@pipeline-builder/api-core 4.1.20 → 4.1.21

package/lib/types/remote-audit-actions.js

@@ -0,0 +1,305 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * The remote (non-platform) audit ACTION VOCABULARY.
+ *
+ * Kept apart from the client that ships the events (`services/remote-audit-client.ts`)
+ * because it is an allow-list, not machinery: it is the thing a reviewer reads
+ * end to end when deciding whether a service may emit a given action, and it is
+ * what platform's ingest validates against.
+ */
+/**
+ * The exact set of audit actions a NON-PLATFORM (remote) service is permitted to
+ * emit through `POST /audit/events`. This is the SINGLE SOURCE — `RemoteAuditAction`
+ * is derived from it, so the type and the runtime allow-list can never drift.
+ *
+ * SECURITY: platform's ingest validates `action` against this subset (via
+ * {@link isRemoteAuditAction}), NOT the full platform `AuditAction` union — a
+ * `service:*` token must not be able to forge platform-authority events
+ * (`admin.superadmin.grant`, `org.ownership.transfer`, `user.login`, …). Keep
+ * this list free of any platform-only action.
+ */
+export const REMOTE_AUDIT_ACTIONS = [
+    'plugin.build.completed',
+    'plugin.build.failed',
+    'plugin.build.timeout',
+    // A version persisted UNSCANNED because the build-time scan could not run and
+    // the operator escape hatch `PLUGIN_ALLOW_UNSCANNED` is on (without it the
+    // build fails `IMAGE_SCAN_UNAVAILABLE`). `details` carry name/version/digest.
+    'plugin.scan.skipped',
+    // Plugin lifecycle mutations (api/plugin route handlers) — the destructive /
+    // publishing surface that builds already audit's counterpart: registry delete,
+    // source upload, and deploy-to-cluster. `targetId` is the plugin id.
+    'plugin.delete',
+    'plugin.restore',
+    // Manual purge: permanent hard-delete of a soft-deleted plugin tombstone on
+    // demand (finalizes what the retention sweep would otherwise do later).
+    'plugin.purge',
+    'plugin.update',
+    'plugin.upload',
+    'plugin.deploy',
+    // Plugin bulk mutations (api/plugin bulk-plugin route) + DLQ purge (drops all
+    // dead-lettered build jobs, cross-org, sysadmin). `details` carries counts.
+    'plugin.bulk.update',
+    'plugin.bulk.delete',
+    'plugin.dlq.purge',
+    // Build re-runs from the queue-triage surface: re-enqueue a FAILED build
+    // (`plugin.build.retry`) or a dead-lettered one (`plugin.dlq.replay`). Both
+    // re-run an image build + plugin persist on the caller's authority, so they
+    // are audited mutations; `affectedOrgId` carries the job's owning org.
+    'plugin.build.retry',
+    'plugin.dlq.replay',
+    // Pipeline mutations — emitted by api/pipeline's route handlers
+    // (create/update/delete + CodePipeline execution trigger/cancel) and
+    // posted to platform's `POST /audit/events` ingest.
+    'pipeline.create',
+    'pipeline.update',
+    'pipeline.delete',
+    'pipeline.restore',
+    // Manual purge: permanent hard-delete of a soft-deleted pipeline /
+    // pipeline_template tombstone on demand (finalizes what the retention sweep
+    // would otherwise do later). `targetId` is the purged id.
+    'pipeline.purge',
+    'pipeline_template.create',
+    'pipeline_template.update',
+    'pipeline_template.delete',
+    'pipeline_template.restore',
+    'pipeline_template.purge',
+    'pipeline.execution.start',
+    'pipeline.execution.cancel',
+    // CodePipeline ARN-registry config (api/pipeline registry route) — registering /
+    // deregistering the external CodePipeline that backs a pipeline (deploy-affecting).
+    'pipeline.registry.register',
+    'pipeline.registry.deregister',
+    // Quota administration (api/quota) — a superadmin resetting an org's usage
+    // counter or editing its tier limits. `affectedOrgId` is the org changed;
+    // `details` carries the quotaType + old/new value.
+    'quota.reset',
+    'quota.limit.update',
+    // A superadmin deleting an org's entire quota document.
+    'quota.delete',
+    // Compliance administration (api/compliance) — the enforcement-posture surface.
+    // Approving/revoking an exemption, toggling/authoring/deleting a rule,
+    // authoring/deleting a policy, managing scan schedules, applying a template,
+    // or cancelling a running scan. `targetId` is the rule/policy/exemption/scan id.
+    'compliance.exemption.approve',
+    'compliance.exemption.revoke',
+    'compliance.rule.toggle',
+    'compliance.rule.create',
+    'compliance.rule.update',
+    'compliance.rule.delete',
+    'compliance.rule.restore',
+    // Manual on-demand hard-delete (PURGE) of a soft-deleted rule/policy tombstone —
+    // the caller-initiated counterpart to the retention sweep's auto-purge. Destroys
+    // the tombstone permanently, so it carries the durable, tamper-evident trail.
+    'compliance.rule.purge',
+    'compliance.policy.create',
+    'compliance.policy.update',
+    'compliance.policy.delete',
+    'compliance.policy.restore',
+    'compliance.policy.purge',
+    'compliance.scan-schedule.create',
+    'compliance.scan-schedule.update',
+    'compliance.scan-schedule.delete',
+    'compliance.template.apply',
+    // Launching an org-wide re-evaluation (the counterpart to `.cancel`) — it
+    // persists a scan and can block entities that passed before.
+    'compliance.scan.create',
+    'compliance.scan.cancel',
+    // Per-org compliance notification settings: recipients + the outbound webhook
+    // URL/secret. Bearer-equivalent config that redirects violation notices, so a
+    // change carries the durable trail (never the secret itself).
+    'compliance.notification-preference.update',
+    // Image-registry destructive ops (api/image-registry) — garbage-collection
+    // sweeps and explicit image/tag deletes.
+    'registry.gc',
+    'registry.image.delete',
+    // Cross-repo tag/image copy (api/image-registry POST /api/images/copy). A
+    // cross-tenant copy moves data across customer boundaries, so it needs the
+    // durable, tamper-evident trail — not just the Loki operator line.
+    'registry.image.copy',
+    // A plugin image signed + SBOM-attested by the platform's plugin-signing key
+    // (api/image-registry POST /internal/plugin-signatures, called by the plugin
+    // build worker). The key is what synth trusts, so every use is on the trail.
+    'registry.image.sign',
+    // Messaging (api/message) — admin BROADCAST announcements + destructive
+    // deletes. 1:1 user messages are intentionally NOT audited (noise + they would
+    // pull private content into the trail). `details` carry metadata only
+    // (subject/type/scope), NEVER message body content.
+    'message.announcement.create',
+    'message.delete',
+    'message.restore',
+    // Manual on-demand PURGE (permanent hard-delete) of an already-soft-deleted
+    // message tombstone — the destructive finalizer the retention sweep would
+    // otherwise perform at the purge deadline. `details` carry metadata only.
+    'message.purge',
+    // Billing (api/billing) — subscription + entitlement mutations, mirrored to the
+    // central audit trail (these also write to the service-local billing_events
+    // collection). `details` carry plan/tier/addon ids only — never card/payment
+    // secrets or an AWS account id.
+    // Subscription lifecycle a CUSTOMER drives (the admin counterpart is
+    // `billing.tier.override`): self-serve create (direct or Marketplace claim),
+    // plan/interval change, cancel-at-period-end, undo-cancel, cascade delete.
+    'billing.subscription.create',
+    'billing.subscription.update',
+    'billing.subscription.reactivate',
+    'billing.subscription.cancel',
+    'billing.subscription.delete',
+    'billing.tier.override',
+    // Operator-only reseed of the invoice ledger from the payment provider's
+    // history (POST /billing/admin/backfill) — mutates finance data fleet-wide.
+    'billing.addon.add',
+    'billing.addon.remove',
+    // System-initiated removal of a tier-included add-on on a plan upgrade (the
+    // account's new tier now bundles the feature) — distinct from a user-initiated
+    // `remove` so finance can tell an auto-prune from a customer action.
+    'billing.addon.prune',
+    // Discounts (docs/billing-discounts.md) — mint/issue/apply/remove/revoke of a
+    // price coupon or usage credit. `details` carry the discount id + kind/value
+    // only, never the opaque token or signing key.
+    'billing.discount.generate',
+    'billing.discount.issue',
+    'billing.discount.apply',
+    'billing.discount.remove',
+    'billing.discount.revoke',
+    // Promotions (docs/billing-discounts.md#promotions) — rule-driven auto-grant
+    // campaigns. `details` carry the promotion id + cents/event only.
+    'billing.promotion.create',
+    'billing.promotion.update',
+    'billing.promotion.revoke',
+    'billing.promotion.grant',
+    'billing.promotion.activate',
+    // Usage-credit realization — a customer/compliance-visible record of credit
+    // movement: `consumed` (Marketplace metered drawdown), `exhausted` (balance hit
+    // zero), and a combo ending. `details` carry cents/ids only, no payment secrets.
+    'billing.credit.consumed',
+    'billing.credit.exhausted',
+    'billing.combo.expired',
+    // Reporting (api/reporting) — the three reporting mutations whose effect
+    // outlives a request log: the per-org correlation-window config write, a
+    // post-deploy outcome marker (it moves the org's DORA CFR/MTTR), and the
+    // inbound billing→reporting retention-entitlement sync (a retention cut is a
+    // data-destroying change applied by the next sweep). `details` carry the
+    // settings/outcome values only.
+    'reporting.settings.update',
+    'reporting.deployment.outcome',
+    'reporting.retention.sync',
+    // Denied authorization attempt — emitted best-effort by the shared
+    // `requirePermission` / `requireSystemAdmin` gate when a state-changing
+    // (non-GET) request is rejected, so probing/escalation attempts are visible
+    // rather than invisible. `details` carries the required permission + path;
+    // `outcome` is 'failure'.
+    'authz.denied',
+    // "Ask" assistant activity — visibility into what the assistant did on a user's
+    // behalf. `ask.query` is a read-only how-to turn; `ask.agent.turn` is a tool-calling
+    // turn. `details` carry SAFE METADATA ONLY (tools used, proposal kinds, query
+    // length, outcome), never the raw query text.
+    'ask.query',
+    'ask.agent.turn',
+    // Plugin ecosystem (docs/runbooks/ecosystem-moderation.md). Governance actions
+    // are recorded with `orgId` = the system org; `affectedOrgId` is the
+    // publisher's org (listing/version/review/advisory/publisher moderation) or
+    // the installing org (installs + policy). Anonymous submissions use the
+    // `ANONYMOUS_ACTOR_ID` actor with `details.submissionId`. `details` carry ids,
+    // versions, digests, tier, state and reason codes only — never review bodies,
+    // README content, secrets or emails.
+    // Publishers.
+    'publisher.create',
+    'publisher.update',
+    'publisher.terms.accept',
+    'publisher.verify.request',
+    'publisher.verify.approve',
+    'publisher.verify.reject',
+    'publisher.tier.change',
+    'publisher.suspend',
+    'publisher.unsuspend',
+    'publisher.transfer.request',
+    'publisher.transfer.accept',
+    'publisher.transfer.decline',
+    'publisher.transfer.approve',
+    'publisher.transfer.reject',
+    'publisher.profile-change.approve',
+    'publisher.profile-change.reject',
+    // Publish requests (tenant → system org). `details.kind` names the request.
+    'plugin.request.submit',
+    'plugin.request.withdraw',
+    'plugin.request.approve',
+    'plugin.request.second-approve',
+    'plugin.request.reject',
+    'plugin.request.auto-approve',
+    // Listings and versions (system org, except the tenant pause).
+    'plugin.listing.publish',
+    'plugin.listing.unlist',
+    'plugin.listing.update',
+    'plugin.listing.state.change',
+    'plugin.listing.pause',
+    'plugin.listing.unpause',
+    'plugin.version.pause',
+    'plugin.version.yank',
+    'plugin.version.unyank',
+    'plugin.version.deprecate',
+    'plugin.collection.update',
+    // Ecosystem configuration (system org).
+    'ecosystem.auto-approval-rule.create',
+    'ecosystem.auto-approval-rule.update',
+    'ecosystem.auto-approval-rule.delete',
+    'ecosystem.reserved-name.update',
+    'ecosystem.sla.update',
+    // Public registry namespace (`public/*`): copy + sign + attest on publish,
+    // the tier-change/suspension re-sign job, tag removal on yank/takedown, and
+    // the retention sweep.
+    'registry.image.publish',
+    'registry.image.resign',
+    'registry.image.yank',
+    'registry.image.gc',
+    // Installs and the installing org's consumption policy (org-local).
+    'plugin.install.request',
+    'plugin.install.approve',
+    'plugin.install.deny',
+    'plugin.install.create',
+    'plugin.install.upgrade',
+    // A member's request to change an install past what they may do alone, and its decision.
+    'plugin.install.change-request',
+    'plugin.install.change-approve',
+    'plugin.install.change-reject',
+    'plugin.install.remove',
+    'org.plugin-install-policy.update',
+    // Reviews and replies.
+    'plugin.review.create',
+    'plugin.review.update',
+    'plugin.review.delete',
+    'plugin.review.report',
+    'plugin.review.hold',
+    'plugin.review.release',
+    'plugin.review.remove',
+    'plugin.review.anonymize',
+    'plugin.review.reply.create',
+    'plugin.review.reply.update',
+    'plugin.review.reply.delete',
+    // Anonymous submissions.
+    'plugin.submission.create',
+    'plugin.submission.verify',
+    'plugin.submission.gate-fail',
+    'plugin.submission.approve',
+    'plugin.submission.reject',
+    'plugin.submission.claim',
+    'plugin.submission.expire',
+    // Security advisories (publish/withdraw are system-org only; update = a
+    // moderator editing a draft before it is published).
+    'plugin.advisory.create',
+    'plugin.advisory.update',
+    'plugin.advisory.publish',
+    'plugin.advisory.withdraw',
+    // Per-org plugin security notifications (plugin scan gates): the settings
+    // (recipients, digest, webhook, external address — changed field names and
+    // the webhook host only, never the secret or the address), an external
+    // address confirmed through its emailed single-use link, and a test send.
