@pipeline-builder/pipeline-core 0.0.1

package/lib/config/infrastructure-config.js

@@ -0,0 +1,197 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import path from 'path';
+/**
+ * Load Docker registry configuration from environment variables.
+ *
+ * Environment variables:
+ * - `IMAGE_REGISTRY_HOST` — Registry hostname (default: `'registry'`)
+ * - `IMAGE_REGISTRY_PORT` — Registry port (default: `5000`)
+ * - `IMAGE_REGISTRY_PULL_HOST` — Host an out-of-cluster client (CodeBuild)
+ *   uses to pull plugin images. When unset, derived from `PLATFORM_BASE_URL`'s
+ *   host (the public endpoint CodeBuild can resolve), then `IMAGE_REGISTRY_HOST`.
+ * - `IMAGE_REGISTRY_PULL_PORT` — Port for the above. When unset, derived from
+ *   `PLATFORM_BASE_URL`'s port, then `IMAGE_REGISTRY_PORT`.
+ * - `DOCKER_NETWORK` — Docker network for build/push (default: `''`)
+ * - `IMAGE_REGISTRY_HTTP` — Use plain HTTP instead of HTTPS (default: `true`,
+ *   the in-cluster registry has no TLS).
+ *
+ * @returns Registry configuration
+ */
+export function loadRegistryConfig() {
+    const host = process.env.IMAGE_REGISTRY_HOST || 'registry';
+    const port = parseInt(process.env.IMAGE_REGISTRY_PORT || '5000', 10);
+    // When no explicit pull host is set, derive it from PLATFORM_BASE_URL — the
+    // public platform endpoint an out-of-cluster client (AWS CodeBuild) can
+    // resolve, unlike the in-cluster `registry` ClusterIP. Only falls back to the
+    // in-cluster host when PLATFORM_BASE_URL is unset/unparseable (e.g. local).
+    const platform = parsePlatformBaseUrl(process.env.PLATFORM_BASE_URL);
+    return {
+        host,
+        port,
+        pullHost: process.env.IMAGE_REGISTRY_PULL_HOST || platform?.host || host,
+        pullPort: process.env.IMAGE_REGISTRY_PULL_PORT
+            ? parseInt(process.env.IMAGE_REGISTRY_PULL_PORT, 10)
+            : (platform?.port ?? port),
+        network: process.env.DOCKER_NETWORK || '',
+        http: process.env.IMAGE_REGISTRY_HTTP !== 'false',
+    };
+}
+/** Extract host + port from PLATFORM_BASE_URL (e.g. `https://pipeline-builder.com`
+ *  → `{ host: 'pipeline-builder.com', port: 443 }`). Returns null when the value
+ *  is unset or not a valid URL. Exported so the CLI (pipeline-manager) derives
+ *  the registry pull target with the SAME parsing, instead of duplicating it. */
+export function parsePlatformBaseUrl(raw) {
+    if (!raw)
+        return null;
+    try {
+        const u = new URL(raw);
+        // A scheme-less value like `host:8443` parses with a custom protocol and an
+        // EMPTY hostname — reject it so callers fall back rather than derive a
+        // host-less endpoint.
+        if (!u.hostname)
+            return null;
+        const port = u.port ? parseInt(u.port, 10) : (u.protocol === 'https:' ? 443 : 80);
+        return { host: u.hostname, port };
+    }
+    catch {
+        return null;
+    }
+}
+export function loadRedisConfig() {
+    return {
+        host: process.env.REDIS_HOST || 'localhost',
+        port: parseInt(process.env.REDIS_PORT || '6379', 10),
+    };
+}
+/**
+ * Load plugin build queue configuration.
+ *
+ * Environment variables:
+ * - `PLUGIN_BUILD_CONCURRENCY` — Max concurrent plugin builds (default: `1`)
+ */
+export function loadPluginBuildConfig() {
+    return {
+        concurrency: parseInt(process.env.PLUGIN_BUILD_CONCURRENCY || '1', 10),
+        maxAttempts: parseInt(process.env.PLUGIN_BUILD_MAX_ATTEMPTS || '2', 10),
+        backoffDelayMs: parseInt(process.env.PLUGIN_BUILD_BACKOFF_DELAY_MS || '5000', 10),
+        workerTimeoutMs: parseInt(process.env.PLUGIN_BUILD_WORKER_TIMEOUT_MS || '10000', 10),
+        tempDirMaxAgeMs: parseInt(process.env.TEMP_DIR_MAX_AGE_MS || '14400000', 10),
+        dlqMaxAttempts: parseInt(process.env.PLUGIN_DLQ_MAX_ATTEMPTS || '3', 10),
+        dlqBackoffBaseMs: parseInt(process.env.PLUGIN_DLQ_BACKOFF_BASE_MS || '300000', 10),
+        dlqMaxSize: parseInt(process.env.PLUGIN_DLQ_MAX_SIZE || '20', 10),
+    };
+}
+export function loadDatabaseConfig() {
+    return {
+        postgres: {
+            host: process.env.DB_HOST || 'postgres',
+            port: parseInt(process.env.DB_PORT || '5432', 10),
+            database: process.env.DATABASE || 'pipeline_builder',
+            user: process.env.DB_USER || 'postgres',
+            password: process.env.DB_PASSWORD || '',
+        },
+        drizzle: {
+            maxPoolSize: parseInt(process.env.DRIZZLE_MAX_POOL_SIZE || '20', 10),
+            idleTimeoutMillis: parseInt(process.env.DRIZZLE_IDLE_TIMEOUT_MILLIS || '30000', 10),
+            connectionTimeoutMillis: parseInt(process.env.DRIZZLE_CONNECTION_TIMEOUT_MILLIS || '10000', 10),
+        },
+    };
+}
+export function loadObservabilityConfig() {
+    return {
+        logLevel: process.env.LOG_LEVEL || 'info',
+        logFormat: process.env.LOG_FORMAT || 'json',
+        serviceName: process.env.SERVICE_NAME || 'api',
+        tracing: {
+            enabled: process.env.OTEL_TRACING_ENABLED === 'true',
+            endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT || 'http://localhost:4318/v1/traces',
+        },
+    };
+}
+export function loadComplianceConfig() {
+    return {
+        scanSchedulerIntervalMs: parseInt(process.env.SCAN_SCHEDULER_INTERVAL_MS || '60000', 10),
+        systemOrgScansEnabled: process.env.SYSTEM_ORG_SCANS_ENABLED === 'true',
+        scanLockTtlMs: parseInt(process.env.SCAN_LOCK_TTL_MS || '300000', 10),
+        digestSchedulerIntervalMs: parseInt(process.env.DIGEST_SCHEDULER_INTERVAL_MS || '3600000', 10),
+        digestLockTtlMs: parseInt(process.env.DIGEST_LOCK_TTL_MS || '300000', 10),
+    };
+}
+/**
+ * Load plugin build configuration. Builds run against a rootless `moby/buildkit`
+ * sidecar — see `BUILDKIT_HOST`.
+ *
+ * Environment variables:
+ * - `DOCKER_BUILD_TEMP_ROOT` — Temp directory for build contexts (default: `<cwd>/tmp`)
+ * - `DOCKER_BUILD_TIMEOUT_MS` — Build timeout in milliseconds (default: `900000` / 15 min)
+ * - `DOCKER_PUSH_TIMEOUT_MS` — Push timeout in milliseconds (default: `300000` / 5 min)
+ * - `BUILDKIT_HOST` — buildctl `--addr` value for the buildkitd sidecar
+ *   (default: `unix:///run/buildkit/buildkitd.sock`)
+ */
+export function loadDockerConfig() {
+    return {
+        tempRoot: process.env.DOCKER_BUILD_TEMP_ROOT || path.join(process.cwd(), 'tmp'),
+        timeoutMs: parseInt(process.env.DOCKER_BUILD_TIMEOUT_MS || '900000', 10),
+        pushTimeoutMs: parseInt(process.env.DOCKER_PUSH_TIMEOUT_MS || '300000', 10),
+        buildkitAddr: process.env.BUILDKIT_HOST || 'unix:///run/buildkit/buildkitd.sock',
+    };
+}
+/**
+ * Load AWS infrastructure configuration from environment variables.
+ *
+ * Environment variables:
+ * - `LAMBDA_RUNTIME` — Lambda runtime (default: `'nodejs24.x'`; unknown values fall back to it)
+ * - `LAMBDA_TIMEOUT` — Lambda timeout in seconds (default: `900`)
+ * - `LAMBDA_MEMORY_SIZE` — Lambda memory in MB (default: `512`)
+ * - `LAMBDA_ARCHITECTURE` — `'x86_64'` or ARM (default: ARM_64)
+ * - `LOG_GROUP_NAME` — CloudWatch log group (default: `'/pipeline-builder/logs'`)
+ * - `LOG_RETENTION` — Log retention in days (default: `7`)
+ * - `LOG_REMOVAL_POLICY` — `'RETAIN'` or destroy (default: DESTROY)
+ * - `CODEBUILD_COMPUTE_TYPE` — CodeBuild compute type (default: `'SMALL'`)
+ *
+ * @returns AWS infrastructure configuration
+ */
+export function loadAWSConfig() {
+    return {
+        lambda: {
+            runtime: process.env.LAMBDA_RUNTIME || 'nodejs24.x',
+            timeoutSeconds: parseInt(process.env.LAMBDA_TIMEOUT || '900', 10),
+            memorySize: parseInt(process.env.LAMBDA_MEMORY_SIZE || '512', 10),
+            architecture: process.env.LAMBDA_ARCHITECTURE === 'x86_64' ? 'x86_64' : 'arm64',
+            reservedConcurrentExecutions: process.env.LAMBDA_RESERVED_CONCURRENCY
+                ? parseInt(process.env.LAMBDA_RESERVED_CONCURRENCY, 10)
+                : undefined,
+        },
+        logging: {
+            groupName: process.env.LOG_GROUP_NAME || '/pipeline-builder/logs',
+            retentionDays: parseRetentionDays(process.env.LOG_RETENTION || '7'),
+            removalPolicy: process.env.LOG_REMOVAL_POLICY === 'RETAIN' ? 'retain' : 'destroy',
+        },
+        codeBuild: {
+            computeType: (process.env.CODEBUILD_COMPUTE_TYPE || 'SMALL').toUpperCase(),
+            defaultImage: process.env.CODEBUILD_DEFAULT_IMAGE || 'pipeline-bootstrap:1.0',
+        },
+    };
+}
+/**
+ * Valid CloudWatch Logs retention periods, in days. Mirrors the day counts of
+ * CDK's `RetentionDays` enum (whose members ARE the day counts), but written out
+ * so this module stays free of `aws-cdk-lib`  see the note on {@link AWSConfig}.
+ * `0` is CDK's `INFINITE` (never expire).
+ */
+const VALID_RETENTION_DAYS = new Set([
+    0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731,
+    1096, 1827, 2192, 2557, 2922, 3288, 3653,
+]);
+/**
+ * Parse a log-retention string into a valid CloudWatch retention day count.
