@pipeline-builder/api-core 3.4.90 → 3.4.91

package/lib/services/audit-spool.js

@@ -0,0 +1,111 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { createRequire } from 'module';
+import { createLogger } from '../utils/logger.js';
+import { emitCounter } from '../utils/metric-emitter.js';
+const logger = createLogger('audit-spool');
+const DEFAULT_SPOOL_KEY = 'audit:spool';
+const DEFAULT_MAX_DEPTH = 10_000;
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function safeParse(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && parsed.event && parsed.serviceName ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Redis-LIST-backed spool. Durable across process restarts (unlike an in-memory
+ * or per-pod-disk buffer), shared by all replicas of a service, and bounded via
+ * a trim-to-tail on overflow (drops the OLDEST, emitting `audit_spool_dropped_total`).
+ */
+export function createRedisAuditSpool(redis, opts = {}) {
+    const key = opts.key ?? DEFAULT_SPOOL_KEY;
+    const maxDepth = Math.max(1, opts.maxDepth ?? DEFAULT_MAX_DEPTH);
+    return {
+        async enqueue(entry) {
+            try {
+                const len = await redis.rpush(key, JSON.stringify(entry));
+                emitCounter('audit_spool_enqueued_total', { service: entry.serviceName });
+                if (len > maxDepth) {
+                    // Keep only the newest `maxDepth`; drop the overflow at the head.
+                    const dropped = len - maxDepth;
+                    await redis.ltrim(key, dropped, -1);
+                    emitCounter('audit_spool_dropped_total', { service: entry.serviceName }, dropped);
+                    logger.warn('Audit spool overflow — dropped oldest buffered events', { dropped, maxDepth });
+                }
+            }
+            catch (err) {
+                logger.warn('Audit spool enqueue failed (event lost)', { error: errMsg(err) });
+            }
+        },
+        async take(max) {
+            try {
+                const raw = await redis.lpop(key, Math.max(1, max));
+                if (!raw || raw.length === 0)
+                    return [];
+                return raw.map(safeParse).filter((e) => e !== null);
+            }
+            catch (err) {
+                logger.warn('Audit spool take failed', { error: errMsg(err) });
+                return [];
+            }
+        },
+        async requeue(entries) {
+            if (entries.length === 0)
+                return;
+            try {
+                // Put failed re-deliveries back at the HEAD so they're retried first and
+                // rough emission order is preserved across the outage.
+                await redis.lpush(key, ...entries.map((e) => JSON.stringify(e)));
+            }
+            catch (err) {
+                logger.warn('Audit spool requeue failed (events lost)', { error: errMsg(err) });
+            }
+        },
+        async depth() {
+            try {
+                return await redis.llen(key);
+            }
+            catch {
+                return 0;
+            }
+        },
+    };
+}
+/**
+ * Build a Redis-backed audit spool from the ambient `REDIS_URL` / `REDIS_HOST`
+ * env (mirrors `createEnvRedisTokenRevocationStore`). Returns `null` when Redis
+ * is not configured or the client can't be constructed — the caller then runs
+ * without a spool (pre-spool best-effort behavior), never crashing. ioredis is a
+ * runtime-only optional dep loaded via `createRequire`, so this stays importable
+ * where Redis isn't present.
+ */
+export function createEnvRedisAuditSpool(opts = {}) {
+    try {
+        const url = process.env.REDIS_URL;
+        const host = process.env.REDIS_HOST;
+        if (!url && !host)
+            return null;
+        const req = createRequire(import.meta.url);
+        const mod = req('ioredis');
+        const RedisCtor = (mod.Redis ?? mod.default ?? mod);
+        const redisOpts = { maxRetriesPerRequest: 1, enableOfflineQueue: false };
+        const inst = url
+            ? new RedisCtor(url, redisOpts)
+            : new RedisCtor({ host, port: parseInt(process.env.REDIS_PORT ?? '6379', 10), ...redisOpts });
+        inst
+            .on('error', (e) => logger.warn('Redis audit-spool client error', { error: errMsg(e) }));
+        logger.info('Redis audit spool initialized');
+        return createRedisAuditSpool(inst, opts);
+    }
+    catch (err) {
+        logger.warn('Redis unavailable for audit spool; audit delivery is best-effort only', { error: errMsg(err) });
+        return null;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXVkaXQtc3Bvb2wuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VydmljZXMvYXVkaXQtc3Bvb2wudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sUUFBUSxDQUFDO0FBR3ZDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFekQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0FBNEMzQyxNQUFNLGlCQUFpQixHQUFHLGFBQWEsQ0FBQztBQUN4QyxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQztBQUVqQyxTQUFTLE1BQU0sQ0FBQyxHQUFZO0lBQzFCLE9BQU8sR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQzFELENBQUM7QUFFRCxTQUFTLFNBQVMsQ0FBQyxHQUFXO0lBQzVCLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFvQixDQUFDO1FBQ2xELE9BQU8sTUFBTSxJQUFJLE1BQU0sQ0FBQyxLQUFLLElBQUksTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDdEUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLHFCQUFxQixDQUNuQyxLQUFzQixFQUN0QixPQUE0QyxFQUFFO0lBRTlDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLElBQUksaUJBQWlCLENBQUM7SUFDMUMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFDLFFBQVEsSUFBSSxpQkFBaUIsQ0FBQyxDQUFDO0lBRWpFLE9BQU87UUFDTCxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUs7WUFDakIsSUFBSSxDQUFDO2dCQUNILE1BQU0sR0FBRyxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO2dCQUMxRCxXQUFXLENBQUMsNEJBQTRCLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7Z0JBQzFFLElBQUksR0FBRyxHQUFHLFFBQVEsRUFBRSxDQUFDO29CQUNuQixrRUFBa0U7b0JBQ2xFLE1BQU0sT0FBTyxHQUFHLEdBQUcsR0FBRyxRQUFRLENBQUM7b0JBQy9CLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7b0JBQ3BDLFdBQVcsQ0FBQywyQkFBMkIsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUUsT0FBTyxDQUFDLENBQUM7b0JBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELEVBQUUsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztnQkFDOUYsQ0FBQztZQUNILENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMseUNBQXlDLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNqRixDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRztZQUNaLElBQUksQ0FBQztnQkFDSCxNQUFNLEdBQUcsR0FBRyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ3BELElBQUksQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxDQUFDO29CQUFFLE9BQU8sRUFBRSxDQUFDO2dCQUN4QyxPQUFPLEdBQUcsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUF3QixFQUFFLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFDO1lBQzVFLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMseUJBQXlCLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztnQkFDL0QsT0FBTyxFQUFFLENBQUM7WUFDWixDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTztZQUNuQixJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztnQkFBRSxPQUFPO1lBQ2pDLElBQUksQ0FBQztnQkFDSCx5RUFBeUU7Z0JBQ3pFLHVEQUF1RDtnQkFDdkQsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ25FLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMsMENBQTBDLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNsRixDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxLQUFLO1lBQ1QsSUFBSSxDQUFDO2dCQUNILE9BQU8sTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQy9CLENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsT0FBTyxDQUFDLENBQUM7WUFDWCxDQUFDO1FBQ0gsQ0FBQztLQUNGLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sVUFBVSx3QkFBd0IsQ0FBQyxPQUE0QyxFQUFFO0lBQ3JGLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDO1FBQ2xDLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO1FBQ3BDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxJQUFJO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDL0IsTUFBTSxHQUFHLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDM0MsTUFBTSxHQUFHLEdBQUcsR0FBRyxDQUFDLFNBQVMsQ0FHeEIsQ0FBQztRQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssSUFBSSxHQUFHLENBQUMsT0FBTyxJQUFJLEdBQUcsQ0FBZ0QsQ0FBQztRQUNuRyxNQUFNLFNBQVMsR0FBRyxFQUFFLG9CQUFvQixFQUFFLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUN6RSxNQUFNLElBQUksR0FBRyxHQUFHO1lBQ2QsQ0FBQyxDQUFDLElBQUksU0FBUyxDQUFDLEdBQUcsRUFBRSxTQUFTLENBQUM7WUFDL0IsQ0FBQyxDQUFDLElBQUksU0FBUyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQyxFQUFFLEdBQUcsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUMvRixJQUEyRTthQUN6RSxFQUFFLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLCtCQUErQixDQUFDLENBQUM7UUFDN0MsT0FBTyxxQkFBcUIsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7UUFDYixNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0csT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBjcmVhdGVSZXF1aXJlIH0gZnJvbSAnbW9kdWxlJztcblxuaW1wb3J0IHR5cGUgeyBSZW1vdGVBdWRpdEV2ZW50IH0gZnJvbSAnLi9yZW1vdGUtYXVkaXQtY2xpZW50LmpzJztcbmltcG9ydCB7IGNyZWF0ZUxvZ2dlciB9IGZyb20gJy4uL3V0aWxzL2xvZ2dlci5qcyc7XG5pbXBvcnQgeyBlbWl0Q291bnRlciB9IGZyb20gJy4uL3V0aWxzL21ldHJpYy1lbWl0dGVyLmpzJztcblxuY29uc3QgbG9nZ2VyID0gY3JlYXRlTG9nZ2VyKCdhdWRpdC1zcG9vbCcpO1xuXG4vKiogQSBidWZmZXJlZCBlbWlzc2lvbjogdGhlIGV2ZW50IHBsdXMgd2hpY2ggc2VydmljZSBtdXN0IHJlLWRlbGl2ZXIgaXQuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1ZGl0U3Bvb2xFbnRyeSB7XG4gIGV2ZW50OiBSZW1vdGVBdWRpdEV2ZW50O1xuICBzZXJ2aWNlTmFtZTogc3RyaW5nO1xufVxuXG4vKipcbiAqIER1cmFibGUgYnVmZmVyIGZvciBhdWRpdCBldmVudHMgdGhhdCBmYWlsZWQgTElWRSBkZWxpdmVyeSB0byB0aGUgcGxhdGZvcm1cbiAqIChyZXRyaWVzIGV4aGF1c3RlZCBkdXJpbmcgYSBzdXN0YWluZWQgb3V0YWdlKS4gV2l0aG91dCB0aGlzLCB0aGUgYXVkaXQgdHJhaWwg4oCUXG4gKiBhIHNlY3VyaXR5IGxvZyDigJQgaXMgc2lsZW50bHkgbG9zdCB0aGUgbW9tZW50IHRoZSBwbGF0Zm9ybSBpcyBkb3duIGZvciBsb25nZXJcbiAqIHRoYW4gdGhlIGNsaWVudCdzIHNtYWxsIHJldHJ5IGJ1ZGdldC5cbiAqXG4gKiBDb250cmFjdDpcbiAqIC0gQk9VTkRFRC4gQSBzZWN1cml0eSBsb2cgbXVzdCBkZWdyYWRlIHRvIFwiZHJvcHBlZCB0aGUgb2xkZXN0LCBsb3VkbHlcIiAoYVxuICogICBtZXRyaWMpIHJhdGhlciB0aGFuIGdyb3cgd2l0aG91dCBsaW1pdCBhbmQgT09NIHRoZSBlbWl0dGVyLlxuICogLSBGQUlMLVNBRkUuIEV2ZXJ5IG1ldGhvZCBzd2FsbG93cyBpdHMgb3duIGVycm9ycyDigJQgYSBicm9rZW4vdW5yZWFjaGFibGUgc3Bvb2xcbiAqICAgbXVzdCBuZXZlciBicmVhayBvciBibG9jayB0aGUgYXVkaXQgZW1pc3Npb24gcGF0aCAod2hpY2ggaXMgaXRzZWxmXG4gKiAgIGZpcmUtYW5kLWZvcmdldCkuIEEgc3Bvb2wgcHJvYmxlbSBkZWdyYWRlcyB0byB0aGUgcHJlLXNwb29sIGJlaGF2aW9yLlxuICogLSBPcmRlcmluZyBpcyBiZXN0LWVmZm9ydC4gUmUtZGVsaXZlcmVkIGV2ZW50cyBjaGFpbiBhdCByZS1kZWxpdmVyeSB0aW1lXG4gKiAgICh0aGF0J3Mgd2hlbiB0aGUgcGxhdGZvcm0gaW5zZXJ0cyB0aGVtKSwgc28gZWFjaCBldmVudCBhbHNvIGNhcnJpZXMgYW5cbiAqICAgYG9jY3VycmVkQXRgIHN0YW1wZWQgYXQgZW1pc3Npb24gZm9yIHJldmlld2VycyDigJQgc2VlIFJlbW90ZUF1ZGl0RXZlbnQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXVkaXRTcG9vbCB7XG4gIC8qKiBCdWZmZXIgYW4gZXZlbnQgdGhhdCBmYWlsZWQgbGl2ZSBkZWxpdmVyeS4gKi9cbiAgZW5xdWV1ZShlbnRyeTogQXVkaXRTcG9vbEVudHJ5KTogUHJvbWlzZTx2b2lkPjtcbiAgLyoqIFJlbW92ZSBhbmQgcmV0dXJuIHVwIHRvIGBtYXhgIGJ1ZmZlcmVkIGVudHJpZXMgZm9yIHJlLWRlbGl2ZXJ5IGF0dGVtcHRzLiAqL1xuICB0YWtlKG1heDogbnVtYmVyKTogUHJvbWlzZTxBdWRpdFNwb29sRW50cnlbXT47XG4gIC8qKiBSZXR1cm4gZW50cmllcyB3aG9zZSByZS1kZWxpdmVyeSBmYWlsZWQgdG8gdGhlIGJ1ZmZlciAoYmVzdC1lZmZvcnQpLiAqL1xuICByZXF1ZXVlKGVudHJpZXM6IEF1ZGl0U3Bvb2xFbnRyeVtdKTogUHJvbWlzZTx2b2lkPjtcbiAgLyoqIEFwcHJveGltYXRlIGN1cnJlbnQgZGVwdGggKGZvciBtZXRyaWNzIC8gZHJhaW4gZGVjaXNpb25zKS4gKi9cbiAgZGVwdGgoKTogUHJvbWlzZTxudW1iZXI+O1xufVxuXG4vKiogTWluaW1hbCBSZWRpcyBMSVNUIHN1cmZhY2UgdGhlIHNwb29sIG5lZWRzIChhIHN1YnNldCBvZiBpb3JlZGlzKS4gKi9cbmludGVyZmFjZSBSZWRpc0xpc3RDbGllbnQge1xuICBycHVzaChrZXk6IHN0cmluZywgLi4udmFsdWVzOiBzdHJpbmdbXSk6IFByb21pc2U8bnVtYmVyPjtcbiAgbHB1c2goa2V5OiBzdHJpbmcsIC4uLnZhbHVlczogc3RyaW5nW10pOiBQcm9taXNlPG51bWJlcj47XG4gIGxwb3Aoa2V5OiBzdHJpbmcsIGNvdW50OiBudW1iZXIpOiBQcm9taXNlPHN0cmluZ1tdIHwgbnVsbD47XG4gIGx0cmltKGtleTogc3RyaW5nLCBzdGFydDogbnVtYmVyLCBzdG9wOiBudW1iZXIpOiBQcm9taXNlPHVua25vd24+O1xuICBsbGVuKGtleTogc3RyaW5nKTogUHJvbWlzZTxudW1iZXI+O1xufVxuXG5jb25zdCBERUZBVUxUX1NQT09MX0tFWSA9ICdhdWRpdDpzcG9vbCc7XG5jb25zdCBERUZBVUxUX01BWF9ERVBUSCA9IDEwXzAwMDtcblxuZnVuY3Rpb24gZXJyTXNnKGVycjogdW5rbm93bik6IHN0cmluZyB7XG4gIHJldHVybiBlcnIgaW5zdGFuY2VvZiBFcnJvciA/IGVyci5tZXNzYWdlIDogU3RyaW5nKGVycik7XG59XG5cbmZ1bmN0aW9uIHNhZmVQYXJzZShyYXc6IHN0cmluZyk6IEF1ZGl0U3Bvb2xFbnRyeSB8IG51bGwge1xuICB0cnkge1xuICAgIGNvbnN0IHBhcnNlZCA9IEpTT04ucGFyc2UocmF3KSBhcyBBdWRpdFNwb29sRW50cnk7XG4gICAgcmV0dXJuIHBhcnNlZCAmJiBwYXJzZWQuZXZlbnQgJiYgcGFyc2VkLnNlcnZpY2VOYW1lID8gcGFyc2VkIDogbnVsbDtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cbn1cblxuLyoqXG4gKiBSZWRpcy1MSVNULWJhY2tlZCBzcG9vbC4gRHVyYWJsZSBhY3Jvc3MgcHJvY2VzcyByZXN0YXJ0cyAodW5saWtlIGFuIGluLW1lbW9yeVxuICogb3IgcGVyLXBvZC1kaXNrIGJ1ZmZlciksIHNoYXJlZCBieSBhbGwgcmVwbGljYXMgb2YgYSBzZXJ2aWNlLCBhbmQgYm91bmRlZCB2aWFcbiAqIGEgdHJpbS10by10YWlsIG9uIG92ZXJmbG93IChkcm9wcyB0aGUgT0xERVNULCBlbWl0dGluZyBgYXVkaXRfc3Bvb2xfZHJvcHBlZF90b3RhbGApLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY3JlYXRlUmVkaXNBdWRpdFNwb29sKFxuICByZWRpczogUmVkaXNMaXN0Q2xpZW50LFxuICBvcHRzOiB7IG1heERlcHRoPzogbnVtYmVyOyBrZXk/OiBzdHJpbmcgfSA9IHt9LFxuKTogQXVkaXRTcG9vbCB7XG4gIGNvbnN0IGtleSA9IG9wdHMua2V5ID8/IERFRkFVTFRfU1BPT0xfS0VZO1xuICBjb25zdCBtYXhEZXB0aCA9IE1hdGgubWF4KDEsIG9wdHMubWF4RGVwdGggPz8gREVGQVVMVF9NQVhfREVQVEgpO1xuXG4gIHJldHVybiB7XG4gICAgYXN5bmMgZW5xdWV1ZShlbnRyeSkge1xuICAgICAgdHJ5IHtcbiAgICAgICAgY29uc3QgbGVuID0gYXdhaXQgcmVkaXMucnB1c2goa2V5LCBKU09OLnN0cmluZ2lmeShlbnRyeSkpO1xuICAgICAgICBlbWl0Q291bnRlcignYXVkaXRfc3Bvb2xfZW5xdWV1ZWRfdG90YWwnLCB7IHNlcnZpY2U6IGVudHJ5LnNlcnZpY2VOYW1lIH0pO1xuICAgICAgICBpZiAobGVuID4gbWF4RGVwdGgpIHtcbiAgICAgICAgICAvLyBLZWVwIG9ubHkgdGhlIG5ld2VzdCBgbWF4RGVwdGhgOyBkcm9wIHRoZSBvdmVyZmxvdyBhdCB0aGUgaGVhZC5cbiAgICAgICAgICBjb25zdCBkcm9wcGVkID0gbGVuIC0gbWF4RGVwdGg7XG4gICAgICAgICAgYXdhaXQgcmVkaXMubHRyaW0oa2V5LCBkcm9wcGVkLCAtMSk7XG4gICAgICAgICAgZW1pdENvdW50ZXIoJ2F1ZGl0X3Nwb29sX2Ryb3BwZWRfdG90YWwnLCB7IHNlcnZpY2U6IGVudHJ5LnNlcnZpY2VOYW1lIH0sIGRyb3BwZWQpO1xuICAgICAgICAgIGxvZ2dlci53YXJuKCdBdWRpdCBzcG9vbCBvdmVyZmxvdyDigJQgZHJvcHBlZCBvbGRlc3QgYnVmZmVyZWQgZXZlbnRzJywgeyBkcm9wcGVkLCBtYXhEZXB0aCB9KTtcbiAgICAgICAgfVxuICAgICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAgIGxvZ2dlci53YXJuKCdBdWRpdCBzcG9vbCBlbnF1ZXVlIGZhaWxlZCAoZXZlbnQgbG9zdCknLCB7IGVycm9yOiBlcnJNc2coZXJyKSB9KTtcbiAgICAgIH1cbiAgICB9LFxuXG4gICAgYXN5bmMgdGFrZShtYXgpIHtcbiAgICAgIHRyeSB7XG4gICAgICAgIGNvbnN0IHJhdyA9IGF3YWl0IHJlZGlzLmxwb3Aoa2V5LCBNYXRoLm1heCgxLCBtYXgpKTtcbiAgICAgICAgaWYgKCFyYXcgfHwgcmF3Lmxlbmd0aCA9PT0gMCkgcmV0dXJuIFtdO1xuICAgICAgICByZXR1cm4gcmF3Lm1hcChzYWZlUGFyc2UpLmZpbHRlcigoZSk6IGUgaXMgQXVkaXRTcG9vbEVudHJ5ID0+IGUgIT09IG51bGwpO1xuICAgICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAgIGxvZ2dlci53YXJuKCdBdWRpdCBzcG9vbCB0YWtlIGZhaWxlZCcsIHsgZXJyb3I6IGVyck1zZyhlcnIpIH0pO1xuICAgICAgICByZXR1cm4gW107XG4gICAgICB9XG4gICAgfSxcblxuICAgIGFzeW5jIHJlcXVldWUoZW50cmllcykge1xuICAgICAgaWYgKGVudHJpZXMubGVuZ3RoID09PSAwKSByZXR1cm47XG4gICAgICB0cnkge1xuICAgICAgICAvLyBQdXQgZmFpbGVkIHJlLWRlbGl2ZXJpZXMgYmFjayBhdCB0aGUgSEVBRCBzbyB0aGV5J3JlIHJldHJpZWQgZmlyc3QgYW5kXG4gICAgICAgIC8vIHJvdWdoIGVtaXNzaW9uIG9yZGVyIGlzIHByZXNlcnZlZCBhY3Jvc3MgdGhlIG91dGFnZS5cbiAgICAgICAgYXdhaXQgcmVkaXMubHB1c2goa2V5LCAuLi5lbnRyaWVzLm1hcCgoZSkgPT4gSlNPTi5zdHJpbmdpZnkoZSkpKTtcbiAgICAgIH0gY2F0Y2ggKGVycikge1xuICAgICAgICBsb2dnZXIud2FybignQXVkaXQgc3Bvb2wgcmVxdWV1ZSBmYWlsZWQgKGV2ZW50cyBsb3N0KScsIHsgZXJyb3I6IGVyck1zZyhlcnIpIH0pO1xuICAgICAgfVxuICAgIH0sXG5cbiAgICBhc3luYyBkZXB0aCgpIHtcbiAgICAgIHRyeSB7XG4gICAgICAgIHJldHVybiBhd2FpdCByZWRpcy5sbGVuKGtleSk7XG4gICAgICB9IGNhdGNoIHtcbiAgICAgICAgcmV0dXJuIDA7XG4gICAgICB9XG4gICAgfSxcbiAgfTtcbn1cblxuLyoqXG4gKiBCdWlsZCBhIFJlZGlzLWJhY2tlZCBhdWRpdCBzcG9vbCBmcm9tIHRoZSBhbWJpZW50IGBSRURJU19VUkxgIC8gYFJFRElTX0hPU1RgXG4gKiBlbnYgKG1pcnJvcnMgYGNyZWF0ZUVudlJlZGlzVG9rZW5SZXZvY2F0aW9uU3RvcmVgKS4gUmV0dXJucyBgbnVsbGAgd2hlbiBSZWRpc1xuICogaXMgbm90IGNvbmZpZ3VyZWQgb3IgdGhlIGNsaWVudCBjYW4ndCBiZSBjb25zdHJ1Y3RlZCDigJQgdGhlIGNhbGxlciB0aGVuIHJ1bnNcbiAqIHdpdGhvdXQgYSBzcG9vbCAocHJlLXNwb29sIGJlc3QtZWZmb3J0IGJlaGF2aW9yKSwgbmV2ZXIgY3Jhc2hpbmcuIGlvcmVkaXMgaXMgYVxuICogcnVudGltZS1vbmx5IG9wdGlvbmFsIGRlcCBsb2FkZWQgdmlhIGBjcmVhdGVSZXF1aXJlYCwgc28gdGhpcyBzdGF5cyBpbXBvcnRhYmxlXG4gKiB3aGVyZSBSZWRpcyBpc24ndCBwcmVzZW50LlxuICovXG5leHBvcnQgZnVuY3Rpb24gY3JlYXRlRW52UmVkaXNBdWRpdFNwb29sKG9wdHM6IHsgbWF4RGVwdGg/OiBudW1iZXI7IGtleT86IHN0cmluZyB9ID0ge30pOiBBdWRpdFNwb29sIHwgbnVsbCB7XG4gIHRyeSB7XG4gICAgY29uc3QgdXJsID0gcHJvY2Vzcy5lbnYuUkVESVNfVVJMO1xuICAgIGNvbnN0IGhvc3QgPSBwcm9jZXNzLmVudi5SRURJU19IT1NUO1xuICAgIGlmICghdXJsICYmICFob3N0KSByZXR1cm4gbnVsbDtcbiAgICBjb25zdCByZXEgPSBjcmVhdGVSZXF1aXJlKGltcG9ydC5tZXRhLnVybCk7XG4gICAgY29uc3QgbW9kID0gcmVxKCdpb3JlZGlzJykgYXMge1xuICAgICAgUmVkaXM/OiBuZXcgKC4uLmFyZ3M6IHVua25vd25bXSkgPT4gdW5rbm93bjtcbiAgICAgIGRlZmF1bHQ/OiBuZXcgKC4uLmFyZ3M6IHVua25vd25bXSkgPT4gdW5rbm93bjtcbiAgICB9O1xuICAgIGNvbnN0IFJlZGlzQ3RvciA9IChtb2QuUmVkaXMgPz8gbW9kLmRlZmF1bHQgPz8gbW9kKSBhcyBuZXcgKC4uLmFyZ3M6IHVua25vd25bXSkgPT4gUmVkaXNMaXN0Q2xpZW50O1xuICAgIGNvbnN0IHJlZGlzT3B0cyA9IHsgbWF4UmV0cmllc1BlclJlcXVlc3Q6IDEsIGVuYWJsZU9mZmxpbmVRdWV1ZTogZmFsc2UgfTtcbiAgICBjb25zdCBpbnN0ID0gdXJsXG4gICAgICA/IG5ldyBSZWRpc0N0b3IodXJsLCByZWRpc09wdHMpXG4gICAgICA6IG5ldyBSZWRpc0N0b3IoeyBob3N0LCBwb3J0OiBwYXJzZUludChwcm9jZXNzLmVudi5SRURJU19QT1JUID8/ICc2Mzc5JywgMTApLCAuLi5yZWRpc09wdHMgfSk7XG4gICAgKGluc3QgYXMgdW5rbm93biBhcyB7IG9uOiAoZXZ0OiBzdHJpbmcsIGNiOiAoZTogdW5rbm93bikgPT4gdm9pZCkgPT4gdm9pZCB9KVxuICAgICAgLm9uKCdlcnJvcicsIChlKSA9PiBsb2dnZXIud2FybignUmVkaXMgYXVkaXQtc3Bvb2wgY2xpZW50IGVycm9yJywgeyBlcnJvcjogZXJyTXNnKGUpIH0pKTtcbiAgICBsb2dnZXIuaW5mbygnUmVkaXMgYXVkaXQgc3Bvb2wgaW5pdGlhbGl6ZWQnKTtcbiAgICByZXR1cm4gY3JlYXRlUmVkaXNBdWRpdFNwb29sKGluc3QsIG9wdHMpO1xuICB9IGNhdGNoIChlcnIpIHtcbiAgICBsb2dnZXIud2FybignUmVkaXMgdW5hdmFpbGFibGUgZm9yIGF1ZGl0IHNwb29sOyBhdWRpdCBkZWxpdmVyeSBpcyBiZXN0LWVmZm9ydCBvbmx5JywgeyBlcnJvcjogZXJyTXNnKGVycikgfSk7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cbn1cbiJdfQ==

package/lib/services/compliance-client.js

@@ -30,8 +30,10 @@ function bypassResult(context) {
 function buildHeaders(orgId, authHeader) {
     const headers = {
         'x-org-id': orgId,
-        'x-internal-service': 'true',
     };
+    // NOTE: the old `x-internal-service: true` header was removed — it is trusted
+    // by nothing (it was spoofable); compliance routes authenticate the caller via
+    // the `Authorization` service JWT (`requireServicePrincipal`).
     if (authHeader)
         headers.Authorization = authHeader;
     return headers;
@@ -114,4 +116,4 @@ export function createComplianceClient(config) {
         },
