@pipeline-builder/pipeline-core 0.0.1

package/lib/core/metadata-helpers.js

@@ -0,0 +1,55 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Metadata and string helpers that are FREE of `aws-cdk-lib`.
+ *
+ * Split out of `pipeline-helpers.ts` (which builds CodeBuild steps and therefore
+ * pulls in the CDK) so the main `@pipeline-builder/pipeline-core` entry point can
+ * export them without putting `aws-cdk-lib` on every consumer's import graph.
+ * Anything here that needs a CDK type belongs in `pipeline-helpers.ts` instead.
+ */
+import { CDK_METADATA_PREFIX } from './pipeline-types.js';
+/**
+ * Merge multiple metadata objects into one. Later sources override earlier ones.
+ */
+export function merge(...sources) {
+    return Object.assign({}, ...sources);
+}
+/**
+ * Extract non-namespaced metadata keys as environment variable strings.
+ * Keys starting with 'aws:cdk:' are reserved for CDK construct props
+ * (processed by metadata extraction functions) and are excluded here.
+ *
+ * All values are converted to strings for CodeBuild compatibility.
+ */
+export function extractMetadataEnv(metadata) {
+    const env = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        if (!key.startsWith(CDK_METADATA_PREFIX)) {
+            env[key] = String(value);
+        }
+    }
+    return env;
+}
+/** Plugin categories whose failure must NEVER be masked. A scan/security step that
+ *  exits non-zero has to fail the pipeline (repo rule: a failed scan is red, never a
+ *  false-green `|| true`), so such a plugin's failureBehavior is forced to 'fail'
+ *  regardless of what the plugin or step authored. */
+const FAIL_FAST_CATEGORIES = /scan|security|sast|dast|vuln|secret/i;
+/** Resolve the effective failureBehavior: a scan/security-category plugin is pinned
+ *  to 'fail'; otherwise the authored value (default 'fail'). */
+export function resolveFailureBehavior(category, authored) {
+    if (category && FAIL_FAST_CATEGORIES.test(category))
+        return 'fail';
+    return authored ?? 'fail';
+}
+/**
+ * Replaces all characters that are not letters or numbers with the specified value
+ * @param input - The string to process
+ * @param replaceValue - The character(s) to replace non-alphanumeric characters with (default: '_')
+ * @returns The string with non-alphanumeric characters replaced
+ */
+export function replaceNonAlphanumeric(input, replaceValue = '_') {
+    return input.replace(/[^a-zA-Z0-9]/g, replaceValue);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWV0YWRhdGEtaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb3JlL21ldGFkYXRhLWhlbHBlcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7OztHQU9HO0FBRUgsT0FBTyxFQUFFLG1CQUFtQixFQUFxQixNQUFNLHFCQUFxQixDQUFDO0FBRTdFOztHQUVHO0FBQ0gsTUFBTSxVQUFVLEtBQUssQ0FBQyxHQUFHLE9BQXFDO0lBQzVELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQWlCLENBQUM7QUFDdkQsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSxrQkFBa0IsQ0FBQyxRQUFzQjtJQUN2RCxNQUFNLEdBQUcsR0FBMkIsRUFBRSxDQUFDO0lBQ3ZDLEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDcEQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1lBQ3pDLEdBQUcsQ0FBQyxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRDs7O3NEQUdzRDtBQUN0RCxNQUFNLG9CQUFvQixHQUFHLHNDQUFzQyxDQUFDO0FBRXBFO2dFQUNnRTtBQUNoRSxNQUFNLFVBQVUsc0JBQXNCLENBQUMsUUFBaUIsRUFBRSxRQUFxQztJQUM3RixJQUFJLFFBQVEsSUFBSSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDbkUsT0FBTyxRQUFRLElBQUksTUFBTSxDQUFDO0FBQzVCLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FBQyxLQUFhLEVBQUUsWUFBWSxHQUFXLEdBQUc7SUFDOUUsT0FBTyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQWUsRUFBRSxZQUFZLENBQUMsQ0FBQztBQUN0RCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogTWV0YWRhdGEgYW5kIHN0cmluZyBoZWxwZXJzIHRoYXQgYXJlIEZSRUUgb2YgYGF3cy1jZGstbGliYC5cbiAqXG4gKiBTcGxpdCBvdXQgb2YgYHBpcGVsaW5lLWhlbHBlcnMudHNgICh3aGljaCBidWlsZHMgQ29kZUJ1aWxkIHN0ZXBzIGFuZCB0aGVyZWZvcmVcbiAqIHB1bGxzIGluIHRoZSBDREspIHNvIHRoZSBtYWluIGBAcGlwZWxpbmUtYnVpbGRlci9waXBlbGluZS1jb3JlYCBlbnRyeSBwb2ludCBjYW5cbiAqIGV4cG9ydCB0aGVtIHdpdGhvdXQgcHV0dGluZyBgYXdzLWNkay1saWJgIG9uIGV2ZXJ5IGNvbnN1bWVyJ3MgaW1wb3J0IGdyYXBoLlxuICogQW55dGhpbmcgaGVyZSB0aGF0IG5lZWRzIGEgQ0RLIHR5cGUgYmVsb25ncyBpbiBgcGlwZWxpbmUtaGVscGVycy50c2AgaW5zdGVhZC5cbiAqL1xuXG5pbXBvcnQgeyBDREtfTUVUQURBVEFfUFJFRklYLCB0eXBlIE1ldGFEYXRhVHlwZSB9IGZyb20gJy4vcGlwZWxpbmUtdHlwZXMuanMnO1xuXG4vKipcbiAqIE1lcmdlIG11bHRpcGxlIG1ldGFkYXRhIG9iamVjdHMgaW50byBvbmUuIExhdGVyIHNvdXJjZXMgb3ZlcnJpZGUgZWFybGllciBvbmVzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gbWVyZ2UoLi4uc291cmNlczogQXJyYXk8UGFydGlhbDxNZXRhRGF0YVR5cGU+Pik6IE1ldGFEYXRhVHlwZSB7XG4gIHJldHVybiBPYmplY3QuYXNzaWduKHt9LCAuLi5zb3VyY2VzKSBhcyBNZXRhRGF0YVR5cGU7XG59XG5cbi8qKlxuICogRXh0cmFjdCBub24tbmFtZXNwYWNlZCBtZXRhZGF0YSBrZXlzIGFzIGVudmlyb25tZW50IHZhcmlhYmxlIHN0cmluZ3MuXG4gKiBLZXlzIHN0YXJ0aW5nIHdpdGggJ2F3czpjZGs6JyBhcmUgcmVzZXJ2ZWQgZm9yIENESyBjb25zdHJ1Y3QgcHJvcHNcbiAqIChwcm9jZXNzZWQgYnkgbWV0YWRhdGEgZXh0cmFjdGlvbiBmdW5jdGlvbnMpIGFuZCBhcmUgZXhjbHVkZWQgaGVyZS5cbiAqXG4gKiBBbGwgdmFsdWVzIGFyZSBjb252ZXJ0ZWQgdG8gc3RyaW5ncyBmb3IgQ29kZUJ1aWxkIGNvbXBhdGliaWxpdHkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHRyYWN0TWV0YWRhdGFFbnYobWV0YWRhdGE6IE1ldGFEYXRhVHlwZSk6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4ge1xuICBjb25zdCBlbnY6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7fTtcbiAgZm9yIChjb25zdCBba2V5LCB2YWx1ZV0gb2YgT2JqZWN0LmVudHJpZXMobWV0YWRhdGEpKSB7XG4gICAgaWYgKCFrZXkuc3RhcnRzV2l0aChDREtfTUVUQURBVEFfUFJFRklYKSkge1xuICAgICAgZW52W2tleV0gPSBTdHJpbmcodmFsdWUpO1xuICAgIH1cbiAgfVxuICByZXR1cm4gZW52O1xufVxuXG4vKiogUGx1Z2luIGNhdGVnb3JpZXMgd2hvc2UgZmFpbHVyZSBtdXN0IE5FVkVSIGJlIG1hc2tlZC4gQSBzY2FuL3NlY3VyaXR5IHN0ZXAgdGhhdFxuICogIGV4aXRzIG5vbi16ZXJvIGhhcyB0byBmYWlsIHRoZSBwaXBlbGluZSAocmVwbyBydWxlOiBhIGZhaWxlZCBzY2FuIGlzIHJlZCwgbmV2ZXIgYVxuICogIGZhbHNlLWdyZWVuIGB8fCB0cnVlYCksIHNvIHN1Y2ggYSBwbHVnaW4ncyBmYWlsdXJlQmVoYXZpb3IgaXMgZm9yY2VkIHRvICdmYWlsJ1xuICogIHJlZ2FyZGxlc3Mgb2Ygd2hhdCB0aGUgcGx1Z2luIG9yIHN0ZXAgYXV0aG9yZWQuICovXG5jb25zdCBGQUlMX0ZBU1RfQ0FURUdPUklFUyA9IC9zY2FufHNlY3VyaXR5fHNhc3R8ZGFzdHx2dWxufHNlY3JldC9pO1xuXG4vKiogUmVzb2x2ZSB0aGUgZWZmZWN0aXZlIGZhaWx1cmVCZWhhdmlvcjogYSBzY2FuL3NlY3VyaXR5LWNhdGVnb3J5IHBsdWdpbiBpcyBwaW5uZWRcbiAqICB0byAnZmFpbCc7IG90aGVyd2lzZSB0aGUgYXV0aG9yZWQgdmFsdWUgKGRlZmF1bHQgJ2ZhaWwnKS4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlRmFpbHVyZUJlaGF2aW9yKGNhdGVnb3J5Pzogc3RyaW5nLCBhdXRob3JlZD86ICdmYWlsJyB8ICd3YXJuJyB8ICdpZ25vcmUnKTogJ2ZhaWwnIHwgJ3dhcm4nIHwgJ2lnbm9yZScge1xuICBpZiAoY2F0ZWdvcnkgJiYgRkFJTF9GQVNUX0NBVEVHT1JJRVMudGVzdChjYXRlZ29yeSkpIHJldHVybiAnZmFpbCc7XG4gIHJldHVybiBhdXRob3JlZCA/PyAnZmFpbCc7XG59XG5cbi8qKlxuICogUmVwbGFjZXMgYWxsIGNoYXJhY3RlcnMgdGhhdCBhcmUgbm90IGxldHRlcnMgb3IgbnVtYmVycyB3aXRoIHRoZSBzcGVjaWZpZWQgdmFsdWVcbiAqIEBwYXJhbSBpbnB1dCAtIFRoZSBzdHJpbmcgdG8gcHJvY2Vzc1xuICogQHBhcmFtIHJlcGxhY2VWYWx1ZSAtIFRoZSBjaGFyYWN0ZXIocykgdG8gcmVwbGFjZSBub24tYWxwaGFudW1lcmljIGNoYXJhY3RlcnMgd2l0aCAoZGVmYXVsdDogJ18nKVxuICogQHJldHVybnMgVGhlIHN0cmluZyB3aXRoIG5vbi1hbHBoYW51bWVyaWMgY2hhcmFjdGVycyByZXBsYWNlZFxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVwbGFjZU5vbkFscGhhbnVtZXJpYyhpbnB1dDogc3RyaW5nLCByZXBsYWNlVmFsdWU6IHN0cmluZyA9ICdfJyk6IHN0cmluZyB7XG4gIHJldHVybiBpbnB1dC5yZXBsYWNlKC9bXmEtekEtWjAtOV0vZywgcmVwbGFjZVZhbHVlKTtcbn1cbiJdfQ==

