@pipeline-builder/pipeline-manager 0.0.1

package/dist/types/plugin.js

@@ -0,0 +1,4 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3R5cGVzL3BsdWdpbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogUGFja2FnZS1sZXZlbCBtZXRhZGF0YSBleHRyYWN0ZWQgZnJvbSB0aGUgcGx1Z2luIGFyY2hpdmUuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGx1Z2luTWV0YWRhdGEge1xuICAvKipcbiAgICogUGx1Z2luIG5hbWVcbiAgICovXG4gIG5hbWU6IHN0cmluZztcblxuICAvKipcbiAgICogUGx1Z2luIHZlcnNpb25cbiAgICovXG4gIHZlcnNpb246IHN0cmluZztcblxuICAvKipcbiAgICogUGx1Z2luIGRlc2NyaXB0aW9uXG4gICAqL1xuICBkZXNjcmlwdGlvbj86IHN0cmluZztcblxuICAvKipcbiAgICogUGx1Z2luIGF1dGhvclxuICAgKi9cbiAgYXV0aG9yPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBQbHVnaW4gbGljZW5zZVxuICAgKi9cbiAgbGljZW5zZT86IHN0cmluZztcblxuICAvKipcbiAgICogUGx1Z2luIGhvbWVwYWdlIFVSTFxuICAgKi9cbiAgaG9tZXBhZ2U/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFBsdWdpbiByZXBvc2l0b3J5IFVSTFxuICAgKi9cbiAgcmVwb3NpdG9yeT86IHN0cmluZztcblxuICAvKipcbiAgICogUGx1Z2luIGtleXdvcmRzL3RhZ3NcbiAgICovXG4gIGtleXdvcmRzPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIFBsdWdpbiBkZXBlbmRlbmNpZXNcbiAgICovXG4gIGRlcGVuZGVuY2llcz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG59XG5cbi8qKlxuICogUnVudGltZSBjb25maWd1cmF0aW9uIGZvciBhIHBsdWdpbiwgaW5jbHVkaW5nIGl0cyBlbnRyeSBwb2ludCBhbmQgc2NoZW1hLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFBsdWdpbkNvbmZpZyB7XG4gIC8qKlxuICAgKiBQbHVnaW4gZW50cnkgcG9pbnRcbiAgICovXG4gIG1haW4/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFBsdWdpbiBjb25maWd1cmF0aW9uIHNjaGVtYVxuICAgKi9cbiAgc2NoZW1hPzogUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG5cbiAgLyoqXG4gICAqIFBsdWdpbiBkZWZhdWx0IGNvbmZpZ3VyYXRpb25cbiAgICovXG4gIGRlZmF1bHRzPzogUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG59XG5cbi8qKlxuICogQ29yZSBwbHVnaW4gZmllbGRzIHJlcXVpcmVkIG9uIGV2ZXJ5IHBsdWdpbiByZWNvcmQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGx1Z2luQmFzZSB7XG4gIC8qKlxuICAgKiBVbmlxdWUgcGx1Z2luIGlkZW50aWZpZXJcbiAgICovXG4gIGlkOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFBsdWdpbiBuYW1lXG4gICAqL1xuICBuYW1lOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFBsdWdpbiB2ZXJzaW9uXG4gICAqL1xuICB2ZXJzaW9uOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIE9yZ2FuaXphdGlvbiB0aGF0IG93bnMgdGhlIHBsdWdpblxuICAgKi9cbiAgb3JnYW5pemF0aW9uOiBzdHJpbmc7XG59XG5cbi8qKlxuICogQ29tcGxldGUgcGx1Z2luIGVudGl0eSBjb21iaW5pbmcgY29yZSBmaWVsZHMgd2l0aCBvcHRpb25hbCBkZXRhaWwgZmllbGRzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFBsdWdpbiBleHRlbmRzIFBsdWdpbkJhc2Uge1xuICAvKipcbiAgICogUGx1Z2luIGRlc2NyaXB0aW9uXG4gICAqL1xuICBkZXNjcmlwdGlvbj86IHN0cmluZztcblxuICAvKipcbiAgICogUGx1Z2luIG1ldGFkYXRhXG4gICAqL1xuICBtZXRhZGF0YT86IFBsdWdpbk1ldGFkYXRhO1xuXG4gIC8qKlxuICAgKiBQbHVnaW4gY29uZmlndXJhdGlvblxuICAgKi9cbiAgY29uZmlnPzogUGx1Z2luQ29uZmlnO1xuXG4gIC8qKlxuICAgKiBQbHVnaW4gZmlsZSBVUkxcbiAgICovXG4gIGZpbGVVcmw/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFBsdWdpbiBmaWxlIHNpemUgaW4gYnl0ZXNcbiAgICovXG4gIGZpbGVTaXplPzogbnVtYmVyO1xuXG4gIC8qKlxuICAgKiBQbHVnaW4gY2hlY2tzdW0gKFNIQTI1NilcbiAgICovXG4gIGNoZWNrc3VtPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIHRoZSBwbHVnaW4gaXMgYWN0aXZlXG4gICAqL1xuICBpc0FjdGl2ZT86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIFdoZXRoZXIgdGhlIHBsdWdpbiBpcyBwdWJsaWNcbiAgICovXG4gIGlzUHVibGljPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogUGx1Z2luIGNyZWF0aW9uIHRpbWVzdGFtcFxuICAgKi9cbiAgY3JlYXRlZEF0Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBQbHVnaW4gbGFzdCB1cGRhdGUgdGltZXN0YW1wXG4gICAqL1xuICB1cGRhdGVkQXQ/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFVzZXIgd2hvIHVwbG9hZGVkIHRoZSBwbHVnaW5cbiAgICovXG4gIHVwbG9hZGVkQnk/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogUmVzcG9uc2UgcmV0dXJuZWQgYnkgc2luZ2xlLXBsdWdpbiBBUEkgZW5kcG9pbnRzIChnZXQsIHVwbG9hZCkuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGx1Z2luUmVzcG9uc2Uge1xuICBwbHVnaW46IFBsdWdpbjtcbn1cbiJdfQ==

package/dist/utils/api-client.d.ts

@@ -0,0 +1,26 @@
+import FormData from 'form-data';
+import { type Config } from './config-loader.js';
+/**
+ * API Client for making HTTP requests to the platform API
+ */
+export declare class ApiClient {
+    private client;
+    private config;
+    constructor(config: Config);
+    private handleError;
+    get<T = unknown>(url: string, params?: Record<string, unknown>, headers?: Record<string, string>): Promise<T>;