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VydmljZXMvY29tcGxpYW5jZS1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUV0RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFbEQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFFakQ7OztHQUdHO0FBQ0gsTUFBTSxpQkFBaUIsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQixLQUFLLE1BQU0sQ0FBQztBQW1FbkU7OztHQUdHO0FBQ0gsU0FBUyxZQUFZLENBQUMsT0FBZ0M7SUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNqRixPQUFPO1FBQ0wsTUFBTSxFQUFFLElBQUk7UUFDWixPQUFPLEVBQUUsS0FBSztRQUNkLFVBQVUsRUFBRSxFQUFFO1FBQ2QsUUFBUSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxnREFBZ0QsRUFBRSxDQUFDO1FBQ3pMLGNBQWMsRUFBRSxDQUFDO1FBQ2pCLFlBQVksRUFBRSxDQUFDO1FBQ2YsaUJBQWlCLEVBQUUsRUFBRTtLQUN0QixDQUFDO0FBQ0osQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBUyxZQUFZLENBQUMsS0FBYSxFQUFFLFVBQWtCO0lBQ3JELE1BQU0sT0FBTyxHQUEyQjtRQUN0QyxVQUFVLEVBQUUsS0FBSztRQUNqQixvQkFBb0IsRUFBRSxNQUFNO0tBQzdCLENBQUM7SUFDRixJQUFJLFVBQVU7UUFBRSxPQUFPLENBQUMsYUFBYSxHQUFHLFVBQVUsQ0FBQztJQUNuRCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUFDLE1BQStCO0lBQ3BFLE1BQU0sYUFBYSxHQUFrQjtRQUNuQyxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLFlBQVk7UUFDekUsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUJBQXVCLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztLQUNsRixDQUFDO0lBRUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUVyRDs7Ozs7OztPQU9HO0lBQ0gsU0FBUyxNQUFNLENBQ2IsUUFBNkcsRUFDN0csRUFBVTtRQUVWLElBQUksUUFBUSxDQUFDLFVBQVUsR0FBRyxHQUFHLElBQUksUUFBUSxDQUFDLFVBQVUsSUFBSSxHQUFHLEVBQUUsQ0FBQztZQUM1RCxNQUFNLEdBQUcsR0FBRyxRQUFRLENBQUMsSUFBSSxFQUFFLE9BQU8sSUFBSSxRQUFRLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLGNBQWMsRUFBRSxZQUFZLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDckQsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxFQUFFLDZCQUE2QixRQUFRLENBQUMsVUFBVSxHQUFHLENBQUMsQ0FBQztRQUN2RixDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztJQUM1QixDQUFDO0lBRUQsT0FBTztRQUNMLEtBQUssQ0FBQyxjQUFjLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNO1lBQzlFLElBQUksQ0FBQztnQkFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQ2hDLDZCQUE2QixFQUM3QixFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxNQUFNLElBQUksUUFBUSxFQUFFLEVBQ2hFLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FDN0MsQ0FBQztnQkFDRixPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztZQUM1QyxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixJQUFJLGlCQUFpQjtvQkFBRSxPQUFPLFlBQVksQ0FBQyxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUNsRyxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLGdCQUFnQixDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsTUFBTTtZQUNoRixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUNoQywrQkFBK0IsRUFDL0IsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsTUFBTSxJQUFJLFFBQVEsRUFBRSxFQUNoRSxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxFQUFFLENBQzdDLENBQUM7Z0JBQ0YsT0FBTyxNQUFNLENBQUMsUUFBUSxFQUFFLGtCQUFrQixDQUFDLENBQUM7WUFDOUMsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxpQkFBaUI7b0JBQUUsT0FBTyxZQUFZLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztnQkFDcEcsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxVQUFVO1lBQzlDLElBQUksQ0FBQztnQkFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQ2hDLHFDQUFxQyxFQUNyQyxFQUFFLFVBQVUsRUFBRSxFQUNkLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FDN0MsQ0FBQztnQkFDRixPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDMUMsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxpQkFBaUI7b0JBQUUsT0FBTyxZQUFZLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDMUYsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxjQUFjLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxVQUFVO1lBQ2hELElBQUksQ0FBQztnQkFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQ2hDLHVDQUF1QyxFQUN2QyxFQUFFLFVBQVUsRUFBRSxFQUNkLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FDN0MsQ0FBQztnQkFDRixPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztZQUM1QyxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixJQUFJLGlCQUFpQjtvQkFBRSxPQUFPLFlBQVksQ0FBQyxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RixNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgSW50ZXJuYWxIdHRwQ2xpZW50IH0gZnJvbSAnLi9odHRwLWNsaWVudC5qcyc7XG5pbXBvcnQgdHlwZSB7IFNlcnZpY2VDb25maWcgfSBmcm9tICcuLi90eXBlcy9jb21tb24uanMnO1xuaW1wb3J0IHsgY3JlYXRlTG9nZ2VyIH0gZnJvbSAnLi4vdXRpbHMvbG9nZ2VyLmpzJztcblxuY29uc3QgbG9nZ2VyID0gY3JlYXRlTG9nZ2VyKCdjb21wbGlhbmNlLWNsaWVudCcpO1xuXG4vKipcbiAqIFdoZW4gdHJ1ZSwgY29tcGxpYW5jZSBjaGVja3MgYXJlIGJ5cGFzc2VkIGlmIHRoZSBzZXJ2aWNlIGlzIHVuYXZhaWxhYmxlXG4gKiAoZmFpbC1vcGVuKS4gRGVmYXVsdCBpcyBmYWlsLWNsb3NlZCAoZXJyb3JzIHByb3BhZ2F0ZSBhbmQgYmxvY2sgdGhlIG9wZXJhdGlvbikuXG4gKi9cbmNvbnN0IENPTVBMSUFOQ0VfQllQQVNTID0gcHJvY2Vzcy5lbnYuQ09NUExJQU5DRV9CWVBBU1MgPT09ICd0cnVlJztcblxuLyoqXG4gKiBSZXN1bHQgb2YgYSBjb21wbGlhbmNlIHZhbGlkYXRpb24gY2hlY2suXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQ29tcGxpYW5jZUNoZWNrUmVzdWx0IHtcbiAgcGFzc2VkOiBib29sZWFuO1xuICB2aW9sYXRpb25zOiBDb21wbGlhbmNlVmlvbGF0aW9uW107XG4gIHdhcm5pbmdzOiBDb21wbGlhbmNlVmlvbGF0aW9uW107XG4gIGJsb2NrZWQ6IGJvb2xlYW47XG4gIHJ1bGVzRXZhbHVhdGVkOiBudW1iZXI7XG4gIHJ1bGVzU2tpcHBlZDogbnVtYmVyO1xuICBleGVtcHRpb25zQXBwbGllZDogc3RyaW5nW107XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ29tcGxpYW5jZVZpb2xhdGlvbiB7XG4gIHJ1bGVJZDogc3RyaW5nO1xuICBydWxlTmFtZTogc3RyaW5nO1xuICBwb2xpY3lJZD86IHN0cmluZyB8IG51bGw7XG4gIGZpZWxkOiBzdHJpbmc7XG4gIG9wZXJhdG9yOiBzdHJpbmc7XG4gIGV4cGVjdGVkVmFsdWU6IHVua25vd247XG4gIGFjdHVhbFZhbHVlOiB1bmtub3duO1xuICBzZXZlcml0eTogc3RyaW5nO1xuICBtZXNzYWdlOiBzdHJpbmc7XG59XG5cbi8qKlxuICogQ29tcGxpYW5jZSBzZXJ2aWNlIGNsaWVudCBpbnRlcmZhY2UuXG4gKiBVc2VzIGZhaWwtY2xvc2VkIGRlc2lnbjogZXJyb3JzIHByb3BhZ2F0ZSB0byBibG9jayB0aGUgb3BlcmF0aW9uLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIENvbXBsaWFuY2VDbGllbnQge1xuICAvKiogVmFsaWRhdGUgcGx1Z2luIGF0dHJpYnV0ZXMgYWdhaW5zdCBvcmcgcnVsZXMuIFRocm93cyBvbiBzZXJ2aWNlIGVycm9yIChmYWlsLWNsb3NlZCkuICovXG4gIHZhbGlkYXRlUGx1Z2luKFxuICAgIG9yZ0lkOiBzdHJpbmcsXG4gICAgYXR0cmlidXRlczogUmVjb3JkPHN0cmluZywgdW5rbm93bj4sXG4gICAgYXV0aEhlYWRlcjogc3RyaW5nLFxuICAgIGVudGl0eUlkPzogc3RyaW5nLFxuICAgIGVudGl0eU5hbWU/OiBzdHJpbmcsXG4gICAgYWN0aW9uPzogc3RyaW5nLFxuICApOiBQcm9taXNlPENvbXBsaWFuY2VDaGVja1Jlc3VsdD47XG5cbiAgLyoqIFZhbGlkYXRlIHBpcGVsaW5lIGF0dHJpYnV0ZXMgYWdhaW5zdCBvcmcgcnVsZXMuIFRocm93cyBvbiBzZXJ2aWNlIGVycm9yIChmYWlsLWNsb3NlZCkuICovXG4gIHZhbGlkYXRlUGlwZWxpbmUoXG4gICAgb3JnSWQ6IHN0cmluZyxcbiAgICBhdHRyaWJ1dGVzOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPixcbiAgICBhdXRoSGVhZGVyOiBzdHJpbmcsXG4gICAgZW50aXR5SWQ/OiBzdHJpbmcsXG4gICAgZW50aXR5TmFtZT86IHN0cmluZyxcbiAgICBhY3Rpb24/OiBzdHJpbmcsXG4gICk6IFByb21pc2U8Q29tcGxpYW5jZUNoZWNrUmVzdWx0PjtcblxuICAvKiogUHJlLWZsaWdodCBjaGVjayBmb3IgcGx1Z2luIChubyBhdWRpdCwgbm8gbm90aWZpY2F0aW9uKS4gKi9cbiAgZHJ5UnVuUGx1Z2luKFxuICAgIG9yZ0lkOiBzdHJpbmcsXG4gICAgYXR0cmlidXRlczogUmVjb3JkPHN0cmluZywgdW5rbm93bj4sXG4gICAgYXV0aEhlYWRlcjogc3RyaW5nLFxuICApOiBQcm9taXNlPENvbXBsaWFuY2VDaGVja1Jlc3VsdD47XG5cbiAgLyoqIFByZS1mbGlnaHQgY2hlY2sgZm9yIHBpcGVsaW5lIChubyBhdWRpdCwgbm8gbm90aWZpY2F0aW9uKS4gKi9cbiAgZHJ5UnVuUGlwZWxpbmUoXG4gICAgb3JnSWQ6IHN0cmluZyxcbiAgICBhdHRyaWJ1dGVzOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPixcbiAgICBhdXRoSGVhZGVyOiBzdHJpbmcsXG4gICk6IFByb21pc2U8Q29tcGxpYW5jZUNoZWNrUmVzdWx0Pjtcbn1cblxuLyoqXG4gKiBSZXR1cm4gYSBwYXNzLXRocm91Z2ggcmVzdWx0IHdoZW4gQ09NUExJQU5DRV9CWVBBU1MgaXMgZW5hYmxlZCBhbmQgdGhlXG4gKiBjb21wbGlhbmNlIHNlcnZpY2UgaXMgdW5yZWFjaGFibGUuXG4gKi9cbmZ1bmN0aW9uIGJ5cGFzc1Jlc3VsdChjb250ZXh0OiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPik6IENvbXBsaWFuY2VDaGVja1Jlc3VsdCB7XG4gIGxvZ2dlci53YXJuKCdDT01QTElBTkNFX0JZUEFTUzogU2VydmljZSB1bmF2YWlsYWJsZSwgYWxsb3dpbmcgcmVxdWVzdCcsIGNvbnRleHQpO1xuICByZXR1cm4ge1xuICAgIHBhc3NlZDogdHJ1ZSxcbiAgICBibG9ja2VkOiBmYWxzZSxcbiAgICB2aW9sYXRpb25zOiBbXSxcbiAgICB3YXJuaW5nczogW3sgcnVsZUlkOiAnJywgcnVsZU5hbWU6ICcnLCBmaWVsZDogJycsIG9wZXJhdG9yOiAnJywgZXhwZWN0ZWRWYWx1ZTogbnVsbCwgYWN0dWFsVmFsdWU6IG51bGwsIHNldmVyaXR5OiAnd2FybmluZycsIG1lc3NhZ2U6ICdDb21wbGlhbmNlIGNoZWNrIHNraXBwZWQgKHNlcnZpY2UgdW5hdmFpbGFibGUpJyB9XSxcbiAgICBydWxlc0V2YWx1YXRlZDogMCxcbiAgICBydWxlc1NraXBwZWQ6IDAsXG4gICAgZXhlbXB0aW9uc0FwcGxpZWQ6IFtdLFxuICB9O1xufVxuXG4vKipcbiAqIEJ1aWxkIGNvbW1vbiByZXF1ZXN0IGhlYWRlcnMgZm9yIGNvbXBsaWFuY2UgY2FsbHMuXG4gKi9cbmZ1bmN0aW9uIGJ1aWxkSGVhZGVycyhvcmdJZDogc3RyaW5nLCBhdXRoSGVhZGVyOiBzdHJpbmcpOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+IHtcbiAgY29uc3QgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHtcbiAgICAneC1vcmctaWQnOiBvcmdJZCxcbiAgICAneC1pbnRlcm5hbC1zZXJ2aWNlJzogJ3RydWUnLFxuICB9O1xuICBpZiAoYXV0aEhlYWRlcikgaGVhZGVycy5BdXRob3JpemF0aW9uID0gYXV0aEhlYWRlcjtcbiAgcmV0dXJuIGhlYWRlcnM7XG59XG5cbi8qKlxuICogQ3JlYXRlIGEgY29tcGxpYW5jZSBjbGllbnQuXG4gKlxuICogSU1QT1JUQU5UOiBUaGlzIGNsaWVudCBpcyBmYWlsLWNsb3NlZCDigJQgaWYgdGhlIGNvbXBsaWFuY2Ugc2VydmljZSBpc1xuICogdW5yZWFjaGFibGUgb3IgcmV0dXJucyBhbiBlcnJvciwgdGhlIGVycm9yIHByb3BhZ2F0ZXMgYW5kIHRoZSBjYWxsaW5nXG4gKiBvcGVyYXRpb24gKHBsdWdpbiB1cGxvYWQsIHBpcGVsaW5lIGNyZWF0ZSkgaXMgcmVqZWN0ZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVDb21wbGlhbmNlQ2xpZW50KGNvbmZpZz86IFBhcnRpYWw8U2VydmljZUNvbmZpZz4pOiBDb21wbGlhbmNlQ2xpZW50IHtcbiAgY29uc3Qgc2VydmljZUNvbmZpZzogU2VydmljZUNvbmZpZyA9IHtcbiAgICBob3N0OiBjb25maWc/Lmhvc3QgPz8gcHJvY2Vzcy5lbnYuQ09NUExJQU5DRV9TRVJWSUNFX0hPU1QgPz8gJ2NvbXBsaWFuY2UnLFxuICAgIHBvcnQ6IGNvbmZpZz8ucG9ydCA/PyBwYXJzZUludChwcm9jZXNzLmVudi5DT01QTElBTkNFX1NFUlZJQ0VfUE9SVCA/PyAnMzAwMCcsIDEwKSxcbiAgfTtcblxuICBjb25zdCBjbGllbnQgPSBuZXcgSW50ZXJuYWxIdHRwQ2xpZW50KHNlcnZpY2VDb25maWcpO1xuXG4gIC8qKlxuICAgKiBWYWxpZGF0ZSByZXNwb25zZSBzaGFwZSArIHN0YXR1cy4gVGhlIEhUVFAgY2xpZW50IGRvZXNuJ3QgdGhyb3cgb24gbm9uLTJ4eFxuICAgKiAoaXQganVzdCByZXR1cm5zIHRoZSBib2R5KSwgc28gd2l0aG91dCB0aGlzIGFuIGF1dGggZmFpbHVyZSAvIHJvdXRlIG1pc3NcbiAgICogc2lsZW50bHkgcHJvZHVjZWQgYHJlc3BvbnNlLmJvZHkuZGF0YSA9PT0gdW5kZWZpbmVkYCBhbmQgdGhlIGNhbGxlclxuICAgKiBjcmFzaGVkIG9uIGAuYmxvY2tlZGAuIE5vdyBub24tMnh4IHN1cmZhY2VzIGFzIGEgdGhyb3duIGVycm9yIHRoYXQgdGhlXG4gICAqIG91dGVyIHRyeS9jYXRjaCBjYW4gdHVybiBpbnRvIGVpdGhlciBmYWlsLWNsb3NlZCAoZGVmYXVsdCkgb3JcbiAgICogQ09NUExJQU5DRV9CWVBBU1MgKGZhaWwtb3BlbikuXG4gICAqL1xuICBmdW5jdGlvbiB1bndyYXAoXG4gICAgcmVzcG9uc2U6IHsgc3RhdHVzQ29kZTogbnVtYmVyOyBib2R5OiB7IHN1Y2Nlc3M/OiBib29sZWFuOyBkYXRhPzogQ29tcGxpYW5jZUNoZWNrUmVzdWx0OyBtZXNzYWdlPzogc3RyaW5nIH0gfSxcbiAgICBvcDogc3RyaW5nLFxuICApOiBDb21wbGlhbmNlQ2hlY2tSZXN1bHQge1xuICAgIGlmIChyZXNwb25zZS5zdGF0dXNDb2RlIDwgMjAwIHx8IHJlc3BvbnNlLnN0YXR1c0NvZGUgPj0gMzAwKSB7XG4gICAgICBjb25zdCBtc2cgPSByZXNwb25zZS5ib2R5Py5tZXNzYWdlID8/IGBIVFRQICR7cmVzcG9uc2Uuc3RhdHVzQ29kZX1gO1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBjb21wbGlhbmNlICR7b3B9IGZhaWxlZDogJHttc2d9YCk7XG4gICAgfVxuICAgIGlmICghcmVzcG9uc2UuYm9keT8uZGF0YSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBjb21wbGlhbmNlICR7b3B9IHJldHVybmVkIG5vIGRhdGEgKHN0YXR1cyAke3Jlc3BvbnNlLnN0YXR1c0NvZGV9KWApO1xuICAgIH1cbiAgICByZXR1cm4gcmVzcG9uc2UuYm9keS5kYXRhO1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBhc3luYyB2YWxpZGF0ZVBsdWdpbihvcmdJZCwgYXR0cmlidXRlcywgYXV0aEhlYWRlciwgZW50aXR5SWQsIGVudGl0eU5hbWUsIGFjdGlvbikge1xuICAgICAgdHJ5IHtcbiAgICAgICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBjbGllbnQucG9zdDx7IHN1Y2Nlc3M6IGJvb2xlYW47IGRhdGE6IENvbXBsaWFuY2VDaGVja1Jlc3VsdDsgbWVzc2FnZT86IHN0cmluZyB9PihcbiAgICAgICAgICAnL2NvbXBsaWFuY2UvdmFsaWRhdGUvcGx1Z2luJyxcbiAgICAgICAgICB7IGF0dHJpYnV0ZXMsIGVudGl0eUlkLCBlbnRpdHlOYW1lLCBhY3Rpb246IGFjdGlvbiA/PyAndXBsb2FkJyB9LFxuICAgICAgICAgIHsgaGVhZGVyczogYnVpbGRIZWFkZXJzKG9yZ0lkLCBhdXRoSGVhZGVyKSB9LFxuICAgICAgICApO1xuICAgICAgICByZXR1cm4gdW53cmFwKHJlc3BvbnNlLCAndmFsaWRhdGVQbHVnaW4nKTtcbiAgICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICAgIGlmIChDT01QTElBTkNFX0JZUEFTUykgcmV0dXJuIGJ5cGFzc1Jlc3VsdCh7IG9yZ0lkLCBlbnRpdHlUeXBlOiAncGx1Z2luJywgZW50aXR5SWQsIGVudGl0eU5hbWUgfSk7XG4gICAgICAgIHRocm93IGVycm9yO1xuICAgICAgfVxuICAgIH0sXG5cbiAgICBhc3luYyB2YWxpZGF0ZVBpcGVsaW5lKG9yZ0lkLCBhdHRyaWJ1dGVzLCBhdXRoSGVhZGVyLCBlbnRpdHlJZCwgZW50aXR5TmFtZSwgYWN0aW9uKSB7XG4gICAgICB0cnkge1xuICAgICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGNsaWVudC5wb3N0PHsgc3VjY2VzczogYm9vbGVhbjsgZGF0YTogQ29tcGxpYW5jZUNoZWNrUmVzdWx0OyBtZXNzYWdlPzogc3RyaW5nIH0+KFxuICAgICAgICAgICcvY29tcGxpYW5jZS92YWxpZGF0ZS9waXBlbGluZScsXG4gICAgICAgICAgeyBhdHRyaWJ1dGVzLCBlbnRpdHlJZCwgZW50aXR5TmFtZSwgYWN0aW9uOiBhY3Rpb24gPz8gJ2NyZWF0ZScgfSxcbiAgICAgICAgICB7IGhlYWRlcnM6IGJ1aWxkSGVhZGVycyhvcmdJZCwgYXV0aEhlYWRlcikgfSxcbiAgICAgICAgKTtcbiAgICAgICAgcmV0dXJuIHVud3JhcChyZXNwb25zZSwgJ3ZhbGlkYXRlUGlwZWxpbmUnKTtcbiAgICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICAgIGlmIChDT01QTElBTkNFX0JZUEFTUykgcmV0dXJuIGJ5cGFzc1Jlc3VsdCh7IG9yZ0lkLCBlbnRpdHlUeXBlOiAncGlwZWxpbmUnLCBlbnRpdHlJZCwgZW50aXR5TmFtZSB9KTtcbiAgICAgICAgdGhyb3cgZXJyb3I7XG4gICAgICB9XG4gICAgfSxcblxuICAgIGFzeW5jIGRyeVJ1blBsdWdpbihvcmdJZCwgYXR0cmlidXRlcywgYXV0aEhlYWRlcikge1xuICAgICAgdHJ5IHtcbiAgICAgICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBjbGllbnQucG9zdDx7IHN1Y2Nlc3M6IGJvb2xlYW47IGRhdGE6IENvbXBsaWFuY2VDaGVja1Jlc3VsdDsgbWVzc2FnZT86IHN0cmluZyB9PihcbiAgICAgICAgICAnL2NvbXBsaWFuY2UvdmFsaWRhdGUvcGx1Z2luL2RyeS1ydW4nLFxuICAgICAgICAgIHsgYXR0cmlidXRlcyB9LFxuICAgICAgICAgIHsgaGVhZGVyczogYnVpbGRIZWFkZXJzKG9yZ0lkLCBhdXRoSGVhZGVyKSB9LFxuICAgICAgICApO1xuICAgICAgICByZXR1cm4gdW53cmFwKHJlc3BvbnNlLCAnZHJ5UnVuUGx1Z2luJyk7XG4gICAgICB9IGNhdGNoIChlcnJvcikge1xuICAgICAgICBpZiAoQ09NUExJQU5DRV9CWVBBU1MpIHJldHVybiBieXBhc3NSZXN1bHQoeyBvcmdJZCwgZW50aXR5VHlwZTogJ3BsdWdpbicsIGRyeVJ1bjogdHJ1ZSB9KTtcbiAgICAgICAgdGhyb3cgZXJyb3I7XG4gICAgICB9XG4gICAgfSxcblxuICAgIGFzeW5jIGRyeVJ1blBpcGVsaW5lKG9yZ0lkLCBhdHRyaWJ1dGVzLCBhdXRoSGVhZGVyKSB7XG4gICAgICB0cnkge1xuICAgICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGNsaWVudC5wb3N0PHsgc3VjY2VzczogYm9vbGVhbjsgZGF0YTogQ29tcGxpYW5jZUNoZWNrUmVzdWx0OyBtZXNzYWdlPzogc3RyaW5nIH0+KFxuICAgICAgICAgICcvY29tcGxpYW5jZS92YWxpZGF0ZS9waXBlbGluZS9kcnktcnVuJyxcbiAgICAgICAgICB7IGF0dHJpYnV0ZXMgfSxcbiAgICAgICAgICB7IGhlYWRlcnM6IGJ1aWxkSGVhZGVycyhvcmdJZCwgYXV0aEhlYWRlcikgfSxcbiAgICAgICAgKTtcbiAgICAgICAgcmV0dXJuIHVud3JhcChyZXNwb25zZSwgJ2RyeVJ1blBpcGVsaW5lJyk7XG4gICAgICB9IGNhdGNoIChlcnJvcikge1xuICAgICAgICBpZiAoQ09NUExJQU5DRV9CWVBBU1MpIHJldHVybiBieXBhc3NSZXN1bHQoeyBvcmdJZCwgZW50aXR5VHlwZTogJ3BpcGVsaW5lJywgZHJ5UnVuOiB0cnVlIH0pO1xuICAgICAgICB0aHJvdyBlcnJvcjtcbiAgICAgIH1cbiAgICB9LFxuICB9O1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VydmljZXMvY29tcGxpYW5jZS1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUV0RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFbEQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFFakQ7OztHQUdHO0FBQ0gsTUFBTSxpQkFBaUIsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQixLQUFLLE1BQU0sQ0FBQztBQW1FbkU7OztHQUdHO0FBQ0gsU0FBUyxZQUFZLENBQUMsT0FBZ0M7SUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNqRixPQUFPO1FBQ0wsTUFBTSxFQUFFLElBQUk7UUFDWixPQUFPLEVBQUUsS0FBSztRQUNkLFVBQVUsRUFBRSxFQUFFO1FBQ2QsUUFBUSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxnREFBZ0QsRUFBRSxDQUFDO1FBQ3pMLGNBQWMsRUFBRSxDQUFDO1FBQ2pCLFlBQVksRUFBRSxDQUFDO1FBQ2YsaUJBQWlCLEVBQUUsRUFBRTtLQUN0QixDQUFDO0FBQ0osQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBUyxZQUFZLENBQUMsS0FBYSxFQUFFLFVBQWtCO0lBQ3JELE1BQU0sT0FBTyxHQUEyQjtRQUN0QyxVQUFVLEVBQUUsS0FBSztLQUNsQixDQUFDO0lBQ0YsOEVBQThFO0lBQzlFLCtFQUErRTtJQUMvRSwrREFBK0Q7SUFDL0QsSUFBSSxVQUFVO1FBQUUsT0FBTyxDQUFDLGFBQWEsR0FBRyxVQUFVLENBQUM7SUFDbkQsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FBQyxNQUErQjtJQUNwRSxNQUFNLGFBQWEsR0FBa0I7UUFDbkMsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsSUFBSSxZQUFZO1FBQ3pFLElBQUksRUFBRSxNQUFNLEVBQUUsSUFBSSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7S0FDbEYsQ0FBQztJQUVGLE1BQU0sTUFBTSxHQUFHLElBQUksa0JBQWtCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFFckQ7Ozs7Ozs7T0FPRztJQUNILFNBQVMsTUFBTSxDQUNiLFFBQTZHLEVBQzdHLEVBQVU7UUFFVixJQUFJLFFBQVEsQ0FBQyxVQUFVLEdBQUcsR0FBRyxJQUFJLFFBQVEsQ0FBQyxVQUFVLElBQUksR0FBRyxFQUFFLENBQUM7WUFDNUQsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLElBQUksRUFBRSxPQUFPLElBQUksUUFBUSxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDcEUsTUFBTSxJQUFJLEtBQUssQ0FBQyxjQUFjLEVBQUUsWUFBWSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3JELENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLGNBQWMsRUFBRSw2QkFBNkIsUUFBUSxDQUFDLFVBQVUsR0FBRyxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7SUFDNUIsQ0FBQztJQUVELE9BQU87UUFDTCxLQUFLLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsTUFBTTtZQUM5RSxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUNoQyw2QkFBNkIsRUFDN0IsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsTUFBTSxJQUFJLFFBQVEsRUFBRSxFQUNoRSxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxFQUFFLENBQzdDLENBQUM7Z0JBQ0YsT0FBTyxNQUFNLENBQUMsUUFBUSxFQUFFLGdCQUFnQixDQUFDLENBQUM7WUFDNUMsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxpQkFBaUI7b0JBQUUsT0FBTyxZQUFZLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztnQkFDbEcsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1FBQ0gsQ0FBQztRQUVELEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU07WUFDaEYsSUFBSSxDQUFDO2dCQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksQ0FDaEMsK0JBQStCLEVBQy9CLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLE1BQU0sSUFBSSxRQUFRLEVBQUUsRUFDaEUsRUFBRSxPQUFPLEVBQUUsWUFBWSxDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsRUFBRSxDQUM3QyxDQUFDO2dCQUNGLE9BQU8sTUFBTSxDQUFDLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO1lBQzlDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksaUJBQWlCO29CQUFFLE9BQU8sWUFBWSxDQUFDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7Z0JBQ3BHLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7UUFFRCxLQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsVUFBVTtZQUM5QyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUNoQyxxQ0FBcUMsRUFDckMsRUFBRSxVQUFVLEVBQUUsRUFDZCxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxFQUFFLENBQzdDLENBQUM7Z0JBQ0YsT0FBTyxNQUFNLENBQUMsUUFBUSxFQUFFLGNBQWMsQ0FBQyxDQUFDO1lBQzFDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksaUJBQWlCO29CQUFFLE9BQU8sWUFBWSxDQUFDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQzFGLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7UUFFRCxLQUFLLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsVUFBVTtZQUNoRCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUNoQyx1Q0FBdUMsRUFDdkMsRUFBRSxVQUFVLEVBQUUsRUFDZCxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxFQUFFLENBQzdDLENBQUM7Z0JBQ0YsT0FBTyxNQUFNLENBQUMsUUFBUSxFQUFFLGdCQUFnQixDQUFDLENBQUM7WUFDNUMsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxpQkFBaUI7b0JBQUUsT0FBTyxZQUFZLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDNUYsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1FBQ0gsQ0FBQztLQUNGLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IEludGVybmFsSHR0cENsaWVudCB9IGZyb20gJy4vaHR0cC1jbGllbnQuanMnO1xuaW1wb3J0IHR5cGUgeyBTZXJ2aWNlQ29uZmlnIH0gZnJvbSAnLi4vdHlwZXMvY29tbW9uLmpzJztcbmltcG9ydCB7IGNyZWF0ZUxvZ2dlciB9IGZyb20gJy4uL3V0aWxzL2xvZ2dlci5qcyc7XG5cbmNvbnN0IGxvZ2dlciA9IGNyZWF0ZUxvZ2dlcignY29tcGxpYW5jZS1jbGllbnQnKTtcblxuLyoqXG4gKiBXaGVuIHRydWUsIGNvbXBsaWFuY2UgY2hlY2tzIGFyZSBieXBhc3NlZCBpZiB0aGUgc2VydmljZSBpcyB1bmF2YWlsYWJsZVxuICogKGZhaWwtb3BlbikuIERlZmF1bHQgaXMgZmFpbC1jbG9zZWQgKGVycm9ycyBwcm9wYWdhdGUgYW5kIGJsb2NrIHRoZSBvcGVyYXRpb24pLlxuICovXG5jb25zdCBDT01QTElBTkNFX0JZUEFTUyA9IHByb2Nlc3MuZW52LkNPTVBMSUFOQ0VfQllQQVNTID09PSAndHJ1ZSc7XG5cbi8qKlxuICogUmVzdWx0IG9mIGEgY29tcGxpYW5jZSB2YWxpZGF0aW9uIGNoZWNrLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIENvbXBsaWFuY2VDaGVja1Jlc3VsdCB7XG4gIHBhc3NlZDogYm9vbGVhbjtcbiAgdmlvbGF0aW9uczogQ29tcGxpYW5jZVZpb2xhdGlvbltdO1xuICB3YXJuaW5nczogQ29tcGxpYW5jZVZpb2xhdGlvbltdO1xuICBibG9ja2VkOiBib29sZWFuO1xuICBydWxlc0V2YWx1YXRlZDogbnVtYmVyO1xuICBydWxlc1NraXBwZWQ6IG51bWJlcjtcbiAgZXhlbXB0aW9uc0FwcGxpZWQ6IHN0cmluZ1tdO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIENvbXBsaWFuY2VWaW9sYXRpb24ge1xuICBydWxlSWQ6IHN0cmluZztcbiAgcnVsZU5hbWU6IHN0cmluZztcbiAgcG9saWN5SWQ/OiBzdHJpbmcgfCBudWxsO1xuICBmaWVsZDogc3RyaW5nO1xuICBvcGVyYXRvcjogc3RyaW5nO1xuICBleHBlY3RlZFZhbHVlOiB1bmtub3duO1xuICBhY3R1YWxWYWx1ZTogdW5rbm93bjtcbiAgc2V2ZXJpdHk6IHN0cmluZztcbiAgbWVzc2FnZTogc3RyaW5nO1xufVxuXG4vKipcbiAqIENvbXBsaWFuY2Ugc2VydmljZSBjbGllbnQgaW50ZXJmYWNlLlxuICogVXNlcyBmYWlsLWNsb3NlZCBkZXNpZ246IGVycm9ycyBwcm9wYWdhdGUgdG8gYmxvY2sgdGhlIG9wZXJhdGlvbi5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDb21wbGlhbmNlQ2xpZW50IHtcbiAgLyoqIFZhbGlkYXRlIHBsdWdpbiBhdHRyaWJ1dGVzIGFnYWluc3Qgb3JnIHJ1bGVzLiBUaHJvd3Mgb24gc2VydmljZSBlcnJvciAoZmFpbC1jbG9zZWQpLiAqL1xuICB2YWxpZGF0ZVBsdWdpbihcbiAgICBvcmdJZDogc3RyaW5nLFxuICAgIGF0dHJpYnV0ZXM6IFJlY29yZDxzdHJpbmcsIHVua25vd24+LFxuICAgIGF1dGhIZWFkZXI6IHN0cmluZyxcbiAgICBlbnRpdHlJZD86IHN0cmluZyxcbiAgICBlbnRpdHlOYW1lPzogc3RyaW5nLFxuICAgIGFjdGlvbj86IHN0cmluZyxcbiAgKTogUHJvbWlzZTxDb21wbGlhbmNlQ2hlY2tSZXN1bHQ+O1xuXG4gIC8qKiBWYWxpZGF0ZSBwaXBlbGluZSBhdHRyaWJ1dGVzIGFnYWluc3Qgb3JnIHJ1bGVzLiBUaHJvd3Mgb24gc2VydmljZSBlcnJvciAoZmFpbC1jbG9zZWQpLiAqL1xuICB2YWxpZGF0ZVBpcGVsaW5lKFxuICAgIG9yZ0lkOiBzdHJpbmcsXG4gICAgYXR0cmlidXRlczogUmVjb3JkPHN0cmluZywgdW5rbm93bj4sXG4gICAgYXV0aEhlYWRlcjogc3RyaW5nLFxuICAgIGVudGl0eUlkPzogc3RyaW5nLFxuICAgIGVudGl0eU5hbWU/OiBzdHJpbmcsXG4gICAgYWN0aW9uPzogc3RyaW5nLFxuICApOiBQcm9taXNlPENvbXBsaWFuY2VDaGVja1Jlc3VsdD47XG5cbiAgLyoqIFByZS1mbGlnaHQgY2hlY2sgZm9yIHBsdWdpbiAobm8gYXVkaXQsIG5vIG5vdGlmaWNhdGlvbikuICovXG4gIGRyeVJ1blBsdWdpbihcbiAgICBvcmdJZDogc3RyaW5nLFxuICAgIGF0dHJpYnV0ZXM6IFJlY29yZDxzdHJpbmcsIHVua25vd24+LFxuICAgIGF1dGhIZWFkZXI6IHN0cmluZyxcbiAgKTogUHJvbWlzZTxDb21wbGlhbmNlQ2hlY2tSZXN1bHQ+O1xuXG4gIC8qKiBQcmUtZmxpZ2h0IGNoZWNrIGZvciBwaXBlbGluZSAobm8gYXVkaXQsIG5vIG5vdGlmaWNhdGlvbikuICovXG4gIGRyeVJ1blBpcGVsaW5lKFxuICAgIG9yZ0lkOiBzdHJpbmcsXG4gICAgYXR0cmlidXRlczogUmVjb3JkPHN0cmluZywgdW5rbm93bj4sXG4gICAgYXV0aEhlYWRlcjogc3RyaW5nLFxuICApOiBQcm9taXNlPENvbXBsaWFuY2VDaGVja1Jlc3VsdD47XG59XG5cbi8qKlxuICogUmV0dXJuIGEgcGFzcy10aHJvdWdoIHJlc3VsdCB3aGVuIENPTVBMSUFOQ0VfQllQQVNTIGlzIGVuYWJsZWQgYW5kIHRoZVxuICogY29tcGxpYW5jZSBzZXJ2aWNlIGlzIHVucmVhY2hhYmxlLlxuICovXG5mdW5jdGlvbiBieXBhc3NSZXN1bHQoY29udGV4dDogUmVjb3JkPHN0cmluZywgdW5rbm93bj4pOiBDb21wbGlhbmNlQ2hlY2tSZXN1bHQge1xuICBsb2dnZXIud2FybignQ09NUExJQU5DRV9CWVBBU1M6IFNlcnZpY2UgdW5hdmFpbGFibGUsIGFsbG93aW5nIHJlcXVlc3QnLCBjb250ZXh0KTtcbiAgcmV0dXJuIHtcbiAgICBwYXNzZWQ6IHRydWUsXG4gICAgYmxvY2tlZDogZmFsc2UsXG4gICAgdmlvbGF0aW9uczogW10sXG4gICAgd2FybmluZ3M6IFt7IHJ1bGVJZDogJycsIHJ1bGVOYW1lOiAnJywgZmllbGQ6ICcnLCBvcGVyYXRvcjogJycsIGV4cGVjdGVkVmFsdWU6IG51bGwsIGFjdHVhbFZhbHVlOiBudWxsLCBzZXZlcml0eTogJ3dhcm5pbmcnLCBtZXNzYWdlOiAnQ29tcGxpYW5jZSBjaGVjayBza2lwcGVkIChzZXJ2aWNlIHVuYXZhaWxhYmxlKScgfV0sXG4gICAgcnVsZXNFdmFsdWF0ZWQ6IDAsXG4gICAgcnVsZXNTa2lwcGVkOiAwLFxuICAgIGV4ZW1wdGlvbnNBcHBsaWVkOiBbXSxcbiAgfTtcbn1cblxuLyoqXG4gKiBCdWlsZCBjb21tb24gcmVxdWVzdCBoZWFkZXJzIGZvciBjb21wbGlhbmNlIGNhbGxzLlxuICovXG5mdW5jdGlvbiBidWlsZEhlYWRlcnMob3JnSWQ6IHN0cmluZywgYXV0aEhlYWRlcjogc3RyaW5nKTogUmVjb3JkPHN0cmluZywgc3RyaW5nPiB7XG4gIGNvbnN0IGhlYWRlcnM6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7XG4gICAgJ3gtb3JnLWlkJzogb3JnSWQsXG4gIH07XG4gIC8vIE5PVEU6IHRoZSBvbGQgYHgtaW50ZXJuYWwtc2VydmljZTogdHJ1ZWAgaGVhZGVyIHdhcyByZW1vdmVkIOKAlCBpdCBpcyB0cnVzdGVkXG4gIC8vIGJ5IG5vdGhpbmcgKGl0IHdhcyBzcG9vZmFibGUpOyBjb21wbGlhbmNlIHJvdXRlcyBhdXRoZW50aWNhdGUgdGhlIGNhbGxlciB2aWFcbiAgLy8gdGhlIGBBdXRob3JpemF0aW9uYCBzZXJ2aWNlIEpXVCAoYHJlcXVpcmVTZXJ2aWNlUHJpbmNpcGFsYCkuXG4gIGlmIChhdXRoSGVhZGVyKSBoZWFkZXJzLkF1dGhvcml6YXRpb24gPSBhdXRoSGVhZGVyO1xuICByZXR1cm4gaGVhZGVycztcbn1cblxuLyoqXG4gKiBDcmVhdGUgYSBjb21wbGlhbmNlIGNsaWVudC5cbiAqXG4gKiBJTVBPUlRBTlQ6IFRoaXMgY2xpZW50IGlzIGZhaWwtY2xvc2VkIOKAlCBpZiB0aGUgY29tcGxpYW5jZSBzZXJ2aWNlIGlzXG4gKiB1bnJlYWNoYWJsZSBvciByZXR1cm5zIGFuIGVycm9yLCB0aGUgZXJyb3IgcHJvcGFnYXRlcyBhbmQgdGhlIGNhbGxpbmdcbiAqIG9wZXJhdGlvbiAocGx1Z2luIHVwbG9hZCwgcGlwZWxpbmUgY3JlYXRlKSBpcyByZWplY3RlZC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZUNvbXBsaWFuY2VDbGllbnQoY29uZmlnPzogUGFydGlhbDxTZXJ2aWNlQ29uZmlnPik6IENvbXBsaWFuY2VDbGllbnQge1xuICBjb25zdCBzZXJ2aWNlQ29uZmlnOiBTZXJ2aWNlQ29uZmlnID0ge1xuICAgIGhvc3Q6IGNvbmZpZz8uaG9zdCA/PyBwcm9jZXNzLmVudi5DT01QTElBTkNFX1NFUlZJQ0VfSE9TVCA/PyAnY29tcGxpYW5jZScsXG4gICAgcG9ydDogY29uZmlnPy5wb3J0ID8/IHBhcnNlSW50KHByb2Nlc3MuZW52LkNPTVBMSUFOQ0VfU0VSVklDRV9QT1JUID8/ICczMDAwJywgMTApLFxuICB9O1xuXG4gIGNvbnN0IGNsaWVudCA9IG5ldyBJbnRlcm5hbEh0dHBDbGllbnQoc2VydmljZUNvbmZpZyk7XG5cbiAgLyoqXG4gICAqIFZhbGlkYXRlIHJlc3BvbnNlIHNoYXBlICsgc3RhdHVzLiBUaGUgSFRUUCBjbGllbnQgZG9lc24ndCB0aHJvdyBvbiBub24tMnh4XG4gICAqIChpdCBqdXN0IHJldHVybnMgdGhlIGJvZHkpLCBzbyB3aXRob3V0IHRoaXMgYW4gYXV0aCBmYWlsdXJlIC8gcm91dGUgbWlzc1xuICAgKiBzaWxlbnRseSBwcm9kdWNlZCBgcmVzcG9uc2UuYm9keS5kYXRhID09PSB1bmRlZmluZWRgIGFuZCB0aGUgY2FsbGVyXG4gICAqIGNyYXNoZWQgb24gYC5ibG9ja2VkYC4gTm93IG5vbi0yeHggc3VyZmFjZXMgYXMgYSB0aHJvd24gZXJyb3IgdGhhdCB0aGVcbiAgICogb3V0ZXIgdHJ5L2NhdGNoIGNhbiB0dXJuIGludG8gZWl0aGVyIGZhaWwtY2xvc2VkIChkZWZhdWx0KSBvclxuICAgKiBDT01QTElBTkNFX0JZUEFTUyAoZmFpbC1vcGVuKS5cbiAgICovXG4gIGZ1bmN0aW9uIHVud3JhcChcbiAgICByZXNwb25zZTogeyBzdGF0dXNDb2RlOiBudW1iZXI7IGJvZHk6IHsgc3VjY2Vzcz86IGJvb2xlYW47IGRhdGE/OiBDb21wbGlhbmNlQ2hlY2tSZXN1bHQ7IG1lc3NhZ2U/OiBzdHJpbmcgfSB9LFxuICAgIG9wOiBzdHJpbmcsXG4gICk6IENvbXBsaWFuY2VDaGVja1Jlc3VsdCB7XG4gICAgaWYgKHJlc3BvbnNlLnN0YXR1c0NvZGUgPCAyMDAgfHwgcmVzcG9uc2Uuc3RhdHVzQ29kZSA+PSAzMDApIHtcbiAgICAgIGNvbnN0IG1zZyA9IHJlc3BvbnNlLmJvZHk/Lm1lc3NhZ2UgPz8gYEhUVFAgJHtyZXNwb25zZS5zdGF0dXNDb2RlfWA7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYGNvbXBsaWFuY2UgJHtvcH0gZmFpbGVkOiAke21zZ31gKTtcbiAgICB9XG4gICAgaWYgKCFyZXNwb25zZS5ib2R5Py5kYXRhKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYGNvbXBsaWFuY2UgJHtvcH0gcmV0dXJuZWQgbm8gZGF0YSAoc3RhdHVzICR7cmVzcG9uc2Uuc3RhdHVzQ29kZX0pYCk7XG4gICAgfVxuICAgIHJldHVybiByZXNwb25zZS5ib2R5LmRhdGE7XG4gIH1cblxuICByZXR1cm4ge1xuICAgIGFzeW5jIHZhbGlkYXRlUGx1Z2luKG9yZ0lkLCBhdHRyaWJ1dGVzLCBhdXRoSGVhZGVyLCBlbnRpdHlJZCwgZW50aXR5TmFtZSwgYWN0aW9uKSB7XG4gICAgICB0cnkge1xuICAgICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGNsaWVudC5wb3N0PHsgc3VjY2VzczogYm9vbGVhbjsgZGF0YTogQ29tcGxpYW5jZUNoZWNrUmVzdWx0OyBtZXNzYWdlPzogc3RyaW5nIH0+KFxuICAgICAgICAgICcvY29tcGxpYW5jZS92YWxpZGF0ZS9wbHVnaW4nLFxuICAgICAgICAgIHsgYXR0cmlidXRlcywgZW50aXR5SWQsIGVudGl0eU5hbWUsIGFjdGlvbjogYWN0aW9uID8/ICd1cGxvYWQnIH0sXG4gICAgICAgICAgeyBoZWFkZXJzOiBidWlsZEhlYWRlcnMob3JnSWQsIGF1dGhIZWFkZXIpIH0sXG4gICAgICAgICk7XG4gICAgICAgIHJldHVybiB1bndyYXAocmVzcG9uc2UsICd2YWxpZGF0ZVBsdWdpbicpO1xuICAgICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgICAgaWYgKENPTVBMSUFOQ0VfQllQQVNTKSByZXR1cm4gYnlwYXNzUmVzdWx0KHsgb3JnSWQsIGVudGl0eVR5cGU6ICdwbHVnaW4nLCBlbnRpdHlJZCwgZW50aXR5TmFtZSB9KTtcbiAgICAgICAgdGhyb3cgZXJyb3I7XG4gICAgICB9XG4gICAgfSxcblxuICAgIGFzeW5jIHZhbGlkYXRlUGlwZWxpbmUob3JnSWQsIGF0dHJpYnV0ZXMsIGF1dGhIZWFkZXIsIGVudGl0eUlkLCBlbnRpdHlOYW1lLCBhY3Rpb24pIHtcbiAgICAgIHRyeSB7XG4gICAgICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgY2xpZW50LnBvc3Q8eyBzdWNjZXNzOiBib29sZWFuOyBkYXRhOiBDb21wbGlhbmNlQ2hlY2tSZXN1bHQ7IG1lc3NhZ2U/OiBzdHJpbmcgfT4oXG4gICAgICAgICAgJy9jb21wbGlhbmNlL3ZhbGlkYXRlL3BpcGVsaW5lJyxcbiAgICAgICAgICB7IGF0dHJpYnV0ZXMsIGVudGl0eUlkLCBlbnRpdHlOYW1lLCBhY3Rpb246IGFjdGlvbiA/PyAnY3JlYXRlJyB9LFxuICAgICAgICAgIHsgaGVhZGVyczogYnVpbGRIZWFkZXJzKG9yZ0lkLCBhdXRoSGVhZGVyKSB9LFxuICAgICAgICApO1xuICAgICAgICByZXR1cm4gdW53cmFwKHJlc3BvbnNlLCAndmFsaWRhdGVQaXBlbGluZScpO1xuICAgICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgICAgaWYgKENPTVBMSUFOQ0VfQllQQVNTKSByZXR1cm4gYnlwYXNzUmVzdWx0KHsgb3JnSWQsIGVudGl0eVR5cGU6ICdwaXBlbGluZScsIGVudGl0eUlkLCBlbnRpdHlOYW1lIH0pO1xuICAgICAgICB0aHJvdyBlcnJvcjtcbiAgICAgIH1cbiAgICB9LFxuXG4gICAgYXN5bmMgZHJ5UnVuUGx1Z2luKG9yZ0lkLCBhdHRyaWJ1dGVzLCBhdXRoSGVhZGVyKSB7XG4gICAgICB0cnkge1xuICAgICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGNsaWVudC5wb3N0PHsgc3VjY2VzczogYm9vbGVhbjsgZGF0YTogQ29tcGxpYW5jZUNoZWNrUmVzdWx0OyBtZXNzYWdlPzogc3RyaW5nIH0+KFxuICAgICAgICAgICcvY29tcGxpYW5jZS92YWxpZGF0ZS9wbHVnaW4vZHJ5LXJ1bicsXG4gICAgICAgICAgeyBhdHRyaWJ1dGVzIH0sXG4gICAgICAgICAgeyBoZWFkZXJzOiBidWlsZEhlYWRlcnMob3JnSWQsIGF1dGhIZWFkZXIpIH0sXG4gICAgICAgICk7XG4gICAgICAgIHJldHVybiB1bndyYXAocmVzcG9uc2UsICdkcnlSdW5QbHVnaW4nKTtcbiAgICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICAgIGlmIChDT01QTElBTkNFX0JZUEFTUykgcmV0dXJuIGJ5cGFzc1Jlc3VsdCh7IG9yZ0lkLCBlbnRpdHlUeXBlOiAncGx1Z2luJywgZHJ5UnVuOiB0cnVlIH0pO1xuICAgICAgICB0aHJvdyBlcnJvcjtcbiAgICAgIH1cbiAgICB9LFxuXG4gICAgYXN5bmMgZHJ5UnVuUGlwZWxpbmUob3JnSWQsIGF0dHJpYnV0ZXMsIGF1dGhIZWFkZXIpIHtcbiAgICAgIHRyeSB7XG4gICAgICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgY2xpZW50LnBvc3Q8eyBzdWNjZXNzOiBib29sZWFuOyBkYXRhOiBDb21wbGlhbmNlQ2hlY2tSZXN1bHQ7IG1lc3NhZ2U/OiBzdHJpbmcgfT4oXG4gICAgICAgICAgJy9jb21wbGlhbmNlL3ZhbGlkYXRlL3BpcGVsaW5lL2RyeS1ydW4nLFxuICAgICAgICAgIHsgYXR0cmlidXRlcyB9LFxuICAgICAgICAgIHsgaGVhZGVyczogYnVpbGRIZWFkZXJzKG9yZ0lkLCBhdXRoSGVhZGVyKSB9LFxuICAgICAgICApO1xuICAgICAgICByZXR1cm4gdW53cmFwKHJlc3BvbnNlLCAnZHJ5UnVuUGlwZWxpbmUnKTtcbiAgICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICAgIGlmIChDT01QTElBTkNFX0JZUEFTUykgcmV0dXJuIGJ5cGFzc1Jlc3VsdCh7IG9yZ0lkLCBlbnRpdHlUeXBlOiAncGlwZWxpbmUnLCBkcnlSdW46IHRydWUgfSk7XG4gICAgICAgIHRocm93IGVycm9yO1xuICAgICAgfVxuICAgIH0sXG4gIH07XG59XG4iXX0=

package/lib/services/compliance-event-subscriber.js

@@ -1,11 +1,11 @@
 // Copyright 2026 Pipeline Builder Contributors
 // SPDX-License-Identifier: Apache-2.0
-import { enqueueComplianceEvent } from './compliance-queue.js';
 import { entityEvents } from './entity-events.js';
 import { InternalHttpClient } from './http-client.js';
 import { getServiceAuthHeader } from '../middleware/auth.js';
 import {} from '../types/common.js';
 import { createLogger } from '../utils/logger.js';
+import { emitCounter } from '../utils/metric-emitter.js';
 const logger = createLogger('compliance-events');
 /**
  * Registers an entity event subscriber that forwards events to the compliance service.
@@ -35,12 +35,25 @@ export function registerComplianceEventSubscriber(config, serviceName = 'entity-
                 // GUC. The compliance side enforces `requireAuth` +
                 // `requireServicePrincipal` — the previous `x-internal-service`
                 // header is no longer sufficient (and was spoofable).
+                //
+                // This HTTP notify is the SINGLE delivery channel for post-mutation
+                // re-validation (primary enforcement is the fail-CLOSED live
+                // validate path). A stable per-event `Idempotency-Key` makes the POST
+                // retry-safe in the http-client, so a transient 5xx/timeout is retried
+                // rather than dropped on the first attempt; compliance re-evaluation is
+                // naturally idempotent, so a duplicate delivery is harmless.
                 await client.post('/compliance/events/entity', event, {
-                    headers: { Authorization: getServiceAuthHeader({ serviceName, orgId: event.orgId, role: 'member' }) },
+                    headers: {
+                        'Authorization': getServiceAuthHeader({ serviceName, orgId: event.orgId, role: 'member' }),
+                        'Idempotency-Key': `${event.target}:${event.entityId}:${event.eventType}:${event.timestamp.toISOString()}`,
+                    },
                 });
             }
             catch (err) {
-                // Fire-and-forget: log and swallow. Compliance notification is non-fatal.
+                // Fire-and-forget: log + a drop metric so sustained loss is alertable
+                // (operators can't act on a warn line alone), then swallow — compliance
+                // notification is non-fatal to the originating mutation.
