@pipeline-builder/api-core 4.1.19 → 4.1.21

package/lib/types/ask-proposals.js

@@ -0,0 +1,308 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+// -----------------------------------------------------------------------------
+// Provenance (rule 6)
+// -----------------------------------------------------------------------------
+/** The `proposedBy` value every agent-drafted commit records. */
+export const ASK_AGENT_PROPOSER = 'ask-agent';
+/** The audit `details` key that carries provenance. */
+export const PROPOSED_BY_DETAIL_KEY = 'proposedBy';
+/**
+ * Merge agent provenance into an audit event's free-form `details`.
+ * Provenance is applied LAST so a caller-supplied `proposedBy` cannot overwrite
+ * it — the point of the field is that it is not negotiable.
+ */
+export function askProposalAuditDetails(details) {
+    return { ...details, proposedBy: ASK_AGENT_PROPOSER };
+}
+/**
+ * The request HEADER a proposal commit stamps, and the only channel provenance
+ * travels on.
+ *
+ * A HEADER rather than a body field, for three reasons:
+ *
+ *  - **It cannot collide.** `proposedBy` in a body would be a new key in six
+ *    different domain schemas — `PipelineUpdateSchema`, the plugin/template
+ *    update schemas, three notification/settings schemas — two of which are
+ *    `.strict()` and the rest of which feed `Object.keys(body)` straight into
+ *    the update's column list and the audit's `fields`. A field named after an
+ *    audit key would then be indistinguishable from a real one, and the day a
+ *    domain grows its own `proposedBy` the two meanings merge silently.
+ *  - **It is transport metadata, and stays out of the payload.** Nothing
+ *    downstream of `validateBody` ever sees it, so it cannot be persisted, cannot
+ *    widen a diff, and cannot reach a service that forwards the body onward.
+ *  - **The platform already does this.** `X-Step-Up-Token` is the same shape of
+ *    thing — a per-request assertion about HOW the call was made rather than
+ *    WHAT it changes — and rides a header for the same reasons.
+ *
+ * Lower-case because that is how Node normalises incoming header names; the
+ * browser sends `X-PB-Proposed-By`, which arrives here.
+ */
+export const ASK_PROPOSED_BY_HEADER = 'x-pb-proposed-by';
+/**
+ * Read the provenance claim off a request's header bag.
+ *
+ * Deliberately exact: no trimming, no case folding, no prefix matching. The
+ * only sender is the browser's confirm path, which stamps the shared constant,
+ * so every other value is refused rather than repaired. This is what keeps a
+ * client from writing arbitrary audit `details` — the header's whole vocabulary
+ * is one word, and the word is not the client's to choose.
+ *
+ * Takes the header BAG (`req.headers`) rather than a request, so this module
+ * keeps its zero runtime imports and the browser can still import the constant.
+ */
+export function readProposerClaim(headers) {
+    const bag = headers;
+    const raw = bag && typeof bag === 'object' ? bag[ASK_PROPOSED_BY_HEADER] : undefined;
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    if (value === undefined || value === null || value === '')
+        return 'none';
+    return value === ASK_AGENT_PROPOSER ? 'ask-agent' : 'foreign';
+}
+/**
+ * The audit `details` for a write, with provenance folded in when — and ONLY
+ * when — the request carries the agent marker.
+ *
+ * `details` is what the HANDLER built and stays authoritative. Provenance is
+ * additive: the ONLY key it can ever write is `proposedBy`, so every field the
+ * handler set survives untouched, and {@link askProposalAuditDetails} applies
+ * that one key LAST so a `proposedBy` arriving from anywhere else cannot speak
+ * in its place. A request carrying no marker, or a `foreign` one, gets the
+ * handler's details unchanged — an ordinary edit records no `proposedBy` at
+ * all, which is the distinction the field exists to make.
+ */
+export function withProposalProvenance(headers, details) {
+    return readProposerClaim(headers) === 'ask-agent'
+        ? askProposalAuditDetails(details)
+        : { ...details };
+}
+/**
+ * The `digestMode` vocabulary is MIRRORED, not imported: this module keeps zero
+ * runtime imports so the browser entry stays standalone. The type annotation
+ * makes a REMOVED mode a compile error here, and `ask-proposals.test.ts` asserts
+ * the list against `PLUGIN_SECURITY_DIGEST_MODES` so an ADDED one cannot drift
+ * either.
+ */
+const DIGEST_MODES = ['immediate', 'daily', 'weekly'];
+/**
+ * The allowlist. Adding an entry is a deliberate act: name the route you
+ * checked, confirm it carries no `requireStepUp`, and write the `why`.
+ */
+export const ORG_SETTING_PROPOSAL_ALLOWLIST = [
+    {
+        key: 'reporting.incidentWindowHours',
+        surface: 'reporting',
+        field: 'incidentWindowHours',
+        shape: { kind: 'integer', min: 1, max: 720 },
+        api: { method: 'PUT', path: '/reports/settings/incidents' },
+        permission: 'org:settings',
+        label: 'Incident correlation window (hours)',
+        why: 'Analytics tuning only: it decides how long after a deploy an incident is '
+            + 'attributed to that deploy when DORA metrics are computed. It grants nothing, '
+            + 'reveals nothing and reaches no one — the worst outcome of a wrong value is a '
+            + 'misleading change-failure rate, which the next edit corrects. The route '
+            + 'rejects the sibling retention fields outright (they are billing-owned), so '
+            + 'this is the whole writable surface. Bounded integer, so the diff is one number.',
+    },
+    {
+        key: 'complianceNotifications.notifyOnBlock',
+        surface: 'complianceNotifications',
+        field: 'notifyOnBlock',
+        shape: { kind: 'boolean' },
+        api: { method: 'PUT', path: '/compliance/notification-preferences' },
+        permission: 'compliance:write',
+        label: 'Notify when compliance blocks an action',
+        why: 'A delivery preference, not an enforcement control: the block happens either '
+            + 'way and the policy that caused it is unchanged. Turning it off makes the org '
+            + 'quieter, never more permissive.',
+    },
+    {
+        key: 'complianceNotifications.notifyOnWarning',
+        surface: 'complianceNotifications',
+        field: 'notifyOnWarning',
+        shape: { kind: 'boolean' },
+        api: { method: 'PUT', path: '/compliance/notification-preferences' },
+        permission: 'compliance:write',
+        label: 'Notify on compliance warnings',
+        why: 'As notifyOnBlock — which non-blocking findings are announced, not what is enforced.',
+    },
+    {
+        key: 'complianceNotifications.emailEnabled',
+        surface: 'complianceNotifications',
+        field: 'emailEnabled',
+        shape: { kind: 'boolean' },
+        api: { method: 'PUT', path: '/compliance/notification-preferences' },
+        permission: 'compliance:write',
+        label: 'Send compliance notices by email',
+        why: 'Chooses whether the existing notices go out by email. It does not name a '
+            + 'recipient — the address list is resolved from org membership at send time — '
+            + 'so a flipped boolean can never route mail somewhere new.',
+    },
+    {
+        key: 'complianceNotifications.digestMode',
+        surface: 'complianceNotifications',
+        field: 'digestMode',
+        shape: { kind: 'enum', values: DIGEST_MODES },
+        api: { method: 'PUT', path: '/compliance/notification-preferences' },
+        permission: 'compliance:write',
+        label: 'Compliance notice cadence',
+        why: 'Cadence of an existing notice to existing recipients. Closed enum, so the diff is one word.',
+    },
+    {
+        key: 'pluginSecurityNotifications.notifyRescan',
+        surface: 'pluginSecurityNotifications',
+        field: 'notifyRescan',
+        shape: { kind: 'boolean' },
+        api: { method: 'PUT', path: '/plugins/security-notifications' },
+        permission: 'org:settings',
+        label: 'Notify on nightly rescan findings',
+        why: 'Governs the N31 rescan notice only. The scan GATES are untouched: a build that '
+            + 'trips PLUGIN_VULN_GATE still fails and still sends N30, which this flag cannot '
+            + 'suppress. So it changes how noisy an informational notice is, not whether a '
+            + 'vulnerable version can be published.',
+    },
+    {
+        key: 'pluginSecurityNotifications.digestMode',
+        surface: 'pluginSecurityNotifications',
+        field: 'digestMode',
+        shape: { kind: 'enum', values: DIGEST_MODES },
+        api: { method: 'PUT', path: '/plugins/security-notifications' },
+        permission: 'org:settings',
+        label: 'Plugin security notice cadence',
+        why: 'Cadence of the rescan notice. N30 ("version blocked") is always immediate and '
+            + 'ignores this field, so the urgent channel cannot be slowed down.',
+    },
+];
+/**
+ * Fields DELIBERATELY excluded, with the reason, so a future reader does not
+ * re-litigate them and a reviewer can see they were considered rather than
+ * missed. This is documentation only — {@link pickAllowed} consults the
+ * allowlist alone, and a field absent from BOTH lists is refused identically.
+ */
+export const ORG_SETTING_PROPOSAL_EXCLUSIONS = [
+    { field: 'organization.aiConfig', why: 'Step-up gated (PUT /organization/ai-config) and persists per-org provider secrets.' },
+    { field: 'organization.mfaPolicy', why: 'Security control + step-up. Loosening it removes a control for every member.' },
+    { field: 'organization.passwordPolicy', why: 'Security control + step-up.' },
+    { field: 'organization.authenticatorPolicy', why: 'Security control + step-up.' },
+    { field: 'organization.impersonationPolicy', why: 'Security control + step-up; decides who outside the org may view its data.' },
+    { field: 'organization.idp', why: 'SSO/SAML config: security control on its own capability (org:idp), assurance + strong step-up.' },
+    { field: 'organization.kmsConfig', why: 'Key material. Own capability (org:kms), assurance + strong step-up.' },
+    { field: 'organization.identity', why: 'Org name/slug: no step-up, but renaming an org is an impersonation primitive and the slug is addressable.' },
+    { field: 'organization.domains', why: 'Verified domains drive domain-based join — who may become a member.' },
+    { field: 'organization.joinRequests', why: 'Membership decisions are an authority grant, not a setting.' },
+    { field: 'organization.transferOwner', why: 'Ownership transfer: security control, MFA-grade + step-up.' },
+    { field: 'organization.teams', why: 'Team lifecycle (create/delete/move) is structural and step-up gated.' },
+    { field: 'plugins.installPolicy', why: 'Step-up gated (PUT /plugins/install-policy) and decides what may be installed.' },
+    { field: '*.webhookUrl', why: 'A callback target: proposing one turns the platform into an exfiltration channel.' },
+    { field: '*.webhookSecret', why: 'Bearer-equivalent. The API returns hasWebhookSecret, never the value, so it cannot be diffed.' },
+    { field: 'pluginSecurityNotifications.externalEmail', why: 'An address the platform then mails a confirmation link to. Never model-chosen.' },
+    { field: '*.targetUsers', why: 'A list of opaque user ids is not reviewable in a card, and redirecting recipients can silence a channel.' },
+    { field: 'pluginSecurityNotifications.recipientMode', why: 'Pairs with targetUsers; switching to "users" makes an unreviewable list authoritative.' },
+    { field: 'reporting.eventRetentionDays', why: 'Billing-owned (tier + purchased packs). The route already rejects it; admitting it would be an entitlement bypass.' },
+    { field: 'reporting.doraRetentionDays', why: 'Billing-owned, as above.' },
+];
+// -----------------------------------------------------------------------------
+// Lookup
+// -----------------------------------------------------------------------------
+const BY_KEY = new Map(ORG_SETTING_PROPOSAL_ALLOWLIST.map((spec) => [spec.key, spec]));
+/** Every proposable key — the enum a propose tool's input schema is built from. */
+export const ORG_SETTING_PROPOSAL_KEYS = ORG_SETTING_PROPOSAL_ALLOWLIST.map((spec) => spec.key);
+/** Is `key` on the allowlist? */
+export function isProposableOrgSetting(key) {
+    return BY_KEY.has(key);
+}
+/** The spec for `key`, or undefined when it is not proposable. */
+export function orgSettingSpec(key) {
+    return BY_KEY.get(key);
+}
+/** Does `value` match the shape the field declares? */
+export function isValidOrgSettingValue(spec, value) {
+    const shape = spec.shape;
+    if (shape.kind === 'boolean')
+        return typeof value === 'boolean';
+    if (shape.kind === 'integer') {
+        return typeof value === 'number' && Number.isInteger(value) && value >= shape.min && value <= shape.max;
+    }
+    return typeof value === 'string' && shape.values.includes(value);
+}
+/**
+ * Keep only the allowlisted, shape-valid fields of a candidate proposal, and
+ * report everything dropped.
+ *
+ * The result's `allowed` map IS the commit payload (rule 3): the confirm
+ * handler sends these fields and only these, so anything the model slipped in
+ * is structurally unappliable rather than merely unrendered.
+ *
+ * `candidate` is untrusted model output, so it is read defensively: anything
+ * that is not a plain object yields an empty result.
+ */
+export function pickAllowed(candidate) {
+    const allowed = {};
+    const refused = [];
+    const invalid = [];
+    if (candidate && typeof candidate === 'object' && !Array.isArray(candidate)) {
+        for (const [key, value] of Object.entries(candidate)) {
+            const spec = BY_KEY.get(key);
+            if (!spec) {
+                refused.push(key);
+                continue;
+            }
+            if (!isValidOrgSettingValue(spec, value)) {
+                invalid.push(spec.key);
+                continue;
+            }
+            allowed[spec.key] = value;
+        }
+    }
+    return { allowed, refused, invalid, refusedCount: refused.length };
+}
+/**
+ * The changes a proposal actually makes, given the CURRENT values. A field
+ * whose proposed value already equals the current one is dropped — it is not a
+ * change, and rendering it as one makes a diff the user cannot read.
+ *
+ * The confirm handler re-runs this against a FRESH read immediately before
+ * committing (rule 7): these records carry no version column, so if the list
+ * that comes back differs from the one the user approved, state moved under the
+ * proposal and the commit must be refused rather than applied blind.
+ */
+export function diffOrgSettings(current, proposed) {
+    const changes = [];
+    for (const spec of ORG_SETTING_PROPOSAL_ALLOWLIST) {
+        const to = proposed[spec.key];
+        if (to === undefined)
+            continue;
+        const from = current[spec.key];
+        if (from === to)
+            continue;
+        changes.push({ spec, from, to });
+    }
+    return changes;
+}
+/**
+ * Group approved changes into one request per surface, translating proposal
+ * keys back to the field names each API expects. Order follows the allowlist,
+ * so the same proposal always produces the same call sequence.