+    'plugin.security_notifications.update',
+    'plugin.security_notifications.external_email.verify',
+    'plugin.security_notifications.test',
+];
+/** Whether `value` is an action a remote service may emit (the ingest allow-list). */
+export function isRemoteAuditAction(value) {
+    return REMOTE_AUDIT_ACTIONS.includes(value);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLWF1ZGl0LWFjdGlvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvcmVtb3RlLWF1ZGl0LWFjdGlvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7OztHQU9HO0FBR0g7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHO0lBQ2xDLHdCQUF3QjtJQUN4QixxQkFBcUI7SUFDckIsc0JBQXNCO0lBQ3RCLDhFQUE4RTtJQUM5RSwyRUFBMkU7SUFDM0UsOEVBQThFO0lBQzlFLHFCQUFxQjtJQUNyQiw2RUFBNkU7SUFDN0UsK0VBQStFO0lBQy9FLHFFQUFxRTtJQUNyRSxlQUFlO0lBQ2YsZ0JBQWdCO0lBQ2hCLDRFQUE0RTtJQUM1RSx3RUFBd0U7SUFDeEUsY0FBYztJQUNkLGVBQWU7SUFDZixlQUFlO0lBQ2YsZUFBZTtJQUNmLDhFQUE4RTtJQUM5RSw0RUFBNEU7SUFDNUUsb0JBQW9CO0lBQ3BCLG9CQUFvQjtJQUNwQixrQkFBa0I7SUFDbEIseUVBQXlFO0lBQ3pFLDRFQUE0RTtJQUM1RSw0RUFBNEU7SUFDNUUsdUVBQXVFO0lBQ3ZFLG9CQUFvQjtJQUNwQixtQkFBbUI7SUFDbkIsZ0VBQWdFO0lBQ2hFLHFFQUFxRTtJQUNyRSxvREFBb0Q7SUFDcEQsaUJBQWlCO0lBQ2pCLGlCQUFpQjtJQUNqQixpQkFBaUI7SUFDakIsa0JBQWtCO0lBQ2xCLG1FQUFtRTtJQUNuRSw0RUFBNEU7SUFDNUUsMERBQTBEO0lBQzFELGdCQUFnQjtJQUNoQiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsaUZBQWlGO0lBQ2pGLG9GQUFvRjtJQUNwRiw0QkFBNEI7SUFDNUIsOEJBQThCO0lBQzlCLDJFQUEyRTtJQUMzRSwwRUFBMEU7SUFDMUUsbURBQW1EO0lBQ25ELGFBQWE7SUFDYixvQkFBb0I7SUFDcEIsd0RBQXdEO0lBQ3hELGNBQWM7SUFDZCxnRkFBZ0Y7SUFDaEYsdUVBQXVFO0lBQ3ZFLDZFQUE2RTtJQUM3RSxpRkFBaUY7SUFDakYsOEJBQThCO0lBQzlCLDZCQUE2QjtJQUM3Qix3QkFBd0I7SUFDeEIsd0JBQXdCO0lBQ3hCLHdCQUF3QjtJQUN4Qix3QkFBd0I7SUFDeEIseUJBQXlCO0lBQ3pCLGlGQUFpRjtJQUNqRixpRkFBaUY7SUFDakYsOEVBQThFO0lBQzlFLHVCQUF1QjtJQUN2QiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IseUJBQXlCO0lBQ3pCLGlDQUFpQztJQUNqQyxpQ0FBaUM7SUFDakMsaUNBQWlDO0lBQ2pDLDJCQUEyQjtJQUMzQiwwRUFBMEU7SUFDMUUsNkRBQTZEO0lBQzdELHdCQUF3QjtJQUN4Qix3QkFBd0I7SUFDeEIsOEVBQThFO0lBQzlFLDhFQUE4RTtJQUM5RSw4REFBOEQ7SUFDOUQsMkNBQTJDO0lBQzNDLDJFQUEyRTtJQUMzRSx5Q0FBeUM7SUFDekMsYUFBYTtJQUNiLHVCQUF1QjtJQUN2QiwwRUFBMEU7SUFDMUUsMkVBQTJFO0lBQzNFLG1FQUFtRTtJQUNuRSxxQkFBcUI7SUFDckIsNkVBQTZFO0lBQzdFLDZFQUE2RTtJQUM3RSw2RUFBNkU7SUFDN0UscUJBQXFCO0lBQ3JCLHdFQUF3RTtJQUN4RSwrRUFBK0U7SUFDL0Usc0VBQXNFO0lBQ3RFLG9EQUFvRDtJQUNwRCw2QkFBNkI7SUFDN0IsZ0JBQWdCO0lBQ2hCLGlCQUFpQjtJQUNqQiw0RUFBNEU7SUFDNUUsMEVBQTBFO0lBQzFFLDBFQUEwRTtJQUMxRSxlQUFlO0lBQ2YsZ0ZBQWdGO0lBQ2hGLDRFQUE0RTtJQUM1RSw2RUFBNkU7SUFDN0UsZ0NBQWdDO0lBQ2hDLHFFQUFxRTtJQUNyRSw2RUFBNkU7SUFDN0UsMkVBQTJFO0lBQzNFLDZCQUE2QjtJQUM3Qiw2QkFBNkI7SUFDN0IsaUNBQWlDO0lBQ2pDLDZCQUE2QjtJQUM3Qiw2QkFBNkI7SUFDN0IsdUJBQXVCO0lBQ3ZCLHlFQUF5RTtJQUN6RSw0RUFBNEU7SUFDNUUsbUJBQW1CO0lBQ25CLHNCQUFzQjtJQUN0Qiw0RUFBNEU7SUFDNUUsK0VBQStFO0lBQy9FLHFFQUFxRTtJQUNyRSxxQkFBcUI7SUFDckIsOEVBQThFO0lBQzlFLDZFQUE2RTtJQUM3RSwrQ0FBK0M7SUFDL0MsMkJBQTJCO0lBQzNCLHdCQUF3QjtJQUN4Qix3QkFBd0I7SUFDeEIseUJBQXlCO0lBQ3pCLHlCQUF5QjtJQUN6Qiw2RUFBNkU7SUFDN0Usa0VBQWtFO0lBQ2xFLDBCQUEwQjtJQUMxQiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLHlCQUF5QjtJQUN6Qiw0QkFBNEI7SUFDNUIsNEVBQTRFO0lBQzVFLGdGQUFnRjtJQUNoRixpRkFBaUY7SUFDakYseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQix1QkFBdUI7SUFDdkIseUVBQXlFO0lBQ3pFLHlFQUF5RTtJQUN6RSx5RUFBeUU7SUFDekUsNkVBQTZFO0lBQzdFLHlFQUF5RTtJQUN6RSxnQ0FBZ0M7SUFDaEMsMkJBQTJCO0lBQzNCLDhCQUE4QjtJQUM5QiwwQkFBMEI7SUFDMUIsbUVBQW1FO0lBQ25FLHdFQUF3RTtJQUN4RSw0RUFBNEU7SUFDNUUsMkVBQTJFO0lBQzNFLDBCQUEwQjtJQUMxQixjQUFjO0lBQ2QsZ0ZBQWdGO0lBQ2hGLHFGQUFxRjtJQUNyRiw4RUFBOEU7SUFDOUUsOENBQThDO0lBQzlDLFdBQVc7SUFDWCxnQkFBZ0I7SUFDaEIsK0VBQStFO0lBQy9FLHFFQUFxRTtJQUNyRSw0RUFBNEU7SUFDNUUsd0VBQXdFO0lBQ3hFLCtFQUErRTtJQUMvRSw4RUFBOEU7SUFDOUUscUNBQXFDO0lBQ3JDLGNBQWM7SUFDZCxrQkFBa0I7SUFDbEIsa0JBQWtCO0lBQ2xCLHdCQUF3QjtJQUN4QiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLHlCQUF5QjtJQUN6Qix1QkFBdUI7SUFDdkIsbUJBQW1CO0lBQ25CLHFCQUFxQjtJQUNyQiw0QkFBNEI7SUFDNUIsMkJBQTJCO0lBQzNCLDRCQUE0QjtJQUM1Qiw0QkFBNEI7SUFDNUIsMkJBQTJCO0lBQzNCLGtDQUFrQztJQUNsQyxpQ0FBaUM7SUFDakMsNEVBQTRFO0lBQzVFLHVCQUF1QjtJQUN2Qix5QkFBeUI7SUFDekIsd0JBQXdCO0lBQ3hCLCtCQUErQjtJQUMvQix1QkFBdUI7SUFDdkIsNkJBQTZCO0lBQzdCLCtEQUErRDtJQUMvRCx3QkFBd0I7SUFDeEIsdUJBQXVCO0lBQ3ZCLHVCQUF1QjtJQUN2Qiw2QkFBNkI7SUFDN0Isc0JBQXNCO0lBQ3RCLHdCQUF3QjtJQUN4QixzQkFBc0I7SUFDdEIscUJBQXFCO0lBQ3JCLHVCQUF1QjtJQUN2QiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLHdDQUF3QztJQUN4QyxxQ0FBcUM7SUFDckMscUNBQXFDO0lBQ3JDLHFDQUFxQztJQUNyQyxnQ0FBZ0M7SUFDaEMsc0JBQXNCO0lBQ3RCLDJFQUEyRTtJQUMzRSw0RUFBNEU7SUFDNUUsdUJBQXVCO0lBQ3ZCLHdCQUF3QjtJQUN4Qix1QkFBdUI7SUFDdkIscUJBQXFCO0lBQ3JCLG1CQUFtQjtJQUNuQixvRUFBb0U7SUFDcEUsd0JBQXdCO0lBQ3hCLHdCQUF3QjtJQUN4QixxQkFBcUI7SUFDckIsdUJBQXVCO0lBQ3ZCLHdCQUF3QjtJQUN4Qix5RkFBeUY7SUFDekYsK0JBQStCO0lBQy9CLCtCQUErQjtJQUMvQiw4QkFBOEI7SUFDOUIsdUJBQXVCO0lBQ3ZCLGtDQUFrQztJQUNsQyx1QkFBdUI7SUFDdkIsc0JBQXNCO0lBQ3RCLHNCQUFzQjtJQUN0QixzQkFBc0I7SUFDdEIsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQix1QkFBdUI7SUFDdkIsc0JBQXNCO0lBQ3RCLHlCQUF5QjtJQUN6Qiw0QkFBNEI7SUFDNUIsNEJBQTRCO0lBQzVCLDRCQUE0QjtJQUM1Qix5QkFBeUI7SUFDekIsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQiw2QkFBNkI7SUFDN0IsMkJBQTJCO0lBQzNCLDBCQUEwQjtJQUMxQix5QkFBeUI7SUFDekIsMEJBQTBCO0lBQzFCLHdFQUF3RTtJQUN4RSxxREFBcUQ7SUFDckQsd0JBQXdCO0lBQ3hCLHdCQUF3QjtJQUN4Qix5QkFBeUI7SUFDekIsMEJBQTBCO0lBQzFCLDBFQUEwRTtJQUMxRSwyRUFBMkU7SUFDM0UsdUVBQXVFO0lBQ3ZFLDBFQUEwRTtJQUMxRSxzQ0FBc0M7SUFDdEMscURBQXFEO0lBQ3JELG9DQUFvQztDQUM1QixDQUFDO0FBSVgsc0ZBQXNGO0FBQ3RGLE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxLQUFhO0lBQy9DLE9BQVEsb0JBQTBDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ3JFLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBUaGUgcmVtb3RlIChub24tcGxhdGZvcm0pIGF1ZGl0IEFDVElPTiBWT0NBQlVMQVJZLlxuICpcbiAqIEtlcHQgYXBhcnQgZnJvbSB0aGUgY2xpZW50IHRoYXQgc2hpcHMgdGhlIGV2ZW50cyAoYHNlcnZpY2VzL3JlbW90ZS1hdWRpdC1jbGllbnQudHNgKVxuICogYmVjYXVzZSBpdCBpcyBhbiBhbGxvdy1saXN0LCBub3QgbWFjaGluZXJ5OiBpdCBpcyB0aGUgdGhpbmcgYSByZXZpZXdlciByZWFkc1xuICogZW5kIHRvIGVuZCB3aGVuIGRlY2lkaW5nIHdoZXRoZXIgYSBzZXJ2aWNlIG1heSBlbWl0IGEgZ2l2ZW4gYWN0aW9uLCBhbmQgaXQgaXNcbiAqIHdoYXQgcGxhdGZvcm0ncyBpbmdlc3QgdmFsaWRhdGVzIGFnYWluc3QuXG4gKi9cblxuXG4vKipcbiAqIFRoZSBleGFjdCBzZXQgb2YgYXVkaXQgYWN0aW9ucyBhIE5PTi1QTEFURk9STSAocmVtb3RlKSBzZXJ2aWNlIGlzIHBlcm1pdHRlZCB0b1xuICogZW1pdCB0aHJvdWdoIGBQT1NUIC9hdWRpdC9ldmVudHNgLiBUaGlzIGlzIHRoZSBTSU5HTEUgU09VUkNFIOKAlCBgUmVtb3RlQXVkaXRBY3Rpb25gXG4gKiBpcyBkZXJpdmVkIGZyb20gaXQsIHNvIHRoZSB0eXBlIGFuZCB0aGUgcnVudGltZSBhbGxvdy1saXN0IGNhbiBuZXZlciBkcmlmdC5cbiAqXG4gKiBTRUNVUklUWTogcGxhdGZvcm0ncyBpbmdlc3QgdmFsaWRhdGVzIGBhY3Rpb25gIGFnYWluc3QgdGhpcyBzdWJzZXQgKHZpYVxuICoge0BsaW5rIGlzUmVtb3RlQXVkaXRBY3Rpb259KSwgTk9UIHRoZSBmdWxsIHBsYXRmb3JtIGBBdWRpdEFjdGlvbmAgdW5pb24g4oCUIGFcbiAqIGBzZXJ2aWNlOipgIHRva2VuIG11c3Qgbm90IGJlIGFibGUgdG8gZm9yZ2UgcGxhdGZvcm0tYXV0aG9yaXR5IGV2ZW50c1xuICogKGBhZG1pbi5