+ *
+ * @param days - Retention period in days as a string (e.g. `'30'`)
+ * @returns the day count; falls back to 1 day for unknown/invalid values
+ */
+function parseRetentionDays(days) {
+    const parsed = parseInt(days, 10);
+    return VALID_RETENTION_DAYS.has(parsed) ? parsed : 1;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5mcmFzdHJ1Y3R1cmUtY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbmZpZy9pbmZyYXN0cnVjdHVyZS1jb25maWcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLElBQUksTUFBTSxNQUFNLENBQUM7QUFHeEI7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSCxNQUFNLFVBQVUsa0JBQWtCO0lBQ2hDLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLElBQUksVUFBVSxDQUFDO0lBQzNELE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNyRSw0RUFBNEU7SUFDNUUsd0VBQXdFO0lBQ3hFLDhFQUE4RTtJQUM5RSw0RUFBNEU7SUFDNUUsTUFBTSxRQUFRLEdBQUcsb0JBQW9CLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3JFLE9BQU87UUFDTCxJQUFJO1FBQ0osSUFBSTtRQUNKLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLHdCQUF3QixJQUFJLFFBQVEsRUFBRSxJQUFJLElBQUksSUFBSTtRQUN4RSxRQUFRLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyx3QkFBd0I7WUFDNUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHdCQUF3QixFQUFFLEVBQUUsQ0FBQztZQUNwRCxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsSUFBSSxJQUFJLElBQUksQ0FBQztRQUM1QixPQUFPLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLElBQUksRUFBRTtRQUN6QyxJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsS0FBSyxPQUFPO0tBQ2xELENBQUM7QUFDSixDQUFDO0FBRUQ7OztpRkFHaUY7QUFDakYsTUFBTSxVQUFVLG9CQUFvQixDQUFDLEdBQVk7SUFDL0MsSUFBSSxDQUFDLEdBQUc7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN0QixJQUFJLENBQUM7UUFDSCxNQUFNLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN2Qiw0RUFBNEU7UUFDNUUsdUVBQXVFO1FBQ3ZFLHNCQUFzQjtRQUN0QixJQUFJLENBQUMsQ0FBQyxDQUFDLFFBQVE7WUFBRSxPQUFPLElBQUksQ0FBQztRQUM3QixNQUFNLElBQUksR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNsRixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLFVBQVUsZUFBZTtJQUM3QixPQUFPO1FBQ0wsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLFdBQVc7UUFDM0MsSUFBSSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSxNQUFNLEVBQUUsRUFBRSxDQUFDO0tBQ3JELENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCO0lBQ25DLE9BQU87UUFDTCxXQUFXLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLElBQUksR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUN0RSxXQUFXLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMseUJBQXlCLElBQUksR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUN2RSxjQUFjLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsNkJBQTZCLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUNqRixlQUFlLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsOEJBQThCLElBQUksT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNwRixlQUFlLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLElBQUksVUFBVSxFQUFFLEVBQUUsQ0FBQztRQUM1RSxjQUFjLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUJBQXVCLElBQUksR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUN4RSxnQkFBZ0IsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQywwQkFBMEIsSUFBSSxRQUFRLEVBQUUsRUFBRSxDQUFDO1FBQ2xGLFVBQVUsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsSUFBSSxJQUFJLEVBQUUsRUFBRSxDQUFDO0tBQ2xFLENBQUM7QUFDSixDQUFDO0FBRUQsTUFBTSxVQUFVLGtCQUFrQjtJQUNoQyxPQUFPO1FBQ0wsUUFBUSxFQUFFO1lBQ1IsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFVBQVU7WUFDdkMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sSUFBSSxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQ2pELFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsSUFBSSxrQkFBa0I7WUFDcEQsSUFBSSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFVBQVU7WUFDdkMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVyxJQUFJLEVBQUU7U0FDeEM7UUFDRCxPQUFPLEVBQUU7WUFDUCxXQUFXLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMscUJBQXFCLElBQUksSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUNwRSxpQkFBaUIsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQywyQkFBMkIsSUFBSSxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQ25GLHVCQUF1QixFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGlDQUFpQyxJQUFJLE9BQU8sRUFBRSxFQUFFLENBQUM7U0FDaEc7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sVUFBVSx1QkFBdUI7SUFDckMsT0FBTztRQUNMLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsSUFBSSxNQUFNO1FBQ3pDLFNBQVMsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSxNQUFNO1FBQzNDLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFlBQVksSUFBSSxLQUFLO1FBQzlDLE9BQU8sRUFBRTtZQUNQLE9BQU8sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLG9CQUFvQixLQUFLLE1BQU07WUFDcEQsUUFBUSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkJBQTJCLElBQUksaUNBQWlDO1NBQ3ZGO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsb0JBQW9CO0lBQ2xDLE9BQU87UUFDTCx1QkFBdUIsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQywwQkFBMEIsSUFBSSxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3hGLHFCQUFxQixFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLEtBQUssTUFBTTtRQUN0RSxhQUFhLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLElBQUksUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUNyRSx5QkFBeUIsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyw0QkFBNEIsSUFBSSxTQUFTLEVBQUUsRUFBRSxDQUFDO1FBQzlGLGVBQWUsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsSUFBSSxRQUFRLEVBQUUsRUFBRSxDQUFDO0tBQzFFLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sVUFBVSxnQkFBZ0I7SUFDOUIsT0FBTztRQUNMLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLHNCQUFzQixJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssQ0FBQztRQUMvRSxTQUFTLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUJBQXVCLElBQUksUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUN4RSxhQUFhLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsc0JBQXNCLElBQUksUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUMzRSxZQUFZLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxhQUFhLElBQUkscUNBQXFDO0tBQ2pGLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDSCxNQUFNLFVBQVUsYUFBYTtJQUMzQixPQUFPO1FBQ0wsTUFBTSxFQUFFO1lBQ04sT0FBTyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxJQUFJLFlBQVk7WUFDbkQsY0FBYyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsSUFBSSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ2pFLFVBQVUsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsSUFBSSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ2pFLFlBQVksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQixLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPO1lBQy9FLDRCQUE0QixFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkJBQTJCO2dCQUNuRSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkJBQTJCLEVBQUUsRUFBRSxDQUFDO2dCQUN2RCxDQUFDLENBQUMsU0FBUztTQUNkO1FBRUQsT0FBTyxFQUFFO1lBQ1AsU0FBUyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxJQUFJLHdCQUF3QjtZQUNqRSxhQUFhLEVBQUUsa0JBQWtCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxhQUFhLElBQUksR0FBRyxDQUFDO1lBQ25FLGFBQWEsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFrQixLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTO1NBQ2xGO1FBRUQsU0FBUyxFQUFFO1lBQ1QsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsSUFBSSxPQUFPLENBQUMsQ0FBQyxXQUFXLEVBQUU7WUFDMUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUJBQXVCLElBQUksd0JBQXdCO1NBQzlFO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxHQUFHLENBQUM7SUFDbkMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRztJQUNoRSxJQUFJLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJO0NBQ3pDLENBQUMsQ0FBQztBQUVIOzs7OztHQUtHO0FBQ0gsU0FBUyxrQkFBa0IsQ0FBQyxJQUFZO0lBQ3RDLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDbEMsT0FBTyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ3ZELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHBhdGggZnJvbSAncGF0aCc7XG5pbXBvcnQgdHlwZSB7IEFXU0NvbmZpZywgQnVpbGRDb25maWcsIENvbXBsaWFuY2VDb25maWcsIERhdGFiYXNlQ29uZmlnLCBPYnNlcnZhYmlsaXR5Q29uZmlnLCBQbHVnaW5CdWlsZENvbmZpZywgUmVkaXNDb25maWcsIFJlZ2lzdHJ5Q29uZmlnIH0gZnJvbSAnLi9jb25maWctdHlwZXMuanMnO1xuXG4vKipcbiAqIExvYWQgRG9ja2VyIHJlZ2lzdHJ5IGNvbmZpZ3VyYXRpb24gZnJvbSBlbnZpcm9ubWVudCB2YXJpYWJsZXMuXG4gKlxuICogRW52aXJvbm1lbnQgdmFyaWFibGVzOlxuICogLSBgSU1BR0VfUkVHSVNUUllfSE9TVGAg4oCUIFJlZ2lzdHJ5IGhvc3RuYW1lIChkZWZhdWx0OiBgJ3JlZ2lzdHJ5J2ApXG4gKiAtIGBJTUFHRV9SRUdJU1RSWV9QT1JUYCDigJQgUmVnaXN0cnkgcG9ydCAoZGVmYXVsdDogYDUwMDBgKVxuICogLSBgSU1BR0VfUkVHSVNUUllfUFVMTF9IT1NUYCDigJQgSG9zdCBhbiBvdXQtb2YtY2x1c3RlciBjbGllbnQgKENvZGVCdWlsZClcbiAqICAgdXNlcyB0byBwdWxsIHBsdWdpbiBpbWFnZXMuIFdoZW4gdW5zZXQsIGRlcml2ZWQgZnJvbSBgUExBVEZPUk1fQkFTRV9VUkxgJ3NcbiAqICAgaG9zdCAodGhlIHB1YmxpYyBlbmRwb2ludCBDb2RlQnVpbGQgY2FuIHJlc29sdmUpLCB0aGVuIGBJTUFHRV9SRUdJU1RSWV9IT1NUYC5cbiAqIC0gYElNQUdFX1JFR0lTVFJZX1BVTExfUE9SVGAg4oCUIFBvcnQgZm9yIHRoZSBhYm92ZS4gV2hlbiB1bnNldCwgZGVyaXZlZCBmcm9tXG4gKiAgIGBQTEFURk9STV9CQVNFX1VSTGAncyBwb3J0LCB0aGVuIGBJTUFHRV9SRUdJU1RSWV9QT1JUYC5cbiAqIC0gYERPQ0tFUl9ORVRXT1JLYCDigJQgRG9ja2VyIG5ldHdvcmsgZm9yIGJ1aWxkL3B1c2ggKGRlZmF1bHQ6IGAnJ2ApXG4gKiAtIGBJTUFHRV9SRUdJU1RSWV9IVFRQYCDigJQgVXNlIHBsYWluIEhUVFAgaW5zdGVhZCBvZiBIVFRQUyAoZGVmYXVsdDogYHRydWVgLFxuICogICB0aGUgaW4tY2x1c3RlciByZWdpc3RyeSBoYXMgbm8gVExTKS5cbiAqXG4gKiBAcmV0dXJucyBSZWdpc3RyeSBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkUmVnaXN0cnlDb25maWcoKTogUmVnaXN0cnlDb25maWcge1xuICBjb25zdCBob3N0ID0gcHJvY2Vzcy5lbnYuSU1BR0VfUkVHSVNUUllfSE9TVCB8fCAncmVnaXN0cnknO1xuICBjb25zdCBwb3J0ID0gcGFyc2VJbnQocHJvY2Vzcy5lbnYuSU1BR0VfUkVHSVNUUllfUE9SVCB8fCAnNTAwMCcsIDEwKTtcbiAgLy8gV2hlbiBubyBleHBsaWNpdCBwdWxsIGhvc3QgaXMgc2V0LCBkZXJpdmUgaXQgZnJvbSBQTEFURk9STV9CQVNFX1VSTCDigJQgdGhlXG4gIC8vIHB1YmxpYyBwbGF0Zm9ybSBlbmRwb2ludCBhbiBvdXQtb2YtY2x1c3RlciBjbGllbnQgKEFXUyBDb2RlQnVpbGQpIGNhblxuICAvLyByZXNvbHZlLCB1bmxpa2UgdGhlIGluLWNsdXN0ZXIgYHJlZ2lzdHJ5YCBDbHVzdGVySVAuIE9ubHkgZmFsbHMgYmFjayB0byB0aGVcbiAgLy8gaW4tY2x1c3RlciBob3N0IHdoZW4gUExBVEZPUk1fQkFTRV9VUkwgaXMgdW5zZXQvdW5wYXJzZWFibGUgKGUuZy4gbG9jYWwpLlxuICBjb25zdCBwbGF0Zm9ybSA9IHBhcnNlUGxhdGZvcm1CYXNlVXJsKHByb2Nlc3MuZW52LlBMQVRGT1JNX0JBU0VfVVJMKTtcbiAgcmV0dXJuIHtcbiAgICBob3N0LFxuICAgIHBvcnQsXG4gICAgcHVsbEhvc3Q6IHByb2Nlc3MuZW52LklNQUdFX1JFR0lTVFJZX1BVTExfSE9TVCB8fCBwbGF0Zm9ybT8uaG9zdCB8fCBob3N0LFxuICAgIHB1bGxQb3J0OiBwcm9jZXNzLmVudi5JTUFHRV9SRUdJU1RSWV9QVUxMX1BPUlRcbiAgICAgID8gcGFyc2VJbnQocHJvY2Vzcy5lbnYuSU1BR0VfUkVHSVNUUllfUFVMTF9QT1JULCAxMClcbiAgICAgIDogKHBsYXRmb3JtPy5wb3J0ID8/IHBvcnQpLFxuICAgIG5ldHdvcms6IHByb2Nlc3MuZW52LkRPQ0tFUl9ORVRXT1JLIHx8ICcnLFxuICAgIGh0dHA6IHByb2Nlc3MuZW52LklNQUdFX1JFR0lTVFJZX0hUVFAgIT09ICdmYWxzZScsXG4gIH07XG59XG5cbi8qKiBFeHRyYWN0IGhvc3QgKyBwb3J0IGZyb20gUExBVEZPUk1fQkFTRV9VUkwgKGUuZy4gYGh0dHBzOi8vcGlwZWxpbmUtYnVpbGRlci5jb21gXG4gKiAg4oaSIGB7IGhvc3Q6ICdwaXBlbGluZS1idWlsZGVyLmNvbScsIHBvcnQ6IDQ0MyB9YCkuIFJldHVybnMgbnVsbCB3aGVuIHRoZSB2YWx1ZVxuICogIGlzIHVuc2V0IG9yIG5vdCBhIHZhbGlkIFVSTC4gRXhwb3J0ZWQgc28gdGhlIENMSSAocGlwZWxpbmUtbWFuYWdlcikgZGVyaXZlc1xuICogIHRoZSByZWdpc3RyeSBwdWxsIHRhcmdldCB3aXRoIHRoZSBTQU1FIHBhcnNpbmcsIGluc3RlYWQgb2YgZHVwbGljYXRpbmcgaXQuICovXG5leHBvcnQgZnVuY3Rpb24gcGFyc2VQbGF0Zm9ybUJhc2VVcmwocmF3Pzogc3RyaW5nKTogeyBob3N0OiBzdHJpbmc7IHBvcnQ6IG51bWJlciB9IHwgbnVsbCB7XG4gIGlmICghcmF3KSByZXR1cm4gbnVsbDtcbiAgdHJ5IHtcbiAgICBjb25zdCB1ID0gbmV3IFVSTChyYXcpO1xuICAgIC8vIEEgc2NoZW1lLWxlc3MgdmFsdWUgbGlrZSBgaG9zdDo4NDQzYCBwYXJzZXMgd2l0aCBhIGN1c3RvbSBwcm90b2NvbCBhbmQgYW5cbiAgICAvLyBFTVBUWSBob3N0bmFtZSDigJQgcmVqZWN0IGl0IHNvIGNhbGxlcnMgZmFsbCBiYWNrIHJhdGhlciB0aGFuIGRlcml2ZSBhXG4gICAgLy8gaG9zdC1sZXNzIGVuZHBvaW50LlxuICAgIGlmICghdS5ob3N0bmFtZSkgcmV0dXJuIG51bGw7XG4gICAgY29uc3QgcG9ydCA9IHUucG9ydCA/IHBhcnNlSW50KHUucG9ydCwgMTApIDogKHUucHJvdG9jb2wgPT09ICdodHRwczonID8gNDQzIDogODApO1xuICAgIHJldHVybiB7IGhvc3Q6IHUuaG9zdG5hbWUsIHBvcnQgfTtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIG51bGw7XG4gIH1cbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGxvYWRSZWRpc0NvbmZpZygpOiBSZWRpc0NvbmZpZyB7XG4gIHJldHVybiB7XG4gICAgaG9zdDogcHJvY2Vzcy5lbnYuUkVESVNfSE9TVCB8fCAnbG9jYWxob3N0JyxcbiAgICBwb3J0OiBwYXJzZUludChwcm9jZXNzLmVudi5SRURJU19QT1JUIHx8ICc2Mzc5JywgMTApLFxuICB9O1xufVxuXG4vKipcbiAqIExvYWQgcGx1Z2luIGJ1aWxkIHF1ZXVlIGNvbmZpZ3VyYXRpb24uXG4gKlxuICogRW52aXJvbm1lbnQgdmFyaWFibGVzOlxuICogLSBgUExVR0lOX0JVSUxEX0NPTkNVUlJFTkNZYCDigJQgTWF4IGNvbmN1cnJlbnQgcGx1Z2luIGJ1aWxkcyAoZGVmYXVsdDogYDFgKVxuICovXG5leHBvcnQgZnVuY3Rpb24gbG9hZFBsdWdpbkJ1aWxkQ29uZmlnKCk6IFBsdWdpbkJ1aWxkQ29uZmlnIHtcbiAgcmV0dXJuIHtcbiAgICBjb25jdXJyZW5jeTogcGFyc2VJbnQocHJvY2Vzcy5lbnYuUExVR0lOX0JVSUxEX0NPTkNVUlJFTkNZIHx8ICcxJywgMTApLFxuICAgIG1heEF0dGVtcHRzOiBwYXJzZUludChwcm9jZXNzLmVudi5QTFVHSU5fQlVJTERfTUFYX0FUVEVNUFRTIHx8ICcyJywgMTApLFxuICAgIGJhY2tvZmZEZWxheU1zOiBwYXJzZUludChwcm9jZXNzLmVudi5QTFVHSU5fQlVJTERfQkFDS09GRl9ERUxBWV9NUyB8fCAnNTAwMCcsIDEwKSxcbiAgICB3b3JrZXJUaW1lb3V0TXM6IHBhcnNlSW50KHByb2Nlc3MuZW52LlBMVUdJTl9CVUlMRF9XT1JLRVJfVElNRU9VVF9NUyB8fCAnMTAwMDAnLCAxMCksXG4gICAgdGVtcERpck1heEFnZU1zOiBwYXJzZUludChwcm9jZXNzLmVudi5URU1QX0RJUl9NQVhfQUdFX01TIHx8ICcxNDQwMDAwMCcsIDEwKSxcbiAgICBkbHFNYXhBdHRlbXB0czogcGFyc2VJbnQocHJvY2Vzcy5lbnYuUExVR0lOX0RMUV9NQVhfQVRURU1QVFMgfHwgJzMnLCAxMCksXG4gICAgZGxxQmFja29mZkJhc2VNczogcGFyc2VJbnQocHJvY2Vzcy5lbnYuUExVR0lOX0RMUV9CQUNLT0ZGX0JBU0VfTVMgfHwgJzMwMDAwMCcsIDEwKSxcbiAgICBkbHFNYXhTaXplOiBwYXJzZUludChwcm9jZXNzLmVudi5QTFVHSU5fRExRX01BWF9TSVpFIHx8ICcyMCcsIDEwKSxcbiAgfTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGxvYWREYXRhYmFzZUNvbmZpZygpOiBEYXRhYmFzZUNvbmZpZyB7XG4gIHJldHVybiB7XG4gICAgcG9zdGdyZXM6IHtcbiAgICAgIGhvc3Q6IHByb2Nlc3MuZW52LkRCX0hPU1QgfHwgJ3Bvc3RncmVzJyxcbiAgICAgIHBvcnQ6IHBhcnNlSW50KHByb2Nlc3MuZW52LkRCX1BPUlQgfHwgJzU0MzInLCAxMCksXG4gICAgICBkYXRhYmFzZTogcHJvY2Vzcy5lbnYuREFUQUJBU0UgfHwgJ3BpcGVsaW5lX2J1aWxkZXInLFxuICAgICAgdXNlcjogcHJvY2Vzcy5lbnYuREJfVVNFUiB8fCAncG9zdGdyZXMnLFxuICAgICAgcGFzc3dvcmQ6IHByb2Nlc3MuZW52LkRCX1BBU1NXT1JEIHx8ICcnLFxuICAgIH0sXG4gICAgZHJpenpsZToge1xuICAgICAgbWF4UG9vbFNpemU6IHBhcnNlSW50KHByb2Nlc3MuZW52LkRSSVpaTEVfTUFYX1BPT0xfU0laRSB8fCAnMjAnLCAxMCksXG4gICAgICBpZGxlVGltZW91dE1pbGxpczogcGFyc2VJbnQocHJvY2Vzcy5lbnYuRFJJWlpMRV9JRExFX1RJTUVPVVRfTUlMTElTIHx8ICczMDAwMCcsIDEwKSxcbiAgICAgIGNvbm5lY3Rpb25UaW1lb3V0TWlsbGlzOiBwYXJzZUludChwcm9jZXNzLmVudi5EUklaWkxFX0NPTk5FQ1RJT05fVElNRU9VVF9NSUxMSVMgfHwgJzEwMDAwJywgMTApLFxuICAgIH0sXG4gIH07XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBsb2FkT2JzZXJ2YWJpbGl0eUNvbmZpZygpOiBPYnNlcnZhYmlsaXR5Q29uZmlnIHtcbiAgcmV0dXJuIHtcbiAgICBsb2dMZXZlbDogcHJvY2Vzcy5lbnYuTE9HX0xFVkVMIHx8ICdpbmZvJyxcbiAgICBsb2dGb3JtYXQ6IHByb2Nlc3MuZW52LkxPR19GT1JNQVQgfHwgJ2pzb24nLFxuICAgIHNlcnZpY2VOYW1lOiBwcm9jZXNzLmVudi5TRVJWSUNFX05BTUUgfHwgJ2FwaScsXG4gICAgdHJhY2luZzoge1xuICAgICAgZW5hYmxlZDogcHJvY2Vzcy5lbnYuT1RFTF9UUkFDSU5HX0VOQUJMRUQgPT09ICd0cnVlJyxcbiAgICAgIGVuZHBvaW50OiBwcm9jZXNzLmVudi5PVEVMX0VYUE9SVEVSX09UTFBfRU5EUE9JTlQgfHwgJ2h0dHA6Ly9sb2NhbGhvc3Q6NDMxOC92MS90cmFjZXMnLFxuICAgIH0sXG4gIH07XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBsb2FkQ29tcGxpYW5jZUNvbmZpZygpOiBDb21wbGlhbmNlQ29uZmlnIHtcbiAgcmV0dXJuIHtcbiAgICBzY2FuU2NoZWR1bGVySW50ZXJ2YWxNczogcGFyc2VJbnQocHJvY2Vzcy5lbnYuU0NBTl9TQ0hFRFVMRVJfSU5URVJWQUxfTVMgfHwgJzYwMDAwJywgMTApLFxuICAgIHN5c3RlbU9yZ1NjYW5zRW5hYmxlZDogcHJvY2Vzcy5lbnYuU1lTVEVNX09SR19TQ0FOU19FTkFCTEVEID09PSAndHJ1ZScsXG4gICAgc2NhbkxvY2tUdGxNczogcGFyc2VJbnQocHJvY2Vzcy5lbnYuU0NBTl9MT0NLX1RUTF9NUyB8fCAnMzAwMDAwJywgMTApLFxuICAgIGRpZ2VzdFNjaGVkdWxlckludGVydmFsTXM6IHBhcnNlSW50KHByb2Nlc3MuZW52LkRJR0VTVF9TQ0hFRFVMRVJfSU5URVJWQUxfTVMgfHwgJzM2MDAwMDAnLCAxMCksXG4gICAgZGlnZXN0TG9ja1R0bE1zOiBwYXJzZUludChwcm9jZXNzLmVudi5ESUdFU1RfTE9DS19UVExfTVMgfHwgJzMwMDAwMCcsIDEwKSxcbiAgfTtcbn1cblxuLyoqXG4gKiBMb2FkIHBsdWdpbiBidWlsZCBjb25maWd1cmF0aW9uLiBCdWlsZHMgcnVuIGFnYWluc3QgYSByb290bGVzcyBgbW9ieS9idWlsZGtpdGBcbiAqIHNpZGVjYXIg4oCUIHNlZSBgQlVJTERLSVRfSE9TVGAuXG4gKlxuICogRW52aXJvbm1lbnQgdmFyaWFibGVzOlxuICogLSBgRE9DS0VSX0JVSUxEX1RFTVBfUk9PVGAg4oCUIFRlbXAgZGlyZWN0b3J5IGZvciBidWlsZCBjb250ZXh0cyAoZGVmYXVsdDogYDxjd2Q+L3RtcGApXG4gKiAtIGBET0NLRVJfQlVJTERfVElNRU9VVF9NU2Ag4oCUIEJ1aWxkIHRpbWVvdXQgaW4gbWlsbGlzZWNvbmRzIChkZWZhdWx0OiBgOTAwMDAwYCAvIDE1IG1pbilcbiAqIC0gYERPQ0tFUl9QVVNIX1RJTUVPVVRfTVNgIOKAlCBQdXNoIHRpbWVvdXQgaW4gbWlsbGlzZWNvbmRzIChkZWZhdWx0OiBgMzAwMDAwYCAvIDUgbWluKVxuICogLSBgQlVJTERLSVRfSE9TVGAg4oCUIGJ1aWxkY3RsIGAtLWFkZHJgIHZhbHVlIGZvciB0aGUgYnVpbGRraXRkIHNpZGVjYXJcbiAqICAgKGRlZmF1bHQ6IGB1bml4Oi8vL3J1bi9idWlsZGtpdC9idWlsZGtpdGQuc29ja2ApXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkRG9ja2VyQ29uZmlnKCk6IEJ1aWxkQ29uZmlnIHtcbiAgcmV0dXJuIHtcbiAgICB0ZW1wUm9vdDogcHJvY2Vzcy5lbnYuRE9DS0VSX0JVSUxEX1RFTVBfUk9PVCB8fCBwYXRoLmpvaW4ocHJvY2Vzcy5jd2QoKSwgJ3RtcCcpLFxuICAgIHRpbWVvdXRNczogcGFyc2VJbnQocHJvY2Vzcy5lbnYuRE9DS0VSX0JVSUxEX1RJTUVPVVRfTVMgfHwgJzkwMDAwMCcsIDEwKSxcbiAgICBwdXNoVGltZW91dE1zOiBwYXJzZUludChwcm9jZXNzLmVudi5ET0NLRVJfUFVTSF9USU1FT1VUX01TIHx8ICczMDAwMDAnLCAxMCksXG4gICAgYnVpbGRraXRBZGRyOiBwcm9jZXNzLmVudi5CVUlMREtJVF9IT1NUIHx8ICd1bml4Oi8vL3J1bi9idWlsZGtpdC9idWlsZGtpdGQuc29jaycsXG4gIH07XG59XG5cbi8qKlxuICogTG9hZCBBV1MgaW5mcmFzdHJ1Y3R1cmUgY29uZmlndXJhdGlvbiBmcm9tIGVudmlyb25tZW50IHZhcmlhYmxlcy5cbiAqXG4gKiBFbnZpcm9ubWVudCB2YXJpYWJsZXM6XG4gKiAtIGBMQU1CREFfUlVOVElNRWAg4oCUIExhbWJkYSBydW50aW1lIChkZWZhdWx0OiBgJ25vZGVqczI0LngnYDsgdW5rbm93biB2YWx1ZXMgZmFsbCBiYWNrIHRvIGl0KVxuICogLSBgTEFNQkRBX1RJTUVPVVRgIOKAlCBMYW1iZGEgdGltZW91dCBpbiBzZWNvbmRzIChkZWZhdWx0OiBgOTAwYClcbiAqIC0gYExBTUJEQV9NRU1PUllfU0laRWAg4oCUIExhbWJkYSBtZW1vcnkgaW4gTUIgKGRlZmF1bHQ6IGA1MTJgKVxuICogLSBgTEFNQkRBX0FSQ0hJVEVDVFVSRWAg4oCUIGAneDg2XzY0J2Agb3IgQVJNIChkZWZhdWx0OiBBUk1fNjQpXG4gKiAtIGBMT0dfR1JPVVBfTkFNRWAg4oCUIENsb3VkV2F0Y2ggbG9nIGdyb3VwIChkZWZhdWx0OiBgJy9waXBlbGluZS1idWlsZGVyL2xvZ3MnYClcbiAqIC0gYExPR19SRVRFTlRJT05gIOKAlCBMb2cgcmV0ZW50aW9uIGluIGRheXMgKGRlZmF1bHQ6IGA3YClcbiAqIC0gYExPR19SRU1PVkFMX1BPTElDWWAg4oCUIGAnUkVUQUlOJ2Agb3IgZGVzdHJveSAoZGVmYXVsdDogREVTVFJPWSlcbiAqIC0gYENPREVCVUlMRF9DT01QVVRFX1RZUEVgIOKAlCBDb2RlQnVpbGQgY29tcHV0ZSB0eXBlIChkZWZhdWx0OiBgJ1NNQUxMJ2ApXG4gKlxuICogQHJldHVybnMgQVdTIGluZnJhc3RydWN0dXJlIGNvbmZpZ3VyYXRpb25cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGxvYWRBV1NDb25maWcoKTogQVdTQ29uZmlnIHtcbiAgcmV0dXJuIHtcbiAgICBsYW1iZGE6IHtcbiAgICAgIHJ1bnRpbWU6IHByb2Nlc3MuZW52LkxBTUJEQV9SVU5USU1FIHx8ICdub2RlanMyNC54JyxcbiAgICAgIHRpbWVvdXRTZWNvbmRzOiBwYXJzZUludChwcm9jZXNzLmVudi5MQU1CREFfVElNRU9VVCB8fCAnOTAwJywgMTApLFxuICAgICAgbWVtb3J5U2l6ZTogcGFyc2VJbnQocHJvY2Vzcy5lbnYuTEFNQkRBX01FTU9SWV9TSVpFIHx8ICc1MTInLCAxMCksXG4gICAgICBhcmNoaXRlY3R1cmU6IHByb2Nlc3MuZW52LkxBTUJEQV9BUkNISVRFQ1RVUkUgPT09ICd4ODZfNjQnID8gJ3g4Nl82NCcgOiAnYXJtNjQnLFxuICAgICAgcmVzZXJ2ZWRDb25jdXJyZW50RXhlY3V0aW9uczogcHJvY2Vzcy5lbnYuTEFNQkRBX1JFU0VSVkVEX0NPTkNVUlJFTkNZXG4gICAgICAgID8gcGFyc2VJbnQocHJvY2Vzcy5lbnYuTEFNQkRBX1JFU0VSVkVEX0NPTkNVUlJFTkNZLCAxMClcbiAgICAgICAgOiB1bmRlZmluZWQsXG4gICAgfSxcblxuICAgIGxvZ2dpbmc6IHtcbiAgICAgIGdyb3VwTmFtZTogcHJvY2Vzcy5lbnYuTE9HX0dST1VQX05BTUUgfHwgJy9waXBlbGluZS1idWlsZGVyL2xvZ3MnLFxuICAgICAgcmV0ZW50aW9uRGF5czogcGFyc2VSZXRlbnRpb25EYXlzKHByb2Nlc3MuZW52LkxPR19SRVRFTlRJT04gfHwgJzcnKSxcbiAgICAgIHJlbW92YWxQb2xpY3k6IHByb2Nlc3MuZW52LkxPR19SRU1PVkFMX1BPTElDWSA9PT0gJ1JFVEFJTicgPyAncmV0YWluJyA6ICdkZXN0cm95JyxcbiAgICB9LFxuXG4gICAgY29kZUJ1aWxkOiB7XG4gICAgICBjb21wdXRlVHlwZTogKHByb2Nlc3MuZW52LkNPREVCVUlMRF9DT01QVVRFX1RZUEUgfHwgJ1NNQUxMJykudG9VcHBlckNhc2UoKSxcbiAgICAgIGRlZmF1bHRJbWFnZTogcHJvY2Vzcy5lbnYuQ09ERUJVSUxEX0RFRkFVTFRfSU1BR0UgfHwgJ3BpcGVsaW5lLWJvb3RzdHJhcDoxLjAnLFxuICAgIH0sXG4gIH07XG59XG5cbi8qKlxuICogVmFsaWQgQ2xvdWRXYXRjaCBMb2dzIHJldGVudGlvbiBwZXJpb2RzLCBpbiBkYXlzLiBNaXJyb3JzIHRoZSBkYXkgY291bnRzIG9mXG4gKiBDREsncyBgUmV0ZW50aW9uRGF5c2AgZW51bSAod2hvc2UgbWVtYmVycyBBUkUgdGhlIGRheSBjb3VudHMpLCBidXQgd3JpdHRlbiBvdXRcbiAqIHNvIHRoaXMgbW9kdWxlIHN0YXlzIGZyZWUgb2YgYGF3cy1jZGstbGliYCAgc2VlIHRoZSBub3RlIG9uIHtAbGluayBBV1NDb25maWd9LlxuICogYDBgIGlzIENESydzIGBJTkZJTklURWAgKG5ldmVyIGV4cGlyZSkuXG4gKi9cbmNvbnN0IFZBTElEX1JFVEVOVElPTl9EQVlTID0gbmV3IFNldChbXG4gIDAsIDEsIDMsIDUsIDcsIDE0LCAzMCwgNjAsIDkwLCAxMjAsIDE1MCwgMTgwLCAzNjUsIDQwMCwgNTQ1LCA3MzEsXG4gIDEwOTYsIDE4MjcsIDIxOTIsIDI1NTcsIDI5MjIsIDMyODgsIDM2NTMsXG5dKTtcblxuLyoqXG4gKiBQYXJzZSBhIGxvZy1yZXRlbnRpb24gc3RyaW5nIGludG8gYSB2YWxpZCBDbG91ZFdhdGNoIHJldGVudGlvbiBkYXkgY291bnQuXG4gKlxuICogQHBhcmFtIGRheXMgLSBSZXRlbnRpb24gcGVyaW9kIGluIGRheXMgYXMgYSBzdHJpbmcgKGUuZy4gYCczMCdgKVxuICogQHJldHVybnMgdGhlIGRheSBjb3VudDsgZmFsbHMgYmFjayB0byAxIGRheSBmb3IgdW5rbm93bi9pbnZhbGlkIHZhbHVlc1xuICovXG5mdW5jdGlvbiBwYXJzZVJldGVudGlvbkRheXMoZGF5czogc3RyaW5nKTogbnVtYmVyIHtcbiAgY29uc3QgcGFyc2VkID0gcGFyc2VJbnQoZGF5cywgMTApO1xuICByZXR1cm4gVkFMSURfUkVURU5USU9OX0RBWVMuaGFzKHBhcnNlZCkgPyBwYXJzZWQgOiAxO1xufVxuIl19

package/lib/config/server-config.d.ts

@@ -0,0 +1,53 @@
+import type { ServerConfig, AuthConfig, RateLimitConfig } from './config-types.js';
+/**
+ * Load server configuration from environment variables.
+ *
+ * Environment variables:
+ * - `PORT` — HTTP listen port (default: `3000`)
+ * - `CORS_ORIGIN` — Comma-separated allowed origins (default: `PLATFORM_BASE_URL`)
+ * - `CORS_CREDENTIALS` — Allow credentials; set to `'false'` to disable (default: `true`)
+ * - `TRUST_PROXY` — Express trust proxy hops (default: `1`)
+ * - `PLATFORM_BASE_URL` — Frontend URL used as CORS fallback (default: `'https://localhost:8443'`)
+ *
+ * @returns Server configuration with port, CORS, trust proxy, and platform URL
+ */
+export declare function loadServerConfig(): ServerConfig;
+/**
+ * Load authentication configuration from environment variables.
+ *
+ * Environment variables:
+ * - `JWT_SECRET` — **Required.** Secret key for signing JWTs
+ * - `REFRESH_TOKEN_SECRET` — **Required.** Secret key for signing refresh tokens
+ * - `JWT_EXPIRES_IN` — JWT lifetime in seconds (default: `7200` = 2 hours)
+ * - `JWT_ALGORITHM` — JWT signing algorithm (default: `'HS256'`)
+ * - `BCRYPT_SALT_ROUNDS` — bcrypt salt rounds for password hashing (default: `12`)
+ * - `REFRESH_TOKEN_EXPIRES_IN` — Refresh token lifetime in seconds (default: `2592000` = 30 days)
+ *
+ * @returns Authentication configuration with safe defaults (empty strings when env vars are unset).
