@pipeline-builder/api-core 4.1.3 → 4.1.4

package/README.md

@@ -8,7 +8,7 @@ Core server-side utilities (auth middleware, response helpers, error codes, quot
 
 ## Responsibilities
 
-Provides the cross-cutting primitives every backend service depends on: JWT authentication and authorization middleware, inter-service token minting, standardized HTTP response and error helpers, request parameter/identity parsing, Zod validation schemas with an OpenAPI registry, a safe service-to-service HTTP client, quota enforcement types and client, structured Winston logging, an in-memory/Redis cache, domain event pub/sub, and the static AI provider catalog.
+Provides the cross-cutting primitives every backend service depends on: JWT authentication and authorization middleware, inter-service token minting, standardized HTTP response and error helpers, request parameter/identity parsing, Zod validation schemas with an OpenAPI registry, a safe service-to-service HTTP client, quota enforcement types and client, structured Winston logging, an in-memory cache with cross-replica invalidation, domain event pub/sub, and the static AI provider catalog.
 
 ## Key exports
 
@@ -29,7 +29,7 @@ Provides the cross-cutting primitives every backend service depends on: JWT auth
 | `sendPaginated`, `sendPaginatedNested`, `parsePaginationParams` | Paginated response helpers |
 | `extractDbError`, `errorMessage` | Safe DB-error and error-to-string extraction |
 | `ErrorCode`, `getStatusForErrorCode` | Standard error code enum and HTTP status mapping |
-| `AppError`, `NotFoundError`, `ForbiddenError`, `ValidationError`, `ConflictError`, `UnauthorizedError` | Typed HTTP error classes |
+| `AppError`, `NotFoundError`, `ForbiddenError`, `ValidationError`, `ConflictError` | Typed HTTP error classes |
 
 ### Request parsing (`./utils`)
 | Export | Purpose |
@@ -44,7 +44,7 @@ Provides the cross-cutting primitives every backend service depends on: JWT auth
 | `InternalHttpClient`, `createSafeClient` | Service-to-service HTTP client (`ServiceConfig`, `RequestOptions`) |
 | `createComplianceClient` / `ComplianceClient` | Typed compliance-service client built on the safe client |
 | `QuotaService`, `createQuotaService`, `QuotaType`, `QuotaCheckResult`, `QuotaTier`, `QUOTA_TIERS`, `getTierLimits` | Quota enforcement client and tier presets |
-| `CacheService`, `createCacheService` | In-memory TTL cache with optional Redis backend |
+| `CacheService`, `createCacheService` | In-memory LRU TTL cache with cross-replica invalidation over Redis pub/sub |
 | `entityEvents` | Process-local domain event pub/sub for entity changes |
 
 ### Logging, validation & OpenAPI

package/lib/errors/app-errors.d.ts

@@ -24,7 +24,3 @@ export declare class ValidationError extends AppError {
 export declare class ConflictError extends AppError {
     constructor(message: string);
 }
-/** 401 — Unauthorized / authentication required. */
-export declare class UnauthorizedError extends AppError {
-    constructor(message: string);
-}

package/lib/errors/app-errors.js

@@ -43,11 +43,4 @@ export class ConflictError extends AppError {
         this.name = 'ConflictError';
     }
 }
-/** 401 — Unauthorized / authentication required. */
-export class UnauthorizedError extends AppError {
-    constructor(message) {
-        super(getStatusForErrorCode(ErrorCode.UNAUTHORIZED), ErrorCode.UNAUTHORIZED, message);
-        this.name = 'UnauthorizedError';
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLWVycm9ycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9lcnJvcnMvYXBwLWVycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxTQUFTLEVBQUUscUJBQXFCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUUzRTs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sUUFBUyxTQUFRLEtBQUs7SUFFZixVQUFVO0lBQ1YsSUFBSTtJQUZ0QixZQUNrQixVQUFrQixFQUNsQixJQUFlLEVBQy9CLE9BQWU7UUFFZixLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7MEJBSkMsVUFBVTtvQkFDVixJQUFJO1FBSXBCLElBQUksQ0FBQyxJQUFJLEdBQUcsVUFBVSxDQUFDO0lBQ3pCLENBQUM7Q0FDRjtBQUVELGdDQUFnQztBQUNoQyxNQUFNLE9BQU8sYUFBYyxTQUFRLFFBQVE7SUFDekMsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQUUsU0FBUyxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNoRixJQUFJLENBQUMsSUFBSSxHQUFHLGVBQWUsQ0FBQztJQUM5QixDQUFDO0NBQ0Y7QUFFRCxzQ0FBc0M7QUFDdEMsTUFBTSxPQUFPLGNBQWUsU0FBUSxRQUFRO0lBQzFDLFlBQVksT0FBZTtRQUN6QixLQUFLLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLHdCQUF3QixDQUFDLEVBQUUsU0FBUyxDQUFDLHdCQUF3QixFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQzlHLElBQUksQ0FBQyxJQUFJLEdBQUcsZ0JBQWdCLENBQUM7SUFDL0IsQ0FBQztDQUNGO0FBRUQsc0NBQXNDO0FBQ3RDLE1BQU0sT0FBTyxlQUFnQixTQUFRLFFBQVE7SUFDM0MsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxTQUFTLENBQUMsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUYsSUFBSSxDQUFDLElBQUksR0FBRyxpQkFBaUIsQ0FBQztJQUNoQyxDQUFDO0NBQ0Y7QUFFRCxrQ0FBa0M7QUFDbEMsTUFBTSxPQUFPLGFBQWMsU0FBUSxRQUFRO0lBQ3pDLFlBQVksT0FBZTtRQUN6QixLQUFLLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUUsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7SUFDOUIsQ0FBQztDQUNGO0FBRUQsb0RBQW9EO0FBQ3BELE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxRQUFRO0lBQzdDLFlBQVksT0FBZTtRQUN6QixLQUFLLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxFQUFFLFNBQVMsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDdEYsSUFBSSxDQUFDLElBQUksR0FBRyxtQkFBbUIsQ0FBQztJQUNsQyxDQUFDO0NBQ0YiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgRXJyb3JDb2RlLCBnZXRTdGF0dXNGb3JFcnJvckNvZGUgfSBmcm9tICcuLi90eXBlcy9lcnJvci1jb2Rlcy5qcyc7XG5cbi8qKlxuICogQmFzZSBhcHBsaWNhdGlvbiBlcnJvciB3aXRoIEhUVFAgc3RhdHVzIGNvZGUgYW5kIGVycm9yIGNvZGUuXG4gKiBFeHRlbmQgdGhpcyBmb3IgZG9tYWluLXNwZWNpZmljIGVycm9yIHR5cGVzLlxuICovXG5leHBvcnQgY2xhc3MgQXBwRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKFxuICAgIHB1YmxpYyByZWFkb25seSBzdGF0dXNDb2RlOiBudW1iZXIsXG4gICAgcHVibGljIHJlYWRvbmx5IGNvZGU6IEVycm9yQ29kZSxcbiAgICBtZXNzYWdlOiBzdHJpbmcsXG4gICkge1xuICAgIHN1cGVyKG1lc3NhZ2UpO1xuICAgIHRoaXMubmFtZSA9ICdBcHBFcnJvcic7XG4gIH1cbn1cblxuLyoqIDQwNCDigJQgUmVzb3VyY2Ugbm90IGZvdW5kLiAqL1xuZXhwb3J0IGNsYXNzIE5vdEZvdW5kRXJyb3IgZXh0ZW5kcyBBcHBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2U6IHN0cmluZykge1xuICAgIHN1cGVyKGdldFN0YXR1c0ZvckVycm9yQ29kZShFcnJvckNvZGUuTk9UX0ZPVU5EKSwgRXJyb3JDb2RlLk5PVF9GT1VORCwgbWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ05vdEZvdW5kRXJyb3InO1xuICB9XG59XG5cbi8qKiA0MDMg4oCUIEluc3VmZmljaWVudCBwZXJtaXNzaW9ucy4gKi9cbmV4cG9ydCBjbGFzcyBGb3JiaWRkZW5FcnJvciBleHRlbmRzIEFwcEVycm9yIHtcbiAgY29uc3RydWN0b3IobWVzc2FnZTogc3RyaW5nKSB7XG4gICAgc3VwZXIoZ2V0U3RhdHVzRm9yRXJyb3JDb2RlKEVycm9yQ29kZS5JTlNVRkZJQ0lFTlRfUEVSTUlTU0lPTlMpLCBFcnJvckNvZGUuSU5TVUZGSUNJRU5UX1BFUk1JU1NJT05TLCBtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnRm9yYmlkZGVuRXJyb3InO1xuICB9XG59XG5cbi8qKiA0MDAg4oCUIFZhbGlkYXRpb24gLyBiYWQgcmVxdWVzdC4gKi9cbmV4cG9ydCBjbGFzcyBWYWxpZGF0aW9uRXJyb3IgZXh0ZW5kcyBBcHBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2U6IHN0cmluZykge1xuICAgIHN1cGVyKGdldFN0YXR1c0ZvckVycm9yQ29kZShFcnJvckNvZGUuVkFMSURBVElPTl9FUlJPUiksIEVycm9yQ29kZS5WQUxJREFUSU9OX0VSUk9SLCBtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnVmFsaWRhdGlvbkVycm9yJztcbiAgfVxufVxuXG4vKiogNDA5IOKAlCBDb25mbGljdCAvIGR1cGxpY2F0ZS4gKi9cbmV4cG9ydCBjbGFzcyBDb25mbGljdEVycm9yIGV4dGVuZHMgQXBwRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlOiBzdHJpbmcpIHtcbiAgICBzdXBlcihnZXRTdGF0dXNGb3JFcnJvckNvZGUoRXJyb3JDb2RlLkNPTkZMSUNUKSwgRXJyb3JDb2RlLkNPTkZMSUNULCBtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnQ29uZmxpY3RFcnJvcic7XG4gIH1cbn1cblxuLyoqIDQwMSDigJQgVW5hdXRob3JpemVkIC8gYXV0aGVudGljYXRpb24gcmVxdWlyZWQuICovXG5leHBvcnQgY2xhc3MgVW5hdXRob3JpemVkRXJyb3IgZXh0ZW5kcyBBcHBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2U6IHN0cmluZykge1xuICAgIHN1cGVyKGdldFN0YXR1c0ZvckVycm9yQ29kZShFcnJvckNvZGUuVU5BVVRIT1JJWkVEKSwgRXJyb3JDb2RlLlVOQVVUSE9SSVpFRCwgbWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ1VuYXV0aG9yaXplZEVycm9yJztcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLWVycm9ycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9lcnJvcnMvYXBwLWVycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxTQUFTLEVBQUUscUJBQXFCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUUzRTs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sUUFBUyxTQUFRLEtBQUs7SUFFZixVQUFVO0lBQ1YsSUFBSTtJQUZ0QixZQUNrQixVQUFrQixFQUNsQixJQUFlLEVBQy9CLE9BQWU7UUFFZixLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7MEJBSkMsVUFBVTtvQkFDVixJQUFJO1FBSXBCLElBQUksQ0FBQyxJQUFJLEdBQUcsVUFBVSxDQUFDO0lBQ3pCLENBQUM7Q0FDRjtBQUVELGdDQUFnQztBQUNoQyxNQUFNLE9BQU8sYUFBYyxTQUFRLFFBQVE7SUFDekMsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQUUsU0FBUyxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNoRixJQUFJLENBQUMsSUFBSSxHQUFHLGVBQWUsQ0FBQztJQUM5QixDQUFDO0NBQ0Y7QUFFRCxzQ0FBc0M7QUFDdEMsTUFBTSxPQUFPLGNBQWUsU0FBUSxRQUFRO0lBQzFDLFlBQVksT0FBZTtRQUN6QixLQUFLLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLHdCQUF3QixDQUFDLEVBQUUsU0FBUyxDQUFDLHdCQUF3QixFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQzlHLElBQUksQ0FBQyxJQUFJLEdBQUcsZ0JBQWdCLENBQUM7SUFDL0IsQ0FBQztDQUNGO0FBRUQsc0NBQXNDO0FBQ3RDLE1BQU0sT0FBTyxlQUFnQixTQUFRLFFBQVE7SUFDM0MsWUFBWSxPQUFlO1FBQ3pCLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxTQUFTLENBQUMsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUYsSUFBSSxDQUFDLElBQUksR0FBRyxpQkFBaUIsQ0FBQztJQUNoQyxDQUFDO0NBQ0Y7QUFFRCxrQ0FBa0M7QUFDbEMsTUFBTSxPQUFPLGFBQWMsU0FBUSxRQUFRO0lBQ3pDLFlBQVksT0FBZTtRQUN6QixLQUFLLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUUsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7SUFDOUIsQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IEVycm9yQ29kZSwgZ2V0U3RhdHVzRm9yRXJyb3JDb2RlIH0gZnJvbSAnLi4vdHlwZXMvZXJyb3ItY29kZXMuanMnO1xuXG4vKipcbiAqIEJhc2UgYXBwbGljYXRpb24gZXJyb3Igd2l0aCBIVFRQIHN0YXR1cyBjb2RlIGFuZCBlcnJvciBjb2RlLlxuICogRXh0ZW5kIHRoaXMgZm9yIGRvbWFpbi1zcGVjaWZpYyBlcnJvciB0eXBlcy5cbiAqL1xuZXhwb3J0IGNsYXNzIEFwcEVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihcbiAgICBwdWJsaWMgcmVhZG9ubHkgc3RhdHVzQ29kZTogbnVtYmVyLFxuICAgIHB1YmxpYyByZWFkb25seSBjb2RlOiBFcnJvckNvZGUsXG4gICAgbWVzc2FnZTogc3RyaW5nLFxuICApIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnQXBwRXJyb3InO1xuICB9XG59XG5cbi8qKiA0MDQg4oCUIFJlc291cmNlIG5vdCBmb3VuZC4gKi9cbmV4cG9ydCBjbGFzcyBOb3RGb3VuZEVycm9yIGV4dGVuZHMgQXBwRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlOiBzdHJpbmcpIHtcbiAgICBzdXBlcihnZXRTdGF0dXNGb3JFcnJvckNvZGUoRXJyb3JDb2RlLk5PVF9GT1VORCksIEVycm9yQ29kZS5OT1RfRk9VTkQsIG1lc3NhZ2UpO1xuICAgIHRoaXMubmFtZSA9ICdOb3RGb3VuZEVycm9yJztcbiAgfVxufVxuXG4vKiogNDAzIOKAlCBJbnN1ZmZpY2llbnQgcGVybWlzc2lvbnMuICovXG5leHBvcnQgY2xhc3MgRm9yYmlkZGVuRXJyb3IgZXh0ZW5kcyBBcHBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2U6IHN0cmluZykge1xuICAgIHN1cGVyKGdldFN0YXR1c0ZvckVycm9yQ29kZShFcnJvckNvZGUuSU5TVUZGSUNJRU5UX1BFUk1JU1NJT05TKSwgRXJyb3JDb2RlLklOU1VGRklDSUVOVF9QRVJNSVNTSU9OUywgbWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ0ZvcmJpZGRlbkVycm9yJztcbiAgfVxufVxuXG4vKiogNDAwIOKAlCBWYWxpZGF0aW9uIC8gYmFkIHJlcXVlc3QuICovXG5leHBvcnQgY2xhc3MgVmFsaWRhdGlvbkVycm9yIGV4dGVuZHMgQXBwRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlOiBzdHJpbmcpIHtcbiAgICBzdXBlcihnZXRTdGF0dXNGb3JFcnJvckNvZGUoRXJyb3JDb2RlLlZBTElEQVRJT05fRVJST1IpLCBFcnJvckNvZGUuVkFMSURBVElPTl9FUlJPUiwgbWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ1ZhbGlkYXRpb25FcnJvcic7XG4gIH1cbn1cblxuLyoqIDQwOSDigJQgQ29uZmxpY3QgLyBkdXBsaWNhdGUuICovXG5leHBvcnQgY2xhc3MgQ29uZmxpY3RFcnJvciBleHRlbmRzIEFwcEVycm9yIHtcbiAgY29uc3RydWN0b3IobWVzc2FnZTogc3RyaW5nKSB7XG4gICAgc3VwZXIoZ2V0U3RhdHVzRm9yRXJyb3JDb2RlKEVycm9yQ29kZS5DT05GTElDVCksIEVycm9yQ29kZS5DT05GTElDVCwgbWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ0NvbmZsaWN0RXJyb3InO1xuICB9XG59XG4iXX0=

