@pipeline-builder/api-core 0.0.1

package/lib/services/token-revocation.d.ts

@@ -0,0 +1,52 @@
+import type { RedisCacheClient } from './cache-service.js';
+import type { TokenRevocationStore } from '../middleware/auth.js';
+/**
+ * Redis key namespace for the per-user current `tokenVersion`. The platform
+ * PUBLISHES to this key on every privilege change; the stateless services READ
+ * it in `requireAuth` (via {@link createRedisTokenRevocationStore}) to reject
+ * tokens minted before that change. Publisher and readers MUST share this exact
+ * prefix — hence both helpers live here, in one place.
+ */
+export declare const TOKEN_REVOCATION_KEY_PREFIX = "authrev:tv:";
+/** The revocation key for a user id. */
+export declare function tokenRevocationKey(userId: string): string;
+/**
+ * Build a {@link TokenRevocationStore} backed by a Redis client, for a stateless
+ * service to register via `setTokenRevocationStore`. Reads the current
+ * `tokenVersion` the platform published for the user.
+ *
+ * Fail-open by contract: a miss, a parse failure, or a Redis error all yield
+ * `null` (— `requireAuth` treats that as "no known revocation"), so a Redis
+ * outage degrades to the pre-existing behaviour rather than locking users out.
+ */
+export declare function createRedisTokenRevocationStore(redis: RedisCacheClient): TokenRevocationStore;
+/**
+ * Build a {@link TokenRevocationStore} backed by a Redis client that is lazily
+ * constructed from the standard `REDIS_URL` or `REDIS_HOST`/`REDIS_PORT` env —
+ * for a stateless service that keeps NO Redis client of its own. The client is
+ * built on first `getCurrentVersion` call and memoized; `ioredis` is loaded via
+ * a guarded dynamic require so merely importing this never breaks a build/test
+ * where Redis isn't present.
+ *
+ * FULLY FAIL-OPEN: no env configured, an ioredis load failure, a connect error,
+ * or any read failure all resolve to `null` ("no known revocation"), so a
+ * service degrades to natural token expiry rather than locking users out. A
+ * service opts in with a single boot line:
+ *   `setTokenRevocationStore(createEnvRedisTokenRevocationStore());`
+ */
+export declare function createEnvRedisTokenRevocationStore(): TokenRevocationStore;
+/**
+ * Publish a user's current `tokenVersion` so the stateless services see the
+ * revocation immediately (platform side). Best-effort — never throws; a failure
+ * just means the services fall back to natural token expiry for this change.
+ *
+ * The key is written with a TTL equal to the access-token lifetime: any token
+ * that could still carry an older version has expired by the time the entry
+ * lapses, so an expired entry can never cause a false "revoked" nor a missed one.
+ *
+ * @param redis - the platform's Redis client
+ * @param userId - the user whose sessions changed
+ * @param tokenVersion - the user's NEW (post-increment) tokenVersion
+ * @param ttlSeconds - access-token lifetime in seconds
+ */
+export declare function publishTokenRevocation(redis: RedisCacheClient, userId: string, tokenVersion: number, ttlSeconds: number): Promise<void>;

package/lib/services/token-revocation.js

@@ -0,0 +1,120 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { createEnvRedisClient } from './env-redis.js';
+import { createLogger } from '../utils/logger.js';
+import { emitCounter } from '../utils/metric-emitter.js';
+const logger = createLogger('token-revocation');
+/**
+ * Redis key namespace for the per-user current `tokenVersion`. The platform
+ * PUBLISHES to this key on every privilege change; the stateless services READ
+ * it in `requireAuth` (via {@link createRedisTokenRevocationStore}) to reject
+ * tokens minted before that change. Publisher and readers MUST share this exact
+ * prefix — hence both helpers live here, in one place.
+ */
+export const TOKEN_REVOCATION_KEY_PREFIX = 'authrev:tv:';
+/** The revocation key for a user id. */
+export function tokenRevocationKey(userId) {
+    return `${TOKEN_REVOCATION_KEY_PREFIX}${userId}`;
+}
+/**
+ * Build a {@link TokenRevocationStore} backed by a Redis client, for a stateless
+ * service to register via `setTokenRevocationStore`. Reads the current
+ * `tokenVersion` the platform published for the user.
+ *
+ * Fail-open by contract: a miss, a parse failure, or a Redis error all yield
+ * `null` (— `requireAuth` treats that as "no known revocation"), so a Redis
+ * outage degrades to the pre-existing behaviour rather than locking users out.
+ */
+export function createRedisTokenRevocationStore(redis) {
+    return {
+        async getCurrentVersion(userId) {
+            try {
+                const raw = await redis.get(tokenRevocationKey(userId));
+                if (raw === null || raw === undefined || raw.trim() === '')
+                    return null;
+                // Strict integer parse: `Number` (unlike `parseInt`) rejects trailing
+                // garbage ("5abc" → NaN), so a corrupted entry fails open (null → "not
+                // revoked") rather than being read as a bogus version. The empty-string
+                // guard above matters because `Number('')` is 0, not NaN.
+                const n = Number(raw);
+                return Number.isInteger(n) ? n : null;
+            }
+            catch (err) {
+                // Redis was reachable enough to try but the read errored — this is a
+                // DEGRADATION: while it persists, forced logouts / privilege revocations
+                // silently stop taking effect until natural token expiry. Emit a counter
+                // so `TokenRevocationFailingOpen` can alert on a SUSTAINED rate (mirrors
+                // the quota_fail_open_total pattern). Not emitted for the "Redis not
+                // configured" path (createEnvRedisTokenRevocationStore → null client),
+                // which is a deliberate opt-out, not a degradation.
+                emitCounter('token_revocation_fail_open_total', { reason: 'read-error' });
+                logger.debug('Token-revocation read failed (fail-open)', {
+                    userId, error: err instanceof Error ? err.message : String(err),
+                });
+                return null;
+            }
+        },
+    };
+}
+/**
+ * Build a {@link TokenRevocationStore} backed by a Redis client that is lazily
+ * constructed from the standard `REDIS_URL` or `REDIS_HOST`/`REDIS_PORT` env —
+ * for a stateless service that keeps NO Redis client of its own. The client is
+ * built on first `getCurrentVersion` call and memoized; `ioredis` is loaded via
+ * a guarded dynamic require so merely importing this never breaks a build/test
+ * where Redis isn't present.
+ *
+ * FULLY FAIL-OPEN: no env configured, an ioredis load failure, a connect error,
+ * or any read failure all resolve to `null` ("no known revocation"), so a
+ * service degrades to natural token expiry rather than locking users out. A
+ * service opts in with a single boot line:
+ *   `setTokenRevocationStore(createEnvRedisTokenRevocationStore());`
+ */
+export function createEnvRedisTokenRevocationStore() {
+    // undefined = not yet attempted; null = attempted and unavailable (stay off).
+    let cached;
+    function build() {
+        // Shared env-configured ioredis construction (fail-open, error-listener
+        // attached, null when Redis isn't configured/available); the reader stays
+        // fail-open — a null client just falls back to natural token expiry.
+        const inst = createEnvRedisClient('revocation-reader');
+        if (inst)
+            logger.info('Redis token-revocation reader initialized');
+        return inst;
+    }
+    return {
+        async getCurrentVersion(userId) {
+            if (cached === undefined)
+                cached = build();
+            if (!cached)
+                return null;
+            return createRedisTokenRevocationStore(cached).getCurrentVersion(userId);
+        },
+    };
+}
+/**
+ * Publish a user's current `tokenVersion` so the stateless services see the
+ * revocation immediately (platform side). Best-effort — never throws; a failure
+ * just means the services fall back to natural token expiry for this change.
+ *
+ * The key is written with a TTL equal to the access-token lifetime: any token
+ * that could still carry an older version has expired by the time the entry
+ * lapses, so an expired entry can never cause a false "revoked" nor a missed one.
+ *
+ * @param redis - the platform's Redis client
+ * @param userId - the user whose sessions changed
+ * @param tokenVersion - the user's NEW (post-increment) tokenVersion
+ * @param ttlSeconds - access-token lifetime in seconds
+ */
+export async function publishTokenRevocation(redis, userId, tokenVersion, ttlSeconds) {
+    try {
+        // ioredis-style variadic SET with expiry: SET key val EX ttl.
