@pipeline-builder/api-core 4.1.13 → 4.1.14

package/lib/validation/plugin-spec-schema.js

@@ -0,0 +1,163 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * The plugin PACKAGE schemas: `plugin-spec.yaml` and `config.yaml`, exactly as
+ * the plugin service validates an upload. Shared from api-core so the upload
+ * path (api/plugin) and the CLI (`pipeline-manager plugin validate` /
+ * `plugin publish`) apply ONE schema and can't drift.
+ *
+ * Pure: no YAML parsing, no filesystem. Callers parse (with their own size and
+ * alias bounds) and hand the resulting object to {@link checkPluginSpec} /
+ * {@link checkPluginConfig}.
+ */
+import { z } from 'zod';
+import { PLUGIN_CHANGELOG_MAX_BYTES } from '../types/plugin-catalog.js';
+import { IconKeySchema, PLUGIN_CATALOG_FIELD_SCHEMAS, ProjectUrlSchema, isAllowedSpdxId, } from './plugin-catalog-metadata.js';
+// -----------------------------------------------------------------------------
+// Vocabularies
+// -----------------------------------------------------------------------------
+export const PLUGIN_TYPES = ['CodeBuildStep', 'ShellStep', 'ManualApprovalStep'];
+export const PLUGIN_COMPUTE_TYPES = ['SMALL', 'MEDIUM', 'LARGE', 'X2_LARGE'];
+export const PLUGIN_FAILURE_BEHAVIORS = ['fail', 'warn', 'ignore'];
+export const PLUGIN_BUILD_TYPES = ['build_image', 'prebuilt', 'metadata_only'];
+/** Plugin name: lowercase letters, digits and hyphens. */
+export const PLUGIN_NAME_PATTERN = /^[a-z0-9-]+$/;
+/** Plugin version: semver, with optional `-prerelease` and `+build` metadata. */
+export const PLUGIN_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/;
+// -----------------------------------------------------------------------------
+// network.egress (spec-only trust metadata)
+// -----------------------------------------------------------------------------
+/** Max declared `network.egress` hostnames. */
+export const EGRESS_MAX_HOSTS = 50;
+/**
+ * A bare DNS hostname, optionally with ONE leading `*.` wildcard label. No
+ * scheme, port, path, userinfo or IP literal — a declared egress target is a
+ * name the reviewer can read.
+ */
+const EGRESS_HOST_PATTERN = /^(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/;
+/** True when `host` is an acceptable `network.egress` entry. */
+export function isValidEgressHost(host) {
+    return host.length <= 253 && EGRESS_HOST_PATTERN.test(host);
+}
+// -----------------------------------------------------------------------------
+// config.yaml
+// -----------------------------------------------------------------------------
+export const PluginConfigSchema = z.object({
+    pluginSpec: z.string().optional(),
+    dockerfile: z.string().optional(),
+    buildType: z.enum(PLUGIN_BUILD_TYPES).optional(),
+    // Deterministic build tag written by build-plugin-images.sh
+    // (`p-<name>-<sha256:12>`). Informational only on the upload path —
+    // the platform doesn't act on it, but it lives in the same config
+    // file as the rest of the build metadata so re-runs can short-circuit
+    // unchanged plugins without needing a separate .image-hash sidecar.
+    imageTag: z.string().optional(),
+}).strict()
+    .refine(d => !(d.buildType === 'prebuilt' && d.dockerfile), {
+    message: 'dockerfile is not allowed when buildType is prebuilt',
+})
+    .refine(d => !(d.buildType === 'metadata_only' && d.dockerfile), {
+    message: 'dockerfile is not allowed when buildType is metadata_only',
+});
+// -----------------------------------------------------------------------------
+// plugin-spec.yaml
+// -----------------------------------------------------------------------------
+// name/version/commands are the required-field contract, but they're checked by
+// {@link pluginSpecRequiredFieldsProblem} (the stable "name, version, and
+// commands are required" message and the ManualApprovalStep carve-out). Here
+// they're optional strings; the schema's job is to reject malformed *types* on
+// the fields that flow downstream unchecked.
+export const PluginSpecSchema = z.object({
+    name: z.string().optional(),
+    description: z.string().optional(),
+    keywords: z.array(z.string()).optional(),
+    category: z.string().optional(),
+    version: z.string().optional(),
+    pluginType: z.enum(PLUGIN_TYPES).optional(),
+    computeType: z.enum(PLUGIN_COMPUTE_TYPES).optional(),
+    // >= 0 minutes: ManualApprovalStep specs legitimately declare `timeout: 0`.
+    timeout: z.number().int().nonnegative().optional(),
+    failureBehavior: z.enum(PLUGIN_FAILURE_BEHAVIORS).optional(),
+    secrets: z.array(z.object({
+        name: z.string().min(1),
+        required: z.boolean(),
+        description: z.string().optional(),
+    })).optional(),
+    // Accept an explicit `primaryOutputDirectory: null` (a ManualApprovalStep /
+    // output-less step legitimately declares it) and normalize it to `undefined`.
+    // Without `.nullish()` a present YAML `null` fails the bare string check and
+    // 400s the whole upload.
+    primaryOutputDirectory: z.string().nullish().transform((v) => v ?? undefined),
+    metadata: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+    dockerfile: z.string().optional(),
+    installCommands: z.array(z.string()).optional(),
+    commands: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    buildArgs: z.record(z.string(), z.string()).optional(),
+    requiredMetadata: z.array(z.string()).optional(),
+    requiredVars: z.array(z.string()).optional(),
+    // Kept as free-string maps rather than a value enum: shipped specs use both
+    // `bool` and `boolean`, and the coercion-vs-declared-type consistency is
+    // enforced separately by the template contract check. The schema only
+    // guarantees they're string-valued records here.
+    metadataTypes: z.record(z.string(), z.string()).optional(),
+    varsTypes: z.record(z.string(), z.string()).optional(),
+    // A command the build tooling runs against the built image
+    // (build-plugin-images.sh, test-plugins.sh --build, `plugin test`).
+    smokeTest: z.string().optional(),
+    // Documentation + trust metadata. The README is NOT a spec field — it
+    // is README.md at the zip root.
+    license: z.string().refine(isAllowedSpdxId, {
+        message: 'must be a supported SPDX license identifier (e.g. Apache-2.0, MIT)',
+    }).optional(),
+    changelog: z.string().refine((v) => new TextEncoder().encode(v).length <= PLUGIN_CHANGELOG_MAX_BYTES, {
+        message: `must be at most ${PLUGIN_CHANGELOG_MAX_BYTES} bytes`,
+    }).optional(),
+    homepageUrl: ProjectUrlSchema.optional(),
+    sourceUrl: ProjectUrlSchema.optional(),
+    // Catalog metadata: the card one-liner and the docs link. Same
+    // validators as a value typed into the upload form.
+    summary: PLUGIN_CATALOG_FIELD_SCHEMAS.summary.optional(),
+    documentationUrl: ProjectUrlSchema.optional(),
+    icon: z.union([
+        IconKeySchema,
+        z.object({ key: IconKeySchema, badge: IconKeySchema.optional() }).strict(),
+    ]).optional(),
+    network: z.object({
+        egress: z.array(z.string().refine(isValidEgressHost, {
+            message: 'must be a bare hostname (no scheme, port or path; one leading *. allowed)',
+        })).max(EGRESS_MAX_HOSTS).optional(),
+    }).strict().optional(),
+}).strict();
+const isMapping = (raw) => typeof raw === 'object' && raw !== null && !Array.isArray(raw);
+function checkAgainst(file, raw, schema, withPath) {
+    if (!isMapping(raw)) {
+        const message = `${file} must be a YAML mapping`;
+        return { ok: false, issues: [message], message };
+    }
+    const result = schema.safeParse(raw);
+    if (result.success)
+        return { ok: true, value: result.data };
+    const issues = result.error.issues.map(i => (withPath ? `${i.path.join('.') || '(root)'}: ${i.message}` : i.message));
+    return { ok: false, issues, message: `${file}: ${issues.join('; ')}` };
+}
+/** Check a parsed `plugin-spec.yaml` document against {@link PluginSpecSchema}. */
+export function checkPluginSpec(raw) {
+    return checkAgainst('plugin-spec.yaml', raw, PluginSpecSchema, true);
+}
+/** Check a parsed `config.yaml` document against {@link PluginConfigSchema}. */
+export function checkPluginConfig(raw) {
+    return checkAgainst('config.yaml', raw, PluginConfigSchema, false);
+}
+/**
+ * The required-field contract: `name` and `version` always, `commands` for
+ * every type except `ManualApprovalStep`. Returns the upload's message, or null.