package/lib/helpers/restore-helpers.d.ts

@@ -38,9 +38,9 @@ export interface PurgeableService<T extends RestorableEntity> {
  * genuine tombstone (a live/active row loads as `null` here and 404s, so purge
  * can never hard-delete a live row). Returns `{ existing, purgedId }` on success
  * (the caller emits the entity-specific audit off `existing`), or `null` when it
- * has ALREADY sent a response (400/404/403). Purge is intentionally NOT step-up
- * gated: it only finalizes what the retention sweep would remove anyway, and the
- * frontend gates it with an explicit confirm dialog. DRYs the near-identical
+ * has ALREADY sent a response (400/404/403). Step-up is the ROUTE's job: the
+ * pipeline, template and plugin services mount purge behind `requireStepUp`
+ * (sharing restore's chain so one token isn't consumed twice). DRYs the near-identical
  * pipeline / pipeline_template purge routes.
  */
 export declare function loadAndPurge<T extends RestorableEntity>(req: Request, res: Response, orgId: string, service: PurgeableService<T>, label: string, publishPermission: Permission, userId: string): Promise<{

package/lib/helpers/restore-helpers.js

@@ -45,9 +45,9 @@ export async function loadAndRestore(req, res, orgId, userId, service, label, pu
  * genuine tombstone (a live/active row loads as `null` here and 404s, so purge
  * can never hard-delete a live row). Returns `{ existing, purgedId }` on success
  * (the caller emits the entity-specific audit off `existing`), or `null` when it
- * has ALREADY sent a response (400/404/403). Purge is intentionally NOT step-up
- * gated: it only finalizes what the retention sweep would remove anyway, and the
- * frontend gates it with an explicit confirm dialog. DRYs the near-identical
+ * has ALREADY sent a response (400/404/403). Step-up is the ROUTE's job: the
+ * pipeline, template and plugin services mount purge behind `requireStepUp`
+ * (sharing restore's chain so one token isn't consumed twice). DRYs the near-identical
  * pipeline / pipeline_template purge routes.
  */
 export async function loadAndPurge(req, res, orgId, service, label, publishPermission, userId) {
@@ -75,4 +75,4 @@ export async function loadAndPurge(req, res, orgId, service, label, publishPermi
     }
     return { existing, purgedId };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzdG9yZS1oZWxwZXJzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2hlbHBlcnMvcmVzdG9yZS1oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFHdEMsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDbkUsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDdkQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXBELE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUM5QyxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFpQnREOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxjQUFjLENBQ2xDLEdBQVksRUFDWixHQUFhLEVBQ2IsS0FBYSxFQUNiLE1BQWMsRUFDZCxPQUE2QixFQUM3QixLQUFhLEVBQ2IsaUJBQTZCO0lBRTdCLE1BQU0sRUFBRSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3RDLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNSLGNBQWMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFLLGtCQUFrQixFQUFFLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1FBQ2xGLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELGdGQUFnRjtJQUNoRixNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxlQUFlLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzFELElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCwrRUFBK0U7SUFDL0UsMkVBQTJFO0lBQzNFLDZFQUE2RTtJQUM3RSxJQUFJLENBQUMsNEJBQTRCLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsTUFBTSxJQUFJLEVBQUUsRUFBRSxpQkFBaUIsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXBHLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sSUFBSSxRQUFRLENBQUMsQ0FBQztJQUN0RSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDZCxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDL0IsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUNoQyxDQUFDO0FBUUQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLFlBQVksQ0FDaEMsR0FBWSxFQUNaLEdBQWEsRUFDYixLQUFhLEVBQ2IsT0FBNEIsRUFDNUIsS0FBYSxFQUNiLGlCQUE2QixFQUM3QixNQUFjO0lBRWQsTUFBTSxFQUFFLEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDdEMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ1IsY0FBYyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssa0JBQWtCLEVBQUUsU0FBUyxDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDbEYsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsZ0ZBQWdGO0lBQ2hGLHdFQUF3RTtJQUN4RSxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxlQUFlLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzFELElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCxnRUFBZ0U7SUFDaEUsSUFBSSxDQUFDLDRCQUE0QixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE1BQU0sSUFBSSxFQUFFLEVBQUUsaUJBQWlCLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUVwRyw0RUFBNEU7SUFDNUUsNEVBQTRFO0lBQzVFLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDcEQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ2Qsa0JBQWtCLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQy9CLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELE9BQU8sRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLENBQUM7QUFDaEMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgdHlwZSB7IFJlcXVlc3QsIFJlc3BvbnNlIH0gZnJvbSAnZXhwcmVzcyc7XG5pbXBvcnQgeyByZXF1aXJlVmlzaWJpbGl0eVdyaXRlQWNjZXNzIH0gZnJvbSAnLi9hY2Nlc3MtaGVscGVycy5qcyc7XG5pbXBvcnQgeyBzZW5kRW50aXR5Tm90Rm91bmQgfSBmcm9tICcuL2NydWQtaGVscGVycy5qcyc7XG5pbXBvcnQgeyBFcnJvckNvZGUgfSBmcm9tICcuLi90eXBlcy9lcnJvci1jb2Rlcy5qcyc7XG5pbXBvcnQgdHlwZSB7IFBlcm1pc3Npb24gfSBmcm9tICcuLi90eXBlcy9wZXJtaXNzaW9ucy5qcyc7XG5pbXBvcnQgeyBnZXRQYXJhbSB9IGZyb20gJy4uL3V0aWxzL3BhcmFtcy5qcyc7XG5pbXBvcnQgeyBzZW5kQmFkUmVxdWVzdCB9IGZyb20gJy4uL3V0aWxzL3Jlc3BvbnNlLmpzJztcblxuLyoqIE1pbmltYWwgc2hhcGUgYSByZXN0b3JlIHJvdXRlIG5lZWRzIGZyb20gdGhlIGVudGl0eSBpdCByZXN0b3Jlcy4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVzdG9yYWJsZUVudGl0eSB7XG4gIG9yZ0lkOiBzdHJpbmc7XG4gIC8qKiBSdW5nIHRoZSB0b21ic3RvbmUgc2F0IGF0IOKAlCBkcml2ZXMgdGhlIHJlc3RvcmUvcHVyZ2UgYXV0aG9yaXR5IGNoZWNrLiAqL1xuICB2aXNpYmlsaXR5Pzogc3RyaW5nO1xuICAvKiogQXV0aG9yIOKAlCB0aGUgb25seSBub24tYWRtaW4gd2hvIG1heSByZXN0b3JlL3B1cmdlIGEgYHByaXZhdGVgIHJvdy4gKi9cbiAgY3JlYXRlZEJ5Pzogc3RyaW5nO1xufVxuXG4vKiogVGhlIHNsaWNlIG9mIGEgc2VydmljZSBhIHJlc3RvcmUgcm91dGUgdXNlcyAoc2F0aXNmaWVkIGJ5IGFueSBDcnVkU2VydmljZSkuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlc3RvcmFibGVTZXJ2aWNlPFQgZXh0ZW5kcyBSZXN0b3JhYmxlRW50aXR5PiB7XG4gIGZpbmREZWxldGVkQnlJZChpZDogc3RyaW5nLCBvcmdJZD86IHN0cmluZyk6IFByb21pc2U8VCB8IG51bGw+O1xuICByZXN0b3JlKGlkOiBzdHJpbmcsIG9yZ0lkOiBzdHJpbmcsIHVzZXJJZDogc3RyaW5nKTogUHJvbWlzZTxUIHwgbnVsbD47XG59XG5cbi8qKlxuICogU2hhcmVkIHNrZWxldG9uIGZvciBhIHN0ZXAtdXAtZ2F0ZWQgZW50aXR5IHJlc3RvcmUgcm91dGU6IGV4dHJhY3QgYDppZGAsIGxvYWRcbiAqIHRoZSBvd24tb3JnIHRvbWJzdG9uZSwgZ2F0ZSBpdCBvbiB0aGUgdmlzaWJpbGl0eSBsYWRkZXIgKHBhcml0eSB3aXRoIGRlbGV0ZSksXG4gKiByZXN0b3JlLCBhbmQgNDA0IG9uIG1pc3MuIFJldHVybnMgYHsgZXhpc3RpbmcsIHJlc3RvcmVkIH1gIG9uIHN1Y2Nlc3MsXG4gKiBvciBgbnVsbGAgd2hlbiBpdCBoYXMgQUxSRUFEWSBzZW50IGEgcmVzcG9uc2UgKDQwMC80MDQvNDAzKSDigJQgdGhlIGNhbGxlciB0aGVuXG4gKiBkb2VzIHRoZSBlbnRpdHktc3BlY2lmaWMgYXVkaXQgKyByZXNwb25zZS4gRFJZcyB0aGUgbmVhci1pZGVudGljYWxcbiAqIHBpcGVsaW5lIC8gcGx1Z2luIC8gcGlwZWxpbmVfdGVtcGxhdGUgcmVzdG9yZSByb3V0ZXMgKHdoaWNoIGRpZmZlciBvbmx5IGluXG4gKiBzZXJ2aWNlLCBhdWRpdCBhY3Rpb24sIGFuZCByZXNwb25zZSBzaGFwaW5nKS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGxvYWRBbmRSZXN0b3JlPFQgZXh0ZW5kcyBSZXN0b3JhYmxlRW50aXR5PihcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBvcmdJZDogc3RyaW5nLFxuICB1c2VySWQ6IHN0cmluZyxcbiAgc2VydmljZTogUmVzdG9yYWJsZVNlcnZpY2U8VD4sXG4gIGxhYmVsOiBzdHJpbmcsXG4gIHB1Ymxpc2hQZXJtaXNzaW9uOiBQZXJtaXNzaW9uLFxuKTogUHJvbWlzZTx7IGV4aXN0aW5nOiBUOyByZXN0b3JlZDogVCB9IHwgbnVsbD4ge1xuICBjb25zdCBpZCA9IGdldFBhcmFtKHJlcS5wYXJhbXMsICdpZCcpO1xuICBpZiAoIWlkKSB7XG4gICAgc2VuZEJhZFJlcXVlc3QocmVzLCBgJHtsYWJlbH0gSUQgaXMgcmVxdWlyZWQuYCwgRXJyb3JDb2RlLk1JU1NJTkdfUkVRVUlSRURfRklFTEQpO1xuICAgIHJldHVybiBudWxsO1xuICB9XG5cbiAgLy8gTG9hZCB0aGUgVE9NQlNUT05FIChvd24tb3JnKS4gQSBsaXZlIHJvdyAvIHVua25vd24gaWQgLyBhbHJlYWR5LXB1cmdlZCDihpIgNDA0LlxuICBjb25zdCBleGlzdGluZyA9IGF3YWl0IHNlcnZpY2UuZmluZERlbGV0ZWRCeUlkKGlkLCBvcmdJZCk7XG4gIGlmICghZXhpc3RpbmcpIHtcbiAgICBzZW5kRW50aXR5Tm90Rm91bmQocmVzLCBsYWJlbCk7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cblxuICAvLyBTYW1lIGxhZGRlciBhdXRob3JpdHkgYXMgZGVsZXRlOiBgOnB1Ymxpc2hgIGZvciBhIHB1YmxpYyByb3csIGF1dGhvcnNoaXAgZm9yXG4gIC8vIGEgcHJpdmF0ZSBvbmUuIExvYWQtYmVhcmluZyBoZXJlIOKAlCB0aGUgdG9tYnN0b25lIGxvYWQgaXMgb3JnLXNjb3BlZCwgbm90XG4gIC8vIHZpc2liaWxpdHktc2NvcGVkLCBzbyB0aGlzIGlzIHdoYXQgc3RvcHMgYSBjb2xsZWFndWUgcmVzdXJyZWN0aW5nIGEgZHJhZnQuXG4gIGlmICghcmVxdWlyZVZpc2liaWxpdHlXcml0ZUFjY2VzcyhyZXEsIHJlcywgZXhpc3RpbmcsIHVzZXJJZCB8fCAnJywgcHVibGlzaFBlcm1pc3Npb24pKSByZXR1cm4gbnVsbDtcblxuICBjb25zdCByZXN0b3JlZCA9IGF3YWl0IHNlcnZpY2UucmVzdG9yZShpZCwgb3JnSWQsIHVzZXJJZCB8fCAnc3lzdGVtJyk7XG4gIGlmICghcmVzdG9yZWQpIHtcbiAgICBzZW5kRW50aXR5Tm90Rm91bmQocmVzLCBsYWJlbCk7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cblxuICByZXR1cm4geyBleGlzdGluZywgcmVzdG9yZWQgfTtcbn1cblxuLyoqIFRoZSBzbGljZSBvZiBhIHNlcnZpY2UgYSBwdXJnZSByb3V0ZSB1c2VzIChzYXRpc2ZpZWQgYnkgYW55IENydWRTZXJ2aWNlKS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUHVyZ2VhYmxlU2VydmljZTxUIGV4dGVuZHMgUmVzdG9yYWJsZUVudGl0eT4ge1xuICBmaW5kRGVsZXRlZEJ5SWQoaWQ6IHN0cmluZywgb3JnSWQ/OiBzdHJpbmcpOiBQcm9taXNlPFQgfCBudWxsPjtcbiAgcHVyZ2VCeUlkKGlkOiBzdHJpbmcsIG9yZ0lkPzogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmcgfCBudWxsPjtcbn1cblxuLyoqXG4gKiBTaGFyZWQgc2tlbGV0b24gZm9yIGFuIGVudGl0eSBQVVJHRSByb3V0ZTogZXh0cmFjdCBgOmlkYCwgbG9hZCB0aGUgb3duLW9yZ1xuICogdG9tYnN0b25lLCBnYXRlIGl0IG9uIHRoZSB2aXNpYmlsaXR5IGxhZGRlciAocGFyaXR5IHdpdGhcbiAqIGRlbGV0ZS9yZXN0b3JlKSwgdGhlbiBwZXJtYW5lbnRseSBoYXJkLWRlbGV0ZSBpdCDigJQgYnV0IE9OTFkgd2hlbiBpdCBpcyBhXG4gKiBnZW51aW5lIHRvbWJzdG9uZSAoYSBsaXZlL2FjdGl2ZSByb3cgbG9hZHMgYXMgYG51bGxgIGhlcmUgYW5kIDQwNHMsIHNvIHB1cmdlXG4gKiBjYW4gbmV2ZXIgaGFyZC1kZWxldGUgYSBsaXZlIHJvdykuIFJldHVybnMgYHsgZXhpc3RpbmcsIHB1cmdlZElkIH1gIG9uIHN1Y2Nlc3NcbiAqICh0aGUgY2FsbGVyIGVtaXRzIHRoZSBlbnRpdHktc3BlY2lmaWMgYXVkaXQgb2ZmIGBleGlzdGluZ2ApLCBvciBgbnVsbGAgd2hlbiBpdFxuICogaGFzIEFMUkVBRFkgc2VudCBhIHJlc3BvbnNlICg0MDAvNDA0LzQwMykuIFB1cmdlIGlzIGludGVudGlvbmFsbHkgTk9UIHN0ZXAtdXBcbiAqIGdhdGVkOiBpdCBvbmx5IGZpbmFsaXplcyB3aGF0IHRoZSByZXRlbnRpb24gc3dlZXAgd291bGQgcmVtb3ZlIGFueXdheSwgYW5kIHRoZVxuICogZnJvbnRlbmQgZ2F0ZXMgaXQgd2l0aCBhbiBleHBsaWNpdCBjb25maXJtIGRpYWxvZy4gRFJZcyB0aGUgbmVhci1pZGVudGljYWxcbiAqIHBpcGVsaW5lIC8gcGlwZWxpbmVfdGVtcGxhdGUgcHVyZ2Ugcm91dGVzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbG9hZEFuZFB1cmdlPFQgZXh0ZW5kcyBSZXN0b3JhYmxlRW50aXR5PihcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBvcmdJZDogc3RyaW5nLFxuICBzZXJ2aWNlOiBQdXJnZWFibGVTZXJ2aWNlPFQ+LFxuICBsYWJlbDogc3RyaW5nLFxuICBwdWJsaXNoUGVybWlzc2lvbjogUGVybWlzc2lvbixcbiAgdXNlcklkOiBzdHJpbmcsXG4pOiBQcm9taXNlPHsgZXhpc3Rpbmc6IFQ7IHB1cmdlZElkOiBzdHJpbmcgfSB8IG51bGw+IHtcbiAgY29uc3QgaWQgPSBnZXRQYXJhbShyZXEucGFyYW1zLCAnaWQnKTtcbiAgaWYgKCFpZCkge1xuICAgIHNlbmRCYWRSZXF1ZXN0KHJlcywgYCR7bGFiZWx9IElEIGlzIHJlcXVpcmVkLmAsIEVycm9yQ29kZS5NSVNTSU5HX1JFUVVJUkVEX0ZJRUxEKTtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxuXG4gIC8vIExvYWQgdGhlIFRPTUJTVE9ORSAob3duLW9yZykuIEEgbGl2ZSByb3cgLyB1bmtub3duIGlkIC8gYWxyZWFkeS1wdXJnZWQg4oaSIDQwNCxcbiAgLy8gc28gYSBjdXJyZW50bHktYWN0aXZlIGVudGl0eSBpcyBuZXZlciBoYXJkLWRlbGV0ZWQgdGhyb3VnaCB0aGlzIHBhdGguXG4gIGNvbnN0IGV4aXN0aW5nID0gYXdhaXQgc2VydmljZS5maW5kRGVsZXRlZEJ5SWQoaWQsIG9yZ0lkKTtcbiAgaWYgKCFleGlzdGluZykge1xuICAgIHNlbmRFbnRpdHlOb3RGb3VuZChyZXMsIGxhYmVsKTtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxuXG4gIC8vIFNhbWUgbGFkZGVyIGF1dGhvcml0eSBhcyBkZWxldGUvcmVzdG9yZSAoc2VlIGxvYWRBbmRSZXN0b3JlKS5cbiAgaWYgKCFyZXF1aXJlVmlzaWJpbGl0eVdyaXRlQWNjZXNzKHJlcSwgcmVzLCBleGlzdGluZywgdXNlcklkIHx8ICcnLCBwdWJsaXNoUGVybWlzc2lvbikpIHJldHVybiBudWxsO1xuXG4gIC8vIFJldXNlIHRoZSByZXRlbnRpb24gc3dlZXAncyBzaW5nbGUtaWQgaGFyZC1kZWxldGUgKHNhbWUgdG9tYnN0b25lIG1hdGNoICtcbiAgLy8gZGVwZW5kZW50LXRlYXJkb3duIGhvb2tzKS4gUmV0dXJucyBudWxsIG9uIGEgcmFjZSAoYWxyZWFkeSBwdXJnZWQpIOKGkiA0MDQuXG4gIGNvbnN0IHB1cmdlZElkID0gYXdhaXQgc2VydmljZS5wdXJnZUJ5SWQoaWQsIG9yZ0lkKTtcbiAgaWYgKCFwdXJnZWRJZCkge1xuICAgIHNlbmRFbnRpdHlOb3RGb3VuZChyZXMsIGxhYmVsKTtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxuXG4gIHJldHVybiB7IGV4aXN0aW5nLCBwdXJnZWRJZCB9O1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzdG9yZS1oZWxwZXJzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2hlbHBlcnMvcmVzdG9yZS1oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFHdEMsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDbkUsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDdkQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXBELE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUM5QyxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFpQnREOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxjQUFjLENBQ2xDLEdBQVksRUFDWixHQUFhLEVBQ2IsS0FBYSxFQUNiLE1BQWMsRUFDZCxPQUE2QixFQUM3QixLQUFhLEVBQ2IsaUJBQTZCO0lBRTdCLE1BQU0sRUFBRSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3RDLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNSLGNBQWMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFLLGtCQUFrQixFQUFFLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1FBQ2xGLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELGdGQUFnRjtJQUNoRixNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxlQUFlLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzFELElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCwrRUFBK0U7SUFDL0UsMkVBQTJFO0lBQzNFLDZFQUE2RTtJQUM3RSxJQUFJLENBQUMsNEJBQTRCLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsTUFBTSxJQUFJLEVBQUUsRUFBRSxpQkFBaUIsQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBRXBHLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sSUFBSSxRQUFRLENBQUMsQ0FBQztJQUN0RSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDZCxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDL0IsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUNoQyxDQUFDO0FBUUQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLFlBQVksQ0FDaEMsR0FBWSxFQUNaLEdBQWEsRUFDYixLQUFhLEVBQ2IsT0FBNEIsRUFDNUIsS0FBYSxFQUNiLGlCQUE2QixFQUM3QixNQUFjO0lBRWQsTUFBTSxFQUFFLEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDdEMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ1IsY0FBYyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssa0JBQWtCLEVBQUUsU0FBUyxDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDbEYsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsZ0ZBQWdGO0lBQ2hGLHdFQUF3RTtJQUN4RSxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxlQUFlLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzFELElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCxnRUFBZ0U7SUFDaEUsSUFBSSxDQUFDLDRCQUE0QixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLE1BQU0sSUFBSSxFQUFFLEVBQUUsaUJBQWlCLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUVwRyw0RUFBNEU7SUFDNUUsNEVBQTRFO0lBQzVFLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDcEQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ2Qsa0JBQWtCLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQy9CLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELE9BQU8sRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLENBQUM7QUFDaEMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgdHlwZSB7IFJlcXVlc3QsIFJlc3BvbnNlIH0gZnJvbSAnZXhwcmVzcyc7XG5pbXBvcnQgeyByZXF1aXJlVmlzaWJpbGl0eVdyaXRlQWNjZXNzIH0gZnJvbSAnLi9hY2Nlc3MtaGVscGVycy5qcyc7XG5pbXBvcnQgeyBzZW5kRW50aXR5Tm90Rm91bmQgfSBmcm9tICcuL2NydWQtaGVscGVycy5qcyc7XG5pbXBvcnQgeyBFcnJvckNvZGUgfSBmcm9tICcuLi90eXBlcy9lcnJvci1jb2Rlcy5qcyc7XG5pbXBvcnQgdHlwZSB7IFBlcm1pc3Npb24gfSBmcm9tICcuLi90eXBlcy9wZXJtaXNzaW9ucy5qcyc7XG5pbXBvcnQgeyBnZXRQYXJhbSB9IGZyb20gJy4uL3V0aWxzL3BhcmFtcy5qcyc7XG5pbXBvcnQgeyBzZW5kQmFkUmVxdWVzdCB9IGZyb20gJy4uL3V0aWxzL3Jlc3BvbnNlLmpzJztcblxuLyoqIE1pbmltYWwgc2hhcGUgYSByZXN0b3JlIHJvdXRlIG5lZWRzIGZyb20gdGhlIGVudGl0eSBpdCByZXN0b3Jlcy4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVzdG9yYWJsZUVudGl0eSB7XG4gIG9yZ0lkOiBzdHJpbmc7XG4gIC8qKiBSdW5nIHRoZSB0b21ic3RvbmUgc2F0IGF0IOKAlCBkcml2ZXMgdGhlIHJlc3RvcmUvcHVyZ2UgYXV0aG9yaXR5IGNoZWNrLiAqL1xuICB2aXNpYmlsaXR5Pzogc3RyaW5nO1xuICAvKiogQXV0aG9yIOKAlCB0aGUgb25seSBub24tYWRtaW4gd2hvIG1heSByZXN0b3JlL3B1cmdlIGEgYHByaXZhdGVgIHJvdy4gKi9cbiAgY3JlYXRlZEJ5Pzogc3RyaW5nO1xufVxuXG4vKiogVGhlIHNsaWNlIG9mIGEgc2VydmljZSBhIHJlc3RvcmUgcm91dGUgdXNlcyAoc2F0aXNmaWVkIGJ5IGFueSBDcnVkU2VydmljZSkuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlc3RvcmFibGVTZXJ2aWNlPFQgZXh0ZW5kcyBSZXN0b3JhYmxlRW50aXR5PiB7XG4gIGZpbmREZWxldGVkQnlJZChpZDogc3RyaW5nLCBvcmdJZD86IHN0cmluZyk6IFByb21pc2U8VCB8IG51bGw+O1xuICByZXN0b3JlKGlkOiBzdHJpbmcsIG9yZ0lkOiBzdHJpbmcsIHVzZXJJZDogc3RyaW5nKTogUHJvbWlzZTxUIHwgbnVsbD47XG59XG5cbi8qKlxuICogU2hhcmVkIHNrZWxldG9uIGZvciBhIHN0ZXAtdXAtZ2F0ZWQgZW50aXR5IHJlc3RvcmUgcm91dGU6IGV4dHJhY3QgYDppZGAsIGxvYWRcbiAqIHRoZSBvd24tb3JnIHRvbWJzdG9uZSwgZ2F0ZSBpdCBvbiB0aGUgdmlzaWJpbGl0eSBsYWRkZXIgKHBhcml0eSB3aXRoIGRlbGV0ZSksXG4gKiByZXN0b3JlLCBhbmQgNDA0IG9uIG1pc3MuIFJldHVybnMgYHsgZXhpc3RpbmcsIHJlc3RvcmVkIH1gIG9uIHN1Y2Nlc3MsXG4gKiBvciBgbnVsbGAgd2hlbiBpdCBoYXMgQUxSRUFEWSBzZW50IGEgcmVzcG9uc2UgKDQwMC80MDQvNDAzKSDigJQgdGhlIGNhbGxlciB0aGVuXG4gKiBkb2VzIHRoZSBlbnRpdHktc3BlY2lmaWMgYXVkaXQgKyByZXNwb25zZS4gRFJZcyB0aGUgbmVhci1pZGVudGljYWxcbiAqIHBpcGVsaW5lIC8gcGx1Z2luIC8gcGlwZWxpbmVfdGVtcGxhdGUgcmVzdG9yZSByb3V0ZXMgKHdoaWNoIGRpZmZlciBvbmx5IGluXG4gKiBzZXJ2aWNlLCBhdWRpdCBhY3Rpb24sIGFuZCByZXNwb25zZSBzaGFwaW5nKS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGxvYWRBbmRSZXN0b3JlPFQgZXh0ZW5kcyBSZXN0b3JhYmxlRW50aXR5PihcbiAgcmVxOiBSZXF1ZXN0LFxuICByZXM6IFJlc3BvbnNlLFxuICBvcmdJZDogc3RyaW5nLFxuICB1c2VySWQ6IHN0cmluZyxcbiAgc2VydmljZTogUmVzdG9yYWJsZVNlcnZpY2U8VD4sXG4gIGxhYmVsOiBzdHJpbmcsXG4gIHB1Ymxpc2hQZXJtaXNzaW9uOiBQZXJtaXNzaW9uLFxuKTogUHJvbWlzZTx7IGV4aXN0aW5nOiBUOyByZXN0b3JlZDogVCB9IHwgbnVsbD4ge1xuICBjb25zdCBpZCA9IGdldFBhcmFtKHJlcS5wYXJhbXMsICdpZCcpO1xuICBpZiAoIWlkKSB7XG4gICAgc2VuZEJhZFJlcXVlc3QocmVzLCBgJHtsYWJlbH0gSUQgaXMgcmVxdWlyZWQuYCwgRXJyb3JDb2RlLk1JU1NJTkdfUkVRVUlSRURfRklFTEQpO1xuICAgIHJldHVybiBudWxsO1xuICB9XG5cbiAgLy8gTG9hZCB0aGUgVE9NQlNUT05FIChvd24tb3JnKS4gQSBsaXZlIHJvdyAvIHVua25vd24gaWQgLyBhbHJlYWR5LXB1cmdlZCDihpIgNDA0LlxuICBjb25zdCBleGlzdGluZyA9IGF3YWl0IHNlcnZpY2UuZmluZERlbGV0ZWRCeUlkKGlkLCBvcmdJZCk7XG4gIGlmICghZXhpc3RpbmcpIHtcbiAgICBzZW5kRW50aXR5Tm90Rm91bmQocmVzLCBsYWJlbCk7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cblxuICAvLyBTYW1lIGxhZGRlciBhdXRob3JpdHkgYXMgZGVsZXRlOiBgOnB1Ymxpc2hgIGZvciBhIHB1YmxpYyByb3csIGF1dGhvcnNoaXAgZm9yXG4gIC8vIGEgcHJpdmF0ZSBvbmUuIExvYWQtYmVhcmluZyBoZXJlIOKAlCB0aGUgdG9tYnN0b25lIGxvYWQgaXMgb3JnLXNjb3BlZCwgbm90XG4gIC8vIHZpc2liaWxpdHktc2NvcGVkLCBzbyB0aGlzIGlzIHdoYXQgc3RvcHMgYSBjb2xsZWFndWUgcmVzdXJyZWN0aW5nIGEgZHJhZnQuXG4gIGlmICghcmVxdWlyZVZpc2liaWxpdHlXcml0ZUFjY2VzcyhyZXEsIHJlcywgZXhpc3RpbmcsIHVzZXJJZCB8fCAnJywgcHVibGlzaFBlcm1pc3Npb24pKSByZXR1cm4gbnVsbDtcblxuICBjb25zdCByZXN0b3JlZCA9IGF3YWl0IHNlcnZpY2UucmVzdG9yZShpZCwgb3JnSWQsIHVzZXJJZCB8fCAnc3lzdGVtJyk7XG4gIGlmICghcmVzdG9yZWQpIHtcbiAgICBzZW5kRW50aXR5Tm90Rm91bmQocmVzLCBsYWJlbCk7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cblxuICByZXR1cm4geyBleGlzdGluZywgcmVzdG9yZWQgfTtcbn1cblxuLyoqIFRoZSBzbGljZSBvZiBhIHNlcnZpY2UgYSBwdXJnZSByb3V0ZSB1c2VzIChzYXRpc2ZpZWQgYnkgYW55IENydWRTZXJ2aWNlKS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUHVyZ2VhYmxlU2VydmljZTxUIGV4dGVuZHMgUmVzdG9yYWJsZUVudGl0eT4ge1xuICBmaW5kRGVsZXRlZEJ5SWQoaWQ6IHN0cmluZywgb3JnSWQ/OiBzdHJpbmcpOiBQcm9taXNlPFQgfCBudWxsPjtcbiAgcHVyZ2VCeUlkKGlkOiBzdHJpbmcsIG9yZ0lkPzogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmcgfCBudWxsPjtcbn1cblxuLyoqXG4gKiBTaGFyZWQgc2tlbGV0b24gZm9yIGFuIGVudGl0eSBQVVJHRSByb3V0ZTogZXh0cmFjdCBgOmlkYCwgbG9hZCB0aGUgb3duLW9yZ1xuICogdG9tYnN0b25lLCBnYXRlIGl0IG9uIHRoZSB2aXNpYmlsaXR5IGxhZGRlciAocGFyaXR5IHdpdGhcbiAqIGRlbGV0ZS9yZXN0b3JlKSwgdGhlbiBwZXJtYW5lbnRseSBoYXJkLWRlbGV0ZSBpdCDigJQgYnV0IE9OTFkgd2hlbiBpdCBpcyBhXG4gKiBnZW51aW5lIHRvbWJzdG9uZSAoYSBsaXZlL2FjdGl2ZSByb3cgbG9hZHMgYXMgYG51bGxgIGhlcmUgYW5kIDQwNHMsIHNvIHB1cmdlXG4gKiBjYW4gbmV2ZXIgaGFyZC1kZWxldGUgYSBsaXZlIHJvdykuIFJldHVybnMgYHsgZXhpc3RpbmcsIHB1cmdlZElkIH1gIG9uIHN1Y2Nlc3NcbiAqICh0aGUgY2FsbGVyIGVtaXRzIHRoZSBlbnRpdHktc3BlY2lmaWMgYXVkaXQgb2ZmIGBleGlzdGluZ2ApLCBvciBgbnVsbGAgd2hlbiBpdFxuICogaGFzIEFMUkVBRFkgc2VudCBhIHJlc3BvbnNlICg0MDAvNDA0LzQwMykuIFN0ZXAtdXAgaXMgdGhlIFJPVVRFJ3Mgam9iOiB0aGVcbiAqIHBpcGVsaW5lLCB0ZW1wbGF0ZSBhbmQgcGx1Z2luIHNlcnZpY2VzIG1vdW50IHB1cmdlIGJlaGluZCBgcmVxdWlyZVN0ZXBVcGBcbiAqIChzaGFyaW5nIHJlc3RvcmUncyBjaGFpbiBzbyBvbmUgdG9rZW4gaXNuJ3QgY29uc3VtZWQgdHdpY2UpLiBEUllzIHRoZSBuZWFyLWlkZW50aWNhbFxuICogcGlwZWxpbmUgLyBwaXBlbGluZV90ZW1wbGF0ZSBwdXJnZSByb3V0ZXMuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBsb2FkQW5kUHVyZ2U8VCBleHRlbmRzIFJlc3RvcmFibGVFbnRpdHk+KFxuICByZXE6IFJlcXVlc3QsXG4gIHJlczogUmVzcG9uc2UsXG4gIG9yZ0lkOiBzdHJpbmcsXG4gIHNlcnZpY2U6IFB1cmdlYWJsZVNlcnZpY2U8VD4sXG4gIGxhYmVsOiBzdHJpbmcsXG4gIHB1Ymxpc2hQZXJtaXNzaW9uOiBQZXJtaXNzaW9uLFxuICB1c2VySWQ6IHN0cmluZyxcbik6IFByb21pc2U8eyBleGlzdGluZzogVDsgcHVyZ2VkSWQ6IHN0cmluZyB9IHwgbnVsbD4ge1xuICBjb25zdCBpZCA9IGdldFBhcmFtKHJlcS5wYXJhbXMsICdpZCcpO1xuICBpZiAoIWlkKSB7XG4gICAgc2VuZEJhZFJlcXVlc3QocmVzLCBgJHtsYWJlbH0gSUQgaXMgcmVxdWlyZWQuYCwgRXJyb3JDb2RlLk1JU1NJTkdfUkVRVUlSRURfRklFTEQpO1xuICAgIHJldHVybiBudWxsO1xuICB9XG5cbiAgLy8gTG9hZCB0aGUgVE9NQlNUT05FIChvd24tb3JnKS4gQSBsaXZlIHJvdyAvIHVua25vd24gaWQgLyBhbHJlYWR5LXB1cmdlZCDihpIgNDA0LFxuICAvLyBzbyBhIGN1cnJlbnRseS1hY3RpdmUgZW50aXR5IGlzIG5ldmVyIGhhcmQtZGVsZXRlZCB0aHJvdWdoIHRoaXMgcGF0aC5cbiAgY29uc3QgZXhpc3RpbmcgPSBhd2FpdCBzZXJ2aWNlLmZpbmREZWxldGVkQnlJZChpZCwgb3JnSWQpO1xuICBpZiAoIWV4aXN0aW5nKSB7XG4gICAgc2VuZEVudGl0eU5vdEZvdW5kKHJlcywgbGFiZWwpO1xuICAgIHJldHVybiBudWxsO1xuICB9XG5cbiAgLy8gU2FtZSBsYWRkZXIgYXV0aG9yaXR5IGFzIGRlbGV0ZS9yZXN0b3JlIChzZWUgbG9hZEFuZFJlc3RvcmUpLlxuICBpZiAoIXJlcXVpcmVWaXNpYmlsaXR5V3JpdGVBY2Nlc3MocmVxLCByZXMsIGV4aXN0aW5nLCB1c2VySWQgfHwgJycsIHB1Ymxpc2hQZXJtaXNzaW9uKSkgcmV0dXJuIG51bGw7XG5cbiAgLy8gUmV1c2UgdGhlIHJldGVudGlvbiBzd2VlcCdzIHNpbmdsZS1pZCBoYXJkLWRlbGV0ZSAoc2FtZSB0b21ic3RvbmUgbWF0Y2ggK1xuICAvLyBkZXBlbmRlbnQtdGVhcmRvd24gaG9va3MpLiBSZXR1cm5zIG51bGwgb24gYSByYWNlIChhbHJlYWR5IHB1cmdlZCkg4oaSIDQwNC5cbiAgY29uc3QgcHVyZ2VkSWQgPSBhd2FpdCBzZXJ2aWNlLnB1cmdlQnlJZChpZCwgb3JnSWQpO1xuICBpZiAoIXB1cmdlZElkKSB7XG4gICAgc2VuZEVudGl0eU5vdEZvdW5kKHJlcywgbGFiZWwpO1xuICAgIHJldHVybiBudWxsO1xuICB9XG5cbiAgcmV0dXJuIHsgZXhpc3RpbmcsIHB1cmdlZElkIH07XG59XG4iXX0=

