@pipeline-builder/api-core 3.4.36 → 3.4.38

package/lib/utils/org-aws-credentials.js

@@ -0,0 +1,159 @@
+"use strict";
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgAwsCredentialsManager = void 0;
+exports.resolveOrgCredentialsOnce = resolveOrgCredentialsOnce;
+exports.withOrgAwsCredentials = withOrgAwsCredentials;
+/**
+ * Per-process manager that resolves and caches per-org credential providers.
+ * One instance per service; share it across handlers.
+ */
+class OrgAwsCredentialsManager {
+    resolver;
+    fallbackOverride;
+    region;
+    endpoint;
+    cache = new Map();
+    inFlight = new Map();
+    /** Lazy default chain. Built once per manager so we don't import the
+     *  credential-providers SDK in test environments that never touch the
+     *  fallback path. */
+    fallbackCache;
+    constructor(opts) {
+        this.resolver = opts.resolver;
+        this.fallbackOverride = opts.fallback;
+        this.region = opts.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+        this.endpoint = opts.endpoint ?? process.env.AWS_STS_ENDPOINT;
+    }
+    /**
+     * Return an AwsCredentialIdentityProvider scoped to `orgId`. Pass the
+     * returned value into any SDK v3 client's `credentials` option.
+     *
+     * Concurrent first-touch callers share one resolver invocation; later
+     * calls hit the cache. The provider itself caches and refreshes
+     * AssumeRole-derived credentials internally.
+     */
+    async getCredentials(orgId) {
+        if (!orgId)
+            throw new Error('OrgAwsCredentialsManager.getCredentials requires a non-empty orgId');
+        const cached = this.cache.get(orgId);
+        if (cached)
+            return cached.provider;
+        let pending = this.inFlight.get(orgId);
+        if (!pending) {
+            pending = this.resolveAndBuild(orgId);
+            this.inFlight.set(orgId, pending);
+            void pending.finally(() => {
+                if (this.inFlight.get(orgId) === pending)
+                    this.inFlight.delete(orgId);
+            });
+        }
+        return pending;
+    }
+    /** Drop the cached provider for an org. Call after the operator rotates
+     *  the role ARN or external id so the next request rebuilds. */
+    evict(orgId) {
+        this.cache.delete(orgId);
+    }
+    /** Drop every cached provider. Useful in tests; rarely in production. */
+    evictAll() {
+        this.cache.clear();
+    }
+    async resolveAndBuild(orgId) {
+        const cfg = await this.resolver(orgId);
+        if (!cfg || !cfg.assumeRoleArn) {
+            const fallback = await this.getFallback();
+            this.cache.set(orgId, { fingerprint: 'fallback', provider: fallback });
+            return fallback;
+        }
+        const provider = await this.buildAssumeRoleProvider(orgId, cfg);
+        this.cache.set(orgId, { fingerprint: fingerprintConfig(cfg), provider });
+        return provider;
+    }
+    async getFallback() {
+        if (this.fallbackOverride)
+            return this.fallbackOverride;
+        if (this.fallbackCache)
+            return this.fallbackCache;
+        // Lazy-import so test envs that supply their own resolver/fallback
+        // don't load the credential-providers SDK.
+        const { fromNodeProviderChain } = await import('@aws-sdk/credential-providers');
+        this.fallbackCache = fromNodeProviderChain();
+        return this.fallbackCache;
+    }
+    async buildAssumeRoleProvider(orgId, cfg) {
+        // Dynamic imports — STS + credential-providers are heavyweight and
+        // services that never have per-org roles configured shouldn't load them.
+        const [{ STSClient }, { fromTemporaryCredentials }] = await Promise.all([
+            import('@aws-sdk/client-sts'),
+            import('@aws-sdk/credential-providers'),
+        ]);
+        const masterCredentials = this.fallbackOverride ?? (await this.getFallback());
+        const sessionName = cfg.roleSessionName ?? `pipeline-builder-${orgId}`.slice(0, 64);
+        const region = cfg.region ?? this.region;
+        return fromTemporaryCredentials({
+            // Inner STS client uses the service's own credentials (the fallback
+            // chain). Those creds need `sts:AssumeRole` on the org's role.
+            masterCredentials,
+            clientConfig: {
+                region,
+                ...(this.endpoint ? { endpoint: this.endpoint } : {}),
+                // Cast to satisfy fromTemporaryCredentials' typing; STSClient
+                // matches the structural client shape it expects.
+            },
+            params: {
+                RoleArn: cfg.assumeRoleArn,
+                RoleSessionName: sessionName,
+                DurationSeconds: cfg.sessionDurationSeconds ?? 3600,
+                ...(cfg.externalId ? { ExternalId: cfg.externalId } : {}),
+            },
+        });
+    }
+}
+exports.OrgAwsCredentialsManager = OrgAwsCredentialsManager;
+/**
+ * Deterministic fingerprint of a config. Used by `getCredentials` to
+ * detect "the cache is stale because the operator changed the config" —
+ * not exposed publicly, just defense in depth against a missed `evict`.
+ */
+function fingerprintConfig(cfg) {
+    return [
+        cfg.assumeRoleArn,
+        cfg.externalId ?? '',
+        cfg.region ?? '',
+        cfg.sessionDurationSeconds ?? '',
+        cfg.roleSessionName ?? '',
+    ].join('|');
+}
+/** Convenience: directly resolve credentials for a single call. The manager
+ *  doesn't cache when called this way — useful in CLIs / one-shot scripts. */
+async function resolveOrgCredentialsOnce(orgId, resolver) {
+    const manager = new OrgAwsCredentialsManager({ resolver });
+    const provider = await manager.getCredentials(orgId);
+    return provider();
+}
+/**
+ * Adapter: resolve per-org credentials and construct an AWS SDK client
+ * pre-bound to them. The factory is async because credential resolution may
+ * need to make a network call (fetching org config + AssumeRole). Once
+ * resolved, the returned client is ready for normal SDK calls; the provider
+ * inside refreshes credentials automatically before they expire.
+ *
+ * Typical usage:
+ *   ```ts
+ *   const s3 = await withOrgAwsCredentials(manager, orgId, (creds) =>
+ *     new S3Client({ credentials: creds, region: 'us-west-2' }));
+ *   await s3.send(new ListObjectsV2Command({ Bucket: bucketFor(orgId) }));
+ *   ```
+ *
+ * The factory is invoked exactly once per call — callers that need a
+ * long-lived client should cache the result themselves rather than rebuilding
+ * on every operation. (Re-resolving on every op is fine for cold paths and
+ * a wasted couple of object allocations on hot paths.)