+ */
+export function pluginSpecRequiredFieldsProblem(spec) {
+    const isApprovalStep = spec.pluginType === 'ManualApprovalStep';
+    if (!spec.name || !spec.version || (!isApprovalStep && !spec.commands)) {
+        return 'Invalid spec: name, version, and commands are required';
+    }
+    return null;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLXNwZWMtc2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ZhbGlkYXRpb24vcGx1Z2luLXNwZWMtc2NoZW1hLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7OztHQVNHO0FBRUgsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4QixPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUN4RSxPQUFPLEVBQ0wsYUFBYSxFQUFFLDRCQUE0QixFQUFFLGdCQUFnQixFQUFFLGVBQWUsR0FDL0UsTUFBTSw4QkFBOEIsQ0FBQztBQUV0QyxnRkFBZ0Y7QUFDaEYsZUFBZTtBQUNmLGdGQUFnRjtBQUVoRixNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsQ0FBQyxlQUFlLEVBQUUsV0FBVyxFQUFFLG9CQUFvQixDQUFVLENBQUM7QUFDMUYsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQVUsQ0FBQztBQUN0RixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFVLENBQUM7QUFDNUUsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxhQUFhLEVBQUUsVUFBVSxFQUFFLGVBQWUsQ0FBVSxDQUFDO0FBR3hGLDBEQUEwRDtBQUMxRCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxjQUFjLENBQUM7QUFDbEQsaUZBQWlGO0FBQ2pGLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLHNEQUFzRCxDQUFDO0FBRTdGLGdGQUFnRjtBQUNoRiw0Q0FBNEM7QUFDNUMsZ0ZBQWdGO0FBRWhGLCtDQUErQztBQUMvQyxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxFQUFFLENBQUM7QUFFbkM7Ozs7R0FJRztBQUNILE1BQU0sbUJBQW1CLEdBQUcsb0ZBQW9GLENBQUM7QUFFakgsZ0VBQWdFO0FBQ2hFLE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxJQUFZO0lBQzVDLE9BQU8sSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksbUJBQW1CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzlELENBQUM7QUFFRCxnRkFBZ0Y7QUFDaEYsY0FBYztBQUNkLGdGQUFnRjtBQUVoRixNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3pDLFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFO0lBQ2pDLFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFO0lBQ2pDLFNBQVMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLENBQUMsUUFBUSxFQUFFO0lBQ2hELDREQUE0RDtJQUM1RCxvRUFBb0U7SUFDcEUsa0VBQWtFO0lBQ2xFLHNFQUFzRTtJQUN0RSxvRUFBb0U7SUFDcEUsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7Q0FDaEMsQ0FBQyxDQUFDLE1BQU0sRUFBRTtLQUNSLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLFVBQVUsSUFBSSxDQUFDLENBQUMsVUFBVSxDQUFDLEVBQUU7SUFDMUQsT0FBTyxFQUFFLHNEQUFzRDtDQUNoRSxDQUFDO0tBQ0QsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssZUFBZSxJQUFJLENBQUMsQ0FBQyxVQUFVLENBQUMsRUFBRTtJQUMvRCxPQUFPLEVBQUUsMkRBQTJEO0NBQ3JFLENBQUMsQ0FBQztBQUdMLGdGQUFnRjtBQUNoRixtQkFBbUI7QUFDbkIsZ0ZBQWdGO0FBRWhGLGdGQUFnRjtBQUNoRiwwRUFBMEU7QUFDMUUsNkVBQTZFO0FBQzdFLCtFQUErRTtBQUMvRSw2Q0FBNkM7QUFDN0MsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN2QyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMzQixXQUFXLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUNsQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDeEMsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7SUFDL0IsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7SUFDOUIsVUFBVSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUMsUUFBUSxFQUFFO0lBQzNDLFdBQVcsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUMsUUFBUSxFQUFFO0lBQ3BELDRFQUE0RTtJQUM1RSxPQUFPLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUNsRCxlQUFlLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUM1RCxPQUFPLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO1FBQ3hCLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUN2QixRQUFRLEVBQUUsQ0FBQyxDQUFDLE9BQU8sRUFBRTtRQUNyQixXQUFXLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtLQUNuQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDZCw0RUFBNEU7SUFDNUUsOEVBQThFO0lBQzlFLDZFQUE2RTtJQUM3RSx5QkFBeUI7SUFDekIsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLFNBQVMsQ0FBQztJQUM3RSxRQUFRLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN6RixVQUFVLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUNqQyxlQUFlLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDL0MsUUFBUSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFO0lBQ3hDLEdBQUcsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDaEQsU0FBUyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN0RCxnQkFBZ0IsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUNoRCxZQUFZLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDNUMsNEVBQTRFO0lBQzVFLHlFQUF5RTtJQUN6RSxzRUFBc0U7SUFDdEUsaURBQWlEO0lBQ2pELGFBQWEsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7SUFDMUQsU0FBUyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN0RCwyREFBMkQ7SUFDM0Qsb0VBQW9FO0lBQ3BFLFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFO0lBQ2hDLHNFQUFzRTtJQUN0RSxnQ0FBZ0M7SUFDaEMsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxNQUFNLENBQUMsZUFBZSxFQUFFO1FBQzFDLE9BQU8sRUFBRSxvRUFBb0U7S0FDOUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUNiLFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLElBQUksMEJBQTBCLEVBQUU7UUFDcEcsT0FBTyxFQUFFLG1CQUFtQiwwQkFBMEIsUUFBUTtLQUMvRCxDQUFDLENBQUMsUUFBUSxFQUFFO0lBQ2IsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFFBQVEsRUFBRTtJQUN4QyxTQUFTLEVBQUUsZ0JBQWdCLENBQUMsUUFBUSxFQUFFO0lBQ3RDLCtEQUErRDtJQUMvRCxvREFBb0Q7SUFDcEQsT0FBTyxFQUFFLDRCQUE0QixDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUU7SUFDeEQsZ0JBQWdCLEVBQUUsZ0JBQWdCLENBQUMsUUFBUSxFQUFFO0lBQzdDLElBQUksRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDO1FBQ1osYUFBYTtRQUNiLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxHQUFHLEVBQUUsYUFBYSxFQUFFLEtBQUssRUFBRSxhQUFhLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRTtLQUMzRSxDQUFDLENBQUMsUUFBUSxFQUFFO0lBQ2IsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFDaEIsTUFBTSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsRUFBRTtZQUNuRCxPQUFPLEVBQUUsMkVBQTJFO1NBQ3JGLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLFFBQVEsRUFBRTtLQUNyQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFO0NBQ3ZCLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQVVaLE1BQU0sU0FBUyxHQUFHLENBQUMsR0FBWSxFQUFrQyxFQUFFLENBQ2pFLE9BQU8sR0FBRyxLQUFLLFFBQVEsSUFBSSxHQUFHLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUVqRSxTQUFTLFlBQVksQ0FBSSxJQUFZLEVBQUUsR0FBWSxFQUFFLE1BQW9CLEVBQUUsUUFBaUI7SUFDMUYsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3BCLE1BQU0sT0FBTyxHQUFHLEdBQUcsSUFBSSx5QkFBeUIsQ0FBQztRQUNqRCxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNyQyxJQUFJLE1BQU0sQ0FBQyxPQUFPO1FBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1RCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxRQUFRLEtBQUssQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN0SCxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsSUFBSSxLQUFLLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO0FBQ3pFLENBQUM7QUFFRCxtRkFBbUY7QUFDbkYsTUFBTSxVQUFVLGVBQWUsQ0FBQyxHQUFZO0lBQzFDLE9BQU8sWUFBWSxDQUFDLGtCQUFrQixFQUFFLEdBQUcsRUFBRSxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN2RSxDQUFDO0FBRUQsZ0ZBQWdGO0FBQ2hGLE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxHQUFZO0lBQzVDLE9BQU8sWUFBWSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSwrQkFBK0IsQ0FBQyxJQUEyRTtJQUN6SCxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsVUFBVSxLQUFLLG9CQUFvQixDQUFDO0lBQ2hFLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLENBQUMsY0FBYyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDdkUsT0FBTyx3REFBd0QsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogVGhlIHBsdWdpbiBQQUNLQUdFIHNjaGVtYXM6IGBwbHVnaW4tc3BlYy55YW1sYCBhbmQgYGNvbmZpZy55YW1sYCwgZXhhY3RseSBhc1xuICogdGhlIHBsdWdpbiBzZXJ2aWNlIHZhbGlkYXRlcyBhbiB1cGxvYWQuIFNoYXJlZCBmcm9tIGFwaS1jb3JlIHNvIHRoZSB1cGxvYWRcbiAqIHBhdGggKGFwaS9wbHVnaW4pIGFuZCB0aGUgQ0xJIChgcGlwZWxpbmUtbWFuYWdlciBwbHVnaW4gdmFsaWRhdGVgIC9cbiAqIGBwbHVnaW4gcHVibGlzaGApIGFwcGx5IE9ORSBzY2hlbWEgYW5kIGNhbid0IGRyaWZ0LlxuICpcbiAqIFB1cmU6IG5vIFlBTUwgcGFyc2luZywgbm8gZmlsZXN5c3RlbS4gQ2FsbGVycyBwYXJzZSAod2l0aCB0aGVpciBvd24gc2l6ZSBhbmRcbiAqIGFsaWFzIGJvdW5kcykgYW5kIGhhbmQgdGhlIHJlc3VsdGluZyBvYmplY3QgdG8ge0BsaW5rIGNoZWNrUGx1Z2luU3BlY30gL1xuICoge0BsaW5rIGNoZWNrUGx1Z2luQ29uZmlnfS5cbiAqL1xuXG5pbXBvcnQgeyB6IH0gZnJvbSAnem9kJztcblxuaW1wb3J0IHsgUExVR0lOX0NIQU5HRUxPR19NQVhfQllURVMgfSBmcm9tICcuLi90eXBlcy9wbHVnaW4tY2F0YWxvZy5qcyc7XG5pbXBvcnQge1xuICBJY29uS2V5U2NoZW1hLCBQTFVHSU5fQ0FUQUxPR19GSUVMRF9TQ0hFTUFTLCBQcm9qZWN0VXJsU2NoZW1hLCBpc0FsbG93ZWRTcGR4SWQsXG59IGZyb20gJy4vcGx1Z2luLWNhdGFsb2ctbWV0YWRhdGEuanMnO1xuXG4vLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuLy8gVm9jYWJ1bGFyaWVzXG4vLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuXG5leHBvcnQgY29uc3QgUExVR0lOX1RZUEVTID0gWydDb2RlQnVpbGRTdGVwJywgJ1NoZWxsU3RlcCcsICdNYW51YWxBcHByb3ZhbFN0ZXAnXSBhcyBjb25zdDtcbmV4cG9ydCBjb25zdCBQTFVHSU5fQ09NUFVURV9UWVBFUyA9IFsnU01BTEwnLCAnTUVESVVNJywgJ0xBUkdFJywgJ1gyX0xBUkdFJ10gYXMgY29uc3Q7XG5leHBvcnQgY29uc3QgUExVR0lOX0ZBSUxVUkVfQkVIQVZJT1JTID0gWydmYWlsJywgJ3dhcm4nLCAnaWdub3JlJ10gYXMgY29uc3Q7XG5leHBvcnQgY29uc3QgUExVR0lOX0JVSUxEX1RZUEVTID0gWydidWlsZF9pbWFnZScsICdwcmVidWlsdCcsICdtZXRhZGF0YV9vbmx5J10gYXMgY29uc3Q7XG5leHBvcnQgdHlwZSBQbHVnaW5CdWlsZFR5cGUgPSB0eXBlb2YgUExVR0lOX0JVSUxEX1RZUEVTW251bWJlcl07XG5cbi8qKiBQbHVnaW4gbmFtZTogbG93ZXJjYXNlIGxldHRlcnMsIGRpZ2l0cyBhbmQgaHlwaGVucy4gKi9cbmV4cG9ydCBjb25zdCBQTFVHSU5fTkFNRV9QQVRURVJOID0gL15bYS16MC05LV0rJC87XG4vKiogUGx1Z2luIHZlcnNpb246IHNlbXZlciwgd2l0aCBvcHRpb25hbCBgLXByZXJlbGVhc2VgIGFuZCBgK2J1aWxkYCBtZXRhZGF0YS4gKi9cbmV4cG9ydCBjb25zdCBQTFVHSU5fVkVSU0lPTl9QQVRURVJOID0gL15cXGQrXFwuXFxkK1xcLlxcZCsoLVthLXpBLVowLTkuLV0rKT8oXFwrW2EtekEtWjAtOS4tXSspPyQvO1xuXG4vLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuLy8gbmV0d29yay5lZ3Jlc3MgKHNwZWMtb25seSB0cnVzdCBtZXRhZGF0YSlcbi8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG5cbi8qKiBNYXggZGVjbGFyZWQgYG5ldHdvcmsuZWdyZXNzYCBob3N0bmFtZXMuICovXG5leHBvcnQgY29uc3QgRUdSRVNTX01BWF9IT1NUUyA9IDUwO1xuXG4vKipcbiAqIEEgYmFyZSBETlMgaG9zdG5hbWUsIG9wdGlvbmFsbHkgd2l0aCBPTkUgbGVhZGluZyBgKi5gIHdpbGRjYXJkIGxhYmVsLiBOb1xuICogc2NoZW1lLCBwb3J0LCBwYXRoLCB1c2VyaW5mbyBvciBJUCBsaXRlcmFsIOKAlCBhIGRlY2xhcmVkIGVncmVzcyB0YXJnZXQgaXMgYVxuICogbmFtZSB0aGUgcmV2aWV3ZXIgY2FuIHJlYWQuXG4gKi9cbmNvbnN0IEVHUkVTU19IT1NUX1BBVFRFUk4gPSAvXig/OlxcKlxcLik/KD86W2EtejAtOV0oPzpbYS16MC05LV17MCw2MX1bYS16MC05XSk/XFwuKStbYS16XVthLXowLTktXXswLDYxfVthLXowLTldJC87XG5cbi8qKiBUcnVlIHdoZW4gYGhvc3RgIGlzIGFuIGFjY2VwdGFibGUgYG5ldHdvcmsuZWdyZXNzYCBlbnRyeS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1ZhbGlkRWdyZXNzSG9zdChob3N0OiBzdHJpbmcpOiBib29sZWFuIHtcbiAgcmV0dXJuIGhvc3QubGVuZ3RoIDw9IDI1MyAmJiBFR1JFU1NfSE9TVF9QQVRURVJOLnRlc3QoaG9zdCk7XG59XG5cbi8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4vLyBjb25maWcueWFtbFxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuZXhwb3J0IGNvbnN0IFBsdWdpbkNvbmZpZ1NjaGVtYSA9IHoub2JqZWN0KHtcbiAgcGx1Z2luU3BlYzogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICBkb2NrZXJmaWxlOiB6LnN0cmluZygpLm9wdGlvbmFsKCksXG4gIGJ1aWxkVHlwZTogei5lbnVtKFBMVUdJTl9CVUlMRF9UWVBFUykub3B0aW9uYWwoKSxcbiAgLy8gRGV0ZXJtaW5pc3RpYyBidWlsZCB0YWcgd3JpdHRlbiBieSBidWlsZC1wbHVnaW4taW1hZ2VzLnNoXG4gIC8vIChgcC08bmFtZT4tPHNoYTI1NjoxMj5gKS4gSW5mb3JtYXRpb25hbCBvbmx5IG9uIHRoZSB1cGxvYWQgcGF0aCDigJRcbiAgLy8gdGhlIHBsYXRmb3JtIGRvZXNuJ3QgYWN0IG9uIGl0LCBidXQgaXQgbGl2ZXMgaW4gdGhlIHNhbWUgY29uZmlnXG4gIC8vIGZpbGUgYXMgdGhlIHJlc3Qgb2YgdGhlIGJ1aWxkIG1ldGFkYXRhIHNvIHJlLXJ1bnMgY2FuIHNob3J0LWNpcmN1aXRcbiAgLy8gdW5jaGFuZ2VkIHBsdWdpbnMgd2l0aG91dCBuZWVkaW5nIGEgc2VwYXJhdGUgLmltYWdlLWhhc2ggc2lkZWNhci5cbiAgaW1hZ2VUYWc6IHouc3RyaW5nKCkub3B0aW9uYWwoKSxcbn0pLnN0cmljdCgpXG4gIC5yZWZpbmUoZCA9PiAhKGQuYnVpbGRUeXBlID09PSAncHJlYnVpbHQnICYmIGQuZG9ja2VyZmlsZSksIHtcbiAgICBtZXNzYWdlOiAnZG9ja2VyZmlsZSBpcyBub3QgYWxsb3dlZCB3aGVuIGJ1aWxkVHlwZSBpcyBwcmVidWlsdCcsXG4gIH0pXG4gIC5yZWZpbmUoZCA9PiAhKGQuYnVpbGRUeXBlID09PSAnbWV0YWRhdGFfb25seScgJiYgZC5kb2NrZXJmaWxlKSwge1xuICAgIG1lc3NhZ2U6ICdkb2NrZXJmaWxlIGlzIG5vdCBhbGxvd2VkIHdoZW4gYnVpbGRUeXBlIGlzIG1ldGFkYXRhX29ubHknLFxuICB9KTtcbmV4cG9ydCB0eXBlIFBsdWdpbkNvbmZpZ0lucHV0ID0gei5pbmZlcjx0eXBlb2YgUGx1Z2luQ29uZmlnU2NoZW1hPjtcblxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbi8vIHBsdWdpbi1zcGVjLnlhbWxcbi8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG5cbi8vIG5hbWUvdmVyc2lvbi9jb21tYW5kcyBhcmUgdGhlIHJlcXVpcmVkLWZpZWxkIGNvbnRyYWN0LCBidXQgdGhleSdyZSBjaGVja2VkIGJ5XG4vLyB7QGxpbmsgcGx1Z2luU3BlY1JlcXVpcmVkRmllbGRzUHJvYmxlbX0gKHRoZSBzdGFibGUgXCJuYW1lLCB2ZXJzaW9uLCBhbmRcbi8vIGNvbW1hbmRzIGFyZSByZXF1aXJlZFwiIG1lc3NhZ2UgYW5kIHRoZSBNYW51YWxBcHByb3ZhbFN0ZXAgY2FydmUtb3V0KS4gSGVyZVxuLy8gdGhleSdyZSBvcHRpb25hbCBzdHJpbmdzOyB0aGUgc2NoZW1hJ3Mgam9iIGlzIHRvIHJlamVjdCBtYWxmb3JtZWQgKnR5cGVzKiBvblxuLy8gdGhlIGZpZWxkcyB0aGF0IGZsb3cgZG93bnN0cmVhbSB1bmNoZWNrZWQuXG5leHBvcnQgY29uc3QgUGx1Z2luU3BlY1NjaGVtYSA9IHoub2JqZWN0KHtcbiAgbmFtZTogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICBkZXNjcmlwdGlvbjogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICBrZXl3b3Jkczogei5hcnJheSh6LnN0cmluZygpKS5vcHRpb25hbCgpLFxuICBjYXRlZ29yeTogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICB2ZXJzaW9uOiB6LnN0cmluZygpLm9wdGlvbmFsKCksXG4gIHBsdWdpblR5cGU6IHouZW51bShQTFVHSU5fVFlQRVMpLm9wdGlvbmFsKCksXG4gIGNvbXB1dGVUeXBlOiB6LmVudW0oUExVR0lOX0NPTVBVVEVfVFlQRVMpLm9wdGlvbmFsKCksXG4gIC8vID49IDAgbWludXRlczogTWFudWFsQXBwcm92YWxTdGVwIHNwZWNzIGxlZ2l0aW1hdGVseSBkZWNsYXJlIGB0aW1lb3V0OiAwYC5cbiAgdGltZW91dDogei5udW1iZXIoKS5pbnQoKS5ub25uZWdhdGl2ZSgpLm9wdGlvbmFsKCksXG4gIGZhaWx1cmVCZWhhdmlvcjogei5lbnVtKFBMVUdJTl9GQUlMVVJFX0JFSEFWSU9SUykub3B0aW9uYWwoKSxcbiAgc2VjcmV0czogei5hcnJheSh6Lm9iamVjdCh7XG4gICAgbmFtZTogei5zdHJpbmcoKS5taW4oMSksXG4gICAgcmVxdWlyZWQ6IHouYm9vbGVhbigpLFxuICAgIGRlc2NyaXB0aW9uOiB6LnN0cmluZygpLm9wdGlvbmFsKCksXG4gIH0pKS5vcHRpb25hbCgpLFxuICAvLyBBY2NlcHQgYW4gZXhwbGljaXQgYHByaW1hcnlPdXRwdXREaXJlY3Rvcnk6IG51bGxgIChhIE1hbnVhbEFwcHJvdmFsU3RlcCAvXG4gIC8vIG91dHB1dC1sZXNzIHN0ZXAgbGVnaXRpbWF0ZWx5IGRlY2xhcmVzIGl0KSBhbmQgbm9ybWFsaXplIGl0IHRvIGB1bmRlZmluZWRgLlxuICAvLyBXaXRob3V0IGAubnVsbGlzaCgpYCBhIHByZXNlbnQgWUFNTCBgbnVsbGAgZmFpbHMgdGhlIGJhcmUgc3RyaW5nIGNoZWNrIGFuZFxuICAvLyA0MDBzIHRoZSB3aG9sZSB1cGxvYWQuXG4gIHByaW1hcnlPdXRwdXREaXJlY3Rvcnk6IHouc3RyaW5nKCkubnVsbGlzaCgpLnRyYW5zZm9ybSgodikgPT4gdiA/PyB1bmRlZmluZWQpLFxuICBtZXRhZGF0YTogei5yZWNvcmQoei5zdHJpbmcoKSwgei51bmlvbihbei5zdHJpbmcoKSwgei5udW1iZXIoKSwgei5ib29sZWFuKCldKSkub3B0aW9uYWwoKSxcbiAgZG9ja2VyZmlsZTogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICBpbnN0YWxsQ29tbWFuZHM6IHouYXJyYXkoei5zdHJpbmcoKSkub3B0aW9uYWwoKSxcbiAgY29tbWFuZHM6IHouYXJyYXkoei5zdHJpbmcoKSkub3B0aW9uYWwoKSxcbiAgZW52OiB6LnJlY29yZCh6LnN0cmluZygpLCB6LnN0cmluZygpKS5vcHRpb25hbCgpLFxuICBidWlsZEFyZ3M6IHoucmVjb3JkKHouc3RyaW5nKCksIHouc3RyaW5nKCkpLm9wdGlvbmFsKCksXG4gIHJlcXVpcmVkTWV0YWRhdGE6IHouYXJyYXkoei5zdHJpbmcoKSkub3B0aW9uYWwoKSxcbiAgcmVxdWlyZWRWYXJzOiB6LmFycmF5KHouc3RyaW5nKCkpLm9wdGlvbmFsKCksXG4gIC8vIEtlcHQgYXMgZnJlZS1zdHJpbmcgbWFwcyByYXRoZXIgdGhhbiBhIHZhbHVlIGVudW06IHNoaXBwZWQgc3BlY3MgdXNlIGJvdGhcbiAgLy8gYGJvb2xgIGFuZCBgYm9vbGVhbmAsIGFuZCB0aGUgY29lcmNpb24tdnMtZGVjbGFyZWQtdHlwZSBjb25zaXN0ZW5jeSBpc1xuICAvLyBlbmZvcmNlZCBzZXBhcmF0ZWx5IGJ5IHRoZSB0ZW1wbGF0ZSBjb250cmFjdCBjaGVjay4gVGhlIHNjaGVtYSBvbmx5XG4gIC8vIGd1YXJhbnRlZXMgdGhleSdyZSBzdHJpbmctdmFsdWVkIHJlY29yZHMgaGVyZS5cbiAgbWV0YWRhdGFUeXBlczogei5yZWNvcmQoei5zdHJpbmcoKSwgei5zdHJpbmcoKSkub3B0aW9uYWwoKSxcbiAgdmFyc1R5cGVzOiB6LnJlY29yZCh6LnN0cmluZygpLCB6LnN0cmluZygpKS5vcHRpb25hbCgpLFxuICAvLyBBIGNvbW1hbmQgdGhlIGJ1aWxkIHRvb2xpbmcgcnVucyBhZ2FpbnN0IHRoZSBidWlsdCBpbWFnZVxuICAvLyAoYnVpbGQtcGx1Z2luLWltYWdlcy5zaCwgdGVzdC1wbHVnaW5zLnNoIC0tYnVpbGQsIGBwbHVnaW4gdGVzdGApLlxuICBzbW9rZVRlc3Q6IHouc3RyaW5nKCkub3B0aW9uYWwoKSxcbiAgLy8gRG9jdW1lbnRhdGlvbiArIHRydXN0IG1ldGFkYXRhLiBUaGUgUkVBRE1FIGlzIE5PVCBhIHNwZWMgZmllbGQg4oCUIGl0XG4gIC8vIGlzIFJFQURNRS5tZCBhdCB0aGUgemlwIHJvb3QuXG4gIGxpY2Vuc2U6IHouc3RyaW5nKCkucmVmaW5lKGlzQWxsb3dlZFNwZHhJZCwge1xuICAgIG1lc3NhZ2U6ICdtdXN0IGJlIGEgc3VwcG9ydGVkIFNQRFggbGljZW5zZSBpZGVudGlmaWVyIChlLmcuIEFwYWNoZS0yLjAsIE1JVCknLFxuICB9KS5vcHRpb25hbCgpLFxuICBjaGFuZ2Vsb2c6IHouc3RyaW5nKCkucmVmaW5lKCh2KSA9PiBuZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUodikubGVuZ3RoIDw9IFBMVUdJTl9DSEFOR0VMT0dfTUFYX0JZVEVTLCB7XG4gICAgbWVzc2FnZTogYG11c3QgYmUgYXQgbW9zdCAke1BMVUdJTl9DSEFOR0VMT0dfTUFYX0JZVEVTfSBieXRlc2AsXG4gIH0pLm9wdGlvbmFsKCksXG4gIGhvbWVwYWdlVXJsOiBQcm9qZWN0VXJsU2NoZW1hLm9wdGlvbmFsKCksXG4gIHNvdXJjZVVybDogUHJvamVjdFVybFNjaGVtYS5vcHRpb25hbCgpLFxuICAvLyBDYXRhbG9nIG1ldGFkYXRhOiB0aGUgY2FyZCBvbmUtbGluZXIgYW5kIHRoZSBkb2NzIGxpbmsuIFNhbWVcbiAgLy8gdmFsaWRhdG9ycyBhcyBhIHZhbHVlIHR5cGVkIGludG8gdGhlIHVwbG9hZCBmb3JtLlxuICBzdW1tYXJ5OiBQTFVHSU5fQ0FUQUxPR19GSUVMRF9TQ0hFTUFTLnN1bW1hcnkub3B0aW9uYWwoKSxcbiAgZG9jdW1lbnRhdGlvblVybDogUHJvamVjdFVybFNjaGVtYS5vcHRpb25hbCgpLFxuICBpY29uOiB6LnVuaW9uKFtcbiAgICBJY29uS2V5U2NoZW1hLFxuICAgIHoub2JqZWN0KHsga2V5OiBJY29uS2V5U2NoZW1hLCBiYWRnZTogSWNvbktleVNjaGVtYS5vcHRpb25hbCgpIH0pLnN0cmljdCgpLFxuICBdKS5vcHRpb25hbCgpLFxuICBuZXR3b3JrOiB6Lm9iamVjdCh7XG4gICAgZWdyZXNzOiB6LmFycmF5KHouc3RyaW5nKCkucmVmaW5lKGlzVmFsaWRFZ3Jlc3NIb3N0LCB7XG4gICAgICBtZXNzYWdlOiAnbXVzdCBiZSBhIGJhcmUgaG9zdG5hbWUgKG5vIHNjaGVtZSwgcG9ydCBvciBwYXRoOyBvbmUgbGVhZGluZyAqLiBhbGxvd2VkKScsXG4gICAgfSkpLm1heChFR1JFU1NfTUFYX0hPU1RTKS5vcHRpb25hbCgpLFxuICB9KS5zdHJpY3QoKS5vcHRpb25hbCgpLFxufSkuc3RyaWN0KCk7XG5leHBvcnQgdHlwZSBQbHVnaW5TcGVjSW5wdXQgPSB6LmluZmVyPHR5cGVvZiBQbHVnaW5TcGVjU2NoZW1hPjtcblxuLyoqXG4gKiBSZXN1bHQgb2YgY2hlY2tpbmcgYSBwYXJzZWQgWUFNTCBkb2N1bWVudCBhZ2FpbnN0IGEgcGFja2FnZSBzY2hlbWE6XG4gKiBgaXNzdWVzYCBhcmUgdGhlIGluZGl2aWR1YWwgcHJvYmxlbXMsIGBtZXNzYWdlYCB0aGUgb25lLWxpbmUgZm9ybSB0aGUgdXBsb2FkXG4gKiBBUEkgcmVwb3J0cyAoYHBsdWdpbi1zcGVjLnlhbWw6IDxwYXRoPjogPHByb2JsZW0+OyDigKZgKS5cbiAqL1xuZXhwb3J0IHR5cGUgUGFja2FnZUNoZWNrPFQ+ID0geyBvazogdHJ1ZTsgdmFsdWU6IFQgfSB8IHsgb2s6IGZhbHNlOyBpc3N1ZXM6IHN0cmluZ1tdOyBtZXNzYWdlOiBzdHJpbmcgfTtcblxuY29uc3QgaXNNYXBwaW5nID0gKHJhdzogdW5rbm93bik6IHJhdyBpcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiA9PlxuICB0eXBlb2YgcmF3ID09PSAnb2JqZWN0JyAmJiByYXcgIT09IG51bGwgJiYgIUFycmF5LmlzQXJyYXkocmF3KTtcblxuZnVuY3Rpb24gY2hlY2tBZ2FpbnN0PFQ+KGZpbGU6IHN0cmluZywgcmF3OiB1bmtub3duLCBzY2hlbWE6IHouWm9kVHlwZTxUPiwgd2l0aFBhdGg6IGJvb2xlYW4pOiBQYWNrYWdlQ2hlY2s8VD4ge1xuICBpZiAoIWlzTWFwcGluZyhyYXcpKSB7XG4gICAgY29uc3QgbWVzc2FnZSA9IGAke2ZpbGV9IG11c3QgYmUgYSBZQU1MIG1hcHBpbmdgO1xuICAgIHJldHVybiB7IG9rOiBmYWxzZSwgaXNzdWVzOiBbbWVzc2FnZV0sIG1lc3NhZ2UgfTtcbiAgfVxuICBjb25zdCByZXN1bHQgPSBzY2hlbWEuc2FmZVBhcnNlKHJhdyk7XG4gIGlmIChyZXN1bHQuc3VjY2VzcykgcmV0dXJuIHsgb2s6IHRydWUsIHZhbHVlOiByZXN1bHQuZGF0YSB9O1xuICBjb25zdCBpc3N1ZXMgPSByZXN1bHQuZXJyb3IuaXNzdWVzLm1hcChpID0+ICh3aXRoUGF0aCA/IGAke2kucGF0aC5qb2luKCcuJykgfHwgJyhyb290KSd9OiAke2kubWVzc2FnZX1gIDogaS5tZXNzYWdlKSk7XG4gIHJldHVybiB7IG9rOiBmYWxzZSwgaXNzdWVzLCBtZXNzYWdlOiBgJHtmaWxlfTogJHtpc3N1ZXMuam9pbignOyAnKX1gIH07XG59XG5cbi8qKiBDaGVjayBhIHBhcnNlZCBgcGx1Z2luLXNwZWMueWFtbGAgZG9jdW1lbnQgYWdhaW5zdCB7QGxpbmsgUGx1Z2luU3BlY1NjaGVtYX0uICovXG5leHBvcnQgZnVuY3Rpb24gY2hlY2tQbHVnaW5TcGVjKHJhdzogdW5rbm93bik6IFBhY2thZ2VDaGVjazxQbHVnaW5TcGVjSW5wdXQ+IHtcbiAgcmV0dXJuIGNoZWNrQWdhaW5zdCgncGx1Z2luLXNwZWMueWFtbCcsIHJhdywgUGx1Z2luU3BlY1NjaGVtYSwgdHJ1ZSk7XG59XG5cbi8qKiBDaGVjayBhIHBhcnNlZCBgY29uZmlnLnlhbWxgIGRvY3VtZW50IGFnYWluc3Qge0BsaW5rIFBsdWdpbkNvbmZpZ1NjaGVtYX0uICovXG5leHBvcnQgZnVuY3Rpb24gY2hlY2tQbHVnaW5Db25maWcocmF3OiB1bmtub3duKTogUGFja2FnZUNoZWNrPFBsdWdpbkNvbmZpZ0lucHV0PiB7XG4gIHJldHVybiBjaGVja0FnYWluc3QoJ2NvbmZpZy55YW1sJywgcmF3LCBQbHVnaW5Db25maWdTY2hlbWEsIGZhbHNlKTtcbn1cblxuLyoqXG4gKiBUaGUgcmVxdWlyZWQtZmllbGQgY29udHJhY3Q6IGBuYW1lYCBhbmQgYHZlcnNpb25gIGFsd2F5cywgYGNvbW1hbmRzYCBmb3JcbiAqIGV2ZXJ5IHR5cGUgZXhjZXB0IGBNYW51YWxBcHByb3ZhbFN0ZXBgLiBSZXR1cm5zIHRoZSB1cGxvYWQncyBtZXNzYWdlLCBvciBudWxsLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcGx1Z2luU3BlY1JlcXVpcmVkRmllbGRzUHJvYmxlbShzcGVjOiBQaWNrPFBsdWdpblNwZWNJbnB1dCwgJ25hbWUnIHwgJ3ZlcnNpb24nIHwgJ2NvbW1hbmRzJyB8ICdwbHVnaW5UeXBlJz4pOiBzdHJpbmcgfCBudWxsIHtcbiAgY29uc3QgaXNBcHByb3ZhbFN0ZXAgPSBzcGVjLnBsdWdpblR5cGUgPT09ICdNYW51YWxBcHByb3ZhbFN0ZXAnO1xuICBpZiAoIXNwZWMubmFtZSB8fCAhc3BlYy52ZXJzaW9uIHx8ICghaXNBcHByb3ZhbFN0ZXAgJiYgIXNwZWMuY29tbWFuZHMpKSB7XG4gICAgcmV0dXJuICdJbnZhbGlkIHNwZWM6IG5hbWUsIHZlcnNpb24sIGFuZCBjb21tYW5kcyBhcmUgcmVxdWlyZWQnO1xuICB9XG4gIHJldHVybiBudWxsO1xufVxuIl19

package/lib/validation/plugin-template-contract.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The plugin spec's `{{ ... }}` TEMPLATE CONTRACT, exactly as the plugin
+ * service checks an upload. Shared from api-core so the upload path
+ * (api/plugin) and the CLI (`pipeline-manager plugin validate` / `test` /
+ * `publish`) apply ONE check and can't drift (plugin-ecosystem W6).