+ * Call {@link validateAuthConfig} at server startup to enforce required secrets.
+ */
+export declare function loadAuthConfig(): AuthConfig;
+/**
+ * Load rate limiting configuration from environment variables.
+ *
+ * Environment variables:
+ * - `LIMITER_MAX` — Max requests per window (default: `100`)
+ * - `LIMITER_WINDOWMS` — Rate limit window in ms (default: `900000` = 15 minutes)
+ *
+ * @returns Rate limit configuration
+ */
+export declare function loadRateLimitConfig(): RateLimitConfig;
+/**
+ * Validate server configuration and log warnings for insecure settings.
+ *
+ * @param config - Server configuration to validate
+ */
+export declare function validateServerConfig(config: ServerConfig): void;
+/**
+ * Validate authentication configuration (JWT secrets, algorithms, expiration).
+ * Call this at server startup, not during CDK synthesis.
+ *
+ * @param config - Auth configuration to validate
+ * @throws {Error} If secrets are insecure, too short (<32 chars), or use disallowed algorithms
+ */
+export declare function validateAuthConfig(config: AuthConfig): void;

package/lib/config/server-config.js

@@ -0,0 +1,175 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { createLogger } from '@pipeline-builder/api-core';
+import { CoreConstants } from './app-config.js';
+const log = createLogger('server-config');
+/**
+ * Load server configuration from environment variables.
+ *
+ * Environment variables:
+ * - `PORT` — HTTP listen port (default: `3000`)
+ * - `CORS_ORIGIN` — Comma-separated allowed origins (default: `PLATFORM_BASE_URL`)
+ * - `CORS_CREDENTIALS` — Allow credentials; set to `'false'` to disable (default: `true`)
+ * - `TRUST_PROXY` — Express trust proxy hops (default: `1`)
+ * - `PLATFORM_BASE_URL` — Frontend URL used as CORS fallback (default: `'https://localhost:8443'`)
+ *
+ * @returns Server configuration with port, CORS, trust proxy, and platform URL
+ */
+export function loadServerConfig() {
+    return {
+        port: parseInt(process.env.PORT || '3000', 10),
+        cors: {
+            credentials: process.env.CORS_CREDENTIALS !== 'false',
+            origin: process.env.CORS_ORIGIN
+                ? process.env.CORS_ORIGIN.split(',').map(o => o.trim())
+                : [process.env.PLATFORM_BASE_URL || CoreConstants.DEFAULT_PLATFORM_URL],
+        },
+        trustProxy: parseInt(process.env.TRUST_PROXY || '1', 10),
+        platformUrl: process.env.PLATFORM_BASE_URL || CoreConstants.DEFAULT_PLATFORM_URL,
+        httpClient: {
+            timeout: parseInt(process.env.HTTP_CLIENT_TIMEOUT || '5000', 10),
+            maxRetries: parseInt(process.env.HTTP_CLIENT_MAX_RETRIES || '2', 10),
+            retryDelayMs: parseInt(process.env.HTTP_CLIENT_RETRY_DELAY_MS || '200', 10),
+        },
+        sse: {
+            maxClientsPerRequest: parseInt(process.env.SSE_MAX_CLIENTS_PER_REQUEST || '10', 10),
+            clientTimeoutMs: parseInt(process.env.SSE_CLIENT_TIMEOUT_MS || '1800000', 10),
+            cleanupIntervalMs: parseInt(process.env.SSE_CLEANUP_INTERVAL_MS || '300000', 10),
+        },
+        services: {
+            pluginHost: process.env.PLUGIN_SERVICE_HOST || 'plugin',
+            pluginPort: parseInt(process.env.PLUGIN_SERVICE_PORT || '3000', 10),
+            pipelineHost: process.env.PIPELINE_SERVICE_HOST || 'pipeline',
+            pipelinePort: parseInt(process.env.PIPELINE_SERVICE_PORT || '3000', 10),
+            messageHost: process.env.MESSAGE_SERVICE_HOST || 'message',
+            messagePort: parseInt(process.env.MESSAGE_SERVICE_PORT || '3000', 10),
+            platformHost: process.env.PLATFORM_SERVICE_HOST || 'platform',
+            platformPort: parseInt(process.env.PLATFORM_SERVICE_PORT || '3000', 10),
+            complianceHost: process.env.COMPLIANCE_SERVICE_HOST || 'compliance',
+            compliancePort: parseInt(process.env.COMPLIANCE_SERVICE_PORT || '3000', 10),
+            billingHost: process.env.BILLING_SERVICE_HOST || 'billing',
+            billingPort: parseInt(process.env.BILLING_SERVICE_PORT || '3000', 10),
+            billingTimeout: parseInt(process.env.BILLING_SERVICE_TIMEOUT || '5000', 10),
+        },
+    };
+}
+/**
+ * Load authentication configuration from environment variables.
+ *
+ * Environment variables:
+ * - `JWT_SECRET` — **Required.** Secret key for signing JWTs
+ * - `REFRESH_TOKEN_SECRET` — **Required.** Secret key for signing refresh tokens
+ * - `JWT_EXPIRES_IN` — JWT lifetime in seconds (default: `7200` = 2 hours)
+ * - `JWT_ALGORITHM` — JWT signing algorithm (default: `'HS256'`)
+ * - `BCRYPT_SALT_ROUNDS` — bcrypt salt rounds for password hashing (default: `12`)
+ * - `REFRESH_TOKEN_EXPIRES_IN` — Refresh token lifetime in seconds (default: `2592000` = 30 days)
+ *
+ * @returns Authentication configuration with safe defaults (empty strings when env vars are unset).
+ * Call {@link validateAuthConfig} at server startup to enforce required secrets.
+ */
+export function loadAuthConfig() {
+    return {
+        jwt: {
+            secret: process.env.JWT_SECRET ?? '',
+            expiresIn: parseInt(process.env.JWT_EXPIRES_IN || '7200', 10),
+            algorithm: (process.env.JWT_ALGORITHM || 'HS256'),
+            saltRounds: parseInt(process.env.BCRYPT_SALT_ROUNDS || '12', 10),
+        },
+        refreshToken: {
+            secret: process.env.REFRESH_TOKEN_SECRET || '',
+            expiresIn: parseInt(process.env.REFRESH_TOKEN_EXPIRES_IN || '2592000', 10),
+        },
+    };
+}
+/**
+ * Load rate limiting configuration from environment variables.
+ *
+ * Environment variables:
+ * - `LIMITER_MAX` — Max requests per window (default: `100`)
+ * - `LIMITER_WINDOWMS` — Rate limit window in ms (default: `900000` = 15 minutes)
+ *
+ * @returns Rate limit configuration
+ */
+export function loadRateLimitConfig() {
+    return {
+        max: parseInt(process.env.LIMITER_MAX || '100', 10),
+        windowMs: parseInt(process.env.LIMITER_WINDOWMS || '900000', 10),
+        legacyHeaders: false,
+        standardHeaders: true,
+    };
+}
+/**
+ * Validate server configuration and log warnings for insecure settings.
+ *
+ * @param config - Server configuration to validate
+ */
+export function validateServerConfig(config) {
+    const warnings = [];
+    // Check CORS configuration
+    const origin = config.cors.origin;
+    const isWildcard = origin === '*' || (Array.isArray(origin) && origin.includes('*'));
+    if (isWildcard) {
+        warnings.push('CORS origin set to wildcard (*) - consider restricting to specific domains');
+    }
+    if (isWildcard && config.cors.credentials) {
+        // Browsers reject this combination, but it indicates a misconfiguration
+        throw new Error('SECURITY ERROR: CORS_ORIGIN=* with CORS_CREDENTIALS=true is an invalid and insecure configuration. ' +
+            'Set CORS_ORIGIN to specific domains or disable CORS_CREDENTIALS.');
+    }
+    // Check platform URL uses HTTPS
+    if (config.platformUrl.startsWith('http://') &&
+        !config.platformUrl.includes('localhost')) {
+        warnings.push('Platform URL uses HTTP instead of HTTPS - insecure for production');
+    }
+    // Display warnings
+    if (warnings.length > 0) {
+        log.warn('Server configuration warnings:');
+        warnings.forEach(warning => log.warn(`  - ${warning}`));
+    }
+}
+const INSECURE_PATTERNS = ['secret', 'password', 'changeme', 'default', '123456', 'admin'];
+function isInsecureSecret(secret) {
+    const lower = secret.toLowerCase();
+    return INSECURE_PATTERNS.some(s => lower === s || (lower.length < 64 && lower.includes(s)));
+}
+/**
+ * Validate authentication configuration (JWT secrets, algorithms, expiration).
+ * Call this at server startup, not during CDK synthesis.
