTAINER_NAME" \
+      --publish 80:80 \
+      --publish 443:443 \
+      --restart unless-stopped \
+      --volume $HOST_LOCALCERTS_DIR:/etc/ssl/localcerts:ro \
+      --volume $HOST_SECRETS_DIR:/aio-secrets:ro \
+      --volume $HOST_BUILDS_DIR:/var/www/aio-builds \
+      --volume $HOST_LOGS_DIR:/var/log/aio \
+      "$LATEST_IMAGE_NAME"
+
+  echo "The new docker image has been successfully deployed."
+)

aio/build/docs-app.js

@@ -1,3 +0,0 @@
-module.exports = (gulp) => () => {
-  // TODO:(petebd): hook up with whatever builds need doing for the webapp
-};

aio/build/docs.js

@@ -1,24 +0,0 @@
-/**
- * @license
- * Copyright Google Inc. All Rights Reserved.
- *
- * Use of this source code is governed by an MIT-style license that can be
- * found in the LICENSE file at https://angular.io/license
- */
-
-module.exports = {
-  generate: (gulp) => () => {
-    const path = require('path');
-    const Dgeni = require('dgeni');
-    const angularDocsPackage = require(path.resolve(__dirname, '../transforms/angular.io-package'));
-    const dgeni = new Dgeni([angularDocsPackage]);
-    return dgeni.generate();
-  },
-
-  test: (gulp) => () => {
-    const execSync = require('child_process').execSync;
-    execSync(
-        'node ../dist/tools/cjs-jasmine/index-tools ../../transforms/**/*.spec.js',
-        {stdio: ['inherit', 'inherit', 'inherit']});
-  }
-};

aio/content/cheatsheet/bootstrapping.md

@@ -1,18 +0,0 @@
-@cheatsheetSection
-Bootstrapping
-@cheatsheetIndex 0
-@description
-{@target ts}`import { platformBrowserDynamic } from '@angular/platform-browser-dynamic';`{@endtarget}
-{@target js}Available from the `ng.platformBrowserDynamic` namespace{@endtarget}
-
-@cheatsheetItem
-syntax(ts):
-`platformBrowserDynamic().bootstrapModule(AppModule);`|`platformBrowserDynamic().bootstrapModule`
-syntax(js):
-`document.addEventListener('DOMContentLoaded', function() {
-  ng.platformBrowserDynamic
-    .platformBrowserDynamic()
-    .bootstrapModule(app.AppModule);
-});`|`platformBrowserDynamic().bootstrapModule`
-description:
-Bootstraps the app, using the root component from the specified `NgModule`. {@target js}Must be wrapped in the event listener to fire when the page loads.{@endtarget}

aio/content/cheatsheet/built-in-directives.md

@@ -1,34 +0,0 @@
-@cheatsheetSection
-Built-in directives
-@cheatsheetIndex 3
-@description
-{@target ts}`import { CommonModule } from '@angular/common';`{@endtarget}
-{@target js}Available using the `ng.common.CommonModule` module{@endtarget}
-
-@cheatsheetItem
-syntax:
-`<section *ngIf="showSection">`|`*ngIf`
-description:
-Removes or recreates a portion of the DOM tree based on the `showSection` expression.
-
-@cheatsheetItem
-syntax:
-`<li *ngFor="let item of list">`|`*ngFor`
-description:
-Turns the li element and its contents into a template, and uses that to instantiate a view for each item in list.
-
-@cheatsheetItem
-syntax:
-`<div [ngSwitch]="conditionExpression">
-  <ng-template [ngSwitchCase]="case1Exp">...</ng-template>
-  <ng-template ngSwitchCase="case2LiteralString">...</ng-template>
-  <ng-template ngSwitchDefault>...</ng-template>
-</div>`|`[ngSwitch]`|`[ngSwitchCase]`|`ngSwitchCase`|`ngSwitchDefault`
-description:
-Conditionally swaps the contents of the div by selecting one of the embedded templates based on the current value of `conditionExpression`.
-
-@cheatsheetItem
-syntax:
-`<div [ngClass]="{active: isActive, disabled: isDisabled}">`|`[ngClass]`
-description:
-Binds the presence of CSS classes on the element to the truthiness of the associated map values. The right-hand expression should return {class-name: true/false} map.

aio/content/cheatsheet/class-decorators.md

@@ -1,49 +0,0 @@
-@cheatsheetSection
-Class decorators
-@cheatsheetIndex 5
-@description
-{@target ts}`import { Directive, ... } from '@angular/core';`{@endtarget}
-{@target js}Available from the `ng.core` namespace{@endtarget}
-
-@cheatsheetItem
-syntax(ts):
-`@Component({...})
-class MyComponent() {}`|`@Component({...})`
-syntax(js):
-`var MyComponent = ng.core.Component({...}).Class({...})`|`ng.core.Component({...})`
-description:
-Declares that a class is a component and provides metadata about the component.
-
-@cheatsheetItem
-syntax(ts):
-`@Directive({...})
-class MyDirective() {}`|`@Directive({...})`
-syntax(js):
-`var MyDirective = ng.core.Directive({...}).Class({...})`|`ng.core.Directive({...})`
-description:
-Declares that a class is a directive and provides metadata about the directive.
-
-@cheatsheetItem
-syntax(ts):
-`@Pipe({...})
-class MyPipe() {}`|`@Pipe({...})`
-syntax(js):
-`var MyPipe = ng.core.Pipe({...}).Class({...})`|`ng.core.Pipe({...})`
-description:
-Declares that a class is a pipe and provides metadata about the pipe.
-
-@cheatsheetItem
-syntax(ts):
-`@Injectable()
-class MyService() {}`|`@Injectable()`
-syntax(js):
-`var OtherService = ng.core.Class(
-    {constructor: function() { }});
-var MyService = ng.core.Class(
-    {constructor: [OtherService, function(otherService) { }]});`|`var MyService = ng.core.Class({constructor: [OtherService, function(otherService) { }]});`
-description:
-{@target ts}Declares that a class has dependencies that should be injected into the constructor when the dependency injector is creating an instance of this class.
-{@endtarget}
-{@target js}
-Declares a service to inject into a class by providing an array with the services, with the final item being the function to receive the injected services.
-{@endtarget}