+        await redis.set(tokenRevocationKey(userId), String(tokenVersion), 'EX', Math.max(1, Math.floor(ttlSeconds)));
+    }
+    catch (err) {
+        logger.warn('Token-revocation publish failed (services fall back to token expiry)', {
+            userId, error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4tcmV2b2NhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2aWNlcy90b2tlbi1yZXZvY2F0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFHdEMsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFFdEQsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUV6RCxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUVoRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxhQUFhLENBQUM7QUFFekQsd0NBQXdDO0FBQ3hDLE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxNQUFjO0lBQy9DLE9BQU8sR0FBRywyQkFBMkIsR0FBRyxNQUFNLEVBQUUsQ0FBQztBQUNuRCxDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLFVBQVUsK0JBQStCLENBQUMsS0FBdUI7SUFDckUsT0FBTztRQUNMLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxNQUFjO1lBQ3BDLElBQUksQ0FBQztnQkFDSCxNQUFNLEdBQUcsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztnQkFDeEQsSUFBSSxHQUFHLEtBQUssSUFBSSxJQUFJLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUU7b0JBQUUsT0FBTyxJQUFJLENBQUM7Z0JBQ3hFLHNFQUFzRTtnQkFDdEUsdUVBQXVFO2dCQUN2RSx3RUFBd0U7Z0JBQ3hFLDBEQUEwRDtnQkFDMUQsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUN0QixPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ3hDLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLHFFQUFxRTtnQkFDckUseUVBQXlFO2dCQUN6RSx5RUFBeUU7Z0JBQ3pFLHlFQUF5RTtnQkFDekUscUVBQXFFO2dCQUNyRSx1RUFBdUU7Z0JBQ3ZFLG9EQUFvRDtnQkFDcEQsV0FBVyxDQUFDLGtDQUFrQyxFQUFFLEVBQUUsTUFBTSxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUM7Z0JBQzFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsMENBQTBDLEVBQUU7b0JBQ3ZELE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDaEUsQ0FBQyxDQUFDO2dCQUNILE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLFVBQVUsa0NBQWtDO0lBQ2hELDhFQUE4RTtJQUM5RSxJQUFJLE1BQTJDLENBQUM7SUFFaEQsU0FBUyxLQUFLO1FBQ1osd0VBQXdFO1FBQ3hFLDBFQUEwRTtRQUMxRSxxRUFBcUU7UUFDckUsTUFBTSxJQUFJLEdBQUcsb0JBQW9CLENBQW1CLG1CQUFtQixDQUFDLENBQUM7UUFDekUsSUFBSSxJQUFJO1lBQUUsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO1FBQ25FLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELE9BQU87UUFDTCxLQUFLLENBQUMsaUJBQWlCLENBQUMsTUFBYztZQUNwQyxJQUFJLE1BQU0sS0FBSyxTQUFTO2dCQUFFLE1BQU0sR0FBRyxLQUFLLEVBQUUsQ0FBQztZQUMzQyxJQUFJLENBQUMsTUFBTTtnQkFBRSxPQUFPLElBQUksQ0FBQztZQUN6QixPQUFPLCtCQUErQixDQUFDLE1BQU0sQ0FBQyxDQUFDLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNFLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLHNCQUFzQixDQUMxQyxLQUF1QixFQUN2QixNQUFjLEVBQ2QsWUFBb0IsRUFDcEIsVUFBa0I7SUFFbEIsSUFBSSxDQUFDO1FBQ0gsOERBQThEO1FBQzlELE1BQU0sS0FBSyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9HLENBQUM7SUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1FBQ2IsTUFBTSxDQUFDLElBQUksQ0FBQyxzRUFBc0UsRUFBRTtZQUNsRixNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUM7U0FDaEUsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHR5cGUgeyBSZWRpc0NhY2hlQ2xpZW50IH0gZnJvbSAnLi9jYWNoZS1zZXJ2aWNlLmpzJztcbmltcG9ydCB7IGNyZWF0ZUVudlJlZGlzQ2xpZW50IH0gZnJvbSAnLi9lbnYtcmVkaXMuanMnO1xuaW1wb3J0IHR5cGUgeyBUb2tlblJldm9jYXRpb25TdG9yZSB9IGZyb20gJy4uL21pZGRsZXdhcmUvYXV0aC5qcyc7XG5pbXBvcnQgeyBjcmVhdGVMb2dnZXIgfSBmcm9tICcuLi91dGlscy9sb2dnZXIuanMnO1xuaW1wb3J0IHsgZW1pdENvdW50ZXIgfSBmcm9tICcuLi91dGlscy9tZXRyaWMtZW1pdHRlci5qcyc7XG5cbmNvbnN0IGxvZ2dlciA9IGNyZWF0ZUxvZ2dlcigndG9rZW4tcmV2b2NhdGlvbicpO1xuXG4vKipcbiAqIFJlZGlzIGtleSBuYW1lc3BhY2UgZm9yIHRoZSBwZXItdXNlciBjdXJyZW50IGB0b2tlblZlcnNpb25gLiBUaGUgcGxhdGZvcm1cbiAqIFBVQkxJU0hFUyB0byB0aGlzIGtleSBvbiBldmVyeSBwcml2aWxlZ2UgY2hhbmdlOyB0aGUgc3RhdGVsZXNzIHNlcnZpY2VzIFJFQURcbiAqIGl0IGluIGByZXF1aXJlQXV0aGAgKHZpYSB7QGxpbmsgY3JlYXRlUmVkaXNUb2tlblJldm9jYXRpb25TdG9yZX0pIHRvIHJlamVjdFxuICogdG9rZW5zIG1pbnRlZCBiZWZvcmUgdGhhdCBjaGFuZ2UuIFB1Ymxpc2hlciBhbmQgcmVhZGVycyBNVVNUIHNoYXJlIHRoaXMgZXhhY3RcbiAqIHByZWZpeCDigJQgaGVuY2UgYm90aCBoZWxwZXJzIGxpdmUgaGVyZSwgaW4gb25lIHBsYWNlLlxuICovXG5leHBvcnQgY29uc3QgVE9LRU5fUkVWT0NBVElPTl9LRVlfUFJFRklYID0gJ2F1dGhyZXY6dHY6JztcblxuLyoqIFRoZSByZXZvY2F0aW9uIGtleSBmb3IgYSB1c2VyIGlkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHRva2VuUmV2b2NhdGlvbktleSh1c2VySWQ6IHN0cmluZyk6IHN0cmluZyB7XG4gIHJldHVybiBgJHtUT0tFTl9SRVZPQ0FUSU9OX0tFWV9QUkVGSVh9JHt1c2VySWR9YDtcbn1cblxuLyoqXG4gKiBCdWlsZCBhIHtAbGluayBUb2tlblJldm9jYXRpb25TdG9yZX0gYmFja2VkIGJ5IGEgUmVkaXMgY2xpZW50LCBmb3IgYSBzdGF0ZWxlc3NcbiAqIHNlcnZpY2UgdG8gcmVnaXN0ZXIgdmlhIGBzZXRUb2tlblJldm9jYXRpb25TdG9yZWAuIFJlYWRzIHRoZSBjdXJyZW50XG4gKiBgdG9rZW5WZXJzaW9uYCB0aGUgcGxhdGZvcm0gcHVibGlzaGVkIGZvciB0aGUgdXNlci5cbiAqXG4gKiBGYWlsLW9wZW4gYnkgY29udHJhY3Q6IGEgbWlzcywgYSBwYXJzZSBmYWlsdXJlLCBvciBhIFJlZGlzIGVycm9yIGFsbCB5aWVsZFxuICogYG51bGxgICjigJQgYHJlcXVpcmVBdXRoYCB0cmVhdHMgdGhhdCBhcyBcIm5vIGtub3duIHJldm9jYXRpb25cIiksIHNvIGEgUmVkaXNcbiAqIG91dGFnZSBkZWdyYWRlcyB0byB0aGUgcHJlLWV4aXN0aW5nIGJlaGF2aW91ciByYXRoZXIgdGhhbiBsb2NraW5nIHVzZXJzIG91dC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZVJlZGlzVG9rZW5SZXZvY2F0aW9uU3RvcmUocmVkaXM6IFJlZGlzQ2FjaGVDbGllbnQpOiBUb2tlblJldm9jYXRpb25TdG9yZSB7XG4gIHJldHVybiB7XG4gICAgYXN5bmMgZ2V0Q3VycmVudFZlcnNpb24odXNlcklkOiBzdHJpbmcpOiBQcm9taXNlPG51bWJlciB8IG51bGw+IHtcbiAgICAgIHRyeSB7XG4gICAgICAgIGNvbnN0IHJhdyA9IGF3YWl0IHJlZGlzLmdldCh0b2tlblJldm9jYXRpb25LZXkodXNlcklkKSk7XG4gICAgICAgIGlmIChyYXcgPT09IG51bGwgfHwgcmF3ID09PSB1bmRlZmluZWQgfHwgcmF3LnRyaW0oKSA9PT0gJycpIHJldHVybiBudWxsO1xuICAgICAgICAvLyBTdHJpY3QgaW50ZWdlciBwYXJzZTogYE51bWJlcmAgKHVubGlrZSBgcGFyc2VJbnRgKSByZWplY3RzIHRyYWlsaW5nXG4gICAgICAgIC8vIGdhcmJhZ2UgKFwiNWFiY1wiIOKGkiBOYU4pLCBzbyBhIGNvcnJ1cHRlZCBlbnRyeSBmYWlscyBvcGVuIChudWxsIOKGkiBcIm5vdFxuICAgICAgICAvLyByZXZva2VkXCIpIHJhdGhlciB0aGFuIGJlaW5nIHJlYWQgYXMgYSBib2d1cyB2ZXJzaW9uLiBUaGUgZW1wdHktc3RyaW5nXG4gICAgICAgIC8vIGd1YXJkIGFib3ZlIG1hdHRlcnMgYmVjYXVzZSBgTnVtYmVyKCcnKWAgaXMgMCwgbm90IE5hTi5cbiAgICAgICAgY29uc3QgbiA9IE51bWJlcihyYXcpO1xuICAgICAgICByZXR1cm4gTnVtYmVyLmlzSW50ZWdlcihuKSA/IG4gOiBudWxsO1xuICAgICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAgIC8vIFJlZGlzIHdhcyByZWFjaGFibGUgZW5vdWdoIHRvIHRyeSBidXQgdGhlIHJlYWQgZXJyb3JlZCDigJQgdGhpcyBpcyBhXG4gICAgICAgIC8vIERFR1JBREFUSU9OOiB3aGlsZSBpdCBwZXJzaXN0cywgZm9yY2VkIGxvZ291dHMgLyBwcml2aWxlZ2UgcmV2b2NhdGlvbnNcbiAgICAgICAgLy8gc2lsZW50bHkgc3RvcCB0YWtpbmcgZWZmZWN0IHVudGlsIG5hdHVyYWwgdG9rZW4gZXhwaXJ5LiBFbWl0IGEgY291bnRlclxuICAgICAgICAvLyBzbyBgVG9rZW5SZXZvY2F0aW9uRmFpbGluZ09wZW5gIGNhbiBhbGVydCBvbiBhIFNVU1RBSU5FRCByYXRlIChtaXJyb3JzXG4gICAgICAgIC8vIHRoZSBxdW90YV9mYWlsX29wZW5fdG90YWwgcGF0dGVybikuIE5vdCBlbWl0dGVkIGZvciB0aGUgXCJSZWRpcyBub3RcbiAgICAgICAgLy8gY29uZmlndXJlZFwiIHBhdGggKGNyZWF0ZUVudlJlZGlzVG9rZW5SZXZvY2F0aW9uU3RvcmUg4oaSIG51bGwgY2xpZW50KSxcbiAgICAgICAgLy8gd2hpY2ggaXMgYSBkZWxpYmVyYXRlIG9wdC1vdXQsIG5vdCBhIGRlZ3JhZGF0aW9uLlxuICAgICAgICBlbWl0Q291bnRlcigndG9rZW5fcmV2b2NhdGlvbl9mYWlsX29wZW5fdG90YWwnLCB7IHJlYXNvbjogJ3JlYWQtZXJyb3InIH0pO1xuICAgICAgICBsb2dnZXIuZGVidWcoJ1Rva2VuLXJldm9jYXRpb24gcmVhZCBmYWlsZWQgKGZhaWwtb3BlbiknLCB7XG4gICAgICAgICAgdXNlcklkLCBlcnJvcjogZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6IFN0cmluZyhlcnIpLFxuICAgICAgICB9KTtcbiAgICAgICAgcmV0dXJuIG51bGw7XG4gICAgICB9XG4gICAgfSxcbiAgfTtcbn1cblxuLyoqXG4gKiBCdWlsZCBhIHtAbGluayBUb2tlblJldm9jYXRpb25TdG9yZX0gYmFja2VkIGJ5IGEgUmVkaXMgY2xpZW50IHRoYXQgaXMgbGF6aWx5XG4gKiBjb25zdHJ1Y3RlZCBmcm9tIHRoZSBzdGFuZGFyZCBgUkVESVNfVVJMYCBvciBgUkVESVNfSE9TVGAvYFJFRElTX1BPUlRgIGVudiDigJRcbiAqIGZvciBhIHN0YXRlbGVzcyBzZXJ2aWNlIHRoYXQga2VlcHMgTk8gUmVkaXMgY2xpZW50IG9mIGl0cyBvd24uIFRoZSBjbGllbnQgaXNcbiAqIGJ1aWx0IG9uIGZpcnN0IGBnZXRDdXJyZW50VmVyc2lvbmAgY2FsbCBhbmQgbWVtb2l6ZWQ7IGBpb3JlZGlzYCBpcyBsb2FkZWQgdmlhXG4gKiBhIGd1YXJkZWQgZHluYW1pYyByZXF1aXJlIHNvIG1lcmVseSBpbXBvcnRpbmcgdGhpcyBuZXZlciBicmVha3MgYSBidWlsZC90ZXN0XG4gKiB3aGVyZSBSZWRpcyBpc24ndCBwcmVzZW50LlxuICpcbiAqIEZVTExZIEZBSUwtT1BFTjogbm8gZW52IGNvbmZpZ3VyZWQsIGFuIGlvcmVkaXMgbG9hZCBmYWlsdXJlLCBhIGNvbm5lY3QgZXJyb3IsXG4gKiBvciBhbnkgcmVhZCBmYWlsdXJlIGFsbCByZXNvbHZlIHRvIGBudWxsYCAoXCJubyBrbm93biByZXZvY2F0aW9uXCIpLCBzbyBhXG4gKiBzZXJ2aWNlIGRlZ3JhZGVzIHRvIG5hdHVyYWwgdG9rZW4gZXhwaXJ5IHJhdGhlciB0aGFuIGxvY2tpbmcgdXNlcnMgb3V0LiBBXG4gKiBzZXJ2aWNlIG9wdHMgaW4gd2l0aCBhIHNpbmdsZSBib290IGxpbmU6XG4gKiAgIGBzZXRUb2tlblJldm9jYXRpb25TdG9yZShjcmVhdGVFbnZSZWRpc1Rva2VuUmV2b2NhdGlvblN0b3JlKCkpO2BcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZUVudlJlZGlzVG9rZW5SZXZvY2F0aW9uU3RvcmUoKTogVG9rZW5SZXZvY2F0aW9uU3RvcmUge1xuICAvLyB1bmRlZmluZWQgPSBub3QgeWV0IGF0dGVtcHRlZDsgbnVsbCA9IGF0dGVtcHRlZCBhbmQgdW5hdmFpbGFibGUgKHN0YXkgb2ZmKS5cbiAgbGV0IGNhY2hlZDogUmVkaXNDYWNoZUNsaWVudCB8IG51bGwgfCB1bmRlZmluZWQ7XG5cbiAgZnVuY3Rpb24gYnVpbGQoKTogUmVkaXNDYWNoZUNsaWVudCB8IG51bGwge1xuICAgIC8vIFNoYXJlZCBlbnYtY29uZmlndXJlZCBpb3JlZGlzIGNvbnN0cnVjdGlvbiAoZmFpbC1vcGVuLCBlcnJvci1saXN0ZW5lclxuICAgIC8vIGF0dGFjaGVkLCBudWxsIHdoZW4gUmVkaXMgaXNuJ3QgY29uZmlndXJlZC9hdmFpbGFibGUpOyB0aGUgcmVhZGVyIHN0YXlzXG4gICAgLy8gZmFpbC1vcGVuIOKAlCBhIG51bGwgY2xpZW50IGp1c3QgZmFsbHMgYmFjayB0byBuYXR1cmFsIHRva2VuIGV4cGlyeS5cbiAgICBjb25zdCBpbnN0ID0gY3JlYXRlRW52UmVkaXNDbGllbnQ8UmVkaXNDYWNoZUNsaWVudD4oJ3Jldm9jYXRpb24tcmVhZGVyJyk7XG4gICAgaWYgKGluc3QpIGxvZ2dlci5pbmZvKCdSZWRpcyB0b2tlbi1yZXZvY2F0aW9uIHJlYWRlciBpbml0aWFsaXplZCcpO1xuICAgIHJldHVybiBpbnN0O1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBhc3luYyBnZXRDdXJyZW50VmVyc2lvbih1c2VySWQ6IHN0cmluZyk6IFByb21pc2U8bnVtYmVyIHwgbnVsbD4ge1xuICAgICAgaWYgKGNhY2hlZCA9PT0gdW5kZWZpbmVkKSBjYWNoZWQgPSBidWlsZCgpO1xuICAgICAgaWYgKCFjYWNoZWQpIHJldHVybiBudWxsO1xuICAgICAgcmV0dXJuIGNyZWF0ZVJlZGlzVG9rZW5SZXZvY2F0aW9uU3RvcmUoY2FjaGVkKS5nZXRDdXJyZW50VmVyc2lvbih1c2VySWQpO1xuICAgIH0sXG4gIH07XG59XG5cbi8qKlxuICogUHVibGlzaCBhIHVzZXIncyBjdXJyZW50IGB0b2tlblZlcnNpb25gIHNvIHRoZSBzdGF0ZWxlc3Mgc2VydmljZXMgc2VlIHRoZVxuICogcmV2b2NhdGlvbiBpbW1lZGlhdGVseSAocGxhdGZvcm0gc2lkZSkuIEJlc3QtZWZmb3J0IOKAlCBuZXZlciB0aHJvd3M7IGEgZmFpbHVyZVxuICoganVzdCBtZWFucyB0aGUgc2VydmljZXMgZmFsbCBiYWNrIHRvIG5hdHVyYWwgdG9rZW4gZXhwaXJ5IGZvciB0aGlzIGNoYW5nZS5cbiAqXG4gKiBUaGUga2V5IGlzIHdyaXR0ZW4gd2l0aCBhIFRUTCBlcXVhbCB0byB0aGUgYWNjZXNzLXRva2VuIGxpZmV0aW1lOiBhbnkgdG9rZW5cbiAqIHRoYXQgY291bGQgc3RpbGwgY2FycnkgYW4gb2xkZXIgdmVyc2lvbiBoYXMgZXhwaXJlZCBieSB0aGUgdGltZSB0aGUgZW50cnlcbiAqIGxhcHNlcywgc28gYW4gZXhwaXJlZCBlbnRyeSBjYW4gbmV2ZXIgY2F1c2UgYSBmYWxzZSBcInJldm9rZWRcIiBub3IgYSBtaXNzZWQgb25lLlxuICpcbiAqIEBwYXJhbSByZWRpcyAtIHRoZSBwbGF0Zm9ybSdzIFJlZGlzIGNsaWVudFxuICogQHBhcmFtIHVzZXJJZCAtIHRoZSB1c2VyIHdob3NlIHNlc3Npb25zIGNoYW5nZWRcbiAqIEBwYXJhbSB0b2tlblZlcnNpb24gLSB0aGUgdXNlcidzIE5FVyAocG9zdC1pbmNyZW1lbnQpIHRva2VuVmVyc2lvblxuICogQHBhcmFtIHR0bFNlY29uZHMgLSBhY2Nlc3MtdG9rZW4gbGlmZXRpbWUgaW4gc2Vjb25kc1xuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcHVibGlzaFRva2VuUmV2b2NhdGlvbihcbiAgcmVkaXM6IFJlZGlzQ2FjaGVDbGllbnQsXG4gIHVzZXJJZDogc3RyaW5nLFxuICB0b2tlblZlcnNpb246IG51bWJlcixcbiAgdHRsU2Vjb25kczogbnVtYmVyLFxuKTogUHJvbWlzZTx2b2lkPiB7XG4gIHRyeSB7XG4gICAgLy8gaW9yZWRpcy1zdHlsZSB2YXJpYWRpYyBTRVQgd2l0aCBleHBpcnk6IFNFVCBrZXkgdmFsIEVYIHR0bC5cbiAgICBhd2FpdCByZWRpcy5zZXQodG9rZW5SZXZvY2F0aW9uS2V5KHVzZXJJZCksIFN0cmluZyh0b2tlblZlcnNpb24pLCAnRVgnLCBNYXRoLm1heCgxLCBNYXRoLmZsb29yKHR0bFNlY29uZHMpKSk7XG4gIH0gY2F0Y2ggKGVycikge1xuICAgIGxvZ2dlci53YXJuKCdUb2tlbi1yZXZvY2F0aW9uIHB1Ymxpc2ggZmFpbGVkIChzZXJ2aWNlcyBmYWxsIGJhY2sgdG8gdG9rZW4gZXhwaXJ5KScsIHtcbiAgICAgIHVzZXJJZCwgZXJyb3I6IGVyciBpbnN0YW5jZW9mIEVycm9yID8gZXJyLm1lc3NhZ2UgOiBTdHJpbmcoZXJyKSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/testing/tier-mock.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared tier fixture for the per-package `@pipeline-builder/api-core` test
