@pipeline-builder/api-core 0.0.1

package/lib/types/feature-flags.js

@@ -0,0 +1,128 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/** All valid feature flags (order determines display order). */
+export const ALL_FEATURE_FLAGS = [
+    'priority_support',
+    'ai_generation',
+    'bulk_operations',
+    'custom_integrations',
+    'audit_log',
+    'sso',
+    'advanced_reporting',
+    'team_usage_analytics',
+    'compliance_standard',
+    'compliance_advanced',
+];
+/** Check whether a string is a valid FeatureFlag. */
+export function isValidFeatureFlag(value) {
+    return ALL_FEATURE_FLAGS.includes(value);
+}
+// Tier-to-feature mapping
+/** Features enabled by default for each tier. */
+export const TIER_FEATURES = {
+    developer: [],
+    pro: ['priority_support', 'ai_generation', 'bulk_operations'],
+    // Team adds audit_log (collaboration/governance) and sso (SSO/IdP is INCLUDED
+    // in Team, not an add-on). advanced_reporting (DORA) is NOT a Team tier feature —
+    // it's INCLUDED only in Enterprise and sold as an add-on bundle to every other
+    // tier (see billing-config `advanced_reporting`). Enterprise unlocks all.
+    team: ['priority_support', 'ai_generation', 'bulk_operations', 'audit_log', 'sso'],
+    enterprise: [...ALL_FEATURE_FLAGS],
+    // Unlimited includes every feature / add-on bundle (billing-disabled default).
+    unlimited: [...ALL_FEATURE_FLAGS],
+};
+// Feature metadata (for display)
+/** Human-readable metadata for each feature flag. */
+export const FEATURE_METADATA = {
+    priority_support: {
+        label: 'Priority Support',
+        description: 'Faster response times and dedicated support channels',
+    },
+    ai_generation: {
+        label: 'AI Generation',
+        description: 'AI-powered pipeline and plugin generation',
+    },
+    bulk_operations: {
+        label: 'Bulk Operations',
+        description: 'Batch create, update, and delete for pipelines and plugins',
+    },
+    custom_integrations: {
+        label: 'Custom Integrations',
+        description: 'Connect to external services and custom webhook endpoints',
+    },
+    audit_log: {
+        label: 'Audit Log',
+        description: 'Detailed audit trail of all user and system actions',
+    },
+    sso: {
+        label: 'SSO / IdP',
+        description: 'Single sign-on and external identity-provider configurations',
+    },
+    advanced_reporting: {
+        label: 'Advanced Reporting',
+        description: 'DORA / advanced delivery analytics',
+    },
+    team_usage_analytics: {
+        label: 'Team Usage Analytics',
+        description: 'Per-team usage breakdown across the org → team subtree',
+    },
+    compliance_standard: {
+        label: 'Standard Compliance',
+        description: 'Curated CI/CD best-practice compliance rule library',
+    },
+    compliance_advanced: {
+        label: 'Advanced Compliance',
+        description: 'Curated framework compliance libraries (SOC2 / PCI-DSS / CIS)',
+    },
+};
+// Resolution logic
+/**
+ * Resolve a user's effective feature set.
+ *
+ * 1. Sysadmins (isSuperAdmin) always get ALL features.
+ * 2. Start with the tier's default features.
+ * 3. Apply per-user overrides: `true` adds a feature, `false` removes it.
+ * 4. Invalid override keys are silently ignored.
+ *
+ * @param tier - The organization's quota tier
+ * @param opts - Resolution options:
+ *   - `overrides`: per-user overrides (key = feature flag, value = enabled)
+ *   - `isSuperAdmin`: whether the user has the global super-admin flag
+ *   - `accountFeatures`: account-level entitlements (e.g. purchased add-on
+ *     bundles). A NAMED field so it can never be silently dropped by a caller
+ *     that omits a trailing positional arg.
+ * @returns Sorted array of enabled feature flags
+ */
+export function resolveUserFeatures(tier, opts) {
+    const { overrides: featureOverrides, isSuperAdmin, accountFeatures } = opts ?? {};
+    // Sysadmins get everything regardless of tier.
+    if (isSuperAdmin)
+        return [...ALL_FEATURE_FLAGS];
+    // Start with tier defaults
+    const features = new Set(TIER_FEATURES[tier] ?? []);
+    // Account-level entitlements (purchased feature bundles — e.g. audit_log, sso,
+    // advanced_reporting, team_usage_analytics, compliance_standard/advanced).
+    // Applied before per-user overrides so an explicit user override still wins.
+    if (accountFeatures) {
+        for (const key of accountFeatures) {
+            if (isValidFeatureFlag(key))
+                features.add(key);
+        }
+    }
+    // Apply per-user overrides
+    if (featureOverrides) {
+        for (const [key, enabled] of Object.entries(featureOverrides)) {
+            if (!isValidFeatureFlag(key))
+                continue;
+            if (enabled) {
+                features.add(key);
+            }
+            else {
+                features.delete(key);
+            }
+        }
+    }
+    // Return in canonical order
+    return ALL_FEATURE_FLAGS.filter(f => features.has(f));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZmVhdHVyZS1mbGFncy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy90eXBlcy9mZWF0dXJlLWZsYWdzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFtQ3RDLGdFQUFnRTtBQUNoRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBMkI7SUFDdkQsa0JBQWtCO0lBQ2xCLGVBQWU7SUFDZixpQkFBaUI7SUFDakIscUJBQXFCO0lBQ3JCLFdBQVc7SUFDWCxLQUFLO0lBQ0wsb0JBQW9CO0lBQ3BCLHNCQUFzQjtJQUN0QixxQkFBcUI7SUFDckIscUJBQXFCO0NBQ3RCLENBQUM7QUFFRixxREFBcUQ7QUFDckQsTUFBTSxVQUFVLGtCQUFrQixDQUFDLEtBQWE7SUFDOUMsT0FBUSxpQkFBdUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDbEUsQ0FBQztBQUVELDBCQUEwQjtBQUUxQixpREFBaUQ7QUFDakQsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUE4QztJQUN0RSxTQUFTLEVBQUUsRUFBRTtJQUNiLEdBQUcsRUFBRSxDQUFDLGtCQUFrQixFQUFFLGVBQWUsRUFBRSxpQkFBaUIsQ0FBQztJQUM3RCw4RUFBOEU7SUFDOUUsa0ZBQWtGO0lBQ2xGLCtFQUErRTtJQUMvRSwwRUFBMEU7SUFDMUUsSUFBSSxFQUFFLENBQUMsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLGlCQUFpQixFQUFFLFdBQVcsRUFBRSxLQUFLLENBQUM7SUFDbEYsVUFBVSxFQUFFLENBQUMsR0FBRyxpQkFBaUIsQ0FBQztJQUNsQywrRUFBK0U7SUFDL0UsU0FBUyxFQUFFLENBQUMsR0FBRyxpQkFBaUIsQ0FBQztDQUNsQyxDQUFDO0FBRUYsaUNBQWlDO0FBRWpDLHFEQUFxRDtBQUNyRCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBZ0U7SUFDM0YsZ0JBQWdCLEVBQUU7UUFDaEIsS0FBSyxFQUFFLGtCQUFrQjtRQUN6QixXQUFXLEVBQUUsc0RBQXNEO0tBQ3BFO0lBQ0QsYUFBYSxFQUFFO1FBQ2IsS0FBSyxFQUFFLGVBQWU7UUFDdEIsV0FBVyxFQUFFLDJDQUEyQztLQUN6RDtJQUNELGVBQWUsRUFBRTtRQUNmLEtBQUssRUFBRSxpQkFBaUI7UUFDeEIsV0FBVyxFQUFFLDREQUE0RDtLQUMxRTtJQUNELG1CQUFtQixFQUFFO1FBQ25CLEtBQUssRUFBRSxxQkFBcUI7UUFDNUIsV0FBVyxFQUFFLDJEQUEyRDtLQUN6RTtJQUNELFNBQVMsRUFBRTtRQUNULEtBQUssRUFBRSxXQUFXO1FBQ2xCLFdBQVcsRUFBRSxxREFBcUQ7S0FDbkU7SUFDRCxHQUFHLEVBQUU7UUFDSCxLQUFLLEVBQUUsV0FBVztRQUNsQixXQUFXLEVBQUUsOERBQThEO0tBQzVFO0lBQ0Qsa0JBQWtCLEVBQUU7UUFDbEIsS0FBSyxFQUFFLG9CQUFvQjtRQUMzQixXQUFXLEVBQUUsb0NBQW9DO0tBQ2xEO0lBQ0Qsb0JBQW9CLEVBQUU7UUFDcEIsS0FBSyxFQUFFLHNCQUFzQjtRQUM3QixXQUFXLEVBQUUsd0RBQXdEO0tBQ3RFO0lBQ0QsbUJBQW1CLEVBQUU7UUFDbkIsS0FBSyxFQUFFLHFCQUFxQjtRQUM1QixXQUFXLEVBQUUscURBQXFEO0tBQ25FO0lBQ0QsbUJBQW1CLEVBQUU7UUFDbkIsS0FBSyxFQUFFLHFCQUFxQjtRQUM1QixXQUFXLEVBQUUsK0RBQStEO0tBQzdFO0NBQ0YsQ0FBQztBQUVGLG1CQUFtQjtBQUVuQjs7Ozs7Ozs7Ozs7Ozs7OztHQWdCRztBQUNILE1BQU0sVUFBVSxtQkFBbUIsQ0FDakMsSUFBZSxFQUNmLElBSUM7SUFFRCxNQUFNLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxlQUFlLEVBQUUsR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO0lBRWxGLCtDQUErQztJQUMvQyxJQUFJLFlBQVk7UUFBRSxPQUFPLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDO0lBRWhELDJCQUEyQjtJQUMzQixNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBYyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFFakUsK0VBQStFO0lBQy9FLDJFQUEyRTtJQUMzRSw2RUFBNkU7SUFDN0UsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUNwQixLQUFLLE1BQU0sR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO1lBQ2xDLElBQUksa0JBQWtCLENBQUMsR0FBRyxDQUFDO2dCQUFFLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakQsQ0FBQztJQUNILENBQUM7SUFFRCwyQkFBMkI7SUFDM0IsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1FBQ3JCLEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztZQUM5RCxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDO2dCQUFFLFNBQVM7WUFDdkMsSUFBSSxPQUFPLEVBQUUsQ0FBQztnQkFDWixRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3BCLENBQUM7aUJBQU0sQ0FBQztnQkFDTixRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3ZCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVELDRCQUE0QjtJQUM1QixPQUFPLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN4RCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB0eXBlIHsgUXVvdGFUaWVyIH0gZnJvbSAnLi9xdW90YS10aWVycy5qcyc7XG5cbi8vIEZlYXR1cmUgZmxhZyBpZGVudGlmaWVyc1xuXG4vKiogQ2Fub25pY2FsIGZlYXR1cmUgZmxhZyBpZGVudGlmaWVycy4gKi9cbmV4cG9ydCB0eXBlIEZlYXR1cmVGbGFnID1