aio/content/cheatsheet/component-configuration.md

@@ -1,38 +0,0 @@
-@cheatsheetSection
-Component configuration
-@cheatsheetIndex 7
-@description
-{@target js}`ng.core.Component` extends `ng.core.Directive`,
-so the `ng.core.Directive` configuration applies to components as well{@endtarget}
-{@target ts}`@Component` extends `@Directive`,
-so the `@Directive` configuration applies to components as well{@endtarget}
-
-@cheatsheetItem
-syntax:
-`moduleId: module.id`|`moduleId:`
-description:
-If set, the `templateUrl` and `styleUrl` are resolved relative to the component.
-
-@cheatsheetItem
-syntax(ts):
-`viewProviders: [MyService, { provide: ... }]`|`viewProviders:`
-syntax(js):
-`viewProviders: [MyService, { provide: ... }]`|`viewProviders:`
-description:
-List of dependency injection providers scoped to this component's view.
-
-
-@cheatsheetItem
-syntax:
-`template: 'Hello {{name}}'
-templateUrl: 'my-component.html'`|`template:`|`templateUrl:`
-description:
-Inline template or external template URL of the component's view.
-
-
-@cheatsheetItem
-syntax:
-`styles: ['.primary {color: red}']
-styleUrls: ['my-component.css']`|`styles:`|`styleUrls:`
-description:
-List of inline CSS styles or external stylesheet URLs for styling the component’s view.

aio/content/cheatsheet/dependency-injection.md

@@ -1,30 +0,0 @@
-@cheatsheetSection
-Dependency injection configuration
-@cheatsheetIndex 10
-@description
-
-@cheatsheetItem
-syntax(ts):
-`{ provide: MyService, useClass: MyMockService }`|`provide`|`useClass`
-syntax(js):
-`{ provide: MyService, useClass: MyMockService }`|`provide`|`useClass`
-description:
-Sets or overrides the provider for `MyService` to the `MyMockService` class.
-
-
-@cheatsheetItem
-syntax(ts):
-`{ provide: MyService, useFactory: myFactory }`|`provide`|`useFactory`
-syntax(js):
-`{ provide: MyService, useFactory: myFactory }`|`provide`|`useFactory`
-description:
-Sets or overrides the provider for `MyService` to the `myFactory` factory function.
-
-
-@cheatsheetItem
-syntax(ts):
-`{ provide: MyValue, useValue: 41 }`|`provide`|`useValue`
-syntax(js):
-`{ provide: MyValue, useValue: 41 }`|`provide`|`useValue`
-description:
-Sets or overrides the provider for `MyValue` to the value `41`.

aio/content/cheatsheet/directive-and-component-decorators.md

@@ -1,86 +0,0 @@
-@cheatsheetSection
-Class field decorators for directives and components
-@cheatsheetIndex 8
-@description
-{@target ts}`import { Input, ... } from '@angular/core';`{@endtarget}
-{@target js}Available from the `ng.core` namespace{@endtarget}
-
-@cheatsheetItem
-syntax(ts):
-`@Input() myProperty;`|`@Input()`
-syntax(js):
-`ng.core.Input(myProperty, myComponent);`|`ng.core.Input(`|`);`
-description:
-Declares an input property that you can update via property binding (example:
-`<my-cmp [myProperty]="someExpression">`).
-
-
-@cheatsheetItem
-syntax(ts):
-`@Output() myEvent = new EventEmitter();`|`@Output()`
-syntax(js):
-`myEvent = new ng.core.EventEmitter();
-ng.core.Output(myEvent, myComponent);`|`ng.core.Output(`|`);`
-description:
-Declares an output property that fires events that you can subscribe to with an event binding (example: `<my-cmp (myEvent)="doSomething()">`).
-
-
-@cheatsheetItem
-syntax(ts):
-`@HostBinding('class.valid') isValid;`|`@HostBinding('class.valid')`
-syntax(js):
-`ng.core.HostBinding('class.valid',
-    'isValid', myComponent);`|`ng.core.HostBinding('class.valid', 'isValid'`|`);`
-description:
-Binds a host element property (here, the CSS class `valid`) to a directive/component property (`isValid`).
-
-
-
-@cheatsheetItem
-syntax(ts):
-`@HostListener('click', ['$event']) onClick(e) {...}`|`@HostListener('click', ['$event'])`
-syntax(js):
-`ng.core.HostListener('click',
-    ['$event'], onClick(e) {...}, myComponent);`|`ng.core.HostListener('click', ['$event'], onClick(e)`|`);`
-description:
-Subscribes to a host element event (`click`) with a directive/component method (`onClick`), optionally passing an argument (`$event`).
-
-
-@cheatsheetItem
-syntax(ts):
-`@ContentChild(myPredicate) myChildComponent;`|`@ContentChild(myPredicate)`
-syntax(js):
-`ng.core.ContentChild(myPredicate,
-    'myChildComponent', myComponent);`|`ng.core.ContentChild(myPredicate,`|`);`
-description:
-Binds the first result of the component content query (`myPredicate`) to a property (`myChildComponent`) of the class.
-
-
-@cheatsheetItem
-syntax(ts):
-`@ContentChildren(myPredicate) myChildComponents;`|`@ContentChildren(myPredicate)`
-syntax(js):
-`ng.core.ContentChildren(myPredicate,
-    'myChildComponents', myComponent);`|`ng.core.ContentChildren(myPredicate,`|`);`
-description:
-Binds the results of the component content query (`myPredicate`) to a property (`myChildComponents`) of the class.
-
-
-@cheatsheetItem
-syntax(ts):
-`@ViewChild(myPredicate) myChildComponent;`|`@ViewChild(myPredicate)`
-syntax(js):
-`ng.core.ViewChild(myPredicate,
-    'myChildComponent', myComponent);`|`ng.core.ViewChild(myPredicate,`|`);`
-description:
-Binds the first result of the component view query (`myPredicate`) to a property (`myChildComponent`) of the class. Not available for directives.
-
-
-@cheatsheetItem
-syntax(ts):
-`@ViewChildren(myPredicate) myChildComponents;`|`@ViewChildren(myPredicate)`
-syntax(js):
-`ng.core.ViewChildren(myPredicate,
-    'myChildComponents', myComponent);`|`ng.core.ViewChildren(myPredicate,`|`);`
-description:
-Binds the results of the component view query (`myPredicate`) to a property (`myChildComponents`) of the class. Not available for directives.