+ */
+export function orgSettingRequests(changes) {
+    const bySurface = new Map();
+    for (const spec of ORG_SETTING_PROPOSAL_ALLOWLIST) {
+        const change = changes.find((c) => c.spec.key === spec.key);
+        if (!change)
+            continue;
+        const existing = bySurface.get(spec.surface);
+        if (existing) {
+            existing.body[spec.field] = change.to;
+            continue;
+        }
+        bySurface.set(spec.surface, {
+            surface: spec.surface,
+            method: spec.api.method,
+            path: spec.api.path,
+            permission: spec.permission,
+            body: { [spec.field]: change.to },
+        });
+    }
+    return [...bySurface.values()];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXNrLXByb3Bvc2Fscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy90eXBlcy9hc2stcHJvcG9zYWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUF3RXRDLGdGQUFnRjtBQUNoRixzQkFBc0I7QUFDdEIsZ0ZBQWdGO0FBRWhGLGlFQUFpRTtBQUNqRSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxXQUFXLENBQUM7QUFFOUMsdURBQXVEO0FBQ3ZELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLFlBQVksQ0FBQztBQU9uRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLHVCQUF1QixDQUNyQyxPQUEyQztJQUUzQyxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsVUFBVSxFQUFFLGtCQUFrQixFQUFFLENBQUM7QUFDeEQsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBc0JHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsa0JBQWtCLENBQUM7QUFXekQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLFVBQVUsaUJBQWlCLENBQUMsT0FBZ0I7SUFDaEQsTUFBTSxHQUFHLEdBQUcsT0FBcUQsQ0FBQztJQUNsRSxNQUFNLEdBQUcsR0FBRyxHQUFHLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3JGLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO0lBQ2hELElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLEtBQUssS0FBSyxFQUFFO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDekUsT0FBTyxLQUFLLEtBQUssa0JBQWtCLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ2hFLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FDcEMsT0FBZ0IsRUFDaEIsT0FBMkM7SUFFM0MsT0FBTyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsS0FBSyxXQUFXO1FBQy9DLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUM7UUFDbEMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxPQUFPLEVBQUUsQ0FBQztBQUNyQixDQUFDO0FBc0REOzs7Ozs7R0FNRztBQUNILE1BQU0sWUFBWSxHQUF3QyxDQUFDLFdBQVcsRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7QUFFM0Y7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQThCO0lBQ3ZFO1FBQ0UsR0FBRyxFQUFFLCtCQUErQjtRQUNwQyxPQUFPLEVBQUUsV0FBVztRQUNwQixLQUFLLEVBQUUscUJBQXFCO1FBQzVCLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFO1FBQzVDLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLDZCQUE2QixFQUFFO1FBQzNELFVBQVUsRUFBRSxjQUFjO1FBQzFCLEtBQUssRUFBRSxxQ0FBcUM7UUFDNUMsR0FBRyxFQUNELDJFQUEyRTtjQUN6RSwrRUFBK0U7Y0FDL0UsK0VBQStFO2NBQy9FLDBFQUEwRTtjQUMxRSw2RUFBNkU7Y0FDN0UsaUZBQWlGO0tBQ3RGO0lBQ0Q7UUFDRSxHQUFHLEVBQUUsdUNBQXVDO1FBQzVDLE9BQU8sRUFBRSx5QkFBeUI7UUFDbEMsS0FBSyxFQUFFLGVBQWU7UUFDdEIsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRTtRQUMxQixHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxzQ0FBc0MsRUFBRTtRQUNwRSxVQUFVLEVBQUUsa0JBQWtCO1FBQzlCLEtBQUssRUFBRSx5Q0FBeUM7UUFDaEQsR0FBRyxFQUNELDhFQUE4RTtjQUM1RSwrRUFBK0U7Y0FDL0UsaUNBQWlDO0tBQ3RDO0lBQ0Q7UUFDRSxHQUFHLEVBQUUseUNBQXlDO1FBQzlDLE9BQU8sRUFBRSx5QkFBeUI7UUFDbEMsS0FBSyxFQUFFLGlCQUFpQjtRQUN4QixLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFO1FBQzFCLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLHNDQUFzQyxFQUFFO1FBQ3BFLFVBQVUsRUFBRSxrQkFBa0I7UUFDOUIsS0FBSyxFQUFFLCtCQUErQjtRQUN0QyxHQUFHLEVBQUUscUZBQXFGO0tBQzNGO0lBQ0Q7UUFDRSxHQUFHLEVBQUUsc0NBQXNDO1FBQzNDLE9BQU8sRUFBRSx5QkFBeUI7UUFDbEMsS0FBSyxFQUFFLGNBQWM7UUFDckIsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRTtRQUMxQixHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxzQ0FBc0MsRUFBRTtRQUNwRSxVQUFVLEVBQUUsa0JBQWtCO1FBQzlCLEtBQUssRUFBRSxrQ0FBa0M7UUFDekMsR0FBRyxFQUNELDJFQUEyRTtjQUN6RSw4RUFBOEU7Y0FDOUUsMERBQTBEO0tBQy9EO0lBQ0Q7UUFDRSxHQUFHLEVBQUUsb0NBQW9DO1FBQ3pDLE9BQU8sRUFBRSx5QkFBeUI7UUFDbEMsS0FBSyxFQUFFLFlBQVk7UUFDbkIsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFO1FBQzdDLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLHNDQUFzQyxFQUFFO1FBQ3BFLFVBQVUsRUFBRSxrQkFBa0I7UUFDOUIsS0FBSyxFQUFFLDJCQUEyQjtRQUNsQyxHQUFHLEVBQUUsNkZBQTZGO0tBQ25HO0lBQ0Q7UUFDRSxHQUFHLEVBQUUsMENBQTBDO1FBQy9DLE9BQU8sRUFBRSw2QkFBNkI7UUFDdEMsS0FBSyxFQUFFLGNBQWM7UUFDckIsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRTtRQUMxQixHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxpQ0FBaUMsRUFBRTtRQUMvRCxVQUFVLEVBQUUsY0FBYztRQUMxQixLQUFLLEVBQUUsbUNBQW1DO1FBQzFDLEdBQUcsRUFDRCxpRkFBaUY7Y0FDL0UsaUZBQWlGO2NBQ2pGLDhFQUE4RTtjQUM5RSxzQ0FBc0M7S0FDM0M7SUFDRDtRQUNFLEdBQUcsRUFBRSx3Q0FBd0M7UUFDN0MsT0FBTyxFQUFFLDZCQUE2QjtRQUN0QyxLQUFLLEVBQUUsWUFBWTtRQUNuQixLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUU7UUFDN0MsR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsaUNBQWlDLEVBQUU7UUFDL0QsVUFBVSxFQUFFLGNBQWM7UUFDMUIsS0FBSyxFQUFFLGdDQUFnQztRQUN2QyxHQUFHLEVBQ0QsZ0ZBQWdGO2NBQzlFLGtFQUFrRTtLQUN2RTtDQUNGLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFvRTtJQUM5RyxFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRSxHQUFHLEVBQUUsb0ZBQW9GLEVBQUU7SUFDN0gsRUFBRSxLQUFLLEVBQUUsd0JBQXdCLEVBQUUsR0FBRyxFQUFFLDhFQUE4RSxFQUFFO0lBQ3hILEVBQUUsS0FBSyxFQUFFLDZCQUE2QixFQUFFLEdBQUcsRUFBRSw2QkFBNkIsRUFBRTtJQUM1RSxFQUFFLEtBQUssRUFBRSxrQ0FBa0MsRUFBRSxHQUFHLEVBQUUsNkJBQTZCLEVBQUU7SUFDakYsRUFBRSxLQUFLLEVBQUUsa0NBQWtDLEVBQUUsR0FBRyxFQUFFLDRFQUE0RSxFQUFFO0lBQ2hJLEVBQUUsS0FBSyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsRUFBRSxnR0FBZ0csRUFBRTtJQUNwSSxFQUFFLEtBQUssRUFBRSx3QkFBd0IsRUFBRSxHQUFHLEVBQUUscUVBQXFFLEVBQUU7SUFDL0csRUFBRSxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsR0FBRyxFQUFFLDJHQUEyRyxFQUFFO0lBQ3BKLEVBQUUsS0FBSyxFQUFFLHNCQUFzQixFQUFFLEdBQUcsRUFBRSxxRUFBcUUsRUFBRTtJQUM3RyxFQUFFLEtBQUssRUFBRSwyQkFBMkIsRUFBRSxHQUFHLEVBQUUsNkRBQTZELEVBQUU7SUFDMUcsRUFBRSxLQUFLLEVBQUUsNEJBQTRCLEVBQUUsR0FBRyxFQUFFLDREQUE0RCxFQUFFO0lBQzFHLEVBQUUsS0FBSyxFQUFFLG9CQUFvQixFQUFFLEdBQUcsRUFBRSxzRUFBc0UsRUFBRTtJQUM1RyxFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRSxHQUFHLEVBQUUsZ0ZBQWdGLEVBQUU7SUFDekgsRUFBRSxLQUFLLEVBQUUsY0FBYyxFQUFFLEdBQUcsRUFBRSxtRkFBbUYsRUFBRTtJQUNuSCxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxHQUFHLEVBQUUsK0ZBQStGLEVBQUU7SUFDbEksRUFBRSxLQUFLLEVBQUUsMkNBQTJDLEVBQUUsR0FBRyxFQUFFLGdGQUFnRixFQUFFO0lBQzdJLEVBQUUsS0FBSyxFQUFFLGVBQWUsRUFBRSxHQUFHLEVBQUUsMEdBQTBHLEVBQUU7SUFDM0ksRUFBRSxLQUFLLEVBQUUsMkNBQTJDLEVBQUUsR0FBRyxFQUFFLHdGQUF3RixFQUFFO0lBQ3JKLEVBQUUsS0FBSyxFQUFFLDhCQUE4QixFQUFFLEdBQUcsRUFBRSxvSEFBb0gsRUFBRTtJQUNwSyxFQUFFLEtBQUssRUFBRSw2QkFBNkIsRUFBRSxHQUFHLEVBQUUsMEJBQTBCLEVBQUU7Q0FDMUUsQ0FBQztBQUVGLGdGQUFnRjtBQUNoRixTQUFTO0FBQ1QsZ0ZBQWdGO0FBRWhGLE1BQU0sTUFBTSxHQUNWLElBQUksR0FBRyxDQUFDLDhCQUE4QixDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUUxRSxtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQ3BDLDhCQUE4QixDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBRXpELGlDQUFpQztBQUNqQyxNQUFNLFVBQVUsc0JBQXNCLENBQUMsR0FBVztJQUNoRCxPQUFPLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDekIsQ0FBQztBQUVELGtFQUFrRTtBQUNsRSxNQUFNLFVBQVUsY0FBYyxDQUFDLEdBQVc7SUFDeEMsT0FBTyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ3pCLENBQUM7QUFFRCx1REFBdUQ7QUFDdkQsTUFBTSxVQUFVLHNCQUFzQixDQUFDLElBQW9CLEVBQUUsS0FBYztJQUN6RSxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDO0lBQ3pCLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO1FBQUUsT0FBTyxPQUFPLEtBQUssS0FBSyxTQUFTLENBQUM7SUFDaEUsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxJQUFJLEtBQUssQ0FBQyxHQUFHLElBQUksS0FBSyxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUM7SUFDMUcsQ0FBQztJQUNELE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ25FLENBQUM7QUE2QkQ7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sVUFBVSxXQUFXLENBQUMsU0FBa0I7SUFDNUMsTUFBTSxPQUFPLEdBQW9CLEVBQUUsQ0FBQztJQUNwQyxNQUFNLE9BQU8sR0FBYSxFQUFFLENBQUM7SUFDN0IsTUFBTSxPQUFPLEdBQW9CLEVBQUUsQ0FBQztJQUVwQyxJQUFJLFNBQVMsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsU0FBb0MsQ0FBQyxFQUFFLENBQUM7WUFDaEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM3QixJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFBQyxTQUFTO1lBQUMsQ0FBQztZQUMzQyxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQUMsU0FBUztZQUFDLENBQUM7WUFDL0UsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLENBQUM7UUFDNUIsQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUNyRSxDQUFDO0FBYUQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxVQUFVLGVBQWUsQ0FDN0IsT0FBa0MsRUFDbEMsUUFBbUM7SUFFbkMsTUFBTSxPQUFPLEdBQXVCLEVBQUUsQ0FBQztJQUN2QyxLQUFLLE1BQU0sSUFBSSxJQUFJLDhCQUE4QixFQUFFLENBQUM7UUFDbEQsTUFBTSxFQUFFLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM5QixJQUFJLEVBQUUsS0FBSyxTQUFTO1lBQUUsU0FBUztRQUMvQixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQy9CLElBQUksSUFBSSxLQUFLLEVBQUU7WUFBRSxTQUFTO1FBQzFCLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDbkMsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUM7QUFZRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLGtCQUFrQixDQUFDLE9BQW9DO0lBQ3JFLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUF3QyxDQUFDO0lBQ2xFLEtBQUssTUFBTSxJQUFJLElBQUksOEJBQThCLEVBQUUsQ0FBQztRQUNsRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDNUQsSUFBSSxDQUFDLE1BQU07WUFBRSxTQUFTO1FBQ3RCLE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzdDLElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ3RDLFNBQVM7UUFDWCxDQUFDO1FBQ0QsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFO1lBQzFCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztZQUNyQixNQUFNLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNO1lBQ3ZCLElBQUksRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUk7WUFDbkIsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQzNCLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUU7U0FDbEMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sQ0FBQyxHQUFHLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQ2pDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBUaGUgc2hhcmVkIGNvbnRyYWN0IGJldHdlZW4gdGhlIGFzayBhZ2VudCdzIFBST1BPU0UgdG9vbHMgYW5kIHRoZSBicm93c2VyJ3NcbiAqIENPTkZJUk0gaGFuZGxlcnMuIFR3byB0aGluZ3MgbGl2ZSBoZXJlLCBhbmQgdGhleSBsaXZlIGhlcmUgYmVjYXVzZSBCT1RIIHNpZGVzXG4gKiBuZWVkIHRoZW06IGBhcGkvYXNrYCBidWlsZHMgaXRzIHRvb2wgc2NoZW1hIGZyb20gdGhpcyBtb2R1bGUsIHRoZSBmcm9udGVuZCdzXG4gKiBjb25maXJtIGhhbmRsZXIgYnVpbGRzIGl0cyByZXF1ZXN0IGZyb20gaXQsIGFuZCB0aGUgdGVzdHMgb2YgYm90aCBhc3NlcnRcbiAqIGFnYWluc3QgaXQuIEEgc2Vjb25kIGNvcHkgd291bGQgYmUgYSBzZWNvbmQgcG9saWN5LlxuICpcbiAqIERlcGVuZGVuY3ktZnJlZSBvbiBwdXJwb3NlIOKAlCBubyBydW50aW1lIGltcG9ydHMgYXQgYWxsIOKAlCBzbyB0aGUgYnJvd3NlciBjYW5cbiAqIGltcG9ydCBpdCB0aHJvdWdoIGFwaS1jb3JlJ3MgYC4vYXNrLXByb3Bvc2Fsc2AgZW50cnkgd2l0aG91dCBkcmFnZ2luZyBpbiB0aGVcbiAqIHNlcnZlciBncmFwaCAoZXhwcmVzcyAvIGp3dCAvIGlvcmVkaXMpLiBUaGUgb25seSBpbXBvcnRzIGFyZSBgaW1wb3J0IHR5cGVgLFxuICogd2hpY2ggdGhlIGNvbXBpbGVyIGVyYXNlcy5cbiAqXG4gKiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuICogMS4gUFJPVkVOQU5DRVxuICogLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAqIEV2ZXJ5IGNvbW1pdCB0aGF0IHN0YXJ0ZWQgbGlmZSBhcyBhbiBhZ2VudCBkcmFmdCBzdGFtcHNcbiAqIGBkZXRhaWxzOiB7IHByb3Bvc2VkQnk6ICdhc2stYWdlbnQnIH1gIG9udG8gaXRzIGF1ZGl0IGV2ZW50LiBUaGUgYXVkaXQgdHJhaWxcbiAqIGlzIGhhc2gtY2hhaW5lZCBhbmQgdGFtcGVyLWV2aWRlbnQsIGJ1dCB3aXRob3V0IHRoaXMgZmllbGQgaXQgY2Fubm90XG4gKiBkaXN0aW5ndWlzaCBcInRoZSBhZG1pbiBjaGFuZ2VkIHRoaXNcIiBmcm9tIFwiYW4gQUkgZHJhZnRlZCBpdCBhbmQgdGhlIGFkbWluXG4gKiBjbGlja2VkIEFwcGx5XCIg4oCUIHRoZSB0d28gbWVhbiB2ZXJ5IGRpZmZlcmVudCB0aGluZ3MgaW4gYW4gaW5jaWRlbnQgcmV2aWV3LlxuICogVGhlIGNvbnN0YW50IGV4aXN0cyBzbyB0aGUgbGl0ZXJhbCBpcyBub3QgcmV0eXBlZCBpbiB0d28gY29kZWJhc2VzLCB3aGVyZSBhXG4gKiB0eXBvIHdvdWxkIHNpbGVudGx5IHByb2R1Y2UgYW4gdW5xdWVyeWFibGUgdHJhaWwuXG4gKlxuICogLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbiAqIDIuIFRIRSBPUkctU0VUVElOR1MgQUxMT1dMSVNUXG4gKiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuICogVGhpcyBpcyBhbiBBTExPV0xJU1QsIG5vdCBhIGRlbnlsaXN0LCBhbmQgdGhlIGRpc3RpbmN0aW9uIGlzIHRoZSB3aG9sZSBwb2ludDpcbiAqIGEgc2V0dGluZyBhZGRlZCB0byB0aGUgcGxhdGZvcm0gdG9tb3Jyb3cgaXMgVU5BVkFJTEFCTEUgdG8gdGhlIGFnZW50IHVudGlsXG4gKiBzb21lb25lIGRlbGliZXJhdGVseSBhZGRzIGl0IGhlcmUsIHJhdGhlciB0aGFuIGJlaW5nIGV4cG9zZWQgYnkgb21pc3Npb24uXG4gKiBJZiB5b3UgYXJlIHJlYWRpbmcgdGhpcyBiZWNhdXNlIGEgcHJvcG9zYWwgd2FzIHJlZnVzZWQsIHRoZSBmaXggaXMgdG8gYWRkIHRoZVxuICogZmllbGQgYmVsb3cgV0lUSCBpdHMgYHdoeWAg4oCUIG5vdCB0byBsb29zZW4ge0BsaW5rIHBpY2tBbGxvd2VkfS5cbiAqXG4gKiBBIGZpZWxkIGVhcm5zIGEgcGxhY2UgaGVyZSBvbmx5IGlmIGFsbCBvZiB0aGUgZm9sbG93aW5nIGhvbGQuIFRoZXkgd2VyZVxuICogY2hlY2tlZCBhZ2FpbnN0IHRoZSByb3V0ZXMsIG5vdCBhc3N1bWVkOlxuICpcbiAqICAtICoqTm8gc3RlcC11cC4qKiBBIHJvdXRlIGNhcnJ5aW5nIGByZXF1aXJlU3RlcFVwYCBpcyBvdXQsIG5vIGV4Y2VwdGlvbnMuXG4gKiAgICBTdGVwLXVwIG1lYW5zIHRoZSBwbGF0Zm9ybSBhbHJlYWR5IGRlY2lkZWQgYSBsaXZlIHNlc3Npb24gaXMgbm90IGVub3VnaFxuICogICAgYXV0aG9yaXR5OyBhIGNoYXQgcHJvcG9zYWwgaXMgc3RyaWN0bHkgbGVzcy4gVGhpcyBpcyB3aGF0IGtlZXBzXG4gKiAgICBgUFVUIC9vcmdhbml6YXRpb24vYWktY29uZmlnYCBvdXQgKGl0IHBlcnNpc3RzIHBlci1vcmcgcHJvdmlkZXIgU0VDUkVUUyksXG4gKiAgICBhbG9uZyB3aXRoIHRoZSBNRkEgLyBwYXNzd29yZCAvIGF1dGhlbnRpY2F0b3IgcG9saWNpZXMsXG4gKiAgICBgUFVUIC9wbHVnaW5zL2luc3RhbGwtcG9saWN5YCwgb3JnIHJlc3RvcmUgYW5kIHRyYW5zZmVyLW93bmVyLlxuICogIC0gKipOb3QgYSBzZWN1cml0eSBjb250cm9sLioqIE1GQSAvIHBhc3N3b3JkIC8gYXV0aGVudGljYXRvciAvIGltcGVyc29uYXRpb25cbiAqICAgIHBvbGljeSwgU1NPK1NBTUwgYW5kIGl0cyBncm91cCBtYXBwaW5ncywgdmVyaWZpZWQgZG9tYWlucyBhbmQgZG9tYWluLWJhc2VkXG4gKiAgICBqb2luLCBqb2luLXJlcXVlc3QgZGVjaXNpb25zLCB0cmFuc2Zlci1vd25lciBhbmQgdGVhbSBsaWZlY3ljbGUgYXJlIEFCU0VOVFxuICogICAgaGVyZSByYXRoZXIgdGhhbiBnYXRlZCB3aXRoaW4g4oCUIFwicmVsYXggdGhlIE1GQSBwb2xpY3lcIiBpcyBwcmVjaXNlbHkgd2hhdCBhblxuICogICAgaW5qZWN0aW9uIHBheWxvYWQgYXNrcyBmb3IsIGFuZCBpdCBhcnJpdmVzIHRocm91Z2ggdGV4dCB0aGUgYWdlbnQgYWxyZWFkeVxuICogICAgcmVhZHMuIEFic2VudCBjYW5ub3QgYmUgYXJndWVkIHdpdGg7IGdhdGVkIGNhbi5cbiAqICAtICoqQ2FycmllcyBubyBzZWNyZXQgYW5kIG5vIGNhbGxiYWNrIHRhcmdldC4qKiBBbiBBUEkgdGhhdCByZXR1cm5zXG4gKiAgICBgaGFzV2ViaG9va1NlY3JldGAgaW5zdGVhZCBvZiB0aGUgc2VjcmV0IGlzIHRlbGxpbmcgeW91IHRoZSBmaWVsZCBjYW5ub3QgYmVcbiAqICAgIGRpZmZlZCwgc28gaXQgY2Fubm90IGJlIHJldmlld2VkLCBzbyBpdCBjYW5ub3QgYmUgcHJvcG9zZWQuIFdlYmhvb2sgVVJMc1xuICogICAgYW5kIGVtYWlsIGFkZHJlc3NlcyBhcmUgb3V0IGZvciB0aGUgc2FtZSByZWFzb24gcGx1cyBvbmUgbW9yZTogdGhleSBhcmVcbiAqICAgIGV4ZmlsdHJhdGlvbiB0YXJnZXRzLCBhbmQgYSBjb25maXJtYXRpb24gbWFpbCB0byBhbiBhdHRhY2tlci1jaG9zZW4gYWRkcmVzc1xuICogICAgaXMgYSBzZW5kIHRoZSBwbGF0Zm9ybSBwZXJmb3JtcyBvbiB0aGUgbW9kZWwncyBzYXktc28uXG4gKiAgLSAqKlJldmlld2FibGUgYXMgYSBkaWZmLioqIEEgc2NhbGFyIHdpdGggYSBjbG9zZWQgc2hhcGUgKGJvb2xlYW4sIGJvdW5kZWRcbiAqICAgIGludGVnZXIsIHNtYWxsIGVudW0pLiBBIGxpc3Qgb2Ygb3BhcXVlIHVzZXIgaWRzIHJlbmRlcnMgYXMgaWRzIGluIGEgY2FyZFxuICogICAgbm9ib2R5IGNhbiBjaGVjaywgc28gcmVjaXBpZW50IExJU1RTIGFyZSBvdXQgZXZlbiB0aG91Z2ggY2FkZW5jZSBpcyBpbi5cbiAqXG4gKiBFYWNoIGVudHJ5IG5hbWVzIHRoZSBBUEkgdGhhdCBhcHBsaWVzIGl0LiBUaGUgYnJvd3NlciBhcHBsaWVzIGl0IHRocm91Z2ggdGhlXG4gKiBVU0VSJ3Mgb3duIHNlc3Npb24gYW5kIHRoZSB1c2VyJ3Mgb3duIHBlcm1pc3Npb25zIOKAlCB0aGUgYWdlbnQgbmV2ZXIgd3JpdGVzIOKAlFxuICogc28gYSBwcm9wb3NhbCBhIG1lbWJlciBtYXkgbm90IGNvbW1pdCBzaW1wbHkgNDAzcyBhdCB0aGUgcm91dGUsIGV4YWN0bHkgYXMgYVxuICogaGFuZC1tYWRlIHJlcXVlc3Qgd291bGQuXG4gKlxuICogUnVsZSAxMCBsaXZlcyBpbiB7QGxpbmsgcGlja0FsbG93ZWR9OiBhIGNhbmRpZGF0ZSBjYXJyeWluZyBhIGZpZWxkIG91dHNpZGVcbiAqIHRoaXMgbGlzdCBpcyB0aGUgaW5qZWN0aW9uIHNpZ25hbCwgc28gdGhlIHJlZnVzZWQgbmFtZXMgY29tZSBiYWNrIHRvIHRoZVxuICogY2FsbGVyIHRvIGJlIGNvdW50ZWQgYW5kIGxvZ2dlZCByYXRoZXIgdGhhbiBiZWluZyBxdWlldGx5IGRyb3BwZWQuXG4gKi9cblxuaW1wb3J0IHR5cGUgeyBQZXJtaXNzaW9uIH0gZnJvbSAnLi9wZXJtaXNzaW9ucy5qcyc7XG5pbXBvcnQgdHlwZSB7IFBsdWdpblNlY3VyaXR5RGlnZXN0TW9kZSB9IGZyb20gJy4vd2lyZS12b2NhYnVsYXJ5LmpzJztcblxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbi8vIFByb3ZlbmFuY2UgKHJ1bGUgNilcbi8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG5cbi8qKiBUaGUgYHByb3Bvc2VkQnlgIHZhbHVlIGV2ZXJ5IGFnZW50LWRyYWZ0ZWQgY29tbWl0IHJlY29yZHMuICovXG5leHBvcnQgY29uc3QgQVNLX0FHRU5UX1BST1BPU0VSID0gJ2Fzay1hZ2VudCc7XG5cbi8qKiBUaGUgYXVkaXQgYGRldGFpbHNgIGtleSB0aGF0IGNhcnJpZXMgcHJvdmVuYW5jZS4gKi9cbmV4cG9ydCBjb25zdCBQUk9QT1NFRF9CWV9ERVRBSUxfS0VZID0gJ3Byb3Bvc2VkQnknO1xuXG4vKiogVGhlIHByb3ZlbmFuY2UgZnJhZ21lbnQgbWVyZ2VkIGludG8gYSBgUmVtb3RlQXVkaXRFdmVudC5kZXRhaWxzYC4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXNrUHJvcG9zYWxQcm92ZW5hbmNlIHtcbiAgcmVhZG9ubHkgcHJvcG9zZWRCeTogdHlwZW9mIEFTS19BR0VOVF9QUk9QT1NFUjtcbn1cblxuLyoqXG4gKiBNZXJnZSBhZ2VudCBwcm92ZW5hbmNlIGludG8gYW4gYXVkaXQgZXZlbnQncyBmcmVlLWZvcm0gYGRldGFpbHNgLlxuICogUHJvdmVuYW5jZSBpcyBhcHBsaWVkIExBU1Qgc28gYSBjYWxsZXItc3VwcGxpZWQgYHByb3Bvc2VkQnlgIGNhbm5vdCBvdmVyd3JpdGVcbiAqIGl0IOKAlCB0aGUgcG9pbnQgb2YgdGhlIGZpZWxkIGlzIHRoYXQgaXQgaXMgbm90IG5lZ290aWFibGUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhc2tQcm9wb3NhbEF1ZGl0RGV0YWlscyhcbiAgZGV0YWlscz86IFJlYWRvbmx5PFJlY29yZDxzdHJpbmcsIHVua25vd24+Pixcbik6IFJlY29yZDxzdHJpbmcsIHVua25vd24+ICYgQXNrUHJvcG9zYWxQcm92ZW5hbmNlIHtcbiAgcmV0dXJuIHsgLi4uZGV0YWlscywgcHJvcG9zZWRCeTogQVNLX0FHRU5UX1BST1BPU0VSIH07XG59XG5cbi8qKlxuICogVGhlIHJlcXVlc3QgSEVBREVSIGEgcHJvcG9zYWwgY29tbWl0IHN0YW1wcywgYW5kIHRoZSBvbmx5IGNoYW5uZWwgcHJvdmVuYW5jZVxuICogdHJhdmVscyBvbi5cbiAqXG4gKiBBIEhFQURFUiByYXRoZXIgdGhhbiBhIGJvZHkgZmllbGQsIGZvciB0aHJlZSByZWFzb25zOlxuICpcbiAqICAtICoqSXQgY2Fubm90IGNvbGxpZGUuKiogYHByb3Bvc2VkQnlgIGluIGEgYm9keSB3b3VsZCBiZSBhIG5ldyBrZXkgaW4gc2l4XG4gKiAgICBkaWZmZXJlbnQgZG9tYWluIHNjaGVtYXMg4oCUIGBQaXBlbGluZVVwZGF0ZVNjaGVtYWAsIHRoZSBwbHVnaW4vdGVtcGxhdGVcbiAqICAgIHVwZGF0ZSBzY2hlbWFzLCB0aHJlZSBub3RpZmljYXRpb24vc2V0dGluZ3Mgc2NoZW1hcyDigJQgdHdvIG9mIHdoaWNoIGFyZVxuICogICAgYC5zdHJpY3QoKWAgYW5kIHRoZSByZXN0IG9mIHdoaWNoIGZlZWQgYE9iamVjdC5rZXlzKGJvZHkpYCBzdHJhaWdodCBpbnRvXG4gKiAgICB0aGUgdXBkYXRlJ3MgY29sdW1uIGxpc3QgYW5kIHRoZSBhdWRpdCdzIGBmaWVsZHNgLiBBIGZpZWxkIG5hbWVkIGFmdGVyIGFuXG4gKiAgICBhdWRpdCBrZXkgd291bGQgdGhlbiBiZSBpbmRpc3Rpbmd1aXNoYWJsZSBmcm9tIGEgcmVhbCBvbmUsIGFuZCB0aGUgZGF5IGFcbiAqICAgIGRvbWFpbiBncm93cyBpdHMgb3duIGBwcm9wb3NlZEJ5YCB0aGUgdHdvIG1lYW5pbmdzIG1lcmdlIHNpbGVudGx5LlxuICogIC0gKipJdCBpcyB0cmFuc3BvcnQgbWV0YWRhdGEsIGFuZCBzdGF5cyBvdXQgb2YgdGhlIHBheWxvYWQuKiogTm90aGluZ1xuICogICAgZG93bnN0cmVhbSBvZiBgdmFsaWRhdGVCb2R5YCBldmVyIHNlZXMgaXQsIHNvIGl0IGNhbm5vdCBiZSBwZXJzaXN0ZWQsIGNhbm5vdFxuICogICAgd2lkZW4gYSBkaWZmLCBhbmQgY2Fubm90IHJlYWNoIGEgc2VydmljZSB0aGF0IGZvcndhcmRzIHRoZSBib2R5IG9ud2FyZC5cbiAqICAtICoqVGhlIHBsYXRmb3JtIGFscmVhZHkgZG9lcyB0aGlzLioqIGBYLVN0ZXAtVXAtVG9rZW5gIGlzIHRoZSBzYW1lIHNoYXBlIG9mXG4gKiAgICB0aGluZyDigJQgYSBwZXItcmVxdWVzdCBhc3NlcnRpb24gYWJvdXQgSE9XIHRoZSBjYWxsIHdhcyBtYWRlIHJhdGhlciB0aGFuXG4gKiAgICBXSEFUIGl0IGNoYW5nZXMg4oCUIGFuZCByaWRlcyBhIGhlYWRlciBmb3IgdGhlIHNhbWUgcmVhc29ucy5cbiAqXG4gKiBMb3dlci1jYXNlIGJlY2F1c2UgdGhhdCBpcyBob3cgTm9kZSBub3JtYWxpc2VzIGluY29taW5nIGhlYWRlciBuYW1lczsgdGhlXG4gKiBicm93c2VyIHNlbmRzIGBYLVBCLVByb3Bvc2VkLUJ5YCwgd2hpY2ggYXJyaXZlcyBoZXJlLlxuICovXG5leHBvcnQgY29uc3QgQVNLX1BST1BPU0VEX0JZX0hFQURFUiA9ICd4LXBiLXByb3Bvc2VkLWJ5JztcblxuLyoqXG4gKiBXaGF0IGEgcmVxdWVzdCdzIHByb3ZlbmFuY2UgaGVhZGVyIGNsYWltcy5cbiAqXG4gKiBgZm9yZWlnbmAgaXMgYW55IHZhbHVlIHRoYXQgaXMgbm90IEVYQUNUTFkge0BsaW5rIEFTS19BR0VOVF9QUk9QT1NFUn0g4oCUIHRoZXJlXG4gKiBpcyBvbmUgbGVnaXRpbWF0ZSBwcm9wb3NlciBhbmQgbm8gZnJlZS1mb3JtIHRleHQsIHNvIGFueXRoaW5nIGVsc2UgaXMgYSBidWdcbiAqIG9yIGEgZm9yZ2VyeSBhbmQgaXMgbmFtZWQgYXMgc3VjaCByYXRoZXIgdGhhbiBmb2xkZWQgaW50byBgbm9uZWAuXG4gKi9cbmV4cG9ydCB0eXBlIFByb3Bvc2VyQ2xhaW0gPSAnbm9uZScgfCAnYXNrLWFnZW50JyB8ICdmb3JlaWduJztcblxuLyoqXG4gKiBSZWFkIHRoZSBwcm92ZW5hbmNlIGNsYWltIG9mZiBhIHJlcXVlc3QncyBoZWFkZXIgYmFnLlxuICpcbiAqIERlbGliZXJhdGVseSBleGFjdDogbm8gdHJpbW1pbmcsIG5vIGNhc2UgZm9sZGluZywgbm8gcHJlZml4IG1hdGNoaW5nLiBUaGVcbiAqIG9ubHkgc2VuZGVyIGlzIHRoZSBicm93c2VyJ3MgY29uZmlybSBwYXRoLCB3aGljaCBzdGFtcHMgdGhlIHNoYXJlZCBjb25zdGFudCxcbiAqIHNvIGV2ZXJ5IG90aGVyIHZhbHVlIGlzIHJlZnVzZWQgcmF0aGVyIHRoYW4gcmVwYWlyZWQuIFRoaXMgaXMgd2hhdCBrZWVwcyBhXG4gKiBjbGllbnQgZnJvbSB3cml0aW5nIGFyYml0cmFyeSBhdWRpdCBgZGV0YWlsc2Ag4oCUIHRoZSBoZWFkZXIncyB3aG9sZSB2b2NhYnVsYXJ5XG4gKiBpcyBvbmUgd29yZCwgYW5kIHRoZSB3b3JkIGlzIG5vdCB0aGUgY2xpZW50J3MgdG8gY2hvb3NlLlxuICpcbiAqIFRha2VzIHRoZSBoZWFkZXIgQkFHIChgcmVxLmhlYWRlcnNgKSByYXRoZXIgdGhhbiBhIHJlcXVlc3QsIHNvIHRoaXMgbW9kdWxlXG4gKiBrZWVwcyBpdHMgemVybyBydW50aW1lIGltcG9ydHMgYW5kIHRoZSBicm93c2VyIGNhbiBzdGlsbCBpbXBvcnQgdGhlIGNvbnN0YW50LlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVhZFByb3Bvc2VyQ2xhaW0oaGVhZGVyczogdW5rbm93bik6IFByb3Bvc2VyQ2xhaW0ge1xuICBjb25zdCBiYWcgPSBoZWFkZXJzIGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+IHwgbnVsbCB8IHVuZGVmaW5lZDtcbiAgY29uc3QgcmF3ID0gYmFnICYmIHR5cGVvZiBiYWcgPT09ICdvYmplY3QnID8gYmFnW0FTS19QUk9QT1NFRF9CWV9IRUFERVJdIDogdW5kZWZpbmVkO1xuICBjb25zdCB2YWx1ZSA9IEFycmF5LmlzQXJyYXkocmF3KSA/IHJhd1swXSA6IHJhdztcbiAgaWYgKHZhbHVlID09PSB1bmRlZmluZWQgfHwgdmFsdWUgPT09IG51bGwgfHwgdmFsdWUgPT09ICcnKSByZXR1cm4gJ25vbmUnO1xuICByZXR1cm4gdmFsdWUgPT09IEFTS19BR0VOVF9QUk9QT1NFUiA/ICdhc2stYWdlbnQnIDogJ2ZvcmVpZ24nO1xufVxuXG4vKipcbiAqIFRoZSBhdWRpdCBgZGV0YWlsc2AgZm9yIGEgd3JpdGUsIHdpdGggcHJvdmVuYW5jZSBmb2xkZWQgaW4gd2hlbiDigJQgYW5kIE9OTFlcbiAqIHdoZW4g4oCUIHRoZSByZXF1ZXN0IGNhcnJpZXMgdGhlIGFnZW50IG1hcmtlci5cbiAqXG4gKiBgZGV0YWlsc2AgaXMgd2hhdCB0aGUgSEFORExFUiBidWlsdCBhbmQgc3RheXMgYXV0aG9yaXRhdGl2ZS4gUHJvdmVuYW5jZSBpc1xuICogYWRkaXRpdmU6IHRoZSBPTkxZIGtleSBpdCBjYW4gZXZlciB3cml0ZSBpcyBgcHJvcG9zZWRCeWAsIHNvIGV2ZXJ5IGZpZWxkIHRoZVxuICogaGFuZGxlciBzZXQgc3Vydml2ZXMgdW50b3VjaGVkLCBhbmQge0BsaW5rIGFza1Byb3Bvc2FsQXVkaXREZXRhaWxzfSBhcHBsaWVzXG4gKiB0aGF0IG9uZSBrZXkgTEFTVCBzbyBhIGBwcm9wb3NlZEJ5YCBhcnJpdmluZyBmcm9tIGFueXdoZXJlIGVsc2UgY2Fubm90IHNwZWFrXG4gKiBpbiBpdHMgcGxhY2UuIEEgcmVxdWVzdCBjYXJyeWluZyBubyBtYXJrZXIsIG9yIGEgYGZvcmVpZ25gIG9uZSwgZ2V0cyB0aGVcbiAqIGhhbmRsZXIncyBkZXRhaWxzIHVuY2hhbmdlZCDigJQgYW4gb3JkaW5hcnkgZWRpdCByZWNvcmRzIG5vIGBwcm9wb3NlZEJ5YCBhdFxuICogYWxsLCB3aGljaCBpcyB0aGUgZGlzdGluY3Rpb24gdGhlIGZpZWxkIGV4aXN0cyB0byBtYWtlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gd2l0aFByb3Bvc2FsUHJvdmVuYW5jZShcbiAgaGVhZGVyczogdW5rbm93bixcbiAgZGV0YWlscz86IFJlYWRvbmx5PFJlY29yZDxzdHJpbmcsIHVua25vd24+Pixcbik6IFJlY29yZDxzdHJpbmcsIHVua25vd24+IHtcbiAgcmV0dXJuIHJlYWRQcm9wb3NlckNsYWltKGhlYWRlcnMpID09PSAnYXNrLWFnZW50J1xuICAgID8gYXNrUHJvcG9zYWxBdWRpdERldGFpbHMoZGV0YWlscylcbiAgICA6IHsgLi4uZGV0YWlscyB9O1xufVxuXG4vLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuLy8gVGhlIGFsbG93bGlzdFxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuLyoqIEEgdmFsdWUgYW4gYWxsb3dsaXN0ZWQgb3JnIHNldHRpbmcgY2FuIGhvbGQuICovXG5leHBvcnQgdHlwZSBPcmdTZXR0aW5nVmFsdWUgPSBzdHJpbmcgfCBudW1iZXIgfCBib29sZWFuO1xuXG4vKiogV2hpY2ggcGVyLW9yZyByZWNvcmQgKGFuZCB0aGVyZWZvcmUgd2hpY2ggQVBJKSBhIGZpZWxkIGJlbG9uZ3MgdG8uICovXG5leHBvcnQgdHlwZSBPcmdTZXR0aW5nU3VyZmFjZSA9XG4gIHwgJ3JlcG9ydGluZydcbiAgfCAnY29tcGxpYW5jZU5vdGlmaWNhdGlvbnMnXG4gIHwgJ3BsdWdpblNlY3VyaXR5Tm90aWZpY2F0aW9ucyc7XG5cbi8qKlxuICogRXZlcnkgcHJvcG9zYWJsZSBzZXR0aW5nLCBhcyBgPHN1cmZhY2U+LjxmaWVsZD5gLiBXcml0aW5nIHRoZSB1bmlvbiBvdXQgYnlcbiAqIGhhbmQgKHJhdGhlciB0aGFuIGluZmVycmluZyBpdCBmcm9tIHRoZSBhcnJheSkgaXMgZGVsaWJlcmF0ZTogdGhlIGtleSBzcGFjZVxuICogaXMgdGhlIGNvbnRyYWN0IHRoZSB0b29sIHNjaGVtYSBhbmQgdGhlIGNvbmZpcm0gaGFuZGxlciBzaGFyZSwgc28gaXQgaXNcbiAqIHN0YXRlZCBvbmNlLCBleHBsaWNpdGx5LCBhbmQgYSB0eXBvIGluIGFuIGVudHJ5IGJlbG93IGlzIGEgY29tcGlsZSBlcnJvci5cbiAqL1xuZXhwb3J0IHR5cGUgT3JnU2V0dGluZ0tleSA9XG4gIHwgJ3JlcG9ydGluZy5pbmNpZGVudFdpbmRvd0hvdXJzJ1xuICB8ICdjb21wbGlhbmNlTm90aWZpY2F0aW9ucy5ub3RpZnlPbkJsb2NrJ1xuICB8ICdjb21wbGlhbmNlTm90aWZpY2F0aW9ucy5ub3RpZnlPbldhcm5pbmcnXG4gIHwgJ2NvbXBsaWFuY2VOb3RpZmljYXRpb25zLmVtYWlsRW5hYmxlZCdcbiAgfCAnY29tcGxpYW5jZU5vdGlmaWNhdGlvbnMuZGlnZXN0TW9kZSdcbiAgfCAncGx1Z2luU2VjdXJpdHlOb3RpZmljYXRpb25zLm5vdGlmeVJlc2NhbidcbiAgfCAncGx1Z2luU2VjdXJpdHlOb3RpZmljYXRpb25zLmRpZ2VzdE1vZGUnO1xuXG4vKiogVGhlIGNsb3NlZCBzaGFwZSBhIHByb3Bvc2VkIHZhbHVlIG11c3QgbWF0Y2ggYmVmb3JlIGl0IGlzIGFjY2VwdGVkLiAqL1xuZXhwb3J0IHR5cGUgT3JnU2V0dGluZ1NoYXBlID1cbiAgfCB7IHJlYWRvbmx5IGtpbmQ6ICdib29sZWFuJyB9XG4gIHwgeyByZWFkb25seSBraW5kOiAnaW50ZWdlcic7IHJlYWRvbmx5IG1pbjogbnVtYmVyOyByZWFkb25seSBtYXg6IG51bWJlciB9XG4gIHwgeyByZWFkb25seSBraW5kOiAnZW51bSc7IHJlYWRvbmx5IHZhbHVlczogcmVhZG9ubHkgc3RyaW5nW10gfTtcblxuLyoqIE9uZSBwcm9wb3NhYmxlIG9yZyBzZXR0aW5nLiAqL1xuZXhwb3J0IGludGVyZmFjZSBPcmdTZXR0aW5nU3BlYyB7XG4gIC8qKiBTdGFibGUgcHJvcG9zYWwga2V5IOKAlCBgPHN1cmZhY2U+LjxmaWVsZD5gLiBUaGlzIGlzIHdoYXQgdGhlIG1vZGVsIG5hbWVzLiAqL1xuICByZWFkb25seSBrZXk6IE9yZ1NldHRpbmdLZXk7XG4gIHJlYWRvbmx5IHN1cmZhY2U6IE9yZ1NldHRpbmdTdXJmYWNlO1xuICAvKiogVGhlIHJlcXVlc3QtYm9keSBmaWVsZCBuYW1lIHRoZSBBUEkgZXhwZWN0cy4gKi9cbiAgcmVhZG9ubHkgZmllbGQ6IHN0cmluZztcbiAgcmVhZG9ubHkgc2hhcGU6IE9yZ1NldHRpbmdTaGFwZTtcbiAgLyoqIFRoZSByb3V0ZSB0aGF0IGFwcGxpZXMgaXQsIGNhbGxlZCBieSB0aGUgQlJPV1NFUiB3aXRoIHRoZSB1c2VyJ3Mgc2Vzc2lvbi4gKi9cbiAgcmVhZG9ubHkgYXBpOiB7IHJlYWRvbmx5IG1ldGhvZDogJ1BVVCc7IHJlYWRvbmx5IHBhdGg6IHN0cmluZyB9O1xuICAvKiogVGhlIHBlcm1pc3Npb24gdGhhdCByb3V0ZSByZXF1aXJlcyBvZiB0aGUgY2FsbGVyLiAqL1xuICByZWFkb25seSBwZXJtaXNzaW9uOiBQZXJtaXNzaW9uO1xuICAvKiogU2hvcnQgaHVtYW4gbGFiZWwgZm9yIHRoZSBjb25maXJtIGNhcmQuICovXG4gIHJlYWRvbmx5IGxhYmVsOiBzdHJpbmc7XG4gIC8qKiBXSFkgdGhpcyBmaWVsZCBpcyBzYWZlIHRvIHByb3Bvc2UuIEV2ZXJ5IGVudHJ5IHN0YXRlcyBpdHMgb3duIGNhc2UuICovXG4gIHJlYWRvbmx5IHdoeTogc3RyaW5nO1xufVxuXG4vKipcbiAqIFRoZSBgZGlnZXN0TW9kZWAgdm9jYWJ1bGFyeSBpcyBNSVJST1JFRCwgbm90IGltcG9ydGVkOiB0aGlzIG1vZHVsZSBrZWVwcyB6ZXJvXG4gKiBydW50aW1lIGltcG9ydHMgc28gdGhlIGJyb3dzZXIgZW50cnkgc3RheXMgc3RhbmRhbG9uZS4gVGhlIHR5cGUgYW5ub3RhdGlvblxuICogbWFrZXMgYSBSRU1PVkVEIG1vZGUgYSBjb21waWxlIGVycm9yIGhlcmUsIGFuZCBgYXNrLXByb3Bvc2Fscy50ZXN0LnRzYCBhc3NlcnRzXG4gKiB0aGUgbGlzdCBhZ2FpbnN0IGBQTFVHSU5fU0VDVVJJVFlfRElHRVNUX01PREVTYCBzbyBhbiBBRERFRCBvbmUgY2Fubm90IGRyaWZ0XG4gKiBlaXRoZXIuXG4gKi9cbmNvbnN0IERJR0VTVF9NT0RFUzogcmVhZG9ubHkgUGx1Z2luU2VjdXJpdHlEaWdlc3RNb2RlW10gPSBbJ2ltbWVkaWF0ZScsICdkYWlseScsICd3ZWVrbHknXTtcblxuLyoqXG4gKiBUaGUgYWxsb3dsaXN0LiBBZGRpbmcgYW4gZW50cnkgaXMgYSBkZWxpYmVyYXRlIGFjdDogbmFtZSB0aGUgcm91dGUgeW91XG4gKiBjaGVja2VkLCBjb25maXJtIGl0IGNhcnJpZXMgbm8gYHJlcXVpcmVTdGVwVXBgLCBhbmQgd3JpdGUgdGhlIGB3aHlgLlxuICovXG5leHBvcnQgY29uc3QgT1JHX1NFVFRJTkdfUFJPUE9TQUxfQUxMT1dMSVNUOiByZWFkb25seSBPcmdTZXR0aW5nU3BlY1tdID0gW1xuICB7XG4gICAga2V5OiAncmVwb3J0aW5nLmluY2lkZW50V2luZG93SG91cnMnLFxuICAgIHN1cmZhY2U6ICdyZXBvcnRpbmcnLFxuICAgIGZpZWxkOiAnaW5jaWRlbnRXaW5kb3dIb3VycycsXG4gICAgc2hhcGU6IHsga2luZDogJ2ludGVnZXInLCBtaW46IDEsIG1heDogNzIwIH0sXG4gICAgYXBpOiB7IG1ldGhvZDogJ1BVVCcsIHBhdGg6ICcvcmVwb3J0cy9zZXR0aW5ncy9pbmNpZGVudHMnIH0sXG4gICAgcGVybWlzc2lvbjogJ29yZzpzZXR0aW5ncycsXG4gICAgbGFiZWw6ICdJbmNpZGVudCBjb3JyZWxhdGlvbiB3aW5kb3cgKGhvdXJzKScsXG4gICAgd2h5OlxuICAgICAgJ0FuYWx5dGljcyB0dW5pbmcgb25seTogaXQgZGVjaWRlcyBob3cgbG9uZyBhZnRlciBhIGRlcGxveSBhbiBpbmNpZGVudCBpcyAnXG4gICAgICArICdhdHRyaWJ1dGVkIHRvIHRoYXQgZGVwbG95IHdoZW4gRE9SQSBtZXRyaWNzIGFyZSBjb21wdXRlZC4gSXQgZ3JhbnRzIG5vdGhpbmcsICdcbiAgICAgICsgJ3JldmVhbHMgbm90aGluZyBhbmQgcmVhY2hlcyBubyBvbmUg4oCUIHRoZSB3b3JzdCBvdXRjb21lIG9mIGEgd3JvbmcgdmFsdWUgaXMgYSAnXG4gICAgICArICdtaXNsZWFkaW5nIGNoYW5nZS1mYWlsdXJlIHJhdGUsIHdoaWNoIHRoZSBuZXh0IGVkaXQgY29ycmVjdHMuIFRoZSByb3V0ZSAnXG4gICAgICArICdyZWplY3RzIHRoZSBzaWJsaW5nIHJldGVudGlvbiBmaWVsZHMgb3V0cmlnaHQgKHRoZXkgYXJlIGJpbGxpbmctb3duZWQpLCBzbyAnXG4gICAgICArICd0aGlzIGlzIHRoZSB3aG9sZSB3cml0YWJsZSBzdXJmYWNlLiBCb3VuZGVkIGludGVnZXIsIHNvIHRoZSBkaWZmIGlzIG9uZSBudW1iZXIuJyxcbiAgfSxcbiAge1xuICAgIGtleTogJ2NvbXBsaWFuY2VOb3RpZmljYXRpb25zLm5vdGlmeU9uQmxvY2snLFxuICAgIHN1cmZhY2U6ICdjb21wbGlhbmNlTm90aWZpY2F0aW9ucycsXG4gICAgZmllbGQ6ICdub3RpZnlPbkJsb2NrJyxcbiAgICBzaGFwZTogeyBraW5kOiAnYm9vbGVhbicgfSxcbiAgICBhcGk6IHsgbWV0aG9kOiAnUFVUJywgcGF0aDogJy9jb21wbGlhbmNlL25vdGlmaWNhdGlvbi1wcmVmZXJlbmNlcycgfSxcbiAgICBwZXJtaXNzaW9uOiAnY29tcGxpYW5jZTp3cml0ZScsXG4gICAgbGFiZWw6ICdOb3RpZnkgd2hlbiBjb21wbGlhbmNlIGJsb2NrcyBhbiBhY3Rpb24nLFxuICAgIHdoeTpcbiAgICAgICdBIGRlbGl2ZXJ5IHByZWZlcmVuY2UsIG5vdCBhbiBlbmZvcmNlbWVudCBjb250cm9sOiB0aGUgYmxvY2sgaGFwcGVucyBlaXRoZXIgJ1xuICAgICAgKyAnd2F5IGFuZCB0aGUgcG9saWN5IHRoYXQgY2F1c2VkIGl0IGlzIHVuY2hhbmdlZC4gVHVybmluZyBpdCBvZmYgbWFrZXMgdGhlIG9yZyAnXG4gICAgICArICdxdWlldGVyLCBuZXZlciBtb3JlIHBlcm1pc3NpdmUuJyxcbiAgfSxcbiAge1xuICAgIGtleTogJ2NvbXBsaWFuY2VOb3RpZmljYXRpb25zLm5vdGlmeU9uV2FybmluZycsXG4gICAgc3VyZmFjZTogJ2NvbXBsaWFuY2VOb3RpZmljYXRpb25zJyxcbiAgICBmaWVsZDogJ25vdGlmeU9uV2FybmluZycsXG4gICAgc2hhcGU6IHsga2luZDogJ2Jvb2xlYW4nIH0sXG4gICAgYXBpOiB7IG1ldGhvZDogJ1BVVCcsIHBhdGg6ICcvY29tcGxpYW5jZS9ub3RpZmljYXRpb24tcHJlZmVyZW5jZXMnIH0sXG4gICAgcGVybWlzc2lvbjogJ2NvbXBsaWFuY2U6d3JpdGUnLFxuICAgIGxhYmVsOiAnTm90aWZ5IG9uIGNvbXBsaWFuY2Ugd2FybmluZ3MnLFxuICAgIHdoeTogJ0FzIG5vdGlmeU9uQmxvY2sg4oCUIHdoaWNoIG5vbi1ibG9ja2luZyBmaW5kaW5ncyBhcmUgYW5ub3VuY2VkLCBub3Qgd2hhdCBpcyBlbmZvcmNlZC4nLFxuICB9LFxuICB7XG4gICAga2V5OiAnY29tcGxpYW5jZU5vdGlmaWNhdGlvbnMuZW1haWxFbmFibGVkJyxcbiAgICBzdXJmYWNlOiAnY29tcGxpYW5jZU5vdGlmaWNhdGlvbnMnLFxuICAgIGZpZWxkOiAnZW1haWxFbmFibGVkJyxcbiAgICBzaGFwZTogeyBraW5kOiAnYm9vbGVhbicgfSxcbiAgICBhcGk6IHsgbWV0aG9kOiAnUFVUJywgcGF0aDogJy9jb21wbGlhbmNlL25vdGlmaWNhdGlvbi1wcmVmZXJlbmNlcycgfSxcbiAgICBwZXJtaXNzaW9uOiAnY29tcGxpYW5jZTp3cml0ZScsXG4gICAgbGFiZWw6ICdTZW5kIGNvbXBsaWFuY2Ugbm90aWNlcyBieSBlbWFpbCcsXG4gICAgd2h5OlxuICAgICAgJ0Nob29zZXMgd2hldGhlciB0aGUgZXhpc3Rpbmcgbm90aWNlcyBnbyBvdXQgYnkgZW1haWwuIEl0IGRvZXMgbm90IG5hbWUgYSAnXG4gICAgICArICdyZWNpcGllbnQg4oCUIHRoZSBhZGRyZXNzIGxpc3QgaXMgcmVzb2x2ZWQgZnJvbSBvcmcgbWVtYmVyc2hpcCBhdCBzZW5kIHRpbWUg4oCUICdcbiAgICAgICsgJ3NvIGEgZmxpcHBlZCBib29sZWFuIGNhbiBuZXZlciByb3V0ZSBtYWlsIHNvbWV3aGVyZSBuZXcuJyxcbiAgfSxcbiAge1xuICAgIGtleTogJ2NvbXBsaWFuY2VOb3RpZmljYXRpb25zLmRpZ2VzdE1vZGUnLFxuICAgIHN1cmZhY2U6ICdjb21wbGlhbmNlTm90aWZpY2F0aW9ucycsXG4gICAgZmllbGQ6ICdkaWdlc3RNb2RlJyxcbiAgICBzaGFwZTogeyBraW5kOiAnZW51bScsIHZhbHVlczogRElHRVNUX01PREVTIH0sXG4gICAgYXBpOiB7IG1ldGhvZDogJ1BVVCcsIHBhdGg6ICcvY29tcGxpYW5jZS9ub3RpZmljYXRpb24tcHJlZmVyZW5jZXMnIH0sXG4gICAgcGVybWlzc2lvbjogJ2NvbXBsaWFuY2U6d3JpdGUnLFxuICAgIGxhYmVsOiAnQ29tcGxpYW5jZSBub3RpY2UgY2FkZW5jZScsXG4gICAgd2h5OiAnQ2FkZW5jZSBvZiBhbiBleGlzdGluZyBub3RpY2UgdG8gZXhpc3RpbmcgcmVjaXBpZW50cy4gQ2xvc2VkIGVudW0sIHNvIHRoZSBkaWZmIGlzIG9uZSB3b3JkLicsXG4gIH0sXG4gIHtcbiAgICBrZXk6ICdwbHVnaW5TZWN1cml0eU5vdGlmaWNhdGlvbnMubm90aWZ5UmVzY2FuJyxcbiAgICBzdXJmYWNlOiAncGx1Z2luU2VjdXJpdHlOb3RpZmljYXRpb25zJyxcbiAgICBmaWVsZDogJ25vdGlmeVJlc2NhbicsXG4gICAgc2hhcGU6IHsga2luZDogJ2Jvb2xlYW4nIH0sXG4gICAgYXBpOiB7IG1ldGhvZDogJ1BVVCcsIHBhdGg6ICcvcGx1Z2lucy9zZWN1cml0eS1ub3RpZmljYXRpb25zJyB9LFxuICAgIHBlcm1pc3Npb246ICdvcmc6c2V0dGluZ3MnLFxuICAgIGxhYmVsOiAnTm90aWZ5IG9uIG5pZ2h0bHkgcmVzY2FuIGZpbmRpbmdzJyxcbiAgICB3aHk6XG4gICAgICAnR292ZXJucyB0aGUgTjMxIHJlc2NhbiBub3RpY2Ugb25seS4gVGhlIHNjYW4gR0FURVMgYXJlIHVudG91Y2hlZDogYSBidWlsZCB0aGF0ICdcbiAgICAgICsgJ3RyaXBzIFBMVUdJTl9WVUxOX0dBVEUgc3RpbGwgZmFpbHMgYW5kIHN0aWxsIHNlbmRzIE4zMCwgd2hpY2ggdGhpcyBmbGFnIGNhbm5vdCAnXG4gICAgICArICdzdXBwcmVzcy4gU28gaXQgY2hhbmdlcyBob3cgbm9pc3kgYW4gaW5mb3JtYXRpb25hbCBub3RpY2UgaXMsIG5vdCB3aGV0aGVyIGEgJ1xuICAgICAgKyAndnVsbmVyYWJsZSB2ZXJzaW9uIGNhbiBiZSBwdWJsaXNoZWQuJyxcbiAgfSxcbiAge1xuICAgIGtleTogJ3BsdWdpblNlY3VyaXR5Tm90aWZpY2F0aW9ucy5kaWdlc3RNb2RlJyxcbiAgICBzdXJmYWNlOiAncGx1Z2luU2VjdXJpdHlOb3RpZmljYXRpb25zJyxcbiAgICBmaWVsZDogJ2RpZ2VzdE1vZGUnLFxuICAgIHNoYXBlOiB7IGtpbmQ6ICdlbnVtJywgdmFsdWVzOiBESUdFU1RfTU9ERVMgfSxcbiAgICBhcGk6IHsgbWV0aG9kOiAnUFVUJywgcGF0aDogJy9wbHVnaW5zL3NlY3VyaXR5LW5vdGlmaWNhdGlvbnMnIH0sXG4gICAgcGVybWlzc2lvbjogJ29yZzpzZXR0aW5ncycsXG4gICAgbGFiZWw6ICdQbHVnaW4gc2VjdXJpdHkgbm90aWNlIGNhZGVuY2UnLFxuICAgIHdoeTpcbiAgICAgICdDYWRlbmNlIG9mIHRoZSByZXNjYW4gbm90aWNlLiBOMzAgKFwidmVyc2lvbiBibG9ja2VkXCIpIGlzIGFsd2F5cyBpbW1lZGlhdGUgYW5kICdcbiAgICAgICsgJ2lnbm9yZXMgdGhpcyBmaWVsZCwgc28gdGhlIHVyZ2VudCBjaGFubmVsIGNhbm5vdCBiZSBzbG93ZWQgZG93bi4nLFxuICB9LFxuXTtcblxuLyoqXG4gKiBGaWVsZHMgREVMSUJFUkFURUxZIGV4Y2x1ZGVkLCB3aXRoIHRoZSByZWFzb24sIHNvIGEgZnV0dXJlIHJlYWRlciBkb2VzIG5vdFxuICogcmUtbGl0aWdhdGUgdGhlbSBhbmQgYSByZXZpZXdlciBjYW4gc2VlIHRoZXkgd2VyZSBjb25zaWRlcmVkIHJhdGhlciB0aGFuXG4gKiBtaXNzZWQuIFRoaXMgaXMgZG9jdW1lbnRhdGlvbiBvbmx5IOKAlCB7QGxpbmsgcGlja0FsbG93ZWR9IGNvbnN1bHRzIHRoZVxuICogYWxsb3dsaXN0IGFsb25lLCBhbmQgYSBmaWVsZCBhYnNlbnQgZnJvbSBCT1RIIGxpc3RzIGlzIHJlZnVzZWQgaWRlbnRpY2FsbHkuXG4gKi9cbmV4cG9ydCBjb25zdCBPUkdfU0VUVElOR19QUk9QT1NBTF9FWENMVVNJT05TOiBSZWFkb25seUFycmF5PHsgcmVhZG9ubHkgZmllbGQ6IHN0cmluZzsgcmVhZG9ubHkgd2h5OiBzdHJpbmcgfT4gPSBbXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24uYWlDb25maWcnLCB3aHk6ICdTdGVwLXVwIGdhdGVkIChQVVQgL29yZ2FuaXphdGlvbi9haS1jb25maWcpIGFuZCBwZXJzaXN0cyBwZXItb3JnIHByb3ZpZGVyIHNlY3JldHMuJyB9LFxuICB7IGZpZWxkOiAnb3JnYW5pemF0aW9uLm1mYVBvbGljeScsIHdoeTogJ1NlY3VyaXR5IGNvbnRyb2wgKyBzdGVwLXVwLiBMb29zZW5pbmcgaXQgcmVtb3ZlcyBhIGNvbnRyb2wgZm9yIGV2ZXJ5IG1lbWJlci4nIH0sXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24ucGFzc3dvcmRQb2xpY3knLCB3aHk6ICdTZWN1cml0eSBjb250cm9sICsgc3RlcC11cC4nIH0sXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24uYXV0aGVudGljYXRvclBvbGljeScsIHdoeTogJ1NlY3VyaXR5IGNvbnRyb2wgKyBzdGVwLXVwLicgfSxcbiAgeyBmaWVsZDogJ29yZ2FuaXphdGlvbi5pbXBlcnNvbmF0aW9uUG9saWN5Jywgd2h5OiAnU2VjdXJpdHkgY29udHJvbCArIHN0ZXAtdXA7IGRlY2lkZXMgd2hvIG91dHNpZGUgdGhlIG9yZyBtYXkgdmlldyBpdHMgZGF0YS4nIH0sXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24uaWRwJywgd2h5OiAnU1NPL1NBTUwgY29uZmlnOiBzZWN1cml0eSBjb250cm9sIG9uIGl0cyBvd24gY2FwYWJpbGl0eSAob3JnOmlkcCksIGFzc3VyYW5jZSArIHN0cm9uZyBzdGVwLXVwLicgfSxcbiAgeyBmaWVsZDogJ29yZ2FuaXphdGlvbi5rbXNDb25maWcnLCB3aHk6ICdLZXkgbWF0ZXJpYWwuIE93biBjYXBhYmlsaXR5IChvcmc6a21zKSwgYXNzdXJhbmNlICsgc3Ryb25nIHN0ZXAtdXAuJyB9LFxuICB7IGZpZWxkOiAnb3JnYW5pemF0aW9uLmlkZW50aXR5Jywgd2h5OiAnT3JnIG5hbWUvc2x1Zzogbm8gc3RlcC11cCwgYnV0IHJlbmFtaW5nIGFuIG9yZyBpcyBhbiBpbXBlcnNvbmF0aW9uIHByaW1pdGl2ZSBhbmQgdGhlIHNsdWcgaXMgYWRkcmVzc2FibGUuJyB9LFxuICB7IGZpZWxkOiAnb3JnYW5pemF0aW9uLmRvbWFpbnMnLCB3aHk6ICdWZXJpZmllZCBkb21haW5zIGRyaXZlIGRvbWFpbi1iYXNlZCBqb2luIOKAlCB3aG8gbWF5IGJlY29tZSBhIG1lbWJlci4nIH0sXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24uam9pblJlcXVlc3RzJywgd2h5OiAnTWVtYmVyc2hpcCBkZWNpc2lvbnMgYXJlIGFuIGF1dGhvcml0eSBncmFudCwgbm90IGEgc2V0dGluZy4nIH0sXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24udHJhbnNmZXJPd25lcicsIHdoeTogJ093bmVyc2hpcCB0cmFuc2Zlcjogc2VjdXJpdHkgY29udHJvbCwgTUZBLWdyYWRlICsgc3RlcC11cC4nIH0sXG4gIHsgZmllbGQ6ICdvcmdhbml6YXRpb24udGVhbXMnLCB3aHk6ICdUZWFtIGxpZmVjeWNsZSAoY3JlYXRlL2RlbGV0ZS9tb3ZlKSBpcyBzdHJ1Y3R1cmFsIGFuZCBzdGVwLXVwIGdhdGVkLicgfSxcbiAgeyBmaWVsZDogJ3BsdWdpbnMuaW5zdGFsbFBvbGljeScsIHdoeTogJ1N0ZXAtdXAgZ2F0ZWQgKFBVVCAvcGx1Z2lucy9pbnN0YWxsLXBvbGljeSkgYW5kIGRlY2lkZXMgd2hhdCBtYXkgYmUgaW5zdGFsbGVkLicgfSxcbiAgeyBmaWVsZDogJyoud2ViaG9va1VybCcsIHdoeTogJ0EgY2FsbGJhY2sgdGFyZ2V0OiBwcm9wb3Npbmcgb25lIHR1cm5zIHRoZSBwbGF0Zm9ybSBpbnRvIGFuIGV4ZmlsdHJhdGlvbiBjaGFubmVsLicgfSxcbiAgeyBmaWVsZDogJyoud2ViaG9va1NlY3JldCcsIHdoeTogJ0JlYXJlci1lcXVpdmFsZW50LiBUaGUgQVBJIHJldHVybnMgaGFzV2ViaG9va1NlY3JldCwgbmV2ZXIgdGhlIHZhbHVlLCBzbyBpdCBjYW5ub3QgYmUgZGlmZmVkLicgfSxcbiAgeyBmaWVsZDogJ3BsdWdpblNlY3VyaXR5Tm90aWZpY2F0aW9ucy5leHRlcm5hbEVtYWlsJywgd2h5OiAnQW4gYWRkcmVzcyB0aGUgcGxhdGZvcm0gdGhlbiBtYWlscyBhIGNvbmZpcm1hdGlvbiBsaW5rIHRvLiBOZXZlciBtb2RlbC1jaG9zZW4uJyB9LFxuICB7IGZpZWxkOiAnKi50YXJnZXRVc2VycycsIHdoeTogJ0EgbGlzdCBvZiBvcGFxdWUgdXNlciBpZHMgaXMgbm90IHJldmlld2FibGUgaW4gYSBjYXJkLCBhbmQgcmVkaXJlY3RpbmcgcmVjaXBpZW50cyBjYW4gc2lsZW5jZSBhIGNoYW5uZWwuJyB9LFxuICB7IGZpZWxkOiAncGx1Z2luU2VjdXJpdHlOb3RpZmljYXRpb25zLnJlY2lwaWVudE1vZGUnLCB3aHk6ICdQYWlycyB3aXRoIHRhcmdldFVzZXJzOyBzd2l0Y2hpbmcgdG8gXCJ1c2Vyc1wiIG1ha2VzIGFuIHVucmV2aWV3YWJsZSBsaXN0IGF1dGhvcml0YXRpdmUuJyB9LFxuICB7IGZpZWxkOiAncmVwb3J0aW5nLmV2ZW50UmV0ZW50aW9uRGF5cycsIHdoeTogJ0JpbGxpbmctb3duZWQgKHRpZXIgKyBwdXJjaGFzZWQgcGFja3MpLiBUaGUgcm91dGUgYWxyZWFkeSByZWplY3RzIGl0OyBhZG1pdHRpbmcgaXQgd291bGQgYmUgYW4gZW50aXRsZW1lbnQgYnlwYXNzLicgfSxcbiAgeyBmaWVsZDogJ3JlcG9ydGluZy5kb3JhUmV0ZW50aW9uRGF5cycsIHdoeTogJ0JpbGxpbmctb3duZWQsIGFzIGFib3ZlLicgfSxcbl07XG5cbi8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG4vLyBMb29rdXBcbi8vIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tXG5cbmNvbnN0IEJZX0tFWTogUmVhZG9ubHlNYXA8c3RyaW5nLCBPcmdTZXR0aW5nU3BlYz4gPVxuICBuZXcgTWFwKE9SR19TRVRUSU5HX1BST1BPU0FMX0FMTE9XTElTVC5tYXAoKHNwZWMpID0+IFtzcGVjLmtleSwgc3BlY10pKTtcblxuLyoqIEV2ZXJ5IHByb3Bvc2FibGUga2V5IOKAlCB0aGUgZW51bSBhIHByb3Bvc2UgdG9vbCdzIGlucHV0IHNjaGVtYSBpcyBidWlsdCBmcm9tLiAqL1xuZXhwb3J0IGNvbnN0IE9SR19TRVRUSU5HX1BST1BPU0FMX0tFWVM6IHJlYWRvbmx5IE9yZ1NldHRpbmdLZXlbXSA9XG4gIE9SR19TRVRUSU5HX1BST1BPU0FMX0FMTE9XTElTVC5tYXAoKHNwZWMpID0+IHNwZWMua2V5KTtcblxuLyoqIElzIGBrZXlgIG9uIHRoZSBhbGxvd2xpc3Q/ICovXG5leHBvcnQgZnVuY3Rpb24gaXNQcm9wb3NhYmxlT3JnU2V0dGluZyhrZXk6IHN0cmluZyk6IGtleSBpcyBPcmdTZXR0aW5nS2V5IHtcbiAgcmV0dXJuIEJZX0tFWS5oYXMoa2V5KTtcbn1cblxuLyoqIFRoZSBzcGVjIGZvciBga2V5YCwgb3IgdW5kZWZpbmVkIHdoZW4gaXQgaXMgbm90IHByb3Bvc2FibGUuICovXG5leHBvcnQgZnVuY3Rpb24gb3JnU2V0dGluZ1NwZWMoa2V5OiBzdHJpbmcpOiBPcmdTZXR0aW5nU3BlYyB8IHVuZGVmaW5lZCB7XG4gIHJldHVybiBCWV9LRVkuZ2V0KGtleSk7XG59XG5cbi8qKiBEb2VzIGB2YWx1ZWAgbWF0Y2ggdGhlIHNoYXBlIHRoZSBmaWVsZCBkZWNsYXJlcz8gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1ZhbGlkT3JnU2V0dGluZ1ZhbHVlKHNwZWM6IE9yZ1NldHRpbmdTcGVjLCB2YWx1ZTogdW5rbm93bik6IHZhbHVlIGlzIE9yZ1NldHRpbmdWYWx1ZSB7XG4gIGNvbnN0IHNoYXBlID0gc3BlYy5zaGFwZTtcbiAgaWYgKHNoYXBlLmtpbmQgPT09ICdib29sZWFuJykgcmV0dXJuIHR5cGVvZiB2YWx1ZSA9PT0gJ2Jvb2xlYW4nO1xuICBpZiAoc2hhcGUua2luZCA9PT0gJ2ludGVnZXInKSB7XG4gICAgcmV0dXJuIHR5cGVvZiB2YWx1ZSA9PT0gJ251bWJlcicgJiYgTnVtYmVyLmlzSW50ZWdlcih2YWx1ZSkgJiYgdmFsdWUgPj0gc2hhcGUubWluICYmIHZhbHVlIDw9IHNoYXBlLm1heDtcbiAgfVxuICByZXR1cm4gdHlwZW9mIHZhbHVlID09PSAnc3RyaW5nJyAmJiBzaGFwZS52YWx1ZXMuaW5jbHVkZXModmFsdWUpO1xufVxuXG4vLyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuLy8gcGlja0FsbG93ZWQgKHJ1bGVzIDEsIDMgYW5kIDEwKVxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuLyoqIEEgcHJvcG9zYWwncyBzZXR0aW5ncywga2V5ZWQgYnkgYWxsb3dsaXN0IGtleS4gKi9cbmV4cG9ydCB0eXBlIE9yZ1NldHRpbmdQYXRjaCA9IFBhcnRpYWw8UmVjb3JkPE9yZ1NldHRpbmdLZXksIE9yZ1NldHRpbmdWYWx1ZT4+O1xuXG4vKiogV2hhdCB7QGxpbmsgcGlja0FsbG93ZWR9IGtlcHQsIGFuZCB3aGF0IGl0IHRocmV3IGF3YXkuICovXG5leHBvcnQgaW50ZXJmYWNlIFBpY2tBbGxvd2VkUmVzdWx0IHtcbiAgLyoqIFRoZSBhbGxvd2xpc3RlZCwgc2hhcGUtdmFsaWQgc2V0dGluZ3MuICovXG4gIHJlYWRvbmx5IGFsbG93ZWQ6IE9yZ1NldHRpbmdQYXRjaDtcbiAgLyoqXG4gICAqIEZpZWxkIG5hbWVzIHRoZSBjYW5kaWRhdGUgY2FycmllZCB0aGF0IGFyZSBOT1Qgb24gdGhlIGFsbG93bGlzdC4gVEhJUyBpc1xuICAgKiB0aGUgaW5qZWN0aW9uIHNpZ25hbCAocnVsZSAxMCk6IGEgbGVnaXRpbWF0ZSBkcmFmdCBoYXMgbm9uZSwgc28gYSBub24tZW1wdHlcbiAgICogbGlzdCBpcyBhIGNvdW50ZXIgdG8gaW5jcmVtZW50IGFuZCBhIGxpbmUgdG8gbG9nLCBub3QgYSBzaWxlbnQgZHJvcC5cbiAgICovXG4gIHJlYWRvbmx5IHJlZnVzZWQ6IHJlYWRvbmx5IHN0cmluZ1tdO1xuICAvKipcbiAgICogQWxsb3dsaXN0ZWQga2V5cyB3aG9zZSB2YWx1ZSBkaWQgbm90IG1hdGNoIHRoZSBkZWNsYXJlZCBzaGFwZS4gRHJvcHBlZCB0b28sXG4gICAqIGJ1dCByZXBvcnRlZCBzZXBhcmF0ZWx5IOKAlCBhIGJhZCB2YWx1ZSBpcyBhIGRyYWZ0aW5nIG1pc3Rha2UsIG5vdCBhbiBhdHRlbXB0XG4gICAqIHRvIHJlYWNoIGEgZmllbGQgdGhlIGFnZW50IHdhcyBuZXZlciBnaXZlbi5cbiAgICovXG4gIHJlYWRvbmx5IGludmFsaWQ6IHJlYWRvbmx5IE9yZ1NldHRpbmdLZXlbXTtcbiAgLyoqIGByZWZ1c2VkLmxlbmd0aGAsIHNvIGEgY2FsbGVyIGNhbiBjb3VudCB3aXRob3V0IHJlLWRlcml2aW5nIGl0LiAqL1xuICByZWFkb25seSByZWZ1c2VkQ291bnQ6IG51bWJlcjtcbn1cblxuLyoqXG4gKiBLZWVwIG9ubHkgdGhlIGFsbG93bGlzdGVkLCBzaGFwZS12YWxpZCBmaWVsZHMgb2YgYSBjYW5kaWRhdGUgcHJvcG9zYWwsIGFuZFxuICogcmVwb3J0IGV2ZXJ5dGhpbmcgZHJvcHBlZC5cbiAqXG4gKiBUaGUgcmVzdWx0J3MgYGFsbG93ZWRgIG1hcCBJUyB0aGUgY29tbWl0IHBheWxvYWQgKHJ1bGUgMyk6IHRoZSBjb25maXJtXG4gKiBoYW5kbGVyIHNlbmRzIHRoZXNlIGZpZWxkcyBhbmQgb25seSB0aGVzZSwgc28gYW55dGhpbmcgdGhlIG1vZGVsIHNsaXBwZWQgaW5cbiAqIGlzIHN0cnVjdHVyYWxseSB1bmFwcGxpYWJsZSByYXRoZXIgdGhhbiBtZXJlbHkgdW5yZW5kZXJlZC5cbiAqXG4gKiBgY2FuZGlkYXRlYCBpcyB1bnRydXN0ZWQgbW9kZWwgb3V0cHV0LCBzbyBpdCBpcyByZWFkIGRlZmVuc2l2ZWx5OiBhbnl0aGluZ1xuICogdGhhdCBpcyBub3QgYSBwbGFpbiBvYmplY3QgeWllbGRzIGFuIGVtcHR5IHJlc3VsdC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHBpY2tBbGxvd2VkKGNhbmRpZGF0ZTogdW5rbm93bik6IFBpY2tBbGxvd2VkUmVzdWx0IHtcbiAgY29uc3QgYWxsb3dlZDogT3JnU2V0dGluZ1BhdGNoID0ge307XG4gIGNvbnN0IHJlZnVzZWQ6IHN0cmluZ1tdID0gW107XG4gIGNvbnN0IGludmFsaWQ6IE9yZ1NldHRpbmdLZXlbXSA9IFtdO1xuXG4gIGlmIChjYW5kaWRhdGUgJiYgdHlwZW9mIGNhbmRpZGF0ZSA9PT0gJ29iamVjdCcgJiYgIUFycmF5LmlzQXJyYXkoY2FuZGlkYXRlKSkge1xuICAgIGZvciAoY29uc3QgW2tleSwgdmFsdWVdIG9mIE9iamVjdC5lbnRyaWVzKGNhbmRpZGF0ZSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPikpIHtcbiAgICAgIGNvbnN0IHNwZWMgPSBCWV9LRVkuZ2V0KGtleSk7XG4gICAgICBpZiAoIXNwZWMpIHsgcmVmdXNlZC5wdXNoKGtleSk7IGNvbnRpbnVlOyB9XG4gICAgICBpZiAoIWlzVmFsaWRPcmdTZXR0aW5nVmFsdWUoc3BlYywgdmFsdWUpKSB7IGludmFsaWQucHVzaChzcGVjLmtleSk7IGNvbnRpbnVlOyB9XG4gICAgICBhbGxvd2VkW3NwZWMua2V5XSA9IHZhbHVlO1xuICAgIH1cbiAgfVxuXG4gIHJldHVybiB7IGFsbG93ZWQsIHJlZnVzZWQsIGludmFsaWQsIHJlZnVzZWRDb3VudDogcmVmdXNlZC5sZW5ndGggfTtcbn1cblxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cbi8vIERpZmYgKyByZXF1ZXN0IHBsYW5uaW5nIChydWxlcyAzIGFuZCA3KVxuLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuLyoqIE9uZSByZXZpZXdlZCBjaGFuZ2U6IHdoYXQgdGhlIHNldHRpbmcgaXMgbm93LCBhbmQgd2hhdCBpdCB3b3VsZCBiZWNvbWUuICovXG5leHBvcnQgaW50ZXJmYWNlIE9yZ1NldHRpbmdDaGFuZ2Uge1xuICByZWFkb25seSBzcGVjOiBPcmdTZXR0aW5nU3BlYztcbiAgcmVhZG9ubHkgZnJvbTogT3JnU2V0dGluZ1ZhbHVlIHwgdW5kZWZpbmVkO1xuICByZWFkb25seSB0bzogT3JnU2V0dGluZ1ZhbHVlO1xufVxuXG4vKipcbiAqIFRoZSBjaGFuZ2VzIGEgcHJvcG9zYWwgYWN0dWFsbHkgbWFrZXMsIGdpdmVuIHRoZSBDVVJSRU5UIHZhbHVlcy4gQSBmaWVsZFxuICogd2hvc2UgcHJvcG9zZWQgdmFsdWUgYWxyZWFkeSBlcXVhbHMgdGhlIGN1cnJlbnQgb25lIGlzIGRyb3BwZWQg4oCUIGl0IGlzIG5vdCBhXG4gKiBjaGFuZ2UsIGFuZCByZW5kZXJpbmcgaXQgYXMgb25lIG1ha2VzIGEgZGlmZiB0aGUgdXNlciBjYW5ub3QgcmVhZC5cbiAqXG4gKiBUaGUgY29uZmlybSBoYW5kbGVyIHJlLXJ1bnMgdGhpcyBhZ2FpbnN0IGEgRlJFU0ggcmVhZCBpbW1lZGlhdGVseSBiZWZvcmVcbiAqIGNvbW1pdHRpbmcgKHJ1bGUgNyk6IHRoZXNlIHJlY29yZHMgY2Fycnkgbm8gdmVyc2lvbiBjb2x1bW4sIHNvIGlmIHRoZSBsaXN0XG4gKiB0aGF0IGNvbWVzIGJhY2sgZGlmZmVycyBmcm9tIHRoZSBvbmUgdGhlIHVzZXIgYXBwcm92ZWQsIHN0YXRlIG1vdmVkIHVuZGVyIHRoZVxuICogcHJvcG9zYWwgYW5kIHRoZSBjb21taXQgbXVzdCBiZSByZWZ1c2VkIHJhdGhlciB0aGFuIGFwcGxpZWQgYmxpbmQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkaWZmT3JnU2V0dGluZ3MoXG4gIGN1cnJlbnQ6IFJlYWRvbmx5PE9yZ1NldHRpbmdQYXRjaD4sXG4gIHByb3Bvc2VkOiBSZWFkb25seTxPcmdTZXR0aW5nUGF0Y2g+LFxuKTogcmVhZG9ubHkgT3JnU2V0dGluZ0NoYW5nZVtdIHtcbiAgY29uc3QgY2hhbmdlczogT3JnU2V0dGluZ0NoYW5nZVtdID0gW107XG4gIGZvciAoY29uc3Qgc3BlYyBvZiBPUkdfU0VUVElOR19QUk9QT1NBTF9BTExPV0xJU1QpIHtcbiAgICBjb25zdCB0byA9IHByb3Bvc2VkW3NwZWMua2V5XTtcbiAgICBpZiAodG8gPT09IHVuZGVmaW5lZCkgY29udGludWU7XG4gICAgY29uc3QgZnJvbSA9IGN1cnJlbnRbc3BlYy5rZXldO1xuICAgIGlmIChmcm9tID09PSB0bykgY29udGludWU7XG4gICAgY2hhbmdlcy5wdXNoKHsgc3BlYywgZnJvbSwgdG8gfSk7XG4gIH1cbiAgcmV0dXJuIGNoYW5nZXM7XG59XG5cbi8qKiBPbmUgQVBJIGNhbGwgdGhlIGNvbmZpcm0gaGFuZGxlciBtYWtlczogb25lIHN1cmZhY2UsIG9uZSBib2R5LiAqL1xuZXhwb3J0IGludGVyZmFjZSBPcmdTZXR0aW5nUmVxdWVzdCB7XG4gIHJlYWRvbmx5IHN1cmZhY2U6IE9yZ1NldHRpbmdTdXJmYWNlO1xuICByZWFkb25seSBtZXRob2Q6ICdQVVQnO1xuICByZWFkb25seSBwYXRoOiBzdHJpbmc7XG4gIHJlYWRvbmx5IHBlcm1pc3Npb246IFBlcm1pc3Npb247XG4gIC8qKiBSZXF1ZXN0IGJvZHk6IHRoZSBBUEkncyBvd24gZmllbGQgbmFtZXMsIGNhcnJ5aW5nIG9ubHkgcmV2aWV3ZWQgdmFsdWVzLiAqL1xuICByZWFkb25seSBib2R5OiBSZWNvcmQ8c3RyaW5nLCBPcmdTZXR0aW5nVmFsdWU+O1xufVxuXG4vKipcbiAqIEdyb3VwIGFwcHJvdmVkIGNoYW5nZXMgaW50byBvbmUgcmVxdWVzdCBwZXIgc3VyZmFjZSwgdHJhbnNsYXRpbmcgcHJvcG9zYWxcbiAqIGtleXMgYmFjayB0byB0aGUgZmllbGQgbmFtZXMgZWFjaCBBUEkgZXhwZWN0cy4gT3JkZXIgZm9sbG93cyB0aGUgYWxsb3dsaXN0LFxuICogc28gdGhlIHNhbWUgcHJvcG9zYWwgYWx3YXlzIHByb2R1Y2VzIHRoZSBzYW1lIGNhbGwgc2VxdWVuY2UuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBvcmdTZXR0aW5nUmVxdWVzdHMoY2hhbmdlczogcmVhZG9ubHkgT3JnU2V0dGluZ0NoYW5nZVtdKTogcmVhZG9ubHkgT3JnU2V0dGluZ1JlcXVlc3RbXSB7XG4gIGNvbnN0IGJ5U3VyZmFjZSA9IG5ldyBNYXA8T3JnU2V0dGluZ1N1cmZhY2UsIE9yZ1NldHRpbmdSZXF1ZXN0PigpO1xuICBmb3IgKGNvbnN0IHNwZWMgb2YgT1JHX1NFVFRJTkdfUFJPUE9TQUxfQUxMT1dMSVNUKSB7XG4gICAgY29uc3QgY2hhbmdlID0gY2hhbmdlcy5maW5kKChjKSA9PiBjLnNwZWMua2V5ID09PSBzcGVjLmtleSk7XG4gICAgaWYgKCFjaGFuZ2UpIGNvbnRpbnVlO1xuICAgIGNvbnN0IGV4aXN0aW5nID0gYnlTdXJmYWNlLmdldChzcGVjLnN1cmZhY2UpO1xuICAgIGlmIChleGlzdGluZykge1xuICAgICAgZXhpc3RpbmcuYm9keVtzcGVjLmZpZWxkXSA9IGNoYW5nZS50bztcbiAgICAgIGNvbnRpbnVlO1xuICAgIH1cbiAgICBieVN1cmZhY2Uuc2V0KHNwZWMuc3VyZmFjZSwge1xuICAgICAgc3VyZmFjZTogc3BlYy5zdXJmYWNlLFxuICAgICAgbWV0aG9kOiBzcGVjLmFwaS5tZXRob2QsXG4gICAgICBwYXRoOiBzcGVjLmFwaS5wYXRoLFxuICAgICAgcGVybWlzc2lvbjogc3BlYy5wZXJtaXNzaW9uLFxuICAgICAgYm9keTogeyBbc3BlYy5maWVsZF06IGNoYW5nZS50byB9LFxuICAgIH0pO1xuICB9XG4gIHJldHVybiBbLi4uYnlTdXJmYWNlLnZhbHVlcygpXTtcbn1cbiJdfQ==

package/lib/types/compliance-exemption.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The `POST /compliance/exemptions` request body.