+ *
+ * Pure: it returns issues and never throws. The template engine (tokenizer and
+ * scope validator) lives in pipeline-core, which depends on api-core, so the
+ * caller hands it in as {@link PluginTemplateEngine}; pipeline-core's module
+ * satisfies the interface as-is.
+ */
+/** Scope roots a plugin template may reference. */
+export declare const PLUGIN_TEMPLATE_SCOPE_ROOTS: readonly ['pipeline', 'plugin', 'env'];
+/** Spec fields whose strings may carry `{{ ... }}` templates. */
+export declare const PLUGIN_TEMPLATABLE_FIELDS: readonly ['description', 'commands', 'installCommands', 'env', 'buildArgs'];
+/** True when a walked field path (`commands[2]`, `env.STAGE`) is templatable. */
+export declare function isPluginTemplatableField(field: string): boolean;
+/** The slice of pipeline-core's template engine this check uses. */
+export interface PluginTemplateEngine {
+    allowedScopeRoots(roots: string[]): (path: string[]) => boolean;
+    validateTemplates(doc: object, isTemplatable: (field: string) => boolean, isKnownPath: (path: string[]) => boolean): {
+        errors: ReadonlyArray<{
+            field: string;
+            line?: number;
+            col?: number;
+            message: string;
+        }>;
+    };
+    tokenize(source: string): ReadonlyArray<{
+        kind: string;
+        path?: string[];
+        defaultValue?: string;
+        coerce?: string;
+    }>;
+}
+/**
+ * One template-contract problem.
+ * - `template`: a parse error, unknown scope root or reserved `secrets.*` path.
+ * - `undeclared`: `{{ pipeline.metadata.X }}` / `{{ pipeline.vars.X }}` without
+ *   `X` in `requiredMetadata` / `requiredVars` (and no `| default:`).
+ * - `type-mismatch`: a `| number|bool|json` filter whose declared type differs.
+ */
+export interface PluginTemplateIssue {
+    kind: 'template' | 'undeclared' | 'type-mismatch';
+    /** The spec field (`commands[0]`) for `template` issues; the scope path otherwise. */
+    field: string;
+    line?: number;
+    col?: number;
+    message: string;
+}
+/**
+ * Every `{{ ... }}` problem in a plugin spec: parse errors and scope roots
+ * (only `pipeline`, `plugin`, `env`; `secrets` is reserved), then per
+ * `{{ pipeline.metadata.X }}` / `{{ pipeline.vars.X }}` reference (a) that `X`
+ * is declared in `requiredMetadata` / `requiredVars` unless it has a
+ * `| default:`, and (b) that a coercion filter matches the declared type in
+ * `metadataTypes` / `varsTypes` (undeclared = `string`; `boolean` = `bool`).
+ *
+ * Takes the raw spec object, so a spec that failed the schema is still checked.
+ * Issues are de-duplicated; an empty array means the spec passes.
+ */
+export declare function checkPluginTemplates(spec: object, engine: PluginTemplateEngine): PluginTemplateIssue[];
+/** One line per issue: `[commands[0]:1:5] message` for template issues, the message otherwise. */
+export declare function formatPluginTemplateIssue(issue: PluginTemplateIssue): string;

package/lib/validation/plugin-template-contract.js

@@ -0,0 +1,113 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * The plugin spec's `{{ ... }}` TEMPLATE CONTRACT, exactly as the plugin
+ * service checks an upload. Shared from api-core so the upload path
+ * (api/plugin) and the CLI (`pipeline-manager plugin validate` / `test` /
+ * `publish`) apply ONE check and can't drift (plugin-ecosystem W6).
+ *
+ * Pure: it returns issues and never throws. The template engine (tokenizer and
+ * scope validator) lives in pipeline-core, which depends on api-core, so the
+ * caller hands it in as {@link PluginTemplateEngine}; pipeline-core's module
+ * satisfies the interface as-is.
+ */
+/** Scope roots a plugin template may reference. */
+export const PLUGIN_TEMPLATE_SCOPE_ROOTS = ['pipeline', 'plugin', 'env'];
+/** Spec fields whose strings may carry `{{ ... }}` templates. */
+export const PLUGIN_TEMPLATABLE_FIELDS = ['description', 'commands', 'installCommands', 'env', 'buildArgs'];
+/** True when a walked field path (`commands[2]`, `env.STAGE`) is templatable. */
+export function isPluginTemplatableField(field) {
+    return PLUGIN_TEMPLATABLE_FIELDS.some((f) => field === f || field.startsWith(`${f}[`) || field.startsWith(`${f}.`));
+}
+const COERCE_TO_TYPE = { number: 'number', bool: 'bool', json: 'json' };
+const stringList = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+const stringValues = (v) => (v && typeof v === 'object' && !Array.isArray(v)
+    ? Object.values(v).filter((x) => typeof x === 'string')
+    : []);
+const stringMap = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+/**
+ * Every `{{ ... }}` problem in a plugin spec: parse errors and scope roots
+ * (only `pipeline`, `plugin`, `env`; `secrets` is reserved), then per
+ * `{{ pipeline.metadata.X }}` / `{{ pipeline.vars.X }}` reference (a) that `X`
+ * is declared in `requiredMetadata` / `requiredVars` unless it has a
+ * `| default:`, and (b) that a coercion filter matches the declared type in
+ * `metadataTypes` / `varsTypes` (undeclared = `string`; `boolean` = `bool`).
+ *
+ * Takes the raw spec object, so a spec that failed the schema is still checked.
+ * Issues are de-duplicated; an empty array means the spec passes.
+ */
+export function checkPluginTemplates(spec, engine) {
+    const s = spec;
+    const doc = {
+        description: s.description,
+        commands: s.commands,
+        installCommands: s.installCommands,
+        env: s.env,
+        buildArgs: s.buildArgs,
+    };
+    const issues = [];
+    const { errors } = engine.validateTemplates(doc, isPluginTemplatableField, engine.allowedScopeRoots([...PLUGIN_TEMPLATE_SCOPE_ROOTS]));
+    for (const e of errors) {
+        issues.push({ kind: 'template', field: e.field, ...(e.line !== undefined && { line: e.line, col: e.col }), message: e.message });
+    }
+    const required = { metadata: new Set(stringList(s.requiredMetadata)), vars: new Set(stringList(s.requiredVars)) };
+    const types = { metadata: stringMap(s.metadataTypes), vars: stringMap(s.varsTypes) };
+    const sources = [
+        ...(typeof s.description === 'string' ? [s.description] : []),
+        ...stringList(s.commands), ...stringList(s.installCommands), ...stringValues(s.env), ...stringValues(s.buildArgs),
+    ];
+    const seen = new Set();
+    const add = (issue) => {
+        const key = `${issue.kind}\u0000${issue.message}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            issues.push(issue);
+        }
+    };
+    for (const source of sources) {
+        if (!source.includes('{{'))
+            continue;
+        let tokens;
+        try {
+            tokens = engine.tokenize(source);
+        }
+        catch {
+            continue; /* reported as a `template` issue above */
+        }
+        for (const t of tokens) {
+            if (t.kind !== 'expr' || !t.path)
+                continue;
+            const [root, sub, key] = t.path;
+            if (root !== 'pipeline' || (sub !== 'metadata' && sub !== 'vars') || !key)
+                continue;
+            const scopePath = `pipeline.${sub}.${key}`;
+            const declaredIn = sub === 'metadata' ? 'requiredMetadata' : 'requiredVars';
+            const typesIn = sub === 'metadata' ? 'metadataTypes' : 'varsTypes';
+            if (t.defaultValue === undefined && !required[sub].has(key)) {
+                add({ kind: 'undeclared', field: scopePath, message: `${scopePath} is not declared in '${declaredIn}' (declare it, or add '| default: ...')` });
+            }
+            const expected = t.coerce ? COERCE_TO_TYPE[t.coerce] : undefined;
+            if (expected) {
+                // Shipped specs spell the boolean type both `bool` and `boolean`; the
+                // stored contract (and the filter) use `bool`.