aio/content/cheatsheet/directive-configuration.md

@@ -1,23 +0,0 @@
-@cheatsheetSection
-Directive configuration
-@cheatsheetIndex 6
-@description
-{@target ts}`@Directive({ property1: value1, ... })`{@endtarget}
-{@target js}`ng.core.Directive({ property1: value1, ... }).Class({...})`{@endtarget}
-
-@cheatsheetItem
-syntax:
-`selector: '.cool-button:not(a)'`|`selector:`
-description:
-Specifies a CSS selector that identifies this directive within a template. Supported selectors include `element`,
-`[attribute]`, `.class`, and `:not()`.
-
-Does not support parent-child relationship selectors.
-
-@cheatsheetItem
-syntax(ts):
-`providers: [MyService, { provide: ... }]`|`providers:`
-syntax(js):
-`providers: [MyService, { provide: ... }]`|`providers:`
-description:
-List of dependency injection providers for this directive and its children.

aio/content/cheatsheet/forms.md

@@ -1,12 +0,0 @@
-@cheatsheetSection
-Forms
-@cheatsheetIndex 4
-@description
-{@target ts}`import { FormsModule } from '@angular/forms';`{@endtarget}
-{@target js}Available using the `ng.forms.FormsModule` module{@endtarget}
-
-@cheatsheetItem
-syntax:
-`<input [(ngModel)]="userName">`|`[(ngModel)]`
-description:
-Provides two-way data-binding, parsing, and validation for form controls.

aio/content/cheatsheet/lifecycle hooks.md

@@ -1,86 +0,0 @@
-@cheatsheetSection
-Directive and component change detection and lifecycle hooks
-@cheatsheetIndex 9
-@description
-{@target ts}(implemented as class methods){@endtarget}
-{@target js}(implemented as component properties){@endtarget}
-
-@cheatsheetItem
-syntax(ts):
-`constructor(myService: MyService, ...) { ... }`|`constructor(myService: MyService, ...)`
-syntax(js):
-`constructor: function(MyService, ...) { ... }`|`constructor: function(MyService, ...)`
-description:
-Called before any other lifecycle hook. Use it to inject dependencies, but avoid any serious work here.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngOnChanges(changeRecord) { ... }`|`ngOnChanges(changeRecord)`
-syntax(js):
-`ngOnChanges: function(changeRecord) { ... }`|`ngOnChanges: function(changeRecord)`
-description:
-Called after every change to input properties and before processing content or child views.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngOnInit() { ... }`|`ngOnInit()`
-syntax(js):
-`ngOnInit: function() { ... }`|`ngOnInit: function()`
-description:
-Called after the constructor, initializing input properties, and the first call to `ngOnChanges`.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngDoCheck() { ... }`|`ngDoCheck()`
-syntax(js):
-`ngDoCheck: function() { ... }`|`ngDoCheck: function()`
-description:
-Called every time that the input properties of a component or a directive are checked. Use it to extend change detection by performing a custom check.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngAfterContentInit() { ... }`|`ngAfterContentInit()`
-syntax(js):
-`ngAfterContentInit: function() { ... }`|`ngAfterContentInit: function()`
-description:
-Called after `ngOnInit` when the component's or directive's content has been initialized.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngAfterContentChecked() { ... }`|`ngAfterContentChecked()`
-syntax(js):
-`ngAfterContentChecked: function() { ... }`|`ngAfterContentChecked: function()`
-description:
-Called after every check of the component's or directive's content.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngAfterViewInit() { ... }`|`ngAfterViewInit()`
-syntax(js):
-`ngAfterViewInit: function() { ... }`|`ngAfterViewInit: function()`
-description:
-Called after `ngAfterContentInit` when the component's view has been initialized. Applies to components only.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngAfterViewChecked() { ... }`|`ngAfterViewChecked()`
-syntax(js):
-`ngAfterViewChecked: function() { ... }`|`ngAfterViewChecked: function()`
-description:
-Called after every check of the component's view. Applies to components only.
-
-
-@cheatsheetItem
-syntax(ts):
-`ngOnDestroy() { ... }`|`ngOnDestroy()`
-syntax(js):
-`ngOnDestroy: function() { ... }`|`ngOnDestroy: function()`
-description:
-Called once, before the instance is destroyed.

aio/content/cheatsheet/ngmodules.md

@@ -1,58 +0,0 @@
-@cheatsheetSection
-NgModules
-@cheatsheetIndex 1
-@description
-{@target ts}`import { NgModule } from '@angular/core';`{@endtarget}
-{@target js}Available from the `ng.core` namespace{@endtarget}
-
-@cheatsheetItem
-syntax(ts):
-`@NgModule({ declarations: ..., imports: ...,
-     exports: ..., providers: ..., bootstrap: ...})
-class MyModule {}`|`NgModule`
-description:
-Defines a module that contains components, directives, pipes, and providers.
-
-syntax(js):
-`ng.core.NgModule({declarations: ..., imports: ...,
-     exports: ..., providers: ..., bootstrap: ...}).
-Class({ constructor: function() {}})`
-description:
-Defines a module that contains components, directives, pipes, and providers.
-
-@cheatsheetItem
-syntax:
-`declarations: [MyRedComponent, MyBlueComponent, MyDatePipe]`|`declarations:`
-description:
-List of components, directives, and pipes that belong to this module.
-
-@cheatsheetItem
-syntax(ts):
-`imports: [BrowserModule, SomeOtherModule]`|`imports:`
-description:
-List of modules to import into this module. Everything from the imported modules
-is available to `declarations` of this module.
-
-syntax(js):
-`imports: [ng.platformBrowser.BrowserModule, SomeOtherModule]`|`imports:`
-description:
-List of modules to import into this module. Everything from the imported modules
-is available to `declarations` of this module.
-
-@cheatsheetItem
-syntax:
-`exports: [MyRedComponent, MyDatePipe]`|`exports:`
-description:
-List of components, directives, and pipes visible to modules that import this module.
-
-@cheatsheetItem
-syntax:
-`providers: [MyService, { provide: ... }]`|`providers:`
-description:
-List of dependency injection providers visible both to the contents of this module and to importers of this module.
-
-@cheatsheetItem
-syntax:
-`bootstrap: [MyAppComponent]`|`bootstrap:`
-description:
-List of components to bootstrap when this module is bootstrapped.