cbiAgLy8gYHByaW9yaXR5X3N1cHBvcnRgIGFuZCBgY3VzdG9tX2ludGVncmF0aW9uc2AgYXJlIEVOVEVSUFJJU0UtRVhDTFVTSVZFXG4gIC8vIG1hcmtldGluZy9lbnRpdGxlbWVudCBmbGFnczogZ3JhbnRlZCBvbmx5IGJ5IHRoZSBlbnRlcnByaXNlIHRpZXIgKG5vIGFkZC1vblxuICAvLyBidW5kbGUgc2VsbHMgdGhlbSB0byBhIGxvd2VyIHRpZXIg4oCUIGludGVudGlvbmFsLCB0aGV5IGFuY2hvciB0aGUgRW50ZXJwcmlzZVxuICAvLyBwbGFuKSBhbmQgbm90IGN1cnJlbnRseSBgcmVxdWlyZUZlYXR1cmVgLWdhdGVkIG9uIGFueSByb3V0ZSAodGhleSBzdXJmYWNlIGluXG4gIC8vIHBsYW4gbWFya2V0aW5nICsgdGhlIGVudGl0bGVtZW50IHNldDsgZW5mb3JjZW1lbnQgaXMgYSBmdXR1cmUgaG9vaykuIFRoaXMgaXNcbiAgLy8gYnkgZGVzaWduLCBub3QgZGVhZCBjb2RlIOKAlCBkbyBub3QgXCJmaXhcIiBieSB3aXJpbmcgYSBidW5kbGUgd2l0aG91dCBhIHByaWNpbmdcbiAgLy8gZGVjaXNpb24uIENvbnRyYXN0IGBhdWRpdF9sb2dgL2Bzc29gL2BhZHZhbmNlZF9yZXBvcnRpbmdgLCB3aGljaCBBUkUgc29sZCBhc1xuICAvLyBhZGQtb24gYnVuZGxlcyBhbmQgZ2F0ZWQgKHNlZSBiaWxsaW5nLWNvbmZpZyBgbG9hZEJ1bmRsZXNgICsgYHJlcXVpcmVGZWF0dXJlYCkuXG4gIHwgJ3ByaW9yaXR5X3N1cHBvcnQnXG4gIHwgJ2N1c3RvbV9pbnRlZ3JhdGlvbnMnXG4gIHwgJ2FpX2dlbmVyYXRpb24nXG4gIHwgJ2J1bGtfb3BlcmF0aW9ucydcbiAgfCAnYXVkaXRfbG9nJ1xuICB8ICdzc28nXG4gIC8vIERPUkEgLyBhZHZhbmNlZCBkZWxpdmVyeSBhbmFseXRpY3MgKHBhaWQgdGllcnMgb25seSkuXG4gIHwgJ2FkdmFuY2VkX3JlcG9ydGluZydcbiAgLy8gUGVyLXRlYW0gdXNhZ2UgYnJlYWtkb3duIGFjcm9zcyB0aGUgb3Jn4oaSdGVhbSBzdWJ0cmVlLiBJTkNMVURFRCBpbiBFbnRlcnByaXNlO1xuICAvLyBzb2xkIGFzIGFuIGFkZC1vbiBidW5kbGUgdG8gUHJvL1RlYW0gKHNlZSBiaWxsaW5nLWNvbmZpZyBgdGVhbV91c2FnZV9hbmFseXRpY3NgKS5cbiAgfCAndGVhbV91c2FnZV9hbmFseXRpY3MnXG4gIC8vIEN1cmF0ZWQgY29tcGxpYW5jZSBydWxlIGxpYnJhcmllcyBzb2xkIGFzIGFkZC1vbiBidW5kbGVzLiBgY29tcGxpYW5jZV9zdGFuZGFyZGBcbiAgLy8gPSBDSS9DRCBiZXN0LXByYWN0aWNlIHNldDsgYGNvbXBsaWFuY2VfYWR2YW5jZWRgID0gU09DMi9QQ0kvQ0lTIGZyYW1ld29ya1xuICAvLyBsaWJyYXJpZXMgKHJlcXVpcmVzIFN0YW5kYXJkKS4gVGhlc2UgZ2F0ZSBTVUJTQ1JJQklORyB0byB0aGUgc2V0J3Mgc3lzdGVtLW9yZ1xuICAvLyBwdWJsaXNoZWQgcnVsZXM7IElOQ0xVREVEIGluIEVudGVycHJpc2UvVW5saW1pdGVkICh2aWEgQUxMX0ZFQVRVUkVfRkxBR1MpLFxuICAvLyBzb2xkIHRvIERldmVsb3Blci9Qcm8vVGVhbSAoc2VlIGJpbGxpbmctY29uZmlnIGBjb21wbGlhbmNlX3N0YW5kYXJkL2FkdmFuY2VkYCkuXG4gIHwgJ2NvbXBsaWFuY2Vfc3RhbmRhcmQnXG4gIHwgJ2NvbXBsaWFuY2VfYWR2YW5jZWQnO1xuXG4vKiogQWxsIHZhbGlkIGZlYXR1cmUgZmxhZ3MgKG9yZGVyIGRldGVybWluZXMgZGlzcGxheSBvcmRlcikuICovXG5leHBvcnQgY29uc3QgQUxMX0ZFQVRVUkVfRkxBR1M6IHJlYWRvbmx5IEZlYXR1cmVGbGFnW10gPSBbXG4gICdwcmlvcml0eV9zdXBwb3J0JyxcbiAgJ2FpX2dlbmVyYXRpb24nLFxuICAnYnVsa19vcGVyYXRpb25zJyxcbiAgJ2N1c3RvbV9pbnRlZ3JhdGlvbnMnLFxuICAnYXVkaXRfbG9nJyxcbiAgJ3NzbycsXG4gICdhZHZhbmNlZF9yZXBvcnRpbmcnLFxuICAndGVhbV91c2FnZV9hbmFseXRpY3MnLFxuICAnY29tcGxpYW5jZV9zdGFuZGFyZCcsXG4gICdjb21wbGlhbmNlX2FkdmFuY2VkJyxcbl07XG5cbi8qKiBDaGVjayB3aGV0aGVyIGEgc3RyaW5nIGlzIGEgdmFsaWQgRmVhdHVyZUZsYWcuICovXG5leHBvcnQgZnVuY3Rpb24gaXNWYWxpZEZlYXR1cmVGbGFnKHZhbHVlOiBzdHJpbmcpOiB2YWx1ZSBpcyBGZWF0dXJlRmxhZyB7XG4gIHJldHVybiAoQUxMX0ZFQVRVUkVfRkxBR1MgYXMgcmVhZG9ubHkgc3RyaW5nW10pLmluY2x1ZGVzKHZhbHVlKTtcbn1cblxuLy8gVGllci10by1mZWF0dXJlIG1hcHBpbmdcblxuLyoqIEZlYXR1cmVzIGVuYWJsZWQgYnkgZGVmYXVsdCBmb3IgZWFjaCB0aWVyLiAqL1xuZXhwb3J0IGNvbnN0IFRJRVJfRkVBVFVSRVM6IFJlY29yZDxRdW90YVRpZXIsIHJlYWRvbmx5IEZlYXR1cmVGbGFnW10+ID0ge1xuICBkZXZlbG9wZXI6IFtdLFxuICBwcm86IFsncHJpb3JpdHlfc3VwcG9ydCcsICdhaV9nZW5lcmF0aW9uJywgJ2J1bGtfb3BlcmF0aW9ucyddLFxuICAvLyBUZWFtIGFkZHMgYXVkaXRfbG9nIChjb2xsYWJvcmF0aW9uL2dvdmVybmFuY2UpIGFuZCBzc28gKFNTTy9JZFAgaXMgSU5DTFVERURcbiAgLy8gaW4gVGVhbSwgbm90IGFuIGFkZC1vbikuIGFkdmFuY2VkX3JlcG9ydGluZyAoRE9SQSkgaXMgTk9UIGEgVGVhbSB0aWVyIGZlYXR1cmUg4oCUXG4gIC8vIGl0J3MgSU5DTFVERUQgb25seSBpbiBFbnRlcnByaXNlIGFuZCBzb2xkIGFzIGFuIGFkZC1vbiBidW5kbGUgdG8gZXZlcnkgb3RoZXJcbiAgLy8gdGllciAoc2VlIGJpbGxpbmctY29uZmlnIGBhZHZhbmNlZF9yZXBvcnRpbmdgKS4gRW50ZXJwcmlzZSB1bmxvY2tzIGFsbC5cbiAgdGVhbTogWydwcmlvcml0eV9zdXBwb3J0JywgJ2FpX2dlbmVyYXRpb24nLCAnYnVsa19vcGVyYXRpb25zJywgJ2F1ZGl0X2xvZycsICdzc28nXSxcbiAgZW50ZXJwcmlzZTogWy4uLkFMTF9GRUFUVVJFX0ZMQUdTXSxcbiAgLy8gVW5saW1pdGVkIGluY2x1ZGVzIGV2ZXJ5IGZlYXR1cmUgLyBhZGQtb24gYnVuZGxlIChiaWxsaW5nLWRpc2FibGVkIGRlZmF1bHQpLlxuICB1bmxpbWl0ZWQ6IFsuLi5BTExfRkVBVFVSRV9GTEFHU10sXG59O1xuXG4vLyBGZWF0dXJlIG1ldGFkYXRhIChmb3IgZGlzcGxheSlcblxuLyoqIEh1bWFuLXJlYWRhYmxlIG1ldGFkYXRhIGZvciBlYWNoIGZlYXR1cmUgZmxhZy4gKi9cbmV4cG9ydCBjb25zdCBGRUFUVVJFX01FVEFEQVRBOiBSZWNvcmQ8RmVhdHVyZUZsYWcsIHsgbGFiZWw6IHN0cmluZzsgZGVzY3JpcHRpb246IHN0cmluZyB9PiA9IHtcbiAgcHJpb3JpdHlfc3VwcG9ydDoge1xuICAgIGxhYmVsOiAnUHJpb3JpdHkgU3VwcG9ydCcsXG4gICAgZGVzY3JpcHRpb246ICdGYXN0ZXIgcmVzcG9uc2UgdGltZXMgYW5kIGRlZGljYXRlZCBzdXBwb3J0IGNoYW5uZWxzJyxcbiAgfSxcbiAgYWlfZ2VuZXJhdGlvbjoge1xuICAgIGxhYmVsOiAnQUkgR2VuZXJhdGlvbicsXG4gICAgZGVzY3JpcHRpb246ICdBSS1wb3dlcmVkIHBpcGVsaW5lIGFuZCBwbHVnaW4gZ2VuZXJhdGlvbicsXG4gIH0sXG4gIGJ1bGtfb3BlcmF0aW9uczoge1xuICAgIGxhYmVsOiAnQnVsayBPcGVyYXRpb25zJyxcbiAgICBkZXNjcmlwdGlvbjogJ0JhdGNoIGNyZWF0ZSwgdXBkYXRlLCBhbmQgZGVsZXRlIGZvciBwaXBlbGluZXMgYW5kIHBsdWdpbnMnLFxuICB9LFxuICBjdXN0b21faW50ZWdyYXRpb25zOiB7XG4gICAgbGFiZWw6ICdDdXN0b20gSW50ZWdyYXRpb25zJyxcbiAgICBkZXNjcmlwdGlvbjogJ0Nvbm5lY3QgdG8gZXh0ZXJuYWwgc2VydmljZXMgYW5kIGN1c3RvbSB3ZWJob29rIGVuZHBvaW50cycsXG4gIH0sXG4gIGF1ZGl0X2xvZzoge1xuICAgIGxhYmVsOiAnQXVkaXQgTG9nJyxcbiAgICBkZXNjcmlwdGlvbjogJ0RldGFpbGVkIGF1ZGl0IHRyYWlsIG9mIGFsbCB1c2VyIGFuZCBzeXN0ZW0gYWN0aW9ucycsXG4gIH0sXG4gIHNzbzoge1xuICAgIGxhYmVsOiAnU1NPIC8gSWRQJyxcbiAgICBkZXNjcmlwdGlvbjogJ1NpbmdsZSBzaWduLW9uIGFuZCBleHRlcm5hbCBpZGVudGl0eS1wcm92aWRlciBjb25maWd1cmF0aW9ucycsXG4gIH0sXG4gIGFkdmFuY2VkX3JlcG9ydGluZzoge1xuICAgIGxhYmVsOiAnQWR2YW5jZWQgUmVwb3J0aW5nJyxcbiAgICBkZXNjcmlwdGlvbjogJ0RPUkEgLyBhZHZhbmNlZCBkZWxpdmVyeSBhbmFseXRpY3MnLFxuICB9LFxuICB0ZWFtX3VzYWdlX2FuYWx5dGljczoge1xuICAgIGxhYmVsOiAnVGVhbSBVc2FnZSBBbmFseXRpY3MnLFxuICAgIGRlc2NyaXB0aW9uOiAnUGVyLXRlYW0gdXNhZ2UgYnJlYWtkb3duIGFjcm9zcyB0aGUgb3JnIOKGkiB0ZWFtIHN1YnRyZWUnLFxuICB9LFxuICBjb21wbGlhbmNlX3N0YW5kYXJkOiB7XG4gICAgbGFiZWw6ICdTdGFuZGFyZCBDb21wbGlhbmNlJyxcbiAgICBkZXNjcmlwdGlvbjogJ0N1cmF0ZWQgQ0kvQ0QgYmVzdC1wcmFjdGljZSBjb21wbGlhbmNlIHJ1bGUgbGlicmFyeScsXG4gIH0sXG4gIGNvbXBsaWFuY2VfYWR2YW5jZWQ6IHtcbiAgICBsYWJlbDogJ0FkdmFuY2VkIENvbXBsaWFuY2UnLFxuICAgIGRlc2NyaXB0aW9uOiAnQ3VyYXRlZCBmcmFtZXdvcmsgY29tcGxpYW5jZSBsaWJyYXJpZXMgKFNPQzIgLyBQQ0ktRFNTIC8gQ0lTKScsXG4gIH0sXG59O1xuXG4vLyBSZXNvbHV0aW9uIGxvZ2ljXG5cbi8qKlxuICogUmVzb2x2ZSBhIHVzZXIncyBlZmZlY3RpdmUgZmVhdHVyZSBzZXQuXG4gKlxuICogMS4gU3lzYWRtaW5zIChpc1N1cGVyQWRtaW4pIGFsd2F5cyBnZXQgQUxMIGZlYXR1cmVzLlxuICogMi4gU3RhcnQgd2l0aCB0aGUgdGllcidzIGRlZmF1bHQgZmVhdHVyZXMuXG4gKiAzLiBBcHBseSBwZXItdXNlciBvdmVycmlkZXM6IGB0cnVlYCBhZGRzIGEgZmVhdHVyZSwgYGZhbHNlYCByZW1vdmVzIGl0LlxuICogNC4gSW52YWxpZCBvdmVycmlkZSBrZXlzIGFyZSBzaWxlbnRseSBpZ25vcmVkLlxuICpcbiAqIEBwYXJhbSB0aWVyIC0gVGhlIG9yZ2FuaXphdGlvbidzIHF1b3RhIHRpZXJcbiAqIEBwYXJhbSBvcHRzIC0gUmVzb2x1dGlvbiBvcHRpb25zOlxuICogICAtIGBvdmVycmlkZXNgOiBwZXItdXNlciBvdmVycmlkZXMgKGtleSA9IGZlYXR1cmUgZmxhZywgdmFsdWUgPSBlbmFibGVkKVxuICogICAtIGBpc1N1cGVyQWRtaW5gOiB3aGV0aGVyIHRoZSB1c2VyIGhhcyB0aGUgZ2xvYmFsIHN1cGVyLWFkbWluIGZsYWdcbiAqICAgLSBgYWNjb3VudEZlYXR1cmVzYDogYWNjb3VudC1sZXZlbCBlbnRpdGxlbWVudHMgKGUuZy4gcHVyY2hhc2VkIGFkZC1vblxuICogICAgIGJ1bmRsZXMpLiBBIE5BTUVEIGZpZWxkIHNvIGl0IGNhbiBuZXZlciBiZSBzaWxlbnRseSBkcm9wcGVkIGJ5IGEgY2FsbGVyXG4gKiAgICAgdGhhdCBvbWl0cyBhIHRyYWlsaW5nIHBvc2l0aW9uYWwgYXJnLlxuICogQHJldHVybnMgU29ydGVkIGFycmF5IG9mIGVuYWJsZWQgZmVhdHVyZSBmbGFnc1xuICovXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZVVzZXJGZWF0dXJlcyhcbiAgdGllcjogUXVvdGFUaWVyLFxuICBvcHRzPzoge1xuICAgIG92ZXJyaWRlcz86IFJlY29yZDxzdHJpbmcsIGJvb2xlYW4+IHwgbnVsbDtcbiAgICBpc1N1cGVyQWRtaW4/OiBib29sZWFuO1xuICAgIGFjY291bnRGZWF0dXJlcz86IHJlYWRvbmx5IHN0cmluZ1tdIHwgbnVsbDtcbiAgfSxcbik6IEZlYXR1cmVGbGFnW10ge1xuICBjb25zdCB7IG92ZXJyaWRlczogZmVhdHVyZU92ZXJyaWRlcywgaXNTdXBlckFkbWluLCBhY2NvdW50RmVhdHVyZXMgfSA9IG9wdHMgPz8ge307XG5cbiAgLy8gU3lzYWRtaW5zIGdldCBldmVyeXRoaW5nIHJlZ2FyZGxlc3Mgb2YgdGllci5cbiAgaWYgKGlzU3VwZXJBZG1pbikgcmV0dXJuIFsuLi5BTExfRkVBVFVSRV9GTEFHU107XG5cbiAgLy8gU3RhcnQgd2l0aCB0aWVyIGRlZmF1bHRzXG4gIGNvbnN0IGZlYXR1cmVzID0gbmV3IFNldDxGZWF0dXJlRmxhZz4oVElFUl9GRUFUVVJFU1t0aWVyXSA/PyBbXSk7XG5cbiAgLy8gQWNjb3VudC1sZXZlbCBlbnRpdGxlbWVudHMgKHB1cmNoYXNlZCBmZWF0dXJlIGJ1bmRsZXMg4oCUIGUuZy4gYXVkaXRfbG9nLCBzc28sXG4gIC8vIGFkdmFuY2VkX3JlcG9ydGluZywgdGVhbV91c2FnZV9hbmFseXRpY3MsIGNvbXBsaWFuY2Vfc3RhbmRhcmQvYWR2YW5jZWQpLlxuICAvLyBBcHBsaWVkIGJlZm9yZSBwZXItdXNlciBvdmVycmlkZXMgc28gYW4gZXhwbGljaXQgdXNlciBvdmVycmlkZSBzdGlsbCB3aW5zLlxuICBpZiAoYWNjb3VudEZlYXR1cmVzKSB7XG4gICAgZm9yIChjb25zdCBrZXkgb2YgYWNjb3VudEZlYXR1cmVzKSB7XG4gICAgICBpZiAoaXNWYWxpZEZlYXR1cmVGbGFnKGtleSkpIGZlYXR1cmVzLmFkZChrZXkpO1xuICAgIH1cbiAgfVxuXG4gIC8vIEFwcGx5IHBlci11c2VyIG92ZXJyaWRlc1xuICBpZiAoZmVhdHVyZU92ZXJyaWRlcykge1xuICAgIGZvciAoY29uc3QgW2tleSwgZW5hYmxlZF0gb2YgT2JqZWN0LmVudHJpZXMoZmVhdHVyZU92ZXJyaWRlcykpIHtcbiAgICAgIGlmICghaXNWYWxpZEZlYXR1cmVGbGFnKGtleSkpIGNvbnRpbnVlO1xuICAgICAgaWYgKGVuYWJsZWQpIHtcbiAgICAgICAgZmVhdHVyZXMuYWRkKGtleSk7XG4gICAgICB9IGVsc2Uge1xuICAgICAgICBmZWF0dXJlcy5kZWxldGUoa2V5KTtcbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICAvLyBSZXR1cm4gaW4gY2Fub25pY2FsIG9yZGVyXG4gIHJldHVybiBBTExfRkVBVFVSRV9GTEFHUy5maWx0ZXIoZiA9PiBmZWF0dXJlcy5oYXMoZikpO1xufVxuIl19