package/lib/core/network-types.d.ts

@@ -0,0 +1,200 @@
+import type { SecretValue } from 'aws-cdk-lib';
+import type { MetaDataType } from './pipeline-types.js';
+import type { SecurityGroupConfig } from './security-group-types.js';
+/**
+ * Network configuration using explicit subnet IDs
+ *
+ * Use when you know the exact subnet IDs where CodeBuild should run.
+ * Subnets are selected directly by ID; VPC is looked up from the provided vpcId.
+ *
+ * @example
+ * ```typescript
+ * const network: SubnetIdsNetwork = {
+ *   type: 'subnetIds',
+ *   options: {
+ *     vpcId: 'vpc-0a1b2c3d4e5f6a7b8',
+ *     subnetIds: ['subnet-0a1b2c3d', 'subnet-4e5f6a7b'],
+ *     securityGroupIds: ['sg-12345678']
+ *   }
+ * };
+ * ```
+ */
+export interface SubnetIdsNetwork {
+    readonly type: 'subnetIds';
+    readonly options: SubnetIdsNetworkOptions;
+}
+/**
+ * Network configuration using VPC lookup by ID
+ *
+ * Looks up an existing VPC by its ID and resolves subnets via subnetSelection filters.
+ *
+ * @example
+ * ```typescript
+ * const network: VpcIdNetwork = {
+ *   type: 'vpcId',
+ *   options: {
+ *     vpcId: 'vpc-0a1b2c3d4e5f6a7b8',
+ *     subnetType: 'PRIVATE_WITH_EGRESS',
+ *     securityGroupIds: ['sg-12345678']
+ *   }
+ * };
+ * ```
+ */
+export interface VpcIdNetwork {
+    readonly type: 'vpcId';
+    readonly options: VpcIdNetworkOptions;
+}
+/**
+ * Network configuration using VPC lookup by tags
+ *
+ * Looks up an existing VPC by tag filters and resolves subnets via subnetSelection filters.
+ *
+ * @example
+ * ```typescript
+ * const network: VpcLookupNetwork = {
+ *   type: 'vpcLookup',
+ *   options: {
+ *     tags: { 'aws:cloudformation:stack-name': 'NetworkStack' },
+ *     subnetType: 'PRIVATE_WITH_EGRESS',
+ *     availabilityZones: ['us-east-1a', 'us-east-1b']
+ *   }
+ * };
+ * ```
+ */
+export interface VpcLookupNetwork {
+    readonly type: 'vpcLookup';
+    readonly options: VpcLookupNetworkOptions;
+}
+/**
+ * Common subnet selection filters shared by VPC-based network options
+ */
+interface SubnetSelectionOptions {
+    /**
+     * Subnet type filter for subnet selection
+     * Maps to CDK SubnetType values
+     * @default 'PRIVATE_WITH_EGRESS'
+     */
+    readonly subnetType?: SubnetTypeName;
+    /**
+     * Filter subnets to specific availability zones
+     * @example ['us-east-1a', 'us-east-1b']
+     */
+    readonly availabilityZones?: string[];
+    /**
+     * Filter subnets by CDK subnet group name
+     * Matches the groupName assigned during VPC creation
+     */
+    readonly subnetGroupName?: string;
+    /**
+     * Security group IDs to attach to CodeBuild projects
+     * @example ['sg-12345678']
+     */
+    readonly securityGroupIds?: string[];
+}
+/**
+ * Configuration options for explicit subnet ID network
+ */
+export interface SubnetIdsNetworkOptions {
+    /**
+     * VPC ID that contains the subnets.
+     * Required because CDK CodeBuildStep needs a vpc reference.
+     * Can be a plain string or a SecretValue (e.g. from Secrets Manager).
+     * @example 'vpc-0a1b2c3d4e5f6a7b8'
+     */
+    readonly vpcId: SecretValue | string;
+    /**
+     * Explicit list of subnet IDs where CodeBuild projects will run
+     * @example ['subnet-0a1b2c3d', 'subnet-4e5f6a7b']
+     */
+    readonly subnetIds: string[];
+    /**
+     * Security group IDs to attach to CodeBuild projects
+     * @example ['sg-12345678']
+     */
+    readonly securityGroupIds?: string[];
+}
+/**
+ * Configuration options for VPC lookup by ID
+ */
+export interface VpcIdNetworkOptions extends SubnetSelectionOptions {
+    /**
+     * VPC ID to look up
+     * Can be a plain string or a SecretValue (e.g. from Secrets Manager).
+     * @example 'vpc-0a1b2c3d4e5f6a7b8'
+     */
+    readonly vpcId: SecretValue | string;
+}
+/**
+ * Configuration options for VPC lookup by tags
+ */
+export interface VpcLookupNetworkOptions extends SubnetSelectionOptions {
+    /**
+     * Tag key-value pairs to identify the VPC
+     * All tags must match for lookup to succeed
+     * @example { Environment: 'production', Team: 'platform' }
+     */
+    readonly tags: Record<string, string>;
+    /**
+     * Optional VPC name (value of the 'Name' tag) for additional filtering
+     */
+    readonly vpcName?: string;
+    /**
+     * Optional AWS region override for cross-region VPC lookup
+     * @example 'us-west-2'
+     */
+    readonly region?: string;
+}
+/**
+ * Subnet type names corresponding to CDK SubnetType enum values
+ *
+ * @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetType.html
+ */
+export type SubnetTypeName = 'PRIVATE_WITH_EGRESS' | 'PRIVATE_WITH_NAT' | 'PRIVATE_ISOLATED' | 'PUBLIC';
+/**
+ * Union type of all supported network configurations.
+ *
+ * Used at two independent levels:
+ * - Pipeline-level (`defaults.network`) — applies to all CodeBuild actions
+ * - Step-level (`synth.network`, `CodeBuildStepOptions.network`) — applies to an individual build step
+ *
+ * Each variant resolves to vpc, subnetSelection, and optional securityGroups:
+ * - SubnetIdsNetwork: VPC looked up by ID, subnets selected explicitly by ID
+ * - VpcIdNetwork: VPC looked up by ID, subnets resolved via subnetSelection filters
+ * - VpcLookupNetwork: VPC looked up by tags, subnets resolved via subnetSelection filters
+ */
+export type NetworkConfig = SubnetIdsNetwork | VpcIdNetwork | VpcLookupNetwork;
+/**
+ * Pipeline-level CodeBuild defaults applied to every CodeBuild action
+ * (synth, self-mutation, asset publishing) via `codeBuildDefaults`.