package/lib/helpers/sse-helpers.d.ts

@@ -9,8 +9,15 @@ export declare function writeSseHeaders(res: Response): void;
 /**
  * Set SSE response headers and flush.
  * Returns an `aborted()` function to check if the client disconnected.
+ *
+ * Disconnect is detected on the RESPONSE: `res` emits 'close' when the
+ * underlying connection goes away, and `writableFinished` tells an early close
+ * (client gone) from the normal close after `res.end()`. The request's own
+ * 'close' is not a disconnect signal — on current Node it fires once the request
+ * BODY has been consumed, which for a POST stream happens before this listener
+ * is attached, so a disconnect was never observed.
  */
-export declare function initSSEStream(req: Request, res: Response, timeoutMs: number): {
+export declare function initSSEStream(_req: Request, res: Response, timeoutMs: number): {
     aborted: () => boolean;
 };
 /**

package/lib/helpers/sse-helpers.js

@@ -16,13 +16,21 @@ export function writeSseHeaders(res) {
 /**
  * Set SSE response headers and flush.
  * Returns an `aborted()` function to check if the client disconnected.
+ *
+ * Disconnect is detected on the RESPONSE: `res` emits 'close' when the
+ * underlying connection goes away, and `writableFinished` tells an early close
+ * (client gone) from the normal close after `res.end()`. The request's own
+ * 'close' is not a disconnect signal — on current Node it fires once the request
+ * BODY has been consumed, which for a POST stream happens before this listener
+ * is attached, so a disconnect was never observed.
  */
-export function initSSEStream(req, res, timeoutMs) {
+export function initSSEStream(_req, res, timeoutMs) {
     writeSseHeaders(res);
     res.setTimeout(timeoutMs);
     res.flushHeaders();
     let _aborted = false;
-    req.on('close', () => { _aborted = true; });
+    res.on('close', () => { if (!res.writableFinished)
+        _aborted = true; });
     return { aborted: () => _aborted };
 }
 /**
@@ -49,4 +57,4 @@ export function handleAIError(res, message, fallbackMessage) {
     res.write(`data: ${JSON.stringify({ type: 'error', message })}\n\n`);
     res.end();
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3NlLWhlbHBlcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaGVscGVycy9zc2UtaGVscGVycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBR3RDLE9BQU8sRUFBRSxjQUFjLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUV6RTs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxlQUFlLENBQUMsR0FBYTtJQUMzQyxHQUFHLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO0lBQ25ELEdBQUcsQ0FBQyxTQUFTLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzNDLEdBQUcsQ0FBQyxTQUFTLENBQUMsWUFBWSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDM0MsQ0FBQztBQUVEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxhQUFhLENBQUMsR0FBWSxFQUFFLEdBQWEsRUFBRSxTQUFpQjtJQUMxRSxlQUFlLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDckIsR0FBRyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMxQixHQUFHLENBQUMsWUFBWSxFQUFFLENBQUM7SUFDbkIsSUFBSSxRQUFRLEdBQUcsS0FBSyxDQUFDO0lBQ3JCLEdBQUcsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxHQUFHLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1QyxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDO0FBQ3JDLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsYUFBYSxDQUFDLEdBQWEsRUFBRSxPQUFlLEVBQUUsZUFBdUI7SUFDbkYsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyQixJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDdEUscUVBQXFFO1lBQ3JFLHdFQUF3RTtZQUN4RSx3RUFBd0U7WUFDeEUsaUVBQWlFO1lBQ2pFLDBFQUEwRTtZQUMxRSx5RUFBeUU7WUFDekUseUVBQXlFO1lBQ3pFLE9BQU8saUJBQWlCLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3pDLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsNEJBQTRCLENBQUMsRUFBRSxDQUFDO1lBQ25ELE9BQU8sY0FBYyxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN0QyxDQUFDO1FBQ0QsT0FBTyxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsZUFBZSxFQUFFLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNyRSxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDWixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB0eXBlIHsgUmVxdWVzdCwgUmVzcG9uc2UgfSBmcm9tICdleHByZXNzJztcbmltcG9ydCB7IHNlbmRCYWRSZXF1ZXN0LCBzZW5kSW50ZXJuYWxFcnJvciB9IGZyb20gJy4uL3V0aWxzL3Jlc3BvbnNlLmpzJztcblxuLyoqXG4gKiBTZXQgdGhlIGZvdXIgc3RhbmRhcmQgU1NFIHJlc3BvbnNlIGhlYWRlcnMgKGRvZXMgTk9UIGZsdXNoIOKAlCB0aGUgY2FsbGVyIGZsdXNoZXNcbiAqIGFmdGVyIGFueSBhZGRpdGlvbmFsIHBlci1lbmRwb2ludCBzZXR1cCBsaWtlIGByZXMuc2V0VGltZW91dGApLiBUaGUgc2luZ2xlXG4gKiBzb3VyY2Ugb2YgdHJ1dGggZm9yIHRoZSBgdGV4dC9ldmVudC1zdHJlYW1gICsgbm8tY2FjaGUgKyBrZWVwLWFsaXZlICtcbiAqIGBYLUFjY2VsLUJ1ZmZlcmluZzogbm9gIChkaXNhYmxlIG5naW54IGJ1ZmZlcmluZykgYmxvY2suXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiB3cml0ZVNzZUhlYWRlcnMocmVzOiBSZXNwb25zZSk6IHZvaWQge1xuICByZXMuc2V0SGVhZGVyKCdDb250ZW50LVR5cGUnLCAndGV4dC9ldmVudC1zdHJlYW0nKTtcbiAgcmVzLnNldEhlYWRlcignQ2FjaGUtQ29udHJvbCcsICduby1jYWNoZScpO1xuICByZXMuc2V0SGVhZGVyKCdDb25uZWN0aW9uJywgJ2tlZXAtYWxpdmUnKTtcbiAgcmVzLnNldEhlYWRlcignWC1BY2NlbC1CdWZmZXJpbmcnLCAnbm8nKTtcbn1cblxuLyoqXG4gKiBTZXQgU1NFIHJlc3BvbnNlIGhlYWRlcnMgYW5kIGZsdXNoLlxuICogUmV0dXJucyBhbiBgYWJvcnRlZCgpYCBmdW5jdGlvbiB0byBjaGVjayBpZiB0aGUgY2xpZW50IGRpc2Nvbm5lY3RlZC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGluaXRTU0VTdHJlYW0ocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCB0aW1lb3V0TXM6IG51bWJlcik6IHsgYWJvcnRlZDogKCkgPT4gYm9vbGVhbiB9IHtcbiAgd3JpdGVTc2VIZWFkZXJzKHJlcyk7XG4gIHJlcy5zZXRUaW1lb3V0KHRpbWVvdXRNcyk7XG4gIHJlcy5mbHVzaEhlYWRlcnMoKTtcbiAgbGV0IF9hYm9ydGVkID0gZmFsc2U7XG4gIHJlcS5vbignY2xvc2UnLCAoKSA9PiB7IF9hYm9ydGVkID0gdHJ1ZTsgfSk7XG4gIHJldHVybiB7IGFib3J0ZWQ6ICgpID0+IF9hYm9ydGVkIH07XG59XG5cbi8qKlxuICogQ2xhc3NpZnkgQUkgZ2VuZXJhdGlvbiBlcnJvcnMgYW5kIHNlbmQgdGhlIGFwcHJvcHJpYXRlIEhUVFAgcmVzcG9uc2Ugb3IgU1NFIGV2ZW50LlxuICogSWYgaGVhZGVycyBhcmUgYWxyZWFkeSBzZW50IChzdHJlYW1pbmcpLCB3cml0ZXMgYW4gU1NFIGVycm9yIGV2ZW50IGFuZCBlbmRzIHRoZSByZXNwb25zZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGhhbmRsZUFJRXJyb3IocmVzOiBSZXNwb25zZSwgbWVzc2FnZTogc3RyaW5nLCBmYWxsYmFja01lc3NhZ2U6IHN0cmluZyk6IHZvaWQge1xuICBpZiAoIXJlcy5oZWFkZXJzU2VudCkge1xuICAgIGlmIChtZXNzYWdlLmluY2x1ZGVzKCdub3QgY29uZmlndXJlZCcpIHx8IG1lc3NhZ2UuaW5jbHVkZXMoJ0FQSSBrZXknKSkge1xuICAgICAgLy8gU3VyZmFjZSB0aGUgT1JJR0lOQUwgbWVzc2FnZS4gSXQgbmFtZXMgdGhlIE1JU1NJTkcgQ09ORklHVVJBVElPTiDigJRcbiAgICAgIC8vIFwibm8gcHJvdmlkZXIgQVBJIGtleSBpcyBzZXQgYW5kIE9QRU5BSV9DT01QQVRJQkxFX0JBU0VfVVJMIGlzIHVuc2V0XCIsXG4gICAgICAvLyBvciB3aGljaCBlbnYgdmFyIGEgbmFtZWQgcHJvdmlkZXIgd2FudHMg4oCUIG5ldmVyIGEgc2VjcmV0IFZBTFVFLCBzbyBpdFxuICAgICAgLy8gaXMgc2FmZSB0byBzaG93IGFuZCBpdCBpcyB0aGUgb25seSB0aGluZyB0aGF0IG1ha2VzIHRoaXMgZXJyb3JcbiAgICAgIC8vIGFjdGlvbmFibGUuIFRoZSBnZW5lcmljIHJlcGxhY2VtZW50IGFsc28gbWlzLWRlc2NyaWJlZCB0aGUgY29tbW9uIGNhc2U6XG4gICAgICAvLyBpdCBzYWlkIFwiZm9yIHRoZSByZXF1ZXN0ZWQgcHJvdmlkZXJcIiB3aGVuIG5vIHByb3ZpZGVyIHdhcyByZXF1ZXN0ZWQgYXRcbiAgICAgIC8vIGFsbCwgcG9pbnRpbmcgb3BlcmF0b3JzIGF0IGEgcHJvdmlkZXIgYnVnIGluc3RlYWQgb2YgYXQgY29uZmlndXJhdGlvbi5cbiAgICAgIHJldHVybiBzZW5kSW50ZXJuYWxFcnJvcihyZXMsIG1lc3NhZ2UpO1xuICAgIH1cbiAgICBpZiAobWVzc2FnZS5pbmNsdWRlcygnbm90IGF2YWlsYWJsZSBmb3IgcHJvdmlkZXInKSkge1xuICAgICAgcmV0dXJuIHNlbmRCYWRSZXF1ZXN0KHJlcywgbWVzc2FnZSk7XG4gICAgfVxuICAgIHJldHVybiBzZW5kSW50ZXJuYWxFcnJvcihyZXMsIGZhbGxiYWNrTWVzc2FnZSwgeyBkZXRhaWxzOiBtZXNzYWdlIH0pO1xuICB9XG4gIHJlcy53cml0ZShgZGF0YTogJHtKU09OLnN0cmluZ2lmeSh7IHR5cGU6ICdlcnJvcicsIG1lc3NhZ2UgfSl9XFxuXFxuYCk7XG4gIHJlcy5lbmQoKTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3NlLWhlbHBlcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaGVscGVycy9zc2UtaGVscGVycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBR3RDLE9BQU8sRUFBRSxjQUFjLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUV6RTs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxlQUFlLENBQUMsR0FBYTtJQUMzQyxHQUFHLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO0lBQ25ELEdBQUcsQ0FBQyxTQUFTLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzNDLEdBQUcsQ0FBQyxTQUFTLENBQUMsWUFBWSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDM0MsQ0FBQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLFVBQVUsYUFBYSxDQUFDLElBQWEsRUFBRSxHQUFhLEVBQUUsU0FBaUI7SUFDM0UsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3JCLEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDMUIsR0FBRyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ25CLElBQUksUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNyQixHQUFHLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLGdCQUFnQjtRQUFFLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN2RSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDO0FBQ3JDLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsYUFBYSxDQUFDLEdBQWEsRUFBRSxPQUFlLEVBQUUsZUFBdUI7SUFDbkYsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyQixJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDdEUscUVBQXFFO1lBQ3JFLHdFQUF3RTtZQUN4RSx3RUFBd0U7WUFDeEUsaUVBQWlFO1lBQ2pFLDBFQUEwRTtZQUMxRSx5RUFBeUU7WUFDekUseUVBQXlFO1lBQ3pFLE9BQU8saUJBQWlCLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3pDLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsNEJBQTRCLENBQUMsRUFBRSxDQUFDO1lBQ25ELE9BQU8sY0FBYyxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN0QyxDQUFDO1FBQ0QsT0FBTyxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsZUFBZSxFQUFFLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNyRSxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDWixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB0eXBlIHsgUmVxdWVzdCwgUmVzcG9uc2UgfSBmcm9tICdleHByZXNzJztcbmltcG9ydCB7IHNlbmRCYWRSZXF1ZXN0LCBzZW5kSW50ZXJuYWxFcnJvciB9IGZyb20gJy4uL3V0aWxzL3Jlc3BvbnNlLmpzJztcblxuLyoqXG4gKiBTZXQgdGhlIGZvdXIgc3RhbmRhcmQgU1NFIHJlc3BvbnNlIGhlYWRlcnMgKGRvZXMgTk9UIGZsdXNoIOKAlCB0aGUgY2FsbGVyIGZsdXNoZXNcbiAqIGFmdGVyIGFueSBhZGRpdGlvbmFsIHBlci1lbmRwb2ludCBzZXR1cCBsaWtlIGByZXMuc2V0VGltZW91dGApLiBUaGUgc2luZ2xlXG4gKiBzb3VyY2Ugb2YgdHJ1dGggZm9yIHRoZSBgdGV4dC9ldmVudC1zdHJlYW1gICsgbm8tY2FjaGUgKyBrZWVwLWFsaXZlICtcbiAqIGBYLUFjY2VsLUJ1ZmZlcmluZzogbm9gIChkaXNhYmxlIG5naW54IGJ1ZmZlcmluZykgYmxvY2suXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiB3cml0ZVNzZUhlYWRlcnMocmVzOiBSZXNwb25zZSk6IHZvaWQge1xuICByZXMuc2V0SGVhZGVyKCdDb250ZW50LVR5cGUnLCAndGV4dC9ldmVudC1zdHJlYW0nKTtcbiAgcmVzLnNldEhlYWRlcignQ2FjaGUtQ29udHJvbCcsICduby1jYWNoZScpO1xuICByZXMuc2V0SGVhZGVyKCdDb25uZWN0aW9uJywgJ2tlZXAtYWxpdmUnKTtcbiAgcmVzLnNldEhlYWRlcignWC1BY2NlbC1CdWZmZXJpbmcnLCAnbm8nKTtcbn1cblxuLyoqXG4gKiBTZXQgU1NFIHJlc3BvbnNlIGhlYWRlcnMgYW5kIGZsdXNoLlxuICogUmV0dXJucyBhbiBgYWJvcnRlZCgpYCBmdW5jdGlvbiB0byBjaGVjayBpZiB0aGUgY2xpZW50IGRpc2Nvbm5lY3RlZC5cbiAqXG4gKiBEaXNjb25uZWN0IGlzIGRldGVjdGVkIG9uIHRoZSBSRVNQT05TRTogYHJlc2AgZW1pdHMgJ2Nsb3NlJyB3aGVuIHRoZVxuICogdW5kZXJseWluZyBjb25uZWN0aW9uIGdvZXMgYXdheSwgYW5kIGB3cml0YWJsZUZpbmlzaGVkYCB0ZWxscyBhbiBlYXJseSBjbG9zZVxuICogKGNsaWVudCBnb25lKSBmcm9tIHRoZSBub3JtYWwgY2xvc2UgYWZ0ZXIgYHJlcy5lbmQoKWAuIFRoZSByZXF1ZXN0J3Mgb3duXG4gKiAnY2xvc2UnIGlzIG5vdCBhIGRpc2Nvbm5lY3Qgc2lnbmFsIOKAlCBvbiBjdXJyZW50IE5vZGUgaXQgZmlyZXMgb25jZSB0aGUgcmVxdWVzdFxuICogQk9EWSBoYXMgYmVlbiBjb25zdW1lZCwgd2hpY2ggZm9yIGEgUE9TVCBzdHJlYW0gaGFwcGVucyBiZWZvcmUgdGhpcyBsaXN0ZW5lclxuICogaXMgYXR0YWNoZWQsIHNvIGEgZGlzY29ubmVjdCB3YXMgbmV2ZXIgb2JzZXJ2ZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpbml0U1NFU3RyZWFtKF9yZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIHRpbWVvdXRNczogbnVtYmVyKTogeyBhYm9ydGVkOiAoKSA9PiBib29sZWFuIH0ge1xuICB3cml0ZVNzZUhlYWRlcnMocmVzKTtcbiAgcmVzLnNldFRpbWVvdXQodGltZW91dE1zKTtcbiAgcmVzLmZsdXNoSGVhZGVycygpO1xuICBsZXQgX2Fib3J0ZWQgPSBmYWxzZTtcbiAgcmVzLm9uKCdjbG9zZScsICgpID0+IHsgaWYgKCFyZXMud3JpdGFibGVGaW5pc2hlZCkgX2Fib3J0ZWQgPSB0cnVlOyB9KTtcbiAgcmV0dXJuIHsgYWJvcnRlZDogKCkgPT4gX2Fib3J0ZWQgfTtcbn1cblxuLyoqXG4gKiBDbGFzc2lmeSBBSSBnZW5lcmF0aW9uIGVycm9ycyBhbmQgc2VuZCB0aGUgYXBwcm9wcmlhdGUgSFRUUCByZXNwb25zZSBvciBTU0UgZXZlbnQuXG4gKiBJZiBoZWFkZXJzIGFyZSBhbHJlYWR5IHNlbnQgKHN0cmVhbWluZyksIHdyaXRlcyBhbiBTU0UgZXJyb3IgZXZlbnQgYW5kIGVuZHMgdGhlIHJlc3BvbnNlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaGFuZGxlQUlFcnJvcihyZXM6IFJlc3BvbnNlLCBtZXNzYWdlOiBzdHJpbmcsIGZhbGxiYWNrTWVzc2FnZTogc3RyaW5nKTogdm9pZCB7XG4gIGlmICghcmVzLmhlYWRlcnNTZW50KSB7XG4gICAgaWYgKG1lc3NhZ2UuaW5jbHVkZXMoJ25vdCBjb25maWd1cmVkJykgfHwgbWVzc2FnZS5pbmNsdWRlcygnQVBJIGtleScpKSB7XG4gICAgICAvLyBTdXJmYWNlIHRoZSBPUklHSU5BTCBtZXNzYWdlLiBJdCBuYW1lcyB0aGUgTUlTU0lORyBDT05GSUdVUkFUSU9OIOKAlFxuICAgICAgLy8gXCJubyBwcm92aWRlciBBUEkga2V5IGlzIHNldCBhbmQgT1BFTkFJX0NPTVBBVElCTEVfQkFTRV9VUkwgaXMgdW5zZXRcIixcbiAgICAgIC8vIG9yIHdoaWNoIGVudiB2YXIgYSBuYW1lZCBwcm92aWRlciB3YW50cyDigJQgbmV2ZXIgYSBzZWNyZXQgVkFMVUUsIHNvIGl0XG4gICAgICAvLyBpcyBzYWZlIHRvIHNob3cgYW5kIGl0IGlzIHRoZSBvbmx5IHRoaW5nIHRoYXQgbWFrZXMgdGhpcyBlcnJvclxuICAgICAgLy8gYWN0aW9uYWJsZS4gVGhlIGdlbmVyaWMgcmVwbGFjZW1lbnQgYWxzbyBtaXMtZGVzY3JpYmVkIHRoZSBjb21tb24gY2FzZTpcbiAgICAgIC8vIGl0IHNhaWQgXCJmb3IgdGhlIHJlcXVlc3RlZCBwcm92aWRlclwiIHdoZW4gbm8gcHJvdmlkZXIgd2FzIHJlcXVlc3RlZCBhdFxuICAgICAgLy8gYWxsLCBwb2ludGluZyBvcGVyYXRvcnMgYXQgYSBwcm92aWRlciBidWcgaW5zdGVhZCBvZiBhdCBjb25maWd1cmF0aW9uLlxuICAgICAgcmV0dXJuIHNlbmRJbnRlcm5hbEVycm9yKHJlcywgbWVzc2FnZSk7XG4gICAgfVxuICAgIGlmIChtZXNzYWdlLmluY2x1ZGVzKCdub3QgYXZhaWxhYmxlIGZvciBwcm92aWRlcicpKSB7XG4gICAgICByZXR1cm4gc2VuZEJhZFJlcXVlc3QocmVzLCBtZXNzYWdlKTtcbiAgICB9XG4gICAgcmV0dXJuIHNlbmRJbnRlcm5hbEVycm9yKHJlcywgZmFsbGJhY2tNZXNzYWdlLCB7IGRldGFpbHM6IG1lc3NhZ2UgfSk7XG4gIH1cbiAgcmVzLndyaXRlKGBkYXRhOiAke0pTT04uc3RyaW5naWZ5KHsgdHlwZTogJ2Vycm9yJywgbWVzc2FnZSB9KX1cXG5cXG5gKTtcbiAgcmVzLmVuZCgpO1xufVxuIl19