+ *
+ * @param config - Auth configuration to validate
+ * @throws {Error} If secrets are insecure, too short (<32 chars), or use disallowed algorithms
+ */
+export function validateAuthConfig(config) {
+    const errors = [];
+    const warnings = [];
+    // Validate both secrets with the same checks
+    for (const [label, secret] of [['JWT', config.jwt.secret], ['Refresh token', config.refreshToken.secret]]) {
+        if (secret.length < 32) {
+            errors.push(`${label} secret should be at least 32 characters long`);
+        }
+        if (isInsecureSecret(secret)) {
+            errors.push(`${label} secret appears to be insecure or default value`);
+        }
+    }
+    // Check JWT expiration times
+    if (config.jwt.expiresIn > 86400) {
+        errors.push('JWT expiration must not exceed 24 hours (86400 seconds)');
+    }
+    else if (config.jwt.expiresIn > 7200) {
+        warnings.push('JWT expiration time is greater than 2 hours - shorter expiration recommended');
+    }
+    // Check algorithm
+    if (!CoreConstants.ALLOWED_JWT_ALGORITHMS.includes(config.jwt.algorithm)) {
+        errors.push(`JWT algorithm ${config.jwt.algorithm} is not in the allowed list`);
+    }
+    // Display warnings
+    if (warnings.length > 0) {
+        log.warn('Auth configuration warnings:');
+        warnings.forEach(warning => log.warn(`  - ${warning}`));
+    }
+    // Throw errors
+    if (errors.length > 0) {
+        throw new Error(`Auth configuration validation failed:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25maWcvc2VydmVyLWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUUxRCxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFHaEQsTUFBTSxHQUFHLEdBQUcsWUFBWSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0FBRTFDOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQjtJQUM5QixPQUFPO1FBQ0wsSUFBSSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxNQUFNLEVBQUUsRUFBRSxDQUFDO1FBQzlDLElBQUksRUFBRTtZQUNKLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixLQUFLLE9BQU87WUFDckQsTUFBTSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVztnQkFDN0IsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ3ZELENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsaUJBQWlCLElBQUksYUFBYSxDQUFDLG9CQUFvQixDQUFDO1NBQzFFO1FBQ0QsVUFBVSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFdBQVcsSUFBSSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQ3hELFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQixJQUFJLGFBQWEsQ0FBQyxvQkFBb0I7UUFFaEYsVUFBVSxFQUFFO1lBQ1YsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDaEUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDcEUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLDBCQUEwQixJQUFJLEtBQUssRUFBRSxFQUFFLENBQUM7U0FDNUU7UUFFRCxHQUFHLEVBQUU7WUFDSCxvQkFBb0IsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQywyQkFBMkIsSUFBSSxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ25GLGVBQWUsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxTQUFTLEVBQUUsRUFBRSxDQUFDO1lBQzdFLGlCQUFpQixFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLFFBQVEsRUFBRSxFQUFFLENBQUM7U0FDakY7UUFFRCxRQUFRLEVBQUU7WUFDUixVQUFVLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsSUFBSSxRQUFRO1lBQ3ZELFVBQVUsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsSUFBSSxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQ25FLFlBQVksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLHFCQUFxQixJQUFJLFVBQVU7WUFDN0QsWUFBWSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHFCQUFxQixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDdkUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksU0FBUztZQUMxRCxXQUFXLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUNyRSxZQUFZLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxVQUFVO1lBQzdELFlBQVksRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQ3ZFLGNBQWMsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLFlBQVk7WUFDbkUsY0FBYyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDM0UsV0FBVyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksU0FBUztZQUMxRCxXQUFXLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUNyRSxjQUFjLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsdUJBQXVCLElBQUksTUFBTSxFQUFFLEVBQUUsQ0FBQztTQUM1RTtLQUNGLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILE1BQU0sVUFBVSxjQUFjO0lBQzVCLE9BQU87UUFDTCxHQUFHLEVBQUU7WUFDSCxNQUFNLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLElBQUksRUFBRTtZQUNwQyxTQUFTLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDN0QsU0FBUyxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxhQUFhLElBQUksT0FBTyxDQUFjO1lBQzlELFVBQVUsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsSUFBSSxJQUFJLEVBQUUsRUFBRSxDQUFDO1NBQ2pFO1FBQ0QsWUFBWSxFQUFFO1lBQ1osTUFBTSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksRUFBRTtZQUM5QyxTQUFTLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLElBQUksU0FBUyxFQUFFLEVBQUUsQ0FBQztTQUMzRTtLQUNGLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLFVBQVUsbUJBQW1CO0lBQ2pDLE9BQU87UUFDTCxHQUFHLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVyxJQUFJLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDbkQsUUFBUSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixJQUFJLFFBQVEsRUFBRSxFQUFFLENBQUM7UUFDaEUsYUFBYSxFQUFFLEtBQUs7UUFDcEIsZUFBZSxFQUFFLElBQUk7S0FDdEIsQ0FBQztBQUNKLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLG9CQUFvQixDQUFDLE1BQW9CO0lBQ3ZELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUU5QiwyQkFBMkI7SUFDM0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7SUFDbEMsTUFBTSxVQUFVLEdBQUcsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLElBQUksVUFBVSxFQUFFLENBQUM7UUFDZixRQUFRLENBQUMsSUFBSSxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDOUYsQ0FBQztJQUNELElBQUksVUFBVSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDMUMsd0VBQXdFO1FBQ3hFLE1BQU0sSUFBSSxLQUFLLENBQ2IscUdBQXFHO1lBQ3JHLGtFQUFrRSxDQUNuRSxDQUFDO0lBQ0osQ0FBQztJQUVELGdDQUFnQztJQUNoQyxJQUFJLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUMxQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDNUMsUUFBUSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxtQkFBbUI7SUFDbkIsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLEdBQUcsQ0FBQyxJQUFJLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUMzQyxRQUFRLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0FBQ0gsQ0FBQztBQUVELE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBRTNGLFNBQVMsZ0JBQWdCLENBQUMsTUFBYztJQUN0QyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDbkMsT0FBTyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxFQUFFLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDOUYsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxNQUFrQjtJQUNuRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBRTlCLDZDQUE2QztJQUM3QyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQVUsRUFBRSxDQUFDO1FBQ25ILElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUN2QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSywrQ0FBK0MsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxJQUFJLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDN0IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssaURBQWlELENBQUMsQ0FBQztRQUN6RSxDQUFDO0lBQ0gsQ0FBQztJQUVELDZCQUE2QjtJQUM3QixJQUFJLE1BQU0sQ0FBQyxHQUFHLENBQUMsU0FBUyxHQUFHLEtBQUssRUFBRSxDQUFDO1FBQ2pDLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO1NBQU0sSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUN2QyxRQUFRLENBQUMsSUFBSSxDQUFDLDhFQUE4RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUVELGtCQUFrQjtJQUNsQixJQUFJLENBQUMsYUFBYSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxTQUFTLDZCQUE2QixDQUFDLENBQUM7SUFDbEYsQ0FBQztJQUVELG1CQUFtQjtJQUNuQixJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEIsR0FBRyxDQUFDLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ3pDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFRCxlQUFlO0lBQ2YsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQ2IsMENBQTBDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ25GLENBQUM7SUFDSixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBjcmVhdGVMb2dnZXIgfSBmcm9tICdAcGlwZWxpbmUtYnVpbGRlci9hcGktY29yZSc7XG5pbXBvcnQgdHlwZSB7IEFsZ29yaXRobSB9IGZyb20gJ2pzb253ZWJ0b2tlbic7XG5pbXBvcnQgeyBDb3JlQ29uc3RhbnRzIH0gZnJvbSAnLi9hcHAtY29uZmlnLmpzJztcbmltcG9ydCB0eXBlIHsgU2VydmVyQ29uZmlnLCBBdXRoQ29uZmlnLCBSYXRlTGltaXRDb25maWcgfSBmcm9tICcuL2NvbmZpZy10eXBlcy5qcyc7XG5cbmNvbnN0IGxvZyA9IGNyZWF0ZUxvZ2dlcignc2VydmVyLWNvbmZpZycpO1xuXG4vKipcbiAqIExvYWQgc2VydmVyIGNvbmZpZ3VyYXRpb24gZnJvbSBlbnZpcm9ubWVudCB2YXJpYWJsZXMuXG4gKlxuICogRW52aXJvbm1lbnQgdmFyaWFibGVzOlxuICogLSBgUE9SVGAg4oCUIEhUVFAgbGlzdGVuIHBvcnQgKGRlZmF1bHQ6IGAzMDAwYClcbiAqIC0gYENPUlNfT1JJR0lOYCDigJQgQ29tbWEtc2VwYXJhdGVkIGFsbG93ZWQgb3JpZ2lucyAoZGVmYXVsdDogYFBMQVRGT1JNX0JBU0VfVVJMYClcbiAqIC0gYENPUlNfQ1JFREVOVElBTFNgIOKAlCBBbGxvdyBjcmVkZW50aWFsczsgc2V0IHRvIGAnZmFsc2UnYCB0byBkaXNhYmxlIChkZWZhdWx0OiBgdHJ1ZWApXG4gKiAtIGBUUlVTVF9QUk9YWWAg4oCUIEV4cHJlc3MgdHJ1c3QgcHJveHkgaG9wcyAoZGVmYXVsdDogYDFgKVxuICogLSBgUExBVEZPUk1fQkFTRV9VUkxgIOKAlCBGcm9udGVuZCBVUkwgdXNlZCBhcyBDT1JTIGZhbGxiYWNrIChkZWZhdWx0OiBgJ2h0dHBzOi8vbG9jYWxob3N0Ojg0NDMnYClcbiAqXG4gKiBAcmV0dXJucyBTZXJ2ZXIgY29uZmlndXJhdGlvbiB3aXRoIHBvcnQsIENPUlMsIHRydXN0IHByb3h5LCBhbmQgcGxhdGZvcm0gVVJMXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkU2VydmVyQ29uZmlnKCk6IFNlcnZlckNvbmZpZyB7XG4gIHJldHVybiB7XG4gICAgcG9ydDogcGFyc2VJbnQocHJvY2Vzcy5lbnYuUE9SVCB8fCAnMzAwMCcsIDEwKSxcbiAgICBjb3JzOiB7XG4gICAgICBjcmVkZW50aWFsczogcHJvY2Vzcy5lbnYuQ09SU19DUkVERU5USUFMUyAhPT0gJ2ZhbHNlJyxcbiAgICAgIG9yaWdpbjogcHJvY2Vzcy5lbnYuQ09SU19PUklHSU5cbiAgICAgICAgPyBwcm9jZXNzLmVudi5DT1JTX09SSUdJTi5zcGxpdCgnLCcpLm1hcChvID0+IG8udHJpbSgpKVxuICAgICAgICA6IFtwcm9jZXNzLmVudi5QTEFURk9STV9CQVNFX1VSTCB8fCBDb3JlQ29uc3RhbnRzLkRFRkFVTFRfUExBVEZPUk1fVVJMXSxcbiAgICB9LFxuICAgIHRydXN0UHJveHk6IHBhcnNlSW50KHByb2Nlc3MuZW52LlRSVVNUX1BST1hZIHx8ICcxJywgMTApLFxuICAgIHBsYXRmb3JtVXJsOiBwcm9jZXNzLmVudi5QTEFURk9STV9CQVNFX1VSTCB8fCBDb3JlQ29uc3RhbnRzLkRFRkFVTFRfUExBVEZPUk1fVVJMLFxuXG4gICAgaHR0cENsaWVudDoge1xuICAgICAgdGltZW91dDogcGFyc2VJbnQocHJvY2Vzcy5lbnYuSFRUUF9DTElFTlRfVElNRU9VVCB8fCAnNTAwMCcsIDEwKSxcbiAgICAgIG1heFJldHJpZXM6IHBhcnNlSW50KHByb2Nlc3MuZW52LkhUVFBfQ0xJRU5UX01BWF9SRVRSSUVTIHx8ICcyJywgMTApLFxuICAgICAgcmV0cnlEZWxheU1zOiBwYXJzZUludChwcm9jZXNzLmVudi5IVFRQX0NMSUVOVF9SRVRSWV9ERUxBWV9NUyB8fCAnMjAwJywgMTApLFxuICAgIH0sXG5cbiAgICBzc2U6IHtcbiAgICAgIG1heENsaWVudHNQZXJSZXF1ZXN0OiBwYXJzZUludChwcm9jZXNzLmVudi5TU0VfTUFYX0NMSUVOVFNfUEVSX1JFUVVFU1QgfHwgJzEwJywgMTApLFxuICAgICAgY2xpZW50VGltZW91dE1zOiBwYXJzZUludChwcm9jZXNzLmVudi5TU0VfQ0xJRU5UX1RJTUVPVVRfTVMgfHwgJzE4MDAwMDAnLCAxMCksXG4gICAgICBjbGVhbnVwSW50ZXJ2YWxNczogcGFyc2VJbnQocHJvY2Vzcy5lbnYuU1NFX0NMRUFOVVBfSU5URVJWQUxfTVMgfHwgJzMwMDAwMCcsIDEwKSxcbiAgICB9LFxuXG4gICAgc2VydmljZXM6IHtcbiAgICAgIHBsdWdpbkhvc3Q6IHByb2Nlc3MuZW52LlBMVUdJTl9TRVJWSUNFX0hPU1QgfHwgJ3BsdWdpbicsXG4gICAgICBwbHVnaW5Qb3J0OiBwYXJzZUludChwcm9jZXNzLmVudi5QTFVHSU5fU0VSVklDRV9QT1JUIHx8ICczMDAwJywgMTApLFxuICAgICAgcGlwZWxpbmVIb3N0OiBwcm9jZXNzLmVudi5QSVBFTElORV9TRVJWSUNFX0hPU1QgfHwgJ3BpcGVsaW5lJyxcbiAgICAgIHBpcGVsaW5lUG9ydDogcGFyc2VJbnQocHJvY2Vzcy5lbnYuUElQRUxJTkVfU0VSVklDRV9QT1JUIHx8ICczMDAwJywgMTApLFxuICAgICAgbWVzc2FnZUhvc3Q6IHByb2Nlc3MuZW52Lk1FU1NBR0VfU0VSVklDRV9IT1NUIHx8ICdtZXNzYWdlJyxcbiAgICAgIG1lc3NhZ2VQb3J0OiBwYXJzZUludChwcm9jZXNzLmVudi5NRVNTQUdFX1NFUlZJQ0VfUE9SVCB8fCAnMzAwMCcsIDEwKSxcbiAgICAgIHBsYXRmb3JtSG9zdDogcHJvY2Vzcy5lbnYuUExBVEZPUk1fU0VSVklDRV9IT1NUIHx8ICdwbGF0Zm9ybScsXG4gICAgICBwbGF0Zm9ybVBvcnQ6IHBhcnNlSW50KHByb2Nlc3MuZW52LlBMQVRGT1JNX1NFUlZJQ0VfUE9SVCB8fCAnMzAwMCcsIDEwKSxcbiAgICAgIGNvbXBsaWFuY2VIb3N0OiBwcm9jZXNzLmVudi5DT01QTElBTkNFX1NFUlZJQ0VfSE9TVCB8fCAnY29tcGxpYW5jZScsXG4gICAgICBjb21wbGlhbmNlUG9ydDogcGFyc2VJbnQocHJvY2Vzcy5lbnYuQ09NUExJQU5DRV9TRVJWSUNFX1BPUlQgfHwgJzMwMDAnLCAxMCksXG4gICAgICBiaWxsaW5nSG9zdDogcHJvY2Vzcy5lbnYuQklMTElOR19TRVJWSUNFX0hPU1QgfHwgJ2JpbGxpbmcnLFxuICAgICAgYmlsbGluZ1BvcnQ6IHBhcnNlSW50KHByb2Nlc3MuZW52LkJJTExJTkdfU0VSVklDRV9QT1JUIHx8ICczMDAwJywgMTApLFxuICAgICAgYmlsbGluZ1RpbWVvdXQ6IHBhcnNlSW50KHByb2Nlc3MuZW52LkJJTExJTkdfU0VSVklDRV9USU1FT1VUIHx8ICc1MDAwJywgMTApLFxuICAgIH0sXG4gIH07XG59XG5cbi8qKlxuICogTG9hZCBhdXRoZW50aWNhdGlvbiBjb25maWd1cmF0aW9uIGZyb20gZW52aXJvbm1lbnQgdmFyaWFibGVzLlxuICpcbiAqIEVudmlyb25tZW50IHZhcmlhYmxlczpcbiAqIC0gYEpXVF9TRUNSRVRgIOKAlCAqKlJlcXVpcmVkLioqIFNlY3JldCBrZXkgZm9yIHNpZ25pbmcgSldUc1xuICogLSBgUkVGUkVTSF9UT0tFTl9TRUNSRVRgIOKAlCAqKlJlcXVpcmVkLioqIFNlY3JldCBrZXkgZm9yIHNpZ25pbmcgcmVmcmVzaCB0b2tlbnNcbiAqIC0gYEpXVF9FWFBJUkVTX0lOYCDigJQgSldUIGxpZmV0aW1lIGluIHNlY29uZHMgKGRlZmF1bHQ6IGA3MjAwYCA9IDIgaG91cnMpXG4gKiAtIGBKV1RfQUxHT1JJVEhNYCDigJQgSldUIHNpZ25pbmcgYWxnb3JpdGhtIChkZWZhdWx0OiBgJ0hTMjU2J2ApXG4gKiAtIGBCQ1JZUFRfU0FMVF9ST1VORFNgIOKAlCBiY3J5cHQgc2FsdCByb3VuZHMgZm9yIHBhc3N3b3JkIGhhc2hpbmcgKGRlZmF1bHQ6IGAxMmApXG4gKiAtIGBSRUZSRVNIX1RPS0VOX0VYUElSRVNfSU5gIOKAlCBSZWZyZXNoIHRva2VuIGxpZmV0aW1lIGluIHNlY29uZHMgKGRlZmF1bHQ6IGAyNTkyMDAwYCA9IDMwIGRheXMpXG4gKlxuICogQHJldHVybnMgQXV0aGVudGljYXRpb24gY29uZmlndXJhdGlvbiB3aXRoIHNhZmUgZGVmYXVsdHMgKGVtcHR5IHN0cmluZ3Mgd2hlbiBlbnYgdmFycyBhcmUgdW5zZXQpLlxuICogQ2FsbCB7QGxpbmsgdmFsaWRhdGVBdXRoQ29uZmlnfSBhdCBzZXJ2ZXIgc3RhcnR1cCB0byBlbmZvcmNlIHJlcXVpcmVkIHNlY3JldHMuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkQXV0aENvbmZpZygpOiBBdXRoQ29uZmlnIHtcbiAgcmV0dXJuIHtcbiAgICBqd3Q6IHtcbiAgICAgIHNlY3JldDogcHJvY2Vzcy5lbnYuSldUX1NFQ1JFVCA/PyAnJyxcbiAgICAgIGV4cGlyZXNJbjogcGFyc2VJbnQocHJvY2Vzcy5lbnYuSldUX0VYUElSRVNfSU4gfHwgJzcyMDAnLCAxMCksXG4gICAgICBhbGdvcml0aG06IChwcm9jZXNzLmVudi5KV1RfQUxHT1JJVEhNIHx8ICdIUzI1NicpIGFzIEFsZ29yaXRobSxcbiAgICAgIHNhbHRSb3VuZHM6IHBhcnNlSW50KHByb2Nlc3MuZW52LkJDUllQVF9TQUxUX1JPVU5EUyB8fCAnMTInLCAxMCksXG4gICAgfSxcbiAgICByZWZyZXNoVG9rZW46IHtcbiAgICAgIHNlY3JldDogcHJvY2Vzcy5lbnYuUkVGUkVTSF9UT0tFTl9TRUNSRVQgfHwgJycsXG4gICAgICBleHBpcmVzSW46IHBhcnNlSW50KHByb2Nlc3MuZW52LlJFRlJFU0hfVE9LRU5fRVhQSVJFU19JTiB8fCAnMjU5MjAwMCcsIDEwKSxcbiAgICB9LFxuICB9O1xufVxuXG4vKipcbiAqIExvYWQgcmF0ZSBsaW1pdGluZyBjb25maWd1cmF0aW9uIGZyb20gZW52aXJvbm1lbnQgdmFyaWFibGVzLlxuICpcbiAqIEVudmlyb25tZW50IHZhcmlhYmxlczpcbiAqIC0gYExJTUlURVJfTUFYYCDigJQgTWF4IHJlcXVlc3RzIHBlciB3aW5kb3cgKGRlZmF1bHQ6IGAxMDBgKVxuICogLSBgTElNSVRFUl9XSU5ET1dNU2Ag4oCUIFJhdGUgbGltaXQgd2luZG93IGluIG1zIChkZWZhdWx0OiBgOTAwMDAwYCA9IDE1IG1pbnV0ZXMpXG4gKlxuICogQHJldHVybnMgUmF0ZSBsaW1pdCBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkUmF0ZUxpbWl0Q29uZmlnKCk6IFJhdGVMaW1pdENvbmZpZyB7XG4gIHJldHVybiB7XG4gICAgbWF4OiBwYXJzZUludChwcm9jZXNzLmVudi5MSU1JVEVSX01BWCB8fCAnMTAwJywgMTApLFxuICAgIHdpbmRvd01zOiBwYXJzZUludChwcm9jZXNzLmVudi5MSU1JVEVSX1dJTkRPV01TIHx8ICc5MDAwMDAnLCAxMCksXG4gICAgbGVnYWN5SGVhZGVyczogZmFsc2UsXG4gICAgc3RhbmRhcmRIZWFkZXJzOiB0cnVlLFxuICB9O1xufVxuXG4vKipcbiAqIFZhbGlkYXRlIHNlcnZlciBjb25maWd1cmF0aW9uIGFuZCBsb2cgd2FybmluZ3MgZm9yIGluc2VjdXJlIHNldHRpbmdzLlxuICpcbiAqIEBwYXJhbSBjb25maWcgLSBTZXJ2ZXIgY29uZmlndXJhdGlvbiB0byB2YWxpZGF0ZVxuICovXG5leHBvcnQgZnVuY3Rpb24gdmFsaWRhdGVTZXJ2ZXJDb25maWcoY29uZmlnOiBTZXJ2ZXJDb25maWcpOiB2b2lkIHtcbiAgY29uc3Qgd2FybmluZ3M6IHN0cmluZ1tdID0gW107XG5cbiAgLy8gQ2hlY2sgQ09SUyBjb25maWd1cmF0aW9uXG4gIGNvbnN0IG9yaWdpbiA9IGNvbmZpZy5jb3JzLm9yaWdpbjtcbiAgY29uc3QgaXNXaWxkY2FyZCA9IG9yaWdpbiA9PT0gJyonIHx8IChBcnJheS5pc0FycmF5KG9yaWdpbikgJiYgb3JpZ2luLmluY2x1ZGVzKCcqJykpO1xuICBpZiAoaXNXaWxkY2FyZCkge1xuICAgIHdhcm5pbmdzLnB1c2goJ0NPUlMgb3JpZ2luIHNldCB0byB3aWxkY2FyZCAoKikgLSBjb25zaWRlciByZXN0cmljdGluZyB0byBzcGVjaWZpYyBkb21haW5zJyk7XG4gIH1cbiAgaWYgKGlzV2lsZGNhcmQgJiYgY29uZmlnLmNvcnMuY3JlZGVudGlhbHMpIHtcbiAgICAvLyBCcm93c2VycyByZWplY3QgdGhpcyBjb21iaW5hdGlvbiwgYnV0IGl0IGluZGljYXRlcyBhIG1pc2NvbmZpZ3VyYXRpb25cbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAnU0VDVVJJVFkgRVJST1I6IENPUlNfT1JJR0lOPSogd2l0aCBDT1JTX0NSRURFTlRJQUxTPXRydWUgaXMgYW4gaW52YWxpZCBhbmQgaW5zZWN1cmUgY29uZmlndXJhdGlvbi4gJyArXG4gICAgICAnU2V0IENPUlNfT1JJR0lOIHRvIHNwZWNpZmljIGRvbWFpbnMgb3IgZGlzYWJsZSBDT1JTX0NSRURFTlRJQUxTLicsXG4gICAgKTtcbiAgfVxuXG4gIC8vIENoZWNrIHBsYXRmb3JtIFVSTCB1c2VzIEhUVFBTXG4gIGlmIChjb25maWcucGxhdGZvcm1Vcmwuc3RhcnRzV2l0aCgnaHR0cDovLycpICYmXG4gICAgIWNvbmZpZy5wbGF0Zm9ybVVybC5pbmNsdWRlcygnbG9jYWxob3N0JykpIHtcbiAgICB3YXJuaW5ncy5wdXNoKCdQbGF0Zm9ybSBVUkwgdXNlcyBIVFRQIGluc3RlYWQgb2YgSFRUUFMgLSBpbnNlY3VyZSBmb3IgcHJvZHVjdGlvbicpO1xuICB9XG5cbiAgLy8gRGlzcGxheSB3YXJuaW5nc1xuICBpZiAod2FybmluZ3MubGVuZ3RoID4gMCkge1xuICAgIGxvZy53YXJuKCdTZXJ2ZXIgY29uZmlndXJhdGlvbiB3YXJuaW5nczonKTtcbiAgICB3YXJuaW5ncy5mb3JFYWNoKHdhcm5pbmcgPT4gbG9nLndhcm4oYCAgLSAke3dhcm5pbmd9YCkpO1xuICB9XG59XG5cbmNvbnN0IElOU0VDVVJFX1BBVFRFUk5TID0gWydzZWNyZXQnLCAncGFzc3dvcmQnLCAnY2hhbmdlbWUnLCAnZGVmYXVsdCcsICcxMjM0NTYnLCAnYWRtaW4nXTtcblxuZnVuY3Rpb24gaXNJbnNlY3VyZVNlY3JldChzZWNyZXQ6IHN0cmluZyk6IGJvb2xlYW4ge1xuICBjb25zdCBsb3dlciA9IHNlY3JldC50b0xvd2VyQ2FzZSgpO1xuICByZXR1cm4gSU5TRUNVUkVfUEFUVEVSTlMuc29tZShzID0+IGxvd2VyID