+                emitCounter('compliance_event_drop_total', { service: serviceName, target: event.target });
                 logger.warn('Failed to notify compliance service of entity event', {
                     target: event.target,
                     eventType: event.eventType,
@@ -48,17 +61,6 @@ export function registerComplianceEventSubscriber(config, serviceName = 'entity-
                     error: err instanceof Error ? err.message : String(err),
                 });
             }
-            // Also enqueue for async re-validation (catches rule changes after creation)
-            void enqueueComplianceEvent({
-                eventType: 'validate',
-                target: event.target,
-                entityId: event.entityId,
-                orgId: event.orgId,
-                parentOrgId: event.parentOrgId,
-                userId: event.userId,
-                attributes: event.attributes,
-                timestamp: event.timestamp.toISOString(),
-            });
         },
     };
     entityEvents.subscribe(subscriber);
@@ -67,4 +69,4 @@ export function registerComplianceEventSubscriber(config, serviceName = 'entity-
         port: serviceConfig.port,
     });
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1ldmVudC1zdWJzY3JpYmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcnZpY2VzL2NvbXBsaWFuY2UtZXZlbnQtc3Vic2NyaWJlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQy9ELE9BQU8sRUFBRSxZQUFZLEVBQWdELE1BQU0sb0JBQW9CLENBQUM7QUFDaEcsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDdEQsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDN0QsT0FBTyxFQUFzQixNQUFNLG9CQUFvQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUVsRCxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsbUJBQW1CLENBQUMsQ0FBQztBQUVqRDs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxVQUFVLGlDQUFpQyxDQUMvQyxNQUErQixFQUMvQixjQUFzQixlQUFlO0lBRXJDLE1BQU0sYUFBYSxHQUFrQjtRQUNuQyxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLFlBQVk7UUFDekUsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUJBQXVCLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztLQUNsRixDQUFDO0lBRUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUVyRCxNQUFNLFVBQVUsR0FBMEI7UUFDeEMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxLQUFrQjtZQUNwQyxJQUFJLENBQUM7Z0JBQ0gsZ0VBQWdFO2dCQUNoRSxrRUFBa0U7Z0JBQ2xFLG9EQUFvRDtnQkFDcEQsZ0VBQWdFO2dCQUNoRSxzREFBc0Q7Z0JBQ3RELE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxLQUFLLEVBQUU7b0JBQ3BELE9BQU8sRUFBRSxFQUFFLGFBQWEsRUFBRSxvQkFBb0IsQ0FBQyxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsRUFBRTtpQkFDdEcsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7Z0JBQ2IsMEVBQTBFO2dCQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxFQUFFO29CQUNqRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07b0JBQ3BCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztvQkFDMUIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO29CQUN4QixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDeEQsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUVELDZFQUE2RTtZQUM3RSxLQUFLLHNCQUFzQixDQUFDO2dCQUMxQixTQUFTLEVBQUUsVUFBVTtnQkFDckIsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUErQjtnQkFDN0MsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2dCQUN4QixLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQUs7Z0JBQ2xCLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztnQkFDOUIsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO2dCQUNwQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7Z0JBQzVCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxDQUFDLFdBQVcsRUFBRTthQUN6QyxDQUFDLENBQUM7UUFDTCxDQUFDO0tBQ0YsQ0FBQztJQUVGLFlBQVksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbkMsTUFBTSxDQUFDLElBQUksQ0FBQyx3Q0FBd0MsRUFBRTtRQUNwRCxJQUFJLEVBQUUsYUFBYSxDQUFDLElBQUk7UUFDeEIsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO0tBQ3pCLENBQUMsQ0FBQztBQUNMLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgZW5xdWV1ZUNvbXBsaWFuY2VFdmVudCB9IGZyb20gJy4vY29tcGxpYW5jZS1xdWV1ZS5qcyc7XG5pbXBvcnQgeyBlbnRpdHlFdmVudHMsIHR5cGUgRW50aXR5RXZlbnQsIHR5cGUgRW50aXR5RXZlbnRTdWJzY3JpYmVyIH0gZnJvbSAnLi9lbnRpdHktZXZlbnRzLmpzJztcbmltcG9ydCB7IEludGVybmFsSHR0cENsaWVudCB9IGZyb20gJy4vaHR0cC1jbGllbnQuanMnO1xuaW1wb3J0IHsgZ2V0U2VydmljZUF1dGhIZWFkZXIgfSBmcm9tICcuLi9taWRkbGV3YXJlL2F1dGguanMnO1xuaW1wb3J0IHsgdHlwZSBTZXJ2aWNlQ29uZmlnIH0gZnJvbSAnLi4vdHlwZXMvY29tbW9uLmpzJztcbmltcG9ydCB7IGNyZWF0ZUxvZ2dlciB9IGZyb20gJy4uL3V0aWxzL2xvZ2dlci5qcyc7XG5cbmNvbnN0IGxvZ2dlciA9IGNyZWF0ZUxvZ2dlcignY29tcGxpYW5jZS1ldmVudHMnKTtcblxuLyoqXG4gKiBSZWdpc3RlcnMgYW4gZW50aXR5IGV2ZW50IHN1YnNjcmliZXIgdGhhdCBmb3J3YXJkcyBldmVudHMgdG8gdGhlIGNvbXBsaWFuY2Ugc2VydmljZS5cbiAqXG4gKiBDYWxsIHRoaXMgYXQgc2VydmljZSBzdGFydHVwIChpbiBpbmRleC50cykgdG8gZW5hYmxlIGF1dG9tYXRpYyBjb21wbGlhbmNlXG4gKiBub3RpZmljYXRpb24gb24gZW50aXR5IG11dGF0aW9ucy4gRXZlbnRzIGFyZSBmaXJlLWFuZC1mb3JnZXQg4oCUIGZhaWx1cmVzXG4gKiBhcmUgbG9nZ2VkIGJ1dCBuZXZlciBibG9jayB0aGUgb3JpZ2luYWwgcmVxdWVzdC5cbiAqXG4gKiBAcGFyYW0gY29uZmlnIC0gT3B0aW9uYWwgc2VydmljZSBjb25maWcgb3ZlcnJpZGUgKGRlZmF1bHRzIHRvIENPTVBMSUFOQ0VfU0VSVklDRV9IT1NUL1BPUlQgZW52IHZhcnMpXG4gKiBAcGFyYW0gc2VydmljZU5hbWUgLSBTZXJ2aWNlIGlkZW50aWZpZXIgYmFrZWQgaW50byB0aGUgc2lnbmVkIEpXVCdzIGBzdWJgXG4gKiAgIChlLmcuICdwaXBlbGluZScsICdwbHVnaW4nKS4gVGhlIGNvbXBsaWFuY2Ugcm91dGUgcmVxdWlyZXMgYSBzZXJ2aWNlXG4gKiAgIHByaW5jaXBhbCDigJQgYSBzcG9vZmFibGUgYHgtaW50ZXJuYWwtc2VydmljZTogdHJ1ZWAgaGVhZGVyIGlzIG5vIGxvbmdlclxuICogICBhY2NlcHRlZC4gRGVmYXVsdHMgdG8gYSBnZW5lcmljICdlbnRpdHktZXZlbnRzJyB3aGVuIHVuc3BlY2lmaWVkLCBidXRcbiAqICAgY2FsbGVycyBzaG91bGQgcGFzcyB0aGVpciBzZXJ2aWNlIG5hbWUgZm9yIGFjY3VyYXRlIGF1ZGl0IHRyYWlscy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlZ2lzdGVyQ29tcGxpYW5jZUV2ZW50U3Vic2NyaWJlcihcbiAgY29uZmlnPzogUGFydGlhbDxTZXJ2aWNlQ29uZmlnPixcbiAgc2VydmljZU5hbWU6IHN0cmluZyA9ICdlbnRpdHktZXZlbnRzJyxcbik6IHZvaWQge1xuICBjb25zdCBzZXJ2aWNlQ29uZmlnOiBTZXJ2aWNlQ29uZmlnID0ge1xuICAgIGhvc3Q6IGNvbmZpZz8uaG9zdCA/PyBwcm9jZXNzLmVudi5DT01QTElBTkNFX1NFUlZJQ0VfSE9TVCA/PyAnY29tcGxpYW5jZScsXG4gICAgcG9ydDogY29uZmlnPy5wb3J0ID8/IHBhcnNlSW50KHByb2Nlc3MuZW52LkNPTVBMSUFOQ0VfU0VSVklDRV9QT1JUID8/ICczMDAwJywgMTApLFxuICB9O1xuXG4gIGNvbnN0IGNsaWVudCA9IG5ldyBJbnRlcm5hbEh0dHBDbGllbnQoc2VydmljZUNvbmZpZyk7XG5cbiAgY29uc3Qgc3Vic2NyaWJlcjogRW50aXR5RXZlbnRTdWJzY3JpYmVyID0ge1xuICAgIGFzeW5jIG9uRW50aXR5RXZlbnQoZXZlbnQ6IEVudGl0eUV2ZW50KTogUHJvbWlzZTx2b2lkPiB7XG4gICAgICB0cnkge1xuICAgICAgICAvLyBNaW50IGEgcGVyLWV2ZW50IHNlcnZpY2UgSldUIHNjb3BlZCB0byB0aGUgZXZlbnQncyBvcmcgc28gdGhlXG4gICAgICAgIC8vIGNvbXBsaWFuY2Ugcm91dGUncyBgcnVuV2l0aFRlbmFudENvbnRleHRgIHNlZXMgdGhlIHJpZ2h0IHRlbmFudFxuICAgICAgICAvLyBHVUMuIFRoZSBjb21wbGlhbmNlIHNpZGUgZW5mb3JjZXMgYHJlcXVpcmVBdXRoYCArXG4gICAgICAgIC8vIGByZXF1aXJlU2VydmljZVByaW5jaXBhbGAg4oCUIHRoZSBwcmV2aW91cyBgeC1pbnRlcm5hbC1zZXJ2aWNlYFxuICAgICAgICAvLyBoZWFkZXIgaXMgbm8gbG9uZ2VyIHN1ZmZpY2llbnQgKGFuZCB3YXMgc3Bvb2ZhYmxlKS5cbiAgICAgICAgYXdhaXQgY2xpZW50LnBvc3QoJy9jb21wbGlhbmNlL2V2ZW50cy9lbnRpdHknLCBldmVudCwge1xuICAgICAgICAgIGhlYWRlcnM6IHsgQXV0aG9yaXphdGlvbjogZ2V0U2VydmljZUF1dGhIZWFkZXIoeyBzZXJ2aWNlTmFtZSwgb3JnSWQ6IGV2ZW50Lm9yZ0lkLCByb2xlOiAnbWVtYmVyJyB9KSB9LFxuICAgICAgICB9KTtcbiAgICAgIH0gY2F0Y2ggKGVycikge1xuICAgICAgICAvLyBGaXJlLWFuZC1mb3JnZXQ6IGxvZyBhbmQgc3dhbGxvdy4gQ29tcGxpYW5jZSBub3RpZmljYXRpb24gaXMgbm9uLWZhdGFsLlxuICAgICAgICBsb2dnZXIud2FybignRmFpbGVkIHRvIG5vdGlmeSBjb21wbGlhbmNlIHNlcnZpY2Ugb2YgZW50aXR5IGV2ZW50Jywge1xuICAgICAgICAgIHRhcmdldDogZXZlbnQudGFyZ2V0LFxuICAgICAgICAgIGV2ZW50VHlwZTogZXZlbnQuZXZlbnRUeXBlLFxuICAgICAgICAgIGVudGl0eUlkOiBldmVudC5lbnRpdHlJZCxcbiAgICAgICAgICBlcnJvcjogZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6IFN0cmluZyhlcnIpLFxuICAgICAgICB9KTtcbiAgICAgIH1cblxuICAgICAgLy8gQWxzbyBlbnF1ZXVlIGZvciBhc3luYyByZS12YWxpZGF0aW9uIChjYXRjaGVzIHJ1bGUgY2hhbmdlcyBhZnRlciBjcmVhdGlvbilcbiAgICAgIHZvaWQgZW5xdWV1ZUNvbXBsaWFuY2VFdmVudCh7XG4gICAgICAgIGV2ZW50VHlwZTogJ3ZhbGlkYXRlJyxcbiAgICAgICAgdGFyZ2V0OiBldmVudC50YXJnZXQgYXMgJ3BsdWdpbicgfCAncGlwZWxpbmUnLFxuICAgICAgICBlbnRpdHlJZDogZXZlbnQuZW50aXR5SWQsXG4gICAgICAgIG9yZ0lkOiBldmVudC5vcmdJZCxcbiAgICAgICAgcGFyZW50T3JnSWQ6IGV2ZW50LnBhcmVudE9yZ0lkLFxuICAgICAgICB1c2VySWQ6IGV2ZW50LnVzZXJJZCxcbiAgICAgICAgYXR0cmlidXRlczogZXZlbnQuYXR0cmlidXRlcyxcbiAgICAgICAgdGltZXN0YW1wOiBldmVudC50aW1lc3RhbXAudG9JU09TdHJpbmcoKSxcbiAgICAgIH0pO1xuICAgIH0sXG4gIH07XG5cbiAgZW50aXR5RXZlbnRzLnN1YnNjcmliZShzdWJzY3JpYmVyKTtcbiAgbG9nZ2VyLmluZm8oJ0NvbXBsaWFuY2UgZXZlbnQgc3Vic2NyaWJlciByZWdpc3RlcmVkJywge1xuICAgIGhvc3Q6IHNlcnZpY2VDb25maWcuaG9zdCxcbiAgICBwb3J0OiBzZXJ2aWNlQ29uZmlnLnBvcnQsXG4gIH0pO1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1ldmVudC1zdWJzY3JpYmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlcnZpY2VzL2NvbXBsaWFuY2UtZXZlbnQtc3Vic2NyaWJlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxZQUFZLEVBQWdELE1BQU0sb0JBQW9CLENBQUM7QUFDaEcsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDdEQsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDN0QsT0FBTyxFQUFzQixNQUFNLG9CQUFvQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFekQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFFakQ7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILE1BQU0sVUFBVSxpQ0FBaUMsQ0FDL0MsTUFBK0IsRUFDL0IsY0FBc0IsZUFBZTtJQUVyQyxNQUFNLGFBQWEsR0FBa0I7UUFDbkMsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsSUFBSSxZQUFZO1FBQ3pFLElBQUksRUFBRSxNQUFNLEVBQUUsSUFBSSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7S0FDbEYsQ0FBQztJQUVGLE1BQU0sTUFBTSxHQUFHLElBQUksa0JBQWtCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFFckQsTUFBTSxVQUFVLEdBQTBCO1FBQ3hDLEtBQUssQ0FBQyxhQUFhLENBQUMsS0FBa0I7WUFDcEMsSUFBSSxDQUFDO2dCQUNILGdFQUFnRTtnQkFDaEUsa0VBQWtFO2dCQUNsRSxvREFBb0Q7Z0JBQ3BELGdFQUFnRTtnQkFDaEUsc0RBQXNEO2dCQUN0RCxFQUFFO2dCQUNGLG9FQUFvRTtnQkFDcEUsNkRBQTZEO2dCQUM3RCxzRUFBc0U7Z0JBQ3RFLHVFQUF1RTtnQkFDdkUsd0VBQXdFO2dCQUN4RSw2REFBNkQ7Z0JBQzdELE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxLQUFLLEVBQUU7b0JBQ3BELE9BQU8sRUFBRTt3QkFDUCxlQUFlLEVBQUUsb0JBQW9CLENBQUMsRUFBRSxXQUFXLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxDQUFDO3dCQUMxRixpQkFBaUIsRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUMsU0FBUyxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLEVBQUU7cUJBQzNHO2lCQUNGLENBQUMsQ0FBQztZQUNMLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNiLHNFQUFzRTtnQkFDdEUsd0VBQXdFO2dCQUN4RSx5REFBeUQ7Z0JBQ3pELFdBQVcsQ0FBQyw2QkFBNkIsRUFBRSxFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO2dCQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxFQUFFO29CQUNqRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07b0JBQ3BCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztvQkFDMUIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO29CQUN4QixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztpQkFDeEQsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztRQUNILENBQUM7S0FDRixDQUFDO0lBRUYsWUFBWSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNuQyxNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxFQUFFO1FBQ3BELElBQUksRUFBRSxhQUFhLENBQUMsSUFBSTtRQUN4QixJQUFJLEVBQUUsYUFBYSxDQUFDLElBQUk7S0FDekIsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBlbnRpdHlFdmVudHMsIHR5cGUgRW50aXR5RXZlbnQsIHR5cGUgRW50aXR5RXZlbnRTdWJzY3JpYmVyIH0gZnJvbSAnLi9lbnRpdHktZXZlbnRzLmpzJztcbmltcG9ydCB7IEludGVybmFsSHR0cENsaWVudCB9IGZyb20gJy4vaHR0cC1jbGllbnQuanMnO1xuaW1wb3J0IHsgZ2V0U2VydmljZUF1dGhIZWFkZXIgfSBmcm9tICcuLi9taWRkbGV3YXJlL2F1dGguanMnO1xuaW1wb3J0IHsgdHlwZSBTZXJ2aWNlQ29uZmlnIH0gZnJvbSAnLi4vdHlwZXMvY29tbW9uLmpzJztcbmltcG9ydCB7IGNyZWF0ZUxvZ2dlciB9IGZyb20gJy4uL3V0aWxzL2xvZ2dlci5qcyc7XG5pbXBvcnQgeyBlbWl0Q291bnRlciB9IGZyb20gJy4uL3V0aWxzL21ldHJpYy1lbWl0dGVyLmpzJztcblxuY29uc3QgbG9nZ2VyID0gY3JlYXRlTG9nZ2VyKCdjb21wbGlhbmNlLWV2ZW50cycpO1xuXG4vKipcbiAqIFJlZ2lzdGVycyBhbiBlbnRpdHkgZXZlbnQgc3Vic2NyaWJlciB0aGF0IGZvcndhcmRzIGV2ZW50cyB0byB0aGUgY29tcGxpYW5jZSBzZXJ2aWNlLlxuICpcbiAqIENhbGwgdGhpcyBhdCBzZXJ2aWNlIHN0YXJ0dXAgKGluIGluZGV4LnRzKSB0byBlbmFibGUgYXV0b21hdGljIGNvbXBsaWFuY2VcbiAqIG5vdGlmaWNhdGlvbiBvbiBlbnRpdHkgbXV0YXRpb25zLiBFdmVudHMgYXJlIGZpcmUtYW5kLWZvcmdldCDigJQgZmFpbHVyZXNcbiAqIGFyZSBsb2dnZWQgYnV0IG5ldmVyIGJsb2NrIHRoZSBvcmlnaW5hbCByZXF1ZXN0LlxuICpcbiAqIEBwYXJhbSBjb25maWcgLSBPcHRpb25hbCBzZXJ2aWNlIGNvbmZpZyBvdmVycmlkZSAoZGVmYXVsdHMgdG8gQ09NUExJQU5DRV9TRVJWSUNFX0hPU1QvUE9SVCBlbnYgdmFycylcbiAqIEBwYXJhbSBzZXJ2aWNlTmFtZSAtIFNlcnZpY2UgaWRlbnRpZmllciBiYWtlZCBpbnRvIHRoZSBzaWduZWQgSldUJ3MgYHN1YmBcbiAqICAgKGUuZy4gJ3BpcGVsaW5lJywgJ3BsdWdpbicpLiBUaGUgY29tcGxpYW5jZSByb3V0ZSByZXF1aXJlcyBhIHNlcnZpY2VcbiAqICAgcHJpbmNpcGFsIOKAlCBhIHNwb29mYWJsZSBgeC1pbnRlcm5hbC1zZXJ2aWNlOiB0cnVlYCBoZWFkZXIgaXMgbm8gbG9uZ2VyXG4gKiAgIGFjY2VwdGVkLiBEZWZhdWx0cyB0byBhIGdlbmVyaWMgJ2VudGl0eS1ldmVudHMnIHdoZW4gdW5zcGVjaWZpZWQsIGJ1dFxuICogICBjYWxsZXJzIHNob3VsZCBwYXNzIHRoZWlyIHNlcnZpY2UgbmFtZSBmb3IgYWNjdXJhdGUgYXVkaXQgdHJhaWxzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVnaXN0ZXJDb21wbGlhbmNlRXZlbnRTdWJzY3JpYmVyKFxuICBjb25maWc/OiBQYXJ0aWFsPFNlcnZpY2VDb25maWc+LFxuICBzZXJ2aWNlTmFtZTogc3RyaW5nID0gJ2VudGl0eS1ldmVudHMnLFxuKTogdm9pZCB7XG4gIGNvbnN0IHNlcnZpY2VDb25maWc6IFNlcnZpY2VDb25maWcgPSB7XG4gICAgaG9zdDogY29uZmlnPy5ob3N0ID8/IHByb2Nlc3MuZW52LkNPTVBMSUFOQ0VfU0VSVklDRV9IT1NUID8/ICdjb21wbGlhbmNlJyxcbiAgICBwb3J0OiBjb25maWc/LnBvcnQgPz8gcGFyc2VJbnQocHJvY2Vzcy5lbnYuQ09NUExJQU5DRV9TRVJWSUNFX1BPUlQgPz8gJzMwMDAnLCAxMCksXG4gIH07XG5cbiAgY29uc3QgY2xpZW50ID0gbmV3IEludGVybmFsSHR0cENsaWVudChzZXJ2aWNlQ29uZmlnKTtcblxuICBjb25zdCBzdWJzY3JpYmVyOiBFbnRpdHlFdmVudFN1YnNjcmliZXIgPSB7XG4gICAgYXN5bmMgb25FbnRpdHlFdmVudChldmVudDogRW50aXR5RXZlbnQpOiBQcm9taXNlPHZvaWQ+IHtcbiAgICAgIHRyeSB7XG4gICAgICAgIC8vIE1pbnQgYSBwZXItZXZlbnQgc2VydmljZSBKV1Qgc2NvcGVkIHRvIHRoZSBldmVudCdzIG9yZyBzbyB0aGVcbiAgICAgICAgLy8gY29tcGxpYW5jZSByb3V0ZSdzIGBydW5XaXRoVGVuYW50Q29udGV4dGAgc2VlcyB0aGUgcmlnaHQgdGVuYW50XG4gICAgICAgIC8vIEdVQy4gVGhlIGNvbXBsaWFuY2Ugc2lkZSBlbmZvcmNlcyBgcmVxdWlyZUF1dGhgICtcbiAgICAgICAgLy8gYHJlcXVpcmVTZXJ2aWNlUHJpbmNpcGFsYCDigJQgdGhlIHByZXZpb3VzIGB4LWludGVybmFsLXNlcnZpY2VgXG4gICAgICAgIC8vIGhlYWRlciBpcyBubyBsb25nZXIgc3VmZmljaWVudCAoYW5kIHdhcyBzcG9vZmFibGUpLlxuICAgICAgICAvL1xuICAgICAgICAvLyBUaGlzIEhUVFAgbm90aWZ5IGlzIHRoZSBTSU5HTEUgZGVsaXZlcnkgY2hhbm5lbCBmb3IgcG9zdC1tdXRhdGlvblxuICAgICAgICAvLyByZS12YWxpZGF0aW9uIChwcmltYXJ5IGVuZm9yY2VtZW50IGlzIHRoZSBmYWlsLUNMT1NFRCBsaXZlXG4gICAgICAgIC8vIHZhbGlkYXRlIHBhdGgpLiBBIHN0YWJsZSBwZXItZXZlbnQgYElkZW1wb3RlbmN5LUtleWAgbWFrZXMgdGhlIFBPU1RcbiAgICAgICAgLy8gcmV0cnktc2FmZSBpbiB0aGUgaHR0cC1jbGllbnQsIHNvIGEgdHJhbnNpZW50IDV4eC90aW1lb3V0IGlzIHJldHJpZWRcbiAgICAgICAgLy8gcmF0aGVyIHRoYW4gZHJvcHBlZCBvbiB0aGUgZmlyc3QgYXR0ZW1wdDsgY29tcGxpYW5jZSByZS1ldmFsdWF0aW9uIGlzXG4gICAgICAgIC8vIG5hdHVyYWxseSBpZGVtcG90ZW50LCBzbyBhIGR1cGxpY2F0ZSBkZWxpdmVyeSBpcyBoYXJtbGVzcy5cbiAgICAgICAgYXdhaXQgY2xpZW50LnBvc3QoJy9jb21wbGlhbmNlL2V2ZW50cy9lbnRpdHknLCBldmVudCwge1xuICAgICAgICAgIGhlYWRlcnM6IHtcbiAgICAgICAgICAgICdBdXRob3JpemF0aW9uJzogZ2V0U2VydmljZUF1dGhIZWFkZXIoeyBzZXJ2aWNlTmFtZSwgb3JnSWQ6IGV2ZW50Lm9yZ0lkLCByb2xlOiAnbWVtYmVyJyB9KSxcbiAgICAgICAgICAgICdJZGVtcG90ZW5jeS1LZXknOiBgJHtldmVudC50YXJnZXR9OiR7ZXZlbnQuZW50aXR5SWR9OiR7ZXZlbnQuZXZlbnRUeXBlfToke2V2ZW50LnRpbWVzdGFtcC50b0lTT1N0cmluZygpfWAsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSk7XG4gICAgICB9IGNhdGNoIChlcnIpIHtcbiAgICAgICAgLy8gRmlyZS1hbmQtZm9yZ2V0OiBsb2cgKyBhIGRyb3AgbWV0cmljIHNvIHN1c3RhaW5lZCBsb3NzIGlzIGFsZXJ0YWJsZVxuICAgICAgICAvLyAob3BlcmF0b3JzIGNhbid0IGFjdCBvbiBhIHdhcm4gbGluZSBhbG9uZSksIHRoZW4gc3dhbGxvdyDigJQgY29tcGxpYW5jZVxuICAgICAgICAvLyBub3RpZmljYXRpb24gaXMgbm9uLWZhdGFsIHRvIHRoZSBvcmlnaW5hdGluZyBtdXRhdGlvbi5cbiAgICAgICAgZW1pdENvdW50ZXIoJ2NvbXBsaWFuY2VfZXZlbnRfZHJvcF90b3RhbCcsIHsgc2VydmljZTogc2VydmljZU5hbWUsIHRhcmdldDogZXZlbnQudGFyZ2V0IH0pO1xuICAgICAgICBsb2dnZXIud2FybignRmFpbGVkIHRvIG5vdGlmeSBjb21wbGlhbmNlIHNlcnZpY2Ugb2YgZW50aXR5IGV2ZW50Jywge1xuICAgICAgICAgIHRhcmdldDogZXZlbnQudGFyZ2V0LFxuICAgICAgICAgIGV2ZW50VHlwZTogZXZlbnQuZXZlbnRUeXBlLFxuICAgICAgICAgIGVudGl0eUlkOiBldmVudC5lbnRpdHlJZCxcbiAgICAgICAgICBlcnJvcjogZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6IFN0cmluZyhlcnIpLFxuICAgICAgICB9KTtcbiAgICAgIH1cbiAgICB9LFxuICB9O1xuXG4gIGVudGl0eUV2ZW50cy5zdWJzY3JpYmUoc3Vic2NyaWJlcik7XG4gIGxvZ2dlci5pbmZvKCdDb21wbGlhbmNlIGV2ZW50IHN1YnNjcmliZXIgcmVnaXN0ZXJlZCcsIHtcbiAgICBob3N0OiBzZXJ2aWNlQ29uZmlnLmhvc3QsXG4gICAgcG9ydDogc2VydmljZUNvbmZpZy5wb3J0LFxuICB9KTtcbn1cbiJdfQ==

package/lib/services/compliance-queue.js

@@ -6,6 +6,15 @@ const logger = createLogger('compliance-queue');
  * Pluggable compliance event queue.
  * Services register a backend (BullMQ, SQS, or in-memory) at startup.
  * If no backend is registered, events are logged and discarded.
+ *
+ * NOTE (2026-07): currently has NO producer. The entity-event path was the only
+ * caller of {@link enqueueComplianceEvent}, but it only ever ran in the
+ * plugin/pipeline processes — which register NO backend — so every enqueue was a
+ * silent no-op there (the "durable async re-validation" it advertised never
+ * existed). That dead call was removed; post-mutation re-validation now rides the
+ * retriable HTTP notify in `compliance-event-subscriber.ts` (primary enforcement
+ * is the fail-closed live validate path regardless). This queue machinery is
+ * retained for a future real durable producer; until one is wired it is inert.
  */
 let enqueueFn = null;
 export function registerComplianceQueueBackend(fn) {
@@ -31,4 +40,4 @@ export async function enqueueComplianceEvent(event) {
         });
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1xdWV1ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2aWNlcy9jb21wbGlhbmNlLXF1ZXVlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRWxELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBZWhEOzs7O0dBSUc7QUFDSCxJQUFJLFNBQVMsR0FBdUQsSUFBSSxDQUFDO0FBRXpFLE1BQU0sVUFBVSw4QkFBOEIsQ0FBQyxFQUE2QztJQUMxRixTQUFTLEdBQUcsRUFBRSxDQUFDO0lBQ2YsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0FBQ3JELENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLHNCQUFzQixDQUFDLEtBQXNCO0lBQ2pFLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNmLE1BQU0sQ0FBQyxLQUFLLENBQUMsMERBQTBELEVBQUU7WUFDdkUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1NBQzNFLENBQUMsQ0FBQztRQUNILE9BQU87SUFDVCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsTUFBTSxDQUFDLEtBQUssQ0FBQywyQkFBMkIsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1SCxDQUFDO0lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztRQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0NBQW9DLEVBQUU7WUFDaEQsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQzFCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztTQUN4RCxDQUFDLENBQUM7SUFDTCxDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBjcmVhdGVMb2dnZXIgfSBmcm9tICcuLi91dGlscy9sb2dnZXIuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ2NvbXBsaWFuY2UtcXVldWUnKTtcblxuZXhwb3J0IGludGVyZmFjZSBDb21wbGlhbmNlRXZlbnQge1xuICBldmVudFR5cGU6ICd2YWxpZGF0ZScgfCAnc2NhbicgfCAnbm90aWZ5JztcbiAgdGFyZ2V0OiAncGx1Z2luJyB8ICdwaXBlbGluZSc7XG4gIGVudGl0eUlkOiBzdHJpbmc7XG4gIG9yZ0lkOiBzdHJpbmc7XG4gIC8qKiBPd25pbmcgb3JnJ3MgcGFyZW50IChwcmVzZW50IG9ubHkgd2hlbiBgb3JnSWRgIGlzIGEgdGVhbSkgc28gdGhlIGFzeW5jXG4gICAqICB3b3JrZXIgZXZhbHVhdGVzIHBhcmVudCBgcHJvcGFnYXRlVG9DaGlsZHJlbmAgcnVsZXMgbGlrZSB0aGUgbGl2ZSBwYXRoLiAqL1xuICBwYXJlbnRPcmdJZD86IHN0cmluZztcbiAgdXNlcklkOiBzdHJpbmc7XG4gIGF0dHJpYnV0ZXM6IFJlY29yZDxzdHJpbmcsIHVua25vd24+O1xuICB0aW1lc3RhbXA6IHN0cmluZztcbn1cblxuLyoqXG4gKiBQbHVnZ2FibGUgY29tcGxpYW5jZSBldmVudCBxdWV1ZS5cbiAqIFNlcnZpY2VzIHJlZ2lzdGVyIGEgYmFja2VuZCAoQnVsbE1RLCBTUVMsIG9yIGluLW1lbW9yeSkgYXQgc3RhcnR1cC5cbiAqIElmIG5vIGJhY2tlbmQgaXMgcmVnaXN0ZXJlZCwgZXZlbnRzIGFyZSBsb2dnZWQgYW5kIGRpc2NhcmRlZC5cbiAqL1xubGV0IGVucXVldWVGbjogKChldmVudDogQ29tcGxpYW5jZUV2ZW50KSA9PiBQcm9taXNlPHZvaWQ+KSB8IG51bGwgPSBudWxsO1xuXG5leHBvcnQgZnVuY3Rpb24gcmVnaXN0ZXJDb21wbGlhbmNlUXVldWVCYWNrZW5kKGZuOiAoZXZlbnQ6IENvbXBsaWFuY2VFdmVudCkgPT4gUHJvbWlzZTx2b2lkPik6IHZvaWQge1xuICBlbnF1ZXVlRm4gPSBmbjtcbiAgbG9nZ2VyLmluZm8oJ0NvbXBsaWFuY2UgcXVldWUgYmFja2VuZCByZWdpc3RlcmVkJyk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbnF1ZXVlQ29tcGxpYW5jZUV2ZW50KGV2ZW50OiBDb21wbGlhbmNlRXZlbnQpOiBQcm9taXNlPHZvaWQ+IHtcbiAgaWYgKCFlbnF1ZXVlRm4pIHtcbiAgICBsb2dnZXIuZGVidWcoJ0NvbXBsaWFuY2UgZXZlbnQgZGlzY2FyZGVkIChubyBxdWV1ZSBiYWNrZW5kIHJlZ2lzdGVyZWQpJywge1xuICAgICAgZXZlbnRUeXBlOiBldmVudC5ldmVudFR5cGUsIHRhcmdldDogZXZlbnQudGFyZ2V0LCBlbnRpdHlJZDogZXZlbnQuZW50aXR5SWQsXG4gICAgfSk7XG4gICAgcmV0dXJuO1xuICB9XG4gIHRyeSB7XG4gICAgYXdhaXQgZW5xdWV1ZUZuKGV2ZW50KTtcbiAgICBsb2dnZXIuZGVidWcoJ0NvbXBsaWFuY2UgZXZlbnQgZW5xdWV1ZWQnLCB7IGV2ZW50VHlwZTogZXZlbnQuZXZlbnRUeXBlLCB0YXJnZXQ6IGV2ZW50LnRhcmdldCwgZW50aXR5SWQ6IGV2ZW50LmVudGl0eUlkIH0pO1xuICB9IGNhdGNoIChlcnIpIHtcbiAgICBsb2dnZXIud2FybignRmFpbGVkIHRvIGVucXVldWUgY29tcGxpYW5jZSBldmVudCcsIHtcbiAgICAgIGV2ZW50VHlwZTogZXZlbnQuZXZlbnRUeXBlLFxuICAgICAgZW50aXR5SWQ6IGV2ZW50LmVudGl0eUlkLFxuICAgICAgZXJyb3I6IGVyciBpbnN0YW5jZW9mIEVycm9yID8gZXJyLm1lc3NhZ2UgOiBTdHJpbmcoZXJyKSxcbiAgICB9KTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1xdWV1ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2aWNlcy9jb21wbGlhbmNlLXF1ZXVlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRWxELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBZWhEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxJQUFJLFNBQVMsR0FBdUQsSUFBSSxDQUFDO0FBRXpFLE1BQU0sVUFBVSw4QkFBOEIsQ0FBQyxFQUE2QztJQUMxRixTQUFTLEdBQUcsRUFBRSxDQUFDO0lBQ2YsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0FBQ3JELENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLHNCQUFzQixDQUFDLEtBQXNCO0lBQ2pFLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNmLE1BQU0sQ0FBQyxLQUFLLENBQUMsMERBQTBELEVBQUU7WUFDdkUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1NBQzNFLENBQUMsQ0FBQztRQUNILE9BQU87SUFDVCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsTUFBTSxDQUFDLEtBQUssQ0FBQywyQkFBMkIsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM1SCxDQUFDO0lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztRQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0NBQW9DLEVBQUU7WUFDaEQsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQzFCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztTQUN4RCxDQUFDLENBQUM7SUFDTCxDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBjcmVhdGVMb2dnZXIgfSBmcm9tICcuLi91dGlscy9sb2dnZXIuanMnO1xuXG5jb25zdCBsb2dnZXIgPSBjcmVhdGVMb2dnZXIoJ2NvbXBsaWFuY2UtcXVldWUnKTtcblxuZXhwb3J0IGludGVyZmFjZSBDb21wbGlhbmNlRXZlbnQge1xuICBldmVudFR5cGU6ICd2YWxpZGF0ZScgfCAnc2NhbicgfCAnbm90aWZ5JztcbiAgdGFyZ2V0OiAncGx1Z2luJyB8ICdwaXBlbGluZSc7XG4gIGVudGl0eUlkOiBzdHJpbmc7XG4gIG9yZ0lkOiBzdHJpbmc7XG4gIC8qKiBPd25pbmcgb3JnJ3MgcGFyZW50IChwcmVzZW50IG9ubHkgd2hlbiBgb3JnSWRgIGlzIGEgdGVhbSkgc28gdGhlIGFzeW5jXG4gICAqICB3b3JrZXIgZXZhbHVhdGVzIHBhcmVudCBgcHJvcGFnYXRlVG9DaGlsZHJlbmAgcnVsZXMgbGlrZSB0aGUgbGl2ZSBwYXRoLiAqL1xuICBwYXJlbnRPcmdJZD86IHN0cmluZztcbiAgdXNlcklkOiBzdHJpbmc7XG4gIGF0dHJpYnV0ZXM6IFJlY29yZDxzdHJpbmcsIHVua25vd24+O1xuICB0aW1lc3RhbXA6IHN0cmluZztcbn1cblxuLyoqXG4gKiBQbHVnZ2FibGUgY29tcGxpYW5jZSBldmVudCBxdWV1ZS5cbiAqIFNlcnZpY2VzIHJlZ2lzdGVyIGEgYmFja2VuZCAoQnVsbE1RLCBTUVMsIG9yIGluLW1lbW9yeSkgYXQgc3RhcnR1cC5cbiAqIElmIG5vIGJhY2tlbmQgaXMgcmVnaXN0ZXJlZCwgZXZlbnRzIGFyZSBsb2dnZWQgYW5kIGRpc2NhcmRlZC5cbiAqXG4gKiBOT1RFICgyMDI2LTA3KTogY3VycmVudGx5IGhhcyBOTyBwcm9kdWNlci4gVGhlIGVudGl0eS1ldmVudCBwYXRoIHdhcyB0aGUgb25seVxuICogY2FsbGVyIG9mIHtAbGluayBlbnF1ZXVlQ29tcGxpYW5jZUV2ZW50fSwgYnV0IGl0IG9ubHkgZXZlciByYW4gaW4gdGhlXG4gKiBwbHVnaW4vcGlwZWxpbmUgcHJvY2Vzc2VzIOKAlCB3aGljaCByZWdpc3RlciBOTyBiYWNrZW5kIOKAlCBzbyBldmVyeSBlbnF1ZXVlIHdhcyBhXG4gKiBzaWxlbnQgbm8tb3AgdGhlcmUgKHRoZSBcImR1cmFibGUgYXN5bmMgcmUtdmFsaWRhdGlvblwiIGl0IGFkdmVydGlzZWQgbmV2ZXJcbiAqIGV4aXN0ZWQpLiBUaGF0IGRlYWQgY2FsbCB3YXMgcmVtb3ZlZDsgcG9zdC1tdXRhdGlvbiByZS12YWxpZGF0aW9uIG5vdyByaWRlcyB0aGVcbiAqIHJldHJpYWJsZSBIVFRQIG5vdGlmeSBpbiBgY29tcGxpYW5jZS1ldmVudC1zdWJzY3JpYmVyLnRzYCAocHJpbWFyeSBlbmZvcmNlbWVudFxuICogaXMgdGhlIGZhaWwtY2xvc2VkIGxpdmUgdmFsaWRhdGUgcGF0aCByZWdhcmRsZXNzKS4gVGhpcyBxdWV1ZSBtYWNoaW5lcnkgaXNcbiAqIHJldGFpbmVkIGZvciBhIGZ1dHVyZSByZWFsIGR1cmFibGUgcHJvZHVjZXI7IHVudGlsIG9uZSBpcyB3aXJlZCBpdCBpcyBpbmVydC5cbiAqL1xubGV0IGVucXVldWVGbjogKChldmVudDogQ29tcGxpYW5jZUV2ZW50KSA9PiBQcm9taXNlPHZvaWQ+KSB8IG51bGwgPSBudWxsO1xuXG5leHBvcnQgZnVuY3Rpb24gcmVnaXN0ZXJDb21wbGlhbmNlUXVldWVCYWNrZW5kKGZuOiAoZXZlbnQ6IENvbXBsaWFuY2VFdmVudCkgPT4gUHJvbWlzZTx2b2lkPik6IHZvaWQge1xuICBlbnF1ZXVlRm4gPSBmbjtcbiAgbG9nZ2VyLmluZm8oJ0NvbXBsaWFuY2UgcXVldWUgYmFja2VuZCByZWdpc3RlcmVkJyk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbnF1ZXVlQ29tcGxpYW5jZUV2ZW50KGV2ZW50OiBDb21wbGlhbmNlRXZlbnQpOiBQcm9taXNlPHZvaWQ+IHtcbiAgaWYgKCFlbnF1ZXVlRm4pIHtcbiAgICBsb2dnZXIuZGVidWcoJ0NvbXBsaWFuY2UgZXZlbnQgZGlzY2FyZGVkIChubyBxdWV1ZSBiYWNrZW5kIHJlZ2lzdGVyZWQpJywge1xuICAgICAgZXZlbnRUeXBlOiBldmVudC5ldmVudFR5cGUsIHRhcmdldDogZXZlbnQudGFyZ2V0LCBlbnRpdHlJZDogZXZlbnQuZW50aXR5SWQsXG4gICAgfSk7XG4gICAgcmV0dXJuO1xuICB9XG4gIHRyeSB7XG4gICAgYXdhaXQgZW5xdWV1ZUZuKGV2ZW50KTtcbiAgICBsb2dnZXIuZGVidWcoJ0NvbXBsaWFuY2UgZXZlbnQgZW5xdWV1ZWQnLCB7IGV2ZW50VHlwZTogZXZlbnQuZXZlbnRUeXBlLCB0YXJnZXQ6IGV2ZW50LnRhcmdldCwgZW50aXR5SWQ6IGV2ZW50LmVudGl0eUlkIH0pO1xuICB9IGNhdGNoIChlcnIpIHtcbiAgICBsb2dnZXIud2FybignRmFpbGVkIHRvIGVucXVldWUgY29tcGxpYW5jZSBldmVudCcsIHtcbiAgICAgIGV2ZW50VHlwZTogZXZlbnQuZXZlbnRUeXBlLFxuICAgICAgZW50aXR5SWQ6IGV2ZW50LmVudGl0eUlkLFxuICAgICAgZXJyb3I6IGVyciBpbnN0YW5jZW9mIEVycm9yID8gZXJyLm1lc3NhZ2UgOiBTdHJpbmcoZXJyKSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/services/index.d.ts