package/lib/middleware/auth.d.ts

@@ -1,44 +1,41 @@
 import type { Request, Response, NextFunction } from 'express';
-import jwt from 'jsonwebtoken';
-import type { JwtPayload } from '../types/common.js';
+import { type AssuranceLevel, type JwtPayload } from '../types/common.js';
 import { type Permission } from '../types/permissions.js';
 /**
- * Test-only: drop the cached JWT secrets so the next verify re-reads the env.
+ * Verify a token that speaks for a PERSON — access, step-up, and the token an
+ * opaque access key is exchanged for — against platform's published signing
+ * keys.
  *
- * Both secrets are cached for {@link JWT_SECRET_REFRESH_INTERVAL_MS}, so a test
- * that sets `JWT_SECRET`/`JWT_SECRET_PREVIOUS` mid-run would otherwise keep
- * verifying against the values read on first use. Don't call from production
- * code — rotation is picked up by the refresh interval.
- */
-export declare function _resetJwtSecretCacheForTests(): void;
-/**
- * The JWT verify options every token check in the fleet must share: pinned
- * algorithm (blocks alg-confusion / `alg:none`) plus issuer/audience when the
- * deployment configures them.
+ * ES256 and a `kid` are both mandatory: no `kid` means no way to pick the right
+ * key across a rotation, and any other algorithm is refused outright, which is
+ * what makes "no service accepts an HS256 user token" a property of the code
+ * rather than a convention. Key lookup goes through the shared JWKS cache
+ * (10-minute refresh, one refetch on an unknown `kid`, brief negative cache).
  *
- * Centralized because it was built inline at each call site and `step-up.ts`
- * re-implemented it WITHOUT the issuer/audience pinning — so in a deployment
- * that sets `JWT_ISSUER`/`JWT_AUDIENCE`, a step-up token minted by any other
- * system sharing `JWT_SECRET` was accepted.
+ * @throws {UnknownKidError} the key set is current and has no such key → 401.
+ * @throws {JwksUnavailableError} the key set could not be obtained → 503; an
+ *         unverifiable token is never treated as valid.
  */
-export declare function buildJwtVerifyOptions(): jwt.VerifyOptions;
+export declare function verifyUserJwt<T = JwtPayload>(token: string): Promise<T>;
 /**
- * Verify a JWT against the primary secret, falling back to the previous secret
- * (when `JWT_SECRET_PREVIOUS` is configured) ONLY on a signature/verification
- * failure. This makes token verification survive a secret rotation with zero
- * downtime: a token valid under EITHER secret passes.
+ * Verify ANY bearer token and return its claims.
+ *
+ * Since #14 there is no shared secret left: BOTH chains are ES256 with a `kid`,
+ * so the dispatch is by **who owns the `kid`** rather than by algorithm — and
+ * because a `kid` is an RFC 7638 thumbprint, ownership is a fact about the key,
+ * not a claim the token makes about itself:
  *
- * jsonwebtoken's `verify` takes a single secret, so this is try-primary-then-
- * previous — NOT a secret array. No existing check is weakened:
- *   - `verifyOptions` (algorithm pinning + optional issuer/audience) is applied
- *     identically on BOTH attempts, so alg-confusion / `alg:none` stay blocked.
- *   - Expiry / not-before from the PRIMARY attempt are authoritative and are
- *     re-thrown without a previous-secret retry, so a `TokenExpiredError` is
- *     never masked into an "invalid signature".
- *   - When no previous secret is set, behaviour is byte-for-byte the original:
- *     the primary error propagates unchanged.
+ * - a `kid` published in the per-service key bundle → an INTERNAL SERVICE token
+ *   ({@link signServiceToken}), verified with that service's key; its `sub` must
+ *   name the same service, so one service can never speak for another.
+ * - anything else → a platform-signed USER token, verified against platform's
+ *   published JWKS. A token claiming `principalType: 'service'` is refused
+ *   here: an internal identity may not ride the user signing key.
+ *
+ * Anything that is not ES256 with a `kid` fails in both chains, which is what
+ * makes "no HS256 token is accepted anywhere" a property of the code.
  */
-export declare function verifyJwtWithRotation(token: string, verifyOptions: jwt.VerifyOptions): JwtPayload;
+export declare function verifyBearerToken(token: string): Promise<JwtPayload>;
 export interface RequireAuthOptions {
     /**
      * Allow x-org-id/x-org-name headers to override the JWT's organization fields.
@@ -50,6 +47,35 @@ export interface RequireAuthOptions {
      * (e.g. a sysadmin managing a given org's billing). If unsure, leave it disabled.
      */
     allowOrgHeaderOverride?: boolean;
+    /**
+     * Demand that the whole SESSION be at least this assurance level (#8).
+     *
+     * `minAssurance: 2` means the person authenticated with a second factor — a
+     * passkey with user verification, a password plus an authenticator code, or
+     * SSO through an IdP the org marked as enforcing MFA. A weaker token gets
+     * **401 `MFA_REQUIRED`**, which the client answers by sending the person to
+     * enrolment or to a stronger sign-in; refreshing cannot help, because `aal`
+     * lives on the session slot and a refresh never raises it.
+     *
+     * This is the SESSION-level counterpart to {@link requireStepUp}, which stays
+     * a fresh, per-action confirmation. Use both on the most dangerous routes.
+     *
+     * MACHINES NEVER SATISFY IT. A service principal, an org service account and
+     * an exchanged access key all get **403 `HUMAN_SESSION_REQUIRED`** — there is
+     * no person behind them to have presented a factor, so "assurance" is not a
+     * question their credential can answer. That is deliberately not a silent
+     * pass-through for internal services: a route that demands MFA is a route a
+     * human is doing something dangerous on.
+     */
+    minAssurance?: AssuranceLevel;
+    /**
+     * With {@link minAssurance}, additionally bound how long ago that sign-in
+     * happened (seconds, compared against the token's `auth_time`). A session that
+     * is MFA-grade but older than this gets **401 `REAUTH_REQUIRED`**. Ignored
+     * without `minAssurance` — "how recent" is only meaningful once "how strong"
+     * is being asked.
+     */
+    maxAge?: number;
 }
 /** JWT auth middleware. Use directly or call with options. */
 export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
@@ -106,6 +132,42 @@ export declare function isAccessTokenRevoked(claims: {
     jti?: string;
     impersonatorId?: string;
 }): Promise<boolean>;
+/**
+ * Whether a set of verified claims speaks for a PERSON's own session — the only
+ * kind of credential an assurance level can be asserted about.
+ *
+ * Excludes all three machine shapes: an internal service principal, an org
+ * service account, and any exchanged access key (`token_use: 'api_key'`, i.e. a
+ * PAT or a service-account key), each of which authenticates a program holding a
+ * secret rather than a person presenting factors.
+ */
+export declare function isHumanPrincipal(claims: Pick<JwtPayload, 'principalType' | 'token_use'> | undefined): boolean;
+/** What an assurance gate demands. */
+export interface AssuranceOptions {
+    minAssurance: AssuranceLevel;
+    maxAge?: number;
+}
+/**
+ * Standalone assurance gate, for a service whose own `requireAuth` is not
+ * api-core's (platform's is its own, because it reads Mongo). Compose it AFTER
+ * authentication: `router.get('/x', requireAuth, requireAssurance({ minAssurance: 2 }), h)`.
+ *
+ * Identical rules and identical refusals to `requireAuth({ minAssurance })` —
+ * that option simply calls the same check inline, so there is one implementation
+ * of "is this session MFA-grade" in the codebase.
+ */
+export declare function requireAssurance(options: AssuranceOptions): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Whether a verified token carries a well-formed identity: a known
+ * `principalType` and `token_use`, and the claims that kind of principal must
+ * have. Fails closed — a token minted before these claims existed, or one with a
+ * contradictory combination, is not an identity any gate should reason about.
+ *
+ * - `service`: `token_use: 'access'` and a `service:<name>` subject (the name
+ *   feeds the denylist and audit attribution).
+ * - `user` / `service_account`: `amr` (known methods), `aal` and `auth_time`.
+ */
+export declare function hasValidIdentityClaims(decoded: Partial<JwtPayload>): boolean;
 /**
  * Whether the request's user holds `permission`. Superadmins implicitly hold
  * every permission. Reads the resolved `permissions` claim (set at token issue,
@@ -134,6 +196,16 @@ export interface AuthzDenialInfo {
  * auditor. Idempotent; the last registration wins.
  */
 export declare function setAuthzDenialAuditor(fn: ((info: AuthzDenialInfo) => void) | undefined): void;
+/**
+ * Emit a denial event, best-effort. Only fires for state-changing (non-GET,
+ * non-HEAD/OPTIONS) requests — a rejected GET is low-signal probing noise and
+ * would amplify audit volume under a scan. Never throws.
+ *
+ * The permission gates here call it themselves. Export it for data-driven checks
+ * a route makes inline (cross-org access, service-only endpoints), so those 403s
+ * reach the same `authz.denied` trail. `required` names what was missing.
+ */
+export declare function recordAuthzDenial(req: Request, required: string): void;
 /**
  * Requires that the user hold AT LEAST ONE of the given permissions (or be a
  * superadmin). Use after requireAuth. Mirrors `requireRole`'s any-of semantics;
@@ -152,7 +224,7 @@ export declare function requirePermission(...permissions: Permission[]): (req: R
 export declare function requireAllPermissions(...permissions: Permission[]): (req: Request, res: Response, next: NextFunction) => void;
 /**
  * Like {@link requirePermission} (any-of) but ALSO admits an internal service
- * principal (a `service:*` machine token). For READ endpoints that BOTH
+ * principal (`principalType: 'service'`). For READ endpoints that BOTH
  * interactive users — who must hold one of the `:read` capabilities — AND
  * service-to-service callers legitimately hit; service tokens carry no
  * permission claims (they're least-privilege `role:member`), so a plain
@@ -163,13 +235,41 @@ export declare function requireAllPermissions(...permissions: Permission[]): (re
  */
 export declare function requirePermissionOrService(...permissions: Permission[]): (req: Request, res: Response, next: NextFunction) => void;
 /**
- * Gate an endpoint to internal service-to-service callers only (a `service:*`
- * machine principal minted via {@link signServiceToken} / `getServiceAuthHeader`).
+ * Gate an endpoint to internal service-to-service callers only (a
+ * `principalType: 'service'` principal minted via {@link signServiceToken} / `getServiceAuthHeader`).
  * Rejects any user token. For NON-user-facing endpoints — entity-event ingest,
  * auto-subscribe, and similar peer-service hooks — that a browser must never
  * reach. Compose after `requireAuth` so `req.user` is populated.
  */
 export declare function requireServicePrincipal(req: Request, res: Response, next: NextFunction): void;
+/**
+ * THE gate for an INTERNAL route (#14) — the one every `/internal/*` path, the
+ * quota usage counters, the entity-event ingest and the audit ingest go through.
+ *
+ * Two rules, both fail-closed:
+ *
+ *  1. **No user token, ever.** Not a member's, not a superadmin's, not a
+ *     service-account key's. An internal route is a peer-service API surface, so
+ *     "a sufficiently privileged human" is not an acceptable caller — that
+ *     equivalence is exactly how a browser-reachable path becomes a tenant
+ *     boundary bug. `requireServicePrincipal` already refused users; this also
+ *     closes the `|| isSystemAdmin(req)` escape hatches that had grown around
+ *     the individual internal routes.
+ *  2. **Only the NAMED callers.** `callers` lists the services that legitimately
+ *     call this route, and the name is cryptographically bound to the signing
+ *     key (`services/service-keys.ts`), so this is an identity check rather than
+ *     a claim check. It is the same allow-list the mesh policy names, at the
+ *     layer that also holds in docker compose, where there is no mesh at all —
+ *     the Istio `AuthorizationPolicy` is defence in depth on top, never the
+ *     enforcement.
+ *
+ * Compose after `requireAuth` so `req.user` is populated. Refusals are counted
+ * (`internal_route_refused_total`) and audited through the shared `authz.denied`
+ * sink.
+ */
+export declare function requireInternalService(options: {
+    callers: readonly string[];
+}): (req: Request, res: Response, next: NextFunction) => void;
 /**
  * The system tenant's canonical org **id** — a fixed, well-known ObjectId (NOT
  * the string 'system'). This is the single knob every service resolves the
@@ -214,10 +314,19 @@ export declare function requireSystemAdmin(req: Request, res: Response, next: Ne
  * Sysadmins (isSuperAdmin) bypass — they always have every feature.
  */
 export declare function requireFeature(feature: string): (req: Request, res: Response, next: NextFunction) => void;
-/** Replace the service-token denylist (service names). Empty ⇒ kill-switch off. */
-export declare function setServiceTokenDenylist(names: Iterable<string>): void;
-/** True when `sub` is `service:<name>` and `<name>` is on the denylist. */
-export declare function isServiceTokenDenied(sub: string): boolean;
+/**
+ * The calling service's name for a SERVICE principal (`principalType: 'service'`),
+ * else `undefined`. A user token never yields a name, whatever its `sub` says.
+ */
+export declare function serviceNameOf(claims: {
+    principalType?: string;
+    sub?: string;
+} | undefined): string | undefined;
+/** True when the claims are a service principal whose service is on the denylist. */
+export declare function isServiceTokenDenied(claims: {
+    principalType?: string;
+    sub?: string;
+}): boolean;
 export interface ServiceTokenOptions {
     /** Calling service identifier (e.g. 'billing', 'platform'). Embedded as `sub: service:<name>`. */
     serviceName: string;
@@ -248,19 +357,41 @@ export interface ServiceTokenOptions {
  * Mint a JWT identifying the calling service. Used for inter-service HTTP calls.
  * The token satisfies `requireAuth` and (when orgId is present) `requireOrganization`.
  * Scope it with `opts.role` — least privilege keeps a leaked token low-value.
+ *
+ * `opts.serviceName` must be THIS process's own identity (`SERVICE_NAME`): a
+ * service holds only its own signing key, so minting a token that names another
+ * service throws rather than producing one every peer would reject. That is the
+ * one behaviour change #14 forces on callers — see `services/service-keys.ts`.
  */
 export declare function signServiceToken(opts: ServiceTokenOptions): string;
 /** Convenience: returns a `Bearer <token>` header value for fetch/axios calls. */
 export declare function getServiceAuthHeader(opts: ServiceTokenOptions): string;
-/** True when `req.user.sub` was issued by `signServiceToken` (i.e. starts with `service:`). */
+/** True when `req.user` is a service principal (`principalType: 'service'`, minted by `signServiceToken`). */
 export declare function isServicePrincipal(req: Request): boolean;
+/**
+ * True when `req.user` is an ORG SERVICE ACCOUNT (`principalType:
+ * 'service_account'`) — a non-human principal owned by one org, authenticating
+ * with a `pb_sa_…` key exchanged at platform.
+ *
+ * A service account is NOT an internal service principal: it holds org Roles and
+ * is subject to every permission gate a member is. What it can never do is
+ * satisfy a HUMAN-presence requirement — step-up (and any later assurance gate)
+ * refuses it outright, because there is no person behind it to re-verify.
+ */
+export declare function isServiceAccountPrincipal(req: Request): boolean;
+/** True when `req.user` is the named internal service (e.g. `'billing'`). */
+export declare function isServicePrincipalNamed(req: Request, serviceName: string): boolean;
 /**
  * PRE-auth check: cryptographically verify the request carries a valid, signed
- * SERVICE token (`sub` starts with `service:`). Unlike {@link isServicePrincipal}
+ * SERVICE token (`principalType: 'service'`). Unlike {@link isServicePrincipal}
  * (which reads the already-populated `req.user`), this verifies the bearer token
  * itself, so it is safe to call BEFORE `requireAuth` runs — e.g. the global rate
  * limiter's `skip`, which must not trust the spoofable `x-internal-service`
- * header. Mirrors `requireAuth`'s verification (algorithm pinning + optional
- * issuer/audience) and returns `false` on any missing/invalid/non-service token.
+ * header. Mirrors `requireAuth`'s SERVICE chain exactly (the signer's own key,
+ * resolved by `kid`, with the `sub`/signer agreement check and the optional
+ * issuer/audience) and returns `false` on any missing/invalid/non-service token
+ * — including any platform-signed USER token, whose `kid` is not in the service
+ * bundle at all. Stays SYNCHRONOUS, which is why the per-service public keys are
+ * distributed as a mounted bundle rather than fetched over HTTP.
  */
 export declare function verifyServicePrincipal(req: Request): boolean;