09PSBzIHx8IChsb3dlci5sZW5ndGggPCA2NCAmJiBsb3dlci5pbmNsdWRlcyhzKSkpO1xufVxuXG4vKipcbiAqIFZhbGlkYXRlIGF1dGhlbnRpY2F0aW9uIGNvbmZpZ3VyYXRpb24gKEpXVCBzZWNyZXRzLCBhbGdvcml0aG1zLCBleHBpcmF0aW9uKS5cbiAqIENhbGwgdGhpcyBhdCBzZXJ2ZXIgc3RhcnR1cCwgbm90IGR1cmluZyBDREsgc3ludGhlc2lzLlxuICpcbiAqIEBwYXJhbSBjb25maWcgLSBBdXRoIGNvbmZpZ3VyYXRpb24gdG8gdmFsaWRhdGVcbiAqIEB0aHJvd3Mge0Vycm9yfSBJZiBzZWNyZXRzIGFyZSBpbnNlY3VyZSwgdG9vIHNob3J0ICg8MzIgY2hhcnMpLCBvciB1c2UgZGlzYWxsb3dlZCBhbGdvcml0aG1zXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiB2YWxpZGF0ZUF1dGhDb25maWcoY29uZmlnOiBBdXRoQ29uZmlnKTogdm9pZCB7XG4gIGNvbnN0IGVycm9yczogc3RyaW5nW10gPSBbXTtcbiAgY29uc3Qgd2FybmluZ3M6IHN0cmluZ1tdID0gW107XG5cbiAgLy8gVmFsaWRhdGUgYm90aCBzZWNyZXRzIHdpdGggdGhlIHNhbWUgY2hlY2tzXG4gIGZvciAoY29uc3QgW2xhYmVsLCBzZWNyZXRdIG9mIFtbJ0pXVCcsIGNvbmZpZy5qd3Quc2VjcmV0XSwgWydSZWZyZXNoIHRva2VuJywgY29uZmlnLnJlZnJlc2hUb2tlbi5zZWNyZXRdXSBhcyBjb25zdCkge1xuICAgIGlmIChzZWNyZXQubGVuZ3RoIDwgMzIpIHtcbiAgICAgIGVycm9ycy5wdXNoKGAke2xhYmVsfSBzZWNyZXQgc2hvdWxkIGJlIGF0IGxlYXN0IDMyIGNoYXJhY3RlcnMgbG9uZ2ApO1xuICAgIH1cbiAgICBpZiAoaXNJbnNlY3VyZVNlY3JldChzZWNyZXQpKSB7XG4gICAgICBlcnJvcnMucHVzaChgJHtsYWJlbH0gc2VjcmV0IGFwcGVhcnMgdG8gYmUgaW5zZWN1cmUgb3IgZGVmYXVsdCB2YWx1ZWApO1xuICAgIH1cbiAgfVxuXG4gIC8vIENoZWNrIEpXVCBleHBpcmF0aW9uIHRpbWVzXG4gIGlmIChjb25maWcuand0LmV4cGlyZXNJbiA+IDg2NDAwKSB7XG4gICAgZXJyb3JzLnB1c2goJ0pXVCBleHBpcmF0aW9uIG11c3Qgbm90IGV4Y2VlZCAyNCBob3VycyAoODY0MDAgc2Vjb25kcyknKTtcbiAgfSBlbHNlIGlmIChjb25maWcuand0LmV4cGlyZXNJbiA+IDcyMDApIHtcbiAgICB3YXJuaW5ncy5wdXNoKCdKV1QgZXhwaXJhdGlvbiB0aW1lIGlzIGdyZWF0ZXIgdGhhbiAyIGhvdXJzIC0gc2hvcnRlciBleHBpcmF0aW9uIHJlY29tbWVuZGVkJyk7XG4gIH1cblxuICAvLyBDaGVjayBhbGdvcml0aG1cbiAgaWYgKCFDb3JlQ29uc3RhbnRzLkFMTE9XRURfSldUX0FMR09SSVRITVMuaW5jbHVkZXMoY29uZmlnLmp3dC5hbGdvcml0aG0pKSB7XG4gICAgZXJyb3JzLnB1c2goYEpXVCBhbGdvcml0aG0gJHtjb25maWcuand0LmFsZ29yaXRobX0gaXMgbm90IGluIHRoZSBhbGxvd2VkIGxpc3RgKTtcbiAgfVxuXG4gIC8vIERpc3BsYXkgd2FybmluZ3NcbiAgaWYgKHdhcm5pbmdzLmxlbmd0aCA+IDApIHtcbiAgICBsb2cud2FybignQXV0aCBjb25maWd1cmF0aW9uIHdhcm5pbmdzOicpO1xuICAgIHdhcm5pbmdzLmZvckVhY2god2FybmluZyA9PiBsb2cud2FybihgICAtICR7d2FybmluZ31gKSk7XG4gIH1cblxuICAvLyBUaHJvdyBlcnJvcnNcbiAgaWYgKGVycm9ycy5sZW5ndGggPiAwKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYEF1dGggY29uZmlndXJhdGlvbiB2YWxpZGF0aW9uIGZhaWxlZDpcXG4ke2Vycm9ycy5tYXAoZSA9PiBgICAtICR7ZX1gKS5qb2luKCdcXG4nKX1gLFxuICAgICk7XG4gIH1cbn1cbiJdfQ==

package/lib/config/service-client.d.ts

@@ -0,0 +1,13 @@
+import { InternalHttpClient } from '@pipeline-builder/api-core';
+/** Sibling services reachable over the internal network, keyed by the typed
+ *  `server.services.<name>Host`/`<name>Port` config entries. */
+export type InternalService = 'plugin' | 'pipeline' | 'message' | 'platform' | 'compliance' | 'billing';
+/**
+ * Construct an `InternalHttpClient` for a sibling service from the typed
+ * `server.services` config — replacing the per-client boilerplate of reading
+ * `Config.getAny('server')` with a loose cast and hand-building the host/port.
+ *
+ * @example
+ *   export const messageClient = createServiceClient('message');
+ */
+export declare function createServiceClient(service: InternalService): InternalHttpClient;

package/lib/config/service-client.js

@@ -0,0 +1,20 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { InternalHttpClient } from '@pipeline-builder/api-core';
+import { Config } from './app-config.js';
+/**
+ * Construct an `InternalHttpClient` for a sibling service from the typed
+ * `server.services` config — replacing the per-client boilerplate of reading
+ * `Config.getAny('server')` with a loose cast and hand-building the host/port.
+ *
+ * @example
+ *   export const messageClient = createServiceClient('message');
+ */
+export function createServiceClient(service) {
+    const { services } = Config.get('server');
+    return new InternalHttpClient({
+        host: services[`${service}Host`],
+        port: services[`${service}Port`],
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uZmlnL3NlcnZpY2UtY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFDaEUsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBTXpDOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLFVBQVUsbUJBQW1CLENBQUMsT0FBd0I7SUFDMUQsTUFBTSxFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUMsT0FBTyxJQUFJLGtCQUFrQixDQUFDO1FBQzVCLElBQUksRUFBRSxRQUFRLENBQUMsR0FBRyxPQUFPLE1BQU0sQ0FBQztRQUNoQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEdBQUcsT0FBTyxNQUFNLENBQUM7S0FDakMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgeyBJbnRlcm5hbEh0dHBDbGllbnQgfSBmcm9tICdAcGlwZWxpbmUtYnVpbGRlci9hcGktY29yZSc7XG5pbXBvcnQgeyBDb25maWcgfSBmcm9tICcuL2FwcC1jb25maWcuanMnO1xuXG4vKiogU2libGluZyBzZXJ2aWNlcyByZWFjaGFibGUgb3ZlciB0aGUgaW50ZXJuYWwgbmV0d29yaywga2V5ZWQgYnkgdGhlIHR5cGVkXG4gKiAgYHNlcnZlci5zZXJ2aWNlcy48bmFtZT5Ib3N0YC9gPG5hbWU+UG9ydGAgY29uZmlnIGVudHJpZXMuICovXG5leHBvcnQgdHlwZSBJbnRlcm5hbFNlcnZpY2UgPSAncGx1Z2luJyB8ICdwaXBlbGluZScgfCAnbWVzc2FnZScgfCAncGxhdGZvcm0nIHwgJ2NvbXBsaWFuY2UnIHwgJ2JpbGxpbmcnO1xuXG4vKipcbiAqIENvbnN0cnVjdCBhbiBgSW50ZXJuYWxIdHRwQ2xpZW50YCBmb3IgYSBzaWJsaW5nIHNlcnZpY2UgZnJvbSB0aGUgdHlwZWRcbiAqIGBzZXJ2ZXIuc2VydmljZXNgIGNvbmZpZyDigJQgcmVwbGFjaW5nIHRoZSBwZXItY2xpZW50IGJvaWxlcnBsYXRlIG9mIHJlYWRpbmdcbiAqIGBDb25maWcuZ2V0QW55KCdzZXJ2ZXInKWAgd2l0aCBhIGxvb3NlIGNhc3QgYW5kIGhhbmQtYnVpbGRpbmcgdGhlIGhvc3QvcG9ydC5cbiAqXG4gKiBAZXhhbXBsZVxuICogICBleHBvcnQgY29uc3QgbWVzc2FnZUNsaWVudCA9IGNyZWF0ZVNlcnZpY2VDbGllbnQoJ21lc3NhZ2UnKTtcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNyZWF0ZVNlcnZpY2VDbGllbnQoc2VydmljZTogSW50ZXJuYWxTZXJ2aWNlKTogSW50ZXJuYWxIdHRwQ2xpZW50IHtcbiAgY29uc3QgeyBzZXJ2aWNlcyB9ID0gQ29uZmlnLmdldCgnc2VydmVyJyk7XG4gIHJldHVybiBuZXcgSW50ZXJuYWxIdHRwQ2xpZW50KHtcbiAgICBob3N0OiBzZXJ2aWNlc1tgJHtzZXJ2aWNlfUhvc3RgXSxcbiAgICBwb3J0OiBzZXJ2aWNlc1tgJHtzZXJ2aWNlfVBvcnRgXSxcbiAgfSk7XG59XG4iXX0=

package/lib/core/artifact-manager.d.ts

@@ -0,0 +1,62 @@
+import { CodeBuildStep, FileSet, ShellStep } from 'aws-cdk-lib/pipelines';
+export interface ArtifactKey {
+    readonly stageName: string;
+    readonly stageAlias: string;
+    readonly pluginName: string;
+    readonly pluginAlias: string;
+    readonly outputDirectory: string;
+}
+/**
+ * Manages build step artifacts with hierarchical key-based lookup.
+ * Keys follow the pattern: stageName:stageAlias:pluginName:pluginAlias:outputDirectory
+ *
+ * @example
+ * ```typescript
+ * // Synth step: "no-stage:no-stage-alias:cdk-synth:cdk-synth-alias:cdk.out"
+ * // Build step: "build:build-alias:nodejs-build:nodejs-build-alias:dist"
+ * ```
+ */
+export declare class ArtifactManager {
+    private readonly artifacts;
+    /**
+     * Generate a key string from artifact parameters
+     */
+    private generateKey;
+    /**
+     * Register a build step artifact
+     * @param key - The hierarchical key identifying this artifact (includes output directory)
+     * @param step - The CodeBuildStep or ShellStep to store
+     */
+    add(key: ArtifactKey, step: CodeBuildStep | ShellStep): void;
+    /**
+     * Get a build step by its artifact key
+     * @param key - The hierarchical key identifying the artifact
+     * @returns The stored step, or undefined if not found
+     */
+    get(key: ArtifactKey): CodeBuildStep | ShellStep | undefined;
+    /**
+     * Get the primary output FileSet from a registered step.
+     * @param key - The artifact key identifying the step
+     * @returns The primary output FileSet
+     * @throws Error if the step is not found or has no primary output
+     */
+    getOutput(key: ArtifactKey): FileSet;
+    /**
+     * Register an additional output directory on a stored step and return its FileSet.
+     * Calls CDK's addOutputDirectory() to create a named output beyond the primary.
+     * @param key - The artifact key identifying the step
+     * @param directory - The additional output directory path to register
+     * @returns The FileSet for the additional output directory
+     * @throws Error if the step is not found
+     */
+    addOutput(key: ArtifactKey, directory: string): FileSet;
+    /**
+     * Get a step by key or throw with a helpful error listing available artifacts.
+     */
+    private require;
+    /**
+     * List all artifact keys
+     * @returns Array of all stored artifact key strings
+     */
+    list(): string[];
+}