+ * mocks (each suite's `test/helpers/mock-api-core.ts`).
+ *
+ * WHY A SEPARATE MODULE: every service mocks `@pipeline-builder/api-core` via
+ * `jest.unstable_mockModule('@pipeline-builder/api-core', …)`. That intercepts the
+ * *package* specifier only — this file is imported through the DEEP built path
+ * `@pipeline-builder/api-core/lib/testing/tier-mock.js`, a different specifier the
+ * mock does NOT intercept, so a mock can pull real, complete tier data without
+ * self-referencing its own mock. api-core has no `exports` map, so the subpath
+ * resolves; both sides are ESM so there's no interop wrinkle.
+ *
+ * WHAT IT BUYS: the tier NAME LIST is sourced from the real `VALID_TIERS`, so
+ * adding a tier in `quota-tiers.ts` flows into every mock automatically — no more
+ * "add a tier → hand-edit N mocks, discover the misses one gate round at a time"
+ * (which is exactly how the `unlimited` tier broke pipeline-core/api-server/platform).
+ * `mockQuotaTiers()` builds a COMPLETE `QUOTA_TIERS` (an entry for every tier) from
+ * caller-supplied per-tier limits, defaulting any unspecified tier to uncapped — so
+ * a new tier can never leave a `QUOTA_TIERS[tier].limits` undefined at mock load.
+ */
+import { type FeatureFlag } from '../types/feature-flags.js';
+import { type QuotaTier, type QuotaTierLimits } from '../types/quota-tiers.js';
+/** The real, complete tier-name list — the single source mocks derive from. */
+export declare const MOCK_TIER_NAMES: readonly QuotaTier[];
+/** Mirrors api-core's `isValidTier`, driven by the shared name list. */
+export declare const mockIsValidTier: (t: string) => boolean;
+type TierPreset = {
+    label: string;
+    limits: QuotaTierLimits;
+};
+/**
+ * Build a COMPLETE `QUOTA_TIERS` map (one entry per real tier) for a mock.
+ * Pass the per-tier limit overrides a suite actually asserts on; every other
+ * dimension (and every unspecified tier) falls back to uncapped, so the map is
+ * always exhaustive over `VALID_TIERS` — the property that keeps a newly-added
+ * tier from crashing mock load.
+ */
+export declare function mockQuotaTiers(limitsByTier?: Partial<Record<QuotaTier, Partial<QuotaTierLimits>>>): Record<QuotaTier, TierPreset>;
+/**
+ * Build a COMPLETE `TIER_FEATURES` map. Defaults every tier to all feature flags
+ * (the common mock stance); pass overrides for suites that assert a narrower set.
+ */
+export declare function mockTierFeatures(featuresByTier?: Partial<Record<QuotaTier, readonly FeatureFlag[]>>): Record<QuotaTier, readonly FeatureFlag[]>;
+export {};

package/lib/testing/tier-mock.js

@@ -0,0 +1,65 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared tier fixture for the per-package `@pipeline-builder/api-core` test
+ * mocks (each suite's `test/helpers/mock-api-core.ts`).
+ *
+ * WHY A SEPARATE MODULE: every service mocks `@pipeline-builder/api-core` via
+ * `jest.unstable_mockModule('@pipeline-builder/api-core', …)`. That intercepts the
+ * *package* specifier only — this file is imported through the DEEP built path
+ * `@pipeline-builder/api-core/lib/testing/tier-mock.js`, a different specifier the
+ * mock does NOT intercept, so a mock can pull real, complete tier data without
+ * self-referencing its own mock. api-core has no `exports` map, so the subpath
+ * resolves; both sides are ESM so there's no interop wrinkle.
+ *
+ * WHAT IT BUYS: the tier NAME LIST is sourced from the real `VALID_TIERS`, so
+ * adding a tier in `quota-tiers.ts` flows into every mock automatically — no more
+ * "add a tier → hand-edit N mocks, discover the misses one gate round at a time"
+ * (which is exactly how the `unlimited` tier broke pipeline-core/api-server/platform).
+ * `mockQuotaTiers()` builds a COMPLETE `QUOTA_TIERS` (an entry for every tier) from
+ * caller-supplied per-tier limits, defaulting any unspecified tier to uncapped — so
+ * a new tier can never leave a `QUOTA_TIERS[tier].limits` undefined at mock load.
+ */
+import { ALL_FEATURE_FLAGS } from '../types/feature-flags.js';
+import { VALID_TIERS } from '../types/quota-tiers.js';
+/** The real, complete tier-name list — the single source mocks derive from. */
+export const MOCK_TIER_NAMES = VALID_TIERS;
+/** Mirrors api-core's `isValidTier`, driven by the shared name list. */
+export const mockIsValidTier = (t) => MOCK_TIER_NAMES.includes(t);
+/** Every quota dimension uncapped — the default for tiers a caller doesn't specify. */
+const uncappedLimits = () => ({
+    seats: -1,
+    plugins: -1,
+    pipelines: -1,
+    apiCalls: -1,
+    aiCalls: -1,
+    storageBytes: -1,
+    dashboards: -1,
+    alertRules: -1,
+    alertDestinations: -1,
+    idpConfigs: -1,
+    eventRetentionDays: -1,
+    doraRetentionDays: -1,
+});
+const titleCase = (t) => t.charAt(0).toUpperCase() + t.slice(1);
+/**
+ * Build a COMPLETE `QUOTA_TIERS` map (one entry per real tier) for a mock.