+    post<T = unknown>(url: string, data?: unknown, headers?: Record<string, string>): Promise<T>;
+    postForm<T = unknown>(url: string, formData: FormData, headers?: Record<string, string>): Promise<T>;
+    put<T = unknown>(url: string, data?: unknown, headers?: Record<string, string>): Promise<T>;
+    delete<T = unknown>(url: string, headers?: Record<string, string>): Promise<T>;
+    patch<T = unknown>(url: string, data?: unknown, headers?: Record<string, string>): Promise<T>;
+    getConfig(): Config;
+    getBaseUrl(): string;
+    isAuthenticated(): boolean;
+    /**
+     * Advisory check: decode JWT exp claim and warn if expired.
+     * Does NOT verify signature — server handles that.
+     */
+    private checkTokenExpiry;
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/utils/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/utils/api-client.ts"],"names":[],"mappings":"AAKA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAMjD;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAS;IAEvB,YAAY,MAAM,EAAE,MAAM,EAsDzB;IAED,OAAO,CAAC,WAAW;IAkDb,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAGlH;IAEK,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAGjG;IAEK,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASzG;IAEK,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAGhG;IAEK,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAGnF;IAEK,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAGlG;IAED,SAAS,IAAI,MAAM,CAAwB;IAC3C,UAAU,IAAI,MAAM,CAAoC;IACxD,eAAe,IAAI,OAAO,CAAsC;IAEhE;;;OAGG;IACH,OAAO,CAAC,gBAAgB;CASzB"}

package/dist/utils/api-client.js

@@ -0,0 +1,151 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import https from 'https';
+import axios, { AxiosError } from 'axios';
+import FormData from 'form-data';
+import { decodeTokenPayload } from './auth-guard.js';
+import {} from './config-loader.js';
+import { NetworkError } from './error-handler.js';
+import { printDebug, printError, printWarning } from './output-utils.js';
+import { TIMEOUTS } from '../config/cli.constants.js';
+import { ApiError } from '../types/index.js';
+/**
+ * API Client for making HTTP requests to the platform API
+ */
+export class ApiClient {
+    client;
+    config;
+    constructor(config) {
+        this.config = config;
+        if (!config.auth?.token) {
+            throw new Error('Authentication token is required. Set PLATFORM_TOKEN environment variable.');
+        }
+        // Warn if token appears expired (advisory — server validates authoritatively)
+        this.checkTokenExpiry(config.auth.token);
+        const httpsAgent = new https.Agent({
+            rejectUnauthorized: config.api.rejectUnauthorized ?? true,
+        });
+        if (config.api.rejectUnauthorized === false) {
+            printWarning('Certificate validation is disabled');
+        }
+        this.client = axios.create({
+            baseURL: config.api.baseUrl,
+            timeout: config.api.timeout || TIMEOUTS.HTTP_REQUEST,
+            httpsAgent,
+            headers: { 'Content-Type': 'application/json' },
+        });
+        // Auth interceptor
+        this.client.interceptors.request.use((requestConfig) => {
+            requestConfig.headers.Authorization = `Bearer ${config.auth.token}`;
+            printDebug('API Request', {
+                method: requestConfig.method?.toUpperCase(),
+                url: requestConfig.url,
+                baseURL: requestConfig.baseURL,
+            });
+            return requestConfig;
+        }, (error) => {
+            printError('Request interceptor error', { error: error.message });
+            return Promise.reject(error);
+        });
+        // Response interceptor
+        this.client.interceptors.response.use((response) => {
+            printDebug('API Response', {
+                status: response.status,
+                statusText: response.statusText,
+                url: response.config.url,
+            });
+            return response;
+        }, (error) => this.handleError(error));
+    }
+    handleError(error) {
+        if (error.response) {
+            const { status, statusText, data } = error.response;
+            const url = error.config?.url;
+            // The response body (`data`) can carry tokens/PII, and printError always writes
+            // (not gated on DEBUG) — keep it out of the always-on line; surface it only under DEBUG.