+ */
+async function withOrgAwsCredentials(manager, orgId, factory) {
+    const credentials = await manager.getCredentials(orgId);
+    return factory(credentials);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3JnLWF3cy1jcmVkZW50aWFscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9vcmctYXdzLWNyZWRlbnRpYWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDOzs7QUFxUHRDLDhEQU9DO0FBcUJELHNEQU9DO0FBdktEOzs7R0FHRztBQUNILE1BQWEsd0JBQXdCO0lBQ2xCLFFBQVEsQ0FBdUI7SUFDL0IsZ0JBQWdCLENBQWlDO0lBQ2pELE1BQU0sQ0FBVTtJQUNoQixRQUFRLENBQVU7SUFDbEIsS0FBSyxHQUFHLElBQUksR0FBRyxFQUFzQixDQUFDO0lBQ3RDLFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBa0QsQ0FBQztJQUN0Rjs7eUJBRXFCO0lBQ2IsYUFBYSxDQUFpQztJQUV0RCxZQUFZLElBQXFDO1FBQy9DLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQztRQUM5QixJQUFJLENBQUMsZ0JBQWdCLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQztRQUN0QyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQztRQUN0RixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQztJQUNoRSxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNILEtBQUssQ0FBQyxjQUFjLENBQUMsS0FBYTtRQUNoQyxJQUFJLENBQUMsS0FBSztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUVsRyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyQyxJQUFJLE1BQU07WUFBRSxPQUFPLE1BQU0sQ0FBQyxRQUFRLENBQUM7UUFFbkMsSUFBSSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsT0FBTyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDdEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQ2xDLEtBQUssT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7Z0JBQ3hCLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssT0FBTztvQkFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN4RSxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQ7b0VBQ2dFO0lBQ2hFLEtBQUssQ0FBQyxLQUFhO1FBQ2pCLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFFRCx5RUFBeUU7SUFDekUsUUFBUTtRQUNOLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDckIsQ0FBQztJQUVPLEtBQUssQ0FBQyxlQUFlLENBQUMsS0FBYTtRQUN6QyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUMvQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUMxQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsRUFBRSxXQUFXLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZFLE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFFRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDekUsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUVPLEtBQUssQ0FBQyxXQUFXO1FBQ3ZCLElBQUksSUFBSSxDQUFDLGdCQUFnQjtZQUFFLE9BQU8sSUFBSSxDQUFDLGdCQUFnQixDQUFDO1FBQ3hELElBQUksSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDbEQsbUVBQW1FO1FBQ25FLDJDQUEyQztRQUMzQyxNQUFNLEVBQUUscUJBQXFCLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxhQUFhLEdBQUcscUJBQXFCLEVBQUUsQ0FBQztRQUM3QyxPQUFPLElBQUksQ0FBQyxhQUFhLENBQUM7SUFDNUIsQ0FBQztJQUVPLEtBQUssQ0FBQyx1QkFBdUIsQ0FBQyxLQUFhLEVBQUUsR0FBaUI7UUFDcEUsbUVBQW1FO1FBQ25FLHlFQUF5RTtRQUN6RSxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLHdCQUF3QixFQUFFLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7WUFDdEUsTUFBTSxDQUFDLHFCQUFxQixDQUFDO1lBQzdCLE1BQU0sQ0FBQywrQkFBK0IsQ0FBQztTQUN4QyxDQUFDLENBQUM7UUFFSCxNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFFOUUsTUFBTSxXQUFXLEdBQUcsR0FBRyxDQUFDLGVBQWUsSUFBSSxvQkFBb0IsS0FBSyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNwRixNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUM7UUFFekMsT0FBTyx3QkFBd0IsQ0FBQztZQUM5QixvRUFBb0U7WUFDcEUsK0RBQStEO1lBQy9ELGlCQUFpQjtZQUNqQixZQUFZLEVBQUU7Z0JBQ1osTUFBTTtnQkFDTixHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3JELDhEQUE4RDtnQkFDOUQsa0RBQWtEO2FBQ007WUFDMUQsTUFBTSxFQUFFO2dCQUNOLE9BQU8sRUFBRSxHQUFHLENBQUMsYUFBYTtnQkFDMUIsZUFBZSxFQUFFLFdBQVc7Z0JBQzVCLGVBQWUsRUFBRSxHQUFHLENBQUMsc0JBQXNCLElBQUksSUFBSTtnQkFDbkQsR0FBRyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzFEO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBN0dELDREQTZHQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFTLGlCQUFpQixDQUFDLEdBQWlCO0lBQzFDLE9BQU87UUFDTCxHQUFHLENBQUMsYUFBYTtRQUNqQixHQUFHLENBQUMsVUFBVSxJQUFJLEVBQUU7UUFDcEIsR0FBRyxDQUFDLE1BQU0sSUFBSSxFQUFFO1FBQ2hCLEdBQUcsQ0FBQyxzQkFBc0IsSUFBSSxFQUFFO1FBQ2hDLEdBQUcsQ0FBQyxlQUFlLElBQUksRUFBRTtLQUMxQixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNkLENBQUM7QUFFRDs4RUFDOEU7QUFDdkUsS0FBSyxVQUFVLHlCQUF5QixDQUM3QyxLQUFhLEVBQ2IsUUFBOEI7SUFFOUIsTUFBTSxPQUFPLEdBQUcsSUFBSSx3QkFBd0IsQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDM0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JELE9BQU8sUUFBUSxFQUFFLENBQUM7QUFDcEIsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSSxLQUFLLFVBQVUscUJBQXFCLENBQ3pDLE9BQWlDLEVBQ2pDLEtBQWEsRUFDYixPQUFnRTtJQUVoRSxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEQsT0FBTyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7QUFDOUIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIFBlci1vcmcgSUFNIHJvbGUgYXNzdW1wdGlvbiBmb3IgYnVpbGQgLyBydW50aW1lIEFXUyBBUEkgY2FsbHMuXG4gKlxuICogVGhlIHNoYXJlZCBwb3N0dXJlIGZvciBBV1MgY2FsbHMgdG9kYXkgaXMgXCJ0aGUgc2VydmljZSdzIElBTSByb2xlLCBmdWxsXG4gKiBibGFzdCByYWRpdXMgYWNyb3NzIGV2ZXJ5IG9yZy5cIiBUaGUgb3BlcmF0b3Itc2lkZSBtaXRpZ2F0aW9uIG9wZXJhdG9yc1xuICogYWN0dWFsbHkgd2FudCBpczogZWFjaCBjdXN0b21lciBvcmcgZ2V0cyBpdHMgb3duIElBTSByb2xlIGluIGl0cyBvd25cbiAqIGFjY291bnQ7IGJ1aWxkL3J1bnRpbWUgQVdTIGNhbGxzIGZvciB0aGF0IG9yZyBgc3RzOkFzc3VtZVJvbGVgIGludG8gdGhlXG4gKiBjdXN0b21lcidzIHJvbGU7IGEgY29tcHJvbWlzZSBvZiBvbmUgb3JnJ3Mgcm9sZSBjYW4ndCBlbnVtZXJhdGUgYW5vdGhlclxuICogb3JnJ3MgUzMgYnVja2V0cyAvIEVDUiByZXBvcy5cbiAqXG4gKiBUaGlzIG1vZHVsZSBpcyB0aGUgY3JlZGVudGlhbC1wcm92aWRlciBwcmltaXRpdmUuIEl0J3MgcGx1Z2dhYmxlIG9uIHRoZVxuICogb3JnLWNvbmZpZyByZXNvbHZlciBzbyB0aGUgc2FtZSBjb2RlIHBhdGggd29ya3Mgd2hldGhlciBjb25maWcgaXMgcmVhZFxuICogZnJvbSBNb25nbywgUG9zdGdyZXMsIG9yIGVudiB2YXJzLiBDYWxsZXJzIHJlY2VpdmUgYSBzdGFuZGFyZCBTREsgdjNcbiAqIGBBd3NDcmVkZW50aWFsSWRlbnRpdHlQcm92aWRlcmAgYW5kIHBhc3MgaXQgdG8gYW55IFNESyBjbGllbnRcbiAqIChgbmV3IENvZGVCdWlsZENsaWVudCh7IGNyZWRlbnRpYWxzIH0pYCwgZXRjLikuXG4gKlxuICogTm8gZ2xvYmFsIHN0YXRlIOKAlCBjYWxsZXJzIGNvbnN0cnVjdCBvbmUgYE9yZ0F3c0NyZWRlbnRpYWxzTWFuYWdlcmAgcGVyXG4gKiBwcm9jZXNzIGFuZCBgYXdhaXQgbWFuYWdlci5nZXRDcmVkZW50aWFscyhvcmdJZClgIGJlZm9yZSBlYWNoIEFXUyBjYWxsLlxuICogVGhlIHJldHVybmVkIHByb3ZpZGVyIGhhbmRsZXMgY3JlZGVudGlhbCByZWZyZXNoIGludGVybmFsbHkgKHRoZVxuICogdW5kZXJseWluZyBgZnJvbVRlbXBvcmFyeUNyZWRlbnRpYWxzYCByZS1jYWxscyBBc3N1bWVSb2xlIH41IG1pbiBiZWZvcmVcbiAqIHRoZSB0ZW1wb3JhcnkgY3JlZGVudGlhbHMgZXhwaXJlKSwgc28gY2FsbCBzaXRlcyBkb24ndCBtYW5hZ2UgVFRMLlxuICpcbiAqIFNhZmV0eSBwcm9wZXJ0aWVzOlxuICogIC0gYGV4dGVybmFsSWRgIGlzIHBsdW1iZWQgdGhyb3VnaCB0byBBc3N1bWVSb2xlLiBPcGVyYXRvcnMgYmFrZSB0aGlzXG4gKiAgICBpbnRvIHRoZSBJQU0gdHJ1c3QgcG9saWN5IGFzIHRoZSBcImNvbmZ1c2VkIGRlcHV0eVwiIG1pdGlnYXRpb247IHRoaXNcbiAqICAgIG1vZHVsZSBuZXZlciBzaWxlbnRseSBvbWl0cyBpdC5cbiAqICAtIE9yZ3Mgd2l0aG91dCBhIGNvbmZpZ3VyZWQgcm9sZSBmYWxsIHRocm91Z2ggdG8gdGhlIHN1cHBsaWVkXG4gKiAgICBgZmFsbGJhY2tgIHByb3ZpZGVyICh0eXBpY2FsbHkgdGhlIFNESyBkZWZhdWx0IGNoYWluKS4gTWl4ZWQtbW9kZVxuICogICAgZGVwbG95bWVudHMgd2hlcmUgc29tZSBvcmdzIGhhdmUgcGVyLW9yZyByb2xlcyBhbmQgb3RoZXJzIHVzZSB0aGVcbiAqICAgIHNoYXJlZCByb2xlIGFyZSBleHBsaWNpdGx5IHN1cHBvcnRlZC5cbiAqICAtIGBldmljdChvcmdJZClgIGRyb3BzIHRoZSBjYWNoZWQgcHJvdmlkZXIgc28gdGhlIG5leHQgY2FsbCByZS1yZXNvbHZlc1xuICogICAgZnJvbSB0aGUgcmVzb2x2ZXIg4oCUIHVzZSBhZnRlciB0aGUgb3BlcmF0b3IgY2hhbmdlcyBhbiBvcmcncyByb2xlLlxuICpcbiAqIEludGVncmF0aW9uIHBhdHRlcm4gZm9yIEFXUyBTREsgY2xpZW50czpcbiAqXG4gKiAgIGBgYHRzXG4gKiAgIGltcG9ydCB7IFMzQ2xpZW50IH0gZnJvbSAnQGF3cy1zZGsvY2xpZW50LXMzJztcbiAqICAgaW1wb3J0IHsgd2l0aE9yZ0F3c0NyZWRlbnRpYWxzIH0gZnJvbSAnQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmUnO1xuICpcbiAqICAgY29uc3QgbWFuYWdlciA9IG5ldyBPcmdBd3NDcmVkZW50aWFsc01hbmFnZXIoeyByZXNvbHZlciB9KTtcbiAqXG4gKiAgIGFzeW5jIGZ1bmN0aW9uIHMzRm9yT3JnKG9yZ0lkOiBzdHJpbmcpIHtcbiAqICAgICByZXR1cm4gd2l0aE9yZ0F3c0NyZWRlbnRpYWxzKG1hbmFnZXIsIG9yZ0lkLCAoY3JlZHMpID0+XG4gKiAgICAgICBuZXcgUzNDbGllbnQoeyBjcmVkZW50aWFsczogY3JlZHMsIHJlZ2lvbjogJ3VzLXdlc3QtMicgfSkpO1xuICogICB9XG4gKiAgIGBgYFxuICpcbiAqIFRvZGF5J3MgY29kZWJhc2U6IG5vIHBsYXRmb3JtLXNpZGUgc2VydmljZSBtYWtlcyBBV1MgQVBJIGNhbGxzIHNjb3BlZCB0b1xuICogYSBjdXN0b21lciBvcmcgKGJ1aWxkIHJ1bm5lcnMgdXNlIGJ1aWxka2l0ZDsgQVdTIExhbWJkYSBoYW5kbGVycyBydW4gaW5cbiAqIGN1c3RvbWVyIHRlcnJpdG9yeSB3aXRoIHRoZWlyIG93biBJQU0pLiBUaGlzIHByaW1pdGl2ZSBpcyBpbiBwbGFjZSBmb3JcbiAqIHdoZW4gdGhlIGFyY2hpdGVjdHVyZSBncm93cyB0byBhZGQgc3VjaCBjYWxsIHNpdGVzIOKAlCBwZXItb3JnIFMzIGJ1Y2tldHMsXG4gKiBwZXItb3JnIEVDUiByZXBvcywgcGVyLW9yZyBDb2RlQnVpbGQgcHJvamVjdHMg4oCUIHdpdGhvdXQgZm9yY2luZyBhblxuICogaW5zZWN1cmUgZGVmYXVsdC5cbiAqL1xuXG4vKiogU3RydWN0dXJhbCBzaGFwZSBvZiBhbiBBV1MgY3JlZGVudGlhbC4gTWF0Y2hlcyBgQHNtaXRoeS90eXBlcyNBd3NDcmVkZW50aWFsSWRlbnRpdHlgXG4gKiAgZXhhY3RseSDigJQgZGVmaW5lZCBsb2NhbGx5IHNvIGFwaS1jb3JlIGRvZXNuJ3QgbmVlZCB0byBkZWNsYXJlIEBzbWl0aHkvdHlwZXNcbiAqICBhcyBhIGRpcmVjdCBkZXAgKGl0J3MgYSB0cmFuc2l0aXZlIG9mIGV2ZXJ5IEFXUyBTREsgY2xpZW50IHdlIHVzZSkuICovXG5leHBvcnQgaW50ZXJmYWNlIEF3c0NyZWRlbnRpYWxJZGVudGl0eSB7XG4gIGFjY2Vzc0tleUlkOiBzdHJpbmc7XG4gIHNlY3JldEFjY2Vzc0tleTogc3RyaW5nO1xuICBzZXNzaW9uVG9rZW4/OiBzdHJpbmc7XG4gIGV4cGlyYXRpb24/OiBEYXRlO1xuICBjcmVkZW50aWFsU2NvcGU/OiBzdHJpbmc7XG4gIGFjY291bnRJZD86IHN0cmluZztcbn1cblxuLyoqIFN0YW5kYXJkIGNyZWRlbnRpYWwtcHJvdmlkZXIgY2FsbGFibGUuIE1hdGNoZXMgYEBzbWl0aHkvdHlwZXMjQXdzQ3JlZGVudGlhbElkZW50aXR5UHJvdmlkZXJgLiAqL1xuZXhwb3J0IHR5cGUgQXdzQ3JlZGVudGlhbElkZW50aXR5UHJvdmlkZXIgPSAoKSA9PiBQcm9taXNlPEF3c0NyZWRlbnRpYWxJZGVudGl0eT47XG5cbi8qKiBPcGVyYXRvci1zdXBwbGllZCBwZXItb3JnIElBTSByb2xlICsgcmVnaW9uIHBpbm5pbmcuICovXG5leHBvcnQgaW50ZXJmYWNlIE9yZ0F3c0NvbmZpZyB7XG4gIC8qKiBBUk4gb2YgdGhlIHJvbGUgdGhpcyBvcmcncyBidWlsZC9ydW50aW1lIGNvZGUgc2hvdWxkIGFzc3VtZS4gKi9cbiAgYXNzdW1lUm9sZUFybjogc3RyaW5nO1xuICAvKiogRXh0ZXJuYWwgaWQgYmFrZWQgaW50byB0aGUgcm9sZSdzIHRydXN0IHBvbGljeSAocmVjb21tZW5kZWQpLiAqL1xuICBleHRlcm5hbElkPzogc3RyaW5nO1xuICAvKiogUmVnaW9uIHRvIHVzZSB3aGVuIHRoZSBjYWxsaW5nIGNvZGUgZG9lc24ndCBwaW4gb25lLiAqL1xuICByZWdpb24/OiBzdHJpbmc7XG4gIC8qKiBBc3N1bWVSb2xlIHNlc3Npb24gZHVyYXRpb24gKHNlY29uZHMpLiBBV1MgYWxsb3dzIDkwMC00MzIwMDsgdGhlXG4gICAqICBlZmZlY3RpdmUgY2VpbGluZyBpcyB0aGUgcm9sZSdzIGBNYXhTZXNzaW9uRHVyYXRpb25gLiBEZWZhdWx0IDM2MDAuICovXG4gIHNlc3Npb25EdXJhdGlvblNlY29uZHM/OiBudW1iZXI7XG4gIC8qKiBTZXNzaW9uIG5hbWUgZW1iZWRkZWQgaW4gQ2xvdWRUcmFpbC4gVXNlZnVsIGZvciBpbmNpZGVudC1yZXNwb25zZVxuICAgKiAgYXR0cmlidXRpb24uIERlZmF1bHQgYHBpcGVsaW5lLWJ1aWxkZXItPG9yZ0lkPmAuICovXG4gIHJvbGVTZXNzaW9uTmFtZT86IHN0cmluZztcbn1cblxuLyoqIEFzeW5jIHJlc29sdmVyOiBvcmdJZCDihpIgY29uZmlnIHwgbnVsbC4gUmV0dXJuaW5nIG51bGwgbWVhbnMgXCJ0aGlzIG9yZ1xuICogIGhhcyBubyBwZXItb3JnIHJvbGU7IHVzZSB0aGUgZmFsbGJhY2sgcHJvdmlkZXIuXCIgKi9cbmV4cG9ydCB0eXBlIE9yZ0F3c0NvbmZpZ1Jlc29sdmVyID0gKG9yZ0lkOiBzdHJpbmcpID0+IFByb21pc2U8T3JnQXdzQ29uZmlnIHwgbnVsbD47XG5cbi8qKiBDb25zdHJ1Y3RvciBvcHRpb25zLiAqL1xuZXhwb3J0IGludGVyZmFjZSBPcmdBd3NDcmVkZW50aWFsc01hbmFnZXJPcHRpb25zIHtcbiAgcmVzb2x2ZXI6IE9yZ0F3c0NvbmZpZ1Jlc29sdmVyO1xuICAvKiogUHJvdmlkZXIgdXNlZCBmb3Igb3JncyB3aG9zZSByZXNvbHZlciByZXR1cm5zIG51bGwuIERlZmF1bHQ6IHRoZSBTREtcbiAgICogIGRlZmF1bHQgY2hhaW4gdmlhIGBAYXdzLXNkay9jcmVkZW50aWFsLXByb3ZpZGVycyNmcm9tTm9kZVByb3ZpZGVyQ2hhaW5gLiAqL1xuICBmYWxsYmFjaz86IEF3c0NyZWRlbnRpYWxJZGVudGl0eVByb3ZpZGVyO1xuICAvKiogUmVnaW9uIHBhc3NlZCB0byB0aGUgaW5uZXIgU1RTIGNsaWVudCB3aGVuIHRoZSBvcmcgY29uZmlnIGRvZXNuJ3RcbiAgICogIHBpbiBvbmUuIERlZmF1bHQ6IGBBV1NfUkVHSU9OYCAvIGBBV1NfREVGQVVMVF9SRUdJT05gIGVudi4gKi9cbiAgcmVnaW9uPzogc3RyaW5nO1xuICAvKiogU1RTIGVuZHBvaW50IG92ZXJyaWRlIChMb2NhbFN0YWNrLCBWUEMgZW5kcG9pbnQpLiBEZWZhdWx0OiBTREsgZGVmYXVsdC4gKi9cbiAgZW5kcG9pbnQ/OiBzdHJpbmc7XG59XG5cbmludGVyZmFjZSBDYWNoZUVudHJ5IHtcbiAgLyoqIFN0YWJsZSBpZGVudGl0eSBvZiB0aGUgY29uZmlnIHdlIGJ1aWx0IHRoaXMgZW50cnkgZnJvbS4gTGV0cyBgZ2V0YFxuICAgKiAgZGV0ZWN0IHRoYXQgdGhlIG9wZXJhdG9yIGNoYW5nZWQgdGhlIGNvbmZpZyBhbmQgd2Ugc2hvdWxkIHJlLWJ1aWxkXG4gICAqICByYXRoZXIgdGhhbiBzZXJ2ZSBhIHN0YWxlIHByb3ZpZGVyLiAqL1xuICBmaW5nZXJwcmludDogc3RyaW5nO1xuICBwcm92aWRlcjogQXdzQ3JlZGVudGlhbElkZW50aXR5UHJvdmlkZXI7XG59XG5cbi8qKlxuICogUGVyLXByb2Nlc3MgbWFuYWdlciB0aGF0IHJlc29sdmVzIGFuZCBjYWNoZXMgcGVyLW9yZyBjcmVkZW50aWFsIHByb3ZpZGVycy5cbiAqIE9uZSBpbnN0YW5jZSBwZXIgc2VydmljZTsgc2hhcmUgaXQgYWNyb3NzIGhhbmRsZXJzLlxuICovXG5leHBvcnQgY2xhc3MgT3JnQXdzQ3JlZGVudGlhbHNNYW5hZ2VyIHtcbiAgcHJpdmF0ZSByZWFkb25seSByZXNvbHZlcjogT3JnQXdzQ29uZmlnUmVzb2x2ZXI7XG4gIHByaXZhdGUgcmVhZG9ubHkgZmFsbGJhY2tPdmVycmlkZT86IEF3c0NyZWRlbnRpYWxJZGVudGl0eVByb3ZpZGVyO1xuICBwcml2YXRlIHJlYWRvbmx5IHJlZ2lvbj86IHN0cmluZztcbiAgcHJpdmF0ZSByZWFkb25seSBlbmRwb2ludD86IHN0cmluZztcbiAgcHJpdmF0ZSByZWFkb25seSBjYWNoZSA9IG5ldyBNYXA8c3RyaW5nLCBDYWNoZUVudHJ5PigpO1xuICBwcml2YXRlIHJlYWRvbmx5IGluRmxpZ2h0ID0gbmV3IE1hcDxzdHJpbmcsIFByb21pc2U8QXdzQ3JlZGVudGlhbElkZW50aXR5UHJvdmlkZXI+PigpO1xuICAvKiogTGF6eSBkZWZhdWx0IGNoYWluLiBCdWlsdCBvbmNlIHBlciBtYW5hZ2VyIHNvIHdlIGRvbid0IGltcG9ydCB0aGVcbiAgICogIGNyZWRlbnRpYWwtcHJvdmlkZXJzIFNESyBpbiB0ZXN0IGVudmlyb25tZW50cyB0aGF0IG5ldmVyIHRvdWNoIHRoZVxuICAgKiAgZmFsbGJhY2sgcGF0aC4gKi9cbiAgcHJpdmF0ZSBmYWxsYmFja0NhY2hlPzogQXdzQ3JlZGVudGlhbElkZW50aXR5UHJvdmlkZXI7XG5cbiAgY29uc3RydWN0b3Iob3B0czogT3JnQXdzQ3JlZGVudGlhbHNNYW5hZ2VyT3B0aW9ucykge1xuICAgIHRoaXMucmVzb2x2ZXIgPSBvcHRzLnJlc29sdmVyO1xuICAgIHRoaXMuZmFsbGJhY2tPdmVycmlkZSA9IG9wdHMuZmFsbGJhY2s7XG4gICAgdGhpcy5yZWdpb24gPSBvcHRzLnJlZ2lvbiA/PyBwcm9jZXNzLmVudi5BV1NfUkVHSU9OID8/IHByb2Nlc3MuZW52LkFXU19ERUZBVUxUX1JFR0lPTjtcbiAgICB0aGlzLmVuZHBvaW50ID0gb3B0cy5lbmRwb2ludCA/PyBwcm9jZXNzLmVudi5BV1NfU1RTX0VORFBPSU5UO1xuICB9XG5cbiAgLyoqXG4gICAqIFJldHVybiBhbiBBd3NDcmVkZW50aWFsSWRlbnRpdHlQcm92aWRlciBzY29wZWQgdG8gYG9yZ0lkYC4gUGFzcyB0aGVcbiAgICogcmV0dXJuZWQgdmFsdWUgaW50byBhbnkgU0RLIHYzIGNsaWVudCdzIGBjcmVkZW50aWFsc2Agb3B0aW9uLlxuICAgKlxuICAgKiBDb25jdXJyZW50IGZpcnN0LXRvdWNoIGNhbGxlcnMgc2hhcmUgb25lIHJlc29sdmVyIGludm9jYXRpb247IGxhdGVyXG4gICAqIGNhbGxzIGhpdCB0aGUgY2FjaGUuIFRoZSBwcm92aWRlciBpdHNlbGYgY2FjaGVzIGFuZCByZWZyZXNoZXNcbiAgICogQXNzdW1lUm9sZS1kZXJpdmVkIGNyZWRlbnRpYWxzIGludGVybmFsbHkuXG4gICAqL1xuICBhc3luYyBnZXRDcmVkZW50aWFscyhvcmdJZDogc3RyaW5nKTogUHJvbWlzZTxBd3NDcmVkZW50aWFsSWRlbnRpdHlQcm92aWRlcj4ge1xuICAgIGlmICghb3JnSWQpIHRocm93IG5ldyBFcnJvcignT3JnQXdzQ3JlZGVudGlhbHNNYW5hZ2VyLmdldENyZWRlbnRpYWxzIHJlcXVpcmVzIGEgbm9uLWVtcHR5IG9yZ0lkJyk7XG5cbiAgICBjb25zdCBjYWNoZWQgPSB0aGlzLmNhY2hlLmdldChvcmdJZCk7XG4gICAgaWYgKGNhY2hlZCkgcmV0dXJuIGNhY2hlZC5wcm92aWRlcjtcblxuICAgIGxldCBwZW5kaW5nID0gdGhpcy5pbkZsaWdodC5nZXQob3JnSWQpO1xuICAgIGlmICghcGVuZGluZykge1xuICAgICAgcGVuZGluZyA9IHRoaXMucmVzb2x2ZUFuZEJ1aWxkKG9yZ0lkKTtcbiAgICAgIHRoaXMuaW5GbGlnaHQuc2V0KG9yZ0lkLCBwZW5kaW5nKTtcbiAgICAgIHZvaWQgcGVuZGluZy5maW5hbGx5KCgpID0+IHtcbiAgICAgICAgaWYgKHRoaXMuaW5GbGlnaHQuZ2V0KG9yZ0lkKSA9PT0gcGVuZGluZykgdGhpcy5pbkZsaWdodC5kZWxldGUob3JnSWQpO1xuICAgICAgfSk7XG4gICAgfVxuICAgIHJldHVybiBwZW5kaW5nO1xuICB9XG5cbiAgLyoqIERyb3AgdGhlIGNhY2hlZCBwcm92aWRlciBmb3IgYW4gb3JnLiBDYWxsIGFmdGVyIHRoZSBvcGVyYXRvciByb3RhdGVzXG4gICAqICB0aGUgcm9sZSBBUk4gb3IgZXh0ZXJuYWwgaWQgc28gdGhlIG5leHQgcmVxdWVzdCByZWJ1aWxkcy4gKi9cbiAgZXZpY3Qob3JnSWQ6IHN0cmluZyk6IHZvaWQge1xuICAgIHRoaXMuY2FjaGUuZGVsZXRlKG9yZ0lkKTtcbiAgfVxuXG4gIC8qKiBEcm9wIGV2ZXJ5IGNhY2hlZCBwcm92aWRlci4gVXNlZnVsIGluIHRlc3RzOyByYXJlbHkgaW4gcHJvZHVjdGlvbi4gKi9cbiAgZXZpY3RBbGwoKTogdm9pZCB7XG4gICAgdGhpcy5jYWNoZS5jbGVhcigpO1xuICB9XG5cbiAgcHJpdmF0ZSBhc3luYyByZXNvbHZlQW5kQnVpbGQob3JnSWQ6IHN0cmluZyk6IFByb21pc2U8QXdzQ3JlZGVudGlhbElkZW50aXR5UHJvdmlkZXI+IHtcbiAgICBjb25zdCBjZmcgPSBhd2FpdCB0aGlzLnJlc29sdmVyKG9yZ0lkKTtcbiAgICBpZiAoIWNmZyB8fCAhY2ZnLmFzc3VtZVJvbGVBcm4pIHtcbiAgICAgIGNvbnN0IGZhbGxiYWNrID0gYXdhaXQgdGhpcy5nZXRGYWxsYmFjaygpO1xuICAgICAgdGhpcy5jYWNoZS5zZXQob3JnSWQsIHsgZmluZ2VycHJpbnQ6ICdmYWxsYmFjaycsIHByb3ZpZGVyOiBmYWxsYmFjayB9KTtcbiAgICAgIHJldHVybiBmYWxsYmFjaztcbiAgICB9XG5cbiAgICBjb25zdCBwcm92aWRlciA9IGF3YWl0IHRoaXMuYnVpbGRBc3N1bWVSb2xlUHJvdmlkZXIob3JnSWQsIGNmZyk7XG4gICAgdGhpcy5jYWNoZS5zZXQob3JnSWQsIHsgZmluZ2VycHJpbnQ6IGZpbmdlcnByaW50Q29uZmlnKGNmZyksIHByb3ZpZGVyIH0pO1xuICAgIHJldHVybiBwcm92aWRlcjtcbiAgfVxuXG4gIHByaXZhdGUgYXN5bmMgZ2V0RmFsbGJhY2soKTogUHJvbWlzZTxBd3NDcmVkZW50aWFsSWRlbnRpdHlQcm92aWRlcj4ge1xuICAgIGlmICh0aGlzLmZhbGxiYWNrT3ZlcnJpZGUpIHJldHVybiB0aGlzLmZhbGxiYWNrT3ZlcnJpZGU7XG4gICAgaWYgKHRoaXMuZmFsbGJhY2tDYWNoZSkgcmV0dXJuIHRoaXMuZmFsbGJhY2tDYWNoZTtcbiAgICAvLyBMYXp5LWltcG9ydCBzbyB0ZXN0IGVudnMgdGhhdCBzdXBwbHkgdGhlaXIgb3duIHJlc29sdmVyL2ZhbGxiYWNrXG4gICAgLy8gZG9uJ3QgbG9hZCB0aGUgY3JlZGVudGlhbC1wcm92aWRlcnMgU0RLLlxuICAgIGNvbnN0IHsgZnJvbU5vZGVQcm92aWRlckNoYWluIH0gPSBhd2FpdCBpbXBvcnQoJ0Bhd3Mtc2RrL2NyZWRlbnRpYWwtcHJvdmlkZXJzJyk7XG4gICAgdGhpcy5mYWxsYmFja0NhY2hlID0gZnJvbU5vZGVQcm92aWRlckNoYWluKCk7XG4gICAgcmV0dXJuIHRoaXMuZmFsbGJhY2tDYWNoZTtcbiAgfVxuXG4gIHByaXZhdGUgYXN5bmMgYnVpbGRBc3N1bWVSb2xlUHJvdmlkZXIob3JnSWQ6IHN0cmluZywgY2ZnOiBPcmdBd3NDb25maWcpOiBQcm9taXNlPEF3c0NyZWRlbnRpYWxJZGVudGl0eVByb3ZpZGVyPiB7XG4gICAgLy8gRHluYW1pYyBpbXBvcnRzIOKAlCBTVFMgKyBjcmVkZW50aWFsLXByb3ZpZGVycyBhcmUgaGVhdnl3ZWlnaHQgYW5kXG4gICAgLy8gc2VydmljZXMgdGhhdCBuZXZlciBoYXZlIHBlci1vcmcgcm9sZXMgY29uZmlndXJlZCBzaG91bGRuJ3QgbG9hZCB0aGVtLlxuICAgIGNvbnN0IFt7IFNUU0NsaWVudCB9LCB7IGZyb21UZW1wb3JhcnlDcmVkZW50aWFscyB9XSA9IGF3YWl0IFByb21pc2UuYWxsKFtcbiAgICAgIGltcG9ydCgnQGF3cy1zZGsvY2xpZW50LXN0cycpLFxuICAgICAgaW1wb3J0KCdAYXdzLXNkay9jcmVkZW50aWFsLXByb3ZpZGVycycpLFxuICAgIF0pO1xuXG4gICAgY29uc3QgbWFzdGVyQ3JlZGVudGlhbHMgPSB0aGlzLmZhbGxiYWNrT3ZlcnJpZGUgPz8gKGF3YWl0IHRoaXMuZ2V0RmFsbGJhY2soKSk7XG5cbiAgICBjb25zdCBzZXNzaW9uTmFtZSA9IGNmZy5yb2xlU2Vzc2lvbk5hbWUgPz8gYHBpcGVsaW5lLWJ1aWxkZXItJHtvcmdJZH1gLnNsaWNlKDAsIDY0KTtcbiAgICBjb25zdCByZWdpb24gPSBjZmcucmVnaW9uID8/IHRoaXMucmVnaW9uO1xuXG4gICAgcmV0dXJuIGZyb21UZW1wb3JhcnlDcmVkZW50aWFscyh7XG4gICAgICAvLyBJbm5lciBTVFMgY2xpZW50IHVzZXMgdGhlIHNlcnZpY2UncyBvd24gY3JlZGVudGlhbHMgKHRoZSBmYWxsYmFja1xuICAgICAgLy8gY2hhaW4pLiBUaG9zZSBjcmVkcyBuZWVkIGBzdHM6QXNzdW1lUm9sZWAgb24gdGhlIG9yZydzIHJvbGUuXG4gICAgICBtYXN0ZXJDcmVkZW50aWFscyxcbiAgICAgIGNsaWVudENvbmZpZzoge1xuICAgICAgICByZWdpb24sXG4gICAgICAgIC4uLih0aGlzLmVuZHBvaW50ID8geyBlbmRwb2ludDogdGhpcy5lbmRwb2ludCB9IDoge30pLFxuICAgICAgICAvLyBDYXN0IHRvIHNhdGlzZnkgZnJvbVRlbXBvcmFyeUNyZWRlbnRpYWxzJyB0eXBpbmc7IFNUU0NsaWVudFxuICAgICAgICAvLyBtYXRjaGVzIHRoZSBzdHJ1Y3R1cmFsIGNsaWVudCBzaGFwZSBpdCBleHBlY3RzLlxuICAgICAgfSBhcyB1bmtub3duIGFzIENvbnN0cnVjdG9yUGFyYW1ldGVyczx0eXBlb2YgU1RTQ2xpZW50PlswXSxcbiAgICAgIHBhcmFtczoge1xuICAgICAgICBSb2xlQXJuOiBjZmcuYXNzdW1lUm9sZUFybixcbiAgICAgICAgUm9sZVNlc3Npb25OYW1lOiBzZXNzaW9uTmFtZSxcbiAgICAgICAgRHVyYXRpb25TZWNvbmRzOiBjZmcuc2Vzc2lvbkR1cmF0aW9uU2Vjb25kcyA/PyAzNjAwLFxuICAgICAgICAuLi4oY2ZnLmV4dGVybmFsSWQgPyB7IEV4dGVybmFsSWQ6IGNmZy5leHRlcm5hbElkIH0gOiB7fSksXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG5cbi8qKlxuICogRGV0ZXJtaW5pc3RpYyBmaW5nZXJwcmludCBvZiBhIGNvbmZpZy4gVXNlZCBieSBgZ2V0Q3JlZGVudGlhbHNgIHRvXG4gKiBkZXRlY3QgXCJ0aGUgY2FjaGUgaXMgc3RhbGUgYmVjYXVzZSB0aGUgb3BlcmF0b3IgY2hhbmdlZCB0aGUgY29uZmlnXCIg4oCUXG4gKiBub3QgZXhwb3NlZCBwdWJsaWNseSwganVzdCBkZWZlbnNlIGluIGRlcHRoIGFnYWluc3QgYSBtaXNzZWQgYGV2aWN0YC5cbiAqL1xuZnVuY3Rpb24gZmluZ2VycHJpbnRDb25maWcoY2ZnOiBPcmdBd3NDb25maWcpOiBzdHJpbmcge1xuICByZXR1cm4gW1xuICAgIGNmZy5hc3N1bWVSb2xlQXJuLFxuICAgIGNmZy5leHRlcm5hbElkID8/ICcnLFxuICAgIGNmZy5yZWdpb24gPz8gJycsXG4gICAgY2ZnLnNlc3Npb25EdXJhdGlvblNlY29uZHMgPz8gJycsXG4gICAgY2ZnLnJvbGVTZXNzaW9uTmFtZSA/PyAnJyxcbiAgXS5qb2luKCd8Jyk7XG59XG5cbi8qKiBDb252ZW5pZW5jZTogZGlyZWN0bHkgcmVzb2x2ZSBjcmVkZW50aWFscyBmb3IgYSBzaW5nbGUgY2FsbC4gVGhlIG1hbmFnZXJcbiAqICBkb2Vzbid0IGNhY2hlIHdoZW4gY2FsbGVkIHRoaXMgd2F5IOKAlCB1c2VmdWwgaW4gQ0xJcyAvIG9uZS1zaG90IHNjcmlwdHMuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZU9yZ0NyZWRlbnRpYWxzT25jZShcbiAgb3JnSWQ6IHN0cmluZyxcbiAgcmVzb2x2ZXI6IE9yZ0F3c0NvbmZpZ1Jlc29sdmVyLFxuKTogUHJvbWlzZTxBd3NDcmVkZW50aWFsSWRlbnRpdHk+IHtcbiAgY29uc3QgbWFuYWdlciA9IG5ldyBPcmdBd3NDcmVkZW50aWFsc01hbmFnZXIoeyByZXNvbHZlciB9KTtcbiAgY29uc3QgcHJvdmlkZXIgPSBhd2FpdCBtYW5hZ2VyLmdldENyZWRlbnRpYWxzKG9yZ0lkKTtcbiAgcmV0dXJuIHByb3ZpZGVyKCk7XG59XG5cbi8qKlxuICogQWRhcHRlcjogcmVzb2x2ZSBwZXItb3JnIGNyZWRlbnRpYWxzIGFuZCBjb25zdHJ1Y3QgYW4gQVdTIFNESyBjbGllbnRcbiAqIHByZS1ib3VuZCB0byB0aGVtLiBUaGUgZmFjdG9yeSBpcyBhc3luYyBiZWNhdXNlIGNyZWRlbnRpYWwgcmVzb2x1dGlvbiBtYXlcbiAqIG5lZWQgdG8gbWFrZSBhIG5ldHdvcmsgY2FsbCAoZmV0Y2hpbmcgb3JnIGNvbmZpZyArIEFzc3VtZVJvbGUpLiBPbmNlXG4gKiByZXNvbHZlZCwgdGhlIHJldHVybmVkIGNsaWVudCBpcyByZWFkeSBmb3Igbm9ybWFsIFNESyBjYWxsczsgdGhlIHByb3ZpZGVyXG4gKiBpbnNpZGUgcmVmcmVzaGVzIGNyZWRlbnRpYWxzIGF1dG9tYXRpY2FsbHkgYmVmb3JlIHRoZXkgZXhwaXJlLlxuICpcbiAqIFR5cGljYWwgdXNhZ2U6XG4gKiAgIGBgYHRzXG4gKiAgIGNvbnN0IHMzID0gYXdhaXQgd2l0aE9yZ0F3c0NyZWRlbnRpYWxzKG1hbmFnZXIsIG9yZ0lkLCAoY3JlZHMpID0+XG4gKiAgICAgbmV3IFMzQ2xpZW50KHsgY3JlZGVudGlhbHM6IGNyZWRzLCByZWdpb246ICd1cy13ZXN0LTInIH0pKTtcbiAqICAgYXdhaXQgczMuc2VuZChuZXcgTGlzdE9iamVjdHNWMkNvbW1hbmQoeyBCdWNrZXQ6IGJ1Y2tldEZvcihvcmdJZCkgfSkpO1xuICogICBgYGBcbiAqXG4gKiBUaGUgZmFjdG9yeSBpcyBpbnZva2VkIGV4YWN0bHkgb25jZSBwZXIgY2FsbCDigJQgY2FsbGVycyB0aGF0IG5lZWQgYVxuICogbG9uZy1saXZlZCBjbGllbnQgc2hvdWxkIGNhY2hlIHRoZSByZXN1bHQgdGhlbXNlbHZlcyByYXRoZXIgdGhhbiByZWJ1aWxkaW5nXG4gKiBvbiBldmVyeSBvcGVyYXRpb24uIChSZS1yZXNvbHZpbmcgb24gZXZlcnkgb3AgaXMgZmluZSBmb3IgY29sZCBwYXRocyBhbmRcbiAqIGEgd2FzdGVkIGNvdXBsZSBvZiBvYmplY3QgYWxsb2NhdGlvbnMgb24gaG90IHBhdGhzLilcbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdpdGhPcmdBd3NDcmVkZW50aWFsczxUQ2xpZW50PihcbiAgbWFuYWdlcjogT3JnQXdzQ3JlZGVudGlhbHNNYW5hZ2VyLFxuICBvcmdJZDogc3RyaW5nLFxuICBmYWN0b3J5OiAoY3JlZGVudGlhbHM6IEF3c0NyZWRlbnRpYWxJZGVudGl0eVByb3ZpZGVyKSA9PiBUQ2xpZW50LFxuKTogUHJvbWlzZTxUQ2xpZW50PiB7XG4gIGNvbnN0IGNyZWRlbnRpYWxzID0gYXdhaXQgbWFuYWdlci5nZXRDcmVkZW50aWFscyhvcmdJZCk7XG4gIHJldHVybiBmYWN0b3J5KGNyZWRlbnRpYWxzKTtcbn1cbiJdfQ==

package/lib/utils/secret-encryption.d.ts

@@ -0,0 +1,205 @@
+/** On-disk shape of an encrypted secret. JSON-serializable. */
+export interface EncryptedBlob {
+    /** Algorithm tag. Bump on format change so a future migration can detect old blobs. */
+    alg: 'aes-256-gcm-v1';
+    /** Base64-encoded 12-byte IV. */
+    iv: string;
+    /** Base64-encoded ciphertext + 16-byte authentication tag concatenated. */
+    ciphertext: string;
+    /** Optional key id  populated by KMS-backed providers, ignored by the env provider. */
+    kid?: string;
+}
+/** Pluggable key source. Env-backed by default; KMS-backed available. */
+export interface KeyProvider {
+    /** Derive a 32-byte symmetric key bound to `orgId`. */
+    deriveKey(orgId: string): Buffer;
+    /** Optional async variant for providers that need to do I/O (e.g.
+     *  per-org KMS lookup the first time an org is seen). Default
+     *  implementation forwards to the sync `deriveKey`. */
+    deriveKeyAsync?(orgId: string): Promise<Buffer>;
+    /** Optional KMS-key-id this provider used for `orgId`. Embedded in the
+     *  `EncryptedBlob.kid` field on write so decrypt can verify the right
+     *  KMS CMK is being used (defense against an attacker who swaps a blob
+     *  between orgs). Default returns undefined (env provider). */
+    kidFor?(orgId: string): string | undefined;
+}
+/**
+ * Default provider  derives a per-org key from `SECRET_ENCRYPTION_KEY` via
+ * HKDF-SHA256. Suitable for self-hosted / dev where operators don't have KMS.
+ *
+ * Fails fast if the env is missing or the key is the wrong length so misconfig
+ * surfaces at first use rather than silently fingerprinting all writes with
+ * a default zero key.
+ */
+export declare class EnvKeyProvider implements KeyProvider {
+    private readonly masterKey;
+    constructor(masterKeyOverride?: string);
+    deriveKey(orgId: string): Buffer;
+}
+/**
+ *  AWS-KMS-backed KeyProvider.
+ *
+ * Trade-off picked: store ONE master key encrypted under a KMS CMK; on
+ * first use, call `kms:Decrypt` to recover the master key bytes; HKDF-
+ * derive per-org from it (same as EnvKeyProvider). The process then holds
+ * the plaintext master key in memory until restart.
+ *
+ * PROS: one KMS call per process lifetime (cheap, low p99 impact),
+ * the encrypted-master-key blob is safe to commit/log/checkin,
+ * KMS audit log records when the master is recovered.
+ * CONS: process memory still holds the master key  same posture as
+ * EnvKeyProvider once warmed up. For stronger isolation an
+ * operator can move to per-record envelope encryption (call
+ * GenerateDataKey on every write); that's a follow-on.
