@pipeline-builder/api-core 4.1.6 → 4.1.8

package/README.md

@@ -36,6 +36,8 @@ Provides the cross-cutting primitives every backend service depends on: JWT auth
 | --- | --- |
 | `getParam`, `getRequiredParam`, `getParams`, `getOrgId`, `getAuthHeader` | Request parameter/header extraction |
 | `parseQueryBoolean`, `parseQueryInt`, `parseQueryString` | Query-string coercion |
+| `parsePage` | **The** pagination primitive — parses and clamps `?limit=&offset=` against a per-route `{ def, max }` (and an optional `maxOffset`). Use it instead of a hand-rolled `Math.min(Math.max(...))`; route defaults stay per-route but are declared, not re-derived |
+| `envInt`, `envBool`, `envStr` | **The** env readers. Strict (a non-integer `envInt` falls back to the default rather than silently truncating), and every variable read through them must appear in `docs/environment-variables.md` — enforced by `test/env-documented.test.ts` |
 | `getIdentity`, `validateIdentity` | Parsed JWT identity (`RequestIdentity`) helpers |
 
 ### HTTP client & services (`./services`)
@@ -45,6 +47,12 @@ Provides the cross-cutting primitives every backend service depends on: JWT auth
 | `createComplianceClient` / `ComplianceClient` | Typed compliance-service client built on the safe client |
 | `QuotaService`, `createQuotaService`, `QuotaType`, `QuotaCheckResult`, `QuotaTier`, `QUOTA_TIERS`, `getTierLimits` | Quota enforcement client and tier presets |
 | `CacheService`, `createCacheService` | In-memory LRU TTL cache with cross-replica invalidation over Redis pub/sub |
+| `safeFetch`, `resolveSafeTarget`, `assertSafeUrl`, `isPrivateAddress` | SSRF guards for user/tenant-supplied URLs. **`safeFetch` is the one to use for an outbound request**: it resolves the host, PINS the vetted IP into the socket (no DNS-rebinding window between check and connect), refuses redirects, and caps body size and wall-clock time. `assertSafeUrl` is VALIDATION ONLY — for rejecting a URL at create/update time; never pair it with a `fetch` |
+| `createWebhookChannel`, `createEmailChannel`, `createChannelRegistry`, `NotificationChannel`, `NotificationMessage`, `ChannelTarget`, `DeliveryResult` | Shared notification-channel contract plus the webhook (SSRF-safe, HMAC-signing) and email transports. Services supply only their own `in-app` transport |
+| `wireServiceSecurity` | One call for every stateless service's boot security: the `authz.denied` audit sink, the token-revocation reader (overridable), and the access-key-exchange service name |
+| `createRemoteAuditAccessor` | Returns both audit shapes a service needs — `getAuditClient` (for `wireServiceSecurity`) and `emit` (the terse per-service emitter) |
+| `getRetryDecision`, `getErrorRetryDecision`, `RetryConfig` | The single retry/backoff decision function (Retry-After aware, jittered) and the single `RetryConfig`. pipeline-data's `ConnectionRetryStrategy` is built on it |
+| `createOrgIdCaster` | Builds the Mongo org-id cast (24-hex → ObjectId, anything else through) from a supplied `Types.ObjectId`, so platform and quota share one implementation without api-core depending on mongoose |
 | `entityEvents` | Process-local domain event pub/sub for entity changes |
 
 ### Logging, validation & OpenAPI

package/lib/helpers/org-hierarchy.d.ts

@@ -25,6 +25,25 @@ export type GetParentOrgId = (orgId: string) => Promise<string | undefined>;
 export type GetChildOrgIds = (frontier: string[]) => Promise<string[]>;
 /** Normalize a Mixed/ObjectId/string org id to a non-empty string, or undefined. */
 export declare function toOrgIdString(v: unknown): string | undefined;
+/**
+ * Build the org-id cast the Mongo-backed services use on every `_id` lookup.
+ *
+ * Platform writes ObjectId `_id`s into the shared `organizations` collection,
+ * while the well-known `'system'` org (and `parentOrgId`, still a String column)
+ * are plain strings — so a 24-hex id arriving from a route param / JWT claim /
+ * cross-service payload must be cast or `findById('<24hex>')` never matches.
+ *
+ * Platform and quota each had their OWN `toOrgId` with a different signature
+ * (`string | string[]` vs `string`), which is exactly the drift this removes:
+ * the logic and the signature live here once, and each service supplies only
+ * its mongoose `Types.ObjectId` constructor. api-core cannot import mongoose
+ * itself (it is not — and should not become — an api-core dependency), so the
+ * constructor is injected rather than imported.
+ *
+ * @example
+ * export const toOrgId = createOrgIdCaster(mongoose.Types.ObjectId);
+ */
+export declare function createOrgIdCaster<T>(ObjectIdCtor: new (hex: string) => T): (id: string | string[]) => string | T;
 export interface OrgLineage {
     /** The org's direct parent id, or `undefined` when it's a root org. */
     parentOrgId?: string;

package/lib/helpers/org-hierarchy.js

@@ -28,6 +28,34 @@ export function toOrgIdString(v) {
     const s = String(v);
     return s && s !== 'null' && s !== 'undefined' ? s : undefined;
 }
+/** True when `id` is a 24-character hex string — i.e. castable to an ObjectId. */
+function isObjectIdHex(id) {
+    return id.length === 24 && /^[0-9a-fA-F]{24}$/.test(id);
+}
+/**
+ * Build the org-id cast the Mongo-backed services use on every `_id` lookup.
+ *
+ * Platform writes ObjectId `_id`s into the shared `organizations` collection,
+ * while the well-known `'system'` org (and `parentOrgId`, still a String column)
+ * are plain strings — so a 24-hex id arriving from a route param / JWT claim /
+ * cross-service payload must be cast or `findById('<24hex>')` never matches.
+ *
+ * Platform and quota each had their OWN `toOrgId` with a different signature
+ * (`string | string[]` vs `string`), which is exactly the drift this removes:
+ * the logic and the signature live here once, and each service supplies only
+ * its mongoose `Types.ObjectId` constructor. api-core cannot import mongoose
+ * itself (it is not — and should not become — an api-core dependency), so the
+ * constructor is injected rather than imported.
+ *
+ * @example
+ * export const toOrgId = createOrgIdCaster(mongoose.Types.ObjectId);
+ */
+export function createOrgIdCaster(ObjectIdCtor) {
+    return (id) => {
+        const idStr = Array.isArray(id) ? id[0] : id;
+        return isObjectIdHex(idStr) ? new ObjectIdCtor(idStr) : idStr;
+    };
+}
 /**
