@pipeline-builder/api-core 3.4.109 → 3.4.111

package/lib/services/sse-ticket-store.js

@@ -0,0 +1,125 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import crypto from 'crypto';
+import { createEnvRedisClient } from './env-redis.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('sse-ticket-store');
+/** Redis key namespaces. Ticket → orgId; windowed issue counters bound abuse. */
+const TICKET_KEY_PREFIX = 'sse:tk:';
+const ORG_COUNT_PREFIX = 'sse:tkc:';
+const TOTAL_COUNT_KEY = 'sse:tkc:__all__';
+function newTicketId() {
+    return crypto.randomBytes(24).toString('base64url');
+}
+/**
+ * In-memory backend — the original single-process behaviour. Counts LIVE
+ * (unexpired) tickets per org and evicts expired entries on a timer. Correct
+ * only within one process, so it is the fallback used when Redis isn't configured.
+ */
+function createInMemorySseTicketStore(config) {
+    const store = new Map();
+    const cleanup = setInterval(() => {
+        const now = Date.now();
+        for (const [id, t] of store)
+            if (now > t.expiresAt)
+                store.delete(id);
+    }, config.ttlMs);
+    cleanup.unref();
+    function countLiveForOrg(orgId, now) {
+        let count = 0;
+        for (const t of store.values())
+            if (t.orgId === orgId && t.expiresAt > now)
+                count++;
+        return count;
+    }
+    return {
+        async issue(orgId) {
+            const now = Date.now();
+            if (store.size >= config.maxTotal)
+                return { ok: false, reason: 'total' };
+            if (countLiveForOrg(orgId, now) >= config.maxPerOrg)
+                return { ok: false, reason: 'org' };
+            const ticket = newTicketId();
+            store.set(ticket, { orgId, expiresAt: now + config.ttlMs });
+            return { ok: true, ticket };
+        },
+        async consume(ticketId) {
+            const t = store.get(ticketId);
+            store.delete(ticketId); // single-use — consume immediately
+            if (!t || Date.now() > t.expiresAt)
+                return null;
+            return { orgId: t.orgId };
+        },
+        stop() { clearInterval(cleanup); },
+    };
+}
+/**
+ * Redis backend — multi-replica safe. Tickets live under a TTL'd key so any pod
+ * can redeem one; {@link SseTicketStore.consume} uses GETDEL so redemption is
+ * atomic (two pods can't both spend the same ticket). The per-org / global caps
+ * become windowed rate limits (max mints per TTL window) via INCR + first-hit
+ * EXPIRE — equivalent abuse bounding to the in-memory live-count, and it also
+ * caps churn.
+ *
+ * Fail-CLOSED by design (unlike the fail-open token-revocation reader): if Redis
+ * errors, `issue` returns a cap rejection and `consume` returns null, so a Redis
+ * outage degrades to "no live notifications" rather than handing out or
+ * accepting unvalidated tickets. SSE notifications are non-critical, so failing
+ * closed here costs only real-time delivery, never correctness.
+ */
+function createRedisSseTicketStore(redis, config) {
+    const ttlSec = Math.max(1, Math.ceil(config.ttlMs / 1000));
+    // Windowed counter: INCR, and on the first hit of a window set the TTL so it
+    // auto-resets. Returns true while still within `limit` for this window.
+    async function withinWindow(key, limit) {
+        const n = await redis.incr(key);
+        if (n === 1)
+            await redis.expire(key, ttlSec);
+        return n <= limit;
+    }
+    return {
+        async issue(orgId) {
+            try {
+                if (!(await withinWindow(TOTAL_COUNT_KEY, config.maxTotal)))
+                    return { ok: false, reason: 'total' };
+                if (!(await withinWindow(`${ORG_COUNT_PREFIX}${orgId}`, config.maxPerOrg)))
+                    return { ok: false, reason: 'org' };
+                const ticket = newTicketId();
+                await redis.set(`${TICKET_KEY_PREFIX}${ticket}`, orgId, 'EX', ttlSec);
+                return { ok: true, ticket };
+            }
+            catch (err) {
+                logger.warn('SSE ticket issue failed (fail-closed)', { error: err instanceof Error ? err.message : String(err) });
+                return { ok: false, reason: 'total' };
+            }
+        },
+        async consume(ticketId) {
+            try {
+                const orgId = await redis.getdel(`${TICKET_KEY_PREFIX}${ticketId}`);
+                return orgId ? { orgId } : null;
+            }
+            catch (err) {
+                logger.warn('SSE ticket consume failed (fail-closed)', { error: err instanceof Error ? err.message : String(err) });
+                return null;
+            }
+        },
+        stop() { },
+    };
+}
+/**
+ * Build an {@link SseTicketStore} from the standard Redis env (`REDIS_URL` or
+ * `REDIS_HOST`/`REDIS_PORT`). Uses the Redis backend when configured
+ * (multi-replica safe), otherwise falls back to the in-memory single-process
+ * backend. A service opts in with one boot line:
+ *   `const tickets = createEnvSseTicketStore({ ttlMs, maxTotal, maxPerOrg });`
+ */
+export function createEnvSseTicketStore(config) {
+    const redis = createEnvRedisClient('sse-ticket');
+    if (redis) {
+        logger.info('SSE ticket store: Redis backend (multi-replica)');
+        return createRedisSseTicketStore(redis, config);
+    }
+    logger.info('SSE ticket store: in-memory backend (single-process fallback)');
+    return createInMemorySseTicketStore(config);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3NlLXRpY2tldC1zdG9yZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2aWNlcy9zc2UtdGlja2V0LXN0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBRTVCLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ3RELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUVsRCxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUVoRCxpRkFBaUY7QUFDakYsTUFBTSxpQkFBaUIsR0FBRyxTQUFTLENBQUM7QUFDcEMsTUFBTSxnQkFBZ0IsR0FBRyxVQUFVLENBQUM7QUFDcEMsTUFBTSxlQUFlLEdBQUcsaUJBQWlCLENBQUM7QUEyQzFDLFNBQVMsV0FBVztJQUNsQixPQUFPLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3RELENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBUyw0QkFBNEIsQ0FBQyxNQUE0QjtJQUVoRSxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBaUIsQ0FBQztJQUV2QyxNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsR0FBRyxFQUFFO1FBQy9CLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixLQUFLLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksS0FBSztZQUFFLElBQUksR0FBRyxHQUFHLENBQUMsQ0FBQyxTQUFTO2dCQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdkUsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqQixPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7SUFFaEIsU0FBUyxlQUFlLENBQUMsS0FBYSxFQUFFLEdBQVc7UUFDakQsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO1FBQ2QsS0FBSyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxFQUFFO1lBQUUsSUFBSSxDQUFDLENBQUMsS0FBSyxLQUFLLEtBQUssSUFBSSxDQUFDLENBQUMsU0FBUyxHQUFHLEdBQUc7Z0JBQUUsS0FBSyxFQUFFLENBQUM7UUFDcEYsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsT0FBTztRQUNMLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBYTtZQUN2QixNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDdkIsSUFBSSxLQUFLLENBQUMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUN6RSxJQUFJLGVBQWUsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLFNBQVM7Z0JBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDO1lBQ3pGLE1BQU0sTUFBTSxHQUFHLFdBQVcsRUFBRSxDQUFDO1lBQzdCLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxHQUFHLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDNUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUM7UUFDOUIsQ0FBQztRQUNELEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBZ0I7WUFDNUIsTUFBTSxDQUFDLEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUM5QixLQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsbUNBQW1DO1lBQzNELElBQUksQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxTQUFTO2dCQUFFLE9BQU8sSUFBSSxDQUFDO1lBQ2hELE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzVCLENBQUM7UUFDRCxJQUFJLEtBQVcsYUFBYSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztLQUN6QyxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxTQUFTLHlCQUF5QixDQUFDLEtBQWUsRUFBRSxNQUE0QjtJQUM5RSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUUzRCw2RUFBNkU7SUFDN0Usd0VBQXdFO0lBQ3hFLEtBQUssVUFBVSxZQUFZLENBQUMsR0FBVyxFQUFFLEtBQWE7UUFDcEQsTUFBTSxDQUFDLEdBQUcsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2hDLElBQUksQ0FBQyxLQUFLLENBQUM7WUFBRSxNQUFNLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzdDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQztJQUNwQixDQUFDO0lBRUQsT0FBTztRQUNMLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBYTtZQUN2QixJQUFJLENBQUM7Z0JBQ0gsSUFBSSxDQUFDLENBQUMsTUFBTSxZQUFZLENBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztvQkFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUM7Z0JBQ25HLElBQUksQ0FBQyxDQUFDLE1BQU0sWUFBWSxDQUFDLEdBQUcsZ0JBQWdCLEdBQUcsS0FBSyxFQUFFLEVBQUUsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO29CQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQztnQkFDaEgsTUFBTSxNQUFNLEdBQUcsV0FBVyxFQUFFLENBQUM7Z0JBQzdCLE1BQU0sS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLGlCQUFpQixHQUFHLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQzlCLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUNBQXVDLEVBQUUsRUFBRSxLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztnQkFDbEgsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQ3hDLENBQUM7UUFDSCxDQUFDO1FBQ0QsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFnQjtZQUM1QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsaUJBQWlCLEdBQUcsUUFBUSxFQUFFLENBQUMsQ0FBQztnQkFDcEUsT0FBTyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNsQyxDQUFDO1lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztnQkFDYixNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7Z0JBQ3BILE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLEtBQTBFLENBQUM7S0FDaEYsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsdUJBQXVCLENBQUMsTUFBNEI7SUFDbEUsTUFBTSxLQUFLLEdBQUcsb0JBQW9CLENBQVcsWUFBWSxDQUFDLENBQUM7SUFDM0QsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUNWLE1BQU0sQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztRQUMvRCxPQUFPLHlCQUF5QixDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQzdFLE9BQU8sNEJBQTRCLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDOUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgY3J5cHRvIGZyb20gJ2NyeXB0byc7XG5cbmltcG9ydCB7IGNyZWF0ZUVudlJlZGlzQ2xpZW50IH0gZnJvbSAnLi9lbnYtcmVkaXMuanMnO1xuaW1wb3J0IHsgY3JlYXRlTG9nZ2VyIH0gZnJvbSAnLi4vdXRpbHMvbG9nZ2VyLmpzJztcblxuY29uc3QgbG9nZ2VyID0gY3JlYXRlTG9nZ2VyKCdzc2UtdGlja2V0LXN0b3JlJyk7XG5cbi8qKiBSZWRpcyBrZXkgbmFtZXNwYWNlcy4gVGlja2V0IOKGkiBvcmdJZDsgd2luZG93ZWQgaXNzdWUgY291bnRlcnMgYm91bmQgYWJ1c2UuICovXG5jb25zdCBUSUNLRVRfS0VZX1BSRUZJWCA9ICdzc2U6dGs6JztcbmNvbnN0IE9SR19DT1VOVF9QUkVGSVggPSAnc3NlOnRrYzonO1xuY29uc3QgVE9UQUxfQ09VTlRfS0VZID0gJ3NzZTp0a2M6X19hbGxfXyc7XG5cbi8qKiBSZXN1bHQgb2Yge0BsaW5rIFNzZVRpY2tldFN0b3JlLmlzc3VlfS4gKi9cbmV4cG9ydCB0eXBlIFNzZVRpY2tldElzc3VlUmVzdWx0ID1cbiAgfCB7IG9rOiB0cnVlOyB0aWNrZXQ6IHN0cmluZyB9XG4gIHwgeyBvazogZmFsc2U7IHJlYXNvbjogJ3RvdGFsJyB8ICdvcmcnIH07XG5cbi8qKlxuICogU3RvcmUgZm9yIHNob3J0LWxpdmVkLCBzaW5nbGUtdXNlIFNTRSBhdXRoIHRpY2tldHMuIEEgY2xpZW50IGV4Y2hhbmdlcyBpdHMgSldUXG4gKiBmb3IgYSB0aWNrZXQgKHNvIHRoZSB0b2tlbiBuZXZlciBsYW5kcyBpbiBhbiBFdmVudFNvdXJjZSBxdWVyeSBzdHJpbmcgLyBhY2Nlc3NcbiAqIGxvZyksIHRoZW4gcmVkZWVtcyBpdCBvbiB0aGUgU1NFIGBHRVRgLlxuICpcbiAqIFRoZSBzdG9yZSBpcyB0aGUgbXVsdGktcmVwbGljYSBjb3JyZWN0bmVzcyBib3VuZGFyeTogYSB0aWNrZXQgbWludGVkIG9uIHBvZCBBXG4gKiBNVVNUIGJlIHJlZGVlbWFibGUgb24gcG9kIEIuIFRoZSBSZWRpcyBiYWNrZW5kIG1ha2VzIHRoYXQgdHJ1ZTsgdGhlIGluLW1lbW9yeVxuICogYmFja2VuZCBpcyBhIHNpbmdsZS1wcm9jZXNzIGZhbGxiYWNrIGZvciBkZXYgLyBzaW5nbGUtcmVwbGljYSBpbnN0YWxscy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTc2VUaWNrZXRTdG9yZSB7XG4gIC8qKiBNaW50IGEgdGlja2V0IGZvciBgb3JnSWRgLCBvciByZWplY3Qgd2hlbiBhIHJhdGUgd2luZG93IGlzIHNhdHVyYXRlZC4gKi9cbiAgaXNzdWUob3JnSWQ6IHN0cmluZyk6IFByb21pc2U8U3NlVGlja2V0SXNzdWVSZXN1bHQ+O1xuICAvKiogQXRvbWljYWxseSByZWRlZW0gYSB0aWNrZXQgZXhhY3RseSBvbmNlOyByZXR1cm5zIGl0cyBvcmcgb3IgbnVsbCBpZiBpbnZhbGlkL2V4cGlyZWQvc3BlbnQuICovXG4gIGNvbnN1bWUodGlja2V0SWQ6IHN0cmluZyk6IFByb21pc2U8eyBvcmdJZDogc3RyaW5nIH0gfCBudWxsPjtcbiAgLyoqIFJlbGVhc2UgdGltZXJzL3Jlc291cmNlcy4gSW4tbWVtb3J5IGNsZWFycyBpdHMgc3dlZXAgaW50ZXJ2YWw7IFJlZGlzIGlzIGEgbm8tb3AuICovXG4gIHN0b3AoKTogdm9pZDtcbn1cblxuLyoqIENhcHMgKyBUVEwgZm9yIHRoZSB0aWNrZXQgc3RvcmUuICovXG5leHBvcnQgaW50ZXJmYWNlIFNzZVRpY2tldFN0b3JlQ29uZmlnIHtcbiAgLyoqIFRpY2tldCBsaWZldGltZSDigJQgbG9uZyBlbm91Z2ggZm9yIHRoZSBjbGllbnQgdG8gb3BlbiB0aGUgRXZlbnRTb3VyY2UuICovXG4gIHR0bE1zOiBudW1iZXI7XG4gIC8qKiBIYXJkIGNhcCBvbiB0aWNrZXRzIG1pbnRlZCBwZXIgVFRMIHdpbmRvdyBhY3Jvc3MgYWxsIG9yZ3MgKGFidXNlIGJvdW5kKS4gKi9cbiAgbWF4VG90YWw6IG51bWJlcjtcbiAgLyoqIFBlci1vcmcgY2FwIG9uIHRpY2tldHMgbWludGVkIHBlciBUVEwgd2luZG93IChzaW5nbGUtdGVuYW50IGFidXNlIGJvdW5kKS4gKi9cbiAgbWF4UGVyT3JnOiBudW1iZXI7XG59XG5cbi8qKiBNaW5pbWFsIGlvcmVkaXMgc3VyZmFjZSB0aGlzIHN0b3JlIG5lZWRzIChHRVRERUwgcmVxdWlyZXMgUmVkaXMg4omlIDYuMikuICovXG5pbnRlcmZhY2UgU3NlUmVkaXMge1xuICBpbmNyKGtleTogc3RyaW5nKTogUHJvbWlzZTxudW1iZXI+O1xuICBleHBpcmUoa2V5OiBzdHJpbmcsIHNlY29uZHM6IG51bWJlcik6IFByb21pc2U8dW5rbm93bj47XG4gIHNldChrZXk6IHN0cmluZywgdmFsdWU6IHN0cmluZywgLi4uYXJnczogdW5rbm93bltdKTogUHJvbWlzZTx1bmtub3duPjtcbiAgZ2V0ZGVsKGtleTogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmcgfCBudWxsPjtcbn1cblxuZnVuY3Rpb24gbmV3VGlja2V0SWQoKTogc3RyaW5nIHtcbiAgcmV0dXJuIGNyeXB0by5yYW5kb21CeXRlcygyNCkudG9TdHJpbmcoJ2Jhc2U2NHVybCcpO1xufVxuXG4vKipcbiAqIEluLW1lbW9yeSBiYWNrZW5kIOKAlCB0aGUgb3JpZ2luYWwgc2luZ2xlLXByb2Nlc3MgYmVoYXZpb3VyLiBDb3VudHMgTElWRVxuICogKHVuZXhwaXJlZCkgdGlja2V0cyBwZXIgb3JnIGFuZCBldmljdHMgZXhwaXJlZCBlbnRyaWVzIG9uIGEgdGltZXIuIENvcnJlY3RcbiAqIG9ubHkgd2l0aGluIG9uZSBwcm9jZXNzLCBzbyBpdCBpcyB0aGUgZmFsbGJhY2sgdXNlZCB3aGVuIFJlZGlzIGlzbid0IGNvbmZpZ3VyZWQuXG4gKi9cbmZ1bmN0aW9uIGNyZWF0ZUluTWVtb3J5U3NlVGlja2V0U3RvcmUoY29uZmlnOiBTc2VUaWNrZXRTdG9yZUNvbmZpZyk6IFNzZVRpY2tldFN0b3JlIHtcbiAgaW50ZXJmYWNlIEVudHJ5IHsgb3JnSWQ6IHN0cmluZzsgZXhwaXJlc0F0OiBudW1iZXIgfVxuICBjb25zdCBzdG9yZSA9IG5ldyBNYXA8c3RyaW5nLCBFbnRyeT4oKTtcblxuICBjb25zdCBjbGVhbnVwID0gc2V0SW50ZXJ2YWwoKCkgPT4ge1xuICAgIGNvbnN0IG5vdyA9IERhdGUubm93KCk7XG4gICAgZm9yIChjb25zdCBbaWQsIHRdIG9mIHN0b3JlKSBpZiAobm93ID4gdC5leHBpcmVzQXQpIHN0b3JlLmRlbGV0ZShpZCk7XG4gIH0sIGNvbmZpZy50dGxNcyk7XG4gIGNsZWFudXAudW5yZWYoKTtcblxuICBmdW5jdGlvbiBjb3VudExpdmVGb3JPcmcob3JnSWQ6IHN0cmluZywgbm93OiBudW1iZXIpOiBudW1iZXIge1xuICAgIGxldCBjb3VudCA9IDA7XG4gICAgZm9yIChjb25zdCB0IG9mIHN0b3JlLnZhbHVlcygpKSBpZiAodC5vcmdJZCA9PT0gb3JnSWQgJiYgdC5leHBpcmVzQXQgPiBub3cpIGNvdW50Kys7XG4gICAgcmV0dXJuIGNvdW50O1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBhc3luYyBpc3N1ZShvcmdJZDogc3RyaW5nKTogUHJvbWlzZTxTc2VUaWNrZXRJc3N1ZVJlc3VsdD4ge1xuICAgICAgY29uc3Qgbm93ID0gRGF0ZS5ub3coKTtcbiAgICAgIGlmIChzdG9yZS5zaXplID49IGNvbmZpZy5tYXhUb3RhbCkgcmV0dXJuIHsgb2s6IGZhbHNlLCByZWFzb246ICd0b3RhbCcgfTtcbiAgICAgIGlmIChjb3VudExpdmVGb3JPcmcob3JnSWQsIG5vdykgPj0gY29uZmlnLm1heFBlck9yZykgcmV0dXJuIHsgb2s6IGZhbHNlLCByZWFzb246ICdvcmcnIH07XG4gICAgICBjb25zdCB0aWNrZXQgPSBuZXdUaWNrZXRJZCgpO1xuICAgICAgc3RvcmUuc2V0KHRpY2tldCwgeyBvcmdJZCwgZXhwaXJlc0F0OiBub3cgKyBjb25maWcudHRsTXMgfSk7XG4gICAgICByZXR1cm4geyBvazogdHJ1ZSwgdGlja2V0IH07XG4gICAgfSxcbiAgICBhc3luYyBjb25zdW1lKHRpY2tldElkOiBzdHJpbmcpOiBQcm9taXNlPHsgb3JnSWQ6IHN0cmluZyB9IHwgbnVsbD4ge1xuICAgICAgY29uc3QgdCA9IHN0b3JlLmdldCh0aWNrZXRJZCk7XG4gICAgICBzdG9yZS5kZWxldGUodGlja2V0SWQpOyAvLyBzaW5nbGUtdXNlIOKAlCBjb25zdW1lIGltbWVkaWF0ZWx5XG4gICAgICBpZiAoIXQgfHwgRGF0ZS5ub3coKSA+IHQuZXhwaXJlc0F0KSByZXR1cm4gbnVsbDtcbiAgICAgIHJldHVybiB7IG9yZ0lkOiB0Lm9yZ0lkIH07XG4gICAgfSxcbiAgICBzdG9wKCk6IHZvaWQgeyBjbGVhckludGVydmFsKGNsZWFudXApOyB9LFxuICB9O1xufVxuXG4vKipcbiAqIFJlZGlzIGJhY2tlbmQg4oCUIG11bHRpLXJlcGxpY2Egc2FmZS4gVGlja2V0cyBsaXZlIHVuZGVyIGEgVFRMJ2Qga2V5IHNvIGFueSBwb2RcbiAqIGNhbiByZWRlZW0gb25lOyB7QGxpbmsgU3NlVGlja2V0U3RvcmUuY29uc3VtZX0gdXNlcyBHRVRERUwgc28gcmVkZW1wdGlvbiBpc1xuICogYXRvbWljICh0d28gcG9kcyBjYW4ndCBib3RoIHNwZW5kIHRoZSBzYW1lIHRpY2tldCkuIFRoZSBwZXItb3JnIC8gZ2xvYmFsIGNhcHNcbiAqIGJlY29tZSB3aW5kb3dlZCByYXRlIGxpbWl0cyAobWF4IG1pbnRzIHBlciBUVEwgd2luZG93KSB2aWEgSU5DUiArIGZpcnN0LWhpdFxuICogRVhQSVJFIOKAlCBlcXVpdmFsZW50IGFidXNlIGJvdW5kaW5nIHRvIHRoZSBpbi1tZW1vcnkgbGl2ZS1jb3VudCwgYW5kIGl0IGFsc29cbiAqIGNhcHMgY2h1cm4uXG4gKlxuICogRmFpbC1DTE9TRUQgYnkgZGVzaWduICh1bmxpa2UgdGhlIGZhaWwtb3BlbiB0b2tlbi1yZXZvY2F0aW9uIHJlYWRlcik6IGlmIFJlZGlzXG4gKiBlcnJvcnMsIGBpc3N1ZWAgcmV0dXJucyBhIGNhcCByZWplY3Rpb24gYW5kIGBjb25zdW1lYCByZXR1cm5zIG51bGwsIHNvIGEgUmVkaXNcbiAqIG91dGFnZSBkZWdyYWRlcyB0byBcIm5vIGxpdmUgbm90aWZpY2F0aW9uc1wiIHJhdGhlciB0aGFuIGhhbmRpbmcgb3V0IG9yXG4gKiBhY2NlcHRpbmcgdW52YWxpZGF0ZWQgdGlja2V0cy4gU1NFIG5vdGlmaWNhdGlvbnMgYXJlIG5vbi1jcml0aWNhbCwgc28gZmFpbGluZ1xuICogY2xvc2VkIGhlcmUgY29zdHMgb25seSByZWFsLXRpbWUgZGVsaXZlcnksIG5ldmVyIGNvcnJlY3RuZXNzLlxuICovXG5mdW5jdGlvbiBjcmVhdGVSZWRpc1NzZVRpY2tldFN0b3JlKHJlZGlzOiBTc2VSZWRpcywgY29uZmlnOiBTc2VUaWNrZXRTdG9yZUNvbmZpZyk6IFNzZVRpY2tldFN0b3JlIHtcbiAgY29uc3QgdHRsU2VjID0gTWF0aC5tYXgoMSwgTWF0aC5jZWlsKGNvbmZpZy50dGxNcyAvIDEwMDApKTtcblxuICAvLyBXaW5kb3dlZCBjb3VudGVyOiBJTkNSLCBhbmQgb24gdGhlIGZpcnN0IGhpdCBvZiBhIHdpbmRvdyBzZXQgdGhlIFRUTCBzbyBpdFxuICAvLyBhdXRvLXJlc2V0cy4gUmV0dXJucyB0cnVlIHdoaWxlIHN0aWxsIHdpdGhpbiBgbGltaXRgIGZvciB0aGlzIHdpbmRvdy5cbiAgYXN5bmMgZnVuY3Rpb24gd2l0aGluV2luZG93KGtleTogc3RyaW5nLCBsaW1pdDogbnVtYmVyKTogUHJvbWlzZTxib29sZWFuPiB7XG4gICAgY29uc3QgbiA9IGF3YWl0IHJlZGlzLmluY3Ioa2V5KTtcbiAgICBpZiAobiA9PT0gMSkgYXdhaXQgcmVkaXMuZXhwaXJlKGtleSwgdHRsU2VjKTtcbiAgICByZXR1cm4gbiA8PSBsaW1pdDtcbiAgfVxuXG4gIHJldHVybiB7XG4gICAgYXN5bmMgaXNzdWUob3JnSWQ6IHN0cmluZyk6IFByb21pc2U8U3NlVGlja2V0SXNzdWVSZXN1bHQ+IHtcbiAgICAgIHRyeSB7XG4gICAgICAgIGlmICghKGF3YWl0IHdpdGhpbldpbmRvdyhUT1RBTF9DT1VOVF9LRVksIGNvbmZpZy5tYXhUb3RhbCkpKSByZXR1cm4geyBvazogZmFsc2UsIHJlYXNvbjogJ3RvdGFsJyB9O1xuICAgICAgICBpZiAoIShhd2FpdCB3aXRoaW5XaW5kb3coYCR7T1JHX0NPVU5UX1BSRUZJWH0ke29yZ0lkfWAsIGNvbmZpZy5tYXhQZXJPcmcpKSkgcmV0dXJuIHsgb2s6IGZhbHNlLCByZWFzb246ICdvcmcnIH07XG4gICAgICAgIGNvbnN0IHRpY2tldCA9IG5ld1RpY2tldElkKCk7XG4gICAgICAgIGF3YWl0IHJlZGlzLnNldChgJHtUSUNLRVRfS0VZX1BSRUZJWH0ke3RpY2tldH1gLCBvcmdJZCwgJ0VYJywgdHRsU2VjKTtcbiAgICAgICAgcmV0dXJuIHsgb2s6IHRydWUsIHRpY2tldCB9O1xuICAgICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAgIGxvZ2dlci53YXJuKCdTU0UgdGlja2V0IGlzc3VlIGZhaWxlZCAoZmFpbC1jbG9zZWQpJywgeyBlcnJvcjogZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6IFN0cmluZyhlcnIpIH0pO1xuICAgICAgICByZXR1cm4geyBvazogZmFsc2UsIHJlYXNvbjogJ3RvdGFsJyB9O1xuICAgICAgfVxuICAgIH0sXG4gICAgYXN5bmMgY29uc3VtZSh0aWNrZXRJZDogc3RyaW5nKTogUHJvbWlzZTx7IG9yZ0lkOiBzdHJpbmcgfSB8IG51bGw+IHtcbiAgICAgIHRyeSB7XG4gICAgICAgIGNvbnN0IG9yZ0lkID0gYXdhaXQgcmVkaXMuZ2V0ZGVsKGAke1RJQ0tFVF9LRVlfUFJFRklYfSR7dGlja2V0SWR9YCk7XG4gICAgICAgIHJldHVybiBvcmdJZCA/IHsgb3JnSWQgfSA6IG51bGw7XG4gICAgICB9IGNhdGNoIChlcnIpIHtcbiAgICAgICAgbG9nZ2VyLndhcm4oJ1NTRSB0aWNrZXQgY29uc3VtZSBmYWlsZWQgKGZhaWwtY2xvc2VkKScsIHsgZXJyb3I6IGVyciBpbnN0YW5jZW9mIEVycm9yID8gZXJyLm1lc3NhZ2UgOiBTdHJpbmcoZXJyKSB9KTtcbiAgICAgICAgcmV0dXJuIG51bGw7XG4gICAgICB9XG4gICAgfSxcbiAgICBzdG9wKCk6IHZvaWQgeyAvKiBSZWRpcyBrZXlzIGV4cGlyZSBvbiB0aGVpciBvd24gVFRMIOKAlCBub3RoaW5nIHRvIHJlbGVhc2UuICovIH0sXG4gIH07XG59XG5cbi8qKlxuICogQnVpbGQgYW4ge0BsaW5rIFNzZVRpY2tldFN0b3JlfSBmcm9tIHRoZSBzdGFuZGFyZCBSZWRpcyBlbnYgKGBSRURJU19VUkxgIG9yXG4gKiBgUkVESVNfSE9TVGAvYFJFRElTX1BPUlRgKS4gVXNlcyB0aGUgUmVkaXMgYmFja2VuZCB3aGVuIGNvbmZpZ3VyZWRcbiAqIChtdWx0aS1yZXBsaWNhIHNhZmUpLCBvdGhlcndpc2UgZmFsbHMgYmFjayB0byB0aGUgaW4tbWVtb3J5IHNpbmdsZS1wcm9jZXNzXG4gKiBiYWNrZW5kLiBBIHNlcnZpY2Ugb3B0cyBpbiB3aXRoIG9uZSBib290IGxpbmU6XG4gKiAgIGBjb25zdCB0aWNrZXRzID0gY3JlYXRlRW52U3NlVGlja2V0U3RvcmUoeyB0dGxNcywgbWF4VG90YWwsIG1heFBlck9yZyB9KTtgXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVFbnZTc2VUaWNrZXRTdG9yZShjb25maWc6IFNzZVRpY2tldFN0b3JlQ29uZmlnKTogU3NlVGlja2V0U3RvcmUge1xuICBjb25zdCByZWRpcyA9IGNyZWF0ZUVudlJlZGlzQ2xpZW50PFNzZVJlZGlzPignc3NlLXRpY2tldCcpO1xuICBpZiAocmVkaXMpIHtcbiAgICBsb2dnZXIuaW5mbygnU1NFIHRpY2tldCBzdG9yZTogUmVkaXMgYmFja2VuZCAobXVsdGktcmVwbGljYSknKTtcbiAgICByZXR1cm4gY3JlYXRlUmVkaXNTc2VUaWNrZXRTdG9yZShyZWRpcywgY29uZmlnKTtcbiAgfVxuICBsb2dnZXIuaW5mbygnU1NFIHRpY2tldCBzdG9yZTogaW4tbWVtb3J5IGJhY2tlbmQgKHNpbmdsZS1wcm9jZXNzIGZhbGxiYWNrKScpO1xuICByZXR1cm4gY3JlYXRlSW5NZW1vcnlTc2VUaWNrZXRTdG9yZShjb25maWcpO1xufVxuIl19