+ *
+ * Operator setup * 1. Create a KMS CMK with key policy allowing the platform service's
+ * IAM role kms:Decrypt.
+ * 2. Generate a random 32-byte master * head -c 32 /dev/urandom | base64
+ * 3. Wrap it with KMS * aws kms encrypt --key-id <KEY_ID> \
+ * --plaintext <base64-from-step-2> --output text \
+ * --query CiphertextBlob
+ * 4. Set on the service * SECRET_ENCRYPTION_KMS_KEY_ID=<KEY_ID>
+ * SECRET_ENCRYPTION_KMS_CIPHERTEXT=<base64-output-of-step-3>
+ * 5. Pick this provider via `setKeyProvider(new KmsKeyProvider())`.
+ *
+ * Construct lazily  importing the AWS SDK has a non-trivial cold-start
+ * cost so envs that stay on EnvKeyProvider never load it.
+ */
+export declare class KmsKeyProvider implements KeyProvider {
+    private masterKeyCache;
+    private readonly keyId;
+    private readonly ciphertextB64;
+    private readonly region?;
+    private readonly endpoint?;
+    private decryptInFlight;
+    constructor(opts?: {
+        keyId?: string;
+        ciphertextBase64?: string;
+        region?: string;
+        endpoint?: string;
+    });
+    deriveKey(orgId: string): Buffer;
+    /**
+     * Eagerly recover the master key from KMS so subsequent `deriveKey`
+     * calls are sync. Idempotent  concurrent callers share the same in-
+     * flight promise so we don't spawn multiple KMS Decrypt requests at
+     * boot. Throws on any KMS failure; the caller (typically the service's
+     * onBeforeStart hook) decides whether to fall back to a different
+     * provider or fail-startup.
+     */
+    warmup(): Promise<void>;
+    private fetchAndDecrypt;
+}
+/** Read the active default provider. Exposed so service code (e.g. an
+ *  admin endpoint that just rotated an org's KMS config) can call
+ *  `provider.evict(orgId)` on the live provider rather than reconstructing
+ *  one. Triggers lazy initialization on first access, same as the internal
+ *  callers below. */
+export declare function getDefaultKeyProvider(): KeyProvider;
+/** Reset the cached default provider  for tests that mutate `process.env`. */
+export declare function resetDefaultKeyProvider(): void;
+/** Replace the default provider  services that opt into KMS call this
+ * once at startup with a warmed-up `KmsKeyProvider`. */
+export declare function setKeyProvider(provider: KeyProvider): void;
+/** Per-org KMS config the operator supplies. The `keyId` identifies the
+ *  KMS CMK to call Decrypt on; `ciphertextBase64` is the wrapped 32-byte
+ *  master generated by `aws kms encrypt` against that key. */
+export interface PerOrgKmsConfig {
+    keyId: string;
+    ciphertextBase64: string;
+}
+/**
+ * Async resolver that maps an org id to its KMS config. Returns `null` when
+ * the org has no per-org config — the provider then falls back to the
+ * `fallback` provider supplied at construction (usually an EnvKeyProvider
+ * or a default KmsKeyProvider).
+ */
+export type PerOrgKmsResolver = (orgId: string) => Promise<PerOrgKmsConfig | null>;
+/**
+ * Per-org KMS-backed KeyProvider. The blast radius of a KMS key compromise
+ * is one org instead of every org under a shared master.
+ *
+ * Each org has its own KMS CMK + its own wrapped master (stored in Mongo
+ * via the operator's setup script). On first encrypt/decrypt for an org,
+ * the provider:
+ *   1. Calls the resolver to fetch the org's KMS config.
+ *   2. Calls `kms:Decrypt` to recover the 32-byte master.
+ *   3. Caches the recovered master in-memory for the process lifetime.
+ *   4. HKDF-derives per-call from that master + the org id salt.
+ *
+ * Blobs encrypted by this provider carry `kid = <kms-key-id>` so the
+ * decrypt path detects a stale config (operator rotated the key but
+ * existing rows weren't re-encrypted) BEFORE AES-GCM throws an opaque
+ * authentication-tag error.
+ *
+ * Orgs without per-org config fall through to the `fallback` provider —
+ * mixed-mode deployments where some orgs have KMS isolation and others
+ * stay on the shared master are explicitly supported.
+ */
+export declare class PerOrgKmsKeyProvider implements KeyProvider {
+    /** Cached per-org master keys, keyed by orgId. */
+    private readonly masters;
+    /** Resolved per-org configs cached for the process lifetime. */
+    private readonly configs;
+    /** In-flight resolver promises so concurrent first-touch callers share one KMS Decrypt.
+     *  Resolves to `null` for orgs with no per-org config — caller treats null as
+     *  "fall through to the fallback provider", same as a cold cache miss. */
+    private readonly inFlight;
+    /** Provider used for orgs that have no per-org config. */
+    private readonly fallback;
+    private readonly resolver;
+    private readonly region?;
+    private readonly endpoint?;
+    constructor(opts: {
+        resolver: PerOrgKmsResolver;
+        fallback: KeyProvider;
+        region?: string;
+        endpoint?: string;
+    });
+    /** Sync `deriveKey` only works for already-warmed orgs. Cold orgs fall
+     *  through to the fallback provider. Callers that want per-org isolation
+     *  MUST `await deriveKeyAsync(orgId)` once first (e.g. during request setup
+     *  or as part of a warmup pass) — otherwise the org silently uses the
+     *  shared master. */
+    deriveKey(orgId: string): Buffer;
+    deriveKeyAsync(orgId: string): Promise<Buffer>;
+    kidFor(orgId: string): string | undefined;
+    /**
+     * Resolve the org's KMS config, call Decrypt, cache the master. Subsequent
+     * calls for the same org are no-ops. Concurrent callers share the in-flight
+     * Decrypt promise.
+     *
+     * Returns silently when the org has no per-org config — the fallback
+     * provider handles those orgs.
+     */
+    ensureWarmed(orgId: string): Promise<void>;
+    private resolveAndDecrypt;
+    private fetchAndDecrypt;
+    /** Evict a cached per-org master. Use after a key rotation so the next
+     *  touch re-fetches the new wrapped master from the resolver. */
+    evict(orgId: string): void;
+}
+/**
+ * Encrypt a plaintext string for storage. Returns an `EncryptedBlob` that
+ * can be JSON-serialized into the underlying column / Mongo document.
+ *
+ * Empty strings round-trip as `null` so the calling model layer can treat
+ * "no secret set" identically to "field absent".
+ */
+export declare function encryptSecret(plaintext: string, orgId: string, provider?: KeyProvider): EncryptedBlob;
+/**
+ * Decrypt an `EncryptedBlob` written by `encryptSecret`. Throws on * - unknown `alg` (forces an explicit migration when the format changes)
+ * - wrong orgId (HKDF binding mismatch fails the auth tag)
+ * - tampered ciphertext (GCM auth tag check fails)
+ *
+ * Callers handle the throw  masking the failure as `null` would hide
+ * silent corruption / wrong-org reads.
+ */
+export declare function decryptSecret(blob: EncryptedBlob, orgId: string, provider?: KeyProvider): string;
+/**
+ * Type guard  handy for model layers that hold a column whose value may be
+ * either a clear-text string (legacy / unencrypted) OR an encrypted blob
+ * (post-migration). Mixed states arise mid-migration; the model decides
+ * what to do (decrypt on read, encrypt on next write).
+ */
+export declare function isEncryptedBlob(value: unknown): value is EncryptedBlob;