  * Walk `parentOrgId` from `orgId` up to the root. Returns the direct parent (if
  * any) and the root org id (the input itself when the org has no parent). On a
@@ -107,4 +135,4 @@ export async function expandOrgScopeWith(orgId, getChildren) {
     }
     return result;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3JnLWhpZXJhcmNoeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzL29yZy1oaWVyYXJjaHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBRUgsMkVBQTJFO0FBQzNFLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxFQUFFLENBQUM7QUFRaEMsb0ZBQW9GO0FBQ3BGLE1BQU0sVUFBVSxhQUFhLENBQUMsQ0FBVTtJQUN0QyxJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxLQUFLLFNBQVM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUNwRCxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEIsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLE1BQU0sSUFBSSxDQUFDLEtBQUssV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNoRSxDQUFDO0FBU0Q7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLHFCQUFxQixDQUFDLEtBQWEsRUFBRSxTQUF5QjtJQUNsRixNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDdEMsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDO0lBQ3RCLElBQUksV0FBK0IsQ0FBQztJQUVwQyxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsYUFBYSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDbkQsTUFBTSxNQUFNLEdBQUcsYUFBYSxDQUFDLE1BQU0sU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLENBQUMsd0JBQXdCO1FBQzVDLDBFQUEwRTtRQUMxRSw0Q0FBNEM7UUFDNUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxJQUFJLE1BQU0sS0FBSyxLQUFLO1lBQUUsV0FBVyxHQUFHLE1BQU0sQ0FBQztRQUMxRCxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDO1lBQUUsTUFBTSxDQUFDLHNDQUFzQztRQUNuRSxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2pCLFNBQVMsR0FBRyxNQUFNLENBQUM7SUFDckIsQ0FBQztJQUVELE9BQU8sRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLEdBQUcsQ0FBQyxXQUFXLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQyxFQUFFLENBQUM7QUFDdkUsQ0FBQztBQUVELHFFQUFxRTtBQUNyRSxNQUFNLENBQUMsS0FBSyxVQUFVLG9CQUFvQixDQUFDLEtBQWEsRUFBRSxTQUF5QjtJQUNqRixPQUFPLENBQUMsTUFBTSxxQkFBcUIsQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDbkUsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsaUJBQWlCLENBQ3JDLGFBQXFCLEVBQ3JCLGNBQXNCLEVBQ3RCLFNBQXlCO0lBRXpCLElBQUksYUFBYSxLQUFLLGNBQWM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUVuRCxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBUyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDL0MsSUFBSSxTQUFTLEdBQUcsY0FBYyxDQUFDO0lBRS9CLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxhQUFhLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNuRCxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsTUFBTSxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUN6RCxJQUFJLENBQUMsTUFBTTtZQUFFLE9BQU8sS0FBSyxDQUFDLENBQUMsa0NBQWtDO1FBQzdELElBQUksTUFBTSxLQUFLLGFBQWE7WUFBRSxPQUFPLElBQUksQ0FBQztRQUMxQyxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUMsQ0FBQyxRQUFRO1FBQzVDLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakIsU0FBUyxHQUFHLE1BQU0sQ0FBQztJQUNyQixDQUFDO0lBRUQsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUFDLEtBQWEsRUFBRSxXQUEyQjtJQUNqRixNQUFNLE1BQU0sR0FBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN0QyxJQUFJLFFBQVEsR0FBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBRWpDLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxhQUFhLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUMxRSxNQUFNLFFBQVEsR0FBRyxNQUFNLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM3QyxNQUFNLElBQUksR0FBYSxFQUFFLENBQUM7UUFDMUIsS0FBSyxNQUFNLEdBQUcsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUMzQixNQUFNLEVBQUUsR0FBRyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDOUIsSUFBSSxDQUFDLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFBRSxTQUFTO1lBQ2xDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDYixNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ2hCLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDaEIsQ0FBQztRQUNELFFBQVEsR0FBRyxJQUFJLENBQUM7SUFDbEIsQ0FBQztJQUVELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBPcmcg4oaSIHRlYW0gaGllcmFyY2h5IHRyYXZlcnNhbCAob3JnLXRlYW0taGllcmFyY2h5IHByb3Bvc2FsKS5cbiAqXG4gKiBBIFwidGVhbVwiIGlzIGFuIG9yZ2FuaXphdGlvbiB3aG9zZSBgcGFyZW50T3JnSWRgIHBvaW50cyBhdCBhbm90aGVyIG9yZzsgYSByb290XG4gKiBvcmcgaGFzIGBwYXJlbnRPcmdJZCA9IG51bGxgLiBUaGVzZSBoZWxwZXJzIHdhbGsgdGhhdCBzaW5nbGUgc2VsZi1yZWZlcmVudGlhbFxuICogY29sdW1uLCBidXQgaG9sZCAqKm5vIGRhdGFiYXNlIGRlcGVuZGVuY3kqKiBvZiB0aGVpciBvd246IGVhY2ggdGFrZXMgYSBxdWVyeVxuICogY2FsbGJhY2sgc28gZXZlcnkgc2VydmljZSAocGxhdGZvcm0sIHF1b3RhLCDigKYpIGNhbiBzaGFyZSB0aGUgY3ljbGUtc2FmZSxcbiAqIGRlcHRoLWNhcHBlZCB0cmF2ZXJzYWwgbG9naWMgd2hpbGUgcmVhZGluZyBpdHMgb3duIE1vbmdvb3NlIG1vZGVsIHdpdGggaXRzIG93blxuICogYF9pZGAgY2FzdGluZyBydWxlcy5cbiAqXG4gKiAgIC0ge0BsaW5rIHJlc29sdmVPcmdMaW5lYWdlV2l0aH0g4oCUIFVQOiBkaXJlY3QgcGFyZW50ICsgcm9vdCBvZiB0aGUgY2hhaW4uXG4gKiAgIC0ge0BsaW5rIHJlc29sdmVSb290T3JnSWRXaXRofSAgIOKAlCBVUDoganVzdCB0aGUgcm9vdCBpZC5cbiAqICAgLSB7QGxpbmsgaXNBbmNlc3Rvck9yZ1dpdGh9ICAgICAg4oCUIFVQOiBpcyBBIGFuIGFuY2VzdG9yIG9mIEI/XG4gKiAgIC0ge0BsaW5rIGV4cGFuZE9yZ1Njb3BlV2l0aH0gICAgIOKAlCBET1dOOiBzZWxmICsgYWxsIGRlc2NlbmRhbnQgb3JnIGlkcy5cbiAqXG4gKiBFdmVyeSBvcmcgaXMgZmxhdCB0b2RheSAoYHBhcmVudE9yZ0lkYCBudWxsIG9uIGFsbCByb3dzKSwgc28gbGluZWFnZSByZXNvbHZlc1xuICogdG8gYHsgcm9vdE9yZ0lkOiBzZWxmIH1gIGFuZCBzY29wZSB0byBgW3NlbGZdYCDigJQgaS5lLiB0aGVzZSBhcmUgbm8tb3BzIHVudGlsXG4gKiBvcmdzIGdldCBwYXJlbnRzLlxuICovXG5cbi8qKiBIYXJkIGNlaWxpbmcgb24gYW5jZXN0cnkvZGVzY2VuZGFudCB0cmF2ZXJzYWwg4oCUIGN5Y2xlICsgYWJ1c2UgZ3VhcmQuICovXG5leHBvcnQgY29uc3QgTUFYX09SR19ERVBUSCA9IDE2O1xuXG4vKiogRmV0Y2ggYW4gb3JnJ3MgZGlyZWN0IGBwYXJlbnRPcmdJZGAsIG9yIHVuZGVmaW5lZCBmb3IgYSByb290L21pc3Npbmcgb3JnLiAqL1xuZXhwb3J0IHR5cGUgR2V0UGFyZW50T3JnSWQgPSAob3JnSWQ6IHN0cmluZykgPT4gUHJvbWlzZTxzdHJpbmcgfCB1bmRlZmluZWQ+O1xuXG4vKiogRmV0Y2ggdGhlIGRpcmVjdCBjaGlsZCBvcmcgaWRzIG9mIGV2ZXJ5IG9yZyBpbiBgZnJvbnRpZXJgIChvbmUgcm91bmQgb2YgQkZTKS4gKi9cbmV4cG9ydCB0eXBlIEdldENoaWxkT3JnSWRzID0gKGZyb250aWVyOiBzdHJpbmdbXSkgPT4gUHJvbWlzZTxzdHJpbmdbXT47XG5cbi8qKiBOb3JtYWxpemUgYSBNaXhlZC9PYmplY3RJZC9zdHJpbmcgb3JnIGlkIHRvIGEgbm9uLWVtcHR5IHN0cmluZywgb3IgdW5kZWZpbmVkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHRvT3JnSWRTdHJpbmcodjogdW5rbm93bik6IHN0cmluZyB8IHVuZGVmaW5lZCB7XG4gIGlmICh2ID09PSBudWxsIHx8IHYgPT09IHVuZGVmaW5lZCkgcmV0dXJuIHVuZGVmaW5lZDtcbiAgY29uc3QgcyA9IFN0cmluZyh2KTtcbiAgcmV0dXJuIHMgJiYgcyAhPT0gJ251bGwnICYmIHMgIT09ICd1bmRlZmluZWQnID8gcyA6IHVuZGVmaW5lZDtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBPcmdMaW5lYWdlIHtcbiAgLyoqIFRoZSBvcmcncyBkaXJlY3QgcGFyZW50IGlkLCBvciBgdW5kZWZpbmVkYCB3aGVuIGl0J3MgYSByb290IG9yZy4gKi9cbiAgcGFyZW50T3JnSWQ/OiBzdHJpbmc7XG4gIC8qKiBUb3Agb2YgdGhlIGFuY2VzdHJ5IGNoYWluLiBFcXVhbHMgdGhlIGlucHV0IGBvcmdJZGAgZm9yIGEgcm9vdCBvcmcuICovXG4gIHJvb3RPcmdJZDogc3RyaW5nO1xufVxuXG4vKipcbiAqIFdhbGsgYHBhcmVudE9yZ0lkYCBmcm9tIGBvcmdJZGAgdXAgdG8gdGhlIHJvb3QuIFJldHVybnMgdGhlIGRpcmVjdCBwYXJlbnQgKGlmXG4gKiBhbnkpIGFuZCB0aGUgcm9vdCBvcmcgaWQgKHRoZSBpbnB1dCBpdHNlbGYgd2hlbiB0aGUgb3JnIGhhcyBubyBwYXJlbnQpLiBPbiBhXG4gKiBkZXRlY3RlZCBjeWNsZSwgYSBtaXNzaW5nIG9yZywgb3IgdGhlIGRlcHRoIGNhcCwgdHJhdmVyc2FsIHN0b3BzIGFuZCB0aGUgbGFzdFxuICogcmVhY2hlZCBpZCBpcyB0cmVhdGVkIGFzIHRoZSByb290LlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZU9yZ0xpbmVhZ2VXaXRoKG9yZ0lkOiBzdHJpbmcsIGdldFBhcmVudDogR2V0UGFyZW50T3JnSWQpOiBQcm9taXNlPE9yZ0xpbmVhZ2U+IHtcbiAgY29uc3Qgc2VlbiA9IG5ldyBTZXQ8c3RyaW5nPihbb3JnSWRdKTtcbiAgbGV0IGN1cnJlbnRJZCA9IG9yZ0lkO1xuICBsZXQgcGFyZW50T3JnSWQ6IHN0cmluZyB8IHVuZGVmaW5lZDtcblxuICBmb3IgKGxldCBkZXB0aCA9IDA7IGRlcHRoIDwgTUFYX09SR19ERVBUSDsgZGVwdGgrKykge1xuICAgIGNvbnN0IHBhcmVudCA9IHRvT3JnSWRTdHJpbmcoYXdhaXQgZ2V0UGFyZW50KGN1cnJlbnRJZCkpO1xuICAgIGlmICghcGFyZW50KSBicmVhazsgLy8gY3VycmVudElkIGlzIHRoZSByb290XG4gICAgLy8gUmVjb3JkIHRoZSBkaXJlY3QgcGFyZW50IG9ubHkgd2hlbiBpdCBpc24ndCBhIHNlbGYtbG9vcCwgc28gYSBtYWxmb3JtZWRcbiAgICAvLyBB4oaSQSBvcmcgaXNuJ3QgcmVwb3J0ZWQgYXMgaXRzIG93biBwYXJlbnQuXG4gICAgaWYgKGRlcHRoID09PSAwICYmIHBhcmVudCAhPT0gb3JnSWQpIHBhcmVudE9yZ0lkID0gcGFyZW50O1xuICAgIGlmIChzZWVuLmhhcyhwYXJlbnQpKSBicmVhazsgLy8gY3ljbGUg4oCUIHRyZWF0IGN1cnJlbnRJZCBhcyB0aGUgcm9vdFxuICAgIHNlZW4uYWRkKHBhcmVudCk7XG4gICAgY3VycmVudElkID0gcGFyZW50O1xuICB9XG5cbiAgcmV0dXJuIHsgcm9vdE9yZ0lkOiBjdXJyZW50SWQsIC4uLihwYXJlbnRPcmdJZCAmJiB7IHBhcmVudE9yZ0lkIH0pIH07XG59XG5cbi8qKiBXYWxrIGBwYXJlbnRPcmdJZGAgdXAgdG8gdGhlIHJvb3QgYW5kIHJldHVybiBqdXN0IHRoZSByb290IGlkLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVSb290T3JnSWRXaXRoKG9yZ0lkOiBzdHJpbmcsIGdldFBhcmVudDogR2V0UGFyZW50T3JnSWQpOiBQcm9taXNlPHN0cmluZz4ge1xuICByZXR1cm4gKGF3YWl0IHJlc29sdmVPcmdMaW5lYWdlV2l0aChvcmdJZCwgZ2V0UGFyZW50KSkucm9vdE9yZ0lkO1xufVxuXG4vKipcbiAqIFRydWUgd2hlbiBgYW5jZXN0b3JPcmdJZGAgaXMgYW4gYW5jZXN0b3Igb2YgYGNhbmRpZGF0ZU9yZ0lkYCDigJQgaS5lLlxuICogYGNhbmRpZGF0ZU9yZ0lkYCBsaXZlcyBzb21ld2hlcmUgaW4gdGhlIHN1YnRyZWUgcm9vdGVkIGF0IGBhbmNlc3Rvck9yZ0lkYC5cbiAqIFdhbGtzIGBjYW5kaWRhdGVPcmdJZGAncyBwYXJlbnQgY2hhaW4gdXB3YXJkLCBkZXB0aC1jYXBwZWQgYW5kIGN5Y2xlLXNhZmUuXG4gKiBSZXR1cm5zIGBmYWxzZWAgd2hlbiB0aGUgdHdvIGFyZSBlcXVhbCAoYW4gb3JnIGlzIG5vdCBpdHMgb3duIGFuY2VzdG9yKSBvclxuICogdW5yZWxhdGVkLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gaXNBbmNlc3Rvck9yZ1dpdGgoXG4gIGFuY2VzdG9yT3JnSWQ6IHN0cmluZyxcbiAgY2FuZGlkYXRlT3JnSWQ6IHN0cmluZyxcbiAgZ2V0UGFyZW50OiBHZXRQYXJlbnRPcmdJZCxcbik6IFByb21pc2U8Ym9vbGVhbj4ge1xuICBpZiAoYW5jZXN0b3JPcmdJZCA9PT0gY2FuZGlkYXRlT3JnSWQpIHJldHVybiBmYWxzZTtcblxuICBjb25zdCBzZWVuID0gbmV3IFNldDxzdHJpbmc+KFtjYW5kaWRhdGVPcmdJZF0pO1xuICBsZXQgY3VycmVudElkID0gY2FuZGlkYXRlT3JnSWQ7XG5cbiAgZm9yIChsZXQgZGVwdGggPSAwOyBkZXB0aCA8IE1BWF9PUkdfREVQVEg7IGRlcHRoKyspIHtcbiAgICBjb25zdCBwYXJlbnQgPSB0b09yZ0lkU3RyaW5nKGF3YWl0IGdldFBhcmVudChjdXJyZW50SWQpKTtcbiAgICBpZiAoIXBhcmVudCkgcmV0dXJuIGZhbHNlOyAvLyByZWFjaGVkIGEgcm9vdCB3aXRob3V0IG1hdGNoaW5nXG4gICAgaWYgKHBhcmVudCA9PT0gYW5jZXN0b3JPcmdJZCkgcmV0dXJuIHRydWU7XG4gICAgaWYgKHNlZW4uaGFzKHBhcmVudCkpIHJldHVybiBmYWxzZTsgLy8gY3ljbGVcbiAgICBzZWVuLmFkZChwYXJlbnQpO1xuICAgIGN1cnJlbnRJZCA9IHBhcmVudDtcbiAgfVxuXG4gIHJldHVybiBmYWxzZTtcbn1cblxuLyoqXG4gKiBFeHBhbmQgYG9yZ0lkYCB0byBpdHNlbGYgcGx1cyBldmVyeSBkZXNjZW5kYW50IG9yZyBpZCAoYnJlYWR0aC1maXJzdCBvdmVyXG4gKiBgcGFyZW50T3JnSWRgKS4gVGhpcyBpcyB0aGUgc2NvcGUgYSBwYXJlbnQgb3JnIFwic2Vlc1wiIGZvciB2aXNpYmlsaXR5IGFuZFxuICogYW5hbHl0aWNzIHJvbGx1cHM6IGBbc2VsZiwgLi4uZGVzY2VuZGFudHNdYC4gUmV0dXJucyBgW29yZ0lkXWAgd2hlbiB0aGUgb3JnXG4gKiBoYXMgbm8gY2hpbGRyZW4uIEN5Y2xlLXNhZmUgYW5kIGRlcHRoLWNhcHBlZC5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGV4cGFuZE9yZ1Njb3BlV2l0aChvcmdJZDogc3RyaW5nLCBnZXRDaGlsZHJlbjogR2V0Q2hpbGRPcmdJZHMpOiBQcm9taXNlPHN0cmluZ1tdPiB7XG4gIGNvbnN0IHJlc3VsdDogc3RyaW5nW10gPSBbb3JnSWRdO1xuICBjb25zdCBzZWVuID0gbmV3IFNldDxzdHJpbmc+KFtvcmdJZF0pO1xuICBsZXQgZnJvbnRpZXI6IHN0cmluZ1tdID0gW29yZ0lkXTtcblxuICBmb3IgKGxldCBkZXB0aCA9IDA7IGRlcHRoIDwgTUFYX09SR19ERVBUSCAmJiBmcm9udGllci5sZW5ndGggPiAwOyBkZXB0aCsrKSB7XG4gICAgY29uc3QgY2hpbGRyZW4gPSBhd2FpdCBnZXRDaGlsZHJlbihmcm9udGllcik7XG4gICAgY29uc3QgbmV4dDogc3RyaW5nW10gPSBbXTtcbiAgICBmb3IgKGNvbnN0IHJhdyBvZiBjaGlsZHJlbikge1xuICAgICAgY29uc3QgaWQgPSB0b09yZ0lkU3RyaW5nKHJhdyk7XG4gICAgICBpZiAoIWlkIHx8IHNlZW4uaGFzKGlkKSkgY29udGludWU7XG4gICAgICBzZWVuLmFkZChpZCk7XG4gICAgICByZXN1bHQucHVzaChpZCk7XG4gICAgICBuZXh0LnB1c2goaWQpO1xuICAgIH1cbiAgICBmcm9udGllciA9IG5leHQ7XG4gIH1cblxuICByZXR1cm4gcmVzdWx0O1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3JnLWhpZXJhcmNoeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzL29yZy1oaWVyYXJjaHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBRUgsMkVBQTJFO0FBQzNFLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxFQUFFLENBQUM7QUFRaEMsb0ZBQW9GO0FBQ3BGLE1BQU0sVUFBVSxhQUFhLENBQUMsQ0FBVTtJQUN0QyxJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxLQUFLLFNBQVM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUNwRCxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEIsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLE1BQU0sSUFBSSxDQUFDLEtBQUssV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNoRSxDQUFDO0FBRUQsa0ZBQWtGO0FBQ2xGLFNBQVMsYUFBYSxDQUFDLEVBQVU7SUFDL0IsT0FBTyxFQUFFLENBQUMsTUFBTSxLQUFLLEVBQUUsSUFBSSxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDMUQsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQU0sVUFBVSxpQkFBaUIsQ0FDL0IsWUFBb0M7SUFFcEMsT0FBTyxDQUFDLEVBQUUsRUFBRSxFQUFFO1FBQ1osTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDN0MsT0FBTyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7SUFDaEUsQ0FBQyxDQUFDO0FBQ0osQ0FBQztBQVNEOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxxQkFBcUIsQ0FBQyxLQUFhLEVBQUUsU0FBeUI7SUFDbEYsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3RDLElBQUksU0FBUyxHQUFHLEtBQUssQ0FBQztJQUN0QixJQUFJLFdBQStCLENBQUM7SUFFcEMsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLGFBQWEsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ25ELE1BQU0sTUFBTSxHQUFHLGFBQWEsQ0FBQyxNQUFNLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3pELElBQUksQ0FBQyxNQUFNO1lBQUUsTUFBTSxDQUFDLHdCQUF3QjtRQUM1QywwRUFBMEU7UUFDMUUsNENBQTRDO1FBQzVDLElBQUksS0FBSyxLQUFLLENBQUMsSUFBSSxNQUFNLEtBQUssS0FBSztZQUFFLFdBQVcsR0FBRyxNQUFNLENBQUM7UUFDMUQsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQztZQUFFLE1BQU0sQ0FBQyxzQ0FBc0M7UUFDbkUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqQixTQUFTLEdBQUcsTUFBTSxDQUFDO0lBQ3JCLENBQUM7SUFFRCxPQUFPLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxHQUFHLENBQUMsV0FBVyxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUMsRUFBRSxDQUFDO0FBQ3ZFLENBQUM7QUFFRCxxRUFBcUU7QUFDckUsTUFBTSxDQUFDLEtBQUssVUFBVSxvQkFBb0IsQ0FBQyxLQUFhLEVBQUUsU0FBeUI7SUFDakYsT0FBTyxDQUFDLE1BQU0scUJBQXFCLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ25FLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGlCQUFpQixDQUNyQyxhQUFxQixFQUNyQixjQUFzQixFQUN0QixTQUF5QjtJQUV6QixJQUFJLGFBQWEsS0FBSyxjQUFjO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFFbkQsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQVMsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDO0lBQy9DLElBQUksU0FBUyxHQUFHLGNBQWMsQ0FBQztJQUUvQixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsYUFBYSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDbkQsTUFBTSxNQUFNLEdBQUcsYUFBYSxDQUFDLE1BQU0sU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLEtBQUssQ0FBQyxDQUFDLGtDQUFrQztRQUM3RCxJQUFJLE1BQU0sS0FBSyxhQUFhO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDMUMsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDLENBQUMsUUFBUTtRQUM1QyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2pCLFNBQVMsR0FBRyxNQUFNLENBQUM7SUFDckIsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxLQUFhLEVBQUUsV0FBMkI7SUFDakYsTUFBTSxNQUFNLEdBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqQyxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDdEMsSUFBSSxRQUFRLEdBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUVqQyxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsYUFBYSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDMUUsTUFBTSxRQUFRLEdBQUcsTUFBTSxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDN0MsTUFBTSxJQUFJLEdBQWEsRUFBRSxDQUFDO1FBQzFCLEtBQUssTUFBTSxHQUFHLElBQUksUUFBUSxFQUFFLENBQUM7WUFDM0IsTUFBTSxFQUFFLEdBQUcsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzlCLElBQUksQ0FBQyxFQUFFLElBQUksSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQUUsU0FBUztZQUNsQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ2IsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNoQixJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ2hCLENBQUM7UUFDRCxRQUFRLEdBQUcsSUFBSSxDQUFDO0lBQ2xCLENBQUM7SUFFRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogT3JnIOKGkiB0ZWFtIGhpZXJhcmNoeSB0cmF2ZXJzYWwgKG9yZy10ZWFtLWhpZXJhcmNoeSBwcm9wb3NhbCkuXG4gKlxuICogQSBcInRlYW1cIiBpcyBhbiBvcmdhbml6YXRpb24gd2hvc2UgYHBhcmVudE9yZ0lkYCBwb2ludHMgYXQgYW5vdGhlciBvcmc7IGEgcm9vdFxuICogb3JnIGhhcyBgcGFyZW50T3JnSWQgPSBudWxsYC4gVGhlc2UgaGVscGVycyB3YWxrIHRoYXQgc2luZ2xlIHNlbGYtcmVmZXJlbnRpYWxcbiAqIGNvbHVtbiwgYnV0IGhvbGQgKipubyBkYXRhYmFzZSBkZXBlbmRlbmN5Kiogb2YgdGhlaXIgb3duOiBlYWNoIHRha2VzIGEgcXVlcnlcbiAqIGNhbGxiYWNrIHNvIGV2ZXJ5IHNlcnZpY2UgKHBsYXRmb3JtLCBxdW90YSwg4oCmKSBjYW4gc2hhcmUgdGhlIGN5Y2xlLXNhZmUsXG4gKiBkZXB0aC1jYXBwZWQgdHJhdmVyc2FsIGxvZ2ljIHdoaWxlIHJlYWRpbmcgaXRzIG93biBNb25nb29zZSBtb2RlbCB3aXRoIGl0cyBvd25cbiAqIGBfaWRgIGNhc3RpbmcgcnVsZXMuXG4gKlxuICogICAtIHtAbGluayByZXNvbHZlT3JnTGluZWFnZVdpdGh9IOKAlCBVUDogZGlyZWN0IHBhcmVudCArIHJvb3Qgb2YgdGhlIGNoYWluLlxuICogICAtIHtAbGluayByZXNvbHZlUm9vdE9yZ0lkV2l0aH0gICDigJQgVVA6IGp1c3QgdGhlIHJvb3QgaWQuXG4gKiAgIC0ge0BsaW5rIGlzQW5jZXN0b3JPcmdXaXRofSAgICAgIOKAlCBVUDogaXMgQSBhbiBhbmNlc3RvciBvZiBCP1xuICogICAtIHtAbGluayBleHBhbmRPcmdTY29wZVdpdGh9ICAgICDigJQgRE9XTjogc2VsZiArIGFsbCBkZXNjZW5kYW50IG9yZyBpZHMuXG4gKlxuICogRXZlcnkgb3JnIGlzIGZsYXQgdG9kYXkgKGBwYXJlbnRPcmdJZGAgbnVsbCBvbiBhbGwgcm93cyksIHNvIGxpbmVhZ2UgcmVzb2x2ZXNcbiAqIHRvIGB7IHJvb3RPcmdJZDogc2VsZiB9YCBhbmQgc2NvcGUgdG8gYFtzZWxmXWAg4oCUIGkuZS4gdGhlc2UgYXJlIG5vLW9wcyB1bnRpbFxuICogb3JncyBnZXQgcGFyZW50cy5cbiAqL1xuXG4vKiogSGFyZCBjZWlsaW5nIG9uIGFuY2VzdHJ5L2Rlc2NlbmRhbnQgdHJhdmVyc2FsIOKAlCBjeWNsZSArIGFidXNlIGd1YXJkLiAqL1xuZXhwb3J0IGNvbnN0IE1BWF9PUkdfREVQVEggPSAxNjtcblxuLyoqIEZldGNoIGFuIG9yZydzIGRpcmVjdCBgcGFyZW50T3JnSWRgLCBvciB1bmRlZmluZWQgZm9yIGEgcm9vdC9taXNzaW5nIG9yZy4gKi9cbmV4cG9ydCB0eXBlIEdldFBhcmVudE9yZ0lkID0gKG9yZ0lkOiBzdHJpbmcpID0+IFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPjtcblxuLyoqIEZldGNoIHRoZSBkaXJlY3QgY2hpbGQgb3JnIGlkcyBvZiBldmVyeSBvcmcgaW4gYGZyb250aWVyYCAob25lIHJvdW5kIG9mIEJGUykuICovXG5leHBvcnQgdHlwZSBHZXRDaGlsZE9yZ0lkcyA9IChmcm9udGllcjogc3RyaW5nW10pID0+IFByb21pc2U8c3RyaW5nW10+O1xuXG4vKiogTm9ybWFsaXplIGEgTWl4ZWQvT2JqZWN0SWQvc3RyaW5nIG9yZyBpZCB0byBhIG5vbi1lbXB0eSBzdHJpbmcsIG9yIHVuZGVmaW5lZC4gKi9cbmV4cG9ydCBmdW5jdGlvbiB0b09yZ0lkU3RyaW5nKHY6IHVua25vd24pOiBzdHJpbmcgfCB1bmRlZmluZWQge1xuICBpZiAodiA9PT0gbnVsbCB8fCB2ID09PSB1bmRlZmluZWQpIHJldHVybiB1bmRlZmluZWQ7XG4gIGNvbnN0IHMgPSBTdHJpbmcodik7XG4gIHJldHVybiBzICYmIHMgIT09ICdudWxsJyAmJiBzICE9PSAndW5kZWZpbmVkJyA/IHMgOiB1bmRlZmluZWQ7XG59XG5cbi8qKiBUcnVlIHdoZW4gYGlkYCBpcyBhIDI0LWNoYXJhY3RlciBoZXggc3RyaW5nIOKAlCBpLmUuIGNhc3RhYmxlIHRvIGFuIE9iamVjdElkLiAqL1xuZnVuY3Rpb24gaXNPYmplY3RJZEhleChpZDogc3RyaW5nKTogYm9vbGVhbiB7XG4gIHJldHVybiBpZC5sZW5ndGggPT09IDI0ICYmIC9eWzAtOWEtZkEtRl17MjR9JC8udGVzdChpZCk7XG59XG5cbi8qKlxuICogQnVpbGQgdGhlIG9yZy1pZCBjYXN0IHRoZSBNb25nby1iYWNrZWQgc2VydmljZXMgdXNlIG9uIGV2ZXJ5IGBfaWRgIGxvb2t1cC5cbiAqXG4gKiBQbGF0Zm9ybSB3cml0ZXMgT2JqZWN0SWQgYF9pZGBzIGludG8gdGhlIHNoYXJlZCBgb3JnYW5pemF0aW9uc2AgY29sbGVjdGlvbixcbiAqIHdoaWxlIHRoZSB3ZWxsLWtub3duIGAnc3lzdGVtJ2Agb3JnIChhbmQgYHBhcmVudE9yZ0lkYCwgc3RpbGwgYSBTdHJpbmcgY29sdW1uKVxuICogYXJlIHBsYWluIHN0cmluZ3Mg4oCUIHNvIGEgMjQtaGV4IGlkIGFycml2aW5nIGZyb20gYSByb3V0ZSBwYXJhbSAvIEpXVCBjbGFpbSAvXG4gKiBjcm9zcy1zZXJ2aWNlIHBheWxvYWQgbXVzdCBiZSBjYXN0IG9yIGBmaW5kQnlJZCgnPDI0aGV4PicpYCBuZXZlciBtYXRjaGVzLlxuICpcbiAqIFBsYXRmb3JtIGFuZCBxdW90YSBlYWNoIGhhZCB0aGVpciBPV04gYHRvT3JnSWRgIHdpdGggYSBkaWZmZXJlbnQgc2lnbmF0dXJlXG4gKiAoYHN0cmluZyB8IHN0cmluZ1tdYCB2cyBgc3RyaW5nYCksIHdoaWNoIGlzIGV4YWN0bHkgdGhlIGRyaWZ0IHRoaXMgcmVtb3ZlczpcbiAqIHRoZSBsb2dpYyBhbmQgdGhlIHNpZ25hdHVyZSBsaXZlIGhlcmUgb25jZSwgYW5kIGVhY2ggc2VydmljZSBzdXBwbGllcyBvbmx5XG4gKiBpdHMgbW9uZ29vc2UgYFR5cGVzLk9iamVjdElkYCBjb25zdHJ1Y3Rvci4gYXBpLWNvcmUgY2Fubm90IGltcG9ydCBtb25nb29zZVxuICogaXRzZWxmIChpdCBpcyBub3Qg4oCUIGFuZCBzaG91bGQgbm90IGJlY29tZSDigJQgYW4gYXBpLWNvcmUgZGVwZW5kZW5jeSksIHNvIHRoZVxuICogY29uc3RydWN0b3IgaXMgaW5qZWN0ZWQgcmF0aGVyIHRoYW4gaW1wb3J0ZWQuXG4gKlxuICogQGV4YW1wbGVcbiAqIGV4cG9ydCBjb25zdCB0b09yZ0lkID0gY3JlYXRlT3JnSWRDYXN0ZXIobW9uZ29vc2UuVHlwZXMuT2JqZWN0SWQpO1xuICovXG5leHBvcnQgZnVuY3Rpb24gY3JlYXRlT3JnSWRDYXN0ZXI8VD4oXG4gIE9iamVjdElkQ3RvcjogbmV3IChoZXg6IHN0cmluZykgPT4gVCxcbik6IChpZDogc3RyaW5nIHwgc3RyaW5nW10pID0+IHN0cmluZyB8IFQge1xuICByZXR1cm4gKGlkKSA9PiB7XG4gICAgY29uc3QgaWRTdHIgPSBBcnJheS5pc0FycmF5KGlkKSA/IGlkWzBdIDogaWQ7XG4gICAgcmV0dXJuIGlzT2JqZWN0SWRIZXgoaWRTdHIpID8gbmV3IE9iamVjdElkQ3RvcihpZFN0cikgOiBpZFN0cjtcbiAgfTtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBPcmdMaW5lYWdlIHtcbiAgLyoqIFRoZSBvcmcncyBkaXJlY3QgcGFyZW50IGlkLCBvciBgdW5kZWZpbmVkYCB3aGVuIGl0J3MgYSByb290IG9yZy4gKi9cbiAgcGFyZW50T3JnSWQ/OiBzdHJpbmc7XG4gIC8qKiBUb3Agb2YgdGhlIGFuY2VzdHJ5IGNoYWluLiBFcXVhbHMgdGhlIGlucHV0IGBvcmdJZGAgZm9yIGEgcm9vdCBvcmcuICovXG4gIHJvb3RPcmdJZDogc3RyaW5nO1xufVxuXG4vKipcbiAqIFdhbGsgYHBhcmVudE9yZ0lkYCBmcm9tIGBvcmdJZGAgdXAgdG8gdGhlIHJvb3QuIFJldHVybnMgdGhlIGRpcmVjdCBwYXJlbnQgKGlmXG4gKiBhbnkpIGFuZCB0aGUgcm9vdCBvcmcgaWQgKHRoZSBpbnB1dCBpdHNlbGYgd2hlbiB0aGUgb3JnIGhhcyBubyBwYXJlbnQpLiBPbiBhXG4gKiBkZXRlY3RlZCBjeWNsZSwgYSBtaXNzaW5nIG9yZywgb3IgdGhlIGRlcHRoIGNhcCwgdHJhdmVyc2FsIHN0b3BzIGFuZCB0aGUgbGFzdFxuICogcmVhY2hlZCBpZCBpcyB0cmVhdGVkIGFzIHRoZSByb290LlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZU9yZ0xpbmVhZ2VXaXRoKG9yZ0lkOiBzdHJpbmcsIGdldFBhcmVudDogR2V0UGFyZW50T3JnSWQpOiBQcm9taXNlPE9yZ0xpbmVhZ2U+IHtcbiAgY29uc3Qgc2VlbiA9IG5ldyBTZXQ8c3RyaW5nPihbb3JnSWRdKTtcbiAgbGV0IGN1cnJlbnRJZCA9IG9yZ0lkO1xuICBsZXQgcGFyZW50T3JnSWQ6IHN0cmluZyB8IHVuZGVmaW5lZDtcblxuICBmb3IgKGxldCBkZXB0aCA9IDA7IGRlcHRoIDwgTUFYX09SR19ERVBUSDsgZGVwdGgrKykge1xuICAgIGNvbnN0IHBhcmVudCA9IHRvT3JnSWRTdHJpbmcoYXdhaXQgZ2V0UGFyZW50KGN1cnJlbnRJZCkpO1xuICAgIGlmICghcGFyZW50KSBicmVhazsgLy8gY3VycmVudElkIGlzIHRoZSByb290XG4gICAgLy8gUmVjb3JkIHRoZSBkaXJlY3QgcGFyZW50IG9ubHkgd2hlbiBpdCBpc24ndCBhIHNlbGYtbG9vcCwgc28gYSBtYWxmb3JtZWRcbiAgICAvLyBB4oaSQSBvcmcgaXNuJ3QgcmVwb3J0ZWQgYXMgaXRzIG93biBwYXJlbnQuXG4gICAgaWYgKGRlcHRoID09PSAwICYmIHBhcmVudCAhPT0gb3JnSWQpIHBhcmVudE9yZ0lkID0gcGFyZW50O1xuICAgIGlmIChzZWVuLmhhcyhwYXJlbnQpKSBicmVhazsgLy8gY3ljbGUg4oCUIHRyZWF0IGN1cnJlbnRJZCBhcyB0aGUgcm9vdFxuICAgIHNlZW4uYWRkKHBhcmVudCk7XG4gICAgY3VycmVudElkID0gcGFyZW50O1xuICB9XG5cbiAgcmV0dXJuIHsgcm9vdE9yZ0lkOiBjdXJyZW50SWQsIC4uLihwYXJlbnRPcmdJZCAmJiB7IHBhcmVudE9yZ0lkIH0pIH07XG59XG5cbi8qKiBXYWxrIGBwYXJlbnRPcmdJZGAgdXAgdG8gdGhlIHJvb3QgYW5kIHJldHVybiBqdXN0IHRoZSByb290IGlkLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVSb290T3JnSWRXaXRoKG9yZ0lkOiBzdHJpbmcsIGdldFBhcmVudDogR2V0UGFyZW50T3JnSWQpOiBQcm9taXNlPHN0cmluZz4ge1xuICByZXR1cm4gKGF3YWl0IHJlc29sdmVPcmdMaW5lYWdlV2l0aChvcmdJZCwgZ2V0UGFyZW50KSkucm9vdE9yZ0lkO1xufVxuXG4vKipcbiAqIFRydWUgd2hlbiBgYW5jZXN0b3JPcmdJZGAgaXMgYW4gYW5jZXN0b3Igb2YgYGNhbmRpZGF0ZU9yZ0lkYCDigJQgaS5lLlxuICogYGNhbmRpZGF0ZU9yZ0lkYCBsaXZlcyBzb21ld2hlcmUgaW4gdGhlIHN1YnRyZWUgcm9vdGVkIGF0IGBhbmNlc3Rvck9yZ0lkYC5cbiAqIFdhbGtzIGBjYW5kaWRhdGVPcmdJZGAncyBwYXJlbnQgY2hhaW4gdXB3YXJkLCBkZXB0aC1jYXBwZWQgYW5kIGN5Y2xlLXNhZmUuXG4gKiBSZXR1cm5zIGBmYWxzZWAgd2hlbiB0aGUgdHdvIGFyZSBlcXVhbCAoYW4gb3JnIGlzIG5vdCBpdHMgb3duIGFuY2VzdG9yKSBvclxuICogdW5yZWxhdGVkLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gaXNBbmNlc3Rvck9yZ1dpdGgoXG4gIGFuY2VzdG9yT3JnSWQ6IHN0cmluZyxcbiAgY2FuZGlkYXRlT3JnSWQ6IHN0cmluZyxcbiAgZ2V0UGFyZW50OiBHZXRQYXJlbnRPcmdJZCxcbik6IFByb21pc2U8Ym9vbGVhbj4ge1xuICBpZiAoYW5jZXN0b3JPcmdJZCA9PT0gY2FuZGlkYXRlT3JnSWQpIHJldHVybiBmYWxzZTtcblxuICBjb25zdCBzZWVuID0gbmV3IFNldDxzdHJpbmc+KFtjYW5kaWRhdGVPcmdJZF0pO1xuICBsZXQgY3VycmVudElkID0gY2FuZGlkYXRlT3JnSWQ7XG5cbiAgZm9yIChsZXQgZGVwdGggPSAwOyBkZXB0aCA8IE1BWF9PUkdfREVQVEg7IGRlcHRoKyspIHtcbiAgICBjb25zdCBwYXJlbnQgPSB0b09yZ0lkU3RyaW5nKGF3YWl0IGdldFBhcmVudChjdXJyZW50SWQpKTtcbiAgICBpZiAoIXBhcmVudCkgcmV0dXJuIGZhbHNlOyAvLyByZWFjaGVkIGEgcm9vdCB3aXRob3V0IG1hdGNoaW5nXG4gICAgaWYgKHBhcmVudCA9PT0gYW5jZXN0b3JPcmdJZCkgcmV0dXJuIHRydWU7XG4gICAgaWYgKHNlZW4uaGFzKHBhcmVudCkpIHJldHVybiBmYWxzZTsgLy8gY3ljbGVcbiAgICBzZWVuLmFkZChwYXJlbnQpO1xuICAgIGN1cnJlbnRJZCA9IHBhcmVudDtcbiAgfVxuXG4gIHJldHVybiBmYWxzZTtcbn1cblxuLyoqXG4gKiBFeHBhbmQgYG9yZ0lkYCB0byBpdHNlbGYgcGx1cyBldmVyeSBkZXNjZW5kYW50IG9yZyBpZCAoYnJlYWR0aC1maXJzdCBvdmVyXG4gKiBgcGFyZW50T3JnSWRgKS4gVGhpcyBpcyB0aGUgc2NvcGUgYSBwYXJlbnQgb3JnIFwic2Vlc1wiIGZvciB2aXNpYmlsaXR5IGFuZFxuICogYW5hbHl0aWNzIHJvbGx1cHM6IGBbc2VsZiwgLi4uZGVzY2VuZGFudHNdYC4gUmV0dXJucyBgW29yZ0lkXWAgd2hlbiB0aGUgb3JnXG4gKiBoYXMgbm8gY2hpbGRyZW4uIEN5Y2xlLXNhZmUgYW5kIGRlcHRoLWNhcHBlZC5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGV4cGFuZE9yZ1Njb3BlV2l0aChvcmdJZDogc3RyaW5nLCBnZXRDaGlsZHJlbjogR2V0Q2hpbGRPcmdJZHMpOiBQcm9taXNlPHN0cmluZ1tdPiB7XG4gIGNvbnN0IHJlc3VsdDogc3RyaW5nW10gPSBbb3JnSWRdO1xuICBjb25zdCBzZWVuID0gbmV3IFNldDxzdHJpbmc+KFtvcmdJZF0pO1xuICBsZXQgZnJvbnRpZXI6IHN0cmluZ1tdID0gW29yZ0lkXTtcblxuICBmb3IgKGxldCBkZXB0aCA9IDA7IGRlcHRoIDwgTUFYX09SR19ERVBUSCAmJiBmcm9udGllci5sZW5ndGggPiAwOyBkZXB0aCsrKSB7XG4gICAgY29uc3QgY2hpbGRyZW4gPSBhd2FpdCBnZXRDaGlsZHJlbihmcm9udGllcik7XG4gICAgY29uc3QgbmV4dDogc3RyaW5nW10gPSBbXTtcbiAgICBmb3IgKGNvbnN0IHJhdyBvZiBjaGlsZHJlbikge1xuICAgICAgY29uc3QgaWQgPSB0b09yZ0lkU3RyaW5nKHJhdyk7XG4gICAgICBpZiAoIWlkIHx8IHNlZW4uaGFzKGlkKSkgY29udGludWU7XG4gICAgICBzZWVuLmFkZChpZCk7XG4gICAgICByZXN1bHQucHVzaChpZCk7XG4gICAgICBuZXh0LnB1c2goaWQpO1xuICAgIH1cbiAgICBmcm9udGllciA9IG5leHQ7XG4gIH1cblxuICByZXR1cm4gcmVzdWx0O1xufVxuIl19

package/lib/index.d.ts

@@ -22,6 +22,7 @@
  * - getParam, getOrgId — request parameter extraction
  * - parseQueryInt, parseQueryString — query string parsing
  * - getIdentity — identity extraction from requests
+ * - actorId — the audit actor for a route context (one `system` sentinel)
  * - errorMessage — safe error-to-string conversion
  *
  * **Constants**
@@ -33,6 +34,7 @@
  * - CacheService — in-memory TTL cache
  * - ComplianceClient — compliance service client
  * - EntityEventEmitter — domain event pub/sub
+ * - retryForever — capped-backoff wait for a dependency that must come up
  *
  * **Errors**
  * - AppError, NotFoundError, ForbiddenError — typed HTTP error classes
@@ -46,6 +48,30 @@
  * **OpenAPI**
  * - Schema registry and spec generation
  */
+/**
+ * PUBLIC SURFACE POLICY
+ *
+ * The root re-exports the ten sub-barrels, and each SUB-BARREL is the allow-list
+ * for its own area — that is where a module is either `export *`'d or narrowed
+ * to the names services may use. Internals are excluded there rather than here,
+ * so the exclusion sits next to the code that defines them and cannot be missed
+ * by someone adding a module.