package/lib/types/http.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Generic HTTP headers representation.
+ */
+export interface HttpHeaders {
+    [key: string]: string | string[] | undefined;
+}
+/**
+ * Generic HTTP request interface.
+ * Represents the minimal request shape needed by api-core utilities.
+ */
+export interface HttpRequest {
+    /** Request headers */
+    headers: HttpHeaders;
+    /** Route parameters */
+    params: Record<string, string | string[] | undefined>;
+    /** Query parameters */
+    query: Record<string, unknown>;
+    /** Authenticated user (if present). `sub` is the OIDC-standard subject
+     *  (= user id); higher-level layers may attach additional fields, hence
+     *  the index signature. */
+    user?: {
+        sub?: string;
+        organizationId?: string;
+        role?: string;
+        [key: string]: unknown;
+    };
+}

package/lib/types/http.js

@@ -0,0 +1,4 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaHR0cC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy90eXBlcy9odHRwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0MiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBHZW5lcmljIEhUVFAgaGVhZGVycyByZXByZXNlbnRhdGlvbi5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBIdHRwSGVhZGVycyB7XG4gIFtrZXk6IHN0cmluZ106IHN0cmluZyB8IHN0cmluZ1tdIHwgdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIEdlbmVyaWMgSFRUUCByZXF1ZXN0IGludGVyZmFjZS5cbiAqIFJlcHJlc2VudHMgdGhlIG1pbmltYWwgcmVxdWVzdCBzaGFwZSBuZWVkZWQgYnkgYXBpLWNvcmUgdXRpbGl0aWVzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEh0dHBSZXF1ZXN0IHtcbiAgLyoqIFJlcXVlc3QgaGVhZGVycyAqL1xuICBoZWFkZXJzOiBIdHRwSGVhZGVycztcbiAgLyoqIFJvdXRlIHBhcmFtZXRlcnMgKi9cbiAgcGFyYW1zOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCBzdHJpbmdbXSB8IHVuZGVmaW5lZD47XG4gIC8qKiBRdWVyeSBwYXJhbWV0ZXJzICovXG4gIHF1ZXJ5OiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgLyoqIEF1dGhlbnRpY2F0ZWQgdXNlciAoaWYgcHJlc2VudCkuIGBzdWJgIGlzIHRoZSBPSURDLXN0YW5kYXJkIHN1YmplY3RcbiAgICogICg9IHVzZXIgaWQpOyBoaWdoZXItbGV2ZWwgbGF5ZXJzIG1heSBhdHRhY2ggYWRkaXRpb25hbCBmaWVsZHMsIGhlbmNlXG4gICAqICB0aGUgaW5kZXggc2lnbmF0dXJlLiAqL1xuICB1c2VyPzoge1xuICAgIHN1Yj86IHN0cmluZztcbiAgICBvcmdhbml6YXRpb25JZD86IHN0cmluZztcbiAgICByb2xlPzogc3RyaW5nO1xuICAgIFtrZXk6IHN0cmluZ106IHVua25vd247XG4gIH07XG59XG5cbiJdfQ==

package/lib/types/index.d.ts

@@ -0,0 +1,11 @@
+export * from './error-codes.js';
+export * from './common.js';
+export * from './pipeline.js';
+export * from './catalog-metadata.js';
+export * from './pipeline-template.js';
+export * from './visibility.js';
+export * from './http.js';
+export * from './quota-tiers.js';
+export * from './feature-flags.js';
+export * from './permissions.js';
+export * from './audit-events.js';