+ *
+ * @example
+ * ```typescript
+ * const defaults: CodeBuildDefaults = {
+ *   network: {
+ *     type: 'vpcId',
+ *     options: { vpcId: 'vpc-abc123', subnetType: 'PRIVATE_WITH_EGRESS' }
+ *   },
+ *   metadata: {
+ *     [MetadataKeys.PRIVILEGED]: true,
+ *   },
+ * };
+ * ```
+ */
+export interface CodeBuildDefaults {
+    /**
+     * Network configuration for all CodeBuild actions.
+     * Resolves to vpc, subnetSelection, and optional securityGroups.
+     */
+    readonly network?: NetworkConfig;
+    /**
+     * Standalone security groups for all CodeBuild actions.
+     * Merged with any security groups resolved from network config.
+     */
+    readonly securityGroups?: SecurityGroupConfig;
+    /**
+     * Metadata applied to all CodeBuild actions.
+     * Merged with step-level metadata; step-level keys take precedence.
+     */
+    readonly metadata?: MetaDataType;
+}
+export {};

package/lib/core/network-types.js

@@ -0,0 +1,4 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29yay10eXBlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb3JlL25ldHdvcmstdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgdHlwZSB7IFNlY3JldFZhbHVlIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHR5cGUgeyBNZXRhRGF0YVR5cGUgfSBmcm9tICcuL3BpcGVsaW5lLXR5cGVzLmpzJztcbmltcG9ydCB0eXBlIHsgU2VjdXJpdHlHcm91cENvbmZpZyB9IGZyb20gJy4vc2VjdXJpdHktZ3JvdXAtdHlwZXMuanMnO1xuXG4vKipcbiAqIE5ldHdvcmsgY29uZmlndXJhdGlvbiB1c2luZyBleHBsaWNpdCBzdWJuZXQgSURzXG4gKlxuICogVXNlIHdoZW4geW91IGtub3cgdGhlIGV4YWN0IHN1Ym5ldCBJRHMgd2hlcmUgQ29kZUJ1aWxkIHNob3VsZCBydW4uXG4gKiBTdWJuZXRzIGFyZSBzZWxlY3RlZCBkaXJlY3RseSBieSBJRDsgVlBDIGlzIGxvb2tlZCB1cCBmcm9tIHRoZSBwcm92aWRlZCB2cGNJZC5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgbmV0d29yazogU3VibmV0SWRzTmV0d29yayA9IHtcbiAqICAgdHlwZTogJ3N1Ym5ldElkcycsXG4gKiAgIG9wdGlvbnM6IHtcbiAqICAgICB2cGNJZDogJ3ZwYy0wYTFiMmMzZDRlNWY2YTdiOCcsXG4gKiAgICAgc3VibmV0SWRzOiBbJ3N1Ym5ldC0wYTFiMmMzZCcsICdzdWJuZXQtNGU1ZjZhN2InXSxcbiAqICAgICBzZWN1cml0eUdyb3VwSWRzOiBbJ3NnLTEyMzQ1Njc4J11cbiAqICAgfVxuICogfTtcbiAqIGBgYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFN1Ym5ldElkc05ldHdvcmsge1xuICByZWFkb25seSB0eXBlOiAnc3VibmV0SWRzJztcbiAgcmVhZG9ubHkgb3B0aW9uczogU3VibmV0SWRzTmV0d29ya09wdGlvbnM7XG59XG5cbi8qKlxuICogTmV0d29yayBjb25maWd1cmF0aW9uIHVzaW5nIFZQQyBsb29rdXAgYnkgSURcbiAqXG4gKiBMb29rcyB1cCBhbiBleGlzdGluZyBWUEMgYnkgaXRzIElEIGFuZCByZXNvbHZlcyBzdWJuZXRzIHZpYSBzdWJuZXRTZWxlY3Rpb24gZmlsdGVycy5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgbmV0d29yazogVnBjSWROZXR3b3JrID0ge1xuICogICB0eXBlOiAndnBjSWQnLFxuICogICBvcHRpb25zOiB7XG4gKiAgICAgdnBjSWQ6ICd2cGMtMGExYjJjM2Q0ZTVmNmE3YjgnLFxuICogICAgIHN1Ym5ldFR5cGU6ICdQUklWQVRFX1dJVEhfRUdSRVNTJyxcbiAqICAgICBzZWN1cml0eUdyb3VwSWRzOiBbJ3NnLTEyMzQ1Njc4J11cbiAqICAgfVxuICogfTtcbiAqIGBgYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFZwY0lkTmV0d29yayB7XG4gIHJlYWRvbmx5IHR5cGU6ICd2cGNJZCc7XG4gIHJlYWRvbmx5IG9wdGlvbnM6IFZwY0lkTmV0d29ya09wdGlvbnM7XG59XG5cbi8qKlxuICogTmV0d29yayBjb25maWd1cmF0aW9uIHVzaW5nIFZQQyBsb29rdXAgYnkgdGFnc1xuICpcbiAqIExvb2tzIHVwIGFuIGV4aXN0aW5nIFZQQyBieSB0YWcgZmlsdGVycyBhbmQgcmVzb2x2ZXMgc3VibmV0cyB2aWEgc3VibmV0U2VsZWN0aW9uIGZpbHRlcnMuXG4gKlxuICogQGV4YW1wbGVcbiAqIGBgYHR5cGVzY3JpcHRcbiAqIGNvbnN0IG5ldHdvcms6IFZwY0xvb2t1cE5ldHdvcmsgPSB7XG4gKiAgIHR5cGU6ICd2cGNMb29rdXAnLFxuICogICBvcHRpb25zOiB7XG4gKiAgICAgdGFnczogeyAnYXdzOmNsb3VkZm9ybWF0aW9uOnN0YWNrLW5hbWUnOiAnTmV0d29ya1N0YWNrJyB9LFxuICogICAgIHN1Ym5ldFR5cGU6ICdQUklWQVRFX1dJVEhfRUdSRVNTJyxcbiAqICAgICBhdmFpbGFiaWxpdHlab25lczogWyd1cy1lYXN0LTFhJywgJ3VzLWVhc3QtMWInXVxuICogICB9XG4gKiB9O1xuICogYGBgXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVnBjTG9va3VwTmV0d29yayB7XG4gIHJlYWRvbmx5IHR5cGU6ICd2cGNMb29rdXAnO1xuICByZWFkb25seSBvcHRpb25zOiBWcGNMb29rdXBOZXR3b3JrT3B0aW9ucztcbn1cblxuLyoqXG4gKiBDb21tb24gc3VibmV0IHNlbGVjdGlvbiBmaWx0ZXJzIHNoYXJlZCBieSBWUEMtYmFzZWQgbmV0d29yayBvcHRpb25zXG4gKi9cbmludGVyZmFjZSBTdWJuZXRTZWxlY3Rpb25PcHRpb25zIHtcbiAgLyoqXG4gICAqIFN1Ym5ldCB0eXBlIGZpbHRlciBmb3Igc3VibmV0IHNlbGVjdGlvblxuICAgKiBNYXBzIHRvIENESyBTdWJuZXRUeXBlIHZhbHVlc1xuICAgKiBAZGVmYXVsdCAnUFJJVkFURV9XSVRIX0VHUkVTUydcbiAgICovXG4gIHJlYWRvbmx5IHN1Ym5ldFR5cGU/OiBTdWJuZXRUeXBlTmFtZTtcblxuICAvKipcbiAgICogRmlsdGVyIHN1Ym5ldHMgdG8gc3BlY2lmaWMgYXZhaWxhYmlsaXR5IHpvbmVzXG4gICAqIEBleGFtcGxlIFsndXMtZWFzdC0xYScsICd1cy1lYXN0LTFiJ11cbiAgICovXG4gIHJlYWRvbmx5IGF2YWlsYWJpbGl0eVpvbmVzPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIEZpbHRlciBzdWJuZXRzIGJ5IENESyBzdWJuZXQgZ3JvdXAgbmFtZVxuICAgKiBNYXRjaGVzIHRoZSBncm91cE5hbWUgYXNzaWduZWQgZHVyaW5nIFZQQyBjcmVhdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgc3VibmV0R3JvdXBOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTZWN1cml0eSBncm91cCBJRHMgdG8gYXR0YWNoIHRvIENvZGVCdWlsZCBwcm9qZWN0c1xuICAgKiBAZXhhbXBsZSBbJ3NnLTEyMzQ1Njc4J11cbiAgICovXG4gIHJlYWRvbmx5IHNlY3VyaXR5R3JvdXBJZHM/OiBzdHJpbmdbXTtcbn1cblxuLyoqXG4gKiBDb25maWd1cmF0aW9uIG9wdGlvbnMgZm9yIGV4cGxpY2l0IHN1Ym5ldCBJRCBuZXR3b3JrXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU3VibmV0SWRzTmV0d29ya09wdGlvbnMge1xuICAvKipcbiAgICogVlBDIElEIHRoYXQgY29udGFpbnMgdGhlIHN1Ym5ldHMuXG4gICAqIFJlcXVpcmVkIGJlY2F1c2UgQ0RLIENvZGVCdWlsZFN0ZXAgbmVlZHMgYSB2cGMgcmVmZXJlbmNlLlxuICAgKiBDYW4gYmUgYSBwbGFpbiBzdHJpbmcgb3IgYSBTZWNyZXRWYWx1ZSAoZS5nLiBmcm9tIFNlY3JldHMgTWFuYWdlcikuXG4gICAqIEBleGFtcGxlICd2cGMtMGExYjJjM2Q0ZTVmNmE3YjgnXG4gICAqL1xuICByZWFkb25seSB2cGNJZDogU2VjcmV0VmFsdWUgfCBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIEV4cGxpY2l0IGxpc3Qgb2Ygc3VibmV0IElEcyB3aGVyZSBDb2RlQnVpbGQgcHJvamVjdHMgd2lsbCBydW5cbiAgICogQGV4YW1wbGUgWydzdWJuZXQtMGExYjJjM2QnLCAnc3VibmV0LTRlNWY2YTdiJ11cbiAgICovXG4gIHJlYWRvbmx5IHN1Ym5ldElkczogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIFNlY3VyaXR5IGdyb3VwIElEcyB0byBhdHRhY2ggdG8gQ29kZUJ1aWxkIHByb2plY3RzXG4gICAqIEBleGFtcGxlIFsnc2ctMTIzNDU2NzgnXVxuICAgKi9cbiAgcmVhZG9ubHkgc2VjdXJpdHlHcm91cElkcz86IHN0cmluZ1tdO1xufVxuXG4vKipcbiAqIENvbmZpZ3VyYXRpb24gb3B0aW9ucyBmb3IgVlBDIGxvb2t1cCBieSBJRFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFZwY0lkTmV0d29ya09wdGlvbnMgZXh0ZW5kcyBTdWJuZXRTZWxlY3Rpb25PcHRpb25zIHtcbiAgLyoqXG4gICAqIFZQQyBJRCB0byBsb29rIHVwXG4gICAqIENhbiBiZSBhIHBsYWluIHN0cmluZyBvciBhIFNlY3JldFZhbHVlIChlLmcuIGZyb20gU2VjcmV0cyBNYW5hZ2VyKS5cbiAgICogQGV4YW1wbGUgJ3ZwYy0wYTFiMmMzZDRlNWY2YTdiOCdcbiAgICovXG4gIHJlYWRvbmx5IHZwY0lkOiBTZWNyZXRWYWx1ZSB8IHN0cmluZztcbn1cblxuLyoqXG4gKiBDb25maWd1cmF0aW9uIG9wdGlvbnMgZm9yIFZQQyBsb29rdXAgYnkgdGFnc1xuICovXG5leHBvcnQgaW50ZXJmYWNlIFZwY0xvb2t1cE5ldHdvcmtPcHRpb25zIGV4dGVuZHMgU3VibmV0U2VsZWN0aW9uT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBUYWcga2V5LXZhbHVlIHBhaXJzIHRvIGlkZW50aWZ5IHRoZSBWUENcbiAgICogQWxsIHRhZ3MgbXVzdCBtYXRjaCBmb3IgbG9va3VwIHRvIHN1Y2NlZWRcbiAgICogQGV4YW1wbGUgeyBFbnZpcm9ubWVudDogJ3Byb2R1Y3Rpb24nLCBUZWFtOiAncGxhdGZvcm0nIH1cbiAgICovXG4gIHJlYWRvbmx5IHRhZ3M6IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIFZQQyBuYW1lICh2YWx1ZSBvZiB0aGUgJ05hbWUnIHRhZykgZm9yIGFkZGl0aW9uYWwgZmlsdGVyaW5nXG4gICAqL1xuICByZWFkb25seSB2cGNOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBBV1MgcmVnaW9uIG92ZXJyaWRlIGZvciBjcm9zcy1yZWdpb24gVlBDIGxvb2t1cFxuICAgKiBAZXhhbXBsZSAndXMtd2VzdC0yJ1xuICAgKi9cbiAgcmVhZG9ubHkgcmVnaW9uPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFN1Ym5ldCB0eXBlIG5hbWVzIGNvcnJlc3BvbmRpbmcgdG8gQ0RLIFN1Ym5ldFR5cGUgZW51bSB2YWx1ZXNcbiAqXG4gKiBAc2VlIGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9jZGsvYXBpL3YyL2RvY3MvYXdzLWNkay1saWIuYXdzX2VjMi5TdWJuZXRUeXBlLmh0bWxcbiAqL1xuZXhwb3J0IHR5cGUgU3VibmV0VHlwZU5hbWUgPVxuICB8ICdQUklWQVRFX1dJVEhfRUdSRVNTJ1xuICB8ICdQUklWQVRFX1dJVEhfTkFUJ1xuICB8ICdQUklWQVRFX0lTT0xBVEVEJ1xuICB8ICdQVUJMSUMnO1xuXG4vKipcbiAqIFVuaW9uIHR5cGUgb2YgYWxsIHN1cHBvcnRlZCBuZXR3b3JrIGNvbmZpZ3VyYXRpb25zLlxuICpcbiAqIFVzZWQgYXQgdHdvIGluZGVwZW5kZW50IGxldmVsczpcbiAqIC0gUGlwZWxpbmUtbGV2ZWwgKGBkZWZhdWx0cy5uZXR3b3JrYCkg4oCUIGFwcGxpZXMgdG8gYWxsIENvZGVCdWlsZCBhY3Rpb25zXG4gKiAtIFN0ZXAtbGV2ZWwgKGBzeW50aC5uZXR3b3JrYCwgYENvZGVCdWlsZFN0ZXBPcHRpb25zLm5ldHdvcmtgKSDigJQgYXBwbGllcyB0byBhbiBpbmRpdmlkdWFsIGJ1aWxkIHN0ZXBcbiAqXG4gKiBFYWNoIHZhcmlhbnQgcmVzb2x2ZXMgdG8gdnBjLCBzdWJuZXRTZWxlY3Rpb24sIGFuZCBvcHRpb25hbCBzZWN1cml0eUdyb3VwczpcbiAqIC0gU3VibmV0SWRzTmV0d29yazogVlBDIGxvb2tlZCB1cCBieSBJRCwgc3VibmV0cyBzZWxlY3RlZCBleHBsaWNpdGx5IGJ5IElEXG4gKiAtIFZwY0lkTmV0d29yazogVlBDIGxvb2tlZCB1cCBieSBJRCwgc3VibmV0cyByZXNvbHZlZCB2aWEgc3VibmV0U2VsZWN0aW9uIGZpbHRlcnNcbiAqIC0gVnBjTG9va3VwTmV0d29yazogVlBDIGxvb2tlZCB1cCBieSB0YWdzLCBzdWJuZXRzIHJlc29sdmVkIHZpYSBzdWJuZXRTZWxlY3Rpb24gZmlsdGVyc1xuICovXG5leHBvcnQgdHlwZSBOZXR3b3JrQ29uZmlnID0gU3VibmV0SWRzTmV0d29yayB8IFZwY0lkTmV0d29yayB8IFZwY0xvb2t1cE5ldHdvcms7XG5cbi8qKlxuICogUGlwZWxpbmUtbGV2ZWwgQ29kZUJ1aWxkIGRlZmF1bHRzIGFwcGxpZWQgdG8gZXZlcnkgQ29kZUJ1aWxkIGFjdGlvblxuICogKHN5bnRoLCBzZWxmLW11dGF0aW9uLCBhc3NldCBwdWJsaXNoaW5nKSB2aWEgYGNvZGVCdWlsZERlZmF1bHRzYC5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3QgZGVmYXVsdHM6IENvZGVCdWlsZERlZmF1bHRzID0ge1xuICogICBuZXR3b3JrOiB7XG4gKiAgICAgdHlwZTogJ3ZwY0lkJyxcbiAqICAgICBvcHRpb25zOiB7IHZwY0lkOiAndnBjLWFiYzEyMycsIHN1Ym5ldFR5cGU6ICdQUklWQVRFX1dJVEhfRUdSRVNTJyB9XG4gKiAgIH0sXG4gKiAgIG1ldGFkYXRhOiB7XG4gKiAgICAgW01ldGFkYXRhS2V5cy5QUklWSUxFR0VEXTogdHJ1ZSxcbiAqICAgfSxcbiAqIH07XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDb2RlQnVpbGREZWZhdWx0cyB7XG4gIC8qKlxuICAgKiBOZXR3b3JrIGNvbmZpZ3VyYXRpb24gZm9yIGFsbCBDb2RlQnVpbGQgYWN0aW9ucy5cbiAgICogUmVzb2x2ZXMgdG8gdnBjLCBzdWJuZXRTZWxlY3Rpb24sIGFuZCBvcHRpb25hbCBzZWN1cml0eUdyb3Vwcy5cbiAgICovXG4gIHJlYWRvbmx5IG5ldHdvcms/OiBOZXR3b3JrQ29uZmlnO1xuXG4gIC8qKlxuICAgKiBTdGFuZGFsb25lIHNlY3VyaXR5IGdyb3VwcyBmb3IgYWxsIENvZGVCdWlsZCBhY3Rpb25zLlxuICAgKiBNZXJnZWQgd2l0aCBhbnkgc2VjdXJpdHkgZ3JvdXBzIHJlc29sdmVkIGZyb20gbmV0d29yayBjb25maWcuXG4gICAqL1xuICByZWFkb25seSBzZWN1cml0eUdyb3Vwcz86IFNlY3VyaXR5R3JvdXBDb25maWc7XG5cbiAgLyoqXG4gICAqIE1ldGFkYXRhIGFwcGxpZWQgdG8gYWxsIENvZGVCdWlsZCBhY3Rpb25zLlxuICAgKiBNZXJnZWQgd2l0aCBzdGVwLWxldmVsIG1ldGFkYXRhOyBzdGVwLWxldmVsIGtleXMgdGFrZSBwcmVjZWRlbmNlLlxuICAgKi9cbiAgcmVhZG9ubHkgbWV0YWRhdGE/OiBNZXRhRGF0YVR5cGU7XG59XG4iXX0=

package/lib/core/network.d.ts

@@ -0,0 +1,33 @@
+import { type ISecurityGroup, type IVpc, type SubnetSelection } from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { UniqueId } from './id-generator.js';
+import type { NetworkConfig } from './network-types.js';
+/** Resolved CDK network props ready to spread into CodeBuildStep or codeBuildDefaults */
+export interface ResolvedNetwork {
+    vpc: IVpc;
+    subnetSelection: SubnetSelection;
+    securityGroups?: ISecurityGroup[];
+}
+/**
+ * Build a NetworkConfig from environment, for deployments that want EVERY
+ * synthesized pipeline's CodeBuild to run inside a VPC (the EC2 "internal" /
+ * inside-AWS-only mode) without per-pipeline network config. Returns undefined
+ * when the env isn't set — public/default deployments run CodeBuild in the
+ * AWS-managed network as before.
+ *
+ * Env (set on the pipeline service in internal mode):
+ *   PIPELINE_VPC_ID              VPC the CodeBuild projects join (required)
+ *   PIPELINE_SUBNET_IDS          comma-separated private subnet IDs (required)