aio/content/cheatsheet/routing.md

@@ -1,170 +0,0 @@
-@cheatsheetSection
-Routing and navigation
-@cheatsheetIndex 11
-@description
-{@target ts}`import { Routes, RouterModule, ... } from '@angular/router';`{@endtarget}
-{@target js}Available from the `ng.router` namespace{@endtarget}
-
-
-@cheatsheetItem
-syntax(ts):
-`const routes: Routes = [
-  { path: '', component: HomeComponent },
-  { path: 'path/:routeParam', component: MyComponent },
-  { path: 'staticPath', component: ... },
-  { path: '**', component: ... },
-  { path: 'oldPath', redirectTo: '/staticPath' },
-  { path: ..., component: ..., data: { message: 'Custom' } }
-]);
-
-const routing = RouterModule.forRoot(routes);`|`Routes`
-syntax(js):
-`var routes = [
-  { path: '', component: HomeComponent },
-  { path: ':routeParam', component: MyComponent },
-  { path: 'staticPath', component: ... },
-  { path: '**', component: ... },
-  { path: 'oldPath', redirectTo: '/staticPath' },
-  { path: ..., component: ..., data: { message: 'Custom' } }
-]);
-
-var routing = ng.router.RouterModule.forRoot(routes);`|`ng.router.Routes`
-description:
-Configures routes for the application. Supports static, parameterized, redirect, and wildcard routes. Also supports custom route data and resolve.
-
-
-@cheatsheetItem
-syntax:
-`
-<router-outlet></router-outlet>
-<router-outlet name="aux"></router-outlet>
-`|`router-outlet`
-description:
-Marks the location to load the component of the active route.
-
-
-@cheatsheetItem
-syntax:
-`
-<a routerLink="/path">
-<a [routerLink]="[ '/path', routeParam ]">
-<a [routerLink]="[ '/path', { matrixParam: 'value' } ]">
-<a [routerLink]="[ '/path' ]" [queryParams]="{ page: 1 }">
-<a [routerLink]="[ '/path' ]" fragment="anchor">
-`|`[routerLink]`
-description:
-Creates a link to a different view based on a route instruction consisting of a route path, required and optional parameters, query parameters, and a fragment. To navigate to a root route, use the `/` prefix; for a child route, use the `./`prefix; for a sibling or parent, use the `../` prefix.
-
-@cheatsheetItem
-syntax:
-`<a [routerLink]="[ '/path' ]" routerLinkActive="active">`
-description:
-The provided classes are added to the element when the `routerLink` becomes the current active route.
-
-@cheatsheetItem
-syntax(ts):
-`class CanActivateGuard implements CanActivate {
-    canActivate(
-      route: ActivatedRouteSnapshot,
-      state: RouterStateSnapshot
-    ): Observable<boolean>|Promise<boolean>|boolean { ... }
-}
-
-{ path: ..., canActivate: [CanActivateGuard] }`|`CanActivate`
-syntax(js):
-`var CanActivateGuard = ng.core.Class({
-  canActivate: function(route, state) {
-    // return Observable/Promise boolean or boolean
-  }
-});
-
-{ path: ..., canActivate: [CanActivateGuard] }`|`CanActivate`
-description:
-An interface for defining a class that the router should call first to determine if it should activate this component. Should return a boolean or an Observable/Promise that resolves to a boolean.
-
-@cheatsheetItem
-syntax(ts):
-`class CanDeactivateGuard implements CanDeactivate<T> {
-    canDeactivate(
-      component: T,
-      route: ActivatedRouteSnapshot,
-      state: RouterStateSnapshot
-    ): Observable<boolean>|Promise<boolean>|boolean { ... }
-}
-
-{ path: ..., canDeactivate: [CanDeactivateGuard] }`|`CanDeactivate`
-syntax(js):
-`var CanDeactivateGuard = ng.core.Class({
-  canDeactivate: function(component, route, state) {
-    // return Observable/Promise boolean or boolean
-  }
-});
-
-{ path: ..., canDeactivate: [CanDeactivateGuard] }`|`CanDeactivate`
-description:
-An interface for defining a class that the router should call first to determine if it should deactivate this component after a navigation. Should return a boolean or an Observable/Promise that resolves to a boolean.
-
-@cheatsheetItem
-syntax(ts):
-`class CanActivateChildGuard implements CanActivateChild {
-    canActivateChild(
-      route: ActivatedRouteSnapshot,
-      state: RouterStateSnapshot
-    ): Observable<boolean>|Promise<boolean>|boolean { ... }
-}
-
-{ path: ..., canActivateChild: [CanActivateGuard],
-    children: ... }`|`CanActivateChild`
-syntax(js):
-`var CanActivateChildGuard = ng.core.Class({
-  canActivateChild: function(route, state) {
-    // return Observable/Promise boolean or boolean
-  }
-});
-
-{ path: ..., canActivateChild: [CanActivateChildGuard],
-    children: ... }`|`CanActivateChild`
-description:
-An interface for defining a class that the router should call first to determine if it should activate the child route. Should return a boolean or an Observable/Promise that resolves to a boolean.
-
-@cheatsheetItem
-syntax(ts):
-`class ResolveGuard implements Resolve<T> {
-    resolve(
-      route: ActivatedRouteSnapshot,
-      state: RouterStateSnapshot
-    ): Observable<any>|Promise<any>|any { ... }
-}
-
-{ path: ..., resolve: [ResolveGuard] }`|`Resolve`
-syntax(js):
-`var ResolveGuard = ng.core.Class({
-  resolve: function(route, state) {
-    // return Observable/Promise value or value
-  }
-});
-
-{ path: ..., resolve: [ResolveGuard] }`|`Resolve`
-description:
-An interface for defining a class that the router should call first to resolve route data before rendering the route. Should return a value or an Observable/Promise that resolves to a value.
-
-@cheatsheetItem
-syntax(ts):
-`class CanLoadGuard implements CanLoad {
-    canLoad(
-      route: Route
-    ): Observable<boolean>|Promise<boolean>|boolean { ... }
-}
-
-{ path: ..., canLoad: [CanLoadGuard], loadChildren: ... }`|`CanLoad`
-syntax(js):
-`var CanLoadGuard = ng.core.Class({
-  canLoad: function(route) {
-    // return Observable/Promise boolean or boolean
-  }
-});
-
-{ path: ..., canLoad: [CanLoadGuard], loadChildren: ... }`|`CanLoad`
-description:
-An interface for defining a class that the router should call first to check if the lazy loaded module should be loaded. Should return a boolean or an Observable/Promise that resolves to a boolean.
-