+ * Pass the per-tier limit overrides a suite actually asserts on; every other
+ * dimension (and every unspecified tier) falls back to uncapped, so the map is
+ * always exhaustive over `VALID_TIERS` — the property that keeps a newly-added
+ * tier from crashing mock load.
+ */
+export function mockQuotaTiers(limitsByTier = {}) {
+    return Object.fromEntries(MOCK_TIER_NAMES.map((t) => [
+        t,
+        { label: titleCase(t), limits: { ...uncappedLimits(), ...(limitsByTier[t] ?? {}) } },
+    ]));
+}
+/**
+ * Build a COMPLETE `TIER_FEATURES` map. Defaults every tier to all feature flags
+ * (the common mock stance); pass overrides for suites that assert a narrower set.
+ */
+export function mockTierFeatures(featuresByTier = {}) {
+    return Object.fromEntries(MOCK_TIER_NAMES.map((t) => [t, featuresByTier[t] ?? [...ALL_FEATURE_FLAGS]]));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGllci1tb2NrLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rlc3RpbmcvdGllci1tb2NrLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFFSCxPQUFPLEVBQUUsaUJBQWlCLEVBQW9CLE1BQU0sMkJBQTJCLENBQUM7QUFDaEYsT0FBTyxFQUFFLFdBQVcsRUFBd0MsTUFBTSx5QkFBeUIsQ0FBQztBQUU1RiwrRUFBK0U7QUFDL0UsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUF5QixXQUFXLENBQUM7QUFFakUsd0VBQXdFO0FBQ3hFLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLENBQVMsRUFBVyxFQUFFLENBQ25ELGVBQXFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXJELHVGQUF1RjtBQUN2RixNQUFNLGNBQWMsR0FBRyxHQUFvQixFQUFFLENBQUMsQ0FBQztJQUM3QyxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ1QsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNYLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDYixRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ1osT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNYLFlBQVksRUFBRSxDQUFDLENBQUM7SUFDaEIsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUNkLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDZCxpQkFBaUIsRUFBRSxDQUFDLENBQUM7SUFDckIsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUNkLGtCQUFrQixFQUFFLENBQUMsQ0FBQztJQUN0QixpQkFBaUIsRUFBRSxDQUFDLENBQUM7Q0FDdEIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxTQUFTLEdBQUcsQ0FBQyxDQUFTLEVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUloRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsY0FBYyxDQUM1QixZQUFZLEdBQXlELEVBQUU7SUFFdkUsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixlQUFlLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUN6QixDQUFDO1FBQ0QsRUFBRSxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLEdBQUcsY0FBYyxFQUFFLEVBQUUsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxFQUFFO0tBQ3JGLENBQUMsQ0FDOEIsQ0FBQztBQUNyQyxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUM5QixjQUFjLEdBQXVELEVBQUU7SUFFdkUsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUN2QixlQUFlLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUNoQyxDQUFDO0FBQ2pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBTaGFyZWQgdGllciBmaXh0dXJlIGZvciB0aGUgcGVyLXBhY2thZ2UgYEBwaXBlbGluZS1idWlsZGVyL2FwaS1jb3JlYCB0ZXN0XG4gKiBtb2NrcyAoZWFjaCBzdWl0ZSdzIGB0ZXN0L2hlbHBlcnMvbW9jay1hcGktY29yZS50c2ApLlxuICpcbiAqIFdIWSBBIFNFUEFSQVRFIE1PRFVMRTogZXZlcnkgc2VydmljZSBtb2NrcyBgQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmVgIHZpYVxuICogYGplc3QudW5zdGFibGVfbW9ja01vZHVsZSgnQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUnLCDigKYpYC4gVGhhdCBpbnRlcmNlcHRzIHRoZVxuICogKnBhY2thZ2UqIHNwZWNpZmllciBvbmx5IOKAlCB0aGlzIGZpbGUgaXMgaW1wb3J0ZWQgdGhyb3VnaCB0aGUgREVFUCBidWlsdCBwYXRoXG4gKiBgQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUvbGliL3Rlc3RpbmcvdGllci1tb2NrLmpzYCwgYSBkaWZmZXJlbnQgc3BlY2lmaWVyIHRoZVxuICogbW9jayBkb2VzIE5PVCBpbnRlcmNlcHQsIHNvIGEgbW9jayBjYW4gcHVsbCByZWFsLCBjb21wbGV0ZSB0aWVyIGRhdGEgd2l0aG91dFxuICogc2VsZi1yZWZlcmVuY2luZyBpdHMgb3duIG1vY2suIGFwaS1jb3JlIGhhcyBubyBgZXhwb3J0c2AgbWFwLCBzbyB0aGUgc3VicGF0aFxuICogcmVzb2x2ZXM7IGJvdGggc2lkZXMgYXJlIEVTTSBzbyB0aGVyZSdzIG5vIGludGVyb3Agd3JpbmtsZS5cbiAqXG4gKiBXSEFUIElUIEJVWVM6IHRoZSB0aWVyIE5BTUUgTElTVCBpcyBzb3VyY2VkIGZyb20gdGhlIHJlYWwgYFZBTElEX1RJRVJTYCwgc29cbiAqIGFkZGluZyBhIHRpZXIgaW4gYHF1b3RhLXRpZXJzLnRzYCBmbG93cyBpbnRvIGV2ZXJ5IG1vY2sgYXV0b21hdGljYWxseSDigJQgbm8gbW9yZVxuICogXCJhZGQgYSB0aWVyIOKGkiBoYW5kLWVkaXQgTiBtb2NrcywgZGlzY292ZXIgdGhlIG1pc3NlcyBvbmUgZ2F0ZSByb3VuZCBhdCBhIHRpbWVcIlxuICogKHdoaWNoIGlzIGV4YWN0bHkgaG93IHRoZSBgdW5saW1pdGVkYCB0aWVyIGJyb2tlIHBpcGVsaW5lLWNvcmUvYXBpLXNlcnZlci9wbGF0Zm9ybSkuXG4gKiBgbW9ja1F1b3RhVGllcnMoKWAgYnVpbGRzIGEgQ09NUExFVEUgYFFVT1RBX1RJRVJTYCAoYW4gZW50cnkgZm9yIGV2ZXJ5IHRpZXIpIGZyb21cbiAqIGNhbGxlci1zdXBwbGllZCBwZXItdGllciBsaW1pdHMsIGRlZmF1bHRpbmcgYW55IHVuc3BlY2lmaWVkIHRpZXIgdG8gdW5jYXBwZWQg4oCUIHNvXG4gKiBhIG5ldyB0aWVyIGNhbiBuZXZlciBsZWF2ZSBhIGBRVU9UQV9USUVSU1t0aWVyXS5saW1pdHNgIHVuZGVmaW5lZCBhdCBtb2NrIGxvYWQuXG4gKi9cblxuaW1wb3J0IHsgQUxMX0ZFQVRVUkVfRkxBR1MsIHR5cGUgRmVhdHVyZUZsYWcgfSBmcm9tICcuLi90eXBlcy9mZWF0dXJlLWZsYWdzLmpzJztcbmltcG9ydCB7IFZBTElEX1RJRVJTLCB0eXBlIFF1b3RhVGllciwgdHlwZSBRdW90YVRpZXJMaW1pdHMgfSBmcm9tICcuLi90eXBlcy9xdW90YS10aWVycy5qcyc7XG5cbi8qKiBUaGUgcmVhbCwgY29tcGxldGUgdGllci1uYW1lIGxpc3Qg4oCUIHRoZSBzaW5nbGUgc291cmNlIG1vY2tzIGRlcml2ZSBmcm9tLiAqL1xuZXhwb3J0IGNvbnN0IE1PQ0tfVElFUl9OQU1FUzogcmVhZG9ubHkgUXVvdGFUaWVyW10gPSBWQUxJRF9USUVSUztcblxuLyoqIE1pcnJvcnMgYXBpLWNvcmUncyBgaXNWYWxpZFRpZXJgLCBkcml2ZW4gYnkgdGhlIHNoYXJlZCBuYW1lIGxpc3QuICovXG5leHBvcnQgY29uc3QgbW9ja0lzVmFsaWRUaWVyID0gKHQ6IHN0cmluZyk6IGJvb2xlYW4gPT5cbiAgKE1PQ0tfVElFUl9OQU1FUyBhcyByZWFkb25seSBzdHJpbmdbXSkuaW5jbHVkZXModCk7XG5cbi8qKiBFdmVyeSBxdW90YSBkaW1lbnNpb24gdW5jYXBwZWQg4oCUIHRoZSBkZWZhdWx0IGZvciB0aWVycyBhIGNhbGxlciBkb2Vzbid0IHNwZWNpZnkuICovXG5jb25zdCB1bmNhcHBlZExpbWl0cyA9ICgpOiBRdW90YVRpZXJMaW1pdHMgPT4gKHtcbiAgc2VhdHM6IC0xLFxuICBwbHVnaW5zOiAtMSxcbiAgcGlwZWxpbmVzOiAtMSxcbiAgYXBpQ2FsbHM6IC0xLFxuICBhaUNhbGxzOiAtMSxcbiAgc3RvcmFnZUJ5dGVzOiAtMSxcbiAgZGFzaGJvYXJkczogLTEsXG4gIGFsZXJ0UnVsZXM6IC0xLFxuICBhbGVydERlc3RpbmF0aW9uczogLTEsXG4gIGlkcENvbmZpZ3M6IC0xLFxuICBldmVudFJldGVudGlvbkRheXM6IC0xLFxuICBkb3JhUmV0ZW50aW9uRGF5czogLTEsXG59KTtcblxuY29uc3QgdGl0bGVDYXNlID0gKHQ6IHN0cmluZyk6IHN0cmluZyA9PiB0LmNoYXJBdCgwKS50b1VwcGVyQ2FzZSgpICsgdC5zbGljZSgxKTtcblxudHlwZSBUaWVyUHJlc2V0ID0geyBsYWJlbDogc3RyaW5nOyBsaW1pdHM6IFF1b3RhVGllckxpbWl0cyB9O1xuXG4vKipcbiAqIEJ1aWxkIGEgQ09NUExFVEUgYFFVT1RBX1RJRVJTYCBtYXAgKG9uZSBlbnRyeSBwZXIgcmVhbCB0aWVyKSBmb3IgYSBtb2NrLlxuICogUGFzcyB0aGUgcGVyLXRpZXIgbGltaXQgb3ZlcnJpZGVzIGEgc3VpdGUgYWN0dWFsbHkgYXNzZXJ0cyBvbjsgZXZlcnkgb3RoZXJcbiAqIGRpbWVuc2lvbiAoYW5kIGV2ZXJ5IHVuc3BlY2lmaWVkIHRpZXIpIGZhbGxzIGJhY2sgdG8gdW5jYXBwZWQsIHNvIHRoZSBtYXAgaXNcbiAqIGFsd2F5cyBleGhhdXN0aXZlIG92ZXIgYFZBTElEX1RJRVJTYCDigJQgdGhlIHByb3BlcnR5IHRoYXQga2VlcHMgYSBuZXdseS1hZGRlZFxuICogdGllciBmcm9tIGNyYXNoaW5nIG1vY2sgbG9hZC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIG1vY2tRdW90YVRpZXJzKFxuICBsaW1pdHNCeVRpZXI6IFBhcnRpYWw8UmVjb3JkPFF1b3RhVGllciwgUGFydGlhbDxRdW90YVRpZXJMaW1pdHM+Pj4gPSB7fSxcbik6IFJlY29yZDxRdW90YVRpZXIsIFRpZXJQcmVzZXQ+IHtcbiAgcmV0dXJuIE9iamVjdC5mcm9tRW50cmllcyhcbiAgICBNT0NLX1RJRVJfTkFNRVMubWFwKCh0KSA9PiBbXG4gICAgICB0LFxuICAgICAgeyBsYWJlbDogdGl0bGVDYXNlKHQpLCBsaW1pdHM6IHsgLi4udW5jYXBwZWRMaW1pdHMoKSwgLi4uKGxpbWl0c0J5VGllclt0XSA/PyB7fSkgfSB9LFxuICAgIF0pLFxuICApIGFzIFJlY29yZDxRdW90YVRpZXIsIFRpZXJQcmVzZXQ+O1xufVxuXG4vKipcbiAqIEJ1aWxkIGEgQ09NUExFVEUgYFRJRVJfRkVBVFVSRVNgIG1hcC4gRGVmYXVsdHMgZXZlcnkgdGllciB0byBhbGwgZmVhdHVyZSBmbGFnc1xuICogKHRoZSBjb21tb24gbW9jayBzdGFuY2UpOyBwYXNzIG92ZXJyaWRlcyBmb3Igc3VpdGVzIHRoYXQgYXNzZXJ0IGEgbmFycm93ZXIgc2V0LlxuICovXG5leHBvcnQgZnVuY3Rpb24gbW9ja1RpZXJGZWF0dXJlcyhcbiAgZmVhdHVyZXNCeVRpZXI6IFBhcnRpYWw8UmVjb3JkPFF1b3RhVGllciwgcmVhZG9ubHkgRmVhdHVyZUZsYWdbXT4+ID0ge30sXG4pOiBSZWNvcmQ8UXVvdGFUaWVyLCByZWFkb25seSBGZWF0dXJlRmxhZ1tdPiB7XG4gIHJldHVybiBPYmplY3QuZnJvbUVudHJpZXMoXG4gICAgTU9DS19USUVSX05BTUVTLm1hcCgodCkgPT4gW3QsIGZlYXR1cmVzQnlUaWVyW3RdID8/IFsuLi5BTExfRkVBVFVSRV9GTEFHU11dKSxcbiAgKSBhcyBSZWNvcmQ8UXVvdGFUaWVyLCByZWFkb25seSBGZWF0dXJlRmxhZ1tdPjtcbn1cbiJdfQ==

package/lib/types/audit-events.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Cross-service audit events emitted via structured logs.
+ *
+ * Platform's own audit events (user.login, org.create, …) live in MongoDB
+ * via the AuditEvent model — that's a separate persistence path scoped to
+ * the platform service. The events below are emitted by other services
+ * (image-registry, etc.) via the `emitAudit` helper as structured log
+ * lines with `eventCategory: 'audit'`, scraped by Loki for queryable
+ * audit history.
+ *
+ * Add a new event:
+ *   1. Extend the union type below.
+ *   2. Document it in `docs/audit-events.md` (or wherever the audit-events
+ *      doc lives) including any payload-specific fields.
+ *   3. Emit via `emitAudit(logger, 'event.name', { … })` from the route.
+ */
+/**
+ * Correlation context shared by every cross-service audit event. Optional so
+ * existing emit sites compile unchanged; when populated, these let an operator
+ * pivot a Loki audit line to the originating HTTP request (`requestId`) or the
+ * end-to-end distributed trace (`traceId`) — and line them up with platform's
+ * MongoDB audit events, which carry the same two fields.
+ */
+export interface AuditCorrelation {
+    /** Originating request id (propagated `x-request-id`). */
+    requestId?: string;
+    /** OpenTelemetry trace id of the active span, when tracing is enabled. */
+    traceId?: string;
+}
+/** Tag-copy emitted from image-registry's POST /api/images/copy. */
+export interface RegistryTagCopyAudit extends AuditCorrelation {
+    event: 'registry.tag.copy';
+    actor: string;
+    source: string;
+    target: string;
+    sourceDigest: string;
+    targetDigest: string;
+    /** True when target's repo starts with `system/` — the highest-privilege case. */
+    isPromotionToSystem: boolean;
+    mounted: {
+        manifests: number;
+        blobs: number;
+    };
+}
+/** Tag-delete emitted from image-registry's DELETE /api/images/:name/manifests/:reference. */
+export interface RegistryTagDeleteAudit extends AuditCorrelation {
+    event: 'registry.tag.delete';
+    actor: string;
+    repo: string;
+    ref: string;
+    digest: string;
+}
+/**
+ * Repository prune emitted from image-registry's DELETE /api/images/:name —
+ * deletes every manifest in a repo (used to remove empty/dead repos from the
+ * catalog). Unlike the tag-delete above, there's no single `ref`/`digest`:
+ * the counts summarize the whole repo.