zdXBlcmFkbWluLmdyYW50YCwgYG9yZy5vd25lcnNoaXAudHJhbnNmZXJgLCBgdXNlci5sb2dpbmAsIOKApikuIEtlZXBcbiAqIHRoaXMgbGlzdCBmcmVlIG9mIGFueSBwbGF0Zm9ybS1vbmx5IGFjdGlvbi5cbiAqL1xuZXhwb3J0IGNvbnN0IFJFTU9URV9BVURJVF9BQ1RJT05TID0gW1xuICAncGx1Z2luLmJ1aWxkLmNvbXBsZXRlZCcsXG4gICdwbHVnaW4uYnVpbGQuZmFpbGVkJyxcbiAgJ3BsdWdpbi5idWlsZC50aW1lb3V0JyxcbiAgLy8gQSB2ZXJzaW9uIHBlcnNpc3RlZCBVTlNDQU5ORUQgYmVjYXVzZSB0aGUgYnVpbGQtdGltZSBzY2FuIGNvdWxkIG5vdCBydW4gYW5kXG4gIC8vIHRoZSBvcGVyYXRvciBlc2NhcGUgaGF0Y2ggYFBMVUdJTl9BTExPV19VTlNDQU5ORURgIGlzIG9uICh3aXRob3V0IGl0IHRoZVxuICAvLyBidWlsZCBmYWlscyBgSU1BR0VfU0NBTl9VTkFWQUlMQUJMRWApLiBgZGV0YWlsc2AgY2FycnkgbmFtZS92ZXJzaW9uL2RpZ2VzdC5cbiAgJ3BsdWdpbi5zY2FuLnNraXBwZWQnLFxuICAvLyBQbHVnaW4gbGlmZWN5Y2xlIG11dGF0aW9ucyAoYXBpL3BsdWdpbiByb3V0ZSBoYW5kbGVycykg4oCUIHRoZSBkZXN0cnVjdGl2ZSAvXG4gIC8vIHB1Ymxpc2hpbmcgc3VyZmFjZSB0aGF0IGJ1aWxkcyBhbHJlYWR5IGF1ZGl0J3MgY291bnRlcnBhcnQ6IHJlZ2lzdHJ5IGRlbGV0ZSxcbiAgLy8gc291cmNlIHVwbG9hZCwgYW5kIGRlcGxveS10by1jbHVzdGVyLiBgdGFyZ2V0SWRgIGlzIHRoZSBwbHVnaW4gaWQuXG4gICdwbHVnaW4uZGVsZXRlJyxcbiAgJ3BsdWdpbi5yZXN0b3JlJyxcbiAgLy8gTWFudWFsIHB1cmdlOiBwZXJtYW5lbnQgaGFyZC1kZWxldGUgb2YgYSBzb2Z0LWRlbGV0ZWQgcGx1Z2luIHRvbWJzdG9uZSBvblxuICAvLyBkZW1hbmQgKGZpbmFsaXplcyB3aGF0IHRoZSByZXRlbnRpb24gc3dlZXAgd291bGQgb3RoZXJ3aXNlIGRvIGxhdGVyKS5cbiAgJ3BsdWdpbi5wdXJnZScsXG4gICdwbHVnaW4udXBkYXRlJyxcbiAgJ3BsdWdpbi51cGxvYWQnLFxuICAncGx1Z2luLmRlcGxveScsXG4gIC8vIFBsdWdpbiBidWxrIG11dGF0aW9ucyAoYXBpL3BsdWdpbiBidWxrLXBsdWdpbiByb3V0ZSkgKyBETFEgcHVyZ2UgKGRyb3BzIGFsbFxuICAvLyBkZWFkLWxldHRlcmVkIGJ1aWxkIGpvYnMsIGNyb3NzLW9yZywgc3lzYWRtaW4pLiBgZGV0YWlsc2AgY2FycmllcyBjb3VudHMuXG4gICdwbHVnaW4uYnVsay51cGRhdGUnLFxuICAncGx1Z2luLmJ1bGsuZGVsZXRlJyxcbiAgJ3BsdWdpbi5kbHEucHVyZ2UnLFxuICAvLyBCdWlsZCByZS1ydW5zIGZyb20gdGhlIHF1ZXVlLXRyaWFnZSBzdXJmYWNlOiByZS1lbnF1ZXVlIGEgRkFJTEVEIGJ1aWxkXG4gIC8vIChgcGx1Z2luLmJ1aWxkLnJldHJ5YCkgb3IgYSBkZWFkLWxldHRlcmVkIG9uZSAoYHBsdWdpbi5kbHEucmVwbGF5YCkuIEJvdGhcbiAgLy8gcmUtcnVuIGFuIGltYWdlIGJ1aWxkICsgcGx1Z2luIHBlcnNpc3Qgb24gdGhlIGNhbGxlcidzIGF1dGhvcml0eSwgc28gdGhleVxuICAvLyBhcmUgYXVkaXRlZCBtdXRhdGlvbnM7IGBhZmZlY3RlZE9yZ0lkYCBjYXJyaWVzIHRoZSBqb2IncyBvd25pbmcgb3JnLlxuICAncGx1Z2luLmJ1aWxkLnJldHJ5JyxcbiAgJ3BsdWdpbi5kbHEucmVwbGF5JyxcbiAgLy8gUGlwZWxpbmUgbXV0YXRpb25zIOKAlCBlbWl0dGVkIGJ5IGFwaS9waXBlbGluZSdzIHJvdXRlIGhhbmRsZXJzXG4gIC8vIChjcmVhdGUvdXBkYXRlL2RlbGV0ZSArIENvZGVQaXBlbGluZSBleGVjdXRpb24gdHJpZ2dlci9jYW5jZWwpIGFuZFxuICAvLyBwb3N0ZWQgdG8gcGxhdGZvcm0ncyBgUE9TVCAvYXVkaXQvZXZlbnRzYCBpbmdlc3QuXG4gICdwaXBlbGluZS5jcmVhdGUnLFxuICAncGlwZWxpbmUudXBkYXRlJyxcbiAgJ3BpcGVsaW5lLmRlbGV0ZScsXG4gICdwaXBlbGluZS5yZXN0b3JlJyxcbiAgLy8gTWFudWFsIHB1cmdlOiBwZXJtYW5lbnQgaGFyZC1kZWxldGUgb2YgYSBzb2Z0LWRlbGV0ZWQgcGlwZWxpbmUgL1xuICAvLyBwaXBlbGluZV90ZW1wbGF0ZSB0b21ic3RvbmUgb24gZGVtYW5kIChmaW5hbGl6ZXMgd2hhdCB0aGUgcmV0ZW50aW9uIHN3ZWVwXG4gIC8vIHdvdWxkIG90aGVyd2lzZSBkbyBsYXRlcikuIGB0YXJnZXRJZGAgaXMgdGhlIHB1cmdlZCBpZC5cbiAgJ3BpcGVsaW5lLnB1cmdlJyxcbiAgJ3BpcGVsaW5lX3RlbXBsYXRlLmNyZWF0ZScsXG4gICdwaXBlbGluZV90ZW1wbGF0ZS51cGRhdGUnLFxuICAncGlwZWxpbmVfdGVtcGxhdGUuZGVsZXRlJyxcbiAgJ3BpcGVsaW5lX3RlbXBsYXRlLnJlc3RvcmUnLFxuICAncGlwZWxpbmVfdGVtcGxhdGUucHVyZ2UnLFxuICAncGlwZWxpbmUuZXhlY3V0aW9uLnN0YXJ0JyxcbiAgJ3BpcGVsaW5lLmV4ZWN1dGlvbi5jYW5jZWwnLFxuICAvLyBDb2RlUGlwZWxpbmUgQVJOLXJlZ2lzdHJ5IGNvbmZpZyAoYXBpL3BpcGVsaW5lIHJlZ2lzdHJ5IHJvdXRlKSDigJQgcmVnaXN0ZXJpbmcgL1xuICAvLyBkZXJlZ2lzdGVyaW5nIHRoZSBleHRlcm5hbCBDb2RlUGlwZWxpbmUgdGhhdCBiYWNrcyBhIHBpcGVsaW5lIChkZXBsb3ktYWZmZWN0aW5nKS5cbiAgJ3BpcGVsaW5lLnJlZ2lzdHJ5LnJlZ2lzdGVyJyxcbiAgJ3BpcGVsaW5lLnJlZ2lzdHJ5LmRlcmVnaXN0ZXInLFxuICAvLyBRdW90YSBhZG1pbmlzdHJhdGlvbiAoYXBpL3F1b3RhKSDigJQgYSBzdXBlcmFkbWluIHJlc2V0dGluZyBhbiBvcmcncyB1c2FnZVxuICAvLyBjb3VudGVyIG9yIGVkaXRpbmcgaXRzIHRpZXIgbGltaXRzLiBgYWZmZWN0ZWRPcmdJZGAgaXMgdGhlIG9yZyBjaGFuZ2VkO1xuICAvLyBgZGV0YWlsc2AgY2FycmllcyB0aGUgcXVvdGFUeXBlICsgb2xkL25ldyB2YWx1ZS5cbiAgJ3F1b3RhLnJlc2V0JyxcbiAgJ3F1b3RhLmxpbWl0LnVwZGF0ZScsXG4gIC8vIEEgc3VwZXJhZG1pbiBkZWxldGluZyBhbiBvcmcncyBlbnRpcmUgcXVvdGEgZG9jdW1lbnQuXG4gICdxdW90YS5kZWxldGUnLFxuICAvLyBDb21wbGlhbmNlIGFkbWluaXN0cmF0aW9uIChhcGkvY29tcGxpYW5jZSkg4oCUIHRoZSBlbmZvcmNlbWVudC1wb3N0dXJlIHN1cmZhY2UuXG4gIC8vIEFwcHJvdmluZy9yZXZva2luZyBhbiBleGVtcHRpb24sIHRvZ2dsaW5nL2F1dGhvcmluZy9kZWxldGluZyBhIHJ1bGUsXG4gIC8vIGF1dGhvcmluZy9kZWxldGluZyBhIHBvbGljeSwgbWFuYWdpbmcgc2NhbiBzY2hlZHVsZXMsIGFwcGx5aW5nIGEgdGVtcGxhdGUsXG4gIC8vIG9yIGNhbmNlbGxpbmcgYSBydW5uaW5nIHNjYW4uIGB0YXJnZXRJZGAgaXMgdGhlIHJ1bGUvcG9saWN5L2V4ZW1wdGlvbi9zY2FuIGlkLlxuICAnY29tcGxpYW5jZS5leGVtcHRpb24uYXBwcm92ZScsXG4gICdjb21wbGlhbmNlLmV4ZW1wdGlvbi5yZXZva2UnLFxuICAnY29tcGxpYW5jZS5ydWxlLnRvZ2dsZScsXG4gICdjb21wbGlhbmNlLnJ1bGUuY3JlYXRlJyxcbiAgJ2NvbXBsaWFuY2UucnVsZS51cGRhdGUnLFxuICAnY29tcGxpYW5jZS5ydWxlLmRlbGV0ZScsXG4gICdjb21wbGlhbmNlLnJ1bGUucmVzdG9yZScsXG4gIC8vIE1hbnVhbCBvbi1kZW1hbmQgaGFyZC1kZWxldGUgKFBVUkdFKSBvZiBhIHNvZnQtZGVsZXRlZCBydWxlL3BvbGljeSB0b21ic3RvbmUg4oCUXG4gIC8vIHRoZSBjYWxsZXItaW5pdGlhdGVkIGNvdW50ZXJwYXJ0IHRvIHRoZSByZXRlbnRpb24gc3dlZXAncyBhdXRvLXB1cmdlLiBEZXN0cm95c1xuICAvLyB0aGUgdG9tYnN0b25lIHBlcm1hbmVudGx5LCBzbyBpdCBjYXJyaWVzIHRoZSBkdXJhYmxlLCB0YW1wZXItZXZpZGVudCB0cmFpbC5cbiAgJ2NvbXBsaWFuY2UucnVsZS5wdXJnZScsXG4gICdjb21wbGlhbmNlLnBvbGljeS5jcmVhdGUnLFxuICAnY29tcGxpYW5jZS5wb2xpY3kudXBkYXRlJyxcbiAgJ2NvbXBsaWFuY2UucG9saWN5LmRlbGV0ZScsXG4gICdjb21wbGlhbmNlLnBvbGljeS5yZXN0b3JlJyxcbiAgJ2NvbXBsaWFuY2UucG9saWN5LnB1cmdlJyxcbiAgJ2NvbXBsaWFuY2Uuc2Nhbi1zY2hlZHVsZS5jcmVhdGUnLFxuICAnY29tcGxpYW5jZS5zY2FuLXNjaGVkdWxlLnVwZGF0ZScsXG4gICdjb21wbGlhbmNlLnNjYW4tc2NoZWR1bGUuZGVsZXRlJyxcbiAgJ2NvbXBsaWFuY2UudGVtcGxhdGUuYXBwbHknLFxuICAvLyBMYXVuY2hpbmcgYW4gb3JnLXdpZGUgcmUtZXZhbHVhdGlvbiAodGhlIGNvdW50ZXJwYXJ0IHRvIGAuY2FuY2VsYCkg4oCUIGl0XG4gIC8vIHBlcnNpc3RzIGEgc2NhbiBhbmQgY2FuIGJsb2NrIGVudGl0aWVzIHRoYXQgcGFzc2VkIGJlZm9yZS5cbiAgJ2NvbXBsaWFuY2Uuc2Nhbi5jcmVhdGUnLFxuICAnY29tcGxpYW5jZS5zY2FuLmNhbmNlbCcsXG4gIC8vIFBlci1vcmcgY29tcGxpYW5jZSBub3RpZmljYXRpb24gc2V0dGluZ3M6IHJlY2lwaWVudHMgKyB0aGUgb3V0Ym91bmQgd2ViaG9va1xuICAvLyBVUkwvc2VjcmV0LiBCZWFyZXItZXF1aXZhbGVudCBjb25maWcgdGhhdCByZWRpcmVjdHMgdmlvbGF0aW9uIG5vdGljZXMsIHNvIGFcbiAgLy8gY2hhbmdlIGNhcnJpZXMgdGhlIGR1cmFibGUgdHJhaWwgKG5ldmVyIHRoZSBzZWNyZXQgaXRzZWxmKS5cbiAgJ2NvbXBsaWFuY2Uubm90aWZpY2F0aW9uLXByZWZlcmVuY2UudXBkYXRlJyxcbiAgLy8gSW1hZ2UtcmVnaXN0cnkgZGVzdHJ1Y3RpdmUgb3BzIChhcGkvaW1hZ2UtcmVnaXN0cnkpIOKAlCBnYXJiYWdlLWNvbGxlY3Rpb25cbiAgLy8gc3dlZXBzIGFuZCBleHBsaWNpdCBpbWFnZS90YWcgZGVsZXRlcy5cbiAgJ3JlZ2lzdHJ5LmdjJyxcbiAgJ3JlZ2lzdHJ5LmltYWdlLmRlbGV0ZScsXG4gIC8vIENyb3NzLXJlcG8gdGFnL2ltYWdlIGNvcHkgKGFwaS9pbWFnZS1yZWdpc3RyeSBQT1NUIC9hcGkvaW1hZ2VzL2NvcHkpLiBBXG4gIC8vIGNyb3NzLXRlbmFudCBjb3B5IG1vdmVzIGRhdGEgYWNyb3NzIGN1c3RvbWVyIGJvdW5kYXJpZXMsIHNvIGl0IG5lZWRzIHRoZVxuICAvLyBkdXJhYmxlLCB0YW1wZXItZXZpZGVudCB0cmFpbCDigJQgbm90IGp1c3QgdGhlIExva2kgb3BlcmF0b3IgbGluZS5cbiAgJ3JlZ2lzdHJ5LmltYWdlLmNvcHknLFxuICAvLyBBIHBsdWdpbiBpbWFnZSBzaWduZWQgKyBTQk9NLWF0dGVzdGVkIGJ5IHRoZSBwbGF0Zm9ybSdzIHBsdWdpbi1zaWduaW5nIGtleVxuICAvLyAoYXBpL2ltYWdlLXJlZ2lzdHJ5IFBPU1QgL2ludGVybmFsL3BsdWdpbi1zaWduYXR1cmVzLCBjYWxsZWQgYnkgdGhlIHBsdWdpblxuICAvLyBidWlsZCB3b3JrZXIpLiBUaGUga2V5IGlzIHdoYXQgc3ludGggdHJ1c3RzLCBzbyBldmVyeSB1c2UgaXMgb24gdGhlIHRyYWlsLlxuICAncmVnaXN0cnkuaW1hZ2Uuc2lnbicsXG4gIC8vIE1lc3NhZ2luZyAoYXBpL21lc3NhZ2UpIOKAlCBhZG1pbiBCUk9BRENBU1QgYW5ub3VuY2VtZW50cyArIGRlc3RydWN0aXZlXG4gIC8vIGRlbGV0ZXMuIDE6MSB1c2VyIG1lc3NhZ2VzIGFyZSBpbnRlbnRpb25hbGx5IE5PVCBhdWRpdGVkIChub2lzZSArIHRoZXkgd291bGRcbiAgLy8gcHVsbCBwcml2YXRlIGNvbnRlbnQgaW50byB0aGUgdHJhaWwpLiBgZGV0YWlsc2AgY2FycnkgbWV0YWRhdGEgb25seVxuICAvLyAoc3ViamVjdC90eXBlL3Njb3BlKSwgTkVWRVIgbWVzc2FnZSBib2R5IGNvbnRlbnQuXG4gICdtZXNzYWdlLmFubm91bmNlbWVudC5jcmVhdGUnLFxuICAnbWVzc2FnZS5kZWxldGUnLFxuICAnbWVzc2FnZS5yZXN0b3JlJyxcbiAgLy8gTWFudWFsIG9uLWRlbWFuZCBQVVJHRSAocGVybWFuZW50IGhhcmQtZGVsZXRlKSBvZiBhbiBhbHJlYWR5LXNvZnQtZGVsZXRlZFxuICAvLyBtZXNzYWdlIHRvbWJzdG9uZSDigJQgdGhlIGRlc3RydWN0aXZlIGZpbmFsaXplciB0aGUgcmV0ZW50aW9uIHN3ZWVwIHdvdWxkXG4gIC8vIG90aGVyd2lzZSBwZXJmb3JtIGF0IHRoZSBwdXJnZSBkZWFkbGluZS4gYGRldGFpbHNgIGNhcnJ5IG1ldGFkYXRhIG9ubHkuXG4gICdtZXNzYWdlLnB1cmdlJyxcbiAgLy8gQmlsbGluZyAoYXBpL2JpbGxpbmcpIOKAlCBzdWJzY3JpcHRpb24gKyBlbnRpdGxlbWVudCBtdXRhdGlvbnMsIG1pcnJvcmVkIHRvIHRoZVxuICAvLyBjZW50cmFsIGF1ZGl0IHRyYWlsICh0aGVzZSBhbHNvIHdyaXRlIHRvIHRoZSBzZXJ2aWNlLWxvY2FsIGJpbGxpbmdfZXZlbnRzXG4gIC8vIGNvbGxlY3Rpb24pLiBgZGV0YWlsc2AgY2FycnkgcGxhbi90aWVyL2FkZG9uIGlkcyBvbmx5IOKAlCBuZXZlciBjYXJkL3BheW1lbnRcbiAgLy8gc2VjcmV0cyBvciBhbiBBV1MgYWNjb3VudCBpZC5cbiAgLy8gU3Vic2NyaXB0aW9uIGxpZmVjeWNsZSBhIENVU1RPTUVSIGRyaXZlcyAodGhlIGFkbWluIGNvdW50ZXJwYXJ0IGlzXG4gIC8vIGBiaWxsaW5nLnRpZXIub3ZlcnJpZGVgKTogc2VsZi1zZXJ2ZSBjcmVhdGUgKGRpcmVjdCBvciBNYXJrZXRwbGFjZSBjbGFpbSksXG4gIC8vIHBsYW4vaW50ZXJ2YWwgY2hhbmdlLCBjYW5jZWwtYXQtcGVyaW9kLWVuZCwgdW5kby1jYW5jZWwsIGNhc2NhZGUgZGVsZXRlLlxuICAnYmlsbGluZy5zdWJzY3JpcHRpb24uY3JlYXRlJyxcbiAgJ2JpbGxpbmcuc3Vic2NyaXB0aW9uLnVwZGF0ZScsXG4gICdiaWxsaW5nLnN1YnNjcmlwdGlvbi5yZWFjdGl2YXRlJyxcbiAgJ2JpbGxpbmcuc3Vic2NyaXB0aW9uLmNhbmNlbCcsXG4gICdiaWxsaW5nLnN1YnNjcmlwdGlvbi5kZWxldGUnLFxuICAnYmlsbGluZy50aWVyLm92ZXJyaWRlJyxcbiAgLy8gT3BlcmF0b3Itb25seSByZXNlZWQgb2YgdGhlIGludm9pY2UgbGVkZ2VyIGZyb20gdGhlIHBheW1lbnQgcHJvdmlkZXInc1xuICAvLyBoaXN0b3J5IChQT1NUIC9iaWxsaW5nL2FkbWluL2JhY2tmaWxsKSDigJQgbXV0YXRlcyBmaW5hbmNlIGRhdGEgZmxlZXQtd2lkZS5cbiAgJ2JpbGxpbmcuYWRkb24uYWRkJyxcbiAgJ2JpbGxpbmcuYWRkb24ucmVtb3ZlJyxcbiAgLy8gU3lzdGVtLWluaXRpYXRlZCByZW1vdmFsIG9mIGEgdGllci1pbmNsdWRlZCBhZGQtb24gb24gYSBwbGFuIHVwZ3JhZGUgKHRoZVxuICAvLyBhY2NvdW50J3MgbmV3IHRpZXIgbm93IGJ1bmRsZXMgdGhlIGZlYXR1cmUpIOKAlCBkaXN0aW5jdCBmcm9tIGEgdXNlci1pbml0aWF0ZWRcbiAgLy8gYHJlbW92ZWAgc28gZmluYW5jZSBjYW4gdGVsbCBhbiBhdXRvLXBydW5lIGZyb20gYSBjdXN0b21lciBhY3Rpb24uXG4gICdiaWxsaW5nLmFkZG9uLnBydW5lJyxcbiAgLy8gRGlzY291bnRzIChkb2NzL2JpbGxpbmctZGlzY291bnRzLm1kKSDigJQgbWludC9pc3N1ZS9hcHBseS9yZW1vdmUvcmV2b2tlIG9mIGFcbiAgLy8gcHJpY2UgY291cG9uIG9yIHVzYWdlIGNyZWRpdC4gYGRldGFpbHNgIGNhcnJ5IHRoZSBkaXNjb3VudCBpZCArIGtpbmQvdmFsdWVcbiAgLy8gb25seSwgbmV2ZXIgdGhlIG9wYXF1ZSB0b2tlbiBvciBzaWduaW5nIGtleS5cbiAgJ2JpbGxpbmcuZGlzY291bnQuZ2VuZXJhdGUnLFxuICAnYmlsbGluZy5kaXNjb3VudC5pc3N1ZScsXG4gICdiaWxsaW5nLmRpc2NvdW50LmFwcGx5JyxcbiAgJ2JpbGxpbmcuZGlzY291bnQucmVtb3ZlJyxcbiAgJ2JpbGxpbmcuZGlzY291bnQucmV2b2tlJyxcbiAgLy8gUHJvbW90aW9ucyAoZG9jcy9iaWxsaW5nLWRpc2NvdW50cy5tZCNwcm9tb3Rpb25zKSDigJQgcnVsZS1kcml2ZW4gYXV0by1ncmFudFxuICAvLyBjYW1wYWlnbnMuIGBkZXRhaWxzYCBjYXJyeSB0aGUgcHJvbW90aW9uIGlkICsgY2VudHMvZXZlbnQgb25seS5cbiAgJ2JpbGxpbmcucHJvbW90aW9uLmNyZWF0ZScsXG4gICdiaWxsaW5nLnByb21vdGlvbi51cGRhdGUnLFxuICAnYmlsbGluZy5wcm9tb3Rpb24ucmV2b2tlJyxcbiAgJ2JpbGxpbmcucHJvbW90aW9uLmdyYW50JyxcbiAgJ2JpbGxpbmcucHJvbW90aW9uLmFjdGl2YXRlJyxcbiAgLy8gVXNhZ2UtY3JlZGl0IHJlYWxpemF0aW9uIOKAlCBhIGN1c3RvbWVyL2NvbXBsaWFuY2UtdmlzaWJsZSByZWNvcmQgb2YgY3JlZGl0XG4gIC8vIG1vdmVtZW50OiBgY29uc3VtZWRgIChNYXJrZXRwbGFjZSBtZXRlcmVkIGRyYXdkb3duKSwgYGV4aGF1c3RlZGAgKGJhbGFuY2UgaGl0XG4gIC8vIHplcm8pLCBhbmQgYSBjb21ibyBlbmRpbmcuIGBkZXRhaWxzYCBjYXJyeSBjZW50cy9pZHMgb25seSwgbm8gcGF5bWVudCBzZWNyZXRzLlxuICAnYmlsbGluZy5jcmVkaXQuY29uc3VtZWQnLFxuICAnYmlsbGluZy5jcmVkaXQuZXhoYXVzdGVkJyxcbiAgJ2JpbGxpbmcuY29tYm8uZXhwaXJlZCcsXG4gIC8vIFJlcG9ydGluZyAoYXBpL3JlcG9ydGluZykg4oCUIHRoZSB0aHJlZSByZXBvcnRpbmcgbXV0YXRpb25zIHdob3NlIGVmZmVjdFxuICAvLyBvdXRsaXZlcyBhIHJlcXVlc3QgbG9nOiB0aGUgcGVyLW9yZyBjb3JyZWxhdGlvbi13aW5kb3cgY29uZmlnIHdyaXRlLCBhXG4gIC8vIHBvc3QtZGVwbG95IG91dGNvbWUgbWFya2VyIChpdCBtb3ZlcyB0aGUgb3JnJ3MgRE9SQSBDRlIvTVRUUiksIGFuZCB0aGVcbiAgLy8gaW5ib3VuZCBiaWxsaW5n4oaScmVwb3J0aW5nIHJldGVudGlvbi1lbnRpdGxlbWVudCBzeW5jIChhIHJldGVudGlvbiBjdXQgaXMgYVxuICAvLyBkYXRhLWRlc3Ryb3lpbmcgY2hhbmdlIGFwcGxpZWQgYnkgdGhlIG5leHQgc3dlZXApLiBgZGV0YWlsc2AgY2FycnkgdGhlXG4gIC8vIHNldHRpbmdzL291dGNvbWUgdmFsdWVzIG9ubHkuXG4gICdyZXBvcnRpbmcuc2V0dGluZ3MudXBkYXRlJyxcbiAgJ3JlcG9ydGluZy5kZXBsb3ltZW50Lm91dGNvbWUnLFxuICAncmVwb3J0aW5nLnJldGVudGlvbi5zeW5jJyxcbiAgLy8gRGVuaWVkIGF1dGhvcml6YXRpb24gYXR0ZW1wdCDigJQgZW1pdHRlZCBiZXN0LWVmZm9ydCBieSB0aGUgc2hhcmVkXG4gIC8vIGByZXF1aXJlUGVybWlzc2lvbmAgLyBgcmVxdWlyZVN5c3RlbUFkbWluYCBnYXRlIHdoZW4gYSBzdGF0ZS1jaGFuZ2luZ1xuICAvLyAobm9uLUdFVCkgcmVxdWVzdCBpcyByZWplY3RlZCwgc28gcHJvYmluZy9lc2NhbGF0aW9uIGF0dGVtcHRzIGFyZSB2aXNpYmxlXG4gIC8vIHJhdGhlciB0aGFuIGludmlzaWJsZS4gYGRldGFpbHNgIGNhcnJpZXMgdGhlIHJlcXVpcmVkIHBlcm1pc3Npb24gKyBwYXRoO1xuICAvLyBgb3V0Y29tZWAgaXMgJ2ZhaWx1cmUnLlxuICAnYXV0aHouZGVuaWVkJyxcbiAgLy8gXCJBc2tcIiBhc3Npc3RhbnQgYWN0aXZpdHkg4oCUIHZpc2liaWxpdHkgaW50byB3aGF0IHRoZSBhc3Npc3RhbnQgZGlkIG9uIGEgdXNlcidzXG4gIC8vIGJlaGFsZi4gYGFzay5xdWVyeWAgaXMgYSByZWFkLW9ubHkgaG93LXRvIHR1cm47IGBhc2suYWdlbnQudHVybmAgaXMgYSB0b29sLWNhbGxpbmdcbiAgLy8gdHVybi4gYGRldGFpbHNgIGNhcnJ5IFNBRkUgTUVUQURBVEEgT05MWSAodG9vbHMgdXNlZCwgcHJvcG9zYWwga2luZHMsIHF1ZXJ5XG4gIC8vIGxlbmd0aCwgb3V0Y29tZSksIG5ldmVyIHRoZSByYXcgcXVlcnkgdGV4dC5cbiAgJ2Fzay5xdWVyeScsXG4gICdhc2suYWdlbnQudHVybicsXG4gIC8vIFBsdWdpbiBlY29zeXN0ZW0gKGRvY3MvcnVuYm9va3MvZWNvc3lzdGVtLW1vZGVyYXRpb24ubWQpLiBHb3Zlcm5hbmNlIGFjdGlvbnNcbiAgLy8gYXJlIHJlY29yZGVkIHdpdGggYG9yZ0lkYCA9IHRoZSBzeXN0ZW0gb3JnOyBgYWZmZWN0ZWRPcmdJZGAgaXMgdGhlXG4gIC8vIHB1Ymxpc2hlcidzIG9yZyAobGlzdGluZy92ZXJzaW9uL3Jldmlldy9hZHZpc29yeS9wdWJsaXNoZXIgbW9kZXJhdGlvbikgb3JcbiAgLy8gdGhlIGluc3RhbGxpbmcgb3JnIChpbnN0YWxscyArIHBvbGljeSkuIEFub255bW91cyBzdWJtaXNzaW9ucyB1c2UgdGhlXG4gIC8vIGBBTk9OWU1PVVNfQUNUT1JfSURgIGFjdG9yIHdpdGggYGRldGFpbHMuc3VibWlzc2lvbklkYC4gYGRldGFpbHNgIGNhcnJ5IGlkcyxcbiAgLy8gdmVyc2lvbnMsIGRpZ2VzdHMsIHRpZXIsIHN0YXRlIGFuZCByZWFzb24gY29kZXMgb25seSDigJQgbmV2ZXIgcmV2aWV3IGJvZGllcyxcbiAgLy8gUkVBRE1FIGNvbnRlbnQsIHNlY3JldHMgb3IgZW1haWxzLlxuICAvLyBQdWJsaXNoZXJzLlxuICAncHVibGlzaGVyLmNyZWF0ZScsXG4gICdwdWJsaXNoZXIudXBkYXRlJyxcbiAgJ3B1Ymxpc2hlci50ZXJtcy5hY2NlcHQnLFxuICAncHVibGlzaGVyLnZlcmlmeS5yZXF1ZXN0JyxcbiAgJ3B1Ymxpc2hlci52ZXJpZnkuYXBwcm92ZScsXG4gICdwdWJsaXNoZXIudmVyaWZ5LnJlamVjdCcsXG4gICdwdWJsaXNoZXIudGllci5jaGFuZ2UnLFxuICAncHVibGlzaGVyLnN1c3BlbmQnLFxuICAncHVibGlzaGVyLnVuc3VzcGVuZCcsXG4gICdwdWJsaXNoZXIudHJhbnNmZXIucmVxdWVzdCcsXG4gICdwdWJsaXNoZXIudHJhbnNmZXIuYWNjZXB0JyxcbiAgJ3B1Ymxpc2hlci50cmFuc2Zlci5kZWNsaW5lJyxcbiAgJ3B1Ymxpc2hlci50cmFuc2Zlci5hcHByb3ZlJyxcbiAgJ3B1Ymxpc2hlci50cmFuc2Zlci5yZWplY3QnLFxuICAncHVibGlzaGVyLnByb2ZpbGUtY2hhbmdlLmFwcHJvdmUnLFxuICAncHVibGlzaGVyLnByb2ZpbGUtY2hhbmdlLnJlamVjdCcsXG4gIC8vIFB1Ymxpc2ggcmVxdWVzdHMgKHRlbmFudCDihpIgc3lzdGVtIG9yZykuIGBkZXRhaWxzLmtpbmRgIG5hbWVzIHRoZSByZXF1ZXN0LlxuICAncGx1Z2luLnJlcXVlc3Quc3VibWl0JyxcbiAgJ3BsdWdpbi5yZXF1ZXN0LndpdGhkcmF3JyxcbiAgJ3BsdWdpbi5yZXF1ZXN0LmFwcHJvdmUnLFxuICAncGx1Z2luLnJlcXVlc3Quc2Vjb25kLWFwcHJvdmUnLFxuICAncGx1Z2luLnJlcXVlc3QucmVqZWN0JyxcbiAgJ3BsdWdpbi5yZXF1ZXN0LmF1dG8tYXBwcm92ZScsXG4gIC8vIExpc3RpbmdzIGFuZCB2ZXJzaW9ucyAoc3lzdGVtIG9yZywgZXhjZXB0IHRoZSB0ZW5hbnQgcGF1c2UpLlxuICAncGx1Z2luLmxpc3RpbmcucHVibGlzaCcsXG4gICdwbHVnaW4ubGlzdGluZy51bmxpc3QnLFxuICAncGx1Z2luLmxpc3RpbmcudXBkYXRlJyxcbiAgJ3BsdWdpbi5saXN0aW5nLnN0YXRlLmNoYW5nZScsXG4gICdwbHVnaW4ubGlzdGluZy5wYXVzZScsXG4gICdwbHVnaW4ubGlzdGluZy51bnBhdXNlJyxcbiAgJ3BsdWdpbi52ZXJzaW9uLnBhdXNlJyxcbiAgJ3BsdWdpbi52ZXJzaW9uLnlhbmsnLFxuICAncGx1Z2luLnZlcnNpb24udW55YW5rJyxcbiAgJ3BsdWdpbi52ZXJzaW9uLmRlcHJlY2F0ZScsXG4gICdwbHVnaW4uY29sbGVjdGlvbi51cGRhdGUnLFxuICAvLyBFY29zeXN0ZW0gY29uZmlndXJhdGlvbiAoc3lzdGVtIG9yZykuXG4gICdlY29zeXN0ZW0uYXV0by1hcHByb3ZhbC1ydWxlLmNyZWF0ZScsXG4gICdlY29zeXN0ZW0uYXV0by1hcHByb3ZhbC1ydWxlLnVwZGF0ZScsXG4gICdlY29zeXN0ZW0uYXV0by1hcHByb3ZhbC1ydWxlLmRlbGV0ZScsXG4gICdlY29zeXN0ZW0ucmVzZXJ2ZWQtbmFtZS51cGRhdGUnLFxuICAnZWNvc3lzdGVtLnNsYS51cGRhdGUnLFxuICAvLyBQdWJsaWMgcmVnaXN0cnkgbmFtZXNwYWNlIChgcHVibGljLypgKTogY29weSArIHNpZ24gKyBhdHRlc3Qgb24gcHVibGlzaCxcbiAgLy8gdGhlIHRpZXItY2hhbmdlL3N1c3BlbnNpb24gcmUtc2lnbiBqb2IsIHRhZyByZW1vdmFsIG9uIHlhbmsvdGFrZWRvd24sIGFuZFxuICAvLyB0aGUgcmV0ZW50aW9uIHN3ZWVwLlxuICAncmVnaXN0cnkuaW1hZ2UucHVibGlzaCcsXG4gICdyZWdpc3RyeS5pbWFnZS5yZXNpZ24nLFxuICAncmVnaXN0cnkuaW1hZ2UueWFuaycsXG4gICdyZWdpc3RyeS5pbWFnZS5nYycsXG4gIC8vIEluc3RhbGxzIGFuZCB0aGUgaW5zdGFsbGluZyBvcmcncyBjb25zdW1wdGlvbiBwb2xpY3kgKG9yZy1sb2NhbCkuXG4gICdwbHVnaW4uaW5zdGFsbC5yZXF1ZXN0JyxcbiAgJ3BsdWdpbi5pbnN0YWxsLmFwcHJvdmUnLFxuICAncGx1Z2luLmluc3RhbGwuZGVueScsXG4gICdwbHVnaW4uaW5zdGFsbC5jcmVhdGUnLFxuICAncGx1Z2luLmluc3RhbGwudXBncmFkZScsXG4gIC8vIEEgbWVtYmVyJ3MgcmVxdWVzdCB0byBjaGFuZ2UgYW4gaW5zdGFsbCBwYXN0IHdoYXQgdGhleSBtYXkgZG8gYWxvbmUsIGFuZCBpdHMgZGVjaXNpb24uXG4gICdwbHVnaW4uaW5zdGFsbC5jaGFuZ2UtcmVxdWVzdCcsXG4gICdwbHVnaW4uaW5zdGFsbC5jaGFuZ2UtYXBwcm92ZScsXG4gICdwbHVnaW4uaW5zdGFsbC5jaGFuZ2UtcmVqZWN0JyxcbiAgJ3BsdWdpbi5pbnN0YWxsLnJlbW92ZScsXG4gICdvcmcucGx1Z2luLWluc3RhbGwtcG9saWN5LnVwZGF0ZScsXG4gIC8vIFJldmlld3MgYW5kIHJlcGxpZXMuXG4gICdwbHVnaW4ucmV2aWV3LmNyZWF0ZScsXG4gICdwbHVnaW4ucmV2aWV3LnVwZGF0ZScsXG4gICdwbHVnaW4ucmV2aWV3LmRlbGV0ZScsXG4gICdwbHVnaW4ucmV2aWV3LnJlcG9ydCcsXG4gICdwbHVnaW4ucmV2aWV3LmhvbGQnLFxuICAncGx1Z2luLnJldmlldy5yZWxlYXNlJyxcbiAgJ3BsdWdpbi5yZXZpZXcucmVtb3ZlJyxcbiAgJ3BsdWdpbi5yZXZpZXcuYW5vbnltaXplJyxcbiAgJ3BsdWdpbi5yZXZpZXcucmVwbHkuY3JlYXRlJyxcbiAgJ3BsdWdpbi5yZXZpZXcucmVwbHkudXBkYXRlJyxcbiAgJ3BsdWdpbi5yZXZpZXcucmVwbHkuZGVsZXRlJyxcbiAgLy8gQW5vbnltb3VzIHN1Ym1pc3Npb25zLlxuICAncGx1Z2luLnN1Ym1pc3Npb24uY3JlYXRlJyxcbiAgJ3BsdWdpbi5zdWJtaXNzaW9uLnZlcmlmeScsXG4gICdwbHVnaW4uc3VibWlzc2lvbi5nYXRlLWZhaWwnLFxuICAncGx1Z2luLnN1Ym1pc3Npb24uYXBwcm92ZScsXG4gICdwbHVnaW4uc3VibWlzc2lvbi5yZWplY3QnLFxuICAncGx1Z2luLnN1Ym1pc3Npb24uY2xhaW0nLFxuICAncGx1Z2luLnN1Ym1pc3Npb24uZXhwaXJlJyxcbiAgLy8gU2VjdXJpdHkgYWR2aXNvcmllcyAocHVibGlzaC93aXRoZHJhdyBhcmUgc3lzdGVtLW9yZyBvbmx5OyB1cGRhdGUgPSBhXG4gIC8vIG1vZGVyYXRvciBlZGl0aW5nIGEgZHJhZnQgYmVmb3JlIGl0IGlzIHB1Ymxpc2hlZCkuXG4gICdwbHVnaW4uYWR2aXNvcnkuY3JlYXRlJyxcbiAgJ3BsdWdpbi5hZHZpc29yeS51cGRhdGUnLFxuICAncGx1Z2luLmFkdmlzb3J5LnB1Ymxpc2gnLFxuICAncGx1Z2luLmFkdmlzb3J5LndpdGhkcmF3JyxcbiAgLy8gUGVyLW9yZyBwbHVnaW4gc2VjdXJpdHkgbm90aWZpY2F0aW9ucyAocGx1Z2luIHNjYW4gZ2F0ZXMpOiB0aGUgc2V0dGluZ3NcbiAgLy8gKHJlY2lwaWVudHMsIGRpZ2VzdCwgd2ViaG9vaywgZXh0ZXJuYWwgYWRkcmVzcyDigJQgY2hhbmdlZCBmaWVsZCBuYW1lcyBhbmRcbiAgLy8gdGhlIHdlYmhvb2sgaG9zdCBvbmx5LCBuZXZlciB0aGUgc2VjcmV0IG9yIHRoZSBhZGRyZXNzKSwgYW4gZXh0ZXJuYWxcbiAgLy8gYWRkcmVzcyBjb25maXJtZWQgdGhyb3VnaCBpdHMgZW1haWxlZCBzaW5nbGUtdXNlIGxpbmssIGFuZCBhIHRlc3Qgc2VuZC5cbiAgJ3BsdWdpbi5zZWN1cml0eV9ub3RpZmljYXRpb25zLnVwZGF0ZScsXG4gICdwbHVnaW4uc2VjdXJpdHlfbm90aWZpY2F0aW9ucy5leHRlcm5hbF9lbWFpbC52ZXJpZnknLFxuICAncGx1Z2luLnNlY3VyaXR5X25vdGlmaWNhdGlvbnMudGVzdCcsXG5dIGFzIGNvbnN0O1xuXG5leHBvcnQgdHlwZSBSZW1vdGVBdWRpdEFjdGlvbiA9IHR5cGVvZiBSRU1PVEVfQVVESVRfQUNUSU9OU1tudW1iZXJdO1xuXG4vKiogV2hldGhlciBgdmFsdWVgIGlzIGFuIGFjdGlvbiBhIHJlbW90ZSBzZXJ2aWNlIG1heSBlbWl0ICh0aGUgaW5nZXN0IGFsbG93LWxpc3QpLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzUmVtb3RlQXVkaXRBY3Rpb24odmFsdWU6IHN0cmluZyk6IHZhbHVlIGlzIFJlbW90ZUF1ZGl0QWN0aW9uIHtcbiAgcmV0dXJuIChSRU1PVEVfQVVESVRfQUNUSU9OUyBhcyByZWFkb25seSBzdHJpbmdbXSkuaW5jbHVkZXModmFsdWUpO1xufVxuIl19

package/lib/utils/date.d.ts

@@ -0,0 +1,19 @@
+/** Date coercions for the JSON boundary. */
+/**
+ * A nullable timestamp as an ISO-8601 string, or `null` when there is no date.
+ *
+ * The shape every API response needs at the DB→JSON boundary: Postgres and
+ * Mongo hand back `Date | null`, the wire wants `string | null`, and a bare
+ * `row.x?.toISOString() ?? null` breaks the moment the driver returns a string
+ * instead (Mongo aggregation output, a `::text` cast, a cached row rehydrated
+ * from JSON). Normalizing through `new Date(d)` handles both.
+ *
+ * Falsy in, `null` out — which folds the epoch (`new Date(0)`) to `null` too.
+ * That is intentional and matches every hand-rolled copy this replaces: a
+ * zero timestamp in this codebase means "unset", never 1970.
+ *
+ * Throws `RangeError` on an unparseable string, deliberately: a malformed
+ * timestamp is a data-integrity problem, and silently serving `null` for it
+ * would hide a corrupt row behind a plausible-looking response.
+ */
+export declare const isoOrNull: (d: Date | string | number | null | undefined) => string | null;

package/lib/utils/date.js

@@ -0,0 +1,22 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/** Date coercions for the JSON boundary. */
+/**
+ * A nullable timestamp as an ISO-8601 string, or `null` when there is no date.
+ *
+ * The shape every API response needs at the DB→JSON boundary: Postgres and
+ * Mongo hand back `Date | null`, the wire wants `string | null`, and a bare
+ * `row.x?.toISOString() ?? null` breaks the moment the driver returns a string
+ * instead (Mongo aggregation output, a `::text` cast, a cached row rehydrated
+ * from JSON). Normalizing through `new Date(d)` handles both.
+ *
+ * Falsy in, `null` out — which folds the epoch (`new Date(0)`) to `null` too.
+ * That is intentional and matches every hand-rolled copy this replaces: a
+ * zero timestamp in this codebase means "unset", never 1970.
+ *
+ * Throws `RangeError` on an unparseable string, deliberately: a malformed
+ * timestamp is a data-integrity problem, and silently serving `null` for it
+ * would hide a corrupt row behind a plausible-looking response.