aio/content/cheatsheet/template-syntax.md

@@ -1,94 +0,0 @@
-@cheatsheetSection
-Template syntax
-@cheatsheetIndex 2
-@description
-
-@cheatsheetItem
-syntax:
-`<input [value]="firstName">`|`[value]`
-description:
-Binds property `value` to the result of expression `firstName`.
-
-@cheatsheetItem
-syntax:
-`<div [attr.role]="myAriaRole">`|`[attr.role]`
-description:
-Binds attribute `role` to the result of expression `myAriaRole`.
-
-@cheatsheetItem
-syntax:
-`<div [class.extra-sparkle]="isDelightful">`|`[class.extra-sparkle]`
-description:
-Binds the presence of the CSS class `extra-sparkle` on the element to the truthiness of the expression `isDelightful`.
-
-@cheatsheetItem
-syntax:
-`<div [style.width.px]="mySize">`|`[style.width.px]`
-description:
-Binds style property `width` to the result of expression `mySize` in pixels. Units are optional.
-
-@cheatsheetItem
-syntax:
-`<button (click)="readRainbow($event)">`|`(click)`
-description:
-Calls method `readRainbow` when a click event is triggered on this button element (or its children) and passes in the event object.
-
-@cheatsheetItem
-syntax:
-`<div title="Hello {{ponyName}}">`|`{{ponyName}}`
-description:
-Binds a property to an interpolated string, for example, "Hello Seabiscuit". Equivalent to:
-`<div [title]="'Hello ' + ponyName">`
-
-@cheatsheetItem
-syntax:
-`<p>Hello {{ponyName}}</p>`|`{{ponyName}}`
-description:
-Binds text content to an interpolated string, for example, "Hello Seabiscuit".
-
-@cheatsheetItem
-syntax:
-`<my-cmp [(title)]="name">`|`[(title)]`
-description:
-Sets up two-way data binding. Equivalent to: `<my-cmp [title]="name" (titleChange)="name=$event">`
-
-@cheatsheetItem
-syntax:
-`<video #movieplayer ...>
-  <button (click)="movieplayer.play()">
-</video>`|`#movieplayer`|`(click)`
-description:
-Creates a local variable `movieplayer` that provides access to the `video` element instance in data-binding and event-binding expressions in the current template.
-
-@cheatsheetItem
-syntax:
-`<p *myUnless="myExpression">...</p>`|`*myUnless`
-description:
-The `*` symbol turns the current element into an embedded template. Equivalent to:
-`<ng-template [myUnless]="myExpression"><p>...</p></ng-template>`
-
-@cheatsheetItem
-syntax:
-`<p>Card No.: {{cardNumber | myCardNumberFormatter}}</p>`|`{{cardNumber | myCardNumberFormatter}}`
-description:
-Transforms the current value of expression `cardNumber` via the pipe called `myCardNumberFormatter`.
-
-@cheatsheetItem
-syntax:
-`<p>Employer: {{employer?.companyName}}</p>`|`{{employer?.companyName}}`
-description:
-The safe navigation operator (`?`) means that the `employer` field is optional and if `undefined`, the rest of the expression should be ignored.
-
-@cheatsheetItem
-syntax:
-`<svg:rect x="0" y="0" width="100" height="100"/>`|`svg:`
-description:
-An SVG snippet template needs an `svg:` prefix on its root element to disambiguate the SVG element from an HTML component.
-
-@cheatsheetItem
-syntax:
-`<svg>
-  <rect x="0" y="0" width="100" height="100"/>
-</svg>`|`svg`
-description:
-An `<svg>` root element is detected as an SVG element automatically, without the prefix.