+ */
+export interface RegistryRepoDeleteAudit extends AuditCorrelation {
+    event: 'registry.repo.delete';
+    actor: string;
+    repo: string;
+    /** Count of unique manifest digests actually deleted. */
+    deletedManifests: number;
+    /** Count of tags the repo held before the prune. */
+    deletedTags: number;
+}
+/** Union of every cross-service audit event currently emitted. */
+export type AuditEvent = RegistryTagCopyAudit | RegistryTagDeleteAudit | RegistryRepoDeleteAudit;

package/lib/types/audit-events.js

@@ -0,0 +1,4 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXVkaXQtZXZlbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3R5cGVzL2F1ZGl0LWV2ZW50cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogQ3Jvc3Mtc2VydmljZSBhdWRpdCBldmVudHMgZW1pdHRlZCB2aWEgc3RydWN0dXJlZCBsb2dzLlxuICpcbiAqIFBsYXRmb3JtJ3Mgb3duIGF1ZGl0IGV2ZW50cyAodXNlci5sb2dpbiwgb3JnLmNyZWF0ZSwg4oCmKSBsaXZlIGluIE1vbmdvREJcbiAqIHZpYSB0aGUgQXVkaXRFdmVudCBtb2RlbCDigJQgdGhhdCdzIGEgc2VwYXJhdGUgcGVyc2lzdGVuY2UgcGF0aCBzY29wZWQgdG9cbiAqIHRoZSBwbGF0Zm9ybSBzZXJ2aWNlLiBUaGUgZXZlbnRzIGJlbG93IGFyZSBlbWl0dGVkIGJ5IG90aGVyIHNlcnZpY2VzXG4gKiAoaW1hZ2UtcmVnaXN0cnksIGV0Yy4pIHZpYSB0aGUgYGVtaXRBdWRpdGAgaGVscGVyIGFzIHN0cnVjdHVyZWQgbG9nXG4gKiBsaW5lcyB3aXRoIGBldmVudENhdGVnb3J5OiAnYXVkaXQnYCwgc2NyYXBlZCBieSBMb2tpIGZvciBxdWVyeWFibGVcbiAqIGF1ZGl0IGhpc3RvcnkuXG4gKlxuICogQWRkIGEgbmV3IGV2ZW50OlxuICogICAxLiBFeHRlbmQgdGhlIHVuaW9uIHR5cGUgYmVsb3cuXG4gKiAgIDIuIERvY3VtZW50IGl0IGluIGBkb2NzL2F1ZGl0LWV2ZW50cy5tZGAgKG9yIHdoZXJldmVyIHRoZSBhdWRpdC1ldmVudHNcbiAqICAgICAgZG9jIGxpdmVzKSBpbmNsdWRpbmcgYW55IHBheWxvYWQtc3BlY2lmaWMgZmllbGRzLlxuICogICAzLiBFbWl0IHZpYSBgZW1pdEF1ZGl0KGxvZ2dlciwgJ2V2ZW50Lm5hbWUnLCB7IOKApiB9KWAgZnJvbSB0aGUgcm91dGUuXG4gKi9cblxuLyoqXG4gKiBDb3JyZWxhdGlvbiBjb250ZXh0IHNoYXJlZCBieSBldmVyeSBjcm9zcy1zZXJ2aWNlIGF1ZGl0IGV2ZW50LiBPcHRpb25hbCBzb1xuICogZXhpc3RpbmcgZW1pdCBzaXRlcyBjb21waWxlIHVuY2hhbmdlZDsgd2hlbiBwb3B1bGF0ZWQsIHRoZXNlIGxldCBhbiBvcGVyYXRvclxuICogcGl2b3QgYSBMb2tpIGF1ZGl0IGxpbmUgdG8gdGhlIG9yaWdpbmF0aW5nIEhUVFAgcmVxdWVzdCAoYHJlcXVlc3RJZGApIG9yIHRoZVxuICogZW5kLXRvLWVuZCBkaXN0cmlidXRlZCB0cmFjZSAoYHRyYWNlSWRgKSDigJQgYW5kIGxpbmUgdGhlbSB1cCB3aXRoIHBsYXRmb3JtJ3NcbiAqIE1vbmdvREIgYXVkaXQgZXZlbnRzLCB3aGljaCBjYXJyeSB0aGUgc2FtZSB0d28gZmllbGRzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1ZGl0Q29ycmVsYXRpb24ge1xuICAvKiogT3JpZ2luYXRpbmcgcmVxdWVzdCBpZCAocHJvcGFnYXRlZCBgeC1yZXF1ZXN0LWlkYCkuICovXG4gIHJlcXVlc3RJZD86IHN0cmluZztcbiAgLyoqIE9wZW5UZWxlbWV0cnkgdHJhY2UgaWQgb2YgdGhlIGFjdGl2ZSBzcGFuLCB3aGVuIHRyYWNpbmcgaXMgZW5hYmxlZC4gKi9cbiAgdHJhY2VJZD86IHN0cmluZztcbn1cblxuLyoqIFRhZy1jb3B5IGVtaXR0ZWQgZnJvbSBpbWFnZS1yZWdpc3RyeSdzIFBPU1QgL2FwaS9pbWFnZXMvY29weS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVnaXN0cnlUYWdDb3B5QXVkaXQgZXh0ZW5kcyBBdWRpdENvcnJlbGF0aW9uIHtcbiAgZXZlbnQ6ICdyZWdpc3RyeS50YWcuY29weSc7XG4gIGFjdG9yOiBzdHJpbmc7XG4gIHNvdXJjZTogc3RyaW5nO1xuICB0YXJnZXQ6IHN0cmluZztcbiAgc291cmNlRGlnZXN0OiBzdHJpbmc7XG4gIHRhcmdldERpZ2VzdDogc3RyaW5nO1xuICAvKiogVHJ1ZSB3aGVuIHRhcmdldCdzIHJlcG8gc3RhcnRzIHdpdGggYHN5c3RlbS9gIOKAlCB0aGUgaGlnaGVzdC1wcml2aWxlZ2UgY2FzZS4gKi9cbiAgaXNQcm9tb3Rpb25Ub1N5c3RlbTogYm9vbGVhbjtcbiAgbW91bnRlZDogeyBtYW5pZmVzdHM6IG51bWJlcjsgYmxvYnM6IG51bWJlciB9O1xufVxuXG4vKiogVGFnLWRlbGV0ZSBlbWl0dGVkIGZyb20gaW1hZ2UtcmVnaXN0cnkncyBERUxFVEUgL2FwaS9pbWFnZXMvOm5hbWUvbWFuaWZlc3RzLzpyZWZlcmVuY2UuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlZ2lzdHJ5VGFnRGVsZXRlQXVkaXQgZXh0ZW5kcyBBdWRpdENvcnJlbGF0aW9uIHtcbiAgZXZlbnQ6ICdyZWdpc3RyeS50YWcuZGVsZXRlJztcbiAgYWN0b3I6IHN0cmluZztcbiAgcmVwbzogc3RyaW5nO1xuICByZWY6IHN0cmluZztcbiAgZGlnZXN0OiBzdHJpbmc7XG59XG5cbi8qKlxuICogUmVwb3NpdG9yeSBwcnVuZSBlbWl0dGVkIGZyb20gaW1hZ2UtcmVnaXN0cnkncyBERUxFVEUgL2FwaS9pbWFnZXMvOm5hbWUg4oCUXG4gKiBkZWxldGVzIGV2ZXJ5IG1hbmlmZXN0IGluIGEgcmVwbyAodXNlZCB0byByZW1vdmUgZW1wdHkvZGVhZCByZXBvcyBmcm9tIHRoZVxuICogY2F0YWxvZykuIFVubGlrZSB0aGUgdGFnLWRlbGV0ZSBhYm92ZSwgdGhlcmUncyBubyBzaW5nbGUgYHJlZmAvYGRpZ2VzdGA6XG4gKiB0aGUgY291bnRzIHN1bW1hcml6ZSB0aGUgd2hvbGUgcmVwby5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBSZWdpc3RyeVJlcG9EZWxldGVBdWRpdCBleHRlbmRzIEF1ZGl0Q29ycmVsYXRpb24ge1xuICBldmVudDogJ3JlZ2lzdHJ5LnJlcG8uZGVsZXRlJztcbiAgYWN0b3I6IHN0cmluZztcbiAgcmVwbzogc3RyaW5nO1xuICAvKiogQ291bnQgb2YgdW5pcXVlIG1hbmlmZXN0IGRpZ2VzdHMgYWN0dWFsbHkgZGVsZXRlZC4gKi9cbiAgZGVsZXRlZE1hbmlmZXN0czogbnVtYmVyO1xuICAvKiogQ291bnQgb2YgdGFncyB0aGUgcmVwbyBoZWxkIGJlZm9yZSB0aGUgcHJ1bmUuICovXG4gIGRlbGV0ZWRUYWdzOiBudW1iZXI7XG59XG5cbi8qKiBVbmlvbiBvZiBldmVyeSBjcm9zcy1zZXJ2aWNlIGF1ZGl0IGV2ZW50IGN1cnJlbnRseSBlbWl0dGVkLiAqL1xuZXhwb3J0IHR5cGUgQXVkaXRFdmVudCA9IFJlZ2lzdHJ5VGFnQ29weUF1ZGl0IHwgUmVnaXN0cnlUYWdEZWxldGVBdWRpdCB8IFJlZ2lzdHJ5UmVwb0RlbGV0ZUF1ZGl0O1xuIl19

package/lib/types/catalog-metadata.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Developer-portal catalog metadata shared across catalog entities
+ * (pipelines and plugins today; any future catalogable entity next).
+ *
+ * These are the ownership/lifecycle/classification fields an internal
+ * developer portal keys its catalog, "my services" views, and scorecards
+ * off of — the counterpart to Backstage's `metadata`/`spec.owner`/
+ * `spec.lifecycle`. Kept here (not per-schema) so the DB schema, the Zod
+ * validation, and the API all draw from one source of truth.