+            printError('API request failed', { status, statusText, url });
+            printDebug('API error response body', { data });
+            let message = `API request failed with status ${status}`;
+            if (data && typeof data === 'object' && 'message' in data && typeof data.message === 'string') {
+                message = data.message;
+            }
+            return Promise.reject(new ApiError(message, status, error.response));
+        }
+        else if (error.request) {
+            const code = error.code || 'UNKNOWN';
+            const url = error.config?.url;
+            const timeout = error.config?.timeout;
+            const cause = error.cause;
+            printError('No response received from API', {
+                url,
+                timeout,
+                code,
+                ...(cause instanceof Error ? { cause: cause.message } : {}),
+            });
+            const hints = {
+                ECONNREFUSED: 'Server is not running or port is wrong',
+                ECONNRESET: 'Server closed the connection unexpectedly',
+                ETIMEDOUT: 'Connection timed out — server unreachable or too slow',
+                ENOTFOUND: 'DNS lookup failed — check the hostname in baseUrl',
+                ERR_BAD_REQUEST: 'Request was malformed — check the endpoint and payload',
+                CERT_HAS_EXPIRED: 'SSL certificate expired — use --no-verify-ssl for dev',
+                DEPTH_ZERO_SELF_SIGNED_CERT: 'Self-signed certificate — use --no-verify-ssl',
+                UNABLE_TO_VERIFY_LEAF_SIGNATURE: 'SSL chain incomplete — use --no-verify-ssl for dev',
+            };
+            const hint = hints[code] || 'Check network connectivity and server status';
+            const message = `${code}: ${hint} (url: ${url})`;
+            return Promise.reject(new NetworkError(message, url, error, timeout));
+        }
+        else {
+            printError('API request error', { error: error.message });
+            return Promise.reject(error);
+        }
+    }
+    async get(url, params, headers) {
+        const response = await this.client.get(url, { params, headers });
+        return response.data;
+    }
+    async post(url, data, headers) {
+        const response = await this.client.post(url, data, { headers });
+        return response.data;
+    }
+    async postForm(url, formData, headers) {
+        const uploadTimeout = this.config.api.uploadTimeout || 15 * 60 * 1000; // default 15 minutes
+        const response = await this.client.post(url, formData, {
+            headers: { ...formData.getHeaders(), ...headers },
+            maxContentLength: Infinity,
+            maxBodyLength: Infinity,
+            timeout: uploadTimeout,
+        });
+        return response.data;
+    }
+    async put(url, data, headers) {
+        const response = await this.client.put(url, data, { headers });
+        return response.data;
+    }
+    async delete(url, headers) {
+        const response = await this.client.delete(url, { headers });
+        return response.data;
+    }
+    async patch(url, data, headers) {
+        const response = await this.client.patch(url, data, { headers });
+        return response.data;
+    }
+    getConfig() { return this.config; }
+    getBaseUrl() { return this.config.api.baseUrl; }
+    isAuthenticated() { return !!this.config.auth?.token; }
+    /**
+     * Advisory check: decode JWT exp claim and warn if expired.
+     * Does NOT verify signature — server handles that.