+ */
+export const isoOrNull = (d) => (d ? new Date(d).toISOString() : null);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9kYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsNENBQTRDO0FBRTVDOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFHLENBQUMsQ0FBNEMsRUFBaUIsRUFBRSxDQUN2RixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKiBEYXRlIGNvZXJjaW9ucyBmb3IgdGhlIEpTT04gYm91bmRhcnkuICovXG5cbi8qKlxuICogQSBudWxsYWJsZSB0aW1lc3RhbXAgYXMgYW4gSVNPLTg2MDEgc3RyaW5nLCBvciBgbnVsbGAgd2hlbiB0aGVyZSBpcyBubyBkYXRlLlxuICpcbiAqIFRoZSBzaGFwZSBldmVyeSBBUEkgcmVzcG9uc2UgbmVlZHMgYXQgdGhlIERC4oaSSlNPTiBib3VuZGFyeTogUG9zdGdyZXMgYW5kXG4gKiBNb25nbyBoYW5kIGJhY2sgYERhdGUgfCBudWxsYCwgdGhlIHdpcmUgd2FudHMgYHN0cmluZyB8IG51bGxgLCBhbmQgYSBiYXJlXG4gKiBgcm93Lng/LnRvSVNPU3RyaW5nKCkgPz8gbnVsbGAgYnJlYWtzIHRoZSBtb21lbnQgdGhlIGRyaXZlciByZXR1cm5zIGEgc3RyaW5nXG4gKiBpbnN0ZWFkIChNb25nbyBhZ2dyZWdhdGlvbiBvdXRwdXQsIGEgYDo6dGV4dGAgY2FzdCwgYSBjYWNoZWQgcm93IHJlaHlkcmF0ZWRcbiAqIGZyb20gSlNPTikuIE5vcm1hbGl6aW5nIHRocm91Z2ggYG5ldyBEYXRlKGQpYCBoYW5kbGVzIGJvdGguXG4gKlxuICogRmFsc3kgaW4sIGBudWxsYCBvdXQg4oCUIHdoaWNoIGZvbGRzIHRoZSBlcG9jaCAoYG5ldyBEYXRlKDApYCkgdG8gYG51bGxgIHRvby5cbiAqIFRoYXQgaXMgaW50ZW50aW9uYWwgYW5kIG1hdGNoZXMgZXZlcnkgaGFuZC1yb2xsZWQgY29weSB0aGlzIHJlcGxhY2VzOiBhXG4gKiB6ZXJvIHRpbWVzdGFtcCBpbiB0aGlzIGNvZGViYXNlIG1lYW5zIFwidW5zZXRcIiwgbmV2ZXIgMTk3MC5cbiAqXG4gKiBUaHJvd3MgYFJhbmdlRXJyb3JgIG9uIGFuIHVucGFyc2VhYmxlIHN0cmluZywgZGVsaWJlcmF0ZWx5OiBhIG1hbGZvcm1lZFxuICogdGltZXN0YW1wIGlzIGEgZGF0YS1pbnRlZ3JpdHkgcHJvYmxlbSwgYW5kIHNpbGVudGx5IHNlcnZpbmcgYG51bGxgIGZvciBpdFxuICogd291bGQgaGlkZSBhIGNvcnJ1cHQgcm93IGJlaGluZCBhIHBsYXVzaWJsZS1sb29raW5nIHJlc3BvbnNlLlxuICovXG5leHBvcnQgY29uc3QgaXNvT3JOdWxsID0gKGQ6IERhdGUgfCBzdHJpbmcgfCBudW1iZXIgfCBudWxsIHwgdW5kZWZpbmVkKTogc3RyaW5nIHwgbnVsbCA9PlxuICAoZCA/IG5ldyBEYXRlKGQpLnRvSVNPU3RyaW5nKCkgOiBudWxsKTtcbiJdfQ==

package/lib/utils/dsse.d.ts

@@ -0,0 +1,32 @@
+/**
+ * DSSE-envelope parsing for cosign attestation output.
+ *
+ * `cosign verify-attestation` prints one DSSE envelope per VERIFIED attestation,
+ * one JSON object per line:
+ * `{ payloadType, payload: base64(in-toto statement), signatures }`.
+ * Signature verification has already happened in cosign by the time we see this
+ * — this module only decodes what cosign vouched for.
+ *
+ * This lives in api-core because BOTH the plugin service (build-time SBOM read)
+ * and the image-registry service (registry-side signed-SBOM read) parse the same
+ * output. Two hand-copied parse loops in supply-chain verification code is a
+ * security risk, not untidiness: a fix applied to one copy silently leaves the
+ * other accepting what it should not.
+ *
+ * Callers keep their OWN not-found policy on top (throw vs. return null) —
+ * that is a per-service decision, the parse is not.
+ */
+/** in-toto predicate type for an SPDX SBOM, as cosign's `--type spdxjson` emits. */
+export declare const SPDX_PREDICATE_TYPE = "https://spdx.dev/Document";
+/**
+ * Return the predicate of the LAST envelope in `stdout` whose in-toto statement
+ * carries `predicateType`, or null when none does.
+ *
+ * LAST, not first: a rebuild re-attests the same digest and cosign lists
+ * attestations oldest-first, so the newest attestation is the final line.
+ *
+ * Lines that are not parseable envelopes are skipped rather than fatal — cosign
+ * prints nothing else on stdout today, but stray output must not turn a valid
+ * attestation into a verification failure.
+ */
+export declare function extractPredicate(stdout: string, predicateType: string): Record<string, unknown> | null;

package/lib/utils/dsse.js

@@ -0,0 +1,55 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * DSSE-envelope parsing for cosign attestation output.
+ *
+ * `cosign verify-attestation` prints one DSSE envelope per VERIFIED attestation,
+ * one JSON object per line:
+ * `{ payloadType, payload: base64(in-toto statement), signatures }`.
+ * Signature verification has already happened in cosign by the time we see this
+ * — this module only decodes what cosign vouched for.
+ *
+ * This lives in api-core because BOTH the plugin service (build-time SBOM read)
+ * and the image-registry service (registry-side signed-SBOM read) parse the same
+ * output. Two hand-copied parse loops in supply-chain verification code is a
+ * security risk, not untidiness: a fix applied to one copy silently leaves the
+ * other accepting what it should not.
+ *
+ * Callers keep their OWN not-found policy on top (throw vs. return null) —
+ * that is a per-service decision, the parse is not.
+ */
+/** in-toto predicate type for an SPDX SBOM, as cosign's `--type spdxjson` emits. */
+export const SPDX_PREDICATE_TYPE = 'https://spdx.dev/Document';
+/**
+ * Return the predicate of the LAST envelope in `stdout` whose in-toto statement
+ * carries `predicateType`, or null when none does.
+ *
+ * LAST, not first: a rebuild re-attests the same digest and cosign lists
+ * attestations oldest-first, so the newest attestation is the final line.
+ *
+ * Lines that are not parseable envelopes are skipped rather than fatal — cosign
+ * prints nothing else on stdout today, but stray output must not turn a valid
+ * attestation into a verification failure.
+ */
+export function extractPredicate(stdout, predicateType) {
+    let predicate = null;
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        try {
+            const envelope = JSON.parse(trimmed);
+            if (!envelope.payload)
+                continue;
+            const statement = JSON.parse(Buffer.from(envelope.payload, 'base64').toString('utf-8'));
+            if (statement.predicateType === predicateType && statement.predicate && typeof statement.predicate === 'object') {
+                predicate = statement.predicate;
+            }
+        }
+        catch {
+            // Not an envelope line.
+        }
+    }
+    return predicate;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZHNzZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9kc3NlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBaUJHO0FBRUgsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLDJCQUEyQixDQUFDO0FBRS9EOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLFVBQVUsZ0JBQWdCLENBQUMsTUFBYyxFQUFFLGFBQXFCO0lBQ3BFLElBQUksU0FBUyxHQUFtQyxJQUFJLENBQUM7SUFDckQsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQzVCLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUFFLFNBQVM7UUFDdkMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQXlCLENBQUM7WUFDN0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPO2dCQUFFLFNBQVM7WUFDaEMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUdyRixDQUFDO1lBQ0YsSUFBSSxTQUFTLENBQUMsYUFBYSxLQUFLLGFBQWEsSUFBSSxTQUFTLENBQUMsU0FBUyxJQUFJLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDaEgsU0FBUyxHQUFHLFNBQVMsQ0FBQyxTQUFvQyxDQUFDO1lBQzdELENBQUM7UUFDSCxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1Asd0JBQXdCO1FBQzFCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIERTU0UtZW52ZWxvcGUgcGFyc2luZyBmb3IgY29zaWduIGF0dGVzdGF0aW9uIG91dHB1dC5cbiAqXG4gKiBgY29zaWduIHZlcmlmeS1hdHRlc3RhdGlvbmAgcHJpbnRzIG9uZSBEU1NFIGVudmVsb3BlIHBlciBWRVJJRklFRCBhdHRlc3RhdGlvbixcbiAqIG9uZSBKU09OIG9iamVjdCBwZXIgbGluZTpcbiAqIGB7IHBheWxvYWRUeXBlLCBwYXlsb2FkOiBiYXNlNjQoaW4tdG90byBzdGF0ZW1lbnQpLCBzaWduYXR1cmVzIH1gLlxuICogU2lnbmF0dXJlIHZlcmlmaWNhdGlvbiBoYXMgYWxyZWFkeSBoYXBwZW5lZCBpbiBjb3NpZ24gYnkgdGhlIHRpbWUgd2Ugc2VlIHRoaXNcbiAqIOKAlCB0aGlzIG1vZHVsZSBvbmx5IGRlY29kZXMgd2hhdCBjb3NpZ24gdm91Y2hlZCBmb3IuXG4gKlxuICogVGhpcyBsaXZlcyBpbiBhcGktY29yZSBiZWNhdXNlIEJPVEggdGhlIHBsdWdpbiBzZXJ2aWNlIChidWlsZC10aW1lIFNCT00gcmVhZClcbiAqIGFuZCB0aGUgaW1hZ2UtcmVnaXN0cnkgc2VydmljZSAocmVnaXN0cnktc2lkZSBzaWduZWQtU0JPTSByZWFkKSBwYXJzZSB0aGUgc2FtZVxuICogb3V0cHV0LiBUd28gaGFuZC1jb3BpZWQgcGFyc2UgbG9vcHMgaW4gc3VwcGx5LWNoYWluIHZlcmlmaWNhdGlvbiBjb2RlIGlzIGFcbiAqIHNlY3VyaXR5IHJpc2ssIG5vdCB1bnRpZGluZXNzOiBhIGZpeCBhcHBsaWVkIHRvIG9uZSBjb3B5IHNpbGVudGx5IGxlYXZlcyB0aGVcbiAqIG90aGVyIGFjY2VwdGluZyB3aGF0IGl0IHNob3VsZCBub3QuXG4gKlxuICogQ2FsbGVycyBrZWVwIHRoZWlyIE9XTiBub3QtZm91bmQgcG9saWN5IG9uIHRvcCAodGhyb3cgdnMuIHJldHVybiBudWxsKSDigJRcbiAqIHRoYXQgaXMgYSBwZXItc2VydmljZSBkZWNpc2lvbiwgdGhlIHBhcnNlIGlzIG5vdC5cbiAqL1xuXG4vKiogaW4tdG90byBwcmVkaWNhdGUgdHlwZSBmb3IgYW4gU1BEWCBTQk9NLCBhcyBjb3NpZ24ncyBgLS10eXBlIHNwZHhqc29uYCBlbWl0cy4gKi9cbmV4cG9ydCBjb25zdCBTUERYX1BSRURJQ0FURV9UWVBFID0gJ2h0dHBzOi8vc3BkeC5kZXYvRG9jdW1lbnQnO1xuXG4vKipcbiAqIFJldHVybiB0aGUgcHJlZGljYXRlIG9mIHRoZSBMQVNUIGVudmVsb3BlIGluIGBzdGRvdXRgIHdob3NlIGluLXRvdG8gc3RhdGVtZW50XG4gKiBjYXJyaWVzIGBwcmVkaWNhdGVUeXBlYCwgb3IgbnVsbCB3aGVuIG5vbmUgZG9lcy5cbiAqXG4gKiBMQVNULCBub3QgZmlyc3Q6IGEgcmVidWlsZCByZS1hdHRlc3RzIHRoZSBzYW1lIGRpZ2VzdCBhbmQgY29zaWduIGxpc3RzXG4gKiBhdHRlc3RhdGlvbnMgb2xkZXN0LWZpcnN0LCBzbyB0aGUgbmV3ZXN0IGF0dGVzdGF0aW9uIGlzIHRoZSBmaW5hbCBsaW5lLlxuICpcbiAqIExpbmVzIHRoYXQgYXJlIG5vdCBwYXJzZWFibGUgZW52ZWxvcGVzIGFyZSBza2lwcGVkIHJhdGhlciB0aGFuIGZhdGFsIOKAlCBjb3NpZ25cbiAqIHByaW50cyBub3RoaW5nIGVsc2Ugb24gc3Rkb3V0IHRvZGF5LCBidXQgc3RyYXkgb3V0cHV0IG11c3Qgbm90IHR1cm4gYSB2YWxpZFxuICogYXR0ZXN0YXRpb24gaW50byBhIHZlcmlmaWNhdGlvbiBmYWlsdXJlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZXh0cmFjdFByZWRpY2F0ZShzdGRvdXQ6IHN0cmluZywgcHJlZGljYXRlVHlwZTogc3RyaW5nKTogUmVjb3JkPHN0cmluZywgdW5rbm93bj4gfCBudWxsIHtcbiAgbGV0IHByZWRpY2F0ZTogUmVjb3JkPHN0cmluZywgdW5rbm93bj4gfCBudWxsID0gbnVsbDtcbiAgZm9yIChjb25zdCBsaW5lIG9mIHN0ZG91dC5zcGxpdCgnXFxuJykpIHtcbiAgICBjb25zdCB0cmltbWVkID0gbGluZS50cmltKCk7XG4gICAgaWYgKCF0cmltbWVkLnN0YXJ0c1dpdGgoJ3snKSkgY29udGludWU7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IGVudmVsb3BlID0gSlNPTi5wYXJzZSh0cmltbWVkKSBhcyB7IHBheWxvYWQ/OiBzdHJpbmcgfTtcbiAgICAgIGlmICghZW52ZWxvcGUucGF5bG9hZCkgY29udGludWU7XG4gICAgICBjb25zdCBzdGF0ZW1lbnQgPSBKU09OLnBhcnNlKEJ1ZmZlci5mcm9tKGVudmVsb3BlLnBheWxvYWQsICdiYXNlNjQnKS50b1N0cmluZygndXRmLTgnKSkgYXMge1xuICAgICAgICBwcmVkaWNhdGVUeXBlPzogc3RyaW5nO1xuICAgICAgICBwcmVkaWNhdGU/OiB1bmtub3duO1xuICAgICAgfTtcbiAgICAgIGlmIChzdGF0ZW1lbnQucHJlZGljYXRlVHlwZSA9PT0gcHJlZGljYXRlVHlwZSAmJiBzdGF0ZW1lbnQucHJlZGljYXRlICYmIHR5cGVvZiBzdGF0ZW1lbnQucHJlZGljYXRlID09PSAnb2JqZWN0Jykge1xuICAgICAgICBwcmVkaWNhdGUgPSBzdGF0ZW1lbnQucHJlZGljYXRlIGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+O1xuICAgICAgfVxuICAgIH0gY2F0Y2gge1xuICAgICAgLy8gTm90IGFuIGVudmVsb3BlIGxpbmUuXG4gICAgfVxuICB9XG4gIHJldHVybiBwcmVkaWNhdGU7XG59XG4iXX0=

package/lib/utils/index.d.ts

@@ -3,13 +3,14 @@ export * from './api-key.js';
 export * from './safe-require.js';
 export * from './secure-compare.js';
 export * from './crash-handlers.js';
-export { sendSuccess, sendError, sendQuotaExceeded, sendPaginatedNested, extractDbError, errorMessage, sendBadRequest, sendInternalError, parsePaginationParams, parseSort, type PaginationParams, type SortParams, } from './response.js';
+export { sendSuccess, sendError, sendQuotaExceeded, sendPaginatedNested, paginationMeta, type PaginationMeta, extractDbError, errorMessage, sendBadRequest, sendInternalError, parsePaginationParams, type PaginationParams, type SortParams, } from './response.js';
 export { getParam, parseQueryInt, parseQueryString, parseOptionalDate, parsePositiveInt, parseQueryIntClamped, parsePage, validateBulkArray, parseReportInterval, parseDateRange, type Page, REPORT_INTERVALS, } from './params.js';
 export * from './headers.js';
 export * from './identity.js';
 export { USER_TOKEN_ALGORITHM, USER_TOKEN_CURVE, JWKS_PATH, decodeJwtHeader, isJwksDocument, publicJwkFrom, derToJoseSignature, encodeJwsSigningInput, compactJws, } from './jwk.js';
 export type { PublicJwk, JwksDocument, } from './jwk.js';
 export * from './object.js';
+export * from './date.js';
 export { resetSupportAliasesCache, getPrimarySupportAlias, getAllSupportAliases, resolveRecipientAlias, DEFAULT_SUPPORT_ALIAS, } from './alias-resolver.js';
 export * from './concurrency.js';
 export * from './audit.js';
@@ -17,6 +18,7 @@ export { getDefaultKeyProvider, resetDefaultKeyProvider, setKeyProvider, encrypt
 export * from './secret-rotation.js';
 export { setCounterEmitter, resetCounterEmitter, emitCounter, } from './metric-emitter.js';
 export * from './aws-scrub.js';
+export { extractPredicate, SPDX_PREDICATE_TYPE, } from './dsse.js';
 export { maskLine, looksSensitive, REDACTED, SENSITIVE_VALUE_PATTERNS, } from './sensitive-patterns.js';
 export { isPrivateAddress, assertSafeUrl, safeFetch, type SafeFetchResponse, } from './ssrf.js';
 export * from './env.js';

package/lib/utils/index.js

@@ -5,7 +5,7 @@ export * from './api-key.js';
 export * from './safe-require.js';
 export * from './secure-compare.js';
 export * from './crash-handlers.js';
-export { sendSuccess, sendError, sendQuotaExceeded, sendPaginatedNested, extractDbError, errorMessage, sendBadRequest, sendInternalError, parsePaginationParams, parseSort, } from './response.js';
+export { sendSuccess, sendError, sendQuotaExceeded, sendPaginatedNested, paginationMeta, extractDbError, errorMessage, sendBadRequest, sendInternalError, parsePaginationParams, } from './response.js';
 export { getParam, parseQueryInt, parseQueryString, parseOptionalDate, parsePositiveInt, parseQueryIntClamped, parsePage, validateBulkArray, parseReportInterval, parseDateRange, REPORT_INTERVALS, } from './params.js';
 export * from './headers.js';
 export * from './identity.js';
@@ -16,6 +16,7 @@ export * from './identity.js';
 // leaking them to every service.