+ *
+ * It lives here because it crosses a SERVICE boundary: the Ask agent drafts one
+ * (`api/ask` — a proposal the user reviews and commits through their own
+ * session) and the compliance service inserts it (`api/compliance`). Each side
+ * had its own six-field declaration, so a field added on one side was invisible
+ * to the other until a request failed validation at runtime.
+ */
+/** A request to waive one compliance rule for one entity. */
+export interface ComplianceExemptionRequest {
+    /** The rule being waived. */
+    ruleId: string;
+    /** Which kind of entity the waiver covers. */
+    entityType: 'plugin' | 'pipeline';
+    /** The entity the waiver applies to. */
+    entityId: string;
+    /** Display label for the entity, for the review queue and the audit trail. */
+    entityName?: string;
+    /** Why the waiver is being asked for; shown to the approver. */
+    reason: string;
+    /** ISO-8601 expiry. Omitted means the waiver does not self-expire. */
+    expiresAt?: string;
+}

package/lib/types/compliance-exemption.js

@@ -0,0 +1,4 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGxpYW5jZS1leGVtcHRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvY29tcGxpYW5jZS1leGVtcHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIFRoZSBgUE9TVCAvY29tcGxpYW5jZS9leGVtcHRpb25zYCByZXF1ZXN0IGJvZHkuXG4gKlxuICogSXQgbGl2ZXMgaGVyZSBiZWNhdXNlIGl0IGNyb3NzZXMgYSBTRVJWSUNFIGJvdW5kYXJ5OiB0aGUgQXNrIGFnZW50IGRyYWZ0cyBvbmVcbiAqIChgYXBpL2Fza2Ag4oCUIGEgcHJvcG9zYWwgdGhlIHVzZXIgcmV2aWV3cyBhbmQgY29tbWl0cyB0aHJvdWdoIHRoZWlyIG93blxuICogc2Vzc2lvbikgYW5kIHRoZSBjb21wbGlhbmNlIHNlcnZpY2UgaW5zZXJ0cyBpdCAoYGFwaS9jb21wbGlhbmNlYCkuIEVhY2ggc2lkZVxuICogaGFkIGl0cyBvd24gc2l4LWZpZWxkIGRlY2xhcmF0aW9uLCBzbyBhIGZpZWxkIGFkZGVkIG9uIG9uZSBzaWRlIHdhcyBpbnZpc2libGVcbiAqIHRvIHRoZSBvdGhlciB1bnRpbCBhIHJlcXVlc3QgZmFpbGVkIHZhbGlkYXRpb24gYXQgcnVudGltZS5cbiAqL1xuXG4vKiogQSByZXF1ZXN0IHRvIHdhaXZlIG9uZSBjb21wbGlhbmNlIHJ1bGUgZm9yIG9uZSBlbnRpdHkuICovXG5leHBvcnQgaW50ZXJmYWNlIENvbXBsaWFuY2VFeGVtcHRpb25SZXF1ZXN0IHtcbiAgLyoqIFRoZSBydWxlIGJlaW5nIHdhaXZlZC4gKi9cbiAgcnVsZUlkOiBzdHJpbmc7XG4gIC8qKiBXaGljaCBraW5kIG9mIGVudGl0eSB0aGUgd2FpdmVyIGNvdmVycy4gKi9cbiAgZW50aXR5VHlwZTogJ3BsdWdpbicgfCAncGlwZWxpbmUnO1xuICAvKiogVGhlIGVudGl0eSB0aGUgd2FpdmVyIGFwcGxpZXMgdG8uICovXG4gIGVudGl0eUlkOiBzdHJpbmc7XG4gIC8qKiBEaXNwbGF5IGxhYmVsIGZvciB0aGUgZW50aXR5LCBmb3IgdGhlIHJldmlldyBxdWV1ZSBhbmQgdGhlIGF1ZGl0IHRyYWlsLiAqL1xuICBlbnRpdHlOYW1lPzogc3RyaW5nO1xuICAvKiogV2h5IHRoZSB3YWl2ZXIgaXMgYmVpbmcgYXNrZWQgZm9yOyBzaG93biB0byB0aGUgYXBwcm92ZXIuICovXG4gIHJlYXNvbjogc3RyaW5nO1xuICAvKiogSVNPLTg2MDEgZXhwaXJ5LiBPbWl0dGVkIG1lYW5zIHRoZSB3YWl2ZXIgZG9lcyBub3Qgc2VsZi1leHBpcmUuICovXG4gIGV4cGlyZXNBdD86IHN0cmluZztcbn1cbiJdfQ==

package/lib/types/index.d.ts

@@ -5,6 +5,7 @@ export { type Lifecycle, type Criticality, type OwnerType, type EntityLink, type
 export { type TemplateInput, } from './pipeline-template.js';
 export * from './visibility.js';
 export * from './wire-vocabulary.js';
+export { type ComplianceExemptionRequest } from './compliance-exemption.js';
 export { PLUGIN_SUMMARY_MAX, PLUGIN_README_MAX_BYTES, PLUGIN_CHANGELOG_MAX_BYTES, PLUGIN_CATEGORIES, type PluginCatalogCategory, PLUGIN_CATALOG_FIELDS, type PluginCatalogField, PLUGIN_CATALOG_LINK_FIELDS, METADATA_SOURCES, type MetadataSource, type MetadataSources, } from './plugin-catalog.js';
 export { type HttpRequest, } from './http.js';
 export { tierAllowsTeams, isBillingEnabled, isValidTier, getTierLimits, type QuotaTier, type QuotaTierLimits, QUOTA_TIERS, VALID_TIERS, STANDARD_TIERS, TEAM_CAPABLE_TIERS, DEFAULT_TIER, QUOTA_RESET_DAYS, nextQuotaResetDate, } from './quota-tiers.js';
@@ -12,7 +13,9 @@ export * from './feature-flags.js';
 export { permissionLabel, isValidPermission, isSystemOrgOnlyPermission, isOrgAssignablePermission, normalizePermissionSubset, intersectPermissions, resolveUserPermissions, confinePermissionsToOrg, hasPermission, type Permission, ALL_PERMISSIONS, PERMISSION_GATES, PERMISSION_CATALOG, SUPERADMIN_ONLY_PERMISSIONS, SYSTEM_ORG_ONLY_PERMISSIONS, ORG_ASSIGNABLE_PERMISSIONS, ORG_ASSIGNABLE_CATEGORIES, READ_ONLY_PERMISSIONS, ROLE_PERMISSIONS, ECOSYSTEM_MANAGER_PERMISSIONS, } from './permissions.js';
 export { METADATA_KEY_CATALOG, MetadataKeys, type MetadataKey, type MetadataKeyOption, METADATA_KEY_GROUPS, } from './metadata-keys.js';
 export { type AuditEvent, } from './audit-events.js';
+export { REMOTE_AUDIT_ACTIONS, isRemoteAuditAction, type RemoteAuditAction, } from './remote-audit-actions.js';
+export { ASK_AGENT_PROPOSER, ASK_PROPOSED_BY_HEADER, PROPOSED_BY_DETAIL_KEY, askProposalAuditDetails, readProposerClaim, withProposalProvenance, ORG_SETTING_PROPOSAL_ALLOWLIST, ORG_SETTING_PROPOSAL_EXCLUSIONS, ORG_SETTING_PROPOSAL_KEYS, isProposableOrgSetting, isValidOrgSettingValue, orgSettingSpec, pickAllowed, diffOrgSettings, orgSettingRequests, type AskProposalProvenance, type ProposerClaim, type OrgSettingChange, type OrgSettingKey, type OrgSettingPatch, type OrgSettingRequest, type OrgSettingShape, type OrgSettingSpec, type OrgSettingSurface, type OrgSettingValue, type PickAllowedResult, } from './ask-proposals.js';
 export { isEcosystemNotificationEvent, parseEcosystemNotifyRequest, nextEcosystemDigestTime, renderEcosystemManagerChange, renderEcosystemDigest, type EcosystemNotificationEventId, type EcosystemNotificationChannel, ECOSYSTEM_EMAIL_PREFERENCE_FIELDS, type EcosystemEmailPreferenceField, ECOSYSTEM_EMAIL_PREFERENCE_FIELD_NAMES, ECOSYSTEM_NOTIFICATION_EVENTS, type EcosystemRecipientSpec, type EcosystemNotifyRequest, } from './ecosystem-notifications.js';
 export { publisherTermsVersion, publisherHandleProblem, isOfficialAutoApprovalEnabled, isPluginPublishingEnabled, isAnonymousSubmissionsEnabled, isPluginReviewsEnabled, OFFICIAL_CATALOG_LOADER_ACCOUNT, DEFAULT_PUBLISHER_TERMS_VERSION, BUILTIN_RESERVED_HANDLES, TENANT_REQUEST_KINDS, PUBLISH_PERMISSION_REQUEST_KINDS, VERIFY_REQUEST_KINDS, STEP_UP_REQUEST_KINDS, REQUEST_SLA_HOURS, } from './ecosystem.js';
-export { ageScore, vulnScore, computeHealthScore, publisherHealthScore, publisherSuccessRate, healthBand, HEALTH_COMPONENTS, HEALTH_WEIGHTS, type HealthBreakdown, type HealthResult, type HealthInputs, type HealthBand, } from './plugin-health.js';
-export { asScanFlag, blockOnNewCritical, describeFindings, describeFix, exceedsVulnFloor, pluginVulnMaxCritical, SCAN_FLAG_TOP_FINDINGS, VULN_FLAGGED_WARNING, vulnBlockedMessage, vulnFlaggedMessage, vulnFlaggedWarning, type PluginScanFinding, type PluginScanFlag, type VulnFlaggedWarning, } from './plugin-scan.js';
+export { ageScore, vulnScore, computeHealthScore, publisherHealthScore, publisherSuccessRate, healthBand, HEALTH_COMPONENTS, HEALTH_WEIGHTS, type HealthBreakdown, type HealthComponentScore, type HealthResult, type HealthInputs, type HealthBand, } from './plugin-health.js';
+export { asScanFlag, blockOnNewCritical, describeFindings, describeFix, exceedsVulnFloor, pluginVulnMaxCritical, SCAN_FLAG_TOP_FINDINGS, vulnBlockedMessage, vulnFlaggedMessage, vulnFlaggedWarning, type PluginScanFinding, type PluginScanFlag, type VulnFlaggedWarning, } from './plugin-scan.js';

package/lib/types/index.js

@@ -7,6 +7,7 @@ export {} from './catalog-metadata.js';
 export {} from './pipeline-template.js';
 export * from './visibility.js';
 export * from './wire-vocabulary.js';
+export {} from './compliance-exemption.js';
 export { PLUGIN_SUMMARY_MAX, PLUGIN_README_MAX_BYTES, PLUGIN_CHANGELOG_MAX_BYTES, PLUGIN_CATEGORIES, PLUGIN_CATALOG_FIELDS, PLUGIN_CATALOG_LINK_FIELDS, METADATA_SOURCES, } from './plugin-catalog.js';
 export {} from './http.js';
 export { tierAllowsTeams, isBillingEnabled, isValidTier, getTierLimits, QUOTA_TIERS, VALID_TIERS, STANDARD_TIERS, TEAM_CAPABLE_TIERS, DEFAULT_TIER, QUOTA_RESET_DAYS, nextQuotaResetDate, } from './quota-tiers.js';
@@ -14,8 +15,10 @@ export * from './feature-flags.js';
 export { permissionLabel, isValidPermission, isSystemOrgOnlyPermission, isOrgAssignablePermission, normalizePermissionSubset, intersectPermissions, resolveUserPermissions, confinePermissionsToOrg, hasPermission, ALL_PERMISSIONS, PERMISSION_GATES, PERMISSION_CATALOG, SUPERADMIN_ONLY_PERMISSIONS, SYSTEM_ORG_ONLY_PERMISSIONS, ORG_ASSIGNABLE_PERMISSIONS, ORG_ASSIGNABLE_CATEGORIES, READ_ONLY_PERMISSIONS, ROLE_PERMISSIONS, ECOSYSTEM_MANAGER_PERMISSIONS, } from './permissions.js';
 export { METADATA_KEY_CATALOG, MetadataKeys, METADATA_KEY_GROUPS, } from './metadata-keys.js';
 export {} from './audit-events.js';
+export { REMOTE_AUDIT_ACTIONS, isRemoteAuditAction, } from './remote-audit-actions.js';
+export { ASK_AGENT_PROPOSER, ASK_PROPOSED_BY_HEADER, PROPOSED_BY_DETAIL_KEY, askProposalAuditDetails, readProposerClaim, withProposalProvenance, ORG_SETTING_PROPOSAL_ALLOWLIST, ORG_SETTING_PROPOSAL_EXCLUSIONS, ORG_SETTING_PROPOSAL_KEYS, isProposableOrgSetting, isValidOrgSettingValue, orgSettingSpec, pickAllowed, diffOrgSettings, orgSettingRequests, } from './ask-proposals.js';
 export { isEcosystemNotificationEvent, parseEcosystemNotifyRequest, nextEcosystemDigestTime, renderEcosystemManagerChange, renderEcosystemDigest, ECOSYSTEM_EMAIL_PREFERENCE_FIELDS, ECOSYSTEM_EMAIL_PREFERENCE_FIELD_NAMES, ECOSYSTEM_NOTIFICATION_EVENTS, } from './ecosystem-notifications.js';
 export { publisherTermsVersion, publisherHandleProblem, isOfficialAutoApprovalEnabled, isPluginPublishingEnabled, isAnonymousSubmissionsEnabled, isPluginReviewsEnabled, OFFICIAL_CATALOG_LOADER_ACCOUNT, DEFAULT_PUBLISHER_TERMS_VERSION, BUILTIN_RESERVED_HANDLES, TENANT_REQUEST_KINDS, PUBLISH_PERMISSION_REQUEST_KINDS, VERIFY_REQUEST_KINDS, STEP_UP_REQUEST_KINDS, REQUEST_SLA_HOURS, } from './ecosystem.js';
 export { ageScore, vulnScore, computeHealthScore, publisherHealthScore, publisherSuccessRate, healthBand, HEALTH_COMPONENTS, HEALTH_WEIGHTS, } from './plugin-health.js';