+     */
+    checkTokenExpiry(token) {
+        const payload = decodeTokenPayload(token);
+        if (payload && typeof payload.exp === 'number') {
+            const expiresAt = new Date(payload.exp * 1000);
+            if (expiresAt.getTime() < Date.now()) {
+                printWarning(`Token expired at ${expiresAt.toISOString()} — run "pipeline-manager auth login" to refresh`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWNsaWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9hcGktY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxLQUFLLE1BQU0sT0FBTyxDQUFDO0FBQzFCLE9BQU8sS0FBSyxFQUFFLEVBQXNCLFVBQVUsRUFBRSxNQUFNLE9BQU8sQ0FBQztBQUM5RCxPQUFPLFFBQVEsTUFBTSxXQUFXLENBQUM7QUFDakMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDckQsT0FBTyxFQUFlLE1BQU0sb0JBQW9CLENBQUM7QUFDakQsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ3pFLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUN0RCxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFFN0M7O0dBRUc7QUFDSCxNQUFNLE9BQU8sU0FBUztJQUNaLE1BQU0sQ0FBZ0I7SUFDdEIsTUFBTSxDQUFTO0lBRXZCLFlBQVksTUFBYztRQUN4QixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUVyQixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUVELDhFQUE4RTtRQUM5RSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUV6QyxNQUFNLFVBQVUsR0FBRyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDakMsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsSUFBSSxJQUFJO1NBQzFELENBQUMsQ0FBQztRQUVILElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsS0FBSyxLQUFLLEVBQUUsQ0FBQztZQUM1QyxZQUFZLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBRUQsSUFBSSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDO1lBQ3pCLE9BQU8sRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU87WUFDM0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxZQUFZO1lBQ3BELFVBQVU7WUFDVixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7U0FDaEQsQ0FBQyxDQUFDO1FBRUgsbUJBQW1CO1FBQ25CLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQ2xDLENBQUMsYUFBYSxFQUFFLEVBQUU7WUFDaEIsYUFBYSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEdBQUcsVUFBVSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3BFLFVBQVUsQ0FBQyxhQUFhLEVBQUU7Z0JBQ3hCLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRTtnQkFDM0MsR0FBRyxFQUFFLGFBQWEsQ0FBQyxHQUFHO2dCQUN0QixPQUFPLEVBQUUsYUFBYSxDQUFDLE9BQU87YUFDL0IsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxhQUFhLENBQUM7UUFDdkIsQ0FBQyxFQUNELENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDUixVQUFVLENBQUMsMkJBQTJCLEVBQUUsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDbEUsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQy9CLENBQUMsQ0FDRixDQUFDO1FBRUYsdUJBQXVCO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQ25DLENBQUMsUUFBUSxFQUFFLEVBQUU7WUFDWCxVQUFVLENBQUMsY0FBYyxFQUFFO2dCQUN6QixNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU07Z0JBQ3ZCLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVTtnQkFDL0IsR0FBRyxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRzthQUN6QixDQUFDLENBQUM7WUFDSCxPQUFPLFFBQVEsQ0FBQztRQUNsQixDQUFDLEVBQ0QsQ0FBQyxLQUFpQixFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUMvQyxDQUFDO0lBQ0osQ0FBQztJQUVPLFdBQVcsQ0FBQyxLQUFpQjtRQUNuQyxJQUFJLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNuQixNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDO1lBQ3BELE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDO1lBRTlCLGdGQUFnRjtZQUNoRix5RkFBeUY7WUFDekYsVUFBVSxDQUFDLG9CQUFvQixFQUFFLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQzlELFVBQVUsQ0FBQyx5QkFBeUIsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFFaEQsSUFBSSxPQUFPLEdBQUcsa0NBQWtDLE1BQU0sRUFBRSxDQUFDO1lBQ3pELElBQUksSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxTQUFTLElBQUksSUFBSSxJQUFJLE9BQVEsSUFBNkIsQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ3hILE9BQU8sR0FBSSxJQUE0QixDQUFDLE9BQU8sQ0FBQztZQUNsRCxDQUFDO1lBRUQsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDdkUsQ0FBQzthQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxJQUFJLElBQUksU0FBUyxDQUFDO1lBQ3JDLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDO1lBQzlCLE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDO1lBQ3RDLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFFMUIsVUFBVSxDQUFDLCtCQUErQixFQUFFO2dCQUMxQyxHQUFHO2dCQUNILE9BQU87Z0JBQ1AsSUFBSTtnQkFDSixHQUFHLENBQUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDNUQsQ0FBQyxDQUFDO1lBRUgsTUFBTSxLQUFLLEdBQTJCO2dCQUNwQyxZQUFZLEVBQUUsd0NBQXdDO2dCQUN0RCxVQUFVLEVBQUUsMkNBQTJDO2dCQUN2RCxTQUFTLEVBQUUsdURBQXVEO2dCQUNsRSxTQUFTLEVBQUUsbURBQW1EO2dCQUM5RCxlQUFlLEVBQUUsd0RBQXdEO2dCQUN6RSxnQkFBZ0IsRUFBRSx1REFBdUQ7Z0JBQ3pFLDJCQUEyQixFQUFFLCtDQUErQztnQkFDNUUsK0JBQStCLEVBQUUsb0RBQW9EO2FBQ3RGLENBQUM7WUFFRixNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksOENBQThDLENBQUM7WUFDM0UsTUFBTSxPQUFPLEdBQUcsR0FBRyxJQUFJLEtBQUssSUFBSSxVQUFVLEdBQUcsR0FBRyxDQUFDO1lBRWpELE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLFlBQVksQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7YUFBTSxDQUFDO1lBQ04sVUFBVSxDQUFDLG1CQUFtQixFQUFFLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQzFELE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQixDQUFDO0lBQ0gsQ0FBQztJQUVELEtBQUssQ0FBQyxHQUFHLENBQWMsR0FBVyxFQUFFLE1BQWdDLEVBQUUsT0FBZ0M7UUFDcEcsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBSSxHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUNwRSxPQUFPLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDdkIsQ0FBQztJQUVELEtBQUssQ0FBQyxJQUFJLENBQWMsR0FBVyxFQUFFLElBQWMsRUFBRSxPQUFnQztRQUNuRixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQztJQUN2QixDQUFDO0lBRUQsS0FBSyxDQUFDLFFBQVEsQ0FBYyxHQUFXLEVBQUUsUUFBa0IsRUFBRSxPQUFnQztRQUMzRixNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxhQUFhLElBQUksRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQyxxQkFBcUI7UUFDNUYsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBSSxHQUFHLEVBQUUsUUFBUSxFQUFFO1lBQ3hELE9BQU8sRUFBRSxFQUFFLEdBQUcsUUFBUSxDQUFDLFVBQVUsRUFBRSxFQUFFLEdBQUcsT0FBTyxFQUFFO1lBQ2pELGdCQUFnQixFQUFFLFFBQVE7WUFDMUIsYUFBYSxFQUFFLFFBQVE7WUFDdkIsT0FBTyxFQUFFLGFBQWE7U0FDdkIsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDO0lBQ3ZCLENBQUM7SUFFRCxLQUFLLENBQUMsR0FBRyxDQUFjLEdBQVcsRUFBRSxJQUFjLEVBQUUsT0FBZ0M7UUFDbEYsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBSSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUNsRSxPQUFPLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDdkIsQ0FBQztJQUVELEtBQUssQ0FBQyxNQUFNLENBQWMsR0FBVyxFQUFFLE9BQWdDO1FBQ3JFLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUksR0FBRyxFQUFFLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUMvRCxPQUFPLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDdkIsQ0FBQztJQUVELEtBQUssQ0FBQyxLQUFLLENBQWMsR0FBVyxFQUFFLElBQWMsRUFBRSxPQUFnQztRQUNwRixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3BFLE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQztJQUN2QixDQUFDO0lBRUQsU0FBUyxLQUFhLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDM0MsVUFBVSxLQUFhLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN4RCxlQUFlLEtBQWMsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUVoRTs7O09BR0c7SUFDSyxnQkFBZ0IsQ0FBQyxLQUFhO1FBQ3BDLE1BQU0sT0FBTyxHQUFHLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzFDLElBQUksT0FBTyxJQUFJLE9BQU8sT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMvQyxNQUFNLFNBQVMsR0FBRyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDO1lBQy9DLElBQUksU0FBUyxDQUFDLE9BQU8sRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDO2dCQUNyQyxZQUFZLENBQUMsb0JBQW9CLFNBQVMsQ0FBQyxXQUFXLEVBQUUsaURBQWlELENBQUMsQ0FBQztZQUM3RyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgaHR0cHMgZnJvbSAnaHR0cHMnO1xuaW1wb3J0IGF4aW9zLCB7IHR5cGUgQXhpb3NJbnN0YW5jZSwgQXhpb3NFcnJvciB9IGZyb20gJ2F4aW9zJztcbmltcG9ydCBGb3JtRGF0YSBmcm9tICdmb3JtLWRhdGEnO1xuaW1wb3J0IHsgZGVjb2RlVG9rZW5QYXlsb2FkIH0gZnJvbSAnLi9hdXRoLWd1YXJkLmpzJztcbmltcG9ydCB7IHR5cGUgQ29uZmlnIH0gZnJvbSAnLi9jb25maWctbG9hZGVyLmpzJztcbmltcG9ydCB7IE5ldHdvcmtFcnJvciB9IGZyb20gJy4vZXJyb3ItaGFuZGxlci5qcyc7XG5pbXBvcnQgeyBwcmludERlYnVnLCBwcmludEVycm9yLCBwcmludFdhcm5pbmcgfSBmcm9tICcuL291dHB1dC11dGlscy5qcyc7XG5pbXBvcnQgeyBUSU1FT1VUUyB9IGZyb20gJy4uL2NvbmZpZy9jbGkuY29uc3RhbnRzLmpzJztcbmltcG9ydCB7IEFwaUVycm9yIH0gZnJvbSAnLi4vdHlwZXMvaW5kZXguanMnO1xuXG4vKipcbiAqIEFQSSBDbGllbnQgZm9yIG1ha2luZyBIVFRQIHJlcXVlc3RzIHRvIHRoZSBwbGF0Zm9ybSBBUElcbiAqL1xuZXhwb3J0IGNsYXNzIEFwaUNsaWVudCB7XG4gIHByaXZhdGUgY2xpZW50OiBBeGlvc0luc3RhbmNlO1xuICBwcml2YXRlIGNvbmZpZzogQ29uZmlnO1xuXG4gIGNvbnN0cnVjdG9yKGNvbmZpZzogQ29uZmlnKSB7XG4gICAgdGhpcy5jb25maWcgPSBjb25maWc7XG5cbiAgICBpZiAoIWNvbmZpZy5hdXRoPy50b2tlbikge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdBdXRoZW50aWNhdGlvbiB0b2tlbiBpcyByZXF1aXJlZC4gU2V0IFBMQVRGT1JNX1RPS0VOIGVudmlyb25tZW50IHZhcmlhYmxlLicpO1xuICAgIH1cblxuICAgIC8vIFdhcm4gaWYgdG9rZW4