package/lib/types/error-codes.d.ts

@@ -33,6 +33,12 @@ export declare enum ErrorCode {
     CONFLICT = "CONFLICT",
     DUPLICATE_ENTRY = "DUPLICATE_ENTRY",
     SCAN_CONFLICT = "SCAN_CONFLICT",
+    PAYMENT_METHOD_REQUIRED = "PAYMENT_METHOD_REQUIRED",// 402
+    DISCOUNT_CEILING_EXCEEDED = "DISCOUNT_CEILING_EXCEEDED",// 400
+    DISCOUNT_NOT_FOUND = "DISCOUNT_NOT_FOUND",// 404
+    DISCOUNT_INACTIVE = "DISCOUNT_INACTIVE",// 409
+    PLAN_OVER_CAP = "PLAN_OVER_CAP",// 409
+    ADDON_OVER_CAP = "ADDON_OVER_CAP",// 409
     INTERNAL_ERROR = "INTERNAL_ERROR",
     DATABASE_ERROR = "DATABASE_ERROR",
     SERVICE_UNAVAILABLE = "SERVICE_UNAVAILABLE",

package/lib/types/error-codes.js

@@ -43,6 +43,13 @@ export var ErrorCode;
     ErrorCode["CONFLICT"] = "CONFLICT";
     ErrorCode["DUPLICATE_ENTRY"] = "DUPLICATE_ENTRY";
     ErrorCode["SCAN_CONFLICT"] = "SCAN_CONFLICT";
+    // Billing errors
+    ErrorCode["PAYMENT_METHOD_REQUIRED"] = "PAYMENT_METHOD_REQUIRED";
+    ErrorCode["DISCOUNT_CEILING_EXCEEDED"] = "DISCOUNT_CEILING_EXCEEDED";
+    ErrorCode["DISCOUNT_NOT_FOUND"] = "DISCOUNT_NOT_FOUND";
+    ErrorCode["DISCOUNT_INACTIVE"] = "DISCOUNT_INACTIVE";
+    ErrorCode["PLAN_OVER_CAP"] = "PLAN_OVER_CAP";
+    ErrorCode["ADDON_OVER_CAP"] = "ADDON_OVER_CAP";
     // Server errors (500)
     ErrorCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
     ErrorCode["DATABASE_ERROR"] = "DATABASE_ERROR";
@@ -80,6 +87,12 @@ export const ErrorCodeStatus = {
     [ErrorCode.CONFLICT]: 409,
     [ErrorCode.DUPLICATE_ENTRY]: 409,
     [ErrorCode.SCAN_CONFLICT]: 409,
+    [ErrorCode.PAYMENT_METHOD_REQUIRED]: 402,
+    [ErrorCode.DISCOUNT_CEILING_EXCEEDED]: 400,
+    [ErrorCode.DISCOUNT_NOT_FOUND]: 404,
+    [ErrorCode.DISCOUNT_INACTIVE]: 409,
+    [ErrorCode.PLAN_OVER_CAP]: 409,
+    [ErrorCode.ADDON_OVER_CAP]: 409,
     [ErrorCode.INTERNAL_ERROR]: 500,
     [ErrorCode.DATABASE_ERROR]: 500,
     [ErrorCode.SERVICE_UNAVAILABLE]: 503,
@@ -91,4 +104,4 @@ export const ErrorCodeStatus = {
 export function getStatusForErrorCode(code) {
     return ErrorCodeStatus[code] ?? 500;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3ItY29kZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvZXJyb3ItY29kZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFOLElBQVksU0FnRFg7QUFoREQsV0FBWSxTQUFTO0lBQ25CLDhCQUE4QjtJQUM5QiwwQ0FBNkIsQ0FBQTtJQUM3Qiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUUvQiw2QkFBNkI7SUFDN0Isa0VBQXFELENBQUE7SUFDckQsMENBQTZCLENBQUE7SUFDN0IsMERBQTZDLENBQUE7SUFFN0MseUJBQXlCO0lBQ3pCLG9DQUF1QixDQUFBO0lBQ3ZCLDRDQUErQixDQUFBO0lBRS9CLDBCQUEwQjtJQUMxQixrREFBcUMsQ0FBQTtJQUNyQyw4REFBaUQsQ0FBQTtJQUNqRCw0REFBK0MsQ0FBQTtJQUMvQyw4Q0FBaUMsQ0FBQTtJQUNqQywwREFBNkMsQ0FBQTtJQUM3Qyw4REFBaUQsQ0FBQTtJQUNqRCxvRUFBdUQsQ0FBQTtJQUN2RCx3RUFBMkQsQ0FBQTtJQUMzRCw4REFBaUQsQ0FBQTtJQUNqRCxzRUFBeUQsQ0FBQTtJQUV6RCxnQ0FBZ0M7SUFDaEMsOENBQWlDLENBQUE7SUFDakMsd0RBQTJDLENBQUE7SUFFM0MsdUJBQXVCO0lBQ3ZCLG9EQUF1QyxDQUFBO0lBRXZDLHdCQUF3QjtJQUN4QixrQ0FBcUIsQ0FBQTtJQUNyQixnREFBbUMsQ0FBQTtJQUNuQyw0Q0FBK0IsQ0FBQTtJQUUvQixzQkFBc0I7SUFDdEIsOENBQWlDLENBQUE7SUFDakMsOENBQWlDLENBQUE7SUFFakMsNEJBQTRCO0lBQzVCLHdEQUEyQyxDQUFBO0lBQzNDLDhFQUFpRSxDQUFBO0FBQ25FLENBQUMsRUFoRFcsU0FBUyxLQUFULFNBQVMsUUFnRHBCO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQThCO0lBQ3hELENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxFQUFFLEdBQUc7SUFDN0IsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHO0lBQzlCLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUFFLEdBQUc7SUFDOUIsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxFQUFFLEdBQUc7SUFDekMsQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLEVBQUUsR0FBRztJQUM3QixDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLEdBQUc7SUFDckMsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQUUsR0FBRztJQUMxQixDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHO0lBQzlCLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLEVBQUUsR0FBRztJQUNqQyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLEdBQUc7SUFDdkMsQ0FBQyxTQUFTLENBQUMscUJBQXFCLENBQUMsRUFBRSxHQUFHO0lBQ3RDLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEdBQUc7SUFDL0IsQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUMsRUFBRSxHQUFHO0lBQ3JDLENBQUMsU0FBUyxDQUFDLHNCQUFzQixDQUFDLEVBQUUsR0FBRztJQUN2QyxDQUFDLFNBQVMsQ0FBQyx5QkFBeUIsQ0FBQyxFQUFFLEdBQUc7SUFDMUMsQ0FBQyxTQUFTLENBQUMsMkJBQTJCLENBQUMsRUFBRSxHQUFHO0lBQzVDLENBQUMsU0FBUyxDQUFDLHNCQUFzQixDQUFDLEVBQUUsR0FBRztJQUN2QyxDQUFDLFNBQVMsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLEdBQUc7SUFDM0MsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsR0FBRztJQUMvQixDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUc7SUFDcEMsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsRUFBRSxHQUFHO0lBQ2xDLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEdBQUc7SUFDekIsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEVBQUUsR0FBRztJQUNoQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHO0lBQzlCLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEdBQUc7SUFDL0IsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsR0FBRztJQUMvQixDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUc7SUFDcEMsQ0FBQyxTQUFTLENBQUMsOEJBQThCLENBQUMsRUFBRSxHQUFHO0NBQ2hELENBQUM7QUFFRjs7R0FFRztBQUNILE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxJQUFlO0lBQ25ELE9BQU8sZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQztBQUN0QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogU3RhbmRhcmRpemVkIGVycm9yIGNvZGVzIHVzZWQgYWNyb3NzIGFsbCBBUEkgbWljcm9zZXJ2aWNlcy5cbiAqIFVzZSB0aGVzZSBjb2RlcyBpbiBlcnJvciByZXNwb25zZXMgZm9yIGNvbnNpc3RlbnQgY2xpZW50IGhhbmRsaW5nLlxuICpcbiAqIEVhY2ggSFRUUCBzdGF0dXMgY2F0ZWdvcnkgaGFzIG9uZSBwcmltYXJ5IGNvZGUuIFVzZSB0aGUgYGRldGFpbHNgXG4gKiBmaWVsZCBpbiBlcnJvciByZXNwb25zZXMgZm9yIHN1Yi10eXBlIGluZm9ybWF0aW9uIChlLmcuIHdoaWNoIHF1b3RhXG4gKiB3YXMgZXhjZWVkZWQsIHdoaWNoIGZpZWxkIGZhaWxlZCB2YWxpZGF0aW9uKS5cbiAqL1xuZXhwb3J0IGVudW0gRXJyb3JDb2RlIHtcbiAgLy8gQXV0aGVudGljYXRpb24gZXJyb3JzICg0MDEpXG4gIFVOQVVUSE9SSVpFRCA9ICdVTkFVVEhPUklaRUQnLFxuICBUT0tFTl9FWFBJUkVEID0gJ1RPS0VOX0VYUElSRUQnLFxuICBUT0tFTl9JTlZBTElEID0gJ1RPS0VOX0lOVkFMSUQnLFxuICBUT0tFTl9NSVNTSU5HID0gJ1RPS0VOX01JU1NJTkcnLFxuICBUT0tFTl9SRVZPS0VEID0gJ1RPS0VOX1JFVk9LRUQnLFxuXG4gIC8vIEF1dGhvcml6YXRpb24gZXJyb3JzICg0MDMpXG4gIElOU1VGRklDSUVOVF9QRVJNSVNTSU9OUyA9ICdJTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMnLFxuICBPUkdfTUlTTUFUQ0ggPSAnT1JHX01JU01BVENIJyxcbiAgQ09NUExJQU5DRV9WSU9MQVRJT04gPSAnQ09NUExJQU5DRV9WSU9MQVRJT04nLFxuXG4gIC8vIE5vdCBmb3VuZCBlcnJvcnMgKDQwNClcbiAgTk9UX0ZPVU5EID0gJ05PVF9GT1VORCcsXG4gIE9SR19OT1RfRk9VTkQgPSAnT1JHX05PVF9GT1VORCcsXG5cbiAgLy8gVmFsaWRhdGlvbiBlcnJvcnMgKDQwMClcbiAgVkFMSURBVElPTl9FUlJPUiA9ICdWQUxJREFUSU9OX0VSUk9SJyxcbiAgTUlTU0lOR19SRVFVSVJFRF9GSUVMRCA9ICdNSVNTSU5HX1JFUVVJUkVEX0ZJRUxEJyxcbiAgVEVNUExBVEVfVU5LTk9XTl9QQVRIID0gJ1RFTVBMQVRFX1VOS05PV05fUEFUSCcsXG4gIFRFTVBMQVRFX0NZQ0xFID0gJ1RFTVBMQVRFX0NZQ0xFJyxcbiAgVEVNUExBVEVfUEFSU0VfRVJST1IgPSAnVEVNUExBVEVfUEFSU0VfRVJST1InLFxuICBURU1QTEFURV9UWVBFX01JU01BVENIID0gJ1RFTVBMQVRFX1RZUEVfTUlTTUFUQ0gnLFxuICBURU1QTEFURV9TRUNSRVRTX1JFU0VSVkVEID0gJ1RFTVBMQVRFX1NFQ1JFVFNfUkVTRVJWRUQnLFxuICBURU1QTEFURV9DT05UUkFDVF9WSU9MQVRJT04gPSAnVEVNUExBVEVfQ09OVFJBQ1RfVklPTEFUSU9OJyxcbiAgVEVNUExBVEVfU0laRV9FWENFRURFRCA9ICdURU1QTEFURV9TSVpFX0VYQ0VFREVEJyxcbiAgVEVNUExBVEVfVkFMSURBVElPTl9GQUlMRUQgPSAnVEVNUExBVEVfVkFMSURBVElPTl9GQUlMRUQnLFxuXG4gIC8vIFF1b3RhL1JhdGUgbGltaXQgZXJyb3JzICg0MjkpXG4gIFFVT1RBX0VYQ0VFREVEID0gJ1FVT1RBX0VYQ0VFREVEJyxcbiAgUkFURV9MSU1JVF9FWENFRURFRCA9ICdSQVRFX0xJTUlUX0VYQ0VFREVEJyxcblxuICAvLyBQYXlsb2FkIGVycm9ycyAoNDEzKVxuICBQQVlMT0FEX1RPT19MQVJHRSA9ICdQQVlMT0FEX1RPT19MQVJHRScsXG5cbiAgLy8gQ29uZmxpY3QgZXJyb3JzICg0MDkpXG4gIENPTkZMSUNUID0gJ0NPTkZMSUNUJyxcbiAgRFVQTElDQVRFX0VOVFJZID0gJ0RVUExJQ0FURV9FTlRSWScsXG4gIFNDQU5fQ09ORkxJQ1QgPSAnU0NBTl9DT05GTElDVCcsXG5cbiAgLy8gU2VydmVyIGVycm9ycyAoNTAwKVxuICBJTlRFUk5BTF9FUlJPUiA9ICdJTlRFUk5BTF9FUlJPUicsXG4gIERBVEFCQVNFX0VSUk9SID0gJ0RBVEFCQVNFX0VSUk9SJyxcblxuICAvLyBTZXJ2aWNlIHVuYXZhaWxhYmxlICg1MDMpXG4gIFNFUlZJQ0VfVU5BVkFJTEFCTEUgPSAnU0VSVklDRV9VTkFWQUlMQUJMRScsXG4gIENPTVBMSUFOQ0VfU0VSVklDRV9VTkFWQUlMQUJMRSA9ICdDT01QTElBTkNFX1NFUlZJQ0VfVU5BVkFJTEFCTEUnLFxufVxuXG4vKipcbiAqIE1hcHMgZXJyb3IgY29kZXMgdG8gdGhlaXIgZGVmYXVsdCBIVFRQIHN0YXR1cyBjb2Rlcy5cbiAqL1xuZXhwb3J0IGNvbnN0IEVycm9yQ29kZVN0YXR1czogUmVjb3JkPEVycm9yQ29kZSwgbnVtYmVyPiA9IHtcbiAgW0Vycm9yQ29kZS5VTkFVVEhPUklaRURdOiA0MDEsXG4gIFtFcnJvckNvZGUuVE9LRU5fRVhQSVJFRF06IDQwMSxcbiAgW0Vycm9yQ29kZS5UT0tFTl9JTlZBTElEXTogNDAxLFxuICBbRXJyb3JDb2RlLlRPS0VOX01JU1NJTkddOiA0MDEsXG4gIFtFcnJvckNvZGUuVE9LRU5fUkVWT0tFRF06IDQwMSxcbiAgW0Vycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlNdOiA0MDMsXG4gIFtFcnJvckNvZGUuT1JHX01JU01BVENIXTogNDAzLFxuICBbRXJyb3JDb2RlLkNPTVBMSUFOQ0VfVklPTEFUSU9OXTogNDAzLFxuICBbRXJyb3JDb2RlLk5PVF9GT1VORF06IDQwNCxcbiAgW0Vycm9yQ29kZS5PUkdfTk9UX0ZPVU5EXTogNDA0LFxuICBbRXJyb3JDb2RlLlZBTElEQVRJT05fRVJST1JdOiA0MDAsXG4gIFtFcnJvckNvZGUuTUlTU0lOR19SRVFVSVJFRF9GSUVMRF06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9VTktOT1dOX1BBVEhdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfQ1lDTEVdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfUEFSU0VfRVJST1JdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfVFlQRV9NSVNNQVRDSF06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9TRUNSRVRTX1JFU0VSVkVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlRFTVBMQVRFX0NPTlRSQUNUX1ZJT0xBVElPTl06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9TSVpFX0VYQ0VFREVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlRFTVBMQVRFX1ZBTElEQVRJT05fRkFJTEVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlFVT1RBX0VYQ0VFREVEXTogNDI5LFxuICBbRXJyb3JDb2RlLlJBVEVfTElNSVRfRVhDRUVERURdOiA0MjksXG4gIFtFcnJvckNvZGUuUEFZTE9BRF9UT09fTEFSR0VdOiA0MTMsXG4gIFtFcnJvckNvZGUuQ09ORkxJQ1RdOiA0MDksXG4gIFtFcnJvckNvZGUuRFVQTElDQVRFX0VOVFJZXTogNDA5LFxuICBbRXJyb3JDb2RlLlNDQU5fQ09ORkxJQ1RdOiA0MDksXG4gIFtFcnJvckNvZGUuSU5URVJOQUxfRVJST1JdOiA1MDAsXG4gIFtFcnJvckNvZGUuREFUQUJBU0VfRVJST1JdOiA1MDAsXG4gIFtFcnJvckNvZGUuU0VSVklDRV9VTkFWQUlMQUJMRV06IDUwMyxcbiAgW0Vycm9yQ29kZS5DT01QTElBTkNFX1NFUlZJQ0VfVU5BVkFJTEFCTEVdOiA1MDMsXG59O1xuXG4vKipcbiAqIEdldCB0aGUgSFRUUCBzdGF0dXMgY29kZSBmb3IgYW4gZXJyb3IgY29kZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldFN0YXR1c0ZvckVycm9yQ29kZShjb2RlOiBFcnJvckNvZGUpOiBudW1iZXIge1xuICByZXR1cm4gRXJyb3JDb2RlU3RhdHVzW2NvZGVdID8/IDUwMDtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3ItY29kZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvZXJyb3ItY29kZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFOLElBQVksU0F3RFg7QUF4REQsV0FBWSxTQUFTO0lBQ25CLDhCQUE4QjtJQUM5QiwwQ0FBNkIsQ0FBQTtJQUM3Qiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUMvQiw0Q0FBK0IsQ0FBQTtJQUUvQiw2QkFBNkI7SUFDN0Isa0VBQXFELENBQUE7SUFDckQsMENBQTZCLENBQUE7SUFDN0IsMERBQTZDLENBQUE7SUFFN0MseUJBQXlCO0lBQ3pCLG9DQUF1QixDQUFBO0lBQ3ZCLDRDQUErQixDQUFBO0lBRS9CLDBCQUEwQjtJQUMxQixrREFBcUMsQ0FBQTtJQUNyQyw4REFBaUQsQ0FBQTtJQUNqRCw0REFBK0MsQ0FBQTtJQUMvQyw4Q0FBaUMsQ0FBQTtJQUNqQywwREFBNkMsQ0FBQTtJQUM3Qyw4REFBaUQsQ0FBQTtJQUNqRCxvRUFBdUQsQ0FBQTtJQUN2RCx3RUFBMkQsQ0FBQTtJQUMzRCw4REFBaUQsQ0FBQTtJQUNqRCxzRUFBeUQsQ0FBQTtJQUV6RCxnQ0FBZ0M7SUFDaEMsOENBQWlDLENBQUE7SUFDakMsd0RBQTJDLENBQUE7SUFFM0MsdUJBQXVCO0lBQ3ZCLG9EQUF1QyxDQUFBO0lBRXZDLHdCQUF3QjtJQUN4QixrQ0FBcUIsQ0FBQTtJQUNyQixnREFBbUMsQ0FBQTtJQUNuQyw0Q0FBK0IsQ0FBQTtJQUUvQixpQkFBaUI7SUFDakIsZ0VBQW1ELENBQUE7SUFDbkQsb0VBQXVELENBQUE7SUFDdkQsc0RBQXlDLENBQUE7SUFDekMsb0RBQXVDLENBQUE7SUFDdkMsNENBQStCLENBQUE7SUFDL0IsOENBQWlDLENBQUE7SUFFakMsc0JBQXNCO0lBQ3RCLDhDQUFpQyxDQUFBO0lBQ2pDLDhDQUFpQyxDQUFBO0lBRWpDLDRCQUE0QjtJQUM1Qix3REFBMkMsQ0FBQTtJQUMzQyw4RUFBaUUsQ0FBQTtBQUNuRSxDQUFDLEVBeERXLFNBQVMsS0FBVCxTQUFTLFFBd0RwQjtBQUVEOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUE4QjtJQUN4RCxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsRUFBRSxHQUFHO0lBQzdCLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUFFLEdBQUc7SUFDOUIsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHO0lBQzlCLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxFQUFFLEdBQUc7SUFDOUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUMsRUFBRSxHQUFHO0lBQ3pDLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxFQUFFLEdBQUc7SUFDN0IsQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUMsRUFBRSxHQUFHO0lBQ3JDLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEdBQUc7SUFDMUIsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLEdBQUc7SUFDakMsQ0FBQyxTQUFTLENBQUMsc0JBQXNCLENBQUMsRUFBRSxHQUFHO0lBQ3ZDLENBQUMsU0FBUyxDQUFDLHFCQUFxQixDQUFDLEVBQUUsR0FBRztJQUN0QyxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsRUFBRSxHQUFHO0lBQy9CLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsR0FBRztJQUNyQyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLEdBQUc7SUFDdkMsQ0FBQyxTQUFTLENBQUMseUJBQXlCLENBQUMsRUFBRSxHQUFHO0lBQzFDLENBQUMsU0FBUyxDQUFDLDJCQUEyQixDQUFDLEVBQUUsR0FBRztJQUM1QyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLEdBQUc7SUFDdkMsQ0FBQyxTQUFTLENBQUMsMEJBQTBCLENBQUMsRUFBRSxHQUFHO0lBQzNDLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEdBQUc7SUFDL0IsQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUMsRUFBRSxHQUFHO0lBQ3BDLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsR0FBRztJQUNsQyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHO0lBQ3pCLENBQUMsU0FBUyxDQUFDLGVBQWUsQ0FBQyxFQUFFLEdBQUc7SUFDaEMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLEdBQUc7SUFDeEMsQ0FBQyxTQUFTLENBQUMseUJBQXlCLENBQUMsRUFBRSxHQUFHO0lBQzFDLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEVBQUUsR0FBRztJQUNuQyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLEdBQUc7SUFDbEMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsR0FBRztJQUM5QixDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsRUFBRSxHQUFHO0lBQy9CLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEdBQUc7SUFDL0IsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsR0FBRztJQUMvQixDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUc7SUFDcEMsQ0FBQyxTQUFTLENBQUMsOEJBQThCLENBQUMsRUFBRSxHQUFHO0NBQ2hELENBQUM7QUFFRjs7R0FFRztBQUNILE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxJQUFlO0lBQ25ELE9BQU8sZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQztBQUN0QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogU3RhbmRhcmRpemVkIGVycm9yIGNvZGVzIHVzZWQgYWNyb3NzIGFsbCBBUEkgbWljcm9zZXJ2aWNlcy5cbiAqIFVzZSB0aGVzZSBjb2RlcyBpbiBlcnJvciByZXNwb25zZXMgZm9yIGNvbnNpc3RlbnQgY2xpZW50IGhhbmRsaW5nLlxuICpcbiAqIEVhY2ggSFRUUCBzdGF0dXMgY2F0ZWdvcnkgaGFzIG9uZSBwcmltYXJ5IGNvZGUuIFVzZSB0aGUgYGRldGFpbHNgXG4gKiBmaWVsZCBpbiBlcnJvciByZXNwb25zZXMgZm9yIHN1Yi10eXBlIGluZm9ybWF0aW9uIChlLmcuIHdoaWNoIHF1b3RhXG4gKiB3YXMgZXhjZWVkZWQsIHdoaWNoIGZpZWxkIGZhaWxlZCB2YWxpZGF0aW9uKS5cbiAqL1xuZXhwb3J0IGVudW0gRXJyb3JDb2RlIHtcbiAgLy8gQXV0aGVudGljYXRpb24gZXJyb3JzICg0MDEpXG4gIFVOQVVUSE9SSVpFRCA9ICdVTkFVVEhPUklaRUQnLFxuICBUT0tFTl9FWFBJUkVEID0gJ1RPS0VOX0VYUElSRUQnLFxuICBUT0tFTl9JTlZBTElEID0gJ1RPS0VOX0lOVkFMSUQnLFxuICBUT0tFTl9NSVNTSU5HID0gJ1RPS0VOX01JU1NJTkcnLFxuICBUT0tFTl9SRVZPS0VEID0gJ1RPS0VOX1JFVk9LRUQnLFxuXG4gIC8vIEF1dGhvcml6YXRpb24gZXJyb3JzICg0MDMpXG4gIElOU1VGRklDSUVOVF9QRVJNSVNTSU9OUyA9ICdJTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMnLFxuICBPUkdfTUlTTUFUQ0ggPSAnT1JHX01JU01BVENIJyxcbiAgQ09NUExJQU5DRV9WSU9MQVRJT04gPSAnQ09NUExJQU5DRV9WSU9MQVRJT04nLFxuXG4gIC8vIE5vdCBmb3VuZCBlcnJvcnMgKDQwNClcbiAgTk9UX0ZPVU5EID0gJ05PVF9GT1VORCcsXG4gIE9SR19OT1RfRk9VTkQgPSAnT1JHX05PVF9GT1VORCcsXG5cbiAgLy8gVmFsaWRhdGlvbiBlcnJvcnMgKDQwMClcbiAgVkFMSURBVElPTl9FUlJPUiA9ICdWQUxJREFUSU9OX0VSUk9SJyxcbiAgTUlTU0lOR19SRVFVSVJFRF9GSUVMRCA9ICdNSVNTSU5HX1JFUVVJUkVEX0ZJRUxEJyxcbiAgVEVNUExBVEVfVU5LTk9XTl9QQVRIID0gJ1RFTVBMQVRFX1VOS05PV05fUEFUSCcsXG4gIFRFTVBMQVRFX0NZQ0xFID0gJ1RFTVBMQVRFX0NZQ0xFJyxcbiAgVEVNUExBVEVfUEFSU0VfRVJST1IgPSAnVEVNUExBVEVfUEFSU0VfRVJST1InLFxuICBURU1QTEFURV9UWVBFX01JU01BVENIID0gJ1RFTVBMQVRFX1RZUEVfTUlTTUFUQ0gnLFxuICBURU1QTEFURV9TRUNSRVRTX1JFU0VSVkVEID0gJ1RFTVBMQVRFX1NFQ1JFVFNfUkVTRVJWRUQnLFxuICBURU1QTEFURV9DT05UUkFDVF9WSU9MQVRJT04gPSAnVEVNUExBVEVfQ09OVFJBQ1RfVklPTEFUSU9OJyxcbiAgVEVNUExBVEVfU0laRV9FWENFRURFRCA9ICdURU1QTEFURV9TSVpFX0VYQ0VFREVEJyxcbiAgVEVNUExBVEVfVkFMSURBVElPTl9GQUlMRUQgPSAnVEVNUExBVEVfVkFMSURBVElPTl9GQUlMRUQnLFxuXG4gIC8vIFF1b3RhL1JhdGUgbGltaXQgZXJyb3JzICg0MjkpXG4gIFFVT1RBX0VYQ0VFREVEID0gJ1FVT1RBX0VYQ0VFREVEJyxcbiAgUkFURV9MSU1JVF9FWENFRURFRCA9ICdSQVRFX0xJTUlUX0VYQ0VFREVEJyxcblxuICAvLyBQYXlsb2FkIGVycm9ycyAoNDEzKVxuICBQQVlMT0FEX1RPT19MQVJHRSA9ICdQQVlMT0FEX1RPT19MQVJHRScsXG5cbiAgLy8gQ29uZmxpY3QgZXJyb3JzICg0MDkpXG4gIENPTkZMSUNUID0gJ0NPTkZMSUNUJyxcbiAgRFVQTElDQVRFX0VOVFJZID0gJ0RVUExJQ0FURV9FTlRSWScsXG4gIFNDQU5fQ09ORkxJQ1QgPSAnU0NBTl9DT05GTElDVCcsXG5cbiAgLy8gQmlsbGluZyBlcnJvcnNcbiAgUEFZTUVOVF9NRVRIT0RfUkVRVUlSRUQgPSAnUEFZTUVOVF9NRVRIT0RfUkVRVUlSRUQnLCAvLyA0MDJcbiAgRElTQ09VTlRfQ0VJTElOR19FWENFRURFRCA9ICdESVNDT1VOVF9DRUlMSU5HX0VYQ0VFREVEJywgLy8gNDAwXG4gIERJU0NPVU5UX05PVF9GT1VORCA9ICdESVNDT1VOVF9OT1RfRk9VTkQnLCAvLyA0MDRcbiAgRElTQ09VTlRfSU5BQ1RJVkUgPSAnRElTQ09VTlRfSU5BQ1RJVkUnLCAvLyA0MDlcbiAgUExBTl9PVkVSX0NBUCA9ICdQTEFOX09WRVJfQ0FQJywgLy8gNDA5XG4gIEFERE9OX09WRVJfQ0FQID0gJ0FERE9OX09WRVJfQ0FQJywgLy8gNDA5XG5cbiAgLy8gU2VydmVyIGVycm9ycyAoNTAwKVxuICBJTlRFUk5BTF9FUlJPUiA9ICdJTlRFUk5BTF9FUlJPUicsXG4gIERBVEFCQVNFX0VSUk9SID0gJ0RBVEFCQVNFX0VSUk9SJyxcblxuICAvLyBTZXJ2aWNlIHVuYXZhaWxhYmxlICg1MDMpXG4gIFNFUlZJQ0VfVU5BVkFJTEFCTEUgPSAnU0VSVklDRV9VTkFWQUlMQUJMRScsXG4gIENPTVBMSUFOQ0VfU0VSVklDRV9VTkFWQUlMQUJMRSA9ICdDT01QTElBTkNFX1NFUlZJQ0VfVU5BVkFJTEFCTEUnLFxufVxuXG4vKipcbiAqIE1hcHMgZXJyb3IgY29kZXMgdG8gdGhlaXIgZGVmYXVsdCBIVFRQIHN0YXR1cyBjb2Rlcy5cbiAqL1xuZXhwb3J0IGNvbnN0IEVycm9yQ29kZVN0YXR1czogUmVjb3JkPEVycm9yQ29kZSwgbnVtYmVyPiA9IHtcbiAgW0Vycm9yQ29kZS5VTkFVVEhPUklaRURdOiA0MDEsXG4gIFtFcnJvckNvZGUuVE9LRU5fRVhQSVJFRF06IDQwMSxcbiAgW0Vycm9yQ29kZS5UT0tFTl9JTlZBTElEXTogNDAxLFxuICBbRXJyb3JDb2RlLlRPS0VOX01JU1NJTkddOiA0MDEsXG4gIFtFcnJvckNvZGUuVE9LRU5fUkVWT0tFRF06IDQwMSxcbiAgW0Vycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlNdOiA0MDMsXG4gIFtFcnJvckNvZGUuT1JHX01JU01BVENIXTogNDAzLFxuICBbRXJyb3JDb2RlLkNPTVBMSUFOQ0VfVklPTEFUSU9OXTogNDAzLFxuICBbRXJyb3JDb2RlLk5PVF9GT1VORF06IDQwNCxcbiAgW0Vycm9yQ29kZS5PUkdfTk9UX0ZPVU5EXTogNDA0LFxuICBbRXJyb3JDb2RlLlZBTElEQVRJT05fRVJST1JdOiA0MDAsXG4gIFtFcnJvckNvZGUuTUlTU0lOR19SRVFVSVJFRF9GSUVMRF06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9VTktOT1dOX1BBVEhdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfQ1lDTEVdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfUEFSU0VfRVJST1JdOiA0MDAsXG4gIFtFcnJvckNvZGUuVEVNUExBVEVfVFlQRV9NSVNNQVRDSF06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9TRUNSRVRTX1JFU0VSVkVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlRFTVBMQVRFX0NPTlRSQUNUX1ZJT0xBVElPTl06IDQwMCxcbiAgW0Vycm9yQ29kZS5URU1QTEFURV9TSVpFX0VYQ0VFREVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlRFTVBMQVRFX1ZBTElEQVRJT05fRkFJTEVEXTogNDAwLFxuICBbRXJyb3JDb2RlLlFVT1RBX0VYQ0VFREVEXTogNDI5LFxuICBbRXJyb3JDb2RlLlJBVEVfTElNSVRfRVhDRUVERURdOiA0MjksXG4gIFtFcnJvckNvZGUuUEFZTE9BRF9UT09fTEFSR0VdOiA0MTMsXG4gIFtFcnJvckNvZGUuQ09ORkxJQ1RdOiA0MDksXG4gIFtFcnJvckNvZGUuRFVQTElDQVRFX0VOVFJZXTogNDA5LFxuICBbRXJyb3JDb2RlLlNDQU5fQ09ORkxJQ1RdOiA0MDksXG4gIFtFcnJvckNvZGUuUEFZTUVOVF9NRVRIT0RfUkVRVUlSRURdOiA0MDIsXG4gIFtFcnJvckNvZGUuRElTQ09VTlRfQ0VJTElOR19FWENFRURFRF06IDQwMCxcbiAgW0Vycm9yQ29kZS5ESVNDT1VOVF9OT1RfRk9VTkRdOiA0MDQsXG4gIFtFcnJvckNvZGUuRElTQ09VTlRfSU5BQ1RJVkVdOiA0MDksXG4gIFtFcnJvckNvZGUuUExBTl9PVkVSX0NBUF06IDQwOSxcbiAgW0Vycm9yQ29kZS5BRERPTl9PVkVSX0NBUF06IDQwOSxcbiAgW0Vycm9yQ29kZS5JTlRFUk5BTF9FUlJPUl06IDUwMCxcbiAgW0Vycm9yQ29kZS5EQVRBQkFTRV9FUlJPUl06IDUwMCxcbiAgW0Vycm9yQ29kZS5TRVJWSUNFX1VOQVZBSUxBQkxFXTogNTAzLFxuICBbRXJyb3JDb2RlLkNPTVBMSUFOQ0VfU0VSVklDRV9VTkFWQUlMQUJMRV06IDUwMyxcbn07XG5cbi8qKlxuICogR2V0IHRoZSBIVFRQIHN0YXR1cyBjb2RlIGZvciBhbiBlcnJvciBjb2RlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0U3RhdHVzRm9yRXJyb3JDb2RlKGNvZGU6IEVycm9yQ29kZSk6IG51bWJlciB7XG4gIHJldHVybiBFcnJvckNvZGVTdGF0dXNbY29kZV0gPz8gNTAwO1xufVxuIl19