package/lib/types/index.js

@@ -0,0 +1,14 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export * from './error-codes.js';
+export * from './common.js';
+export * from './pipeline.js';
+export * from './catalog-metadata.js';
+export * from './pipeline-template.js';
+export * from './visibility.js';
+export * from './http.js';
+export * from './quota-tiers.js';
+export * from './feature-flags.js';
+export * from './permissions.js';
+export * from './audit-events.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsbUJBQW1CLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuZXhwb3J0ICogZnJvbSAnLi9lcnJvci1jb2Rlcy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2NvbW1vbi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3BpcGVsaW5lLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY2F0YWxvZy1tZXRhZGF0YS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3BpcGVsaW5lLXRlbXBsYXRlLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vdmlzaWJpbGl0eS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2h0dHAuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9xdW90YS10aWVycy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2ZlYXR1cmUtZmxhZ3MuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9wZXJtaXNzaW9ucy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2F1ZGl0LWV2ZW50cy5qcyc7XG4iXX0=

package/lib/types/permissions.d.ts

@@ -0,0 +1,65 @@
+import type { OrgRole } from './common.js';
+/**
+ * Canonical fine-grained permission identifiers, in `resource:action` form.
+ *
+ * These are the ORG-SCOPED capabilities a Role can grant (RBAC). Coarse by
+ * design — `:write` covers create/update/delete for a resource — so the catalog
+ * and permission-picker UI stay small; split a `:write` into `:create`/`:delete`
+ * later if a resource needs it.
+ *
+ * NOT modeled here (intentionally): platform-operator actions (org delete, tier/
+ * quota override, user admin, impersonation, platform settings) stay behind the
+ * global `isSuperAdmin` flag, not a per-org permission; and `requireStepUp`
+ * (MFA) / `requireFeature` (plan entitlements) remain orthogonal gates.
+ */
+export type Permission = 'pipelines:read' | 'pipelines:write' | 'pipelines:publish' | 'templates:read' | 'templates:write' | 'templates:publish' | 'plugins:read' | 'plugins:write' | 'plugins:publish' | 'compliance:read' | 'compliance:write' | 'members:manage' | 'roles:manage' | 'invitations:manage' | 'dashboards:read' | 'dashboards:write' | 'observability:read' | 'observability:write' | 'reports:read' | 'reports:rollup' | 'messages:read' | 'messages:write' | 'billing:read' | 'billing:manage' | 'quotas:read' | 'registry:read' | 'registry:write' | 'org:settings' | 'org:idp' | 'org:kms';
+/** All valid permissions (order determines display order in the picker). */
+export declare const ALL_PERMISSIONS: readonly Permission[];
+/** Check whether a string is a valid Permission. */
+export declare function isValidPermission(value: string): value is Permission;
+/**
+ * Permissions that must NEVER be grantable through a user-authored CUSTOM Role —
+ * they gate platform-operator surfaces (the shared image registry), so allowing
+ * an org admin to mint a Role carrying them would be a latent privilege
+ * escalation. They are NOT seeded into ANY built-in Role bundle (neither
+ * `member` nor `admin`), so the only holder is a superadmin (implicit-all) —
+ * which is what makes the image-registry gates that require them effectively
+ * superadmin-only. This list ALSO blocks custom-Role authoring from requesting
+ * them (see platform `sanitizePermissions`).
+ */
+export declare const SUPERADMIN_ONLY_PERMISSIONS: readonly Permission[];
+/**
+ * Permissions an org may assign via a CUSTOM Role — every permission except the
+ * {@link SUPERADMIN_ONLY_PERMISSIONS}. Custom-Role create/update validates the
+ * requested permission set against this (see platform roles-service).
+ */
+export declare const ORG_ASSIGNABLE_PERMISSIONS: readonly Permission[];
+/** Whether `permission` may be granted through a user-authored custom Role. */
+export declare function isOrgAssignablePermission(permission: Permission): boolean;
+/**
+ * Seed bundle for each built-in Role, keyed by the coarse role it grants.
+ * Consumed by the Role seeder + the startup backfill to populate a built-in
+ * Role's `permissions[]`. NOT consulted at request time — see
+ * {@link resolveUserPermissions}.
+ */
+export declare const ROLE_PERMISSIONS: Record<OrgRole, readonly Permission[]>;
+/**
+ * Resolve a user's effective org permissions from the Roles assigned to them.
+ *
+ * Single-source model: a user's abilities are EXACTLY the union of the
+ * permissions carried by the Roles they hold (a Role = a named permission set;
+ * built-in Roles carry their bundle explicitly, seeded from
+ * {@link ROLE_PERMISSIONS}). There is no separate role-derived baseline — the
+ * coarse `role` label no longer grants anything on its own.
+ *
+ * 1. Platform superadmins (`isSuperAdmin`) always get ALL permissions.
+ * 2. Otherwise, union every permission granted by the user's assigned Roles.
+ * 3. Invalid/unknown permission strings are silently ignored.
+ *
+ * @param assignedPermissions - Flattened permissions from every Role the user holds
+ * @param isSuperAdmin - Whether the user has the global super-admin flag
+ * @returns Effective permissions in canonical order
+ */
+export declare function resolveUserPermissions(assignedPermissions?: readonly string[] | null, isSuperAdmin?: boolean): Permission[];
+/** Whether a resolved permission list grants `permission` (superadmin ⇒ always). */
+export declare function hasPermission(granted: readonly string[] | null | undefined, permission: Permission, isSuperAdmin?: boolean): boolean;