+                const raw = types[sub][key] ?? 'string';
+                const declared = raw === 'boolean' ? 'bool' : raw;
+                if (declared !== expected) {
+                    add({
+                        kind: 'type-mismatch',
+                        field: scopePath,
+                        message: `${scopePath} uses '| ${t.coerce}' but declared type is '${declared}' (add '${key}: ${expected}' to ${typesIn})`,
+                    });
+                }
+            }
+        }
+    }
+    return issues;
+}
+/** One line per issue: `[commands[0]:1:5] message` for template issues, the message otherwise. */
+export function formatPluginTemplateIssue(issue) {
+    if (issue.kind !== 'template')
+        return issue.message;
+    return `[${issue.field}${issue.line !== undefined ? `:${issue.line}:${issue.col}` : ''}] ${issue.message}`;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLXRlbXBsYXRlLWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ZhbGlkYXRpb24vcGx1Z2luLXRlbXBsYXRlLWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7Ozs7R0FVRztBQUVILG1EQUFtRDtBQUNuRCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLFVBQVUsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFVLENBQUM7QUFFbEYsaUVBQWlFO0FBQ2pFLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsYUFBYSxFQUFFLFVBQVUsRUFBRSxpQkFBaUIsRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFVLENBQUM7QUFFckgsaUZBQWlGO0FBQ2pGLE1BQU0sVUFBVSx3QkFBd0IsQ0FBQyxLQUFhO0lBQ3BELE9BQU8seUJBQXlCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDdEgsQ0FBQztBQTZCRCxNQUFNLGNBQWMsR0FBcUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBRTFHLE1BQU0sVUFBVSxHQUFHLENBQUMsQ0FBVSxFQUFZLEVBQUUsQ0FDMUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFlLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDaEYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxDQUFVLEVBQVksRUFBRSxDQUM1QyxDQUFDLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM5QyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUE0QixDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFlLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxRQUFRLENBQUM7SUFDL0YsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ1YsTUFBTSxTQUFTLEdBQUcsQ0FBQyxDQUFVLEVBQTBCLEVBQUUsQ0FDdkQsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBMkIsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFdkY7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sVUFBVSxvQkFBb0IsQ0FBQyxJQUFZLEVBQUUsTUFBNEI7SUFDN0UsTUFBTSxDQUFDLEdBQUcsSUFBK0IsQ0FBQztJQUMxQyxNQUFNLEdBQUcsR0FBRztRQUNWLFdBQVcsRUFBRSxDQUFDLENBQUMsV0FBVztRQUMxQixRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVE7UUFDcEIsZUFBZSxFQUFFLENBQUMsQ0FBQyxlQUFlO1FBQ2xDLEdBQUcsRUFBRSxDQUFDLENBQUMsR0FBRztRQUNWLFNBQVMsRUFBRSxDQUFDLENBQUMsU0FBUztLQUN2QixDQUFDO0lBQ0YsTUFBTSxNQUFNLEdBQTBCLEVBQUUsQ0FBQztJQUV6QyxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsRUFBRSx3QkFBd0IsRUFBRSxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxHQUFHLDJCQUEyQixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3ZJLEtBQUssTUFBTSxDQUFDLElBQUksTUFBTSxFQUFFLENBQUM7UUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNuSSxDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsRUFBRSxRQUFRLEVBQUUsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ2xILE1BQU0sS0FBSyxHQUFHLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUNyRixNQUFNLE9BQU8sR0FBRztRQUNkLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxXQUFXLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdELEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsRUFBRSxHQUFHLFVBQVUsQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFDLEVBQUUsR0FBRyxZQUFZLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEdBQUcsWUFBWSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7S0FDbEgsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDL0IsTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUEwQixFQUFFLEVBQUU7UUFDekMsTUFBTSxHQUFHLEdBQUcsR0FBRyxLQUFLLENBQUMsSUFBSSxTQUFTLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNsRCxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO0lBQzVELENBQUMsQ0FBQztJQUVGLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxFQUFFLENBQUM7UUFDN0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQUUsU0FBUztRQUNyQyxJQUFJLE1BQU0sQ0FBQztRQUNYLElBQUksQ0FBQztZQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUFDLFNBQVMsQ0FBQywwQ0FBMEM7UUFBQyxDQUFDO1FBQ3hHLEtBQUssTUFBTSxDQUFDLElBQUksTUFBTSxFQUFFLENBQUM7WUFDdkIsSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJO2dCQUFFLFNBQVM7WUFDM0MsTUFBTSxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNoQyxJQUFJLElBQUksS0FBSyxVQUFVLElBQUksQ0FBQyxHQUFHLEtBQUssVUFBVSxJQUFJLEdBQUcsS0FBSyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUc7Z0JBQUUsU0FBUztZQUNwRixNQUFNLFNBQVMsR0FBRyxZQUFZLEdBQUcsSUFBSSxHQUFHLEVBQUUsQ0FBQztZQUMzQyxNQUFNLFVBQVUsR0FBRyxHQUFHLEtBQUssVUFBVSxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDO1lBQzVFLE1BQU0sT0FBTyxHQUFHLEdBQUcsS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDO1lBRW5FLElBQUksQ0FBQyxDQUFDLFlBQVksS0FBSyxTQUFTLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzVELEdBQUcsQ0FBQyxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsR0FBRyxTQUFTLHdCQUF3QixVQUFVLHlDQUF5QyxFQUFFLENBQUMsQ0FBQztZQUNsSixDQUFDO1lBQ0QsTUFBTSxRQUFRLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1lBQ2pFLElBQUksUUFBUSxFQUFFLENBQUM7Z0JBQ2Isc0VBQXNFO2dCQUN0RSwrQ0FBK0M7Z0JBQy9DLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUM7Z0JBQ3hDLE1BQU0sUUFBUSxHQUFHLEdBQUcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUNsRCxJQUFJLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxDQUFDO3dCQUNGLElBQUksRUFBRSxlQUFlO3dCQUNyQixLQUFLLEVBQUUsU0FBUzt3QkFDaEIsT0FBTyxFQUFFLEdBQUcsU0FBUyxZQUFZLENBQUMsQ0FBQyxNQUFNLDJCQUEyQixRQUFRLFdBQVcsR0FBRyxLQUFLLFFBQVEsUUFBUSxPQUFPLEdBQUc7cUJBQzFILENBQUMsQ0FBQztnQkFDTCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELGtHQUFrRztBQUNsRyxNQUFNLFVBQVUseUJBQXlCLENBQUMsS0FBMEI7SUFDbEUsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFVBQVU7UUFBRSxPQUFPLEtBQUssQ0FBQyxPQUFPLENBQUM7SUFDcEQsT0FBTyxJQUFJLEtBQUssQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksSUFBSSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUM7QUFDN0csQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIFRoZSBwbHVnaW4gc3BlYydzIGB7eyAuLi4gfX1gIFRFTVBMQVRFIENPTlRSQUNULCBleGFjdGx5