-export { asScanFlag, blockOnNewCritical, describeFindings, describeFix, exceedsVulnFloor, pluginVulnMaxCritical, SCAN_FLAG_TOP_FINDINGS, VULN_FLAGGED_WARNING, vulnBlockedMessage, vulnFlaggedMessage, vulnFlaggedWarning, } from './plugin-scan.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsU0FBUyxFQUFFLHFCQUFxQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDcEUsT0FBTyxFQUNMLGdCQUFnQixFQUVoQixZQUFZLEVBTVosaUJBQWlCLEdBTWxCLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLE9BQU8sRUFNTixNQUFNLHVCQUF1QixDQUFDO0FBQy9CLE9BQU8sRUFFTixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxPQUFPLEVBQ0wsa0JBQWtCLEVBQ2xCLHVCQUF1QixFQUN2QiwwQkFBMEIsRUFDMUIsaUJBQWlCLEVBRWpCLHFCQUFxQixFQUVyQiwwQkFBMEIsRUFDMUIsZ0JBQWdCLEdBR2pCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsT0FBTyxFQUVOLE1BQU0sV0FBVyxDQUFDO0FBQ25CLE9BQU8sRUFDTCxlQUFlLEVBQ2YsZ0JBQWdCLEVBQ2hCLFdBQVcsRUFDWCxhQUFhLEVBR2IsV0FBVyxFQUNYLFdBQVcsRUFDWCxjQUFjLEVBQ2Qsa0JBQWtCLEVBQ2xCLFlBQVksRUFDWixnQkFBZ0IsRUFDaEIsa0JBQWtCLEdBQ25CLE1BQU0sa0JBQWtCLENBQUM7QUFDMUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxPQUFPLEVBQ0wsZUFBZSxFQUNmLGlCQUFpQixFQUNqQix5QkFBeUIsRUFDekIseUJBQXlCLEVBQ3pCLHlCQUF5QixFQUN6QixvQkFBb0IsRUFDcEIsc0JBQXNCLEVBQ3RCLHVCQUF1QixFQUN2QixhQUFhLEVBRWIsZUFBZSxFQUNmLGdCQUFnQixFQUNoQixrQkFBa0IsRUFDbEIsMkJBQTJCLEVBQzNCLDJCQUEyQixFQUMzQiwwQkFBMEIsRUFDMUIseUJBQXlCLEVBQ3pCLHFCQUFxQixFQUNyQixnQkFBZ0IsRUFDaEIsNkJBQTZCLEdBQzlCLE1BQU0sa0JBQWtCLENBQUM7QUFDMUIsT0FBTyxFQUNMLG9CQUFvQixFQUNwQixZQUFZLEVBR1osbUJBQW1CLEdBQ3BCLE1BQU0sb0JBQW9CLENBQUM7QUFDNUIsT0FBTyxFQUVOLE1BQU0sbUJBQW1CLENBQUM7QUFDM0IsT0FBTyxFQUNMLDRCQUE0QixFQUM1QiwyQkFBMkIsRUFDM0IsdUJBQXVCLEVBQ3ZCLDRCQUE0QixFQUM1QixxQkFBcUIsRUFHckIsaUNBQWlDLEVBRWpDLHNDQUFzQyxFQUN0Qyw2QkFBNkIsR0FHOUIsTUFBTSw4QkFBOEIsQ0FBQztBQUN0QyxPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLHNCQUFzQixFQUN0Qiw2QkFBNkIsRUFDN0IseUJBQXlCLEVBQ3pCLDZCQUE2QixFQUM3QixzQkFBc0IsRUFDdEIsK0JBQStCLEVBQy9CLCtCQUErQixFQUMvQix3QkFBd0IsRUFDeEIsb0JBQW9CLEVBQ3BCLGdDQUFnQyxFQUNoQyxvQkFBb0IsRUFDcEIscUJBQXFCLEVBQ3JCLGlCQUFpQixHQUNsQixNQUFNLGdCQUFnQixDQUFDO0FBQ3hCLE9BQU8sRUFDTCxRQUFRLEVBQ1IsU0FBUyxFQUNULGtCQUFrQixFQUNsQixvQkFBb0IsRUFDcEIsb0JBQW9CLEVBQ3BCLFVBQVUsRUFDVixpQkFBaUIsRUFDakIsY0FBYyxHQUtmLE1BQU0sb0JBQW9CLENBQUM7QUFDNUIsT0FBTyxFQUNMLFVBQVUsRUFDVixrQkFBa0IsRUFDbEIsZ0JBQWdCLEVBQ2hCLFdBQVcsRUFDWCxnQkFBZ0IsRUFDaEIscUJBQXFCLEVBQ3JCLHNCQUFzQixFQUN0QixvQkFBb0IsRUFDcEIsa0JBQWtCLEVBQ2xCLGtCQUFrQixFQUNsQixrQkFBa0IsR0FJbkIsTUFBTSxrQkFBa0IsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5leHBvcnQgeyBFcnJvckNvZGUsIGdldFN0YXR1c0ZvckVycm9yQ29kZSB9IGZyb20gJy4vZXJyb3ItY29kZXMuanMnO1xuZXhwb3J0IHtcbiAgaXNWYWxpZFF1b3RhVHlwZSxcbiAgdHlwZSBUb2tlblNjb3BlLFxuICBUT0tFTl9TQ09QRVMsXG4gIHR5cGUgUHJpbmNpcGFsVHlwZSxcbiAgdHlwZSBUb2tlblVzZSxcbiAgdHlwZSBBdXRoTWV0aG9kLFxuICB0eXBlIEFzc3VyYW5jZUxldmVsLFxuICB0eXBlIFF1b3RhVHlwZSxcbiAgVkFMSURfUVVPVEFfVFlQRVMsXG4gIHR5cGUgUXVvdGFDaGVja1Jlc3VsdCxcbiAgdHlwZSBRdW90YUluZm8sXG4gIHR5cGUgQXBpUmVzcG9uc2UsXG4gIHR5cGUgSnd0UGF5bG9hZCxcbiAgdHlwZSBIZWFsdGhDaGVja1Jlc3BvbnNlLFxufSBmcm9tICcuL2NvbW1vbi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3BpcGVsaW5lLmpzJztcbmV4cG9ydCB7XG4gIHR5cGUgTGlmZWN5Y2xlLFxuICB0eXBlIENyaXRpY2FsaXR5LFxuICB0eXBlIE93bmVyVHlwZSxcbiAgdHlwZSBFbnRpdHlMaW5rLFxuICB0eXBlIEVudGl0eUxhYmVscyxcbn0gZnJvbSAnLi9jYXRhbG9nLW1ldGFkYXRhLmpzJztcbmV4cG9ydCB7XG4gIHR5cGUgVGVtcGxhdGVJbnB1dCxcbn0gZnJvbSAnLi9waXBlbGluZS10ZW1wbGF0ZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3Zpc2liaWxpdHkuanMnO1xuZXhwb3J0ICogZnJvbSAnLi93aXJlLXZvY2FidWxhcnkuanMnO1xuZXhwb3J0IHtcbiAgUExVR0lOX1NVTU1BUllfTUFYLFxuICBQTFVHSU5fUkVBRE1FX01BWF9CWVRFUyxcbiAgUExVR0lOX0NIQU5HRUxPR19NQVhfQllURVMsXG4gIFBMVUdJTl9DQVRFR09SSUVTLFxuICB0eXBlIFBsdWdpbkNhdGFsb2dDYXRlZ29yeSxcbiAgUExVR0lOX0NBVEFMT0dfRklFTERTLFxuICB0eXBlIFBsdWdpbkNhdGFsb2dGaWVsZCxcbiAgUExVR0lOX0NBVEFMT0dfTElOS19GSUVMRFMsXG4gIE1FVEFEQVRBX1NPVVJDRVMsXG4gIHR5cGUgTWV0YWRhdGFTb3VyY2UsXG4gIHR5cGUgTWV0YWRhdGFTb3VyY2VzLFxufSBmcm9tICcuL3BsdWdpbi1jYXRhbG9nLmpzJztcbmV4cG9ydCB7XG4gIHR5cGUgSHR0cFJlcXVlc3QsXG59IGZyb20gJy4vaHR0cC5qcyc7XG5leHBvcnQge1xuICB0aWVyQWxsb3dzVGVhbXMsXG4gIGlzQmlsbGluZ0VuYWJsZWQsXG4gIGlzVmFsaWRUaWVyLFxuICBnZXRUaWVyTGltaXRzLFxuICB0eXBlIFF1b3RhVGllcixcbiAgdHlwZSBRdW90YVRpZXJMaW1pdHMsXG4gIFFVT1RBX1RJRVJTLFxuICBWQUxJRF9USUVSUyxcbiAgU1RBTkRBUkRfVElFUlMsXG4gIFRFQU1fQ0FQQUJMRV9USUVSUyxcbiAgREVGQVVMVF9USUVSLFxuICBRVU9UQV9SRVNFVF9EQVlTLFxuICBuZXh0UXVvdGFSZXNldERhdGUsXG59IGZyb20gJy4vcXVvdGEtdGllcnMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9mZWF0dXJlLWZsYWdzLmpzJztcbmV4cG9ydCB7XG4gIHBlcm1pc3Npb25MYWJlbCxcbiAgaXNWYWxpZFBlcm1pc3Npb24sXG4gIGlzU3lzdGVtT3JnT25seVBlcm1pc3Npb24sXG4gIGlzT3JnQXNzaWduYWJsZVBlcm1pc3Npb24sXG4gIG5vcm1hbGl6ZVBlcm1pc3Npb25TdWJzZXQsXG4gIGludGVyc2VjdFBlcm1pc3Npb25zLFxuICByZXNvbHZlVXNlclBlcm1pc3Npb25zLFxuICBjb25maW5lUGVybWlzc2lvbnNUb09yZyxcbiAgaGFzUGVybWlzc2lvbixcbiAgdHlwZSBQZXJtaXNzaW9uLFxuICBBTExfUEVSTUlTU0lPTlMsXG4gIFBFUk1JU1NJT05fR0FURVMsXG4gIFBFUk1JU1NJT05fQ0FUQUxPRyxcbiAgU1VQRVJBRE1JTl9PTkxZX1BFUk1JU1NJT05TLFxuICBTWVNURU1fT1JHX09OTFlfUEVSTUlTU0lPTlMsXG4gIE9SR19BU1NJR05BQkxFX1BFUk1JU1NJT05TLFxuICBPUkdfQVNTSUdOQUJMRV9DQVRFR09SSUVTLFxuICBSRUFEX09OTFlfUEVSTUlTU0lPTlMsXG4gIFJPTEVfUEVSTUlTU0lPTlMsXG4gIEVDT1NZU1RFTV9NQU5BR0VSX1BFUk1JU1NJT05TLFxufSBmcm9tICcuL3Blcm1pc3Npb25zLmpzJztcbmV4cG9ydCB7XG4gIE1FVEFEQVRBX0tFWV9DQVRBTE9HLFxuICBNZXRhZGF0YUtleXMsXG4gIHR5cGUgTWV0YWRhdGFLZXksXG4gIHR5cGUgTWV0YWRhdGFLZXlPcHRpb24sXG4gIE1FVEFEQVRBX0tFWV9HUk9VUFMsXG59IGZyb20gJy4vbWV0YWRhdGEta2V5cy5qcyc7XG5leHBvcnQge1xuICB0eXBlIEF1ZGl0RXZlbnQsXG59IGZyb20gJy4vYXVkaXQtZXZlbnRzLmpzJztcbmV4cG9ydCB7XG4gIGlzRWNvc3lzdGVtTm90aWZpY2F0aW9uRXZlbnQsXG4gIHBhcnNlRWNvc3lzdGVtTm90aWZ5UmVxdWVzdCxcbiAgbmV4dEVjb3N5c3RlbURpZ2VzdFRpbWUsXG4gIHJlbmRlckVjb3N5c3RlbU1hbmFnZXJDaGFuZ2UsXG4gIHJlbmRlckVjb3N5c3RlbURpZ2VzdCxcbiAgdHlwZSBFY29zeXN0ZW1Ob3RpZmljYXRpb25FdmVudElkLFxuICB0eXBlIEVjb3N5c3RlbU5vdGlmaWNhdGlvbkNoYW5uZWwsXG4gIEVDT1NZU1RFTV9FTUFJTF9QUkVGRVJFTkNFX0ZJRUxEUyxcbiAgdHlwZSBFY29zeXN0ZW1FbWFpbFByZWZlcmVuY2VGaWVsZCxcbiAgRUNPU1lTVEVNX0VNQUlMX1BSRUZFUkVOQ0VfRklFTERfTkFNRVMsXG4gIEVDT1NZU1RFTV9OT1RJRklDQVRJT05fRVZFTlRTLFxuICB0eXBlIEVjb3N5c3RlbVJlY2lwaWVudFNwZWMsXG4gIHR5cGUgRWNvc3lzdGVtTm90aWZ5UmVxdWVzdCxcbn0gZnJvbSAnLi9lY29zeXN0ZW0tbm90aWZpY2F0aW9ucy5qcyc7XG5leHBvcnQge1xuICBwdWJsaXNoZXJUZXJtc1ZlcnNpb24sXG4gIHB1Ymxpc2hlckhhbmRsZVByb2JsZW0sXG4gIGlzT2ZmaWNpYWxBdXRvQXBwcm92YWxFbmFibGVkLFxuICBpc1BsdWdpblB1Ymxpc2hpbmdFbmFibGVkLFxuICBpc0Fub255bW91c1N1Ym1pc3Npb25zRW5hYmxlZCxcbiAgaXNQbHVnaW5SZXZpZXdzRW5hYmxlZCxcbiAgT0ZGSUNJQUxfQ0FUQUxPR19MT0FERVJfQUNDT1VOVCxcbiAgREVGQVVMVF9QVUJMSVNIRVJfVEVSTVNfVkVSU0lPTixcbiAgQlVJTFRJTl9SRVNFUlZFRF9IQU5ETEVTLFxuICBURU5BTlRfUkVRVUVTVF9LSU5EUyxcbiAgUFVCTElTSF9QRVJNSVNTSU9OX1JFUVVFU1RfS0lORFMsXG4gIFZFUklGWV9SRVFVRVNUX0tJTkRTLFxuICBTVEVQX1VQX1JFUVVFU1RfS0lORFMsXG4gIFJFUVVFU1RfU0xBX0hPVVJTLFxufSBmcm9tICcuL2Vjb3N5c3RlbS5qcyc7XG5leHBvcnQge1xuICBhZ2VTY29yZSxcbiAgdnVsblNjb3JlLFxuICBjb21wdXRlSGVhbHRoU2NvcmUsXG4gIHB1Ymxpc2hlckhlYWx0aFNjb3JlLFxuICBwdWJsaXNoZXJTdWNjZXNzUmF0ZSxcbiAgaGVhbHRoQmFuZCxcbiAgSEVBTFRIX0NPTVBPTkVOVFMsXG4gIEhFQUxUSF9XRUlHSFRTLFxuICB0eXBlIEhlYWx0aEJyZWFrZG93bixcbiAgdHlwZSBIZWFsdGhSZXN1bHQsXG4gIHR5cGUgSGVhbHRoSW5wdXRzLFxuICB0eXBlIEhlYWx0aEJhbmQsXG59IGZyb20gJy4vcGx1Z2luLWhlYWx0aC5qcyc7XG5leHBvcnQge1xuICBhc1NjYW5GbGFnLFxuICBibG9ja09uTmV3Q3JpdGljYWwsXG4gIGRlc2NyaWJlRmluZGluZ3MsXG4gIGRlc2NyaWJlRml4LFxuICBleGNlZWRzVnVsbkZsb29yLFxuICBwbHVnaW5WdWxuTWF4Q3JpdGljYWwsXG4gIFNDQU5fRkxBR19UT1BfRklORElOR1MsXG4gIFZVTE5fRkxBR0dFRF9XQVJOSU5HLFxuICB2dWxuQmxvY2tlZE1lc3NhZ2UsXG4gIHZ1bG5GbGFnZ2VkTWVzc2FnZSxcbiAgdnVsbkZsYWdnZWRXYXJuaW5nLFxuICB0eXBlIFBsdWdpblNjYW5GaW5kaW5nLFxuICB0eXBlIFBsdWdpblNjYW5GbGFnLFxuICB0eXBlIFZ1bG5GbGFnZ2VkV2FybmluZyxcbn0gZnJvbSAnLi9wbHVnaW4tc2Nhbi5qcyc7XG4iXX0=
+export { asScanFlag, blockOnNewCritical, describeFindings, describeFix, exceedsVulnFloor, pluginVulnMaxCritical, SCAN_FLAG_TOP_FINDINGS, vulnBlockedMessage, vulnFlaggedMessage, vulnFlaggedWarning, } from './plugin-scan.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsU0FBUyxFQUFFLHFCQUFxQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDcEUsT0FBTyxFQUNMLGdCQUFnQixFQUVoQixZQUFZLEVBTVosaUJBQWlCLEdBTWxCLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLE9BQU8sRUFNTixNQUFNLHVCQUF1QixDQUFDO0FBQy9CLE9BQU8sRUFFTixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxPQUFPLEVBQW1DLE1BQU0sMkJBQTJCLENBQUM7QUFDNUUsT0FBTyxFQUNMLGtCQUFrQixFQUNsQix1QkFBdUIsRUFDdkIsMEJBQTBCLEVBQzFCLGlCQUFpQixFQUVqQixxQkFBcUIsRUFFckIsMEJBQTBCLEVBQzFCLGdCQUFnQixHQUdqQixNQUFNLHFCQUFxQixDQUFDO0FBQzdCLE9BQU8sRUFFTixNQUFNLFdBQVcsQ0FBQztBQUNuQixPQUFPLEVBQ0wsZUFBZSxFQUNmLGdCQUFnQixFQUNoQixXQUFXLEVBQ1gsYUFBYSxFQUdiLFdBQVcsRUFDWCxXQUFXLEVBQ1gsY0FBYyxFQUNkLGtCQUFrQixFQUNsQixZQUFZLEVBQ1osZ0JBQWdCLEVBQ2hCLGtCQUFrQixHQUNuQixNQUFNLGtCQUFrQixDQUFDO0FBQzFCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsT0FBTyxFQUNMLGVBQWUsRUFDZixpQkFBaUIsRUFDakIseUJBQXlCLEVBQ3pCLHlCQUF5QixFQUN6Qix5QkFBeUIsRUFDekIsb0JBQW9CLEVBQ3BCLHNCQUFzQixFQUN0Qix1QkFBdUIsRUFDdkIsYUFBYSxFQUViLGVBQWUsRUFDZixnQkFBZ0IsRUFDaEIsa0JBQWtCLEVBQ2xCLDJCQUEyQixFQUMzQiwyQkFBMkIsRUFDM0IsMEJBQTBCLEVBQzFCLHlCQUF5QixFQUN6QixxQkFBcUIsRUFDckIsZ0JBQWdCLEVBQ2hCLDZCQUE2QixHQUM5QixNQUFNLGtCQUFrQixDQUFDO0FBQzFCLE9BQU8sRUFDTCxvQkFBb0IsRUFDcEIsWUFBWSxFQUdaLG1CQUFtQixHQUNwQixNQUFNLG9CQUFvQixDQUFDO0FBQzVCLE9BQU8sRUFFTixNQUFNLG1CQUFtQixDQUFDO0FBQzNCLE9BQU8sRUFDTCxvQkFBb0IsRUFDcEIsbUJBQW1CLEdBRXBCLE1BQU0sMkJBQTJCLENBQUM7QUFDbkMsT0FBTyxFQUNMLGtCQUFrQixFQUNsQixzQkFBc0IsRUFDdEIsc0JBQXNCLEVBQ3RCLHVCQUF1QixFQUN2QixpQkFBaUIsRUFDakIsc0JBQXNCLEVBQ3RCLDhCQUE4QixFQUM5QiwrQkFBK0IsRUFDL0IseUJBQXlCLEVBQ3pCLHNCQUFzQixFQUN0QixzQkFBc0IsRUFDdEIsY0FBYyxFQUNkLFdBQVcsRUFDWCxlQUFlLEVBQ2Ysa0JBQWtCLEdBWW5CLE1BQU0sb0JBQW9CLENBQUM7QUFDNUIsT0FBTyxFQUNMLDRCQUE0QixFQUM1QiwyQkFBMkIsRUFDM0IsdUJBQXVCLEVBQ3ZCLDRCQUE0QixFQUM1QixxQkFBcUIsRUFHckIsaUNBQWlDLEVBRWpDLHNDQUFzQyxFQUN0Qyw2QkFBNkIsR0FHOUIsTUFBTSw4QkFBOEIsQ0FBQztBQUN0QyxPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLHNCQUFzQixFQUN0Qiw2QkFBNkIsRUFDN0IseUJBQXlCLEVBQ3pCLDZCQUE2QixFQUM3QixzQkFBc0IsRUFDdEIsK0JBQStCLEVBQy9CLCtCQUErQixFQUMvQix3QkFBd0IsRUFDeEIsb0JBQW9CLEVBQ3BCLGdDQUFnQyxFQUNoQyxvQkFBb0IsRUFDcEIscUJBQXFCLEVBQ3JCLGlCQUFpQixHQUNsQixNQUFNLGdCQUFnQixDQUFDO0FBQ3hCLE9BQU8sRUFDTCxRQUFRLEVBQ1IsU0FBUyxFQUNULGtCQUFrQixFQUNsQixvQkFBb0IsRUFDcEIsb0JBQW9CLEVBQ3BCLFVBQVUsRUFDVixpQkFBaUIsRUFDakIsY0FBYyxHQU1mLE1BQU0sb0JBQW9CLENBQUM7QUFDNUIsT0FBTyxFQUNMLFVBQVUsRUFDVixrQkFBa0IsRUFDbEIsZ0JBQWdCLEVBQ2hCLFdBQVcsRUFDWCxnQkFBZ0IsRUFDaEIscUJBQXFCLEVBQ3JCLHNCQUFzQixFQUN0QixrQkFBa0IsRUFDbEIsa0JBQWtCLEVBQ2xCLGtCQUFrQixHQUluQixNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmV4cG9ydCB7IEVycm9yQ29kZSwgZ2V0U3RhdHVzRm9yRXJyb3JDb2RlIH0gZnJvbSAnLi9lcnJvci1jb2Rlcy5qcyc7XG5leHBvcnQge1xuICBpc1ZhbGlkUXVvdGFUeXBlLFxuICB0eXBlIFRva2VuU2NvcGUsXG4gIFRPS0VOX1NDT1BFUyxcbiAgdHlwZSBQcmluY2lwYWxUeXBlLFxuICB0eXBlIFRva2VuVXNlLFxuICB0eXBlIEF1dGhNZXRob2QsXG4gIHR5cGUgQXNzdXJhbmNlTGV2ZWwsXG4gIHR5cGUgUXVvdGFUeXBlLFxuICBWQUxJRF9RVU9UQV9UWVBFUyxcbiAgdHlwZSBRdW90YUNoZWNrUmVzdWx0LFxuICB0eXBlIFF1b3RhSW5mbyxcbiAgdHlwZSBBcGlSZXNwb25zZSxcbiAgdHlwZSBKd3RQYXlsb2FkLFxuICB0eXBlIEhlYWx0aENoZWNrUmVzcG9uc2UsXG59IGZyb20gJy4vY29tbW9uLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vcGlwZWxpbmUuanMnO1xuZXhwb3J0IHtcbiAgdHlwZSBMaWZlY3ljbGUsXG4gIHR5cGUgQ3JpdGljYWxpdHksXG4gIHR5cGUgT3duZXJUeXBlLFxuICB0eXBlIEVudGl0eUxpbmssXG4gIHR5cGUgRW50aXR5TGFiZWxzLFxufSBmcm9tICcuL2NhdGFsb2ctbWV0YWRhdGEuanMnO1xuZXhwb3J0IHtcbiAgdHlwZSBUZW1wbGF0ZUlucHV0LFxufSBmcm9tICcuL3BpcGVsaW5lLXRlbXBsYXRlLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vdmlzaWJpbGl0eS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3dpcmUtdm9jYWJ1bGFyeS5qcyc7XG5leHBvcnQgeyB0eXBlIENvbXBsaWFuY2VFeGVtcHRpb25SZXF1ZXN0IH0gZnJvbSAnLi9jb21wbGlhbmNlLWV4ZW1wdGlvbi5qcyc7XG5leHBvcnQge1xuICBQTFVHSU5fU1VNTUFSWV9NQVgsXG4gIFBMVUdJTl9SRUFETUVfTUFYX0JZVEVTLFxuICBQTFVHSU5fQ0hBTkdFTE9HX01BWF9CWVRFUyxcbiAgUExVR0lOX0NBVEVHT1JJRVMsXG4gIHR5cGUgUGx1Z2luQ2F0YWxvZ0NhdGVnb3J