package/lib/types/permissions.js

@@ -0,0 +1,131 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/** All valid permissions (order determines display order in the picker). */
+export const ALL_PERMISSIONS = [
+    'pipelines:read', 'pipelines:write', 'pipelines:publish',
+    'templates:read', 'templates:write', 'templates:publish',
+    'plugins:read', 'plugins:write', 'plugins:publish',
+    'compliance:read', 'compliance:write',
+    'members:manage', 'roles:manage', 'invitations:manage',
+    'dashboards:read', 'dashboards:write',
+    'observability:read', 'observability:write',
+    'reports:read', 'reports:rollup',
+    'messages:read', 'messages:write',
+    'billing:read', 'billing:manage',
+    'quotas:read',
+    'registry:read', 'registry:write',
+    'org:settings', 'org:idp', 'org:kms',
+];
+/** Check whether a string is a valid Permission. */
+export function isValidPermission(value) {
+    return ALL_PERMISSIONS.includes(value);
+}
+/**
+ * Permissions that must NEVER be grantable through a user-authored CUSTOM Role —
+ * they gate platform-operator surfaces (the shared image registry), so allowing
+ * an org admin to mint a Role carrying them would be a latent privilege
+ * escalation. They are NOT seeded into ANY built-in Role bundle (neither
+ * `member` nor `admin`), so the only holder is a superadmin (implicit-all) —
+ * which is what makes the image-registry gates that require them effectively
+ * superadmin-only. This list ALSO blocks custom-Role authoring from requesting
+ * them (see platform `sanitizePermissions`).
+ */
+export const SUPERADMIN_ONLY_PERMISSIONS = [
+    'registry:read',
+    'registry:write',
+];
+/**
+ * Permissions an org may assign via a CUSTOM Role — every permission except the
+ * {@link SUPERADMIN_ONLY_PERMISSIONS}. Custom-Role create/update validates the
+ * requested permission set against this (see platform roles-service).
+ */
+export const ORG_ASSIGNABLE_PERMISSIONS = ALL_PERMISSIONS.filter((p) => !SUPERADMIN_ONLY_PERMISSIONS.includes(p));
+/** Whether `permission` may be granted through a user-authored custom Role. */
+export function isOrgAssignablePermission(permission) {
+    return !SUPERADMIN_ONLY_PERMISSIONS.includes(permission);
+}
+// =============================================================================
+// Built-in Role seed bundles
+// =============================================================================
+/**
+ * Permission bundles used to SEED the built-in Roles ("Admin", "Member").
+ *
+ * This is the single definition of what those built-in Roles grant — it is used
+ * when a Role record is created (and by the startup backfill) to populate that
+ * Role's own `permissions[]`. It is NOT a runtime permission source: a user's
+ * effective permissions come ONLY from the Roles assigned to them (see
+ * {@link resolveUserPermissions}). The coarse `role` label (owner/admin/member)
+ * survives only for `isAdmin`/ownership/display, never to grant permissions.
+ *
+ * - `member`  — day-to-day builder: read + write on pipelines/templates/plugins,
+ *   read elsewhere. No member/role/billing management, no compliance/alert
+ *   authoring, and no `:publish` on any catalog.
+ * - `admin`   — full org administration: every ORG-ASSIGNABLE permission (i.e.
+ *   ALL_PERMISSIONS minus the {@link SUPERADMIN_ONLY_PERMISSIONS}, so `registry:*`
+ *   stay superadmin-implicit-only and are NOT granted to org admins).
+ * - `owner`   — same as admin (ownership itself — transfer/delete — is gated
+ *   separately, not via a permission).
+ */
+const MEMBER_PERMISSIONS = [
+    'pipelines:read', 'pipelines:write',
+    'templates:read', 'templates:write',
+    'plugins:read', 'plugins:write',
+    'compliance:read',
+    'dashboards:read',
+    'observability:read',
+    'reports:read',
+    'messages:read', 'messages:write',
+    'billing:read',
+    'quotas:read',
+];
+const ADMIN_PERMISSIONS = [...ORG_ASSIGNABLE_PERMISSIONS];
+/**
+ * Seed bundle for each built-in Role, keyed by the coarse role it grants.
+ * Consumed by the Role seeder + the startup backfill to populate a built-in
+ * Role's `permissions[]`. NOT consulted at request time — see
+ * {@link resolveUserPermissions}.
+ */
+export const ROLE_PERMISSIONS = {
+    member: MEMBER_PERMISSIONS,
+    admin: ADMIN_PERMISSIONS,
+    owner: ADMIN_PERMISSIONS,
+};
+// =============================================================================
+// Resolution
+// =============================================================================
+/**
+ * Resolve a user's effective org permissions from the Roles assigned to them.
+ *
+ * Single-source model: a user's abilities are EXACTLY the union of the
+ * permissions carried by the Roles they hold (a Role = a named permission set;
+ * built-in Roles carry their bundle explicitly, seeded from
+ * {@link ROLE_PERMISSIONS}). There is no separate role-derived baseline — the
+ * coarse `role` label no longer grants anything on its own.
+ *
+ * 1. Platform superadmins (`isSuperAdmin`) always get ALL permissions.
+ * 2. Otherwise, union every permission granted by the user's assigned Roles.
+ * 3. Invalid/unknown permission strings are silently ignored.
+ *
+ * @param assignedPermissions - Flattened permissions from every Role the user holds
+ * @param isSuperAdmin - Whether the user has the global super-admin flag
+ * @returns Effective permissions in canonical order
+ */
+export function resolveUserPermissions(assignedPermissions, isSuperAdmin) {
+    if (isSuperAdmin)
+        return [...ALL_PERMISSIONS];
+    const perms = new Set();
+    if (assignedPermissions) {
+        for (const p of assignedPermissions) {
+            if (isValidPermission(p))
+                perms.add(p);
+        }
+    }
+    return ALL_PERMISSIONS.filter(p => perms.has(p));
+}
+/** Whether a resolved permission list grants `permission` (superadmin ⇒ always). */
+export function hasPermission(granted, permission, isSuperAdmin) {
+    if (isSuperAdmin)
+        return true;
+    return !!granted && granted.includes(permission);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvcGVybWlzc2lvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQTJFdEMsNEVBQTRFO0FBQzVFLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBMEI7SUFDcEQsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQUUsbUJBQW1CO0lBQ3hELGdCQUFnQixFQUFFLGlCQUFpQixFQUFFLG1CQUFtQjtJQUN4RCxjQUFjLEVBQUUsZUFBZSxFQUFFLGlCQUFpQjtJQUNsRCxpQkFBaUIsRUFBRSxrQkFBa0I7SUFDckMsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLG9CQUFvQjtJQUN0RCxpQkFBaUIsRUFBRSxrQkFBa0I7SUFDckMsb0JBQW9CLEVBQUUscUJBQXFCO0lBQzNDLGNBQWMsRUFBRSxnQkFBZ0I7SUFDaEMsZUFBZSxFQUFFLGdCQUFnQjtJQUNqQyxjQUFjLEVBQUUsZ0JBQWdCO0lBQ2hDLGFBQWE7SUFDYixlQUFlLEVBQUUsZ0JBQWdCO0lBQ2pDLGNBQWMsRUFBRSxTQUFTLEVBQUUsU0FBUztDQUNyQyxDQUFDO0FBRUYsb0RBQW9EO0FBQ3BELE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxLQUFhO0lBQzdDLE9BQVEsZUFBcUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDaEUsQ0FBQztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUEwQjtJQUNoRSxlQUFlO0lBQ2YsZ0JBQWdCO0NBQ2pCLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQ3JDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsMkJBQTJCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFMUUsK0VBQStFO0FBQy9FLE1BQU0sVUFBVSx5QkFBeUIsQ0FBQyxVQUFzQjtJQUM5RCxPQUFPLENBQUMsMkJBQTJCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQzNELENBQUM7QUFFRCxnRkFBZ0Y7QUFDaEYsNkJBQTZCO0FBQzdCLGdGQUFnRjtBQUVoRjs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBMEI7SUFDaEQsZ0JBQWdCLEVBQUUsaUJBQWlCO0lBQ25DLGdCQUFnQixFQUFFLGlCQUFpQjtJQUNuQyxjQUFjLEVBQUUsZUFBZTtJQUMvQixpQkFBaUI7SUFDakIsaUJBQWlCO0lBQ2pCLG9CQUFvQjtJQUNwQixjQUFjO0lBQ2QsZUFBZSxFQUFFLGdCQUFnQjtJQUNqQyxjQUFjO0lBQ2QsYUFBYTtDQUNkLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUEwQixDQUFDLEdBQUcsMEJBQTBCLENBQUMsQ0FBQztBQUVqRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUEyQztJQUN0RSxNQUFNLEVBQUUsa0JBQWtCO0lBQzFCLEtBQUssRUFBRSxpQkFBaUI7SUFDeEIsS0FBSyxFQUFFLGlCQUFpQjtDQUN6QixDQUFDO0FBRUYsZ0ZBQWdGO0FBQ2hGLGFBQWE7QUFDYixnRkFBZ0Y7QUFFaEY7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSCxNQUFNLFVBQVUsc0JBQXNCLENBQ3BDLG1CQUE4QyxFQUM5QyxZQUFzQjtJQUV0QixJQUFJLFlBQVk7UUFBRSxPQUFPLENBQUMsR0FBRyxlQUFlLENBQUMsQ0FBQztJQUU5QyxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBYyxDQUFDO0lBQ3BDLElBQUksbUJBQW1CLEVBQUUsQ0FBQztRQUN4QixLQUFLLE1BQU0sQ0FBQyxJQUFJLG1CQUFtQixFQUFFLENBQUM7WUFDcEMsSUFBSSxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7Z0JBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6QyxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sZUFBZSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNuRCxDQUFDO0FBRUQsb0ZBQW9GO0FBQ3BGLE1BQU0sVUFBVSxhQUFhLENBQzNCLE9BQTZDLEVBQzdDLFVBQXNCLEVBQ3RCLFlBQXNCO0lBRXRCLElBQUksWUFBWTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQzlCLE9BQU8sQ0FBQyxDQUFDLE9BQU8sSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ25ELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHR5cGUgeyBPcmdSb2xlIH0gZnJvbSAnLi9jb21tb24uanMnO1xuXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuLy8gUGVybWlzc2lvbiBpZGVudGlmaWVyc1xuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cblxuLyoqXG4gKiBDYW5vbmljYWwgZmluZS1ncmFpbmVkIHBlcm1pc3Npb24gaWRlbnRpZmllcnMsIGluIGByZXNvdXJjZTphY3Rpb25gIGZvcm0uXG4gKlxuICogVGhlc2UgYXJlIHRoZSBPUkctU0NPUEVEIGNhcGFiaWxpdGllcyBhIFJvbGUgY2FuIGdyYW50IChSQkFDKS4gQ29hcnNlIGJ5XG4gKiBkZXNpZ24g4oCUIGA6d3JpdGVgIGNvdmVycyBjcmVhdGUvdXBkYXRlL2RlbGV0ZSBmb3IgYSByZXNvdXJjZSDigJQgc28gdGhlIGNhdGFsb2dcbiAqIGFuZCBwZXJtaXNzaW9uLXBpY2tlciBVSSBzdGF5IHNtYWxsOyBzcGxpdCBhIGA6d3JpdGVgIGludG8gYDpjcmVhdGVgL2A6ZGVsZXRlYFxuICogbGF0ZXIgaWYgYSByZXNvdXJjZSBuZWVkcyBpdC5cbiAqXG4gKiBOT1QgbW9kZWxlZCBoZXJlIChpbnRlbnRpb25hbGx5KTogcGxhdGZvcm0tb3BlcmF0b3IgYWN0aW9ucyAob3JnIGRlbGV0ZSwgdGllci9cbiAqIHF1b3RhIG92ZXJyaWRlLCB1c2VyIGFkbWluLCBpbXBlcnNvbmF0aW9uLCBwbGF0Zm9ybSBzZXR0aW5ncykgc3RheSBiZWhpbmQgdGhlXG4gKiBnbG9iYWwgYGlzU3VwZXJBZG1pbmAgZmxhZywgbm90IGEgcGVyLW9yZyBwZXJtaXNzaW9uOyBhbmQgYHJlcXVpcmVTdGVwVXBgXG4gKiAoTUZBKSAvIGByZXF1aXJlRmVhdHVyZWAgKHBsYW4gZW50aXRsZW1lbnRzKSByZW1haW4gb3J0aG9nb25hbCBnYXRlcy5cbiAqL1xuZXhwb3J0IHR5cGUgUGVybWlzc2lvbiA9XG4gIC8vIFBpcGVsaW5lc1xuICB8ICdwaXBlbGluZXM6cmVhZCdcbiAgfCAncGlwZWxpbmVzOndyaXRlJ1xuICB8ICdwaXBlbGluZXM6cHVibGlzaCdcbiAgLy8gR29sZGVuLXBhdGggcGlwZWxpbmUgdGVtcGxhdGVzLiBTcGxpdCBvdXQgb2YgYHBpcGVsaW5lczoqYCBzbyBhIHBsYXRmb3JtXG4gIC8vIHRlYW0gY2FuIGN