 export { USER_TOKEN_ALGORITHM, USER_TOKEN_CURVE, JWKS_PATH, decodeJwtHeader, isJwksDocument, publicJwkFrom, derToJoseSignature, encodeJwsSigningInput, compactJws, } from './jwk.js';
 export * from './object.js';
+export * from './date.js';
 export { resetSupportAliasesCache, getPrimarySupportAlias, getAllSupportAliases, resolveRecipientAlias, DEFAULT_SUPPORT_ALIAS, } from './alias-resolver.js';
 export * from './concurrency.js';
 export * from './audit.js';
@@ -23,6 +24,7 @@ export { getDefaultKeyProvider, resetDefaultKeyProvider, setKeyProvider, encrypt
 export * from './secret-rotation.js';
 export { setCounterEmitter, resetCounterEmitter, emitCounter, } from './metric-emitter.js';
 export * from './aws-scrub.js';
+export { extractPredicate, SPDX_PREDICATE_TYPE, } from './dsse.js';
 export { maskLine, looksSensitive, REDACTED, SENSITIVE_VALUE_PATTERNS, } from './sensitive-patterns.js';
 export { isPrivateAddress, assertSafeUrl, safeFetch, } from './ssrf.js';
 export * from './env.js';
@@ -30,4 +32,4 @@ export * from './service-registry.js';
 export * from './retention.js';
 export * from './compliance-attributes.js';
 export { leadingZeroBits, proofOfWorkHash, challengeKey, clampDifficulty, createProofOfWorkChallenge, parseProofOfWorkChallenge, verifyProofOfWork, solveProofOfWork, POW_DEFAULT_DIFFICULTY, POW_MAX_DIFFICULTY, POW_CHALLENGE_TTL_MS, } from './proof-of-work.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLGVBQWUsRUFDZixZQUFZLEVBRVosTUFBTSxFQUNOLE9BQU8sR0FDUixNQUFNLGFBQWEsQ0FBQztBQUNyQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxPQUFPLEVBQ0wsV0FBVyxFQUNYLFNBQVMsRUFDVCxpQkFBaUIsRUFDakIsbUJBQW1CLEVBQ25CLGNBQWMsRUFDZCxZQUFZLEVBQ1osY0FBYyxFQUNkLGlCQUFpQixFQUNqQixxQkFBcUIsRUFDckIsU0FBUyxHQUdWLE1BQU0sZUFBZSxDQUFDO0FBQ3ZCLE9BQU8sRUFDTCxRQUFRLEVBQ1IsYUFBYSxFQUNiLGdCQUFnQixFQUNoQixpQkFBaUIsRUFDakIsZ0JBQWdCLEVBQ2hCLG9CQUFvQixFQUNwQixTQUFTLEVBQ1QsaUJBQWlCLEVBQ2pCLG1CQUFtQixFQUNuQixjQUFjLEVBRWQsZ0JBQWdCLEdBQ2pCLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLHlFQUF5RTtBQUN6RSxtRUFBbUU7QUFDbkUseUVBQXlFO0FBQ3pFLDhFQUE4RTtBQUM5RSxpQ0FBaUM7QUFDakMsT0FBTyxFQUNMLG9CQUFvQixFQUNwQixnQkFBZ0IsRUFDaEIsU0FBUyxFQUNULGVBQWUsRUFDZixjQUFjLEVBQ2QsYUFBYSxFQUNiLGtCQUFrQixFQUNsQixxQkFBcUIsRUFDckIsVUFBVSxHQUNYLE1BQU0sVUFBVSxDQUFDO0FBS2xCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLE9BQU8sRUFDTCx3QkFBd0IsRUFDeEIsc0JBQXNCLEVBQ3RCLG9CQUFvQixFQUNwQixxQkFBcUIsRUFDckIscUJBQXFCLEdBQ3RCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLFlBQVksQ0FBQztBQUMzQixPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLHVCQUF1QixFQUN2QixjQUFjLEVBQ2QsYUFBYSxFQUNiLGFBQWEsRUFDYixlQUFlLEVBR2YsY0FBYyxFQUNkLGNBQWMsRUFHZCxvQkFBb0IsR0FDckIsTUFBTSx3QkFBd0IsQ0FBQztBQUNoQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLE9BQU8sRUFDTCxpQkFBaUIsRUFDakIsbUJBQW1CLEVBQ25CLFdBQVcsR0FDWixNQUFNLHFCQUFxQixDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsT0FBTyxFQUNMLFFBQVEsRUFDUixjQUFjLEVBQ2QsUUFBUSxFQUNSLHdCQUF3QixHQUN6QixNQUFNLHlCQUF5QixDQUFDO0FBQ2pDLE9BQU8sRUFDTCxnQkFBZ0IsRUFDaEIsYUFBYSxFQUNiLFNBQVMsR0FFVixNQUFNLFdBQVcsQ0FBQztBQUNuQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxPQUFPLEVBQ0wsZUFBZSxFQUNmLGVBQWUsRUFDZixZQUFZLEVBQ1osZUFBZSxFQUNmLDBCQUEwQixFQUMxQix5QkFBeUIsRUFDekIsaUJBQWlCLEVBQ2pCLGdCQUFnQixFQUNoQixzQkFBc0IsRUFDdEIsa0JBQWtCLEVBQ2xCLG9CQUFvQixHQUdyQixNQUFNLG9CQUFvQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmV4cG9ydCB7XG4gIHNldExvZ0NvbnRleHRQcm92aWRlcixcbiAgcmVkYWN0U2Vuc2l0aXZlLFxuICBjcmVhdGVMb2dnZXIsXG4gIHR5cGUgTG9nZ2VyLFxuICBsb2dnZXIsXG4gIGRlZmF1bHQsXG59IGZyb20gJy4vbG9nZ2VyLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vYXBpLWtleS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NhZmUtcmVxdWlyZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NlY3VyZS1jb21wYXJlLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY3Jhc2gtaGFuZGxlcnMuanMnO1xuZXhwb3J0IHtcbiAgc2VuZFN1Y2Nlc3MsXG4gIHNlbmRFcnJvcixcbiAgc2VuZFF1b3RhRXhjZWVkZWQsXG4gIHNlbmRQYWdpbmF0ZWROZXN0ZWQsXG4gIGV4dHJhY3REYkVycm9yLFxuICBlcnJvck1lc3NhZ2UsXG4gIHNlbmRCYWRSZXF1ZXN0LFxuICBzZW5kSW50ZXJuYWxFcnJvcixcbiAgcGFyc2VQYWdpbmF0aW9uUGFyYW1zLFxuICBwYXJzZVNvcnQsXG4gIHR5cGUgUGFnaW5hdGlvblBhcmFtcyxcbiAgdHlwZSBTb3J0UGFyYW1zLFxufSBmcm9tICcuL3Jlc3BvbnNlLmpzJztcbmV4cG9ydCB7XG4gIGdldFBhcmFtLFxuICBwYXJzZVF1ZXJ5SW50LFxuICBwYXJzZVF1ZXJ5U3RyaW5nLFxuICBwYXJzZU9wdGlvbmFsRGF0ZSxcbiAgcGFyc2VQb3NpdGl2ZUludCxcbiAgcGFyc2VRdWVyeUludENsYW1wZWQsXG4gIHBhcnNlUGFnZSxcbiAgdmFsaWRhdGVCdWxrQXJyYXksXG4gIHBhcnNlUmVwb3J0SW50ZXJ2YWwsXG4gIHBhcnNlRGF0ZVJhbmdlLFxuICB0eXBlIFBhZ2UsXG4gIFJFUE9SVF9JTlRFUlZBTFMsXG59IGZyb20gJy4vcGFyYW1zLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vaGVhZGVycy5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2lkZW50aXR5LmpzJztcbi8vIEpXSyBwcmltaXRpdmVzLiBQbGF0Zm9ybSBJUyB0aGUgdG9rZW4gc2lnbmVyLCBzbyBpdCBsZWdpdGltYXRlbHkgbmVlZHNcbi8vIGBwdWJsaWNKd2tGcm9tYCArIGBkZXJUb0pvc2VTaWduYXR1cmVgIGZyb20gdGhlIHBhY2thZ2Ugc3VyZmFjZS5cbi8vIGBqd2tUaHVtYnByaW50YCBhbmQgYHB1YmxpY0tleUZyb21Kd2tgIGFyZSBraWQtZGVyaXZhdGlvbi92ZXJpZmljYXRpb25cbi8vIHBsdW1iaW5nIHVzZWQgb25seSBpbnNpZGUgYXBpLWNvcmUg4oCUIGRlZXAtaW1wb3J0IHRoZW0gZnJvbSB0aGVyZSBpbnN0ZWFkIG9mXG4vLyBsZWFraW5nIHRoZW0gdG8gZXZlcnkgc2VydmljZS5cbmV4cG9ydCB7XG4gIFVTRVJfVE9LRU5fQUxHT1JJVEhNLFxuICBVU0VSX1RPS0VOX0NVUlZFLFxuICBKV0tTX1BBVEgsXG4gIGRlY29kZUp3dEhlYWRlcixcbiAgaXNKd2tzRG9jdW1lbnQsXG4gIHB1YmxpY0p3a0Zyb20sXG4gIGRlclRvSm9zZVNpZ25hdHVyZSxcbiAgZW5jb2RlSndzU2lnbmluZ0lucHV0LFxuICBjb21wYWN0SndzLFxufSBmcm9tICcuL2p3ay5qcyc7XG5leHBvcnQgdHlwZSB7XG4gIFB1YmxpY0p3ayxcbiAgSndrc0RvY3VtZW50LFxufSBmcm9tICcuL2p3ay5qcyc7XG5leHBvcnQgKiBmcm9tICcuL29iamVjdC5qcyc7XG5leHBvcnQge1xuICByZXNldFN1cHBvcnRBbGlhc2VzQ2FjaGUsXG4gIGdldFByaW1hcnlTdXBwb3J0QWxpYXMsXG4gIGdldEFsbFN1cHBvcnRBbGlhc2VzLFxuICByZXNvbHZlUmVjaXBpZW50QWxpYXMsXG4gIERFRkFVTFRfU1VQUE9SVF9BTElBUyxcbn0gZnJvbSAnLi9hbGlhcy1yZXNvbHZlci5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2NvbmN1cnJlbmN5LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vYXVkaXQuanMnO1xuZXhwb3J0IHtcbiAgZ2V0RGVmYXVsdEtleVByb3ZpZGVyLFxuICByZXNldERlZmF1bHRLZXlQcm92aWRlcixcbiAgc2V0S2V5UHJvdmlkZXIsXG4gIGVuY3J5cHRTZWNyZXQsXG4gIGRlY3J5cHRTZWNyZXQsXG4gIGlzRW5jcnlwdGVkQmxvYixcbiAgdHlwZSBFbmNyeXB0ZWRCbG9iLFxuICB0eXBlIEtleVByb3ZpZGVyLFxuICBFbnZLZXlQcm92aWRlcixcbiAgS21zS2V5UHJvdmlkZXIsXG4gIHR5cGUgUGVyT3JnS21zQ29uZmlnLFxuICB0eXBlIFBlck9yZ0ttc1Jlc29sdmVyLFxuICBQZXJPcmdLbXNLZXlQcm92aWRlcixcbn0gZnJvbSAnLi9zZWNyZXQtZW5jcnlwdGlvbi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NlY3JldC1yb3RhdGlvbi5qcyc7XG5leHBvcnQge1xuICBzZXRDb3VudGVyRW1pdHRlcixcbiAgcmVzZXRDb3VudGVyRW1pdHRlcixcbiAgZW1pdENvdW50ZXIsXG59IGZyb20gJy4vbWV0cmljLWVtaXR0ZXIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9hd3Mtc2NydWIuanMnO1xuZXhwb3J0IHtcbiAgbWFza0xpbmUsXG4gIGxvb2tzU2Vuc2l0aXZlLFxuICBSRURBQ1RFRCxcbiAgU0VOU0lUSVZFX1ZBTFVFX1BBVFRFUk5TLFxufSBmcm9tICcuL3NlbnNpdGl2ZS1wYXR0ZXJucy5qcyc7XG5leHBvcnQge1xuICBpc1ByaXZhdGVBZGRyZXNzLFxuICBhc3NlcnRTYWZlVXJsLFxuICBzYWZlRmV0Y2gsXG4gIHR5cGUgU2FmZUZldGNoUmVzcG9uc2UsXG59IGZyb20gJy4vc3NyZi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2Vudi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NlcnZpY2UtcmVnaXN0cnkuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9yZXRlbnRpb24uanMnO1xuZXhwb3J0ICogZnJvbSAnLi9jb21wbGlhbmNlLWF0dHJpYnV0ZXMuanMnO1xuZXhwb3J0IHtcbiAgbGVhZGluZ1plcm9CaXRzLFxuICBwcm9vZk9mV29ya0hhc2gsXG4gIGNoYWxsZW5nZUtleSxcbiAgY2xhbXBEaWZmaWN1bHR5LFxuICBjcmVhdGVQcm9vZk9mV29ya0NoYWxsZW5nZSxcbiAgcGFyc2VQcm9vZk9mV29ya0NoYWxsZW5nZSxcbiAgdmVyaWZ5UHJvb2ZPZldvcmssXG4gIHNvbHZlUHJvb2ZPZldvcmssXG4gIFBPV19ERUZBVUxUX0RJRkZJQ1VMVFksXG4gIFBPV19NQVhfRElGRklDVUxUWSxcbiAgUE9XX0NIQUxMRU5HRV9UVExfTVMsXG4gIHR5cGUgUHJvb2ZPZldvcmtDaGFsbGVuZ2UsXG4gIHR5cGUgUHJvb2ZPZldvcmtTb2x1dGlvbixcbn0gZnJvbSAnLi9wcm9vZi1vZi13b3JrLmpzJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLGVBQWUsRUFDZixZQUFZLEVBRVosTUFBTSxFQUNOLE9BQU8sR0FDUixNQUFNLGFBQWEsQ0FBQztBQUNyQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxPQUFPLEVBQ0wsV0FBVyxFQUNYLFNBQVMsRUFDVCxpQkFBaUIsRUFDakIsbUJBQW1CLEVBQ25CLGNBQWMsRUFFZCxjQUFjLEVBQ2QsWUFBWSxFQUNaLGNBQWMsRUFDZCxpQkFBaUIsRUFDakIscUJBQXFCLEdBR3RCLE1BQU0sZUFBZSxDQUFDO0FBQ3ZCLE9BQU8sRUFDTCxRQUFRLEVBQ1IsYUFBYSxFQUNiLGdCQUFnQixFQUNoQixpQkFBaUIsRUFDakIsZ0JBQWdCLEVBQ2hCLG9CQUFvQixFQUNwQixTQUFTLEVBQ1QsaUJBQWlCLEVBQ2pCLG1CQUFtQixFQUNuQixjQUFjLEVBRWQsZ0JBQWdCLEdBQ2pCLE1BQU0sYUFBYSxDQUFDO0FBQ3JCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLHlFQUF5RTtBQUN6RSxtRUFBbUU7QUFDbkUseUVBQXlFO0FBQ3pFLDhFQUE4RTtBQUM5RSxpQ0FBaUM7QUFDakMsT0FBTyxFQUNMLG9CQUFvQixFQUNwQixnQkFBZ0IsRUFDaEIsU0FBUyxFQUNULGVBQWUsRUFDZixjQUFjLEVBQ2QsYUFBYSxFQUNiLGtCQUFrQixFQUNsQixxQkFBcUIsRUFDckIsVUFBVSxHQUNYLE1BQU0sVUFBVSxDQUFDO0FBS2xCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLE9BQU8sRUFDTCx3QkFBd0IsRUFDeEIsc0JBQXNCLEVBQ3RCLG9CQUFvQixFQUNwQixxQkFBcUIsRUFDckIscUJBQXFCLEdBQ3RCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLFlBQVksQ0FBQztBQUMzQixPQUFPLEVBQ0wscUJBQXFCLEVBQ3JCLHVCQUF1QixFQUN2QixjQUFjLEVBQ2QsYUFBYSxFQUNiLGFBQWEsRUFDYixlQUFlLEVBR2YsY0FBYyxFQUNkLGNBQWMsRUFHZCxvQkFBb0IsR0FDckIsTUFBTSx3QkFBd0IsQ0FBQztBQUNoQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLE9BQU8sRUFDTCxpQkFBaUIsRUFDakIsbUJBQW1CLEVBQ25CLFdBQVcsR0FDWixNQUFNLHFCQUFxQixDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsT0FBTyxFQUNMLGdCQUFnQixFQUNoQixtQkFBbUIsR0FDcEIsTUFBTSxXQUFXLENBQUM7QUFDbkIsT0FBTyxFQUNMLFFBQVEsRUFDUixjQUFjLEVBQ2QsUUFBUSxFQUNSLHdCQUF3QixHQUN6QixNQUFNLHlCQUF5QixDQUFDO0FBQ2pDLE9BQU8sRUFDTCxnQkFBZ0IsRUFDaEIsYUFBYSxFQUNiLFNBQVMsR0FFVixNQUFNLFdBQVcsQ0FBQztBQUNuQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxPQUFPLEVBQ0wsZUFBZSxFQUNmLGVBQWUsRUFDZixZQUFZLEVBQ1osZUFBZSxFQUNmLDBCQUEwQixFQUMxQix5QkFBeUIsRUFDekIsaUJBQWlCLEVBQ2pCLGdCQUFnQixFQUNoQixzQkFBc0IsRUFDdEIsa0JBQWtCLEVBQ2xCLG9CQUFvQixHQUdyQixNQUFNLG9CQUFvQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmV4cG9ydCB7XG4gIHNldExvZ0NvbnRleHRQcm92aWRlcixcbiAgcmVkYWN0U2Vuc2l0aXZlLFxuICBjcmVhdGVMb2dnZXIsXG4gIHR5cGUgTG9nZ2VyLFxuICBsb2dnZXIsXG4gIGRlZmF1bHQsXG59IGZyb20gJy4vbG9nZ2VyLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vYXBpLWtleS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NhZmUtcmVxdWlyZS5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NlY3VyZS1jb21wYXJlLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY3Jhc2gtaGFuZGxlcnMuanMnO1xuZXhwb3J0IHtcbiAgc2VuZFN1Y2Nlc3MsXG4gIHNlbmRFcnJvcixcbiAgc2VuZFF1b3RhRXhjZWVkZWQsXG4gIHNlbmRQYWdpbmF0ZWROZXN0ZWQsXG4gIHBhZ2luYXRpb25NZXRhLFxuICB0eXBlIFBhZ2luYXRpb25NZXRhLFxuICBleHRyYWN0RGJFcnJvcixcbiAgZXJyb3JNZXNzYWdlLFxuICBzZW5kQmFkUmVxdWVzdCxcbiAgc2VuZEludGVybmFsRXJyb3IsXG4gIHBhcnNlUGFnaW5hdGlvblBhcmFtcyxcbiAgdHlwZSBQYWdpbmF0aW9uUGFyYW1zLFxuICB0eXBlIFNvcnRQYXJhbXMsXG59IGZyb20gJy4vcmVzcG9uc2UuanMnO1xuZXhwb3J0IHtcbiAgZ2V0UGFyYW0sXG4gIHBhcnNlUXVlcnlJbnQsXG4gIHBhcnNlUXVlcnlTdHJpbmcsXG4gIHBhcnNlT3B0aW9uYWxEYXRlLFxuICBwYXJzZVBvc2l0aXZlSW50LFxuICBwYXJzZVF1ZXJ5SW50Q2xhbXBlZCxcbiAgcGFyc2VQYWdlLFxuICB2YWxpZGF0ZUJ1bGtBcnJheSxcbiAgcGFyc2VSZXBvcnRJbnRlcnZhbCxcbiAgcGFyc2VEYXRlUmFuZ2UsXG4gIHR5cGUgUGFnZSxcbiAgUkVQT1JUX0lOVEVSVkFMUyxcbn0gZnJvbSAnLi9wYXJhbXMuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9oZWFkZXJzLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vaWRlbnRpdHkuanMnO1xuLy8gSldLIHByaW1pdGl2ZXMuIFBsYXRmb3JtIElTIHRoZSB0b2tlbiBzaWduZXIsIHNvIGl0IGxlZ2l0aW1hdGVseSBuZWVkc1xuLy8gYHB1YmxpY0p3a0Zyb21gICsgYGRlclRvSm9zZVNpZ25hdHVyZWAgZnJvbSB0aGUgcGFja2FnZSBzdXJmYWNlLlxuLy8gYGp3a1RodW1icHJpbnRgIGFuZCBgcHVibGljS2V5RnJvbUp3a2AgYXJlIGtpZC1kZXJpdmF0aW9uL3ZlcmlmaWNhdGlvblxuLy8gcGx1bWJpbmcgdXNlZCBvbmx5IGluc2lkZSBhcGktY29yZSDigJQgZGVlcC1pbXBvcnQgdGhlbSBmcm9tIHRoZXJlIGluc3RlYWQgb2Zcbi8vIGxlYWtpbmcgdGhlbSB0byBldmVyeSBzZXJ2aWNlLlxuZXhwb3J0IHtcbiAgVVNFUl9UT0tFTl9BTEdPUklUSE0sXG4gIFVTRVJfVE9LRU5fQ1VSVkUsXG4gIEpXS1NfUEFUSCxcbiAgZGVjb2RlSnd0SGVhZGVyLFxuICBpc0p3a3NEb2N1bWVudCxcbiAgcHVibGljSndrRnJvbSxcbiAgZGVyVG9Kb3NlU2lnbmF0dXJlLFxuICBlbmNvZGVKd3NTaWduaW5nSW5wdXQsXG4gIGNvbXBhY3RKd3MsXG59IGZyb20gJy4vandrLmpzJztcbmV4cG9ydCB0eXBlIHtcbiAgUHVibGljSndrLFxuICBKd2tzRG9jdW1lbnQsXG59IGZyb20gJy4vandrLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vb2JqZWN0LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vZGF0ZS5qcyc7XG5leHBvcnQge1xuICByZXNldFN1cHBvcnRBbGlhc2VzQ2FjaGUsXG4gIGdldFByaW1hcnlTdXBwb3J0QWxpYXMsXG4gIGdldEFsbFN1cHBvcnRBbGlhc2VzLFxuICByZXNvbHZlUmVjaXBpZW50QWxpYXMsXG4gIERFRkFVTFRfU1VQUE9SVF9BTElBUyxcbn0gZnJvbSAnLi9hbGlhcy1yZXNvbHZlci5qcyc7XG5leHBvcnQgKiBmcm9tICcuL2NvbmN1cnJlbmN5LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vYXVkaXQuanMnO1xuZXhwb3J0IHtcbiAgZ2V0RGVmYXVsdEtleVByb3ZpZGVyLFxuICByZXNldERlZmF1bHRLZXlQcm92aWRlcixcbiAgc2V0S2V5UHJvdmlkZXIsXG4gIGVuY3J5cHRTZWNyZXQsXG4gIGRlY3J5cHRTZWNyZXQsXG4gIGlzRW5jcnlwdGVkQmxvYixcbiAgdHlwZSBFbmNyeXB0ZWRCbG9iLFxuICB0eXBlIEtleVByb3ZpZGVyLFxuICBFbnZLZXlQcm92aWRlcixcbiAgS21zS2V5UHJvdmlkZXIsXG4gIHR5cGUgUGVyT3JnS21zQ29uZmlnLFxuICB0eXBlIFBlck9yZ0ttc1Jlc29sdmVyLFxuICBQZXJPcmdLbXNLZXlQcm92aWRlcixcbn0gZnJvbSAnLi9zZWNyZXQtZW5jcnlwdGlvbi5qcyc7XG5leHBvcnQgKiBmcm9tICcuL3NlY3JldC1yb3RhdGlvbi5qcyc7XG5leHBvcnQge1xuICBzZXRDb3VudGVyRW1pdHRlcixcbiAgcmVzZXRDb3VudGVyRW1pdHRlcixcbiAgZW1pdENvdW50ZXIsXG59IGZyb20gJy4vbWV0cmljLWVtaXR0ZXIuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9hd3Mtc2NydWIuanMnO1xuZXhwb3J0IHtcbiAgZXh0cmFjdFByZWRpY2F0ZSxcbiAgU1BEWF9QUkVESUNBVEVfVFlQRSxcbn0gZnJvbSAnLi9kc3NlLmpzJztcbmV4cG9ydCB7XG4gIG1hc2tMaW5lLFxuICBsb29rc1NlbnNpdGl2ZSxcbiAgUkVEQUNURUQsXG4gIFNFTlNJVElWRV9WQUxVRV9QQVRURVJOUyxcbn0gZnJvbSAnLi9zZW5zaXRpdmUtcGF0dGVybnMuanMnO1xuZXhwb3J0IHtcbiAgaXNQcml2YXRlQWRkcmVzcyxcbiAgYXNzZXJ0U2FmZVVybCxcbiAgc2FmZUZldGNoLFxuICB0eXBlIFNhZmVGZXRjaFJlc3BvbnNlLFxufSBmcm9tICcuL3NzcmYuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9lbnYuanMnO1xuZXhwb3J0ICogZnJvbSAnLi9zZXJ2aWNlLXJlZ2lzdHJ5LmpzJztcbmV4cG9ydCAqIGZyb20gJy4vcmV0ZW50aW9uLmpzJztcbmV4cG9ydCAqIGZyb20gJy4vY29tcGxpYW5jZS1hdHRyaWJ1dGVzLmpzJztcbmV4cG9ydCB7XG4gIGxlYWRpbmdaZXJvQml0cyxcbiAgcHJvb2ZPZldvcmtIYXNoLFxuICBjaGFsbGVuZ2VLZXksXG4gIGNsYW1wRGlmZmljdWx0eSxcbiAgY3JlYXRlUHJvb2ZPZldvcmtDaGFsbGVuZ2UsXG4gIHBhcnNlUHJvb2ZPZldvcmtDaGFsbGVuZ2UsXG4gIHZlcmlmeVByb29mT2ZXb3JrLFxuICBzb2x2ZVByb29mT2ZXb3JrLFxuICBQT1dfREVGQVVMVF9ESUZGSUNVTFRZLFxuICBQT1dfTUFYX0RJRkZJQ1VMVFksXG4gIFBPV19DSEFMTEVOR0VfVFRMX01TLFxuICB0eXBlIFByb29mT2ZXb3JrQ2hhbGxlbmdlLFxuICB0eXBlIFByb29mT2ZXb3JrU29sdXRpb24sXG59IGZyb20gJy4vcHJvb2Ytb2Ytd29yay5qcyc7XG4iXX0=