+ *
+ * Currently narrowed (the rest is the intended surface):
+ * - `services/retry-strategy` — decision functions only; `parseRetryAfter` and
+ *   `addJitter` are backoff internals.
+ * - `services/circuit-breaker` — `CircuitOpenError` + `resetCircuitBreakers`;
+ *   the `CircuitBreaker` class is wired by the shared HTTP client, not by
+ *   services.
+ * - `services/service-keys` — verify/inspect only; signing, the key bundle and
+ *   `_resetServiceKeysForTests` stay inside.
+ * - `utils/jwk` — constants, shapes, decoders and the two signer-facing helpers
+ *   platform needs; `jwkThumbprint` / `publicKeyFromJwk` stay inside.
+ *
+ * api-core's own modules and its `testing/` helpers reach the excluded symbols
+ * by DEEP import (`@pipeline-builder/api-core/lib/services/service-keys.js`),
+ * which is also how the unit tests reach them.
+ */
 export * from './types/index.js';
 export * from './constants/index.js';
 export * from './utils/index.js';

package/lib/index.js

@@ -24,6 +24,7 @@
  * - getParam, getOrgId — request parameter extraction
  * - parseQueryInt, parseQueryString — query string parsing
  * - getIdentity — identity extraction from requests
+ * - actorId — the audit actor for a route context (one `system` sentinel)
  * - errorMessage — safe error-to-string conversion
  *
  * **Constants**
@@ -35,6 +36,7 @@
  * - CacheService — in-memory TTL cache
  * - ComplianceClient — compliance service client
  * - EntityEventEmitter — domain event pub/sub
+ * - retryForever — capped-backoff wait for a dependency that must come up
  *
  * **Errors**
  * - AppError, NotFoundError, ForbiddenError — typed HTTP error classes
@@ -48,6 +50,30 @@
  * **OpenAPI**
  * - Schema registry and spec generation
  */
+/**
+ * PUBLIC SURFACE POLICY
+ *
+ * The root re-exports the ten sub-barrels, and each SUB-BARREL is the allow-list
+ * for its own area — that is where a module is either `export *`'d or narrowed
+ * to the names services may use. Internals are excluded there rather than here,
+ * so the exclusion sits next to the code that defines them and cannot be missed
+ * by someone adding a module.
+ *
+ * Currently narrowed (the rest is the intended surface):
+ * - `services/retry-strategy` — decision functions only; `parseRetryAfter` and
+ *   `addJitter` are backoff internals.
+ * - `services/circuit-breaker` — `CircuitOpenError` + `resetCircuitBreakers`;
+ *   the `CircuitBreaker` class is wired by the shared HTTP client, not by
+ *   services.
+ * - `services/service-keys` — verify/inspect only; signing, the key bundle and
+ *   `_resetServiceKeysForTests` stay inside.
+ * - `utils/jwk` — constants, shapes, decoders and the two signer-facing helpers
+ *   platform needs; `jwkThumbprint` / `publicKeyFromJwk` stay inside.
+ *
+ * api-core's own modules and its `testing/` helpers reach the excluded symbols
+ * by DEEP import (`@pipeline-builder/api-core/lib/services/service-keys.js`),
+ * which is also how the unit tests reach them.
+ */
 // Types
 export * from './types/index.js';
 // Constants
@@ -68,4 +94,4 @@ export * from './errors/index.js';
 export * from './validation/index.js';
 // OpenAPI
 export * from './openapi/index.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0ErQ0c7QUFFSCxRQUFRO0FBQ1IsY0FBYyxrQkFBa0IsQ0FBQztBQUVqQyxZQUFZO0FBQ1osY0FBYyxzQkFBc0IsQ0FBQztBQUVyQyxRQUFRO0FBQ1IsY0FBYyxrQkFBa0IsQ0FBQztBQUVqQyxVQUFVO0FBQ1YsY0FBYyxvQkFBb0IsQ0FBQztBQUVuQyxXQUFXO0FBQ1gsY0FBYyxxQkFBcUIsQ0FBQztBQUVwQyxhQUFhO0FBQ2IsY0FBYyx1QkFBdUIsQ0FBQztBQUV0QyxTQUFTO0FBQ1QsY0FBYyxtQkFBbUIsQ0FBQztBQUVsQyxTQUFTO0FBQ1QsY0FBYyxtQkFBbUIsQ0FBQztBQUVsQyxhQUFhO0FBQ2IsY0FBYyx1QkFBdUIsQ0FBQztBQUV0QyxVQUFVO0FBQ1YsY0FBYyxvQkFBb0IsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG4vKipcbiAqIEBtb2R1bGUgQHBpcGVsaW5lLWJ1aWxkZXIvYXBpLWNvcmVcbiAqXG4gKiBDb3JlIEFQSSB1dGlsaXRpZXMgc2hhcmVkIGFjcm9zcyBhbGwgc2VydmljZXMuXG4gKlxuICogKipNaWRkbGV3YXJlKipcbiAqIC0gcmVxdWlyZUF1dGgsIHJlcXVpcmVTeXN0ZW1BZG1pbiwgcmVxdWlyZUZlYXR1cmUg4oCUIEpXVCBhdXRoZW50aWNhdGlvblxuICogLSBpc1N5c3RlbUFkbWluLCBpc1NlcnZpY2VQcmluY2lwYWwg4oCUIGF1dGhvcml6YXRpb24gaGVscGVycyAoaXNTeXN0ZW1PcmdJZCByZW1haW5zIGFzIGEgY29udGVudC1vd25lciBjaGVjaywgbm90IGEgcHJpdmlsZWdlIGdhdGUpXG4gKiAtIHNpZ25TZXJ2aWNlVG9rZW4sIGdldFNlcnZpY2VBdXRoSGVhZGVyIOKAlCBpbnRlci1zZXJ2aWNlIEpXVCBtaW50aW5nXG4gKlxuICogKipUeXBlcyoqXG4gKiAtIEVycm9yQ29kZSwgRXJyb3JDb2RlU3RhdHVzIOKAlCBzdGFuZGFyZGl6ZWQgZXJyb3IgY29kZSBlbnVtIGFuZCBzdGF0dXMgbWFwcGluZ1xuICogLSBSZXF1ZXN0SWRlbnRpdHkg4oCUIHBhcnNlZCBKV1QgaWRlbnRpdHlcbiAqIC0gU2VydmljZUNvbmZpZywgUmVxdWVzdE9wdGlvbnMg4oCUIEhUVFAgY2xpZW50IHR5cGVzXG4gKiAtIFF1b3RhVHlwZSwgUXVvdGFDaGVja1Jlc3VsdCDigJQgcXVvdGEgc2VydmljZSB0eXBlc1xuICogLSBQaXBlbGluZVR5cGUsIENvbXB1dGVUeXBlLCBWaXNpYmlsaXR5IOKAlCBwaXBlbGluZSBkb21haW4gdHlwZXNcbiAqIC0gRmVhdHVyZUZsYWdzIOKAlCBmZWF0dXJlIGZsYWcgdHlwZXNcbiAqXG4gKiAqKlV0aWxpdGllcyoqXG4gKiAtIGNyZWF0ZUxvZ2dlciDigJQgV2luc3Rvbi1iYXNlZCBzdHJ1Y3R1cmVkIGxvZ2dlciBmYWN0b3J5XG4gKiAtIHNlbmRTdWNjZXNzLCBzZW5kRXJyb3IsIHNlbmRQYWdpbmF0ZWROZXN0ZWQsIHNlbmRCYWRSZXF1ZXN0LCBzZW5kSW50ZXJuYWxFcnJvciDigJQgSFRUUCByZXNwb25zZSBoZWxwZXJzXG4gKiAtIGdldFBhcmFtLCBnZXRPcmdJZCDigJQgcmVxdWVzdCBwYXJhbWV0ZXIgZXh0cmFjdGlvblxuICogLSBwYXJzZVF1ZXJ5SW50LCBwYXJzZVF1ZXJ5U3RyaW5nIOKAlCBxdWVyeSBzdHJpbmcgcGFyc2luZ1xuICogLSBnZXRJZGVudGl0eSDigJQgaWRlbnRpdHkgZXh0cmFjdGlvbiBmcm9tIHJlcXVlc3RzXG4gKiAtIGVycm9yTWVzc2FnZSDigJQgc2FmZSBlcnJvci10by1zdHJpbmcgY29udmVyc2lvblxuICpcbiAqICoqQ29uc3RhbnRzKipcbiAqIC0gSFRUUCBzdGF0dXMgY29kZXMsIEFJIHByb3ZpZGVyIGlkZW50aWZpZXJzLCB0aW1lIGNvbnN0YW50c1xuICpcbiAqICoqU2VydmljZXMqKlxuICogLSBJbnRlcm5hbEh0dHBDbGllbnQsIGNyZWF0ZVNhZmVDbGllbnQg4oCUIGludGVybmFsIHNlcnZpY2UtdG8tc2VydmljZSBIVFRQIGNsaWVudFxuICogLSBjcmVhdGVRdW90YVNlcnZpY2Ug4oCUIHF1b3RhIGVuZm9yY2VtZW50IGNsaWVudCBmYWN0b3J5XG4gKiAtIENhY2hlU2VydmljZSDigJQgaW4tbWVtb3J5IFRUTCBjYWNoZVxuICogLSBDb21wbGlhbmNlQ2xpZW50IOKAlCBjb21wbGlhbmNlIHNlcnZpY2UgY2xpZW50XG4gKiAtIEVudGl0eUV2ZW50RW1pdHRlciDigJQgZG9tYWluIGV2ZW50IHB1Yi9zdWJcbiAqXG4gKiAqKkVycm9ycyoqXG4gKiAtIEFwcEVycm9yLCBOb3RGb3VuZEVycm9yLCBGb3JiaWRkZW5FcnJvciDigJQgdHlwZWQgSFRUUCBlcnJvciBjbGFzc2VzXG4gKlxuICogKipWYWxpZGF0aW9uKipcbiAqIC0gWm9kLWJhc2VkIHJlcXVlc3QgdmFsaWRhdGlvbiBzY2hlbWFzIGFuZCBtaWRkbGV3YXJlXG4gKlxuICogKipSb3V0ZXMqKlxuICogLSBIZWFsdGggY2hlY2sgcm91dGUgZmFjdG9yeVxuICpcbiAqICoqT3BlbkFQSSoqXG4gKiAtIFNjaGVtYSByZWdpc3RyeSBhbmQgc3BlYyBnZW5lcmF0aW9uXG4gKi9cblxuLy8gVHlwZXNcbmV4cG9ydCAqIGZyb20gJy4vdHlwZXMvaW5kZXguanMnO1xuXG4vLyBDb25zdGFudHNcbmV4cG9ydCAqIGZyb20gJy4vY29uc3RhbnRzL2luZGV4LmpzJztcblxuLy8gVXRpbHNcbmV4cG9ydCAqIGZyb20gJy4vdXRpbHMvaW5kZXguanMnO1xuXG4vLyBIZWxwZXJzXG5leHBvcnQgKiBmcm9tICcuL2hlbHBlcnMvaW5kZXguanMnO1xuXG4vLyBTZXJ2aWNlc1xuZXhwb3J0ICogZnJvbSAnLi9zZXJ2aWNlcy9pbmRleC5qcyc7XG5cbi8vIE1pZGRsZXdhcmVcbmV4cG9ydCAqIGZyb20gJy4vbWlkZGxld2FyZS9pbmRleC5qcyc7XG5cbi8vIFJvdXRlc1xuZXhwb3J0ICogZnJvbSAnLi9yb3V0ZXMvaW5kZXguanMnO1xuXG4vLyBFcnJvcnNcbmV4cG9ydCAqIGZyb20gJy4vZXJyb3JzL2luZGV4LmpzJztcblxuLy8gVmFsaWRhdGlvblxuZXhwb3J0ICogZnJvbSAnLi92YWxpZGF0aW9uL2luZGV4LmpzJztcblxuLy8gT3BlbkFQSVxuZXhwb3J0ICogZnJvbSAnLi9vcGVuYXBpL2luZGV4LmpzJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQWlERztBQUVIOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXVCRztBQUVILFFBQVE7QUFDUixjQUFjLGtCQUFrQixDQUFDO0FBRWpDLFlBQVk7QUFDWixjQUFjLHNCQUFzQixDQUFDO0FBRXJDLFFBQVE7QUFDUixjQUFjLGtCQUFrQixDQUFDO0FBRWpDLFVBQVU7QUFDVixjQUFjLG9CQUFvQixDQUFDO0FBRW5DLFdBQVc7QUFDWCxjQUFjLHFCQUFxQixDQUFDO0FBRXBDLGFBQWE7QUFDYixjQUFjLHVCQUF1QixDQUFDO0FBRXRDLFNBQVM7QUFDVCxjQUFjLG1CQUFtQixDQUFDO0FBRWxDLFNBQVM7QUFDVCxjQUFjLG1CQUFtQixDQUFDO0FBRWxDLGFBQWE7QUFDYixjQUFjLHVCQUF1QixDQUFDO0FBRXRDLFVBQVU7QUFDVixjQUFjLG9CQUFvQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogQG1vZHVsZSBAcGlwZWxpbmUtYnVpbGRlci9hcGktY29yZVxuICpcbiAqIENvcmUgQVBJIHV0aWxpdGllcyBzaGFyZWQgYWNyb3NzIGFsbCBzZXJ2aWNlcy5cbiAqXG4gKiAqKk1pZGRsZXdhcmUqKlxuICogLSByZXF1aXJlQXV0aCwgcmVxdWlyZVN5c3RlbUFkbWluLCByZXF1aXJlRmVhdHVyZSDigJQgSldUIGF1dGhlbnRpY2F0aW9uXG4gKiAtIGlzU3lzdGVtQWRtaW4sIGlzU2VydmljZVByaW5jaXBhbCDigJQgYXV0aG9yaXphdGlvbiBoZWxwZXJzIChpc1N5c3RlbU9yZ0lkIHJlbWFpbnMgYXMgYSBjb250ZW50LW93bmVyIGNoZWNrLCBub3QgYSBwcml2aWxlZ2UgZ2F0ZSlcbiAqIC0gc2lnblNlcnZpY2VUb2tlbiwgZ2V0U2VydmljZUF1dGhIZWFkZXIg4oCUIGludGVyLXNlcnZpY2UgSldUIG1pbnRpbmdcbiAqXG4gKiAqKlR5cGVzKipcbiAqIC0gRXJyb3JDb2RlLCBFcnJvckNvZGVTdGF0dXMg4oCUIHN0YW5kYXJkaXplZCBlcnJvciBjb2RlIGVudW0gYW5kIHN0YXR1cyBtYXBwaW5nXG4gKiAtIFJlcXVlc3RJZGVudGl0eSDigJQgcGFyc2VkIEpXVCBpZGVudGl0eVxuICogLSBTZXJ2aWNlQ29uZmlnLCBSZXF1ZXN0T3B0aW9ucyDigJQgSFRUUCBjbGllbnQgdHlwZXNcbiAqIC0gUXVvdGFUeXBlLCBRdW90YUNoZWNrUmVzdWx0IOKAlCBxdW90YSBzZXJ2aWNlIHR5cGVzXG4gKiAtIFBpcGVsaW5lVHlwZSwgQ29tcHV0ZVR5cGUsIFZpc2liaWxpdHkg4oCUIHBpcGVsaW5lIGRvbWFpbiB0eXBlc1xuICogLSBGZWF0dXJlRmxhZ3Mg4oCUIGZlYXR1cmUgZmxhZyB0eXBlc1xuICpcbiAqICoqVXRpbGl0aWVzKipcbiAqIC0gY3JlYXRlTG9nZ2VyIOKAlCBXaW5zdG9uLWJhc2VkIHN0cnVjdHVyZWQgbG9nZ2VyIGZhY3RvcnlcbiAqIC0gc2VuZFN1Y2Nlc3MsIHNlbmRFcnJvciwgc2VuZFBhZ2luYXRlZE5lc3RlZCwgc2VuZEJhZFJlcXVlc3QsIHNlbmRJbnRlcm5hbEVycm9yIOKAlCBIVFRQIHJlc3BvbnNlIGhlbHBlcnNcbiAqIC0gZ2V0UGFyYW0sIGdldE9yZ0lkIOKAlCByZXF1ZXN0IHBhcmFtZXRlciBleHRyYWN0aW9uXG4gKiAtIHBhcnNlUXVlcnlJbnQsIHBhcnNlUXVlcnlTdHJpbmcg4oCUIHF1ZXJ5IHN0cmluZyBwYXJzaW5nXG4gKiAtIGdldElkZW50aXR5IOKAlCBpZGVudGl0eSBleHRyYWN0aW9uIGZyb20gcmVxdWVzdHNcbiAqIC0gYWN0b3JJZCDigJQgdGhlIGF1ZGl0IGFjdG9yIGZvciBhIHJvdXRlIGNvbnRleHQgKG9uZSBgc3lzdGVtYCBzZW50aW5lbClcbiAqIC0gZXJyb3JNZXNzYWdlIOKAlCBzYWZlIGVycm9yLXRvLXN0cmluZyBjb252ZXJzaW9uXG4gKlxuICogKipDb25zdGFudHMqKlxuICogLSBIVFRQIHN0YXR1cyBjb2RlcywgQUkgcHJvdmlkZXIgaWRlbnRpZmllcnMsIHRpbWUgY29uc3RhbnRzXG4gKlxuICogKipTZXJ2aWNlcyoqXG4gKiAtIEludGVybmFsSHR0cENsaWVudCwgY3JlYXRlU2FmZUNsaWVudCDigJQgaW50ZXJuYWwgc2VydmljZS10by1zZXJ2aWNlIEhUVFAgY2xpZW50XG4gKiAtIGNyZWF0ZVF1b3RhU2VydmljZSDigJQgcXVvdGEgZW5mb3JjZW1lbnQgY2xpZW50IGZhY3RvcnlcbiAqIC0gQ2FjaGVTZXJ2aWNlIOKAlCBpbi1tZW1vcnkgVFRMIGNhY2hlXG4gKiAtIENvbXBsaWFuY2VDbGllbnQg4oCUIGNvbXBsaWFuY2Ugc2VydmljZSBjbGllbnRcbiAqIC0gRW50aXR5RXZlbnRFbWl0dGVyIOKAlCBkb21haW4gZXZlbnQgcHViL3N1YlxuICogLSByZXRyeUZvcmV2ZXIg4oCUIGNhcHBlZC1iYWNrb2ZmIHdhaXQgZm9yIGEgZGVwZW5kZW5jeSB0aGF0IG11c3QgY29tZSB1cFxuICpcbiAqICoqRXJyb3JzKipcbiAqIC0gQXBwRXJyb3IsIE5vdEZvdW5kRXJyb3IsIEZvcmJpZGRlbkVycm9yIOKAlCB0eXBlZCBIVFRQIGVycm9yIGNsYXNzZXNcbiAqXG4gKiAqKlZhbGlkYXRpb24qKlxuICogLSBab2QtYmFzZWQgcmVxdWVzdCB2YWxpZGF0aW9uIHNjaGVtYXMgYW5kIG1pZGRsZXdhcmVcbiAqXG4gKiAqKlJvdXRlcyoqXG4gKiAtIEhlYWx0aCBjaGVjayByb3V0ZSBmYWN0b3J5XG4gKlxuICogKipPcGVuQVBJKipcbiAqIC0gU2NoZW1hIHJlZ2lzdHJ5IGFuZCBzcGVjIGdlbmVyYXRpb25cbiAqL1xuXG4vKipcbiAqIFBVQkxJQyBTVVJGQUNFIFBPTElDWVxuICpcbiAqIFRoZSByb290IHJlLWV4cG9ydHMgdGhlIHRlbiBzdWItYmFycmVscywgYW5kIGVhY2ggU1VCLUJBUlJFTCBpcyB0aGUgYWxsb3ctbGlzdFxuICogZm9yIGl0cyBvd24gYXJlYSDigJQgdGhhdCBpcyB3aGVyZSBhIG1vZHVsZSBpcyBlaXRoZXIgYGV4cG9ydCAqYCdkIG9yIG5hcnJvd2VkXG4gKiB0byB0aGUgbmFtZXMgc2VydmljZXMgbWF5IHVzZS4gSW50ZXJuYWxzIGFyZSBleGNsdWRlZCB0aGVyZSByYXRoZXIgdGhhbiBoZXJlLFxuICogc28gdGhlIGV4Y2x1c2lvbiBzaXRzIG5leHQgdG8gdGhlIGNvZGUgdGhhdCBkZWZpbmVzIHRoZW0gYW5kIGNhbm5vdCBiZSBtaXNzZWRcbiAqIGJ5IHNvbWVvbmUgYWRkaW5nIGEgbW9kdWxlLlxuICpcbiAqIEN1cnJlbnRseSBuYXJyb3dlZCAodGhlIHJlc3QgaXMgdGhlIGludGVuZGVkIHN1cmZhY2UpOlxuICogLSBgc2VydmljZXMvcmV0cnktc3RyYXRlZ3lgIOKAlCBkZWNpc2lvbiBmdW5jdGlvbnMgb25seTsgYHBhcnNlUmV0cnlBZnRlcmAgYW5kXG4gKiAgIGBhZGRKaXR0ZXJgIGFyZSBiYWNrb2ZmIGludGVybmFscy5cbiAqIC0gYHNlcnZpY2VzL2NpcmN1aXQtYnJlYWtlcmAg4oCUIGBDaXJjdWl0T3BlbkVycm9yYCArIGByZXNldENpcmN1aXRCcmVha2Vyc2A7XG4gKiAgIHRoZSBgQ2lyY3VpdEJyZWFrZXJgIGNsYXNzIGlzIHdpcmVkIGJ5IHRoZSBzaGFyZWQgSFRUUCBjbGllbnQsIG5vdCBieVxuICogICBzZXJ2aWNlcy5cbiAqIC0gYHNlcnZpY2VzL3NlcnZpY2Uta2V5c2Ag4oCUIHZlcmlmeS9pbnNwZWN0IG9ubHk7IHNpZ25pbmcsIHRoZSBrZXkgYnVuZGxlIGFuZFxuICogICBgX3Jlc2V0U2VydmljZUtleXNGb3JUZXN0c2Agc3RheSBpbnNpZGUuXG4gKiAtIGB1dGlscy9qd2tgIOKAlCBjb25zdGFudHMsIHNoYXBlcywgZGVjb2RlcnMgYW5kIHRoZSB0d28gc2lnbmVyLWZhY2luZyBoZWxwZXJzXG4gKiAgIHBsYXRmb3JtIG5lZWRzOyBgandrVGh1bWJwcmludGAgLyBgcHVibGljS2V5RnJvbUp3a2Agc3RheSBpbnNpZGUuXG4gKlxuICogYXBpLWNvcmUncyBvd24gbW9kdWxlcyBhbmQgaXRzIGB0ZXN0aW5nL2AgaGVscGVycyByZWFjaCB0aGUgZXhjbHVkZWQgc3ltYm9sc1xuICogYnkgREVFUCBpbXBvcnQgKGBAcGlwZWxpbmUtYnVpbGRlci9hcGktY29yZS9saWIvc2VydmljZXMvc2VydmljZS1rZXlzLmpzYCksXG4gKiB3aGljaCBpcyBhbHNvIGhvdyB0aGUgdW5pdCB0ZXN0cyByZWFjaCB0aGVtLlxuICovXG5cbi8vIFR5cGVzXG5leHBvcnQgKiBmcm9tICcuL3R5cGVzL2luZGV4LmpzJztcblxuLy8gQ29uc3RhbnRzXG5leHBvcnQgKiBmcm9tICcuL2NvbnN0YW50cy9pbmRleC5qcyc7XG5cbi8vIFV0aWxzXG5leHBvcnQgKiBmcm9tICcuL3V0aWxzL2luZGV4LmpzJztcblxuLy8gSGVscGVyc1xuZXhwb3J0ICogZnJvbSAnLi9oZWxwZXJzL2luZGV4LmpzJztcblxuLy8gU2VydmljZXNcbmV4cG9ydCAqIGZyb20gJy4vc2VydmljZXMvaW5kZXguanMnO1xuXG4vLyBNaWRkbGV3YXJlXG5leHBvcnQgKiBmcm9tICcuL21pZGRsZXdhcmUvaW5kZXguanMnO1xuXG4vLyBSb3V0ZXNcbmV4cG9ydCAqIGZyb20gJy4vcm91dGVzL2luZGV4LmpzJztcblxuLy8gRXJyb3JzXG5leHBvcnQgKiBmcm9tICcuL2Vycm9ycy9pbmRleC5qcyc7XG5cbi8vIFZhbGlkYXRpb25cbmV4cG9ydCAqIGZyb20gJy4vdmFsaWRhdGlvbi9pbmRleC5qcyc7XG5cbi8vIE9wZW5BUElcbmV4cG9ydCAqIGZyb20gJy4vb3BlbmFwaS9pbmRleC5qcyc7XG4iXX0=

package/lib/middleware/auth.d.ts

@@ -1,5 +1,7 @@
 import type { Request, Response, NextFunction } from 'express';
+import { type OrgAdminAssuranceMachines } from './route-table.js';
 import { type AssuranceLevel, type JwtPayload } from '../types/common.js';
+import { ErrorCode } from '../types/error-codes.js';
 import { type Permission } from '../types/permissions.js';
 /**
  * Verify a token that speaks for a PERSON — access, step-up, and the token an
@@ -157,6 +159,61 @@ export interface AssuranceOptions {
  * of "is this session MFA-grade" in the codebase.
  */
 export declare function requireAssurance(options: AssuranceOptions): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Handler-level twin of {@link requireAssurance}, for a route where only SOME
+ * requests must be MFA-grade — e.g. a policy route on which TIGHTENING a setting
+ * stays open to a single-factor session (so an admin without MFA can adopt it)
+ * but LOOSENING it does not. Same rules and the same three refusals. Returns
+ * true when the request was REFUSED (a response has been sent).
+ */
+export declare function refuseWeakSession(req: Request, res: Response, options: AssuranceOptions): boolean;
+/** What {@link requireOrgAdminAssurance} demands of a route. */
+export interface OrgAdminAssuranceOptions {
+    /** What a machine credential (PAT, service account, machine session) meets on
+     *  this route while the policy is on — see {@link OrgAdminAssuranceMachines}.
+     *  Required, so every route states its decision rather than inheriting one. */
+    machines: OrgAdminAssuranceMachines;
+}
+/** `details.reason` on a refusal by {@link requireOrgAdminAssurance}, so the UI
+ *  can say it is the ORG's policy asking, not the route's own requirement. */
+export declare const ORG_ADMIN_MFA_REASON = "org_admin_policy";
+/**
+ * The refusal {@link requireOrgAdminAssurance} would send for these claims, or
+ * `undefined` when the request may proceed. Exported so a handler whose policy
+ * applies to only PART of a route (e.g. `generate-token`, where opening a new
+ * machine credential is gated but renewing an existing one is not) applies the
+ * exact same rule rather than a copy of it.
+ */
+export declare function orgAdminAssuranceRefusal(claims: JwtPayload | undefined, options: OrgAdminAssuranceOptions): {
+    status: number;
+    code: ErrorCode;
+    message: string;
+    reason: 'machine_principal' | 'weak_session';
+} | undefined;
+/**
+ * Apply {@link orgAdminAssuranceRefusal} and send its refusal. Returns true when
+ * the request was REFUSED (a response has been sent). For handler-level use;
+ * routes use {@link requireOrgAdminAssurance}.
+ */
+export declare function refuseForOrgAdminAssurance(req: Request, res: Response, options: OrgAdminAssuranceOptions): boolean;
+/**
+ * The org policy "administrative actions require MFA" (`adminActionsRequireMfa`).
+ *
+ * Unlike {@link requireAssurance}, the requirement is the ORG's choice, not the
+ * route's: the gate reads the `org_admin_aal` claim, set at token issue from the
+ * active org's policy (strictest across its ancestors), so a service that cannot
+ * read the org document still enforces it. With the policy off the gate is a
+ * no-op; with it on, a single-factor session is refused 401 `MFA_REQUIRED`
+ * (with `details.reason: 'org_admin_policy'`) — the same code the client already
+ * turns into "enrol a factor / sign in with it", never a sign-out.
+ *
+ * `machines` is decided per route (see {@link OrgAdminAssuranceMachines}): the
+ * policy is about how strongly a PERSON's session was opened, so automation that
+ * legitimately drives a route keeps working (`allow`), while a route that mints
+ * a further credential refuses machines outright (`refuse`, 403
+ * `HUMAN_SESSION_REQUIRED` — the same refusal `requireAssurance` gives them).
+ */
+export declare function requireOrgAdminAssurance(options: OrgAdminAssuranceOptions): (req: Request, res: Response, next: NextFunction) => void;
 /**
  * Whether a verified token carries a well-formed identity: a known
  * `principalType` and `token_use`, and the claims that kind of principal must