1cmF0ZSB0aGUgc3RhcnRlciBjYXRhbG9nIFdJVEhPVVQgd3JpdGUgYWNjZXNzIHRvIGV2ZXJ5IHBpcGVsaW5lXG4gIC8vIChhbmQgdmljZSB2ZXJzYSkg4oCUIHRoZSB0d28gdXNlZCB0byBzaGFyZSBvbmUgZ2F0ZS4gYDpwdWJsaXNoYCBtYXBzIHRvIHRoZVxuICAvLyB0ZW1wbGF0ZSBsYWRkZXIncyBgcHVibGljYCBydW5nOyBgb3JnYCBhbmQgYHByaXZhdGVgIG5lZWQgb25seSBgOndyaXRlYC5cbiAgfCAndGVtcGxhdGVzOnJlYWQnXG4gIHwgJ3RlbXBsYXRlczp3cml0ZSdcbiAgfCAndGVtcGxhdGVzOnB1Ymxpc2gnXG4gIC8vIFBsdWdpbnNcbiAgfCAncGx1Z2luczpyZWFkJ1xuICB8ICdwbHVnaW5zOndyaXRlJ1xuICB8ICdwbHVnaW5zOnB1Ymxpc2gnXG4gIC8vIENvbXBsaWFuY2VcbiAgfCAnY29tcGxpYW5jZTpyZWFkJ1xuICB8ICdjb21wbGlhbmNlOndyaXRlJ1xuICAvLyBNZW1iZXJzICYgYWNjZXNzXG4gIHwgJ21lbWJlcnM6bWFuYWdlJ1xuICB8ICdyb2xlczptYW5hZ2UnXG4gIHwgJ2ludml0YXRpb25zOm1hbmFnZSdcbiAgLy8gT2JzZXJ2YWJpbGl0eVxuICB8ICdkYXNoYm9hcmRzOnJlYWQnXG4gIHwgJ2Rhc2hib2FyZHM6d3JpdGUnXG4gIHwgJ29ic2VydmFiaWxpdHk6cmVhZCdcbiAgfCAnb2JzZXJ2YWJpbGl0eTp3cml0ZSdcbiAgLy8gSW5zaWdodHNcbiAgfCAncmVwb3J0czpyZWFkJ1xuICB8ICdyZXBvcnRzOnJvbGx1cCdcbiAgLy8gTWVzc2FnaW5nXG4gIHwgJ21lc3NhZ2VzOnJlYWQnXG4gIHwgJ21lc3NhZ2VzOndyaXRlJ1xuICAvLyBCaWxsaW5nICYgcXVvdGFzXG4gIHwgJ2JpbGxpbmc6cmVhZCdcbiAgfCAnYmlsbGluZzptYW5hZ2UnXG4gIHwgJ3F1b3RhczpyZWFkJ1xuICAvLyBSZWdpc3RyeVxuICB8ICdyZWdpc3RyeTpyZWFkJ1xuICB8ICdyZWdpc3RyeTp3cml0ZSdcbiAgLy8gT3JnYW5pemF0aW9uIHNldHRpbmdzLlxuICAvLyAgLSBgb3JnOnNldHRpbmdzYCDigJQgZ2VuZXJhbCBvcmcgc2V0dGluZ3MgKyBBSSBjb25maWcuXG4gIC8vICAtIGBvcmc6aWRwYCAgICAgIOKAlCBTU08gLyBJZFAgY29uZmlndXJhdGlvbiAoc2Vuc2l0aXZlOiBjb250cm9scyBsb2dpbikuXG4gIC8vICAtIGBvcmc6a21zYCAgICAgIOKAlCBjdXN0b21lci1tYW5hZ2VkIEtNUyBrZXkgY29uZmlndXJhdGlvbiAoc2Vuc2l0aXZlOlxuICAvLyAgICAgICAgICAgICAgICAgICAgIGNvbnRyb2xzIGVuY3J5cHRpb24gb2Ygb3JnIGRhdGEpLlxuICAvLyBgb3JnOmlkcGAvYG9yZzprbXNgIHdlcmUgc3BsaXQgT1VUIG9mIGBvcmc6c2V0dGluZ3NgIHNvIGEgY3VzdG9tIHJvbGUgY2FuXG4gIC8vIGdyYW50IGdlbmVyYWwgc2V0dGluZ3MgV0lUSE9VVCB0aGUgdHdvIHNlbnNpdGl2ZSBzdXJmYWNlcy4gQm90aCByZW1haW5cbiAgLy8gb3JnLWFzc2lnbmFibGUgYW5kIGFyZSBzZWVkZWQgaW50byB0aGUgYWRtaW4vb3duZXIgYnVuZGxlcyAodmlhXG4gIC8vIE9SR19BU1NJR05BQkxFX1BFUk1JU1NJT05TKSBzbyBleGlzdGluZyBhZG1pbnMga2VlcCBmdWxsIGFjY2Vzcy5cbiAgfCAnb3JnOnNldHRpbmdzJ1xuICB8ICdvcmc6aWRwJ1xuICB8ICdvcmc6a21zJztcblxuLyoqIEFsbCB2YWxpZCBwZXJtaXNzaW9ucyAob3JkZXIgZGV0ZXJtaW5lcyBkaXNwbGF5IG9yZGVyIGluIHRoZSBwaWNrZXIpLiAqL1xuZXhwb3J0IGNvbnN0IEFMTF9QRVJNSVNTSU9OUzogcmVhZG9ubHkgUGVybWlzc2lvbltdID0gW1xuICAncGlwZWxpbmVzOnJlYWQnLCAncGlwZWxpbmVzOndyaXRlJywgJ3BpcGVsaW5lczpwdWJsaXNoJyxcbiAgJ3RlbXBsYXRlczpyZWFkJywgJ3RlbXBsYXRlczp3cml0ZScsICd0ZW1wbGF0ZXM6cHVibGlzaCcsXG4gICdwbHVnaW5zOnJlYWQnLCAncGx1Z2luczp3cml0ZScsICdwbHVnaW5zOnB1Ymxpc2gnLFxuICAnY29tcGxpYW5jZTpyZWFkJywgJ2NvbXBsaWFuY2U6d3JpdGUnLFxuICAnbWVtYmVyczptYW5hZ2UnLCAncm9sZXM6bWFuYWdlJywgJ2ludml0YXRpb25zOm1hbmFnZScsXG4gICdkYXNoYm9hcmRzOnJlYWQnLCAnZGFzaGJvYXJkczp3cml0ZScsXG4gICdvYnNlcnZhYmlsaXR5OnJlYWQnLCAnb2JzZXJ2YWJpbGl0eTp3cml0ZScsXG4gICdyZXBvcnRzOnJlYWQnLCAncmVwb3J0czpyb2xsdXAnLFxuICAnbWVzc2FnZXM6cmVhZCcsICdtZXNzYWdlczp3cml0ZScsXG4gICdiaWxsaW5nOnJlYWQnLCAnYmlsbGluZzptYW5hZ2UnLFxuICAncXVvdGFzOnJlYWQnLFxuICAncmVnaXN0cnk6cmVhZCcsICdyZWdpc3RyeTp3cml0ZScsXG4gICdvcmc6c2V0dGluZ3MnLCAnb3JnOmlkcCcsICdvcmc6a21zJyxcbl07XG5cbi8qKiBDaGVjayB3aGV0aGVyIGEgc3RyaW5nIGlzIGEgdmFsaWQgUGVybWlzc2lvbi4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1ZhbGlkUGVybWlzc2lvbih2YWx1ZTogc3RyaW5nKTogdmFsdWUgaXMgUGVybWlzc2lvbiB7XG4gIHJldHVybiAoQUxMX1BFUk1JU1NJT05TIGFzIHJlYWRvbmx5IHN0cmluZ1tdKS5pbmNsdWRlcyh2YWx1ZSk7XG59XG5cbi8qKlxuICogUGVybWlzc2lvbnMgdGhhdCBtdXN0IE5FVkVSIGJlIGdyYW50YWJsZSB0aHJvdWdoIGEgdXNlci1hdXRob3JlZCBDVVNUT00gUm9sZSDigJRcbiAqIHRoZXkgZ2F0ZSBwbGF0Zm9ybS1vcGVyYXRvciBzdXJmYWNlcyAodGhlIHNoYXJlZCBpbWFnZSByZWdpc3RyeSksIHNvIGFsbG93aW5nXG4gKiBhbiBvcmcgYWRtaW4gdG8gbWludCBhIFJvbGUgY2FycnlpbmcgdGhlbSB3b3VsZCBiZSBhIGxhdGVudCBwcml2aWxlZ2VcbiAqIGVzY2FsYXRpb24uIFRoZXkgYXJlIE5PVCBzZWVkZWQgaW50byBBTlkgYnVpbHQtaW4gUm9sZSBidW5kbGUgKG5laXRoZXJcbiAqIGBtZW1iZXJgIG5vciBgYWRtaW5gKSwgc28gdGhlIG9ubHkgaG9sZGVyIGlzIGEgc3VwZXJhZG1pbiAoaW1wbGljaXQtYWxsKSDigJRcbiAqIHdoaWNoIGlzIHdoYXQgbWFrZXMgdGhlIGltYWdlLXJlZ2lzdHJ5IGdhdGVzIHRoYXQgcmVxdWlyZSB0aGVtIGVmZmVjdGl2ZWx5XG4gKiBzdXBlcmFkbWluLW9ubHkuIFRoaXMgbGlzdCBBTFNPIGJsb2NrcyBjdXN0b20tUm9sZSBhdXRob3JpbmcgZnJvbSByZXF1ZXN0aW5nXG4gKiB0aGVtIChzZWUgcGxhdGZvcm0gYHNhbml0aXplUGVybWlzc2lvbnNgKS5cbiAqL1xuZXhwb3J0IGNvbnN0IFNVUEVSQURNSU5fT05MWV9QRVJNSVNTSU9OUzogcmVhZG9ubHkgUGVybWlzc2lvbltdID0gW1xuICAncmVnaXN0cnk6cmVhZCcsXG4gICdyZWdpc3RyeTp3cml0ZScsXG5dO1xuXG4vKipcbiAqIFBlcm1pc3Npb25zIGFuIG9yZyBtYXkgYXNzaWduIHZpYSBhIENVU1RPTSBSb2xlIOKAlCBldmVyeSBwZXJtaXNzaW9uIGV4Y2VwdCB0aGVcbiAqIHtAbGluayBTVVBFUkFETUlOX09OTFlfUEVSTUlTU0lPTlN9LiBDdXN0b20tUm9sZSBjcmVhdGUvdXBkYXRlIHZhbGlkYXRlcyB0aGVcbiAqIHJlcXVlc3RlZCBwZXJtaXNzaW9uIHNldCBhZ2FpbnN0IHRoaXMgKHNlZSBwbGF0Zm9ybSByb2xlcy1zZXJ2aWNlKS5cbiAqL1xuZXhwb3J0IGNvbnN0IE9SR19BU1NJR05BQkxFX1BFUk1JU1NJT05TOiByZWFkb25seSBQZXJtaXNzaW9uW10gPVxuICBBTExfUEVSTUlTU0lPTlMuZmlsdGVyKChwKSA9PiAhU1VQRVJBRE1JTl9PTkxZX1BFUk1JU1NJT05TLmluY2x1ZGVzKHApKTtcblxuLyoqIFdoZXRoZXIgYHBlcm1pc3Npb25gIG1heSBiZSBncmFudGVkIHRocm91Z2ggYSB1c2VyLWF1dGhvcmVkIGN1c3RvbSBSb2xlLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzT3JnQXNzaWduYWJsZVBlcm1pc3Npb24ocGVybWlzc2lvbjogUGVybWlzc2lvbik6IGJvb2xlYW4ge1xuICByZXR1cm4gIVNVUEVSQURNSU5fT05MWV9QRVJNSVNTSU9OUy5pbmNsdWRlcyhwZXJtaXNzaW9uKTtcbn1cblxuLy8gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1cbi8vIEJ1aWx0LWluIFJvbGUgc2VlZCBidW5kbGVzXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuXG4vKipcbiAqIFBlcm1pc3Npb24gYnVuZGxlcyB1c2VkIHRvIFNFRUQgdGhlIGJ1aWx0LWluIFJvbGVzIChcIkFkbWluXCIsIFwiTWVtYmVyXCIpLlxuICpcbiAqIFRoaXMgaXMgdGhlIHNpbmdsZSBkZWZpbml0aW9uIG9mIHdoYXQgdGhvc2UgYnVpbHQtaW4gUm9sZXMgZ3JhbnQg4oCUIGl0IGlzIHVzZWRcbiAqIHdoZW4gYSBSb2xlIHJlY29yZCBpcyBjcmVhdGVkIChhbmQgYnkgdGhlIHN0YXJ0dXAgYmFja2ZpbGwpIHRvIHBvcHVsYXRlIHRoYXRcbiAqIFJvbGUncyBvd24gYHBlcm1pc3Npb25zW11gLiBJdCBpcyBOT1QgYSBydW50aW1lIHBlcm1pc3Npb24gc291cmNlOiBhIHVzZXInc1xuICogZWZmZWN0aXZlIHBlcm1pc3Npb25zIGNvbWUgT05MWSBmcm9tIHRoZSBSb2xlcyBhc3NpZ25lZCB0byB0aGVtIChzZWVcbiAqIHtAbGluayByZXNvbHZlVXNlclBlcm1pc3Npb25zfSkuIFRoZSBjb2Fyc2UgYHJvbGVgIGxhYmVsIChvd25lci9hZG1pbi9tZW1iZXIpXG4gKiBzdXJ2aXZlcyBvbmx5IGZvciBgaXNBZG1pbmAvb3duZXJzaGlwL2Rpc3BsYXksIG5ldmVyIHRvIGdyYW50IHBlcm1pc3Npb25zLlxuICpcbiAqIC0gYG1lbWJlcmAgIOKAlCBkYXktdG8tZGF5IGJ1aWxkZXI6IHJlYWQgKyB3cml0ZSBvbiBwaXBlbGluZXMvdGVtcGxhdGVzL3BsdWdpbnMsXG4gKiAgIHJlYWQgZWxzZXdoZXJlLiBObyBtZW1iZXIvcm9sZS9iaWxsaW5nIG1hbmFnZW1lbnQsIG5vIGNvbXBsaWFuY2UvYWxlcnRcbiAqICAgYXV0aG9yaW5nLCBhbmQgbm8gYDpwdWJsaXNoYCBvbiBhbnkgY2F0YWxvZy5cbiAqIC0gYGFkbWluYCAgIOKAlCBmdWxsIG9yZyBhZG1pbmlzdHJhdGlvbjogZXZlcnkgT1JHLUFTU0lHTkFCTEUgcGVybWlzc2lvbiAoaS5lLlxuICogICBBTExfUEVSTUlTU0lPTlMgbWludXMgdGhlIHtAbGluayBTVVBFUkFETUlOX09OTFlfUEVSTUlTU0lPTlN9LCBzbyBgcmVnaXN0cnk6KmBcbiAqICAgc3RheSBzdXBlcmFkbWluLWltcGxpY2l0LW9ubHkgYW5kIGFyZSBOT1QgZ3JhbnRlZCB0byBvcmcgYWRtaW5zKS5cbiAqIC0gYG93bmVyYCAgIOKAlCBzYW1lIGFzIGFkbWluIChvd25lcnNoaXAgaXRzZWxmIOKAlCB0cmFuc2Zlci9kZWxldGUg4oCUIGlzIGdhdGVkXG4gKiAgIHNlcGFyYXRlbHksIG5vdCB2aWEgYSBwZXJtaXNzaW9uKS5cbiAqL1xuY29uc3QgTUVNQkVSX1BFUk1JU1NJT05TOiByZWFkb25seSBQZXJtaXNzaW9uW10gPSBbXG4gICdwaXBlbGluZXM6cmVhZCcsICdwaXBlbGluZXM6d3JpdGUnLFxuICAndGVtcGxhdGVzOnJlYWQnLCAndGVtcGxhdGVzOndyaXRlJyxcbiAgJ3BsdWdpbnM6cmVhZCcsICdwbHVnaW5zOndyaXRlJyxcbiAgJ2NvbXBsaWFuY2U6cmVhZCcsXG4gICdkYXNoYm9hcmRzOnJlYWQnLFxuICAnb2JzZXJ2YWJpbGl0eTpyZWFkJyxcbiAgJ3JlcG9ydHM6cmVhZCcsXG4gICdtZXNzYWdlczpyZWFkJywgJ21lc3NhZ2VzOndyaXRlJyxcbiAgJ2JpbGxpbmc6cmVhZCcsXG4gICdxdW90YXM6cmVhZCcsXG5dO1xuXG5jb25zdCBBRE1JTl9QRVJNSVNTSU9OUzogcmVhZG9ubHkgUGVybWlzc2lvbltdID0gWy4uLk9SR19BU1NJR05BQkxFX1BFUk1JU1NJT05TXTtcblxuLyoqXG4gKiBTZWVkIGJ1bmRsZSBmb3IgZWFjaCBidWlsdC1pbiBSb2xlLCBrZXllZCBieSB0aGUgY29hcnNlIHJvbGUgaXQgZ3JhbnRzLlxuICogQ29uc3VtZWQgYnkgdGhlIFJvbGUgc2VlZGVyICsgdGhlIHN0YXJ0dXAgYmFja2ZpbGwgdG8gcG9wdWxhdGUgYSBidWlsdC1pblxuICogUm9sZSdzIGBwZXJtaXNzaW9uc1tdYC4gTk9UIGNvbnN1bHRlZCBhdCByZXF1ZXN0IHRpbWUg4oCUIHNlZVxuICoge0BsaW5rIHJlc29sdmVVc2VyUGVybWlzc2lvbnN9LlxuICovXG5leHBvcnQgY29uc3QgUk9MRV9QRVJNSVNTSU9OUzogUmVjb3JkPE9yZ1JvbGUsIHJlYWRvbmx5IFBlcm1pc3Npb25bXT4gPSB7XG4gIG1lbWJlcjogTUVNQkVSX1BFUk1JU1NJT05TLFxuICBhZG1pbjogQURNSU5fUEVSTUlTU0lPTlMsXG4gIG93bmVyOiBBRE1JTl9QRVJNSVNTSU9OUyxcbn07XG5cbi8vID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09XG4vLyBSZXNvbHV0aW9uXG4vLyA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuXG4vKipcbiAqIFJlc29sdmUgYSB1c2VyJ3MgZWZmZWN0aXZlIG9yZyBwZXJtaXNzaW9ucyBmcm9tIHRoZSBSb2xlcyBhc3NpZ25lZCB0byB0aGVtLlxuICpcbiAqIFNpbmdsZS1zb3VyY2UgbW9kZWw6IGEgdXNlcidzIGFiaWxpdGllcyBhcmUgRVhBQ1RMWSB0aGUgdW5pb24gb2YgdGhlXG4gKiBwZXJtaXNzaW9ucyBjYXJyaWVkIGJ5IHRoZSBSb2xlcyB0aGV5IGhvbGQgKGEgUm9sZSA9IGEgbmFtZWQgcGVybWlzc2lvbiBzZXQ7XG4gKiBidWlsdC1pbiBSb2xlcyBjYXJyeSB0aGVpciBidW5kbGUgZXhwbGljaXRseSwgc2VlZGVkIGZyb21cbiAqIHtAbGluayBST0xFX1BFUk1JU1NJT05TfSkuIFRoZXJlIGlzIG5vIHNlcGFyYXRlIHJvbGUtZGVyaXZlZCBiYXNlbGluZSDigJQgdGhlXG4gKiBjb2Fyc2UgYHJvbGVgIGxhYmVsIG5vIGxvbmdlciBncmFudHMgYW55dGhpbmcgb24gaXRzIG93bi5cbiAqXG4gKiAxLiBQbGF0Zm9ybSBzdXBlcmFkbWlucyAoYGlzU3VwZXJBZG1pbmApIGFsd2F5cyBnZXQgQUxMIHBlcm1pc3Npb25zLlxuICogMi4gT3RoZXJ3aXNlLCB1bmlvbiBldmVyeSBwZXJtaXNzaW9uIGdyYW50ZWQgYnkgdGhlIHVzZXIncyBhc3NpZ25lZCBSb2xlcy5cbiAqIDMuIEludmFsaWQvdW5rbm93biBwZXJtaXNzaW9uIHN0cmluZ3MgYXJlIHNpbGVudGx5IGlnbm9yZWQuXG4gKlxuICogQHBhcmFtIGFzc2lnbmVkUGVybWlzc2lvbnMgLSBGbGF0dGVuZWQgcGVybWlzc2lvbnMgZnJvbSBldmVyeSBSb2xlIHRoZSB1c2VyIGhvbGRzXG4gKiBAcGFyYW0gaXNTdXBlckFkbWluIC0gV2hldGhlciB0aGUgdXNlciBoYXMgdGhlIGdsb2JhbCBzdXBlci1hZG1pbiBmbGFnXG4gKiBAcmV0dXJucyBFZmZlY3RpdmUgcGVybWlzc2lvbnMgaW4gY2Fub25pY2FsIG9yZGVyXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlVXNlclBlcm1pc3Npb25zKFxuICBhc3NpZ25lZFBlcm1pc3Npb25zPzogcmVhZG9ubHkgc3RyaW5nW10gfCBudWxsLFxuICBpc1N1cGVyQWRtaW4/OiBib29sZWFuLFxuKTogUGVybWlzc2lvbltdIHtcbiAgaWYgKGlzU3VwZXJBZG1pbikgcmV0dXJuIFsuLi5BTExfUEVSTUlTU0lPTlNdO1xuXG4gIGNvbnN0IHBlcm1zID0gbmV3IFNldDxQZXJtaXNzaW9uPigpO1xuICBpZiAoYXNzaWduZWRQZXJtaXNzaW9ucykge1xuICAgIGZvciAoY29uc3QgcCBvZiBhc3NpZ25lZFBlcm1pc3Npb25zKSB7XG4gICAgICBpZiAoaXNWYWxpZFBlcm1pc3Npb24ocCkpIHBlcm1zLmFkZChwKTtcbiAgICB9XG4gIH1cbiAgcmV0dXJuIEFMTF9QRVJNSVNTSU9OUy5maWx0ZXIocCA9PiBwZXJtcy5oYXMocCkpO1xufVxuXG4vKiogV2hldGhlciBhIHJlc29sdmVkIHBlcm1pc3Npb24gbGlzdCBncmFudHMgYHBlcm1pc3Npb25gIChzdXBlcmFkbWluIOKHkiBhbHdheXMpLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGhhc1Blcm1pc3Npb24oXG4gIGdyYW50ZWQ6IHJlYWRvbmx5IHN0cmluZ1tdIHwgbnVsbCB8IHVuZGVmaW5lZCxcbiAgcGVybWlzc2lvbjogUGVybWlzc2lvbixcbiAgaXNTdXBlckFkbWluPzogYm9vbGVhbixcbik6IGJvb2xlYW4ge1xuICBpZiAoaXNTdXBlckFkbWluKSByZXR1cm4gdHJ1ZTtcbiAgcmV0dXJuICEhZ3JhbnRlZCAmJiBncmFudGVkLmluY2x1ZGVzKHBlcm1pc3Npb24pO1xufVxuIl19