IGFzIHRoZSBwbHVnaW5cbiAqIHNlcnZpY2UgY2hlY2tzIGFuIHVwbG9hZC4gU2hhcmVkIGZyb20gYXBpLWNvcmUgc28gdGhlIHVwbG9hZCBwYXRoXG4gKiAoYXBpL3BsdWdpbikgYW5kIHRoZSBDTEkgKGBwaXBlbGluZS1tYW5hZ2VyIHBsdWdpbiB2YWxpZGF0ZWAgLyBgdGVzdGAgL1xuICogYHB1Ymxpc2hgKSBhcHBseSBPTkUgY2hlY2sgYW5kIGNhbid0IGRyaWZ0IChwbHVnaW4tZWNvc3lzdGVtIFc2KS5cbiAqXG4gKiBQdXJlOiBpdCByZXR1cm5zIGlzc3VlcyBhbmQgbmV2ZXIgdGhyb3dzLiBUaGUgdGVtcGxhdGUgZW5naW5lICh0b2tlbml6ZXIgYW5kXG4gKiBzY29wZSB2YWxpZGF0b3IpIGxpdmVzIGluIHBpcGVsaW5lLWNvcmUsIHdoaWNoIGRlcGVuZHMgb24gYXBpLWNvcmUsIHNvIHRoZVxuICogY2FsbGVyIGhhbmRzIGl0IGluIGFzIHtAbGluayBQbHVnaW5UZW1wbGF0ZUVuZ2luZX07IHBpcGVsaW5lLWNvcmUncyBtb2R1bGVcbiAqIHNhdGlzZmllcyB0aGUgaW50ZXJmYWNlIGFzLWlzLlxuICovXG5cbi8qKiBTY29wZSByb290cyBhIHBsdWdpbiB0ZW1wbGF0ZSBtYXkgcmVmZXJlbmNlLiAqL1xuZXhwb3J0IGNvbnN0IFBMVUdJTl9URU1QTEFURV9TQ09QRV9ST09UUyA9IFsncGlwZWxpbmUnLCAncGx1Z2luJywgJ2VudiddIGFzIGNvbnN0O1xuXG4vKiogU3BlYyBmaWVsZHMgd2hvc2Ugc3RyaW5ncyBtYXkgY2FycnkgYHt7IC4uLiB9fWAgdGVtcGxhdGVzLiAqL1xuZXhwb3J0IGNvbnN0IFBMVUdJTl9URU1QTEFUQUJMRV9GSUVMRFMgPSBbJ2Rlc2NyaXB0aW9uJywgJ2NvbW1hbmRzJywgJ2luc3RhbGxDb21tYW5kcycsICdlbnYnLCAnYnVpbGRBcmdzJ10gYXMgY29uc3Q7XG5cbi8qKiBUcnVlIHdoZW4gYSB3YWxrZWQgZmllbGQgcGF0aCAoYGNvbW1hbmRzWzJdYCwgYGVudi5TVEFHRWApIGlzIHRlbXBsYXRhYmxlLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzUGx1Z2luVGVtcGxhdGFibGVGaWVsZChmaWVsZDogc3RyaW5nKTogYm9vbGVhbiB7XG4gIHJldHVybiBQTFVHSU5fVEVNUExBVEFCTEVfRklFTERTLnNvbWUoKGYpID0+IGZpZWxkID09PSBmIHx8IGZpZWxkLnN0YXJ0c1dpdGgoYCR7Zn1bYCkgfHwgZmllbGQuc3RhcnRzV2l0aChgJHtmfS5gKSk7XG59XG5cbi8qKiBUaGUgc2xpY2Ugb2YgcGlwZWxpbmUtY29yZSdzIHRlbXBsYXRlIGVuZ2luZSB0aGlzIGNoZWNrIHVzZXMuICovXG5leHBvcnQgaW50ZXJmYWNlIFBsdWdpblRlbXBsYXRlRW5naW5lIHtcbiAgYWxsb3dlZFNjb3BlUm9vdHMocm9vdHM6IHN0cmluZ1tdKTogKHBhdGg6IHN0cmluZ1tdKSA9PiBib29sZWFuO1xuICB2YWxpZGF0ZVRlbXBsYXRlcyhcbiAgICBkb2M6IG9iamVjdCxcbiAgICBpc1RlbXBsYXRhYmxlOiAoZmllbGQ6IHN0cmluZykgPT4gYm9vbGVhbixcbiAgICBpc0tub3duUGF0aDogKHBhdGg6IHN0cmluZ1tdKSA9PiBib29sZWFuLFxuICApOiB7IGVycm9yczogUmVhZG9ubHlBcnJheTx7IGZpZWxkOiBzdHJpbmc7IGxpbmU/OiBudW1iZXI7IGNvbD86IG51bWJlcjsgbWVzc2FnZTogc3RyaW5nIH0+IH07XG4gIHRva2VuaXplKHNvdXJjZTogc3RyaW5nKTogUmVhZG9ubHlBcnJheTx7IGtpbmQ6IHN0cmluZzsgcGF0aD86IHN0cmluZ1tdOyBkZWZhdWx0VmFsdWU/OiBzdHJpbmc7IGNvZXJjZT86IHN0cmluZyB9Pjtcbn1cblxuLyoqXG4gKiBPbmUgdGVtcGxhdGUtY29udHJhY3QgcHJvYmxlbS5cbiAqIC0gYHRlbXBsYXRlYDogYSBwYXJzZSBlcnJvciwgdW5rbm93biBzY29wZSByb290IG9yIHJlc2VydmVkIGBzZWNyZXRzLipgIHBhdGguXG4gKiAtIGB1bmRlY2xhcmVkYDogYHt7IHBpcGVsaW5lLm1ldGFkYXRhLlggfX1gIC8gYHt7IHBpcGVsaW5lLnZhcnMuWCB9fWAgd2l0aG91dFxuICogICBgWGAgaW4gYHJlcXVpcmVkTWV0YWRhdGFgIC8gYHJlcXVpcmVkVmFyc2AgKGFuZCBubyBgfCBkZWZhdWx0OmApLlxuICogLSBgdHlwZS1taXNtYXRjaGA6IGEgYHwgbnVtYmVyfGJvb2x8anNvbmAgZmlsdGVyIHdob3NlIGRlY2xhcmVkIHR5cGUgZGlmZmVycy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQbHVnaW5UZW1wbGF0ZUlzc3VlIHtcbiAga2luZDogJ3RlbXBsYXRlJyB8ICd1bmRlY2xhcmVkJyB8ICd0eXBlLW1pc21hdGNoJztcbiAgLyoqIFRoZSBzcGVjIGZpZWxkIChgY29tbWFuZHNbMF1gKSBmb3IgYHRlbXBsYXRlYCBpc3N1ZXM7IHRoZSBzY29wZSBwYXRoIG90aGVyd2lzZS4gKi9cbiAgZmllbGQ6IHN0cmluZztcbiAgbGluZT86IG51bWJlcjtcbiAgY29sPzogbnVtYmVyO1xuICBtZXNzYWdlOiBzdHJpbmc7XG59XG5cbmNvbnN0IENPRVJDRV9UT19UWVBFOiBSZWFkb25seTxSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+PiA9IHsgbnVtYmVyOiAnbnVtYmVyJywgYm9vbDogJ2Jvb2wnLCBqc29uOiAnanNvbicgfTtcblxuY29uc3Qgc3RyaW5nTGlzdCA9ICh2OiB1bmtub3duKTogc3RyaW5nW10gPT5cbiAgKEFycmF5LmlzQXJyYXkodikgPyB2LmZpbHRlcigoeCk6IHggaXMgc3RyaW5nID0+IHR5cGVvZiB4ID09PSAnc3RyaW5nJykgOiBbXSk7XG5jb25zdCBzdHJpbmdWYWx1ZXMgPSAodjogdW5rbm93bik6IHN0cmluZ1tdID0+XG4gICh2ICYmIHR5cGVvZiB2ID09PSAnb2JqZWN0JyAmJiAhQXJyYXkuaXNBcnJheSh2KVxuICAgID8gT2JqZWN0LnZhbHVlcyh2IGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+KS5maWx0ZXIoKHgpOiB4IGlzIHN0cmluZyA9PiB0eXBlb2YgeCA9PT0gJ3N0cmluZycpXG4gICAgOiBbXSk7XG5jb25zdCBzdHJpbmdNYXAgPSAodjogdW5rbm93bik6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPT5cbiAgKHYgJiYgdHlwZW9mIHYgPT09ICdvYmplY3QnICYmICFBcnJheS5pc0FycmF5KHYpID8gdiBhcyBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+IDoge30pO1xuXG4vKipcbiAqIEV2ZXJ5IGB7eyAuLi4gfX1gIHByb2JsZW0gaW4gYSBwbHVnaW4gc3BlYzogcGFyc2UgZXJyb3JzIGFuZCBzY29wZSByb290c1xuICogKG9ubHkgYHBpcGVsaW5lYCwgYHBsdWdpbmAsIGBlbnZgOyBgc2VjcmV0c2AgaXMgcmVzZXJ2ZWQpLCB0aGVuIHBlclxuICogYHt7IHBpcGVsaW5lLm1ldGFkYXRhLlggfX1gIC8gYHt7IHBpcGVsaW5lLnZhcnMuWCB9fWAgcmVmZXJlbmNlIChhKSB0aGF0IGBYYFxuICogaXMgZGVjbGFyZWQgaW4gYHJlcXVpcmVkTWV0YWRhdGFgIC8gYHJlcXVpcmVkVmFyc2AgdW5sZXNzIGl0IGhhcyBhXG4gKiBgfCBkZWZhdWx0OmAsIGFuZCAoYikgdGhhdCBhIGNvZXJjaW9uIGZpbHRlciBtYXRjaGVzIHRoZSBkZWNsYXJlZCB0eXBlIGluXG4gKiBgbWV0YWRhdGFUeXBlc2AgLyBgdmFyc1R5cGVzYCAodW5kZWNsYXJlZCA9IGBzdHJpbmdgOyBgYm9vbGVhbmAgPSBgYm9vbGApLlxuICpcbiAqIFRha2VzIHRoZSByYXcgc3BlYyBvYmplY3QsIHNvIGEgc3BlYyB0aGF0IGZhaWxlZCB0aGUgc2NoZW1hIGlzIHN0aWxsIGNoZWNrZWQuXG4gKiBJc3N1ZXMgYXJlIGRlLWR1cGxpY2F0ZWQ7IGFuIGVtcHR5IGFycmF5IG1lYW5zIHRoZSBzcGVjIHBhc3Nlcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNoZWNrUGx1Z2luVGVtcGxhdGVzKHNwZWM6IG9iamVjdCwgZW5naW5lOiBQbHVnaW5UZW1wbGF0ZUVuZ2luZSk6IFBsdWdpblRlbXBsYXRlSXNzdWVbXSB7XG4gIGNvbnN0IHMgPSBzcGVjIGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+O1xuICBjb25zdCBkb2MgPSB7XG4gICAgZGVzY3JpcHRpb246IHMuZGVzY3JpcHRpb24sXG4gICAgY29tbWFuZHM6IHMuY29tbWFuZHMsXG4gICAgaW5zdGFsbENvbW1hbmRzOiBzLmluc3RhbGxDb21tYW5kcyxcbiAgICBlbnY6IHMuZW52LFxuICAgIGJ1aWxkQXJnczogcy5idWlsZEFyZ3MsXG4gIH07XG4gIGNvbnN0IGlzc3VlczogUGx1Z2luVGVtcGxhdGVJc3N1ZVtdID0gW107XG5cbiAgY29uc3QgeyBlcnJvcnMgfSA9IGVuZ2luZS52YWxpZGF0ZVRlbXBsYXRlcyhkb2MsIGlzUGx1Z2luVGVtcGxhdGFibGVGaWVsZCwgZW5naW5lLmFsbG93ZWRTY29wZVJvb3RzKFsuLi5QTFVHSU5fVEVNUExBVEVfU0NPUEVfUk9PVFNdKSk7XG4gIGZvciAoY29uc3QgZSBvZiBlcnJvcnMpIHtcbiAgICBpc3N1ZXMucHVzaCh7IGtpbmQ6ICd0ZW1wbGF0ZScsIGZpZWxkOiBlLmZpZWxkLCAuLi4oZS5saW5lICE9PSB1bmRlZmluZWQgJiYgeyBsaW5lOiBlLmxpbmUsIGNvbDogZS5jb2wgfSksIG1lc3NhZ2U6IGUubWVzc2FnZSB9KTtcbiAgfVxuXG4gIGNvbnN0IHJlcXVpcmVkID0geyBtZXRhZGF0YTogbmV3IFNldChzdHJpbmdMaXN0KHMucmVxdWlyZWRNZXRhZGF0YSkpLCB2YXJzOiBuZXcgU2V0KHN0cmluZ0xpc3Qocy5yZXF1aXJlZFZhcnMpKSB9O1xuICBjb25zdCB0eXBlcyA9IHsgbWV0YWRhdGE6IHN0cmluZ01hcChzLm1ldGFkYXRhVHlwZXMpLCB2YXJzOiBzdHJpbmdNYXAocy52YXJzVHlwZXMpIH07XG4gIGNvbnN0IHNvdXJjZXMgPSBbXG4gICAgLi4uKHR5cGVvZiBzLmRlc2NyaXB0aW9uID09PSAnc3RyaW5nJyA/IFtzLmRlc2NyaXB0aW9uXSA6IFtdKSxcbiAgICAuLi5zdHJpbmdMaXN0KHMuY29tbWFuZHMpLCAuLi5zdHJpbmdMaXN0KHMuaW5zdGFsbENvbW1hbmRzKSwgLi4uc3RyaW5nVmFsdWVzKHMuZW52KSwgLi4uc3RyaW5nVmFsdWVzKHMuYnVpbGRBcmdzKSxcbiAgXTtcbiAgY29uc3Qgc2VlbiA9IG5ldyBTZXQ8c3RyaW5nPigpO1xuICBjb25zdCBhZGQgPSAoaXNzdWU6IFBsdWdpblRlbXBsYXRlSXNzdWUpID0+IHtcbiAgICBjb25zdCBrZXkgPSBgJHtpc3N1ZS5raW5kfVxcdTAwMDAke2lzc3VlLm1lc3NhZ2V9YDtcbiAgICBpZiAoIXNlZW4uaGFzKGtleSkpIHsgc2Vlbi5hZGQoa2V5KTsgaXNzdWVzLnB1c2goaXNzdWUpOyB9XG4gIH07XG5cbiAgZm9yIChjb25zdCBzb3VyY2Ugb2Ygc291cmNlcykge1xuICAgIGlmICghc291cmNlLmluY2x1ZGVzKCd7eycpKSBjb250aW51ZTtcbiAgICBsZXQgdG9rZW5zO1xuICAgIHRyeSB7IHRva2VucyA9IGVuZ2luZS50b2tlbml6ZShzb3VyY2UpOyB9IGNhdGNoIHsgY29udGludWU7IC8qIHJlcG9ydGVkIGFzIGEgYHRlbXBsYXRlYCBpc3N1ZSBhYm92ZSAqLyB9XG4gICAgZm9yIChjb25zdCB0IG9mIHRva2Vucykge1xuICAgICAgaWYgKHQua2luZCAhPT0gJ2V4cHInIHx8ICF0LnBhdGgpIGNvbnRpbnVlO1xuICAgICAgY29uc3QgW3Jvb3QsIHN1Yiwga2V5XSA9IHQucGF0aDtcbiAgICAgIGlmIChyb290ICE9PSAncGlwZWxpbmUnIHx8IChzdWIgIT09ICdtZXRhZGF0YScgJiYgc3ViICE9PSAndmFycycpIHx8ICFrZXkpIGNvbnRpbnVlO1xuICAgICAgY29uc3Qgc2NvcGVQYXRoID0gYHBpcGVsaW5lLiR7c3VifS4ke2tleX1gO1xuICAgICAgY29uc3QgZGVjbGFyZWRJbiA9IHN1YiA9PT0gJ21ldGFkYXRhJyA/ICdyZXF1aXJlZE1ldGFkYXRhJyA6ICdyZXF1aXJlZFZhcnMnO1xuICAgICAgY29uc3QgdHlwZXNJbiA9IHN1YiA9PT0gJ21ldGFkYXRhJyA/ICdtZXRhZGF0YVR5cGVzJyA6ICd2YXJzVHlwZXMnO1xuXG4gICAgICBpZiAodC5kZWZhdWx0VmFsdWUgPT09IHVuZGVmaW5lZCAmJiAhcmVxdWlyZWRbc3ViXS5oYXMoa2V5KSkge1xuICAgICAgICBhZGQoeyBraW5kOiAndW5kZWNsYXJlZCcsIGZpZWxkOiBzY29wZVBhdGgsIG1lc3NhZ2U6IGAke3Njb3BlUGF0aH0gaXMgbm90IGRlY2xhcmVkIGluICcke2RlY2xhcmVkSW59JyAoZGVjbGFyZSBpdCwgb3IgYWRkICd8IGRlZmF1bHQ6IC4uLicpYCB9KTtcbiAgICAgIH1cbiAgICAgIGNvbnN0IGV4cGVjdGVkID0gdC5jb2VyY2UgPyBDT0VSQ0VfVE9fVFlQRVt0LmNvZXJjZV0gOiB1bmRlZmluZWQ7XG4gICAgICBpZiAoZXhwZWN0ZWQpIHtcbiAgICAgICAgLy8gU2hpcHBlZCBzcGVjcyBzcGVsbCB0aGUgYm9vbGVhbiB0eXBlIGJvdGggYGJvb2xgIGFuZCBgYm9vbGVhbmA7IHRoZVxuICAgICAgICAvLyBzdG9yZWQgY29udHJhY3QgKGFuZCB0aGUgZmlsdGVyKSB1c2UgYGJvb2xgLlxuICAgICAgICBjb25zdCByYXcgPSB0eXBlc1tzdWJdW2tleV0gPz8gJ3N0cmluZyc7XG4gICAgICAgIGNvbnN0IGRlY2xhcmVkID0gcmF3ID09PSAnYm9vbGVhbicgPyAnYm9vbCcgOiByYXc7XG4gICAgICAgIGlmIChkZWNsYXJlZCAhPT0gZXhwZWN0ZWQpIHtcbiAgICAgICAgICBhZGQoe1xuICAgICAgICAgICAga2luZDogJ3R5cGUtbWlzbWF0Y2gnLFxuICAgICAgICAgICAgZmllbGQ6IHNjb3BlUGF0aCxcbiAgICAgICAgICAgIG1lc3NhZ2U6IGAke3Njb3BlUGF0aH0gdXNlcyAnfCAke3QuY29lcmNlfScgYnV0IGRlY2xhcmVkIHR5cGUgaXMgJyR7ZGVjbGFyZWR9JyAoYWRkICcke2tleX06ICR7ZXhwZWN0ZWR9JyB0byAke3R5cGVzSW59KWAsXG4gICAgICAgICAgfSk7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9XG4gIH1cbiAgcmV0dXJuIGlzc3Vlcztcbn1cblxuLyoqIE9uZSBsaW5lIHBlciBpc3N1ZTogYFtjb21tYW5kc1swXToxOjVdIG1lc3NhZ2VgIGZvciB0ZW1wbGF0ZSBpc3N1ZXMsIHRoZSBtZXNzYWdlIG90aGVyd2lzZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBmb3JtYXRQbHVnaW5UZW1wbGF0ZUlzc3VlKGlzc3VlOiBQbHVnaW5UZW1wbGF0ZUlzc3VlKTogc3RyaW5nIHtcbiAgaWYgKGlzc3VlLmtpbmQgIT09ICd0ZW1wbGF0ZScpIHJldHVybiBpc3N1ZS5tZXNzYWdlO1xuICByZXR1cm4gYFske2lzc3VlLmZpZWxkfSR7aXNzdWUubGluZSAhPT0gdW5kZWZpbmVkID8gYDoke2lzc3VlLmxpbmV9OiR7aXNzdWUuY29sfWAgOiAnJ31dICR7aXNzdWUubWVzc2FnZX1gO1xufVxuIl19

package/package.json

@@ -10,7 +10,7 @@
     "@stylistic/eslint-plugin": "^2",
     "@types/express": "5.0.6",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "26.1.2",
+    "@types/node": "^24",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
     "@typescript/native": "npm:typescript@^7.0.2",
@@ -94,10 +94,16 @@
       ],
       "metadata-keys": [
         "lib/types/metadata-keys.d.ts"
+      ],
+      "feature-flags": [
+        "lib/types/feature-flags.d.ts"
+      ],
+      "plugin-catalog": [
+        "lib/types/plugin-catalog.d.ts"
       ]
     }
   },
-  "version": "4.1.13",
+  "version": "4.1.14",
   "bugs": {
     "url": "https://github.com/mwashburn160/pipeline-builder/issues"
   },
@@ -161,11 +167,31 @@
     "setupFilesAfterEnv": [
       "<rootDir>/../../jest-env-guard.js"
     ],
+    "collectCoverageFrom": [
+      "src/**/*.ts",
+      "!src/**/*.d.ts",
+      "!src/testing/**",
+      "!src/constants/index.ts",
+      "!src/errors/index.ts",
+      "!src/helpers/index.ts",
+      "!src/index.ts",
+      "!src/middleware/index.ts",
+      "!src/openapi/index.ts",
+      "!src/routes/index.ts",
+      "!src/services/index.ts",
+      "!src/testing/any-fn.ts",
+      "!src/testing/index.ts",
+      "!src/types/audit-events.ts",
+      "!src/types/http.ts",
+      "!src/types/index.ts",
+      "!src/utils/index.ts",
+      "!src/validation/index.ts"
+    ],
     "coverageThreshold": {
       "global": {
         "statements": 95,
-        "branches": 88,
-        "functions": 88,
+        "branches": 91,
+        "functions": 91,
         "lines": 95
       },
       "**/src/utils/audit.ts": {
@@ -191,20 +217,59 @@
       "types": "./lib/types/metadata-keys.d.ts",
       "default": "./lib/types/metadata-keys.js"
     },
+    "./feature-flags": {
+      "types": "./lib/types/feature-flags.d.ts",
+      "default": "./lib/types/feature-flags.js"
+    },
+    "./plugin-catalog": {
+      "types": "./lib/types/plugin-catalog.d.ts",
+      "default": "./lib/types/plugin-catalog.js"
+    },
+    "./testing": {
+      "types": "./lib/testing/index.d.ts",
+      "default": "./lib/testing/index.js"
+    },
     "./lib/*": "./lib/*",
     "./package.json": "./package.json"
   },
+  "nx": {
+    "targets": {
+      "build": {
+        "inputs": [
+          "default",
+          "^default",
+          "sharedGlobals",
+          "{workspaceRoot}/docs/environment-variables.md",
+          "!{projectRoot}/lib/**/*",
+          "!{projectRoot}/dist/**/*"
+        ]
+      },
+      "test": {
+        "inputs": [
+          "default",
+          "^default",
+          "sharedGlobals",
+          "{workspaceRoot}/docs/environment-variables.md",
+          "!{projectRoot}/lib/**/*",
+          "!{projectRoot}/dist/**/*"
+        ]
+      }
+    }
+  },
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"pnpm dlx projen\".",
   "scripts": {
     "build": "pnpm dlx projen build",
     "compile": "pnpm dlx projen compile",
     "default": "pnpm dlx projen default",
     "eslint": "pnpm dlx projen eslint",
+    "lint:fix": "pnpm dlx projen lint:fix",
     "package": "pnpm dlx projen package",
     "post-compile": "pnpm dlx projen post-compile",
     "pre-compile": "pnpm dlx projen pre-compile",
     "test": "pnpm dlx projen test",
+    "test:update": "pnpm dlx projen test:update",
     "test:watch": "pnpm dlx projen test:watch",
+    "typecheck:tests": "pnpm dlx projen typecheck:tests",
     "watch": "pnpm dlx projen watch",
     "projen": "pnpm dlx projen"
   }