5LFxuICBQTFVHSU5fQ0FUQUxPR19GSUVMRFMsXG4gIHR5cGUgUGx1Z2luQ2F0YWxvZ0ZpZWxkLFxuICBQTFVHSU5fQ0FUQUxPR19MSU5LX0ZJRUxEUyxcbiAgTUVUQURBVEFfU09VUkNFUyxcbiAgdHlwZSBNZXRhZGF0YVNvdXJjZSxcbiAgdHlwZSBNZXRhZGF0YVNvdXJjZXMsXG59IGZyb20gJy4vcGx1Z2luLWNhdGFsb2cuanMnO1xuZXhwb3J0IHtcbiAgdHlwZSBIdHRwUmVxdWVzdCxcbn0gZnJvbSAnLi9odHRwLmpzJztcbmV4cG9ydCB7XG4gIHRpZXJBbGxvd3NUZWFtcyxcbiAgaXNCaWxsaW5nRW5hYmxlZCxcbiAgaXNWYWxpZFRpZXIsXG4gIGdldFRpZXJMaW1pdHMsXG4gIHR5cGUgUXVvdGFUaWVyLFxuICB0eXBlIFF1b3RhVGllckxpbWl0cyxcbiAgUVVPVEFfVElFUlMsXG4gIFZBTElEX1RJRVJTLFxuICBTVEFOREFSRF9USUVSUyxcbiAgVEVBTV9DQVBBQkxFX1RJRVJTLFxuICBERUZBVUxUX1RJRVIsXG4gIFFVT1RBX1JFU0VUX0RBWVMsXG4gIG5leHRRdW90YVJlc2V0RGF0ZSxcbn0gZnJvbSAnLi9xdW90YS10aWVycy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2ZlYXR1cmUtZmxhZ3MuanMnO1xuZXhwb3J0IHtcbiAgcGVybWlzc2lvbkxhYmVsLFxuICBpc1ZhbGlkUGVybWlzc2lvbixcbiAgaXNTeXN0ZW1PcmdPbmx5UGVybWlzc2lvbixcbiAgaXNPcmdBc3NpZ25hYmxlUGVybWlzc2lvbixcbiAgbm9ybWFsaXplUGVybWlzc2lvblN1YnNldCxcbiAgaW50ZXJzZWN0UGVybWlzc2lvbnMsXG4gIHJlc29sdmVVc2VyUGVybWlzc2lvbnMsXG4gIGNvbmZpbmVQZXJtaXNzaW9uc1RvT3JnLFxuICBoYXNQZXJtaXNzaW9uLFxuICB0eXBlIFBlcm1pc3Npb24sXG4gIEFMTF9QRVJNSVNTSU9OUyxcbiAgUEVSTUlTU0lPTl9HQVRFUyxcbiAgUEVSTUlTU0lPTl9DQVRBTE9HLFxuICBTVVBFUkFETUlOX09OTFlfUEVSTUlTU0lPTlMsXG4gIFNZU1RFTV9PUkdfT05MWV9QRVJNSVNTSU9OUyxcbiAgT1JHX0FTU0lHTkFCTEVfUEVSTUlTU0lPTlMsXG4gIE9SR19BU1NJR05BQkxFX0NBVEVHT1JJRVMsXG4gIFJFQURfT05MWV9QRVJNSVNTSU9OUyxcbiAgUk9MRV9QRVJNSVNTSU9OUyxcbiAgRUNPU1lTVEVNX01BTkFHRVJfUEVSTUlTU0lPTlMsXG59IGZyb20gJy4vcGVybWlzc2lvbnMuanMnO1xuZXhwb3J0IHtcbiAgTUVUQURBVEFfS0VZX0NBVEFMT0csXG4gIE1ldGFkYXRhS2V5cyxcbiAgdHlwZSBNZXRhZGF0YUtleSxcbiAgdHlwZSBNZXRhZGF0YUtleU9wdGlvbixcbiAgTUVUQURBVEFfS0VZX0dST1VQUyxcbn0gZnJvbSAnLi9tZXRhZGF0YS1rZXlzLmpzJztcbmV4cG9ydCB7XG4gIHR5cGUgQXVkaXRFdmVudCxcbn0gZnJvbSAnLi9hdWRpdC1ldmVudHMuanMnO1xuZXhwb3J0IHtcbiAgUkVNT1RFX0FVRElUX0FDVElPTlMsXG4gIGlzUmVtb3RlQXVkaXRBY3Rpb24sXG4gIHR5cGUgUmVtb3RlQXVkaXRBY3Rpb24sXG59IGZyb20gJy4vcmVtb3RlLWF1ZGl0LWFjdGlvbnMuanMnO1xuZXhwb3J0IHtcbiAgQVNLX0FHRU5UX1BST1BPU0VSLFxuICBBU0tfUFJPUE9TRURfQllfSEVBREVSLFxuICBQUk9QT1NFRF9CWV9ERVRBSUxfS0VZLFxuICBhc2tQcm9wb3NhbEF1ZGl0RGV0YWlscyxcbiAgcmVhZFByb3Bvc2VyQ2xhaW0sXG4gIHdpdGhQcm9wb3NhbFByb3ZlbmFuY2UsXG4gIE9SR19TRVRUSU5HX1BST1BPU0FMX0FMTE9XTElTVCxcbiAgT1JHX1NFVFRJTkdfUFJPUE9TQUxfRVhDTFVTSU9OUyxcbiAgT1JHX1NFVFRJTkdfUFJPUE9TQUxfS0VZUyxcbiAgaXNQcm9wb3NhYmxlT3JnU2V0dGluZyxcbiAgaXNWYWxpZE9yZ1NldHRpbmdWYWx1ZSxcbiAgb3JnU2V0dGluZ1NwZWMsXG4gIHBpY2tBbGxvd2VkLFxuICBkaWZmT3JnU2V0dGluZ3MsXG4gIG9yZ1NldHRpbmdSZXF1ZXN0cyxcbiAgdHlwZSBBc2tQcm9wb3NhbFByb3ZlbmFuY2UsXG4gIHR5cGUgUHJvcG9zZXJDbGFpbSxcbiAgdHlwZSBPcmdTZXR0aW5nQ2hhbmdlLFxuICB0eXBlIE9yZ1NldHRpbmdLZXksXG4gIHR5cGUgT3JnU2V0dGluZ1BhdGNoLFxuICB0eXBlIE9yZ1NldHRpbmdSZXF1ZXN0LFxuICB0eXBlIE9yZ1NldHRpbmdTaGFwZSxcbiAgdHlwZSBPcmdTZXR0aW5nU3BlYyxcbiAgdHlwZSBPcmdTZXR0aW5nU3VyZmFjZSxcbiAgdHlwZSBPcmdTZXR0aW5nVmFsdWUsXG4gIHR5cGUgUGlja0FsbG93ZWRSZXN1bHQsXG59IGZyb20gJy4vYXNrLXByb3Bvc2Fscy5qcyc7XG5leHBvcnQge1xuICBpc0Vjb3N5c3RlbU5vdGlmaWNhdGlvbkV2ZW50LFxuICBwYXJzZUVjb3N5c3RlbU5vdGlmeVJlcXVlc3QsXG4gIG5leHRFY29zeXN0ZW1EaWdlc3RUaW1lLFxuICByZW5kZXJFY29zeXN0ZW1NYW5hZ2VyQ2hhbmdlLFxuICByZW5kZXJFY29zeXN0ZW1EaWdlc3QsXG4gIHR5cGUgRWNvc3lzdGVtTm90aWZpY2F0aW9uRXZlbnRJZCxcbiAgdHlwZSBFY29zeXN0ZW1Ob3RpZmljYXRpb25DaGFubmVsLFxuICBFQ09TWVNURU1fRU1BSUxfUFJFRkVSRU5DRV9GSUVMRFMsXG4gIHR5cGUgRWNvc3lzdGVtRW1haWxQcmVmZXJlbmNlRmllbGQsXG4gIEVDT1NZU1RFTV9FTUFJTF9QUkVGRVJFTkNFX0ZJRUxEX05BTUVTLFxuICBFQ09TWVNURU1fTk9USUZJQ0FUSU9OX0VWRU5UUyxcbiAgdHlwZSBFY29zeXN0ZW1SZWNpcGllbnRTcGVjLFxuICB0eXBlIEVjb3N5c3RlbU5vdGlmeVJlcXVlc3QsXG59IGZyb20gJy4vZWNvc3lzdGVtLW5vdGlmaWNhdGlvbnMuanMnO1xuZXhwb3J0IHtcbiAgcHVibGlzaGVyVGVybXNWZXJzaW9uLFxuICBwdWJsaXNoZXJIYW5kbGVQcm9ibGVtLFxuICBpc09mZmljaWFsQXV0b0FwcHJvdmFsRW5hYmxlZCxcbiAgaXNQbHVnaW5QdWJsaXNoaW5nRW5hYmxlZCxcbiAgaXNBbm9ueW1vdXNTdWJtaXNzaW9uc0VuYWJsZWQsXG4gIGlzUGx1Z2luUmV2aWV3c0VuYWJsZWQsXG4gIE9GRklDSUFMX0NBVEFMT0dfTE9BREVSX0FDQ09VTlQsXG4gIERFRkFVTFRfUFVCTElTSEVSX1RFUk1TX1ZFUlNJT04sXG4gIEJVSUxUSU5fUkVTRVJWRURfSEFORExFUyxcbiAgVEVOQU5UX1JFUVVFU1RfS0lORFMsXG4gIFBVQkxJU0hfUEVSTUlTU0lPTl9SRVFVRVNUX0tJTkRTLFxuICBWRVJJRllfUkVRVUVTVF9LSU5EUyxcbiAgU1RFUF9VUF9SRVFVRVNUX0tJTkRTLFxuICBSRVFVRVNUX1NMQV9IT1VSUyxcbn0gZnJvbSAnLi9lY29zeXN0ZW0uanMnO1xuZXhwb3J0IHtcbiAgYWdlU2NvcmUsXG4gIHZ1bG5TY29yZSxcbiAgY29tcHV0ZUhlYWx0aFNjb3JlLFxuICBwdWJsaXNoZXJIZWFsdGhTY29yZSxcbiAgcHVibGlzaGVyU3VjY2Vzc1JhdGUsXG4gIGhlYWx0aEJhbmQsXG4gIEhFQUxUSF9DT01QT05FTlRTLFxuICBIRUFMVEhfV0VJR0hUUyxcbiAgdHlwZSBIZWFsdGhCcmVha2Rvd24sXG4gIHR5cGUgSGVhbHRoQ29tcG9uZW50U2NvcmUsXG4gIHR5cGUgSGVhbHRoUmVzdWx0LFxuICB0eXBlIEhlYWx0aElucHV0cyxcbiAgdHlwZSBIZWFsdGhCYW5kLFxufSBmcm9tICcuL3BsdWdpbi1oZWFsdGguanMnO1xuZXhwb3J0IHtcbiAgYXNTY2FuRmxhZyxcbiAgYmxvY2tPbk5ld0NyaXRpY2FsLFxuICBkZXNjcmliZUZpbmRpbmdzLFxuICBkZXNjcmliZUZpeCxcbiAgZXhjZWVkc1Z1bG5GbG9vcixcbiAgcGx1Z2luVnVsbk1heENyaXRpY2FsLFxuICBTQ0FOX0ZMQUdfVE9QX0ZJTkRJTkdTLFxuICB2dWxuQmxvY2tlZE1lc3NhZ2UsXG4gIHZ1bG5GbGFnZ2VkTWVzc2FnZSxcbiAgdnVsbkZsYWdnZWRXYXJuaW5nLFxuICB0eXBlIFBsdWdpblNjYW5GaW5kaW5nLFxuICB0eXBlIFBsdWdpblNjYW5GbGFnLFxuICB0eXBlIFZ1bG5GbGFnZ2VkV2FybmluZyxcbn0gZnJvbSAnLi9wbHVnaW4tc2Nhbi5qcyc7XG4iXX0=

package/lib/types/remote-audit-actions.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The remote (non-platform) audit ACTION VOCABULARY.
+ *
+ * Kept apart from the client that ships the events (`services/remote-audit-client.ts`)
+ * because it is an allow-list, not machinery: it is the thing a reviewer reads
+ * end to end when deciding whether a service may emit a given action, and it is
+ * what platform's ingest validates against.
+ */
+/**
+ * The exact set of audit actions a NON-PLATFORM (remote) service is permitted to
+ * emit through `POST /audit/events`. This is the SINGLE SOURCE — `RemoteAuditAction`
+ * is derived from it, so the type and the runtime allow-list can never drift.
+ *
+ * SECURITY: platform's ingest validates `action` against this subset (via
+ * {@link isRemoteAuditAction}), NOT the full platform `AuditAction` union — a
+ * `service:*` token must not be able to forge platform-authority events
+ * (`admin.superadmin.grant`, `org.ownership.transfer`, `user.login`, …). Keep
+ * this list free of any platform-only action.
+ */
+export declare const REMOTE_AUDIT_ACTIONS: readonly ['plugin.build.completed', 'plugin.build.failed', 'plugin.build.timeout', 'plugin.scan.skipped', 'plugin.delete', 'plugin.restore', 'plugin.purge', 'plugin.update', 'plugin.upload', 'plugin.deploy', 'plugin.bulk.update', 'plugin.bulk.delete', 'plugin.dlq.purge', 'plugin.build.retry', 'plugin.dlq.replay', 'pipeline.create', 'pipeline.update', 'pipeline.delete', 'pipeline.restore', 'pipeline.purge', 'pipeline_template.create', 'pipeline_template.update', 'pipeline_template.delete', 'pipeline_template.restore', 'pipeline_template.purge', 'pipeline.execution.start', 'pipeline.execution.cancel', 'pipeline.registry.register', 'pipeline.registry.deregister', 'quota.reset', 'quota.limit.update', 'quota.delete', 'compliance.exemption.approve', 'compliance.exemption.revoke', 'compliance.rule.toggle', 'compliance.rule.create', 'compliance.rule.update', 'compliance.rule.delete', 'compliance.rule.restore', 'compliance.rule.purge', 'compliance.policy.create', 'compliance.policy.update', 'compliance.policy.delete', 'compliance.policy.restore', 'compliance.policy.purge', 'compliance.scan-schedule.create', 'compliance.scan-schedule.update', 'compliance.scan-schedule.delete', 'compliance.template.apply', 'compliance.scan.create', 'compliance.scan.cancel', 'compliance.notification-preference.update', 'registry.gc', 'registry.image.delete', 'registry.image.copy', 'registry.image.sign', 'message.announcement.create', 'message.delete', 'message.restore', 'message.purge', 'billing.subscription.create', 'billing.subscription.update', 'billing.subscription.reactivate', 'billing.subscription.cancel', 'billing.subscription.delete', 'billing.tier.override', 'billing.addon.add', 'billing.addon.remove', 'billing.addon.prune', 'billing.discount.generate', 'billing.discount.issue', 'billing.discount.apply', 'billing.discount.remove', 'billing.discount.revoke', 'billing.promotion.create', 'billing.promotion.update', 'billing.promotion.revoke', 'billing.promotion.grant', 'billing.promotion.activate', 'billing.credit.consumed', 'billing.credit.exhausted', 'billing.combo.expired', 'reporting.settings.update', 'reporting.deployment.outcome', 'reporting.retention.sync', 'authz.denied', 'ask.query', 'ask.agent.turn', 'publisher.create', 'publisher.update', 'publisher.terms.accept', 'publisher.verify.request', 'publisher.verify.approve', 'publisher.verify.reject', 'publisher.tier.change', 'publisher.suspend', 'publisher.unsuspend', 'publisher.transfer.request', 'publisher.transfer.accept', 'publisher.transfer.decline', 'publisher.transfer.approve', 'publisher.transfer.reject', 'publisher.profile-change.approve', 'publisher.profile-change.reject', 'plugin.request.submit', 'plugin.request.withdraw', 'plugin.request.approve', 'plugin.request.second-approve', 'plugin.request.reject', 'plugin.request.auto-approve', 'plugin.listing.publish', 'plugin.listing.unlist', 'plugin.listing.update', 'plugin.listing.state.change', 'plugin.listing.pause', 'plugin.listing.unpause', 'plugin.version.pause', 'plugin.version.yank', 'plugin.version.unyank', 'plugin.version.deprecate', 'plugin.collection.update', 'ecosystem.auto-approval-rule.create', 'ecosystem.auto-approval-rule.update', 'ecosystem.auto-approval-rule.delete', 'ecosystem.reserved-name.update', 'ecosystem.sla.update', 'registry.image.publish', 'registry.image.resign', 'registry.image.yank', 'registry.image.gc', 'plugin.install.request', 'plugin.install.approve', 'plugin.install.deny', 'plugin.install.create', 'plugin.install.upgrade', 'plugin.install.change-request', 'plugin.install.change-approve', 'plugin.install.change-reject', 'plugin.install.remove', 'org.plugin-install-policy.update', 'plugin.review.create', 'plugin.review.update', 'plugin.review.delete', 'plugin.review.report', 'plugin.review.hold', 'plugin.review.release', 'plugin.review.remove', 'plugin.review.anonymize', 'plugin.review.reply.create', 'plugin.review.reply.update', 'plugin.review.reply.delete', 'plugin.submission.create', 'plugin.submission.verify', 'plugin.submission.gate-fail', 'plugin.submission.approve', 'plugin.submission.reject', 'plugin.submission.claim', 'plugin.submission.expire', 'plugin.advisory.create', 'plugin.advisory.update', 'plugin.advisory.publish', 'plugin.advisory.withdraw', 'plugin.security_notifications.update', 'plugin.security_notifications.external_email.verify', 'plugin.security_notifications.test'];
+export type RemoteAuditAction = typeof REMOTE_AUDIT_ACTIONS[number];
+/** Whether `value` is an action a remote service may emit (the ingest allow-list). */
+export declare function isRemoteAuditAction(value: string): value is RemoteAuditAction;