package/lib/types/pipeline-template.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Golden-path pipeline templates: a parameterized starter a developer
+ * instantiates (fills inputs) to create a new pipeline. The template body is a
+ * BuilderProps with `{{ vars.* }}` placeholders; each declared input maps to a
+ * `vars.<name>` value. Instantiation bakes the supplied inputs into the new
+ * pipeline's `props.vars` — the placeholders resolve at synth time like any
+ * other pipeline var (no separate template runtime).
+ */
+/** Scalar types a template input can carry. */
+export declare const TEMPLATE_INPUT_TYPES: readonly ['string', 'number', 'boolean'];
+export type TemplateInputType = (typeof TEMPLATE_INPUT_TYPES)[number];
+/**
+ * One declared input of a pipeline template. `name` is the `vars.<name>` key the
+ * template body references. This is the template's counterpart to a plugin's
+ * `requiredVars` contract.
+ */
+export interface TemplateInput {
+    /** Variable key — referenced in the template body as `{{ vars.<name> }}`. */
+    readonly name: string;
+    /** Human label for the instantiate form (falls back to `name`). */
+    readonly label?: string;
+    readonly description?: string;
+    readonly type: TemplateInputType;
+    /** When true, instantiation fails if no value (and no default) is supplied. */
+    readonly required?: boolean;
+    /** Default applied when the user leaves the input blank. */
+    readonly default?: string | number | boolean;
+    /** Optional fixed choice set (renders as a select in the UI). */
+    readonly options?: string[];
+}

package/lib/types/pipeline-template.js

@@ -0,0 +1,13 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Golden-path pipeline templates: a parameterized starter a developer
+ * instantiates (fills inputs) to create a new pipeline. The template body is a
+ * BuilderProps with `{{ vars.* }}` placeholders; each declared input maps to a
+ * `vars.<name>` value. Instantiation bakes the supplied inputs into the new
+ * pipeline's `props.vars` — the placeholders resolve at synth time like any
+ * other pipeline var (no separate template runtime).
+ */
+/** Scalar types a template input can carry. */
+export const TEMPLATE_INPUT_TYPES = ['string', 'number', 'boolean'];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGlwZWxpbmUtdGVtcGxhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvcGlwZWxpbmUtdGVtcGxhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7OztHQU9HO0FBRUgsK0NBQStDO0FBQy9DLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQVUsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIEdvbGRlbi1wYXRoIHBpcGVsaW5lIHRlbXBsYXRlczogYSBwYXJhbWV0ZXJpemVkIHN0YXJ0ZXIgYSBkZXZlbG9wZXJcbiAqIGluc3RhbnRpYXRlcyAoZmlsbHMgaW5wdXRzKSB0byBjcmVhdGUgYSBuZXcgcGlwZWxpbmUuIFRoZSB0ZW1wbGF0ZSBib2R5IGlzIGFcbiAqIEJ1aWxkZXJQcm9wcyB3aXRoIGB7eyB2YXJzLiogfX1gIHBsYWNlaG9sZGVyczsgZWFjaCBkZWNsYXJlZCBpbnB1dCBtYXBzIHRvIGFcbiAqIGB2YXJzLjxuYW1lPmAgdmFsdWUuIEluc3RhbnRpYXRpb24gYmFrZXMgdGhlIHN1cHBsaWVkIGlucHV0cyBpbnRvIHRoZSBuZXdcbiAqIHBpcGVsaW5lJ3MgYHByb3BzLnZhcnNgIOKAlCB0aGUgcGxhY2Vob2xkZXJzIHJlc29sdmUgYXQgc3ludGggdGltZSBsaWtlIGFueVxuICogb3RoZXIgcGlwZWxpbmUgdmFyIChubyBzZXBhcmF0ZSB0ZW1wbGF0ZSBydW50aW1lKS5cbiAqL1xuXG4vKiogU2NhbGFyIHR5cGVzIGEgdGVtcGxhdGUgaW5wdXQgY2FuIGNhcnJ5LiAqL1xuZXhwb3J0IGNvbnN0IFRFTVBMQVRFX0lOUFVUX1RZUEVTID0gWydzdHJpbmcnLCAnbnVtYmVyJywgJ2Jvb2xlYW4nXSBhcyBjb25zdDtcbmV4cG9ydCB0eXBlIFRlbXBsYXRlSW5wdXRUeXBlID0gKHR5cGVvZiBURU1QTEFURV9JTlBVVF9UWVBFUylbbnVtYmVyXTtcblxuLyoqXG4gKiBPbmUgZGVjbGFyZWQgaW5wdXQgb2YgYSBwaXBlbGluZSB0ZW1wbGF0ZS4gYG5hbWVgIGlzIHRoZSBgdmFycy48bmFtZT5gIGtleSB0aGVcbiAqIHRlbXBsYXRlIGJvZHkgcmVmZXJlbmNlcy4gVGhpcyBpcyB0aGUgdGVtcGxhdGUncyBjb3VudGVycGFydCB0byBhIHBsdWdpbidzXG4gKiBgcmVxdWlyZWRWYXJzYCBjb250cmFjdC5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBUZW1wbGF0ZUlucHV0IHtcbiAgLyoqIFZhcmlhYmxlIGtleSDigJQgcmVmZXJlbmNlZCBpbiB0aGUgdGVtcGxhdGUgYm9keSBhcyBge3sgdmFycy48bmFtZT4gfX1gLiAqL1xuICByZWFkb25seSBuYW1lOiBzdHJpbmc7XG4gIC8qKiBIdW1hbiBsYWJlbCBmb3IgdGhlIGluc3RhbnRpYXRlIGZvcm0gKGZhbGxzIGJhY2sgdG8gYG5hbWVgKS4gKi9cbiAgcmVhZG9ubHkgbGFiZWw/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGRlc2NyaXB0aW9uPzogc3RyaW5nO1xuICByZWFkb25seSB0eXBlOiBUZW1wbGF0ZUlucHV0VHlwZTtcbiAgLyoqIFdoZW4gdHJ1ZSwgaW5zdGFudGlhdGlvbiBmYWlscyBpZiBubyB2YWx1ZSAoYW5kIG5vIGRlZmF1bHQpIGlzIHN1cHBsaWVkLiAqL1xuICByZWFkb25seSByZXF1aXJlZD86IGJvb2xlYW47XG4gIC8qKiBEZWZhdWx0IGFwcGxpZWQgd2hlbiB0aGUgdXNlciBsZWF2ZXMgdGhlIGlucHV0IGJsYW5rLiAqL1xuICByZWFkb25seSBkZWZhdWx0Pzogc3RyaW5nIHwgbnVtYmVyIHwgYm9vbGVhbjtcbiAgLyoqIE9wdGlvbmFsIGZpeGVkIGNob2ljZSBzZXQgKHJlbmRlcnMgYXMgYSBzZWxlY3QgaW4gdGhlIFVJKS4gKi9cbiAgcmVhZG9ubHkgb3B0aW9ucz86IHN0cmluZ1tdO1xufVxuIl19