package/lib/utils/alias-resolver.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Clear the memoized alias set so the next access re-reads `SUPPORT_ALIASES`.
+ * The cache is process-lifetime by design (env is fixed per process); this hook
+ * exists so tests can vary the env between cases.
+ */
+export declare function resetSupportAliasesCache(): void;
 /** Well-known fallback support alias used when SUPPORT_ALIASES is unconfigured. */
 export declare const DEFAULT_SUPPORT_ALIAS = "support@pipeline-builder";
 /**
@@ -7,6 +13,12 @@ export declare const DEFAULT_SUPPORT_ALIAS = "support@pipeline-builder";
  * is unset. (All configured aliases still resolve via {@link resolveRecipientAlias}.)
  */
 export declare function getPrimarySupportAlias(): string;
+/**
+ * ALL configured support aliases (order preserved), for UIs that surface every
+ * support inbox as a distinct recipient suggestion. Falls back to a single
+ * {@link DEFAULT_SUPPORT_ALIAS} when SUPPORT_ALIASES is unset.
+ */
+export declare function getAllSupportAliases(): string[];
 /** Result of alias resolution. */
 export interface AliasResolution {
     /** The resolved organization ID (e.g., 'system'). */

package/lib/utils/alias-resolver.js

@@ -13,6 +13,14 @@ function getSupportAliases() {
     }
     return _supportAliases;
 }
+/**
+ * Clear the memoized alias set so the next access re-reads `SUPPORT_ALIASES`.
+ * The cache is process-lifetime by design (env is fixed per process); this hook
+ * exists so tests can vary the env between cases.
+ */
+export function resetSupportAliasesCache() {
+    _supportAliases = undefined;
+}
 /** Well-known fallback support alias used when SUPPORT_ALIASES is unconfigured. */
 export const DEFAULT_SUPPORT_ALIAS = 'support@pipeline-builder';
 /**
@@ -26,6 +34,15 @@ export function getPrimarySupportAlias() {
         return alias;
     return DEFAULT_SUPPORT_ALIAS;
 }
+/**
+ * ALL configured support aliases (order preserved), for UIs that surface every
+ * support inbox as a distinct recipient suggestion. Falls back to a single
+ * {@link DEFAULT_SUPPORT_ALIAS} when SUPPORT_ALIASES is unset.
+ */
+export function getAllSupportAliases() {
+    const all = [...getSupportAliases()];
+    return all.length > 0 ? all : [DEFAULT_SUPPORT_ALIAS];
+}
 /**
  * Resolve an email-like alias to an actual organization ID.
  *
@@ -48,4 +65,4 @@ export function resolveRecipientAlias(recipientOrgId) {
         originalValue: recipientOrgId,
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxpYXMtcmVzb2x2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvYWxpYXMtcmVzb2x2ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFFdEQseUZBQXlGO0FBQ3pGLElBQUksZUFBd0MsQ0FBQztBQUU3QyxTQUFTLGlCQUFpQjtJQUN4QixJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDckIsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLElBQUksRUFBRSxDQUFDO1FBQzlDLGVBQWUsR0FBRyxJQUFJLEdBQUcsQ0FDdkIsR0FBRzthQUNBLEtBQUssQ0FBQyxHQUFHLENBQUM7YUFDVixHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7YUFDeEMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FDckMsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLGVBQWUsQ0FBQztBQUN6QixDQUFDO0FBRUQsbUZBQW1GO0FBQ25GLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLDBCQUEwQixDQUFDO0FBRWhFOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQjtJQUNwQyxLQUFLLE1BQU0sS0FBSyxJQUFJLGlCQUFpQixFQUFFO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdEQsT0FBTyxxQkFBcUIsQ0FBQztBQUMvQixDQUFDO0FBWUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUMsY0FBc0I7SUFDMUQsTUFBTSxVQUFVLEdBQUcsY0FBYyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ3ZELE1BQU0sT0FBTyxHQUFHLGlCQUFpQixFQUFFLENBQUM7SUFFcEMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDNUIsT0FBTztZQUNMLGFBQWEsRUFBRSxhQUFhO1lBQzVCLFFBQVEsRUFBRSxJQUFJO1lBQ2QsYUFBYSxFQUFFLGNBQWM7U0FDOUIsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPO1FBQ0wsYUFBYSxFQUFFLFVBQVU7UUFDekIsUUFBUSxFQUFFLEtBQUs7UUFDZixhQUFhLEVBQUUsY0FBYztLQUM5QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBTWVNURU1fT1JHX0lEIH0gZnJvbSAnLi4vbWlkZGxld2FyZS9hdXRoLmpzJztcblxuLyoqIExhemlseS1jYWNoZWQgc2V0IG9mIHN1cHBvcnQgYWxpYXNlcywgcGFyc2VkIGZyb20gU1VQUE9SVF9BTElBU0VTIG9uIGZpcnN0IGFjY2Vzcy4gKi9cbmxldCBfc3VwcG9ydEFsaWFzZXM6IFNldDxzdHJpbmc+IHwgdW5kZWZpbmVkO1xuXG5mdW5jdGlvbiBnZXRTdXBwb3J0QWxpYXNlcygpOiBTZXQ8c3RyaW5nPiB7XG4gIGlmICghX3N1cHBvcnRBbGlhc2VzKSB7XG4gICAgY29uc3QgcmF3ID0gcHJvY2Vzcy5lbnYuU1VQUE9SVF9BTElBU0VTIHx8ICcnO1xuICAgIF9zdXBwb3J0QWxpYXNlcyA9IG5ldyBTZXQoXG4gICAgICByYXdcbiAgICAgICAgLnNwbGl0KCcsJylcbiAgICAgICAgLm1hcChhbGlhcyA9PiBhbGlhcy50cmltKCkudG9Mb3dlckNhc2UoKSlcbiAgICAgICAgLmZpbHRlcihhbGlhcyA9PiBhbGlhcy5sZW5ndGggPiAwKSxcbiAgICApO1xuICB9XG4gIHJldHVybiBfc3VwcG9ydEFsaWFzZXM7XG59XG5cbi8qKiBXZWxsLWtub3duIGZhbGxiYWNrIHN1cHBvcnQgYWxpYXMgdXNlZCB3aGVuIFNVUFBPUlRfQUxJQVNFUyBpcyB1bmNvbmZpZ3VyZWQuICovXG5leHBvcnQgY29uc3QgREVGQVVMVF9TVVBQT1JUX0FMSUFTID0gJ3N1cHBvcnRAcGlwZWxpbmUtYnVpbGRlcic7XG5cbi8qKlxuICogVGhlIFBSSU1BUlkgKGZpcnN0LWNvbmZpZ3VyZWQpIHN1cHBvcnQgYWxpYXMg4oCUIGZvciBkaXNwbGF5IC8gcHJlZmlsbCBpbiBVSXNcbiAqIChlLmcuIHRoZSBjb21wb3NlIFwiVG9cIiBmaWVsZCksIHNvIHRoZSBzaG93biB2YWx1ZSBpcyBkcml2ZW4gYnkgU1VQUE9SVF9BTElBU0VTXG4gKiByYXRoZXIgdGhhbiBoYXJkY29kZWQuIEZhbGxzIGJhY2sgdG8ge0BsaW5rIERFRkFVTFRfU1VQUE9SVF9BTElBU30gd2hlbiB0aGUgZW52XG4gKiBpcyB1bnNldC4gKEFsbCBjb25maWd1cmVkIGFsaWFzZXMgc3RpbGwgcmVzb2x2ZSB2aWEge0BsaW5rIHJlc29sdmVSZWNpcGllbnRBbGlhc30uKVxuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0UHJpbWFyeVN1cHBvcnRBbGlhcygpOiBzdHJpbmcge1xuICBmb3IgKGNvbnN0IGFsaWFzIG9mIGdldFN1cHBvcnRBbGlhc2VzKCkpIHJldHVybiBhbGlhcztcbiAgcmV0dXJuIERFRkFVTFRfU1VQUE9SVF9BTElBUztcbn1cblxuLyoqIFJlc3VsdCBvZiBhbGlhcyByZXNvbHV0aW9uLiAqL1xuZXhwb3J0IGludGVyZmFjZSBBbGlhc1Jlc29sdXRpb24ge1xuICAvKiogVGhlIHJlc29sdmVkIG9yZ2FuaXphdGlvbiBJRCAoZS5nLiwgJ3N5c3RlbScpLiAqL1xuICByZXNvbHZlZE9yZ0lkOiBzdHJpbmc7XG4gIC8qKiBXaGV0aGVyIHRoZSBpbnB1dCB3YXMgYW4gYWxpYXMgdGhhdCBnb3QgcmVzb2x2ZWQuICovXG4gIHdhc0FsaWFzOiBib29sZWFuO1xuICAvKiogVGhlIG9yaWdpbmFsIGlucHV0IHZhbHVlLCB1c2VmdWwgZm9yIGF1ZGl0IGxvZ2dpbmcuICovXG4gIG9yaWdpbmFsVmFsdWU6IHN0cmluZztcbn1cblxuLyoqXG4gKiBSZXNvbHZlIGFuIGVtYWlsLWxpa2UgYWxpYXMgdG8gYW4gYWN0dWFsIG9yZ2FuaXphdGlvbiBJRC5cbiAqXG4gKiBJZiB0aGUgaW5wdXQgbWF0Y2hlcyBhIGNvbmZpZ3VyZWQgc3VwcG9ydCBhbGlhcywgaXQgcmVzb2x2ZXMgdG8gdGhlIHN5c3RlbVxuICogb3JnIElELiBPdGhlcndpc2UgdGhlIGlucHV0IGlzIHJldHVybmVkIGFzLWlzIChsb3dlcmNhc2VkKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc29sdmVSZWNpcGllbnRBbGlhcyhyZWNpcGllbnRPcmdJZDogc3RyaW5nKTogQWxpYXNSZXNvbHV0aW9uIHtcbiAgY29uc3Qgbm9ybWFsaXplZCA9IHJlY2lwaWVudE9yZ0lkLnRyaW0oKS50b0xvd2VyQ2FzZSgpO1xuICBjb25zdCBhbGlhc2VzID0gZ2V0U3VwcG9ydEFsaWFzZXMoKTtcblxuICBpZiAoYWxpYXNlcy5oYXMobm9ybWFsaXplZCkpIHtcbiAgICByZXR1cm4ge1xuICAgICAgcmVzb2x2ZWRPcmdJZDogU1lTVEVNX09SR19JRCxcbiAgICAgIHdhc0FsaWFzOiB0cnVlLFxuICAgICAgb3JpZ2luYWxWYWx1ZTogcmVjaXBpZW50T3JnSWQsXG4gICAgfTtcbiAgfVxuXG4gIHJldHVybiB7XG4gICAgcmVzb2x2ZWRPcmdJZDogbm9ybWFsaXplZCxcbiAgICB3YXNBbGlhczogZmFsc2UsXG4gICAgb3JpZ2luYWxWYWx1ZTogcmVjaXBpZW50T3JnSWQsXG4gIH07XG59XG5cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxpYXMtcmVzb2x2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvYWxpYXMtcmVzb2x2ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFFdEQseUZBQXlGO0FBQ3pGLElBQUksZUFBd0MsQ0FBQztBQUU3QyxTQUFTLGlCQUFpQjtJQUN4QixJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDckIsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLElBQUksRUFBRSxDQUFDO1FBQzlDLGVBQWUsR0FBRyxJQUFJLEdBQUcsQ0FDdkIsR0FBRzthQUNBLEtBQUssQ0FBQyxHQUFHLENBQUM7YUFDVixHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7YUFDeEMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FDckMsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLGVBQWUsQ0FBQztBQUN6QixDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSx3QkFBd0I7SUFDdEMsZUFBZSxHQUFHLFNBQVMsQ0FBQztBQUM5QixDQUFDO0FBRUQsbUZBQW1GO0FBQ25GLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLDBCQUEwQixDQUFDO0FBRWhFOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQjtJQUNwQyxLQUFLLE1BQU0sS0FBSyxJQUFJLGlCQUFpQixFQUFFO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdEQsT0FBTyxxQkFBcUIsQ0FBQztBQUMvQixDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxvQkFBb0I7SUFDbEMsTUFBTSxHQUFHLEdBQUcsQ0FBQyxHQUFHLGlCQUFpQixFQUFFLENBQUMsQ0FBQztJQUNyQyxPQUFPLEdBQUcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMscUJBQXFCLENBQUMsQ0FBQztBQUN4RCxDQUFDO0FBWUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUMsY0FBc0I7SUFDMUQsTUFBTSxVQUFVLEdBQUcsY0FBYyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ3ZELE1BQU0sT0FBTyxHQUFHLGlCQUFpQixFQUFFLENBQUM7SUFFcEMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDNUIsT0FBTztZQUNMLGFBQWEsRUFBRSxhQUFhO1lBQzVCLFFBQVEsRUFBRSxJQUFJO1lBQ2QsYUFBYSxFQUFFLGNBQWM7U0FDOUIsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPO1FBQ0wsYUFBYSxFQUFFLFVBQVU7UUFDekIsUUFBUSxFQUFFLEtBQUs7UUFDZixhQUFhLEVBQUUsY0FBYztLQUM5QixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBTWVNURU1fT1JHX0lEIH0gZnJvbSAnLi4vbWlkZGxld2FyZS9hdXRoLmpzJztcblxuLyoqIExhemlseS1jYWNoZWQgc2V0IG9mIHN1cHBvcnQgYWxpYXNlcywgcGFyc2VkIGZyb20gU1VQUE9SVF9BTElBU0VTIG9uIGZpcnN0IGFjY2Vzcy4gKi9cbmxldCBfc3VwcG9ydEFsaWFzZXM6IFNldDxzdHJpbmc+IHwgdW5kZWZpbmVkO1xuXG5mdW5jdGlvbiBnZXRTdXBwb3J0QWxpYXNlcygpOiBTZXQ8c3RyaW5nPiB7XG4gIGlmICghX3N1cHBvcnRBbGlhc2VzKSB7XG4gICAgY29uc3QgcmF3ID0gcHJvY2Vzcy5lbnYuU1VQUE9SVF9BTElBU0VTIHx8ICcnO1xuICAgIF9zdXBwb3J0QWxpYXNlcyA9IG5ldyBTZXQoXG4gICAgICByYXdcbiAgICAgICAgLnNwbGl0KCcsJylcbiAgICAgICAgLm1hcChhbGlhcyA9PiBhbGlhcy50cmltKCkudG9Mb3dlckNhc2UoKSlcbiAgICAgICAgLmZpbHRlcihhbGlhcyA9PiBhbGlhcy5sZW5ndGggPiAwKSxcbiAgICApO1xuICB9XG4gIHJldHVybiBfc3VwcG9ydEFsaWFzZXM7XG59XG5cbi8qKlxuICogQ2xlYXIgdGhlIG1lbW9pemVkIGFsaWFzIHNldCBzbyB0aGUgbmV4dCBhY2Nlc3MgcmUtcmVhZHMgYFNVUFBPUlRfQUxJQVNFU2AuXG4gKiBUaGUgY2FjaGUgaXMgcHJvY2Vzcy1saWZldGltZSBieSBkZXNpZ24gKGVudiBpcyBmaXhlZCBwZXIgcHJvY2Vzcyk7IHRoaXMgaG9va1xuICogZXhpc3RzIHNvIHRlc3RzIGNhbiB2YXJ5IHRoZSBlbnYgYmV0d2VlbiBjYXNlcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc2V0U3VwcG9ydEFsaWFzZXNDYWNoZSgpOiB2b2lkIHtcbiAgX3N1cHBvcnRBbGlhc2VzID0gdW5kZWZpbmVkO1xufVxuXG4vKiogV2VsbC1rbm93biBmYWxsYmFjayBzdXBwb3J0IGFsaWFzIHVzZWQgd2hlbiBTVVBQT1JUX0FMSUFTRVMgaXMgdW5jb25maWd1cmVkLiAqL1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfU1VQUE9SVF9BTElBUyA9ICdzdXBwb3J0QHBpcGVsaW5lLWJ1aWxkZXInO1xuXG4vKipcbiAqIFRoZSBQUklNQVJZIChmaXJzdC1jb25maWd1cmVkKSBzdXBwb3J0IGFsaWFzIOKAlCBmb3IgZGlzcGxheSAvIHByZWZpbGwgaW4gVUlzXG4gKiAoZS5nLiB0aGUgY29tcG9zZSBcIlRvXCIgZmllbGQpLCBzbyB0aGUgc2hvd24gdmFsdWUgaXMgZHJpdmVuIGJ5IFNVUFBPUlRfQUxJQVNFU1xuICogcmF0aGVyIHRoYW4gaGFyZGNvZGVkLiBGYWxscyBiYWNrIHRvIHtAbGluayBERUZBVUxUX1NVUFBPUlRfQUxJQVN9IHdoZW4gdGhlIGVudlxuICogaXMgdW5zZXQuIChBbGwgY29uZmlndXJlZCBhbGlhc2VzIHN0aWxsIHJlc29sdmUgdmlhIHtAbGluayByZXNvbHZlUmVjaXBpZW50QWxpYXN9LilcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldFByaW1hcnlTdXBwb3J0QWxpYXMoKTogc3RyaW5nIHtcbiAgZm9yIChjb25zdCBhbGlhcyBvZiBnZXRTdXBwb3J0QWxpYXNlcygpKSByZXR1cm4gYWxpYXM7XG4gIHJldHVybiBERUZBVUxUX1NVUFBPUlRfQUxJQVM7XG59XG5cbi8qKlxuICogQUxMIGNvbmZpZ3VyZWQgc3VwcG9ydCBhbGlhc2VzIChvcmRlciBwcmVzZXJ2ZWQpLCBmb3IgVUlzIHRoYXQgc3VyZmFjZSBldmVyeVxuICogc3VwcG9ydCBpbmJveCBhcyBhIGRpc3RpbmN0IHJlY2lwaWVudCBzdWdnZXN0aW9uLiBGYWxscyBiYWNrIHRvIGEgc2luZ2xlXG4gKiB7QGxpbmsgREVGQVVMVF9TVVBQT1JUX0FMSUFTfSB3aGVuIFNVUFBPUlRfQUxJQVNFUyBpcyB1bnNldC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldEFsbFN1cHBvcnRBbGlhc2VzKCk6IHN0cmluZ1tdIHtcbiAgY29uc3QgYWxsID0gWy4uLmdldFN1cHBvcnRBbGlhc2VzKCldO1xuICByZXR1cm4gYWxsLmxlbmd0aCA+IDAgPyBhbGwgOiBbREVGQVVMVF9TVVBQT1JUX0FMSUFTXTtcbn1cblxuLyoqIFJlc3VsdCBvZiBhbGlhcyByZXNvbHV0aW9uLiAqL1xuZXhwb3J0IGludGVyZmFjZSBBbGlhc1Jlc29sdXRpb24ge1xuICAvKiogVGhlIHJlc29sdmVkIG9yZ2FuaXphdGlvbiBJRCAoZS5nLiwgJ3N5c3RlbScpLiAqL1xuICByZXNvbHZlZE9yZ0lkOiBzdHJpbmc7XG4gIC8qKiBXaGV0aGVyIHRoZSBpbnB1dCB3YXMgYW4gYWxpYXMgdGhhdCBnb3QgcmVzb2x2ZWQuICovXG4gIHdhc0FsaWFzOiBib29sZWFuO1xuICAvKiogVGhlIG9yaWdpbmFsIGlucHV0IHZhbHVlLCB1c2VmdWwgZm9yIGF1ZGl0IGxvZ2dpbmcuICovXG4gIG9yaWdpbmFsVmFsdWU6IHN0cmluZztcbn1cblxuLyoqXG4gKiBSZXNvbHZlIGFuIGVtYWlsLWxpa2UgYWxpYXMgdG8gYW4gYWN0dWFsIG9yZ2FuaXphdGlvbiBJRC5cbiAqXG4gKiBJZiB0aGUgaW5wdXQgbWF0Y2hlcyBhIGNvbmZpZ3VyZWQgc3VwcG9ydCBhbGlhcywgaXQgcmVzb2x2ZXMgdG8gdGhlIHN5c3RlbVxuICogb3JnIElELiBPdGhlcndpc2UgdGhlIGlucHV0IGlzIHJldHVybmVkIGFzLWlzIChsb3dlcmNhc2VkKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc29sdmVSZWNpcGllbnRBbGlhcyhyZWNpcGllbnRPcmdJZDogc3RyaW5nKTogQWxpYXNSZXNvbHV0aW9uIHtcbiAgY29uc3Qgbm9ybWFsaXplZCA9IHJlY2lwaWVudE9yZ0lkLnRyaW0oKS50b0xvd2VyQ2FzZSgpO1xuICBjb25zdCBhbGlhc2VzID0gZ2V0U3VwcG9ydEFsaWFzZXMoKTtcblxuICBpZiAoYWxpYXNlcy5oYXMobm9ybWFsaXplZCkpIHtcbiAgICByZXR1cm4ge1xuICAgICAgcmVzb2x2ZWRPcmdJZDogU1lTVEVNX09SR19JRCxcbiAgICAgIHdhc0FsaWFzOiB0cnVlLFxuICAgICAgb3JpZ2luYWxWYWx1ZTogcmVjaXBpZW50T3JnSWQsXG4gICAgfTtcbiAgfVxuXG4gIHJldHVybiB7XG4gICAgcmVzb2x2ZWRPcmdJZDogbm9ybWFsaXplZCxcbiAgICB3YXNBbGlhczogZmFsc2UsXG4gICAgb3JpZ2luYWxWYWx1ZTogcmVjaXBpZW50T3JnSWQsXG4gIH07XG59XG5cbiJdfQ==

package/lib/utils/compliance-attributes.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Project an entity into the compliance-event `attributes`, redacting secret
+ * VALUES while preserving everything the compliance engine actually evaluates.
+ * Recurses so nested secrets (deep inside a pipeline's `props`) are covered too.
+ */
+export declare function toComplianceAttributes(value: unknown): unknown;

package/lib/utils/compliance-attributes.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Secret-redaction for compliance-event `attributes`.
+ *
+ * Shared by the plugin AND pipeline services (previously a byte-identical copy
+ * in each — a security-critical function that must not drift: a future "also
+ * redact `credentials`" fix has to protect BOTH services). Both feed entity
+ * attributes to the compliance engine over Redis, and neither may leak plaintext
+ * secrets there.
+ *
+ * The compliance rule engine reads secret maps (`env`/`buildArgs`, incl. nested
+ * `props.synth.env`, `props.stages[].steps[].env`, …) ONLY by KEY — `$keys(env)`,
+ * `$count(env)`, dot-path existence, key-`contains` — never by value (see
+ * api/compliance/src/engine/rule-operators.ts + its tests). So we preserve each
+ * secret map's shape + KEYS while overwriting every value with a marker; scalar
+ * secret fields (source `token`, passwords, …) are replaced outright. Structure
+ * and non-secret metadata pass through unchanged, so rule evaluation is
+ * identical while plaintext secrets never reach Redis or the compliance service.
+ */
+/** Marker written in place of a redacted secret VALUE. */
+const REDACTED = '[REDACTED]';
+/** Map keys whose (string→string) VALUES are secret build-time material. */
+const SECRET_MAP_KEYS = new Set(['env', 'buildArgs']);
+/**
+ * Scalar keys that themselves carry a secret string (tokens/passwords/etc.).
+ * Applied only to string values so boolean flags and declaration arrays (e.g.
+ * `secrets: PluginSecret[]`) are left intact.
+ */
+function isSecretScalarKey(key) {
+    const k = key.toLowerCase();
+    return k.includes('token') || k.includes('secret') || k.includes('password')
+        || k.includes('passphrase') || k.includes('credential') || k.includes('apikey')
+        || k.includes('accesskey') || k.includes('privatekey');
+}
+/** Only plain (Object-prototype) objects are traversed — Dates/class instances pass through intact. */
+function isPlainObject(v) {
+    if (v === null || typeof v !== 'object')
+        return false;
+    const proto = Object.getPrototypeOf(v);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Project an entity into the compliance-event `attributes`, redacting secret
+ * VALUES while preserving everything the compliance engine actually evaluates.
+ * Recurses so nested secrets (deep inside a pipeline's `props`) are covered too.
+ */
+export function toComplianceAttributes(value) {
+    if (Array.isArray(value))
+        return value.map(toComplianceAttributes);
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (SECRET_MAP_KEYS.has(k) && isPlainObject(v)) {
+                // Preserve keys (compliance reads $keys/$count/presence), redact values.
+                out[k] = Object.fromEntries(Object.keys(v).map((mk) => [mk, REDACTED]));
+            }
+            else if (isSecretScalarKey(k) && typeof v === 'string') {
+                out[k] = REDACTED;
+            }
+            else {
+                out[k] = toComplianceAttributes(v);
+            }
+        }
+        return out;
+    }
+    return value; // primitives, Date, null — untouched
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1hdHRyaWJ1dGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3V0aWxzL2NvbXBsaWFuY2UtYXR0cmlidXRlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUVILDBEQUEwRDtBQUMxRCxNQUFNLFFBQVEsR0FBRyxZQUFZLENBQUM7QUFFOUIsNEVBQTRFO0FBQzVFLE1BQU0sZUFBZSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFFdEQ7Ozs7R0FJRztBQUNILFNBQVMsaUJBQWlCLENBQUMsR0FBVztJQUNwQyxNQUFNLENBQUMsR0FBRyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDNUIsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDdkUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQzVFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztBQUMzRCxDQUFDO0FBRUQsdUdBQXVHO0FBQ3ZHLFNBQVMsYUFBYSxDQUFDLENBQVU7SUFDL0IsSUFBSSxDQUFDLEtBQUssSUFBSSxJQUFJLE9BQU8sQ0FBQyxLQUFLLFFBQVE7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN0RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3ZDLE9BQU8sS0FBSyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQztBQUN0RCxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FBQyxLQUFjO0lBQ25ELElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsc0JBQXNCLENBQUMsQ0FBQztJQUNuRSxJQUFJLGFBQWEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sR0FBRyxHQUE0QixFQUFFLENBQUM7UUFDeEMsS0FBSyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxJQUFJLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQy9DLHlFQUF5RTtnQkFDekUsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUMxRSxDQUFDO2lCQUFNLElBQUksaUJBQWlCLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ3pELEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxRQUFRLENBQUM7WUFDcEIsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxzQkFBc0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyQyxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sR0FBRyxDQUFDO0lBQ2IsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDLENBQUMscUNBQXFDO0FBQ3JELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBTZWNyZXQtcmVkYWN0aW9uIGZvciBjb21wbGlhbmNlLWV2ZW50IGBhdHRyaWJ1dGVzYC5cbiAqXG4gKiBTaGFyZWQgYnkgdGhlIHBsdWdpbiBBTkQgcGlwZWxpbmUgc2VydmljZXMgKHByZXZpb3VzbHkgYSBieXRlLWlkZW50aWNhbCBjb3B5XG4gKiBpbiBlYWNoIOKAlCBhIHNlY3VyaXR5LWNyaXRpY2FsIGZ1bmN0aW9uIHRoYXQgbXVzdCBub3QgZHJpZnQ6IGEgZnV0dXJlIFwiYWxzb1xuICogcmVkYWN0IGBjcmVkZW50aWFsc2BcIiBmaXggaGFzIHRvIHByb3RlY3QgQk9USCBzZXJ2aWNlcykuIEJvdGggZmVlZCBlbnRpdHlcbiAqIGF0dHJpYnV0ZXMgdG8gdGhlIGNvbXBsaWFuY2UgZW5naW5lIG92ZXIgUmVkaXMsIGFuZCBuZWl0aGVyIG1heSBsZWFrIHBsYWludGV4dFxuICogc2VjcmV0cyB0aGVyZS5cbiAqXG4gKiBUaGUgY29tcGxpYW5jZSBydWxlIGVuZ2luZSByZWFkcyBzZWNyZXQgbWFwcyAoYGVudmAvYGJ1aWxkQXJnc2AsIGluY2wuIG5lc3RlZFxuICogYHByb3BzLnN5bnRoLmVudmAsIGBwcm9wcy5zdGFnZXNbXS5zdGVwc1tdLmVudmAsIOKApikgT05MWSBieSBLRVkg4oCUIGAka2V5cyhlbnYpYCxcbiAqIGAkY291bnQoZW52KWAsIGRvdC1wYXRoIGV4aXN0ZW5jZSwga2V5LWBjb250YWluc2Ag4oCUIG5ldmVyIGJ5IHZhbHVlIChzZWVcbiAqIGFwaS9jb21wbGlhbmNlL3NyYy9lbmdpbmUvcnVsZS1vcGVyYXRvcnMudHMgKyBpdHMgdGVzdHMpLiBTbyB3ZSBwcmVzZXJ2ZSBlYWNoXG4gKiBzZWNyZXQgbWFwJ3Mgc2hhcGUgKyBLRVlTIHdoaWxlIG92ZXJ3cml0aW5nIGV2ZXJ5IHZhbHVlIHdpdGggYSBtYXJrZXI7IHNjYWxhclxuICogc2VjcmV0IGZpZWxkcyAoc291cmNlIGB0b2tlbmAsIHBhc3N3b3Jkcywg4oCmKSBhcmUgcmVwbGFjZWQgb3V0cmlnaHQuIFN0cnVjdHVyZVxuICogYW5kIG5vbi1zZWNyZXQgbWV0YWRhdGEgcGFzcyB0aHJvdWdoIHVuY2hhbmdlZCwgc28gcnVsZSBldmFsdWF0aW9uIGlzXG4gKiBpZGVudGljYWwgd2hpbGUgcGxhaW50ZXh0IHNlY3JldHMgbmV2ZXIgcmVhY2ggUmVkaXMgb3IgdGhlIGNvbXBsaWFuY2Ugc2VydmljZS5cbiAqL1xuXG4vKiogTWFya2VyIHdyaXR0ZW4gaW4gcGxhY2Ugb2YgYSByZWRhY3RlZCBzZWNyZXQgVkFMVUUuICovXG5jb25zdCBSRURBQ1RFRCA9ICdbUkVEQUNURURdJztcblxuLyoqIE1hcCBrZXlzIHdob3NlIChzdHJpbmfihpJzdHJpbmcpIFZBTFVFUyBhcmUgc2VjcmV0IGJ1aWxkLXRpbWUgbWF0ZXJpYWwuICovXG5jb25zdCBTRUNSRVRfTUFQX0tFWVMgPSBuZXcgU2V0KFsnZW52JywgJ2J1aWxkQXJncyddKTtcblxuLyoqXG4gKiBTY2FsYXIga2V5cyB0aGF0IHRoZW1zZWx2ZXMgY2FycnkgYSBzZWNyZXQgc3RyaW5nICh0b2tlbnMvcGFzc3dvcmRzL2V0Yy4pLlxuICogQXBwbGllZCBvbmx5IHRvIHN0cmluZyB2YWx1ZXMgc28gYm9vbGVhbiBmbGFncyBhbmQgZGVjbGFyYXRpb24gYXJyYXlzIChlLmcuXG4gKiBgc2VjcmV0czogUGx1Z2luU2VjcmV0W11gKSBhcmUgbGVmdCBpbnRhY3QuXG4gKi9cbmZ1bmN0aW9uIGlzU2VjcmV0U2NhbGFyS2V5KGtleTogc3RyaW5nKTogYm9vbGVhbiB7XG4gIGNvbnN0IGsgPSBrZXkudG9Mb3dlckNhc2UoKTtcbiAgcmV0dXJuIGsuaW5jbHVkZXMoJ3Rva2VuJykgfHwgay5pbmNsdWRlcygnc2VjcmV0JykgfHwgay5pbmNsdWRlcygncGFzc3dvcmQnKVxuICAgIHx8IGsuaW5jbHVkZXMoJ3Bhc3NwaHJhc2UnKSB8fCBrLmluY2x1ZGVzKCdjcmVkZW50aWFsJykgfHwgay5pbmNsdWRlcygnYXBpa2V5JylcbiAgICB8fCBrLmluY2x1ZGVzKCdhY2Nlc3NrZXknKSB8fCBrLmluY2x1ZGVzKCdwcml2YXRla2V5Jyk7XG59XG5cbi8qKiBPbmx5IHBsYWluIChPYmplY3QtcHJvdG90eXBlKSBvYmplY3RzIGFyZSB0cmF2ZXJzZWQg4oCUIERhdGVzL2NsYXNzIGluc3RhbmNlcyBwYXNzIHRocm91Z2ggaW50YWN0LiAqL1xuZnVuY3Rpb24gaXNQbGFpbk9iamVjdCh2OiB1bmtub3duKTogdiBpcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiB7XG4gIGlmICh2ID09PSBudWxsIHx8IHR5cGVvZiB2ICE9PSAnb2JqZWN0JykgcmV0dXJuIGZhbHNlO1xuICBjb25zdCBwcm90byA9IE9iamVjdC5nZXRQcm90b3R5cGVPZih2KTtcbiAgcmV0dXJuIHByb3RvID09PSBPYmplY3QucHJvdG90eXBlIHx8IHByb3RvID09PSBudWxsO1xufVxuXG4vKipcbiAqIFByb2plY3QgYW4gZW50aXR5IGludG8gdGhlIGNvbXBsaWFuY2UtZXZlbnQgYGF0dHJpYnV0ZXNgLCByZWRhY3Rpbmcgc2VjcmV0XG4gKiBWQUxVRVMgd2hpbGUgcHJlc2VydmluZyBldmVyeXRoaW5nIHRoZSBjb21wbGlhbmNlIGVuZ2luZSBhY3R1YWxseSBldmFsdWF0ZXMuXG4gKiBSZWN1cnNlcyBzbyBuZXN0ZWQgc2VjcmV0cyAoZGVlcCBpbnNpZGUgYSBwaXBlbGluZSdzIGBwcm9wc2ApIGFyZSBjb3ZlcmVkIHRvby5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHRvQ29tcGxpYW5jZUF0dHJpYnV0ZXModmFsdWU6IHVua25vd24pOiB1bmtub3duIHtcbiAgaWYgKEFycmF5LmlzQXJyYXkodmFsdWUpKSByZXR1cm4gdmFsdWUubWFwKHRvQ29tcGxpYW5jZUF0dHJpYnV0ZXMpO1xuICBpZiAoaXNQbGFpbk9iamVjdCh2YWx1ZSkpIHtcbiAgICBjb25zdCBvdXQ6IFJlY29yZDxzdHJpbmcsIHVua25vd24+ID0ge307XG4gICAgZm9yIChjb25zdCBbaywgdl0gb2YgT2JqZWN0LmVudHJpZXModmFsdWUpKSB7XG4gICAgICBpZiAoU0VDUkVUX01BUF9LRVlTLmhhcyhrKSAmJiBpc1BsYWluT2JqZWN0KHYpKSB7XG4gICAgICAgIC8vIFByZXNlcnZlIGtleXMgKGNvbXBsaWFuY2UgcmVhZHMgJGtleXMvJGNvdW50L3ByZXNlbmNlKSwgcmVkYWN0IHZhbHVlcy5cbiAgICAgICAgb3V0W2tdID0gT2JqZWN0LmZyb21FbnRyaWVzKE9iamVjdC5rZXlzKHYpLm1hcCgobWspID0+IFttaywgUkVEQUNURURdKSk7XG4gICAgICB9IGVsc2UgaWYgKGlzU2VjcmV0U2NhbGFyS2V5KGspICYmIHR5cGVvZiB2ID09PSAnc3RyaW5nJykge1xuICAgICAgICBvdXRba10gPSBSRURBQ1RFRDtcbiAgICAgIH0gZWxzZSB7XG4gICAgICAgIG91dFtrXSA9IHRvQ29tcGxpYW5jZUF0dHJpYnV0ZXModik7XG4gICAgICB9XG4gICAgfVxuICAgIHJldHVybiBvdXQ7XG4gIH1cbiAgcmV0dXJuIHZhbHVlOyAvLyBwcmltaXRpdmVzLCBEYXRlLCBudWxsIOKAlCB1bnRvdWNoZWRcbn1cbiJdfQ==

package/lib/utils/env.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Typed environment-variable readers with consistent parsing + defaults.
+ *
+ * Services previously hand-rolled `parseInt(process.env.X || '…', 10)` /
+ * `process.env.X === 'true'` at hundreds of call sites — which drifts (the same
+ * var parsed with different defaults in different packages) and silently returns
+ * the default on a typo'd name. These helpers centralize the parsing so a value
+ * is read the same way everywhere, and make shared constants importable rather
+ * than re-derived (see `MAX_PAGE_LIMIT` / `DEFAULT_PAGE_LIMIT` in
+ * `validation/common-schemas.ts`).
+ */
+/**
+ * Parse an integer env var. Unset / blank / non-numeric → `def`. Optional
+ * `min`/`max` clamp the result (applied after the default).
+ */
+export declare function envInt(name: string, def: number, opts?: {
+    min?: number;
+    max?: number;
+}): number;
+/**
+ * Parse a boolean env var. `true`/`1`/`yes` → true, `false`/`0`/`no` → false
+ * (case-insensitive); unset / blank / unrecognized → `def`.
+ */
+export declare function envBool(name: string, def: boolean): boolean;
+/** Read an env var constrained to `allowed`; unset / not-in-set → `def`. */
+export declare function envEnum<T extends string>(name: string, allowed: readonly T[], def: T): T;
+/** Read a string env var; unset / blank → `def`. */
+export declare function envStr(name: string, def: string): string;