+ *   PIPELINE_SECURITY_GROUP_IDS  comma-separated SG IDs (optional)
+ */
+export declare function networkConfigFromEnv(): NetworkConfig | undefined;
+/**
+ * Resolve a NetworkConfig into CDK props for CodeBuildStep or codeBuildDefaults.
+ * Uses discriminated union narrowing to delegate to the appropriate CDK lookups.
+ *
+ * @param scope - CDK construct scope
+ * @param id - UniqueId instance for generating unique construct IDs
+ * @param network - Network configuration to resolve
+ * @returns Resolved network props ready to spread into CDK constructs
+ */
+export declare function resolveNetwork(scope: Construct, id: UniqueId, network: NetworkConfig): ResolvedNetwork;

package/lib/core/network.js

@@ -0,0 +1,112 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { SecurityGroup, Subnet, SubnetType, Vpc } from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { UniqueId } from './id-generator.js';
+import { unwrapSecret } from './pipeline-helpers.js';
+/**
+ * Mapping from string subnet type names to CDK SubnetType enum values
+ */
+const SUBNET_TYPE_MAP = {
+    PRIVATE_WITH_EGRESS: SubnetType.PRIVATE_WITH_EGRESS,
+    PRIVATE_WITH_NAT: SubnetType.PRIVATE_WITH_NAT,
+    PRIVATE_ISOLATED: SubnetType.PRIVATE_ISOLATED,
+    PUBLIC: SubnetType.PUBLIC,
+};
+const DEFAULT_SUBNET_TYPE = 'PRIVATE_WITH_EGRESS';
+/**
+ * Build a NetworkConfig from environment, for deployments that want EVERY
+ * synthesized pipeline's CodeBuild to run inside a VPC (the EC2 "internal" /
+ * inside-AWS-only mode) without per-pipeline network config. Returns undefined
+ * when the env isn't set — public/default deployments run CodeBuild in the
+ * AWS-managed network as before.
+ *
+ * Env (set on the pipeline service in internal mode):
+ *   PIPELINE_VPC_ID              VPC the CodeBuild projects join (required)
+ *   PIPELINE_SUBNET_IDS          comma-separated private subnet IDs (required)
+ *   PIPELINE_SECURITY_GROUP_IDS  comma-separated SG IDs (optional)
+ */
+export function networkConfigFromEnv() {
+    const vpcId = (process.env.PIPELINE_VPC_ID || '').trim();
+    const subnetIds = (process.env.PIPELINE_SUBNET_IDS || '')
+        .split(',').map((s) => s.trim()).filter(Boolean);
+    if (!vpcId || subnetIds.length === 0)
+        return undefined;
+    const securityGroupIds = (process.env.PIPELINE_SECURITY_GROUP_IDS || '')
+        .split(',').map((s) => s.trim()).filter(Boolean);
+    return {
+        type: 'subnetIds',
+        options: {
+            vpcId,
+            subnetIds,
+            ...(securityGroupIds.length > 0 && { securityGroupIds }),
+        },
+    };
+}
+/**
+ * Resolve a NetworkConfig into CDK props for CodeBuildStep or codeBuildDefaults.
+ * Uses discriminated union narrowing to delegate to the appropriate CDK lookups.
+ *
+ * @param scope - CDK construct scope
+ * @param id - UniqueId instance for generating unique construct IDs
+ * @param network - Network configuration to resolve
+ * @returns Resolved network props ready to spread into CDK constructs
+ */
+export function resolveNetwork(scope, id, network) {
+    switch (network.type) {
+        case 'subnetIds': {
+            const vpc = Vpc.fromLookup(scope, id.generate('network:vpc'), {
+                vpcId: unwrapSecret(network.options.vpcId),
+            });
+            const subnets = network.options.subnetIds.map((subnetId) => Subnet.fromSubnetId(scope, id.generate('network:subnet'), subnetId));
+            return withSecurityGroups({ vpc, subnetSelection: { subnets } }, scope, id, network.options.securityGroupIds);
+        }
+        case 'vpcId': {
+            const vpc = Vpc.fromLookup(scope, id.generate('network:vpc'), {
+                vpcId: unwrapSecret(network.options.vpcId),
+            });
+            return withSecurityGroups({ vpc, subnetSelection: resolveSubnetSelection(network.options) }, scope, id, network.options.securityGroupIds);
+        }
+        case 'vpcLookup': {
+            const vpc = Vpc.fromLookup(scope, id.generate('network:vpc'), {
+                tags: network.options.tags,
+                ...(network.options.vpcName && { vpcName: network.options.vpcName }),
+                ...(network.options.region && { region: network.options.region }),
+            });
+            return withSecurityGroups({ vpc, subnetSelection: resolveSubnetSelection(network.options) }, scope, id, network.options.securityGroupIds);
+        }
+        default: {
+            const _exhaustive = network;
+            throw new Error(`Unknown network config type: ${_exhaustive.type}`);
+        }
+    }
+}
+/**
+ * Attach resolved security groups to a network result when present.
+ */
+function withSecurityGroups(result, scope, id, securityGroupIds) {
+    const securityGroups = resolveSecurityGroups(scope, id, securityGroupIds);
+    return securityGroups ? { ...result, securityGroups } : result;
+}
+/**
+ * Build a SubnetSelection from options that carry subnetType, availabilityZones,
+ * and subnetGroupName. Shared by vpcId and vpcLookup branches.
+ */
+function resolveSubnetSelection(options) {
+    return {
+        subnetType: SUBNET_TYPE_MAP[options.subnetType ?? DEFAULT_SUBNET_TYPE],
+        ...(options.availabilityZones && { availabilityZones: options.availabilityZones }),
+        ...(options.subnetGroupName && { subnetGroupName: options.subnetGroupName }),
+    };
+}
+/**
+ * Resolve security group IDs into CDK security group references.