aio/content/cookbook/aot-compiler.md

@@ -1,623 +0,0 @@
-@title
-Ahead-of-Time Compilation
-
-@intro
-Learn how to use Ahead-of-time compilation
-
-@description
-This cookbook describes how to radically improve performance by compiling _Ahead of Time_ (AOT)
-during a build process.
-
-
-{@a toc}
-## Table of Contents
-* [Overview](#overview)
-* [_Ahead-of-Time_ vs _Just-in-Time_](#aot-jit)
-* [Compile with AOT](#compile)
-* [Bootstrap](#bootstrap)
-* [Tree Shaking](#tree-shaking)
-* [Load the bundle](#load)
-* [Serve the app](#serve)
-* [Workflow and convenience script](#workflow)
-* [Source Code](#source-code)
-* [Tour of Heroes](#toh)
-
-
-{@a overview}
-
-## Overview
-
-An Angular application consist largely of components and their HTML templates.
-Before the browser can render the application,
-the components and templates must be converted to executable JavaScript by the _Angular compiler_.
-<a href="https://www.youtube.com/watch?v=kW9cJsvcsGo" target="_blank">Watch compiler author Tobias Bosch explain the Angular Compiler</a> at AngularConnect 2016.You can compile the app in the browser, at runtime, as the application loads, using the **_Just-in-Time_ (JIT) compiler**.
-This is the standard development approach shown throughout the documentation.
-It's great .. but it has shortcomings.
-
-JIT compilation incurs a runtime performance penalty.
-Views take longer to render because of the in-browser compilation step.
-The application is bigger because it includes the Angular compiler
-and a lot of library code that the application won't actually need.
-Bigger apps take longer to transmit and are slower to load.
-
-Compilation can uncover many component-template binding errors.
-JIT compilation discovers them at runtime which is later than we'd like.
-
-The **_Ahead-of-Time_ (AOT) compiler** can catch template errors early and improve performance
-by compiling at build time as you'll learn in this chapter.
-
-
-
-{@a aot-jit}
-
-## _Ahead-of-time_ (AOT) vs _Just-in-time_ (JIT)
-
-There is actually only one Angular compiler. The difference between AOT and JIT is a matter of timing and tooling.
-With AOT, the compiler runs once at build time using one set of libraries;
-With JIT it runs every time for every user at runtime using a different set of libraries.
-
-### Why do AOT compilation?
-
-*Faster rendering*
-
-With AOT, the browser downloads a pre-compiled version of the application.
-The browser loads executable code so it can render the application immediately, without waiting to compile the app first.
-
-*Fewer asynchronous requests*
-
-The compiler _inlines_ external html templates and css style sheets within the application JavaScript,
-eliminating separate ajax requests for those source files.
-
-*Smaller Angular framework download size*
-
-There's no need to download the Angular compiler if the app is already compiled.
-The compiler is roughly half of Angular itself, so omitting it dramatically reduces the application payload.
-
-
-*Detect template errors earlier*
-
-The AOT compiler detects and reports template binding errors during the build step
-before users can see them.
-
-
-*Better security*
-
-AOT compiles HTML templates and components into JavaScript files long before they are served to the client.
-With no templates to read and no risky client-side HTML or JavaScript evaluation,
-there are fewer opportunities for injection attacks.
-
-
-{@a compile}
-
-## Compile with AOT
-
-### Prepare for offline compilation
-Take the <a href='../guide/setup.html'>Setup</a> as a starting point.
-A few minor changes to the lone `app.component` lead to these two class and html files:
-
-<md-tab-group>
-
-  <md-tab label="src/app/app.component.html">
-    {@example 'cb-aot-compiler/ts/src/app/app.component.html'}
-  </md-tab>
-
-
-  <md-tab label="src/app/app.component.ts">
-    {@example 'cb-aot-compiler/ts/src/app/app.component.ts'}
-  </md-tab>
-
-
-</md-tab-group>
-
-Install a few new npm dependencies with the following command:
-<code-example language="none" class="code-shell">
-  npm install @angular/compiler-cli @angular/platform-server --save
-</code-example>
-
-You will run the `ngc` compiler provided in the `@angular/compiler-cli` npm package
-instead of the TypeScript compiler (`tsc`).
-
-`ngc` is a drop-in replacement for `tsc` and is configured much the same way.
-
-`ngc` requires its own `tsconfig.json` with AOT-oriented settings.
-Copy the original `src/tsconfig.json` to a file called `tsconfig-aot.json` (on the project root),
-then modify it to look as follows.
-
-
-{@example 'cb-aot-compiler/ts/tsconfig-aot.json'}
-
-The `compilerOptions` section is unchanged except for one property.
-**Set the `module` to `es2015`**.
-This is important as explained later in the [Tree Shaking](#tree-shaking) section.
-
-What's really new is the `ngc` section at the bottom called `angularCompilerOptions`.
-Its `"genDir"` property tells the compiler
-to store the compiled output files in a new `aot` folder.
-
-The `"skipMetadataEmit" : true` property prevents the compiler from generating metadata files with the compiled application.
-Metadata files are not necessary when targeting TypeScript files, so there is no reason to include them.
-***Component-relative Template URLS***
-
-The AOT compiler requires that `@Component` URLS for external templates and css files be _component-relative_.
-That means that the value of `@Component.templateUrl` is a URL value _relative_ to the component class file.
-For example, an `'app.component.html'` URL means that the template file is a sibling of its companion `app.component.ts` file.
-
-While JIT app URLs are more flexible, stick with _component-relative_ URLs for compatibility with AOT compilation.
-
-JIT-compiled applications that use the SystemJS loader and _component-relative_ URLs *must set the* `@Component.moduleId` *property to* `module.id`.
-The `module` object is undefined when an AOT-compiled app runs.
-The app fails with a null reference error unless you assign a global `module` value in the `index.html` like this:
-
-{@example 'cb-aot-compiler/ts/src/index.html' region='moduleId'}
-
-
-Setting a global `module` is a temporary expedient.
-### Compiling the application
-
-Initiate AOT compilation from the command line using the previously installed `ngc` compiler by executing:
-<code-example language="none" class="code-shell">
-  node_modules/.bin/ngc -p tsconfig-aot.json
-</code-example>
-
-
-Windows users should surround the `ngc` command in double quotes:
-<code-example format='.'>
-  "node_modules/.bin/ngc" -p tsconfig-aot.json
-</code-example>
-
-`ngc` expects the `-p` switch to point to a `tsconfig.json` file or a folder containing a `tsconfig.json` file.
-
-After `ngc` completes, look for a collection of _NgFactory_ files in the `aot` folder (the folder specified as `genDir` in `tsconfig-aot.json`).
-
-These factory files are essential to the compiled application.
-Each component factory creates an instance of the component at runtime by combining the original class file
-and a JavaScript representation of the component's template.
-Note that the original component class is still referenced internally by the generated factory.