package/lib/types/pipeline.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared pipeline types used by both pipeline-core and pipeline-data
+ */
+/**
+ * Utility type to extract the union of all values from an object type
+ */
+type ValueOf<T> = T[keyof T];
+/**
+ * AWS CodeBuild compute resource sizes
+ *
+ * @property SMALL - 3 GB memory, 2 vCPUs
+ * @property MEDIUM - 7 GB memory, 4 vCPUs
+ * @property LARGE - 15 GB memory, 8 vCPUs
+ * @property X2_LARGE - 145 GB memory, 72 vCPUs
+ *
+ * @see https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html
+ */
+export declare const ComputeType: {
+    readonly SMALL: 'SMALL';
+    readonly MEDIUM: 'MEDIUM';
+    readonly LARGE: 'LARGE';
+    readonly X2_LARGE: 'X2_LARGE';
+};
+export type ComputeType = ValueOf<typeof ComputeType>;
+/**
+ * Types of pipeline steps that can be created by plugins
+ *
+ * @property CODE_BUILD_STEP - Full CodeBuild step with custom build environment
+ * @property SHELL_STEP - Simple shell step without custom build environment
+ * @property MANUAL_APPROVAL_STEP - Native CDK approval gate (no Docker image, no commands)
+ */
+export declare const PluginType: {
+    readonly CODE_BUILD_STEP: 'CodeBuildStep';
+    readonly SHELL_STEP: 'ShellStep';
+    readonly MANUAL_APPROVAL_STEP: 'ManualApprovalStep';
+};
+export type PluginType = ValueOf<typeof PluginType>;
+/**
+ * Metadata type for storing configuration and custom properties
+ *
+ * Supports:
+ * - Standard key-value pairs (string, boolean, number)
+ * - Custom AWS CDK keys with the pattern `aws:cdk:{namespace}:{key}`
+ *   (all lowercase — matches the format produced by `getCustomKey`)
+ *
+ * @example
+ * ```typescript
+ * const metadata: MetaDataType = {
+ *   BUILD_ENV: 'production',
+ *   NODE_VERSION: '18',
+ *   ENABLE_CACHE: true,
+ *   MAX_RETRIES: 3
+ * };
+ * ```
+ */
+export type MetaDataType = Record<string, string | boolean | number> & {
+    [K in `aws:cdk:${string}`]?: unknown;
+};
+export {};

package/lib/types/pipeline.js

@@ -0,0 +1,31 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * AWS CodeBuild compute resource sizes
+ *
+ * @property SMALL - 3 GB memory, 2 vCPUs
+ * @property MEDIUM - 7 GB memory, 4 vCPUs
+ * @property LARGE - 15 GB memory, 8 vCPUs
+ * @property X2_LARGE - 145 GB memory, 72 vCPUs
+ *
+ * @see https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html
+ */
+export const ComputeType = {
+    SMALL: 'SMALL',
+    MEDIUM: 'MEDIUM',
+    LARGE: 'LARGE',
+    X2_LARGE: 'X2_LARGE',
+};
+/**
+ * Types of pipeline steps that can be created by plugins
+ *
+ * @property CODE_BUILD_STEP - Full CodeBuild step with custom build environment
+ * @property SHELL_STEP - Simple shell step without custom build environment
+ * @property MANUAL_APPROVAL_STEP - Native CDK approval gate (no Docker image, no commands)
+ */
+export const PluginType = {
+    CODE_BUILD_STEP: 'CodeBuildStep',
+    SHELL_STEP: 'ShellStep',
+    MANUAL_APPROVAL_STEP: 'ManualApprovalStep',
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGlwZWxpbmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvcGlwZWxpbmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQVd0Qzs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLENBQUMsTUFBTSxXQUFXLEdBQUc7SUFDekIsS0FBSyxFQUFFLE9BQU87SUFDZCxNQUFNLEVBQUUsUUFBUTtJQUNoQixLQUFLLEVBQUUsT0FBTztJQUNkLFFBQVEsRUFBRSxVQUFVO0NBQ1osQ0FBQztBQUdYOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixlQUFlLEVBQUUsZUFBZTtJQUNoQyxVQUFVLEVBQUUsV0FBVztJQUN2QixvQkFBb0IsRUFBRSxvQkFBb0I7Q0FDbEMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIFNoYXJlZCBwaXBlbGluZSB0eXBlcyB1c2VkIGJ5IGJvdGggcGlwZWxpbmUtY29yZSBhbmQgcGlwZWxpbmUtZGF0YVxuICovXG5cbi8qKlxuICogVXRpbGl0eSB0eXBlIHRvIGV4dHJhY3QgdGhlIHVuaW9uIG9mIGFsbCB2YWx1ZXMgZnJvbSBhbiBvYmplY3QgdHlwZVxuICovXG50eXBlIFZhbHVlT2Y8VD4gPSBUW2tleW9mIFRdO1xuXG4vKipcbiAqIEFXUyBDb2RlQnVpbGQgY29tcHV0ZSByZXNvdXJjZSBzaXplc1xuICpcbiAqIEBwcm9wZXJ0eSBTTUFMTCAtIDMgR0IgbWVtb3J5LCAyIHZDUFVzXG4gKiBAcHJvcGVydHkgTUVESVVNIC0gNyBHQiBtZW1vcnksIDQgdkNQVXNcbiAqIEBwcm9wZXJ0eSBMQVJHRSAtIDE1IEdCIG1lbW9yeSwgOCB2Q1BVc1xuICogQHByb3BlcnR5IFgyX0xBUkdFIC0gMTQ1IEdCIG1lbW9yeSwgNzIgdkNQVXNcbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9jb2RlYnVpbGQvbGF0ZXN0L3VzZXJndWlkZS9idWlsZC1lbnYtcmVmLWNvbXB1dGUtdHlwZXMuaHRtbFxuICovXG5leHBvcnQgY29uc3QgQ29tcHV0ZVR5cGUgPSB7XG4gIFNNQUxMOiAnU01BTEwnLFxuICBNRURJVU06ICdNRURJVU0nLFxuICBMQVJHRTogJ0xBUkdFJyxcbiAgWDJfTEFSR0U6ICdYMl9MQVJHRScsXG59IGFzIGNvbnN0O1xuZXhwb3J0IHR5cGUgQ29tcHV0ZVR5cGUgPSBWYWx1ZU9mPHR5cGVvZiBDb21wdXRlVHlwZT47XG5cbi8qKlxuICogVHlwZXMgb2YgcGlwZWxpbmUgc3RlcHMgdGhhdCBjYW4gYmUgY3JlYXRlZCBieSBwbHVnaW5zXG4gKlxuICogQHByb3BlcnR5IENPREVfQlVJTERfU1RFUCAtIEZ1bGwgQ29kZUJ1aWxkIHN0ZXAgd2l0aCBjdXN0b20gYnVpbGQgZW52aXJvbm1lbnRcbiAqIEBwcm9wZXJ0eSBTSEVMTF9TVEVQIC0gU2ltcGxlIHNoZWxsIHN0ZXAgd2l0aG91dCBjdXN0b20gYnVpbGQgZW52aXJvbm1lbnRcbiAqIEBwcm9wZXJ0eSBNQU5VQUxfQVBQUk9WQUxfU1RFUCAtIE5hdGl2ZSBDREsgYXBwcm92YWwgZ2F0ZSAobm8gRG9ja2VyIGltYWdlLCBubyBjb21tYW5kcylcbiAqL1xuZXhwb3J0IGNvbnN0IFBsdWdpblR5cGUgPSB7XG4gIENPREVfQlVJTERfU1RFUDogJ0NvZGVCdWlsZFN0ZXAnLFxuICBTSEVMTF9TVEVQOiAnU2hlbGxTdGVwJyxcbiAgTUFOVUFMX0FQUFJPVkFMX1NURVA6ICdNYW51YWxBcHByb3ZhbFN0ZXAnLFxufSBhcyBjb25zdDtcbmV4cG9ydCB0eXBlIFBsdWdpblR5cGUgPSBWYWx1ZU9mPHR5cGVvZiBQbHVnaW5UeXBlPjtcblxuLyoqXG4gKiBNZXRhZGF0YSB0eXBlIGZvciBzdG9yaW5nIGNvbmZpZ3VyYXRpb24gYW5kIGN1c3RvbSBwcm9wZXJ0aWVzXG4gKlxuICogU3VwcG9ydHM6XG4gKiAtIFN0YW5kYXJkIGtleS12YWx1ZSBwYWlycyAoc3RyaW5nLCBib29sZWFuLCBudW1iZXIpXG4gKiAtIEN1c3RvbSBBV1MgQ0RLIGtleXMgd2l0aCB0aGUgcGF0dGVybiBgYXdzOmNkazp7bmFtZXNwYWNlfTp7a2V5fWBcbiAqICAgKGFsbCBsb3dlcmNhc2Ug4oCUIG1hdGNoZXMgdGhlIGZvcm1hdCBwcm9kdWNlZCBieSBgZ2V0Q3VzdG9tS2V5YClcbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgbWV0YWRhdGE6IE1ldGFEYXRhVHlwZSA9IHtcbiAqICAgQlVJTERfRU5WOiAncHJvZHVjdGlvbicsXG4gKiAgIE5PREVfVkVSU0lPTjogJzE4JyxcbiAqICAgRU5BQkxFX0NBQ0hFOiB0cnVlLFxuICogICBNQVhfUkVUUklFUzogM1xuICogfTtcbiAqIGBgYFxuICovXG5leHBvcnQgdHlwZSBNZXRhRGF0YVR5cGUgPVxuICBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCBib29sZWFuIHwgbnVtYmVyPiAmXG4gIHsgW0sgaW4gYGF3czpjZGs6JHtzdHJpbmd9YF0/OiB1bmtub3duIH07XG4iXX0=