+ * Returns undefined when no IDs are provided.
+ */
+function resolveSecurityGroups(scope, id, securityGroupIds) {
+    if (!securityGroupIds?.length) {
+        return undefined;
+    }
+    return securityGroupIds.map((sgId) => SecurityGroup.fromSecurityGroupId(scope, id.generate('network:sg'), sgId));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29yay5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb3JlL25ldHdvcmsudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQWtDLGFBQWEsRUFBRSxNQUFNLEVBQXdCLFVBQVUsRUFBRSxHQUFHLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNuSSxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sWUFBWSxDQUFDO0FBQ3ZDLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUs3QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFFckQ7O0dBRUc7QUFDSCxNQUFNLGVBQWUsR0FBdUM7SUFDMUQsbUJBQW1CLEVBQUUsVUFBVSxDQUFDLG1CQUFtQjtJQUNuRCxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsZ0JBQWdCO0lBQzdDLGdCQUFnQixFQUFFLFVBQVUsQ0FBQyxnQkFBZ0I7SUFDN0MsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNO0NBQzFCLENBQUM7QUFFRixNQUFNLG1CQUFtQixHQUFtQixxQkFBcUIsQ0FBQztBQVNsRTs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sVUFBVSxvQkFBb0I7SUFDbEMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN6RCxNQUFNLFNBQVMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLElBQUksRUFBRSxDQUFDO1NBQ3RELEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNuRCxJQUFJLENBQUMsS0FBSyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBRXZELE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLDJCQUEyQixJQUFJLEVBQUUsQ0FBQztTQUNyRSxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFFbkQsT0FBTztRQUNMLElBQUksRUFBRSxXQUFXO1FBQ2pCLE9BQU8sRUFBRTtZQUNQLEtBQUs7WUFDTCxTQUFTO1lBQ1QsR0FBRyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO1NBQ3pEO0tBQ0YsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxjQUFjLENBQzVCLEtBQWdCLEVBQ2hCLEVBQVksRUFDWixPQUFzQjtJQUV0QixRQUFRLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNyQixLQUFLLFdBQVcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLEVBQUU7Z0JBQzVELEtBQUssRUFBRSxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7YUFDM0MsQ0FBQyxDQUFDO1lBRUgsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUMzQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUNsRixDQUFDO1lBRUYsT0FBTyxrQkFBa0IsQ0FDdkIsRUFBRSxHQUFHLEVBQUUsZUFBZSxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFDckMsS0FBSyxFQUNMLEVBQUUsRUFDRixPQUFPLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUNqQyxDQUFDO1FBQ0osQ0FBQztRQUNELEtBQUssT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLEdBQUcsR0FBRyxHQUFHLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxFQUFFO2dCQUM1RCxLQUFLLEVBQUUsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO2FBQzNDLENBQUMsQ0FBQztZQUVILE9BQU8sa0JBQWtCLENBQ3ZCLEVBQUUsR0FBRyxFQUFFLGVBQWUsRUFBRSxzQkFBc0IsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFDakUsS0FBSyxFQUNMLEVBQUUsRUFDRixPQUFPLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUNqQyxDQUFDO1FBQ0osQ0FBQztRQUNELEtBQUssV0FBVyxFQUFFLENBQUM7WUFDakIsTUFBTSxHQUFHLEdBQUcsR0FBRyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRTtnQkFDNUQsSUFBSSxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSTtnQkFDMUIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxJQUFJLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3BFLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO2FBQ2xFLENBQUMsQ0FBQztZQUVILE9BQU8sa0JBQWtCLENBQ3ZCLEVBQUUsR0FBRyxFQUFFLGVBQWUsRUFBRSxzQkFBc0IsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFDakUsS0FBSyxFQUNMLEVBQUUsRUFDRixPQUFPLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUNqQyxDQUFDO1FBQ0osQ0FBQztRQUNELFNBQVMsQ0FBQztZQUNSLE1BQU0sV0FBVyxHQUFVLE9BQU8sQ0FBQztZQUNuQyxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFpQyxXQUE2QixDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekYsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDO0FBRUQ7O0dBRUc7QUFDSCxTQUFTLGtCQUFrQixDQUN6QixNQUErQyxFQUMvQyxLQUFnQixFQUNoQixFQUFZLEVBQ1osZ0JBQTJCO0lBRTNCLE1BQU0sY0FBYyxHQUFHLHFCQUFxQixDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztJQUMxRSxPQUFPLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO0FBQ2pFLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFTLHNCQUFzQixDQUM3QixPQUFnRztJQUVoRyxPQUFPO1FBQ0wsVUFBVSxFQUFFLGVBQWUsQ0FBQyxPQUFPLENBQUMsVUFBVSxJQUFJLG1CQUFtQixDQUFDO1FBQ3RFLEdBQUcsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUNsRixHQUFHLENBQUMsT0FBTyxDQUFDLGVBQWUsSUFBSSxFQUFFLGVBQWUsRUFBRSxPQUFPLENBQUMsZUFBZSxFQUFFLENBQUM7S0FDN0UsQ0FBQztBQUNKLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFTLHFCQUFxQixDQUM1QixLQUFnQixFQUNoQixFQUFZLEVBQ1osZ0JBQTJCO0lBRTNCLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUM5QixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBQ0QsT0FBTyxnQkFBZ0IsQ0FBQyxHQUFHLENBQ3pCLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxhQUFhLENBQUMsbUJBQW1CLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQ3BGLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCB7IHR5cGUgSVNlY3VyaXR5R3JvdXAsIHR5cGUgSVZwYywgU2VjdXJpdHlHcm91cCwgU3VibmV0LCB0eXBlIFN1Ym5ldFNlbGVjdGlvbiwgU3VibmV0VHlwZSwgVnBjIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWVjMic7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IFVuaXF1ZUlkIH0gZnJvbSAnLi9pZC1nZW5lcmF0b3IuanMnO1xuaW1wb3J0IHR5cGUge1xuICBOZXR3b3JrQ29uZmlnLFxuICBTdWJuZXRUeXBlTmFtZSxcbn0gZnJvbSAnLi9uZXR3b3JrLXR5cGVzLmpzJztcbmltcG9ydCB7IHVud3JhcFNlY3JldCB9IGZyb20gJy4vcGlwZWxpbmUtaGVscGVycy5qcyc7XG5cbi8qKlxuICogTWFwcGluZyBmcm9tIHN0cmluZyBzdWJuZXQgdHlwZSBuYW1lcyB0byBDREsgU3VibmV0VHlwZSBlbnVtIHZhbHVlc1xuICovXG5jb25zdCBTVUJORVRfVFlQRV9NQVA6IFJlY29yZDxTdWJuZXRUeXBlTmFtZSwgU3VibmV0VHlwZT4gPSB7XG4gIFBSSVZBVEVfV0lUSF9FR1JFU1M6IFN1Ym5ldFR5cGUuUFJJVkFURV9XSVRIX0VHUkVTUyxcbiAgUFJJVkFURV9XSVRIX05BVDogU3VibmV0VHlwZS5QUklWQVRFX1dJVEhfTkFULFxuICBQUklWQVRFX0lTT0xBVEVEOiBTdWJuZXRUeXBlLlBSSVZBVEVfSVNPTEFURUQsXG4gIFBVQkxJQzogU3VibmV0VHlwZS5QVUJMSUMsXG59O1xuXG5jb25zdCBERUZBVUxUX1NVQk5FVF9UWVBFOiBTdWJuZXRUeXBlTmFtZSA9ICdQUklWQVRFX1dJVEhfRUdSRVNTJztcblxuLyoqIFJlc29sdmVkIENESyBuZXR3b3JrIHByb3BzIHJlYWR5IHRvIHNwcmVhZCBpbnRvIENvZGVCdWlsZFN0ZXAgb3IgY29kZUJ1aWxkRGVmYXVsdHMgKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVzb2x2ZWROZXR3b3JrIHtcbiAgdnBjOiBJVnBjO1xuICBzdWJuZXRTZWxlY3Rpb246IFN1Ym5ldFNlbGVjdGlvbjtcbiAgc2VjdXJpdHlHcm91cHM/OiBJU2VjdXJpdHlHcm91cFtdO1xufVxuXG4vKipcbiAqIEJ1aWxkIGEgTmV0d29ya0NvbmZpZyBmcm9tIGVudmlyb25tZW50LCBmb3IgZGVwbG95bWVudHMgdGhhdCB3YW50IEVWRVJZXG4gKiBzeW50aGVzaXplZCBwaXBlbGluZSdzIENvZGVCdWlsZCB0byBydW4gaW5zaWRlIGEgVlBDICh0aGUgRUMyIFwiaW50ZXJuYWxcIiAvXG4gKiBpbnNpZGUtQVdTLW9ubHkgbW9kZSkgd2l0aG91dCBwZXItcGlwZWxpbmUgbmV0d29yayBjb25maWcuIFJldHVybnMgdW5kZWZpbmVkXG4gKiB3aGVuIHRoZSBlbnYgaXNuJ3Qgc2V0IOKAlCBwdWJsaWMvZGVmYXVsdCBkZXBsb3ltZW50cyBydW4gQ29kZUJ1aWxkIGluIHRoZVxuICogQVdTLW1hbmFnZWQgbmV0d29yayBhcyBiZWZvcmUuXG4gKlxuICogRW52IChzZXQgb24gdGhlIHBpcGVsaW5lIHNlcnZpY2UgaW4gaW50ZXJuYWwgbW9kZSk6XG4gKiAgIFBJUEVMSU5FX1ZQQ19JRCAgICAgICAgICAgICAgVlBDIHRoZSBDb2RlQnVpbGQgcHJvamVjdHMgam9pbiAocmVxdWlyZWQpXG4gKiAgIFBJUEVMSU5FX1NVQk5FVF9JRFMgICAgICAgICAgY29tbWEtc2VwYXJhdGVkIHByaXZhdGUgc3VibmV0IElEcyAocmVxdWlyZWQpXG4gKiAgIFBJUEVMSU5FX1NFQ1VSSVRZX0dST1VQX0lEUyAgY29tbWEtc2VwYXJhdGVkIFNHIElEcyAob3B0aW9uYWwpXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBuZXR3b3JrQ29uZmlnRnJvbUVudigpOiBOZXR3b3JrQ29uZmlnIHwgdW5kZWZpbmVkIHtcbiAgY29uc3QgdnBjSWQgPSAocHJvY2Vzcy5lbnYuUElQRUxJTkVfVlBDX0lEIHx8ICcnKS50cmltKCk7XG4gIGNvbnN0IHN1Ym5ldElkcyA9IChwcm9jZXNzLmVudi5QSVBFTElORV9TVUJORVRfSURTIHx8ICcnKVxuICAgIC5zcGxpdCgnLCcpLm1hcCgocykgPT4gcy50cmltKCkpLmZpbHRlcihCb29sZWFuKTtcbiAgaWYgKCF2cGNJZCB8fCBzdWJuZXRJZHMubGVuZ3RoID09PSAwKSByZXR1cm4gdW5kZWZpbmVkO1xuXG4gIGNvbnN0IHNlY3VyaXR5R3JvdXBJZHMgPSAocHJvY2Vzcy5lbnYuUElQRUxJTkVfU0VDVVJJVFlfR1JPVVBfSURTIHx8ICcnKVxuICAgIC5zcGxpdCgnLCcpLm1hcCgocykgPT4gcy50cmltKCkpLmZpbHRlcihCb29sZWFuKTtcblxuICByZXR1cm4ge1xuICAgIHR5cGU6ICdzdWJuZXRJZHMnLFxuICAgIG9wdGlvbnM6IHtcbiAgICAgIHZwY0lkLFxuICAgICAgc3VibmV0SWRzLFxuICAgICAgLi4uKHNlY3VyaXR5R3JvdXBJZHMubGVuZ3RoID4gMCAmJiB7IHNlY3VyaXR5R3JvdXBJZHMgfSksXG4gICAgfSxcbiAgfTtcbn1cblxuLyoqXG4gKiBSZXNvbHZlIGEgTmV0d29ya0NvbmZpZyBpbnRvIENESyBwcm9wcyBmb3IgQ29kZUJ1aWxkU3RlcCBvciBjb2RlQnVpbGREZWZhdWx0cy5cbiAqIFVzZXMgZGlzY3JpbWluYXRlZCB1bmlvbiBuYXJyb3dpbmcgdG8gZGVsZWdhdGUgdG8gdGhlIGFwcHJvcHJpYXRlIENESyBsb29rdXBzLlxuICpcbiAqIEBwYXJhbSBzY29wZSAtIENESyBjb25zdHJ1Y3Qgc2NvcGVcbiAqIEBwYXJhbSBpZCAtIFVuaXF1ZUlkIGluc3RhbmNlIGZvciBnZW5lcmF0aW5nIHVuaXF1ZSBjb25zdHJ1Y3QgSURzXG4gKiBAcGFyYW0gbmV0d29yayAtIE5ldHdvcmsgY29uZmlndXJhdGlvbiB0byByZXNvbHZlXG4gKiBAcmV0dXJucyBSZXNvbHZlZCBuZXR3b3JrIHByb3BzIHJlYWR5IHRvIHNwcmVhZCBpbnRvIENESyBjb25zdHJ1Y3RzXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlTmV0d29yayhcbiAgc2NvcGU6IENvbnN0cnVjdCxcbiAgaWQ6IFVuaXF1ZUlkLFxuICBuZXR3b3JrOiBOZXR3b3JrQ29uZmlnLFxuKTogUmVzb2x2ZWROZXR3b3JrIHtcbiAgc3dpdGNoIChuZXR3b3JrLnR5cGUpIHtcbiAgICBjYXNlICdzdWJuZXRJZHMnOiB7XG4gICAgICBjb25zdCB2cGMgPSBWcGMuZnJvbUxvb2t1cChzY29wZSwgaWQuZ2VuZXJhdGUoJ25ldHdvcms6dnBjJyksIHtcbiAgICAgICAgdnBjSWQ6IHVud3JhcFNlY3JldChuZXR3b3JrLm9wdGlvbnMudnBjSWQpLFxuICAgICAgfSk7XG5cbiAgICAgIGNvbnN0IHN1Ym5ldHMgPSBuZXR3b3JrLm9wdGlvbnMuc3VibmV0SWRzLm1hcChcbiAgICAgICAgKHN1Ym5ldElkKSA9PiBTdWJuZXQuZnJvbVN1Ym5ldElkKHNjb3BlLCBpZC5nZW5lcmF0ZSgnbmV0d29yazpzdWJuZXQnKSwgc3VibmV0SWQpLFxuICAgICAgKTtcblxuICAgICAgcmV0dXJuIHdpdGhTZWN1cml0eUdyb3VwcyhcbiAgICAgICAgeyB2cGMsIHN1Ym5ldFNlbGVjdGlvbjogeyBzdWJuZXRzIH0gfSxcbiAgICAgICAgc2NvcGUsXG4gICAgICAgIGlkLFxuICAgICAgICBuZXR3b3JrLm9wdGlvbnMuc2VjdXJpdHlHcm91cElkcyxcbiAgICAgICk7XG4gICAgfVxuICAgIGNhc2UgJ3ZwY0lkJzoge1xuICAgICAgY29uc3QgdnBjID0gVnBjLmZyb21Mb29rdXAoc2NvcGUsIGlkLmdlbmVyYXRlKCduZXR3b3JrOnZwYycpLCB7XG4gICAgICAgIHZwY0lkOiB1bndyYXBTZWNyZXQobmV0d29yay5vcHRpb25zLnZwY0lkKSxcbiAgICAgIH0pO1xuXG4gICAgICByZXR1cm4gd2l0aFNlY3VyaXR5R3JvdXBzKFxuICAgICAgICB7IHZwYywgc3VibmV0U2VsZWN0aW9uOiByZXNvbHZlU3VibmV0U2VsZWN0aW9uKG5ldHdvcmsub3B0aW9ucykgfSxcbiAgICAgICAgc2NvcGUsXG4gICAgICAgIGlkLFxuICAgICAgICBuZXR3b3JrLm9wdGlvbnMuc2VjdXJpdHlHcm91cElkcyxcbiAgICAgICk7XG4gICAgfVxuICAgIGNhc2UgJ3ZwY0xvb2t1cCc6IHtcbiAgICAgIGNvbnN0IHZwYyA9IFZwYy5mcm9tTG9va3VwKHNjb3BlLCBpZC5nZW5lcmF0ZSgnbmV0d29yazp2cGMnKSwge1xuICAgICAgICB0YWdzOiBuZXR3b3JrLm9wdGlvbnMudGFncyxcbiAgICAgICAgLi4uKG5ldHdvcmsub3B0aW9ucy52cGNOYW1lICYmIHsgdnBjTmFtZTogbmV0d29yay5vcHRpb25zLnZwY05hbWUgfSksXG4gICAgICAgIC4uLihuZXR3b3JrLm9wdGlvbnMucmVnaW9uICYmIHsgcmVnaW9uOiBuZXR3b3JrLm9wdGlvbnMucmVnaW9uIH0pLFxuICAgICAgfSk7XG5cbiAgICAgIHJldHVybiB3aXRoU2VjdXJpdHlHcm91cHMoXG4gICAgICAgIHsgdnBjLCBzdWJuZXRTZWxlY3Rpb246IHJlc29sdmVTdWJuZXRTZWxlY3Rpb24obmV0d29yay5vcHRpb25zKSB9LFxuICAgICAgICBzY29wZSxcbiAgICAgICAgaWQsXG4gICAgICAgIG5ldHdvcmsub3B0aW9ucy5zZWN1cml0eUdyb3VwSWRzLFxuICAgICAgKTtcbiAgICB9XG4gICAgZGVmYXVsdDoge1xuICAgICAgY29uc3QgX2V4aGF1c3RpdmU6IG5ldmVyID0gbmV0d29