-The curious can open the `aot/app.component.ngfactory.ts` to see the original Angular template syntax
-in its intermediate, compiled-to-TypeScript form.
-
-JIT compilation generates these same _NgFactories_ in memory where they are largely invisible.
-AOT compilation reveals them as separate, physical files.
-
-
-~~~ {.alert.is-important}
-
-Do not edit the _NgFactories_! Re-compilation replaces these files and all edits will be lost.
-
-
-~~~
-
-
-
-{@a bootstrap}
-
-## Bootstrap
-
-The AOT path changes application bootstrapping.
-
-Instead of bootstrapping `AppModule`, you bootstrap the application with the generated module factory, `AppModuleNgFactory`.
-
-Make a copy of `main.ts` and name it `main-jit.ts`.
-This is the JIT version; set it aside as you may need it [later](#run-jit "Running with JIT").
-
-Open `main.ts` and convert it to AOT compilation.
-Switch from the `platformBrowserDynamic.bootstrap` used in JIT compilation to
-`platformBrowser().bootstrapModuleFactory` and pass in the AOT-generated `AppModuleNgFactory`.
-
-Here is AOT bootstrap in `main.ts` next to the original JIT version:
-
-<md-tab-group>
-
-  <md-tab label="src/main.ts">
-    {@example 'cb-aot-compiler/ts/src/main.ts'}
-  </md-tab>
-
-
-  <md-tab label="src/main-jit.ts">
-    {@example 'cb-aot-compiler/ts/src/main-jit.ts'}
-  </md-tab>
-
-
-</md-tab-group>
-
-Be sure to recompile with `ngc`!
-
-
-{@a tree-shaking}
-## Tree Shaking
-
-AOT compilation sets the stage for further optimization through a process called _Tree Shaking_.
-A Tree Shaker walks the dependency graph, top to bottom, and _shakes out_ unused code like
-dead needles in a Christmas tree.
-
-Tree Shaking can greatly reduce the downloaded size of the application
-by removing unused portions of both source and library code.
-In fact, most of the reduction in small apps comes from removing unreferenced Angular features.
-
-For example, this demo application doesn't use anything from the `@angular/forms` library.
-There is no reason to download Forms-related Angular code and tree shaking ensures that you don't.
-
-Tree Shaking and AOT compilation are separate steps.
-Tree Shaking can only target JavaScript code.
-AOT compilation converts more of the application to JavaScript,
-which in turn makes more of the application "Tree Shakable".
-
-### Rollup
-
-This cookbook illustrates a Tree Shaking utility called _Rollup_.
-
-Rollup statically analyzes the application by following the trail of `import` and `export` statements.
-It produces a final code _bundle_ that excludes code that is exported, but never imported.
-
-Rollup can only Tree Shake `ES2015` modules which have `import` and `export` statements.
-Recall that `tsconfig-aot.json` is configured to produce `ES2015` modules.
-It's not important that the code itself be written with `ES2015` syntax such as `class` and `const`.
-What matters is that the code uses ES `import` and `export` statements rather than `require` statements.Install the Rollup dependencies with this command:
-<code-example format='.'>
-  npm install rollup rollup-plugin-node-resolve rollup-plugin-commonjs rollup-plugin-uglify --save-dev
-</code-example>
-
-Next, create a configuration file (`rollup-config.js`)
-in the project root directory to tell Rollup how to process the application.
-The cookbook configuration file looks like this.
-
-
-{@example 'cb-aot-compiler/ts/rollup-config.js'}
-
-It tells Rollup that the app entry point is `src/app/main.js` .
-The `dest` attribute tells Rollup to create a bundle called `build.js` in the `dist` folder.
-It overrides the default `onwarn` method in order to skip annoying messages about the AOT compiler's use of the `this` keyword.
-
-Then there are plugins.
-### Rollup Plugins
-
-Optional plugins filter and transform the Rollup inputs and output.
-
-*RxJS*
-Rollup expects application source code to use `ES2015` modules.
-Not all external dependencies are published as `ES2015` modules.
-In fact, most are not. Many of them are published as _CommonJS_ modules.
-
-The _RxJs_ observable library is an essential Angular dependency published as an ES5 JavaScript _CommonJS_ module.
-
-Luckily there is a Rollup plugin that modifies _RxJs_
-to use the ES `import` and `export` statements that Rollup requires.
-Rollup then preserves in the final bundle the parts of `RxJS` referenced by the application.
-
-
-{@example 'cb-aot-compiler/ts/rollup-config.js' region='commonjs'}
-
-*Minification*
-
-Rollup Tree Shaking reduces code size considerably.  Minification makes it smaller still.
-This cookbook relies on the _uglify_ Rollup plugin to minify and mangle the code.
-
-
-{@example 'cb-aot-compiler/ts/rollup-config.js' region='uglify'}
-
-
-In a production setting, you would also enable gzip on the web server to compress
-the code into an even smaller package going over the wire.
-### Run Rollup
-Execute the Rollup process with this command:
-<code-example format='.'>
-  node_modules/.bin/rollup -c rollup-config.js
-</code-example>
-
-
-Windows users should surround the `rollup` command in double quotes:
-<code-example format='.'>
-  "node_modules/.bin/rollup"  -c rollup-config.js
-</code-example>
-
-
-
-{@a load}
-
-## Load the Bundle
-
-Loading the generated application bundle does not require a module loader like SystemJS.
-Remove the scripts that concern SystemJS.
-Instead, load the bundle file using a single `script` tag **_after_** the `</body>` tag:
-
-
-{@example 'cb-aot-compiler/ts/src/index.html' region='bundle'}
-
-
-
-{@a serve}
-
-## Serve the app
-
-You'll need a web server to host the application.
-Use the same _Lite Server_ employed elsewhere in the documentation:
-<code-example language="none" class="code-shell">
-  npm run lite
-</code-example>
-
-The server starts, launches a browser, and the app should appear.
-
-
-{@a source-code}
-
-## AOT QuickStart Source Code
-
-Here's the pertinent source code:
-<md-tab-group>
-
-  <md-tab label="src/app/app.component.html">
-    {@example 'cb-aot-compiler/ts/src/app/app.component.html'}
-  </md-tab>
-
-
-  <md-tab label="src/app/app.component.ts">
-    {@example 'cb-aot-compiler/ts/src/app/app.component.ts'}
-  </md-tab>
-
-
-  <md-tab label="src/main.ts">
-    {@example 'cb-aot-compiler/ts/src/main.ts'}
-  </md-tab>
-
-
-  <md-tab label="src/index.html">
-    {@example 'cb-aot-compiler/ts/src/index.html'}
-  </md-tab>
-
-
-  <md-tab label="tsconfig-aot.json">
-    {@example 'cb-aot-compiler/ts/tsconfig-aot.json'}
-  </md-tab>
-
-
-  <md-tab label="rollup-config.js">
-    {@example 'cb-aot-compiler/ts/rollup-config.js'}
-  </md-tab>
-
-
-</md-tab-group>
-
-
-
-{@a workflow}
-
-## Workflow and convenience script
-
-You'll rebuild the AOT version of the application every time you make a change.
-Those _npm_ commands are long and difficult to remember.
-
-Add the following _npm_ convenience script to the `package.json` so you can compile and rollup in one command.Open a terminal window and try it.
-<code-example language="none" class="code-shell">
-  npm run build:aot  
-    
-</code-example>
-
-
-
-{@a run-jit}
-### And JIT too!
-
-AOT compilation and rollup together take several seconds.