+ */
+/** Lifecycle stage of a catalog entity. */
+export declare const LIFECYCLE_STAGES: readonly ['experimental', 'production', 'deprecated'];
+export type Lifecycle = (typeof LIFECYCLE_STAGES)[number];
+/** Default lifecycle applied when none is supplied (matches the DB column default). */
+export declare const DEFAULT_LIFECYCLE: Lifecycle;
+/** Operational criticality of a catalog entity (optional/unset by default). */
+export declare const CRITICALITY_LEVELS: readonly ['low', 'medium', 'high', 'critical'];
+export type Criticality = (typeof CRITICALITY_LEVELS)[number];
+/** Whether an owner reference points at an individual user or a team/org. */
+export declare const OWNER_TYPES: readonly ['user', 'team'];
+export type OwnerType = (typeof OWNER_TYPES)[number];
+/** A titled external link attached to a catalog entity (docs, dashboard, runbook, …). */
+export interface EntityLink {
+    readonly title: string;
+    readonly url: string;
+    /** Optional icon hint the UI may map to a glyph (e.g. 'docs', 'dashboard'). */
+    readonly icon?: string;
+}
+/** Free-form typed classification labels: `{ team: 'payments', tier: 'gold' }`. */
+export type EntityLabels = Record<string, string>;
+/** Owner reference for a catalog entity. */
+export interface CatalogOwnership {
+    /** User id (ownerType='user') or team/org id (ownerType='team'). */
+    readonly ownerId?: string | null;
+    readonly ownerType?: OwnerType | null;
+}

package/lib/types/catalog-metadata.js

@@ -0,0 +1,21 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Developer-portal catalog metadata shared across catalog entities
+ * (pipelines and plugins today; any future catalogable entity next).
+ *
+ * These are the ownership/lifecycle/classification fields an internal
+ * developer portal keys its catalog, "my services" views, and scorecards
+ * off of — the counterpart to Backstage's `metadata`/`spec.owner`/
+ * `spec.lifecycle`. Kept here (not per-schema) so the DB schema, the Zod
+ * validation, and the API all draw from one source of truth.
+ */
+/** Lifecycle stage of a catalog entity. */
+export const LIFECYCLE_STAGES = ['experimental', 'production', 'deprecated'];
+/** Default lifecycle applied when none is supplied (matches the DB column default). */
+export const DEFAULT_LIFECYCLE = 'production';
+/** Operational criticality of a catalog entity (optional/unset by default). */
+export const CRITICALITY_LEVELS = ['low', 'medium', 'high', 'critical'];
+/** Whether an owner reference points at an individual user or a team/org. */
+export const OWNER_TYPES = ['user', 'team'];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2F0YWxvZy1tZXRhZGF0YS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy90eXBlcy9jYXRhbG9nLW1ldGFkYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7OztHQVNHO0FBRUgsMkNBQTJDO0FBQzNDLE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxZQUFZLENBQVUsQ0FBQztBQUd0Rix1RkFBdUY7QUFDdkYsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQWMsWUFBWSxDQUFDO0FBRXpELCtFQUErRTtBQUMvRSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBVSxDQUFDO0FBR2pGLDZFQUE2RTtBQUM3RSxNQUFNLENBQUMsTUFBTSxXQUFXLEdBQUcsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFVLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBEZXZlbG9wZXItcG9ydGFsIGNhdGFsb2cgbWV0YWRhdGEgc2hhcmVkIGFjcm9zcyBjYXRhbG9nIGVudGl0aWVzXG4gKiAocGlwZWxpbmVzIGFuZCBwbHVnaW5zIHRvZGF5OyBhbnkgZnV0dXJlIGNhdGFsb2dhYmxlIGVudGl0eSBuZXh0KS5cbiAqXG4gKiBUaGVzZSBhcmUgdGhlIG93bmVyc2hpcC9saWZlY3ljbGUvY2xhc3NpZmljYXRpb24gZmllbGRzIGFuIGludGVybmFsXG4gKiBkZXZlbG9wZXIgcG9ydGFsIGtleXMgaXRzIGNhdGFsb2csIFwibXkgc2VydmljZXNcIiB2aWV3cywgYW5kIHNjb3JlY2FyZHNcbiAqIG9mZiBvZiDigJQgdGhlIGNvdW50ZXJwYXJ0IHRvIEJhY2tzdGFnZSdzIGBtZXRhZGF0YWAvYHNwZWMub3duZXJgL1xuICogYHNwZWMubGlmZWN5Y2xlYC4gS2VwdCBoZXJlIChub3QgcGVyLXNjaGVtYSkgc28gdGhlIERCIHNjaGVtYSwgdGhlIFpvZFxuICogdmFsaWRhdGlvbiwgYW5kIHRoZSBBUEkgYWxsIGRyYXcgZnJvbSBvbmUgc291cmNlIG9mIHRydXRoLlxuICovXG5cbi8qKiBMaWZlY3ljbGUgc3RhZ2Ugb2YgYSBjYXRhbG9nIGVudGl0eS4gKi9cbmV4cG9ydCBjb25zdCBMSUZFQ1lDTEVfU1RBR0VTID0gWydleHBlcmltZW50YWwnLCAncHJvZHVjdGlvbicsICdkZXByZWNhdGVkJ10gYXMgY29uc3Q7XG5leHBvcnQgdHlwZSBMaWZlY3ljbGUgPSAodHlwZW9mIExJRkVDWUNMRV9TVEFHRVMpW251bWJlcl07XG5cbi8qKiBEZWZhdWx0IGxpZmVjeWNsZSBhcHBsaWVkIHdoZW4gbm9uZSBpcyBzdXBwbGllZCAobWF0Y2hlcyB0aGUgREIgY29sdW1uIGRlZmF1bHQpLiAqL1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfTElGRUNZQ0xFOiBMaWZlY3ljbGUgPSAncHJvZHVjdGlvbic7XG5cbi8qKiBPcGVyYXRpb25hbCBjcml0aWNhbGl0eSBvZiBhIGNhdGFsb2cgZW50aXR5IChvcHRpb25hbC91bnNldCBieSBkZWZhdWx0KS4gKi9cbmV4cG9ydCBjb25zdCBDUklUSUNBTElUWV9MRVZFTFMgPSBbJ2xvdycsICdtZWRpdW0nLCAnaGlnaCcsICdjcml0aWNhbCddIGFzIGNvbnN0O1xuZXhwb3J0IHR5cGUgQ3JpdGljYWxpdHkgPSAodHlwZW9mIENSSVRJQ0FMSVRZX0xFVkVMUylbbnVtYmVyXTtcblxuLyoqIFdoZXRoZXIgYW4gb3duZXIgcmVmZXJlbmNlIHBvaW50cyBhdCBhbiBpbmRpdmlkdWFsIHVzZXIgb3IgYSB0ZWFtL29yZy4gKi9cbmV4cG9ydCBjb25zdCBPV05FUl9UWVBFUyA9IFsndXNlcicsICd0ZWFtJ10gYXMgY29uc3Q7XG5leHBvcnQgdHlwZSBPd25lclR5cGUgPSAodHlwZW9mIE9XTkVSX1RZUEVTKVtudW1iZXJdO1xuXG4vKiogQSB0aXRsZWQgZXh0ZXJuYWwgbGluayBhdHRhY2hlZCB0byBhIGNhdGFsb2cgZW50aXR5IChkb2NzLCBkYXNoYm9hcmQsIHJ1bmJvb2ssIOKApikuICovXG5leHBvcnQgaW50ZXJmYWNlIEVudGl0eUxpbmsge1xuICByZWFkb25seSB0aXRsZTogc3RyaW5nO1xuICByZWFkb25seSB1cmw6IHN0cmluZztcbiAgLyoqIE9wdGlvbmFsIGljb24gaGludCB0aGUgVUkgbWF5IG1hcCB0byBhIGdseXBoIChlLmcuICdkb2NzJywgJ2Rhc2hib2FyZCcpLiAqL1xuICByZWFkb25seSBpY29uPzogc3RyaW5nO1xufVxuXG4vKiogRnJlZS1mb3JtIHR5cGVkIGNsYXNzaWZpY2F0aW9uIGxhYmVsczogYHsgdGVhbTogJ3BheW1lbnRzJywgdGllcjogJ2dvbGQnIH1gLiAqL1xuZXhwb3J0IHR5cGUgRW50aXR5TGFiZWxzID0gUmVjb3JkPHN0cmluZywgc3RyaW5nPjtcblxuLyoqIE93bmVyIHJlZmVyZW5jZSBmb3IgYSBjYXRhbG9nIGVudGl0eS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQ2F0YWxvZ093bmVyc2hpcCB7XG4gIC8qKiBVc2VyIGlkIChvd25lclR5cGU9J3VzZXInKSBvciB0ZWFtL29yZyBpZCAob3duZXJUeXBlPSd0ZWFtJykuICovXG4gIHJlYWRvbmx5IG93bmVySWQ/OiBzdHJpbmcgfCBudWxsO1xuICByZWFkb25seSBvd25lclR5cGU/OiBPd25lclR5cGUgfCBudWxsO1xufVxuIl19