@@ -9,5 +9,6 @@ export { DEFAULT_MAX_RETRIES, DEFAULT_RETRY_DELAY_MS, DEFAULT_MAX_RATE_LIMIT_RET
 export type { RetryConfig, RetryDecision } from './retry-strategy.js';
 export * from './quota.js';
 export * from './remote-audit-client.js';
+export * from './audit-spool.js';
 export * from './token-revocation.js';
 export { enqueueComplianceEvent, registerComplianceQueueBackend, type ComplianceEvent } from './compliance-queue.js';

package/lib/services/index.js

@@ -10,6 +10,7 @@ export * from './http-client.js';
 export { DEFAULT_MAX_RETRIES, DEFAULT_RETRY_DELAY_MS, DEFAULT_MAX_RATE_LIMIT_RETRIES, calculateBackoff, isTransientStatusCode, isRateLimited, getRetryDecision, getErrorRetryDecision, } from './retry-strategy.js';
 export * from './quota.js';
 export * from './remote-audit-client.js';
+export * from './audit-spool.js';
 export * from './token-revocation.js';
 export { enqueueComplianceEvent, registerComplianceQueueBackend } from './compliance-queue.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VydmljZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIsc0JBQXNCLEVBQ3RCLDhCQUE4QixFQUM5QixnQkFBZ0IsRUFDaEIscUJBQXFCLEVBQ3JCLGFBQWEsRUFDYixnQkFBZ0IsRUFDaEIscUJBQXFCLEdBQ3RCLE1BQU0scUJBQXFCLENBQUM7QUFFN0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSw4QkFBOEIsRUFBd0IsTUFBTSx1QkFBdUIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5leHBvcnQgKiBmcm9tICcuL2NhY2hlLXNlcnZpY2UuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9sZWFkZXItbG9jay5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NjaGVkdWxlci5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2NvbXBsaWFuY2UtY2xpZW50LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY29tcGxpYW5jZS1ldmVudC1zdWJzY3JpYmVyLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vZW50aXR5LWV2ZW50cy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2h0dHAtY2xpZW50LmpzJztcbmV4cG9ydCB7XG4gIERFRkFVTFRfTUFYX1JFVFJJRVMsXG4gIERFRkFVTFRfUkVUUllfREVMQVlfTVMsXG4gIERFRkFVTFRfTUFYX1JBVEVfTElNSVRfUkVUUklFUyxcbiAgY2FsY3VsYXRlQmFja29mZixcbiAgaXNUcmFuc2llbnRTdGF0dXNDb2RlLFxuICBpc1JhdGVMaW1pdGVkLFxuICBnZXRSZXRyeURlY2lzaW9uLFxuICBnZXRFcnJvclJldHJ5RGVjaXNpb24sXG59IGZyb20gJy4vcmV0cnktc3RyYXRlZ3kuanMnO1xuZXhwb3J0IHR5cGUgeyBSZXRyeUNvbmZpZywgUmV0cnlEZWNpc2lvbiB9IGZyb20gJy4vcmV0cnktc3RyYXRlZ3kuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9xdW90YS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3JlbW90ZS1hdWRpdC1jbGllbnQuanMnO1xuZXhwb3J0ICogZnJvbSAnLi90b2tlbi1yZXZvY2F0aW9uLmpzJztcbmV4cG9ydCB7IGVucXVldWVDb21wbGlhbmNlRXZlbnQsIHJlZ2lzdGVyQ29tcGxpYW5jZVF1ZXVlQmFja2VuZCwgdHlwZSBDb21wbGlhbmNlRXZlbnQgfSBmcm9tICcuL2NvbXBsaWFuY2UtcXVldWUuanMnO1xuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VydmljZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIsc0JBQXNCLEVBQ3RCLDhCQUE4QixFQUM5QixnQkFBZ0IsRUFDaEIscUJBQXFCLEVBQ3JCLGFBQWEsRUFDYixnQkFBZ0IsRUFDaEIscUJBQXFCLEdBQ3RCLE1BQU0scUJBQXFCLENBQUM7QUFFN0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDhCQUE4QixFQUF3QixNQUFNLHVCQUF1QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmV4cG9ydCAqIGZyb20gJy4vY2FjaGUtc2VydmljZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2xlYWRlci1sb2NrLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vc2NoZWR1bGVyLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY29tcGxpYW5jZS1jbGllbnQuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21wbGlhbmNlLWV2ZW50LXN1YnNjcmliZXIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9lbnRpdHktZXZlbnRzLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vaHR0cC1jbGllbnQuanMnO1xuZXhwb3J0IHtcbiAgREVGQVVMVF9NQVhfUkVUUklFUyxcbiAgREVGQVVMVF9SRVRSWV9ERUxBWV9NUyxcbiAgREVGQVVMVF9NQVhfUkFURV9MSU1JVF9SRVRSSUVTLFxuICBjYWxjdWxhdGVCYWNrb2ZmLFxuICBpc1RyYW5zaWVudFN0YXR1c0NvZGUsXG4gIGlzUmF0ZUxpbWl0ZWQsXG4gIGdldFJldHJ5RGVjaXNpb24sXG4gIGdldEVycm9yUmV0cnlEZWNpc2lvbixcbn0gZnJvbSAnLi9yZXRyeS1zdHJhdGVneS5qcyc7XG5leHBvcnQgdHlwZSB7IFJldHJ5Q29uZmlnLCBSZXRyeURlY2lzaW9uIH0gZnJvbSAnLi9yZXRyeS1zdHJhdGVneS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3F1b3RhLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vcmVtb3RlLWF1ZGl0LWNsaWVudC5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2F1ZGl0LXNwb29sLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vdG9rZW4tcmV2b2NhdGlvbi5qcyc7XG5leHBvcnQgeyBlbnF1ZXVlQ29tcGxpYW5jZUV2ZW50LCByZWdpc3RlckNvbXBsaWFuY2VRdWV1ZUJhY2tlbmQsIHR5cGUgQ29tcGxpYW5jZUV2ZW50IH0gZnJvbSAnLi9jb21wbGlhbmNlLXF1ZXVlLmpzJztcbiJdfQ==

package/lib/services/remote-audit-client.d.ts

@@ -1,10 +1,19 @@
+import { type AuditSpool } from './audit-spool.js';
 /**
- * Subset of platform's AuditAction enum that non-platform services emit.
- * Kept in sync manually with platform/src/models/audit-event.ts; mismatched
- * actions are rejected by the platform ingest endpoint (400) so a drift is
- * visible in logs rather than silently dropped.
+ * The exact set of audit actions a NON-PLATFORM (remote) service is permitted to
+ * emit through `POST /audit/events`. This is the SINGLE SOURCE — `RemoteAuditAction`
+ * is derived from it, so the type and the runtime allow-list can never drift.
+ *
+ * SECURITY: platform's ingest validates `action` against this subset (via
+ * {@link isRemoteAuditAction}), NOT the full platform `AuditAction` union — a
+ * `service:*` token must not be able to forge platform-authority events
+ * (`admin.superadmin.grant`, `org.ownership.transfer`, `user.login`, …). Keep
+ * this list free of any platform-only action.
  */
-export type RemoteAuditAction = 'plugin.build.completed' | 'plugin.build.failed' | 'plugin.build.timeout' | 'plugin.delete' | 'plugin.upload' | 'plugin.deploy' | 'pipeline.create' | 'pipeline.update' | 'pipeline.delete' | 'pipeline.execution.start' | 'pipeline.execution.cancel' | 'quota.reset' | 'quota.limit.update' | 'compliance.exemption.approve' | 'compliance.rule.toggle' | 'compliance.scan.cancel' | 'registry.gc' | 'registry.image.delete' | 'authz.denied';
+export declare const REMOTE_AUDIT_ACTIONS: readonly ["plugin.build.completed", "plugin.build.failed", "plugin.build.timeout", "plugin.delete", "plugin.upload", "plugin.deploy", "plugin.bulk.update", "plugin.bulk.delete", "plugin.dlq.purge", "pipeline.create", "pipeline.update", "pipeline.delete", "pipeline.execution.start", "pipeline.execution.cancel", "pipeline.registry.register", "pipeline.registry.deregister", "quota.reset", "quota.limit.update", "quota.delete", "compliance.exemption.approve", "compliance.exemption.revoke", "compliance.rule.toggle", "compliance.rule.create", "compliance.rule.update", "compliance.rule.delete", "compliance.policy.create", "compliance.policy.update", "compliance.policy.delete", "compliance.scan-schedule.create", "compliance.scan-schedule.update", "compliance.scan-schedule.delete", "compliance.template.apply", "compliance.scan.cancel", "registry.gc", "registry.image.delete", "message.announcement.create", "message.delete", "billing.subscription.cancel", "billing.subscription.delete", "billing.tier.override", "billing.addon.add", "billing.addon.remove", "authz.denied"];
+export type RemoteAuditAction = typeof REMOTE_AUDIT_ACTIONS[number];
+/** Whether `value` is an action a remote service may emit (the ingest allow-list). */
+export declare function isRemoteAuditAction(value: string): value is RemoteAuditAction;
 export interface RemoteAuditEvent {
     action: RemoteAuditAction;
     actorId: string;
@@ -19,6 +28,20 @@ export interface RemoteAuditEvent {
      * 'failure' so a reviewer can filter attempts from completed actions.
      */
     outcome?: 'success' | 'failure';
+    /**
+     * When the audited action actually OCCURRED (ISO-8601), stamped at emission.
+     * The platform stores this for reviewers; it is NOT the chain-ordering field
+     * (the tamper-evident chain orders by ingest/`createdAt`). It matters for
+     * SPOOLED events: one buffered during a platform outage is re-delivered — and
+     * so chained — later, but `occurredAt` preserves when it really happened.
+     */
+    occurredAt?: string;
+    /**
+     * Stable per-emission dedup key (also sent as the `Idempotency-Key` header the
+     * platform ingest dedups on). Stamped by `record()` and carried on the spooled
+     * copy so a live attempt and its later re-delivery collapse to ONE stored row.
+     */
+    idempotencyKey?: string;
     details?: Record<string, unknown>;
 }
 /**
@@ -31,9 +54,13 @@ export interface RemoteAuditClient {
      * Fire-and-forget audit emission. Failures are logged at warn level but
      * never thrown  the originating action (e.g. a plugin build) has its
      * own success/failure path that shouldn't get polluted by a flaky audit
-     * downstream.
+     * downstream. When a {@link AuditSpool} is configured, an emission that
+     * exhausts its live retries is buffered and re-delivered later instead of
+     * being dropped.
      */
     record(event: RemoteAuditEvent, serviceName: string): void;
+    /** Stop the background spool-drain timer (if any). Safe to call repeatedly. */
+    close(): void;
 }
 /**
  * Configuration for the remote audit client.
@@ -45,6 +72,16 @@ export interface RemoteAuditClientConfig {
     port?: number;
     /** Request timeout ms (default 3000  audit shouldn't block the worker). */
     timeout?: number;
+    /**
+     * Optional durable buffer. When set, an emission that exhausts its live retry
+     * budget (sustained platform outage) is spooled and re-delivered — on the next
+     * successful emission and on a periodic timer — instead of being lost.
+     */
+    spool?: AuditSpool;
+    /** Spool-drain interval ms (default 30_000). Only used when `spool` is set. */
+    drainIntervalMs?: number;
+    /** Max entries drained per sweep (default 100). */
+    drainBatchSize?: number;
 }
 /**
  * Construct a remote-audit client targeted at the platform service.
@@ -67,3 +104,39 @@ export interface RemoteAuditClientConfig {
  * ```
  */
 export declare function createRemoteAuditClient(config?: RemoteAuditClientConfig): RemoteAuditClient;
+/**
+ * Register the standard `authz.denied` sink used by every remote-audit service
+ * (pipeline, plugin, compliance, quota, message, billing, reporting, …).
+ *
+ * The shared `requireAuth` gate forwards each DENIED state-changing request to
+ * the auditor set via {@link setAuthzDenialAuditor}; this wires that hook to the
+ * service's {@link RemoteAuditClient}, forwarding a `failure`-outcome
+ * `authz.denied` event so probing / privilege-escalation attempts leave a trail.
+ * Emission is fire-and-forget (the client never throws). `getClient` is a getter
+ * so the client stays lazily constructed (services memoize it on first use).
+ *
+ * Platform is intentionally NOT a caller — it is the audit authority and writes
+ * `authz.denied` straight to its local store (with `affectedOrgId`), not through
+ * a RemoteAuditClient.
+ */
+export declare function wireAuthzDenialAuditor(serviceName: string, getClient: () => RemoteAuditClient): void;
+/**
+ * A service-scoped audit client: a durable-spool-backed {@link RemoteAuditClient}
+ * with the service name pre-bound for emission. Replaces the per-service
+ * boilerplate of `createRemoteAuditClient({ spool: createEnvRedisAuditSpool() ?? undefined })`
+ * plus a hand-rolled `emit<Service>Audit` wrapper that repeats the service name.
+ */
+export interface ServiceAuditClient {
+    /** Emit an audit event with the service name bound. Fire-and-forget. */
+    emit(event: RemoteAuditEvent): void;
+    /** The underlying remote client — for `wireAuthzDenialAuditor` + `close()`. */
+    readonly client: RemoteAuditClient;
+}
+/**
+ * Build a service's audit client: a RemoteAuditClient wired to the durable Redis
+ * spool (from ambient env; null → no spool) with `serviceName` bound. Construct
+ * ONCE per process — memoize behind a lazy `getAuditClient()` in the service's
+ * `services/audit.ts`. Pass `config.spool` to override the env-derived spool
+ * (e.g. reuse a service's existing ioredis connection).
+ */
+export declare function createServiceAuditClient(serviceName: string, config?: RemoteAuditClientConfig): ServiceAuditClient;