-You may be able to develop iteratively a little faster with SystemJS and JIT.
-The same source code can be built both ways. Here's one way to do that.
-
-* Make a copy of `index.html` and call it `index-jit.html`.
-* Delete the script at the bottom of `index-jit.html` that loads `bundle.js`
-* Restore the SystemJS scripts like this:
-
-{@example 'cb-aot-compiler/ts/src/index-jit.html' region='jit'}
-
-Notice the slight change to the `system.import` which now specifies `src/app/main-jit`.
-That's the JIT version of the bootstrap file that we preserved [above](#bootstrap)
-Open a _different_ terminal window and enter.
-<code-example language="none" class="code-shell">
-  npm start
-</code-example>
-
-That compiles the app with JIT and launches the server.
-The server loads `index.html` which is still the AOT version (confirm in the browser console).
-Change the address bar to `index-jit.html` and it loads the JIT version (confirm in the browser console).
-
-Develop as usual.
-The server and TypeScript compiler are in "watch mode" so your changes are reflected immediately in the browser.
-
-To see those changes in AOT, switch to the original terminal and re-run `npm run build:aot`.
-When it finishes, go back to the browser and back-button to the AOT version in the (default) `index.html`.
-
-Now you can develop JIT and AOT, side-by-side.
-
-
-
-{@a toh}
-
-## Tour of Heroes
-
-The sample above is a trivial variation of the QuickStart app.
-In this section you apply what you've learned about AOT compilation and Tree Shaking
-to an app with more substance, the tutorial [_Tour of Heroes_](../tutorial/toh-pt6.html).
-
-### JIT in development, AOT in production
-
-Today AOT compilation and Tree Shaking take more time than is practical for development. That will change soon.
-For now, it's best to JIT compile in development and switch to AOT compilation before deploying to production.
-
-Fortunately, the source code can be compiled either way without change _if_ you account for a few key differences.
-
-***index.html***
-
-The JIT and AOT apps require their own `index.html` files because they setup and launch so differently.
-
-Here they are for comparison:
-
-<md-tab-group>
-
-  <md-tab label="aot/index.html (AOT)">
-    {@example 'toh-6/ts/aot/index.html'}
-  </md-tab>
-
-
-  <md-tab label="src/index.html (JIT)">
-    {@example 'toh-6/ts/src/index.html'}
-  </md-tab>
-
-
-</md-tab-group>
-
-The JIT version relies on `SystemJS` to load individual modules.
-Its scripts appear in its `index.html`.
-
-The AOT version loads the entire application in a single script, `aot/dist/build.js`.
-It does not need `SystemJS`, so that script is absent from its `index.html`
-
-***main.ts***
-
-JIT and AOT applications boot in much the same way but require different Angular libraries to do so.
-The key differences, covered in the [Bootstrap](#bootstrap) section above,
-are evident in these `main` files which can and should reside in the same folder:
-
-<md-tab-group>
-
-  <md-tab label="main-aot.ts (AOT)">
-    {@example 'toh-6/ts/src/main-aot.ts'}
-  </md-tab>
-
-
-  <md-tab label="main.ts (JIT)">
-    {@example 'toh-6/ts/src/main.ts'}
-  </md-tab>
-
-
-</md-tab-group>
-
-***TypeScript configuration***
-
-JIT-compiled applications transpile to `commonjs` modules.
-AOT-compiled applications transpile to _ES2015_/_ES6_ modules to facilitate Tree Shaking.
-AOT requires its own TypeScript configuration settings as well.
-
-You'll need separate TypeScript configuration files such as these:
-
-<md-tab-group>
-
-  <md-tab label="tsconfig-aot.json (AOT)">
-    {@example 'toh-6/ts/tsconfig-aot.json'}
-  </md-tab>
-
-
-  <md-tab label="src/tsconfig.json (JIT)">
-    {@example 'toh-6/ts/src/tsconfig.1.json'}
-  </md-tab>
-
-
-</md-tab-group>
-
-
-
-~~~ {.callout.is-helpful}
-
-
-<header>
-  @Types and node modules
-</header>
-
-In the file structure of _this particular sample project_,
-the `node_modules` folder happens to be two levels up from the project root.
-Therefore, `"typeRoots"` must be set to `"../../node_modules/@types/"`.
-
-In a more typical project, `node_modules` would be a sibling of `tsconfig-aot.json`
-and `"typeRoots"` would be set to `"node_modules/@types/"`.
-Edit your `tsconfig-aot.json` to fit your project's file structure.
-
-
-~~~
-
-### Tree Shaking
-
-Rollup does the Tree Shaking as before.
-
-
-{@example 'toh-6/ts/rollup-config.js'}
-
-### Running the application
-
-
-~~~ {.alert.is-important}
-
-The general audience instructions for running the AOT build of the Tour of Heroes app are not ready.
-
-The following instructions presuppose that you have cloned the
-<a href="https://github.com/angular/angular.io" target="_blank">angular.io</a>
-github repository and prepared it for development as explained in the repo's README.md.
-
-The _Tour of Heroes_ source code is in the `public/docs/_examples/toh-6/ts` folder.
-
-~~~
-
-Run the JIT-compiled app with `npm start` as for all other JIT examples.
-
-Compiling with AOT presupposes certain supporting files, most of them discussed above.
-<md-tab-group>
-
-  <md-tab label="src/index.html">
-    {@example 'toh-6/ts/src/index.html'}
-  </md-tab>
-
-
-  <md-tab label="copy-dist-files.js">
-    {@example 'toh-6/ts/copy-dist-files.js'}
-  </md-tab>
-
-
-  <md-tab label="rollup-config.js">
-    {@example 'toh-6/ts/rollup-config.js'}
-  </md-tab>
-
-
-  <md-tab label="tsconfig-aot.json">
-    {@example 'toh-6/ts/tsconfig-aot.json'}
-  </md-tab>
-
-
-</md-tab-group>
-
-Extend the `scripts` section of the `package.json` with these npm scripts:Copy the AOT distribution files into the `/aot` folder with the node script:
-<code-example language="none" class="code-shell">
-  node copy-dist-files
-</code-example>
-
-
-You won't do that again until there are updates to `zone.js` or the `core-js` shim for old browsers.Now AOT-compile the app and launch it with the `lite` server:
-<code-example language="none" class="code-shell">
-  npm run build:aot && npm run serve:aot  
-    
-</code-example>
-
-### Inspect the Bundle
-
-It's fascinating to see what the generated JavaScript bundle looks like after Rollup.
-The code is minified, so you won't learn much from inspecting the bundle directly.
-But the <a href="https://github.com/danvk/source-map-explorer/blob/master/README.md" target="_blank">source-map-explorer</a>
-tool can be quite revealing.
-
-Install it:
-<code-example language="none" class="code-shell">
-  npm install source-map-explorer --save-dev
-</code-example>
-
-Run the following command to generate the map.
-
-<code-example language="none" class="code-shell">
-  node_modules/.bin/source-map-explorer aot/dist/build.js  
-    
-</code-example>
-
-The `source-map-explorer` analyzes the source map generated with the bundle and draws a map of all dependencies,
-showing exactly which application and Angular modules and classes are included in the bundle.
-
-Here's the map for _Tour of Heroes_.
-<a href="/resources/images/cookbooks/aot-compiler/toh6-bundle.png" target="_blank" title="View larger image">
-<figure class='image-display'>
-  <img src="/resources/images/cookbooks/aot-compiler/toh6-bundle.png" alt="TOH-6-bundle">  </img>
-</figure>
-
-</a>