package/lib/utils/env.js

@@ -0,0 +1,54 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Typed environment-variable readers with consistent parsing + defaults.
+ *
+ * Services previously hand-rolled `parseInt(process.env.X || '…', 10)` /
+ * `process.env.X === 'true'` at hundreds of call sites — which drifts (the same
+ * var parsed with different defaults in different packages) and silently returns
+ * the default on a typo'd name. These helpers centralize the parsing so a value
+ * is read the same way everywhere, and make shared constants importable rather
+ * than re-derived (see `MAX_PAGE_LIMIT` / `DEFAULT_PAGE_LIMIT` in
+ * `validation/common-schemas.ts`).
+ */
+/**
+ * Parse an integer env var. Unset / blank / non-numeric → `def`. Optional
+ * `min`/`max` clamp the result (applied after the default).
+ */
+export function envInt(name, def, opts) {
+    const raw = process.env[name];
+    let n = raw === undefined || raw.trim() === '' ? def : Number.parseInt(raw, 10);
+    if (!Number.isFinite(n))
+        n = def;
+    if (opts?.min !== undefined)
+        n = Math.max(opts.min, n);
+    if (opts?.max !== undefined)
+        n = Math.min(opts.max, n);
+    return n;
+}
+/**
+ * Parse a boolean env var. `true`/`1`/`yes` → true, `false`/`0`/`no` → false
+ * (case-insensitive); unset / blank / unrecognized → `def`.
+ */
+export function envBool(name, def) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === '')
+        return def;
+    const v = raw.trim().toLowerCase();
+    if (v === 'true' || v === '1' || v === 'yes')
+        return true;
+    if (v === 'false' || v === '0' || v === 'no')
+        return false;
+    return def;
+}
+/** Read an env var constrained to `allowed`; unset / not-in-set → `def`. */
+export function envEnum(name, allowed, def) {
+    const raw = process.env[name]?.trim();
+    return raw !== undefined && allowed.includes(raw) ? raw : def;
+}
+/** Read a string env var; unset / blank → `def`. */
+export function envStr(name, def) {
+    const raw = process.env[name];
+    return raw === undefined || raw.trim() === '' ? def : raw;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3V0aWxzL2Vudi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDOzs7Ozs7Ozs7O0dBVUc7QUFFSDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsTUFBTSxDQUFDLElBQVksRUFBRSxHQUFXLEVBQUUsSUFBcUM7SUFDckYsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM5QixJQUFJLENBQUMsR0FBRyxHQUFHLEtBQUssU0FBUyxJQUFJLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDaEYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQUUsQ0FBQyxHQUFHLEdBQUcsQ0FBQztJQUNqQyxJQUFJLElBQUksRUFBRSxHQUFHLEtBQUssU0FBUztRQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDdkQsSUFBSSxJQUFJLEVBQUUsR0FBRyxLQUFLLFNBQVM7UUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3ZELE9BQU8sQ0FBQyxDQUFDO0FBQ1gsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxPQUFPLENBQUMsSUFBWSxFQUFFLEdBQVk7SUFDaEQsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM5QixJQUFJLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUU7UUFBRSxPQUFPLEdBQUcsQ0FBQztJQUN2RCxNQUFNLENBQUMsR0FBRyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDbkMsSUFBSSxDQUFDLEtBQUssTUFBTSxJQUFJLENBQUMsS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLEtBQUs7UUFBRSxPQUFPLElBQUksQ0FBQztJQUMxRCxJQUFJLENBQUMsS0FBSyxPQUFPLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssSUFBSTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQzNELE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQUVELDRFQUE0RTtBQUM1RSxNQUFNLFVBQVUsT0FBTyxDQUFtQixJQUFZLEVBQUUsT0FBcUIsRUFBRSxHQUFNO0lBQ25GLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFtQixDQUFDO0lBQ3ZELE9BQU8sR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztBQUNoRSxDQUFDO0FBRUQsb0RBQW9EO0FBQ3BELE1BQU0sVUFBVSxNQUFNLENBQUMsSUFBWSxFQUFFLEdBQVc7SUFDOUMsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM5QixPQUFPLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7QUFDNUQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIFR5cGVkIGVudmlyb25tZW50LXZhcmlhYmxlIHJlYWRlcnMgd2l0aCBjb25zaXN0ZW50IHBhcnNpbmcgKyBkZWZhdWx0cy5cbiAqXG4gKiBTZXJ2aWNlcyBwcmV2aW91c2x5IGhhbmQtcm9sbGVkIGBwYXJzZUludChwcm9jZXNzLmVudi5YIHx8ICfigKYnLCAxMClgIC9cbiAqIGBwcm9jZXNzLmVudi5YID09PSAndHJ1ZSdgIGF0IGh1bmRyZWRzIG9mIGNhbGwgc2l0ZXMg4oCUIHdoaWNoIGRyaWZ0cyAodGhlIHNhbWVcbiAqIHZhciBwYXJzZWQgd2l0aCBkaWZmZXJlbnQgZGVmYXVsdHMgaW4gZGlmZmVyZW50IHBhY2thZ2VzKSBhbmQgc2lsZW50bHkgcmV0dXJuc1xuICogdGhlIGRlZmF1bHQgb24gYSB0eXBvJ2QgbmFtZS4gVGhlc2UgaGVscGVycyBjZW50cmFsaXplIHRoZSBwYXJzaW5nIHNvIGEgdmFsdWVcbiAqIGlzIHJlYWQgdGhlIHNhbWUgd2F5IGV2ZXJ5d2hlcmUsIGFuZCBtYWtlIHNoYXJlZCBjb25zdGFudHMgaW1wb3J0YWJsZSByYXRoZXJcbiAqIHRoYW4gcmUtZGVyaXZlZCAoc2VlIGBNQVhfUEFHRV9MSU1JVGAgLyBgREVGQVVMVF9QQUdFX0xJTUlUYCBpblxuICogYHZhbGlkYXRpb24vY29tbW9uLXNjaGVtYXMudHNgKS5cbiAqL1xuXG4vKipcbiAqIFBhcnNlIGFuIGludGVnZXIgZW52IHZhci4gVW5zZXQgLyBibGFuayAvIG5vbi1udW1lcmljIOKGkiBgZGVmYC4gT3B0aW9uYWxcbiAqIGBtaW5gL2BtYXhgIGNsYW1wIHRoZSByZXN1bHQgKGFwcGxpZWQgYWZ0ZXIgdGhlIGRlZmF1bHQpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZW52SW50KG5hbWU6IHN0cmluZywgZGVmOiBudW1iZXIsIG9wdHM/OiB7IG1pbj86IG51bWJlcjsgbWF4PzogbnVtYmVyIH0pOiBudW1iZXIge1xuICBjb25zdCByYXcgPSBwcm9jZXNzLmVudltuYW1lXTtcbiAgbGV0IG4gPSByYXcgPT09IHVuZGVmaW5lZCB8fCByYXcudHJpbSgpID09PSAnJyA/IGRlZiA6IE51bWJlci5wYXJzZUludChyYXcsIDEwKTtcbiAgaWYgKCFOdW1iZXIuaXNGaW5pdGUobikpIG4gPSBkZWY7XG4gIGlmIChvcHRzPy5taW4gIT09IHVuZGVmaW5lZCkgbiA9IE1hdGgubWF4KG9wdHMubWluLCBuKTtcbiAgaWYgKG9wdHM/Lm1heCAhPT0gdW5kZWZpbmVkKSBuID0gTWF0aC5taW4ob3B0cy5tYXgsIG4pO1xuICByZXR1cm4gbjtcbn1cblxuLyoqXG4gKiBQYXJzZSBhIGJvb2xlYW4gZW52IHZhci4gYHRydWVgL2AxYC9geWVzYCDihpIgdHJ1ZSwgYGZhbHNlYC9gMGAvYG5vYCDihpIgZmFsc2VcbiAqIChjYXNlLWluc2Vuc2l0aXZlKTsgdW5zZXQgLyBibGFuayAvIHVucmVjb2duaXplZCDihpIgYGRlZmAuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBlbnZCb29sKG5hbWU6IHN0cmluZywgZGVmOiBib29sZWFuKTogYm9vbGVhbiB7XG4gIGNvbnN0IHJhdyA9IHByb2Nlc3MuZW52W25hbWVdO1xuICBpZiAocmF3ID09PSB1bmRlZmluZWQgfHwgcmF3LnRyaW0oKSA9PT0gJycpIHJldHVybiBkZWY7XG4gIGNvbnN0IHYgPSByYXcudHJpbSgpLnRvTG93ZXJDYXNlKCk7XG4gIGlmICh2ID09PSAndHJ1ZScgfHwgdiA9PT0gJzEnIHx8IHYgPT09ICd5ZXMnKSByZXR1cm4gdHJ1ZTtcbiAgaWYgKHYgPT09ICdmYWxzZScgfHwgdiA9PT0gJzAnIHx8IHYgPT09ICdubycpIHJldHVybiBmYWxzZTtcbiAgcmV0dXJuIGRlZjtcbn1cblxuLyoqIFJlYWQgYW4gZW52IHZhciBjb25zdHJhaW5lZCB0byBgYWxsb3dlZGA7IHVuc2V0IC8gbm90LWluLXNldCDihpIgYGRlZmAuICovXG5leHBvcnQgZnVuY3Rpb24gZW52RW51bTxUIGV4dGVuZHMgc3RyaW5nPihuYW1lOiBzdHJpbmcsIGFsbG93ZWQ6IHJlYWRvbmx5IFRbXSwgZGVmOiBUKTogVCB7XG4gIGNvbnN0IHJhdyA9IHByb2Nlc3MuZW52W25hbWVdPy50cmltKCkgYXMgVCB8IHVuZGVmaW5lZDtcbiAgcmV0dXJuIHJhdyAhPT0gdW5kZWZpbmVkICYmIGFsbG93ZWQuaW5jbHVkZXMocmF3KSA/IHJhdyA6IGRlZjtcbn1cblxuLyoqIFJlYWQgYSBzdHJpbmcgZW52IHZhcjsgdW5zZXQgLyBibGFuayDihpIgYGRlZmAuICovXG5leHBvcnQgZnVuY3Rpb24gZW52U3RyKG5hbWU6IHN0cmluZywgZGVmOiBzdHJpbmcpOiBzdHJpbmcge1xuICBjb25zdCByYXcgPSBwcm9jZXNzLmVudltuYW1lXTtcbiAgcmV0dXJuIHJhdyA9PT0gdW5kZWZpbmVkIHx8IHJhdy50cmltKCkgPT09ICcnID8gZGVmIDogcmF3O1xufVxuIl19

package/lib/utils/index.d.ts

@@ -13,3 +13,5 @@ export * from './secret-encryption.js';
 export * from './metric-emitter.js';
 export * from './aws-scrub.js';
 export * from './ssrf.js';
+export * from './env.js';
+export * from './compliance-attributes.js';

package/lib/utils/index.js

@@ -15,4 +15,6 @@ export * from './secret-encryption.js';
 export * from './metric-emitter.js';
 export * from './aws-scrub.js';
 export * from './ssrf.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmV4cG9ydCAqIGZyb20gJy4vbG9nZ2VyLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vc2FmZS1yZXF1aXJlLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY3Jhc2gtaGFuZGxlcnMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9yZXNwb25zZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3BhcmFtcy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2hlYWRlcnMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9pZGVudGl0eS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL29iamVjdC5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2FsaWFzLXJlc29sdmVyLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY29uY3VycmVuY3kuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9hdWRpdC5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NlY3JldC1lbmNyeXB0aW9uLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vbWV0cmljLWVtaXR0ZXIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9hd3Mtc2NydWIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zc3JmLmpzJztcbiJdfQ==
+export * from './env.js';
+export * from './compliance-attributes.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsNEJBQTRCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuZXhwb3J0ICogZnJvbSAnLi9sb2dnZXIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zYWZlLXJlcXVpcmUuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9jcmFzaC1oYW5kbGVycy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3Jlc3BvbnNlLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vcGFyYW1zLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vaGVhZGVycy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2lkZW50aXR5LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vb2JqZWN0LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vYWxpYXMtcmVzb2x2ZXIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9jb25jdXJyZW5jeS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2F1ZGl0LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vc2VjcmV0LWVuY3J5cHRpb24uanMnO1xuZXhwb3J0ICogZnJvbSAnLi9tZXRyaWMtZW1pdHRlci5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2F3cy1zY3J1Yi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NzcmYuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9lbnYuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21wbGlhbmNlLWF0dHJpYnV0ZXMuanMnO1xuIl19

package/lib/utils/secret-encryption.d.ts

@@ -36,35 +36,6 @@ export declare class EnvKeyProvider implements KeyProvider {
     constructor(masterKeyOverride?: string);
     deriveKey(orgId: string): Buffer;
 }
-/**
- *  AWS-KMS-backed KeyProvider.
- *
- * Trade-off picked: store ONE master key encrypted under a KMS CMK; on
- * first use, call `kms:Decrypt` to recover the master key bytes; HKDF-
- * derive per-org from it (same as EnvKeyProvider). The process then holds
- * the plaintext master key in memory until restart.
- *
- * PROS: one KMS call per process lifetime (cheap, low p99 impact),
- * the encrypted-master-key blob is safe to commit/log/checkin,
- * KMS audit log records when the master is recovered.
- * CONS: process memory still holds the master key  same posture as
- * EnvKeyProvider once warmed up. For stronger isolation an
- * operator can move to per-record envelope encryption (call
- * GenerateDataKey on every write); that's a follow-on.
- *
- * Operator setup * 1. Create a KMS CMK with key policy allowing the platform service's
- * IAM role kms:Decrypt.
- * 2. Generate a random 32-byte master * head -c 32 /dev/urandom | base64
- * 3. Wrap it with KMS * aws kms encrypt --key-id <KEY_ID> \
- * --plaintext <base64-from-step-2> --output text \
- * --query CiphertextBlob
- * 4. Set on the service * SECRET_ENCRYPTION_KMS_KEY_ID=<KEY_ID>
- * SECRET_ENCRYPTION_KMS_CIPHERTEXT=<base64-output-of-step-3>
- * 5. Pick this provider via `setKeyProvider(new KmsKeyProvider())`.
- *
- * Construct lazily  importing the AWS SDK has a non-trivial cold-start
- * cost so envs that stay on EnvKeyProvider never load it.
- */
 export declare class KmsKeyProvider implements KeyProvider {
     private masterKeyCache;
     private readonly keyId;