yaztcbiAgICAgIHRocm93IG5ldyBFcnJvcihgVW5rbm93biBuZXR3b3JrIGNvbmZpZyB0eXBlOiAkeyhfZXhoYXVzdGl2ZSBhcyBOZXR3b3JrQ29uZmlnKS50eXBlfWApO1xuICAgIH1cbiAgfVxufVxuXG4vKipcbiAqIEF0dGFjaCByZXNvbHZlZCBzZWN1cml0eSBncm91cHMgdG8gYSBuZXR3b3JrIHJlc3VsdCB3aGVuIHByZXNlbnQuXG4gKi9cbmZ1bmN0aW9uIHdpdGhTZWN1cml0eUdyb3VwcyhcbiAgcmVzdWx0OiBPbWl0PFJlc29sdmVkTmV0d29yaywgJ3NlY3VyaXR5R3JvdXBzJz4sXG4gIHNjb3BlOiBDb25zdHJ1Y3QsXG4gIGlkOiBVbmlxdWVJZCxcbiAgc2VjdXJpdHlHcm91cElkcz86IHN0cmluZ1tdLFxuKTogUmVzb2x2ZWROZXR3b3JrIHtcbiAgY29uc3Qgc2VjdXJpdHlHcm91cHMgPSByZXNvbHZlU2VjdXJpdHlHcm91cHMoc2NvcGUsIGlkLCBzZWN1cml0eUdyb3VwSWRzKTtcbiAgcmV0dXJuIHNlY3VyaXR5R3JvdXBzID8geyAuLi5yZXN1bHQsIHNlY3VyaXR5R3JvdXBzIH0gOiByZXN1bHQ7XG59XG5cbi8qKlxuICogQnVpbGQgYSBTdWJuZXRTZWxlY3Rpb24gZnJvbSBvcHRpb25zIHRoYXQgY2Fycnkgc3VibmV0VHlwZSwgYXZhaWxhYmlsaXR5Wm9uZXMsXG4gKiBhbmQgc3VibmV0R3JvdXBOYW1lLiBTaGFyZWQgYnkgdnBjSWQgYW5kIHZwY0xvb2t1cCBicmFuY2hlcy5cbiAqL1xuZnVuY3Rpb24gcmVzb2x2ZVN1Ym5ldFNlbGVjdGlvbihcbiAgb3B0aW9uczogeyBzdWJuZXRUeXBlPzogU3VibmV0VHlwZU5hbWU7IGF2YWlsYWJpbGl0eVpvbmVzPzogc3RyaW5nW107IHN1Ym5ldEdyb3VwTmFtZT86IHN0cmluZyB9LFxuKTogU3VibmV0U2VsZWN0aW9uIHtcbiAgcmV0dXJuIHtcbiAgICBzdWJuZXRUeXBlOiBTVUJORVRfVFlQRV9NQVBbb3B0aW9ucy5zdWJuZXRUeXBlID8/IERFRkFVTFRfU1VCTkVUX1RZUEVdLFxuICAgIC4uLihvcHRpb25zLmF2YWlsYWJpbGl0eVpvbmVzICYmIHsgYXZhaWxhYmlsaXR5Wm9uZXM6IG9wdGlvbnMuYXZhaWxhYmlsaXR5Wm9uZXMgfSksXG4gICAgLi4uKG9wdGlvbnMuc3VibmV0R3JvdXBOYW1lICYmIHsgc3VibmV0R3JvdXBOYW1lOiBvcHRpb25zLnN1Ym5ldEdyb3VwTmFtZSB9KSxcbiAgfTtcbn1cblxuLyoqXG4gKiBSZXNvbHZlIHNlY3VyaXR5IGdyb3VwIElEcyBpbnRvIENESyBzZWN1cml0eSBncm91cCByZWZlcmVuY2VzLlxuICogUmV0dXJucyB1bmRlZmluZWQgd2hlbiBubyBJRHMgYXJlIHByb3ZpZGVkLlxuICovXG5mdW5jdGlvbiByZXNvbHZlU2VjdXJpdHlHcm91cHMoXG4gIHNjb3BlOiBDb25zdHJ1Y3QsXG4gIGlkOiBVbmlxdWVJZCxcbiAgc2VjdXJpdHlHcm91cElkcz86IHN0cmluZ1tdLFxuKTogSVNlY3VyaXR5R3JvdXBbXSB8IHVuZGVmaW5lZCB7XG4gIGlmICghc2VjdXJpdHlHcm91cElkcz8ubGVuZ3RoKSB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxuICByZXR1cm4gc2VjdXJpdHlHcm91cElkcy5tYXAoXG4gICAgKHNnSWQpID0+IFNlY3VyaXR5R3JvdXAuZnJvbVNlY3VyaXR5R3JvdXBJZChzY29wZSwgaWQuZ2VuZXJhdGUoJ25ldHdvcms6c2cnKSwgc2dJZCksXG4gICk7XG59XG4iXX0=

package/lib/core/pipeline-helpers.d.ts

@@ -0,0 +1,61 @@
+import type { Plugin } from '@pipeline-builder/pipeline-data';
+import { SecretValue } from 'aws-cdk-lib';
+import { ComputeType as CDKComputeType, type IBuildImage } from 'aws-cdk-lib/aws-codebuild';
+import { CodeBuildStep, ManualApprovalStep, ShellStep } from 'aws-cdk-lib/pipelines';
+import type { Construct } from 'constructs';
+import type { CodeBuildStepOptions } from '../pipeline/step-types.js';
+/**
+ * Resolve the CodeBuild image to use for a plugin.
+ *
+ * Strategy:
+ *   1. If the plugin sets `aws:cdk:codebuild:buildenvironment:buildImage`
+ *      explicitly in metadata, the metadata-builder passthrough handles it
+ *      (via `metadataForBuildEnvironment`). This function returns
+ *      `undefined` and the metadata wins.
+ *   2. Otherwise, if the plugin has a `name`+`version` AND the registry
+ *      config is populated, build a `LinuxBuildImage.fromDockerRegistry()`
+ *      image pointing at `<registry-host>:<port>/<ns>/<name>:<version>`
+ *      where `<ns>` is `system` or `org-<orgId>`. CodeBuild authenticates by
+ *      sending the per-org platform Secret as Basic auth to
+ *      `pipeline-image-registry`'s `/token` endpoint; the JWT in `password`
+ *      resolves to a registry token scoped to the org.
+ *   3. If `metadata_only`, return `undefined` so CodeBuild uses its default
+ *      (`standard:7.0`).
+ *
+ * `scope` and `orgId` are required: the per-org platform Secret is named
+ * `pipeline-builder/<orgId>/platform`, and `Secret.fromSecretNameV2()`
+ * needs a Construct to anchor the imported secret to.
+ */
+export declare function resolvePluginImage(scope: Construct | undefined, plugin: Plugin, orgId?: string): IBuildImage | undefined;
+export declare function resolveDefaultBuildImage(scope?: Construct, orgId?: string): IBuildImage;
+/**
+ * Create a CodeBuild step or Shell step based on plugin configuration.
+ *
+ * Metadata merge order (last wins):
+ *   1. Plugin metadata (from plugin.metadata in database) — the plugin
+ *      author's baked-in defaults
+ *   2. Step-level metadata (from options.metadata) — the pipeline author's
+ *      per-step overrides, which are more specific and must win
+ *
+ * Environment merge order (last wins):
+ *   1. Plugin env vars (from plugin.env)
+ *   2. Custom env vars (from options.env)
+ *   3. WORKDIR from merged metadata
+ *
+ * CDK prop spread order (last wins):
+ *   programmatic defaults (input, commands, env, network) → metadata overrides
+ *
+ * This means metadata keys like `aws:cdk:pipelines:codebuildstep:commands`
+ * will override the plugin-derived commands when explicitly set.
+ */
+export declare function createCodeBuildStep(options: CodeBuildStepOptions): ShellStep | CodeBuildStep | ManualApprovalStep;
+/**
+ * Convert string or ComputeType enum to CDK ComputeType
+ */
+export declare function getComputeType(input?: string | CDKComputeType): CDKComputeType;
+/**
+ * Unwrap a SecretValue | string into a plain string.
+ * When a SecretValue is provided (e.g. from Secrets Manager), calls unsafeUnwrap()
+ * to extract the underlying value.
+ */
+export declare function unwrapSecret(value: SecretValue | string): string;