gYXBwZWFycyBleHBpcmVkIChhZHZpc29yeSDigJQgc2VydmVyIHZhbGlkYXRlcyBhdXRob3JpdGF0aXZlbHkpXG4gICAgdGhpcy5jaGVja1Rva2VuRXhwaXJ5KGNvbmZpZy5hdXRoLnRva2VuKTtcblxuICAgIGNvbnN0IGh0dHBzQWdlbnQgPSBuZXcgaHR0cHMuQWdlbnQoe1xuICAgICAgcmVqZWN0VW5hdXRob3JpemVkOiBjb25maWcuYXBpLnJlamVjdFVuYXV0aG9yaXplZCA/PyB0cnVlLFxuICAgIH0pO1xuXG4gICAgaWYgKGNvbmZpZy5hcGkucmVqZWN0VW5hdXRob3JpemVkID09PSBmYWxzZSkge1xuICAgICAgcHJpbnRXYXJuaW5nKCdDZXJ0aWZpY2F0ZSB2YWxpZGF0aW9uIGlzIGRpc2FibGVkJyk7XG4gICAgfVxuXG4gICAgdGhpcy5jbGllbnQgPSBheGlvcy5jcmVhdGUoe1xuICAgICAgYmFzZVVSTDogY29uZmlnLmFwaS5iYXNlVXJsLFxuICAgICAgdGltZW91dDogY29uZmlnLmFwaS50aW1lb3V0IHx8IFRJTUVPVVRTLkhUVFBfUkVRVUVTVCxcbiAgICAgIGh0dHBzQWdlbnQsXG4gICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSxcbiAgICB9KTtcblxuICAgIC8vIEF1dGggaW50ZXJjZXB0b3JcbiAgICB0aGlzLmNsaWVudC5pbnRlcmNlcHRvcnMucmVxdWVzdC51c2UoXG4gICAgICAocmVxdWVzdENvbmZpZykgPT4ge1xuICAgICAgICByZXF1ZXN0Q29uZmlnLmhlYWRlcnMuQXV0aG9yaXphdGlvbiA9IGBCZWFyZXIgJHtjb25maWcuYXV0aC50b2tlbn1gO1xuICAgICAgICBwcmludERlYnVnKCdBUEkgUmVxdWVzdCcsIHtcbiAgICAgICAgICBtZXRob2Q6IHJlcXVlc3RDb25maWcubWV0aG9kPy50b1VwcGVyQ2FzZSgpLFxuICAgICAgICAgIHVybDogcmVxdWVzdENvbmZpZy51cmwsXG4gICAgICAgICAgYmFzZVVSTDogcmVxdWVzdENvbmZpZy5iYXNlVVJMLFxuICAgICAgICB9KTtcbiAgICAgICAgcmV0dXJuIHJlcXVlc3RDb25maWc7XG4gICAgICB9LFxuICAgICAgKGVycm9yKSA9PiB7XG4gICAgICAgIHByaW50RXJyb3IoJ1JlcXVlc3QgaW50ZXJjZXB0b3IgZXJyb3InLCB7IGVycm9yOiBlcnJvci5tZXNzYWdlIH0pO1xuICAgICAgICByZXR1cm4gUHJvbWlzZS5yZWplY3QoZXJyb3IpO1xuICAgICAgfSxcbiAgICApO1xuXG4gICAgLy8gUmVzcG9uc2UgaW50ZXJjZXB0b3JcbiAgICB0aGlzLmNsaWVudC5pbnRlcmNlcHRvcnMucmVzcG9uc2UudXNlKFxuICAgICAgKHJlc3BvbnNlKSA9PiB7XG4gICAgICAgIHByaW50RGVidWcoJ0FQSSBSZXNwb25zZScsIHtcbiAgICAgICAgICBzdGF0dXM6IHJlc3BvbnNlLnN0YXR1cyxcbiAgICAgICAgICBzdGF0dXNUZXh0OiByZXNwb25zZS5zdGF0dXNUZXh0LFxuICAgICAgICAgIHVybDogcmVzcG9uc2UuY29uZmlnLnVybCxcbiAgICAgICAgfSk7XG4gICAgICAgIHJldHVybiByZXNwb25zZTtcbiAgICAgIH0sXG4gICAgICAoZXJyb3I6IEF4aW9zRXJyb3IpID0+IHRoaXMuaGFuZGxlRXJyb3IoZXJyb3IpLFxuICAgICk7XG4gIH1cblxuICBwcml2YXRlIGhhbmRsZUVycm9yKGVycm9yOiBBeGlvc0Vycm9yKTogUHJvbWlzZTxuZXZlcj4ge1xuICAgIGlmIChlcnJvci5yZXNwb25zZSkge1xuICAgICAgY29uc3QgeyBzdGF0dXMsIHN0YXR1c1RleHQsIGRhdGEgfSA9IGVycm9yLnJlc3BvbnNlO1xuICAgICAgY29uc3QgdXJsID0gZXJyb3IuY29uZmlnPy51cmw7XG5cbiAgICAgIC8vIFRoZSByZXNwb25zZSBib2R5IChgZGF0YWApIGNhbiBjYXJyeSB0b2tlbnMvUElJLCBhbmQgcHJpbnRFcnJvciBhbHdheXMgd3JpdGVzXG4gICAgICAvLyAobm90IGdhdGVkIG9uIERFQlVHKSDigJQga2VlcCBpdCBvdXQgb2YgdGhlIGFsd2F5cy1vbiBsaW5lOyBzdXJmYWNlIGl0IG9ubHkgdW5kZXIgREVCVUcuXG4gICAgICBwcmludEVycm9yKCdBUEkgcmVxdWVzdCBmYWlsZWQnLCB7IHN0YXR1cywgc3RhdHVzVGV4dCwgdXJsIH0pO1xuICAgICAgcHJpbnREZWJ1ZygnQVBJIGVycm9yIHJlc3BvbnNlIGJvZHknLCB7IGRhdGEgfSk7XG5cbiAgICAgIGxldCBtZXNzYWdlID0gYEFQSSByZXF1ZXN0IGZhaWxlZCB3aXRoIHN0YXR1cyAke3N0YXR1c31gO1xuICAgICAgaWYgKGRhdGEgJiYgdHlwZW9mIGRhdGEgPT09ICdvYmplY3QnICYmICdtZXNzYWdlJyBpbiBkYXRhICYmIHR5cGVvZiAoZGF0YSBhcyB7IG1lc3NhZ2U6IHVua25vd24gfSkubWVzc2FnZSA9PT0gJ3N0cmluZycpIHtcbiAgICAgICAgbWVzc2FnZSA9IChkYXRhIGFzIHsgbWVzc2FnZTogc3RyaW5nIH0pLm1lc3NhZ2U7XG4gICAgICB9XG5cbiAgICAgIHJldHVybiBQcm9taXNlLnJlamVjdChuZXcgQXBpRXJyb3IobWVzc2FnZSwgc3RhdHVzLCBlcnJvci5yZXNwb25zZSkpO1xuICAgIH0gZWxzZSBpZiAoZXJyb3IucmVxdWVzdCkge1xuICAgICAgY29uc3QgY29kZSA9IGVycm9yLmNvZGUgfHwgJ1VOS05PV04nO1xuICAgICAgY29uc3QgdXJsID0gZXJyb3IuY29uZmlnPy51cmw7XG4gICAgICBjb25zdCB0aW1lb3V0ID0gZXJyb3IuY29uZmlnPy50aW1lb3V0O1xuICAgICAgY29uc3QgY2F1c2UgPSBlcnJvci5jYXVzZTtcblxuICAgICAgcHJpbnRFcnJvcignTm8gcmVzcG9uc2UgcmVjZWl2ZWQgZnJvbSBBUEknLCB7XG4gICAgICAgIHVybCxcbiAgICAgICAgdGltZW91dCxcbiAgICAgICAgY29kZSxcbiAgICAgICAgLi4uKGNhdXNlIGluc3RhbmNlb2YgRXJyb3IgPyB7IGNhdXNlOiBjYXVzZS5tZXNzYWdlIH0gOiB7fSksXG4gICAgICB9KTtcblxuICAgICAgY29uc3QgaGludHM6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7XG4gICAgICAgIEVDT05OUkVGVVNFRDogJ1NlcnZlciBpcyBub3QgcnVubmluZyBvciBwb3J0IGlzIHdyb25nJyxcbiAgICAgICAgRUNPTk5SRVNFVDogJ1NlcnZlciBjbG9zZWQgdGhlIGNvbm5lY3Rpb24gdW5leHBlY3RlZGx5JyxcbiAgICAgICAgRVRJTUVET1VUOiAnQ29ubmVjdGlvbiB0aW1lZCBvdXQg4oCUIHNlcnZlciB1bnJlYWNoYWJsZSBvciB0b28gc2xvdycsXG4gICAgICAgIEVOT1RGT1VORDogJ0ROUyBsb29rdXAgZmFpbGVkIOKAlCBjaGVjayB0aGUgaG9zdG5hbWUgaW4gYmFzZVVybCcsXG4gICAgICAgIEVSUl9CQURfUkVRVUVTVDogJ1JlcXVlc3Qgd2FzIG1hbGZvcm1lZCDigJQgY2hlY2sgdGhlIGVuZHBvaW50IGFuZCBwYXlsb2FkJyxcbiAgICAgICAgQ0VSVF9IQVNfRVhQSVJFRDogJ1NTTCBjZXJ0aWZpY2F0ZSBleHBpcmVkIOKAlCB1c2UgLS1uby12ZXJpZnktc3NsIGZvciBkZXYnLFxuICAgICAgICBERVBUSF9aRVJPX1NFTEZfU0lHTkVEX0NFUlQ6ICdTZWxmLXNpZ25lZCBjZXJ0aWZpY2F0ZSDigJQgdXNlIC0tbm8tdmVyaWZ5LXNzbCcsXG4gICAgICAgIFVOQUJMRV9UT19WRVJJRllfTEVBRl9TSUdOQVRVUkU6ICdTU0wgY2hhaW4gaW5jb21wbGV0ZSDigJQgdXNlIC0tbm8tdmVyaWZ5LXNzbCBmb3IgZGV2JyxcbiAgICAgIH07XG5cbiAgICAgIGNvbnN0IGhpbnQgPSBoaW50c1tjb2RlXSB8fCAnQ2hlY2sgbmV0d29yayBjb25uZWN0aXZpdHkgYW5kIHNlcnZlciBzdGF0dXMnO1xuICAgICAgY29uc3QgbWVzc2FnZSA9IGAke2NvZGV9OiAke2hpbnR9ICh1cmw6ICR7dXJsfSlgO1xuXG4gICAgICByZXR1cm4gUHJvbWlzZS5yZWplY3QobmV3IE5ldHdvcmtFcnJvcihtZXNzYWdlLCB1cmwsIGVycm9yLCB0aW1lb3V0KSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIHByaW50RXJyb3IoJ0FQSSByZXF1ZXN0IGVycm9yJywgeyBlcnJvcjogZXJyb3IubWVzc2FnZSB9KTtcbiAgICAgIHJldHVybiBQcm9taXNlLnJlamVjdChlcnJvcik7XG4gICAgfVxuICB9XG5cbiAgYXN5bmMgZ2V0PFQgPSB1bmtub3duPih1cmw6IHN0cmluZywgcGFyYW1zPzogUmVjb3JkPHN0cmluZywgdW5rbm93bj4sIGhlYWRlcnM/OiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+KTogUHJvbWlzZTxUPiB7XG4gICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCB0aGlzLmNsaWVudC5nZXQ8VD4odXJsLCB7IHBhcmFtcywgaGVhZGVycyB9KTtcbiAgICByZXR1cm4gcmVzcG9uc2UuZGF0YTtcbiAgfVxuXG4gIGFzeW5jIHBvc3Q8VCA9IHVua25vd24+KHVybDogc3RyaW5nLCBkYXRhPzogdW5rbm93biwgaGVhZGVycz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz4pOiBQcm9taXNlPFQ+IHtcbiAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IHRoaXMuY2xpZW50LnBvc3Q8VD4odXJsLCBkYXRhLCB7IGhlYWRlcnMgfSk7XG4gICAgcmV0dXJuIHJlc3BvbnNlLmRhdGE7XG4gIH1cblxuICBhc3luYyBwb3N0Rm9ybTxUID0gdW5rbm93bj4odXJsOiBzdHJpbmcsIGZvcm1EYXRhOiBGb3JtRGF0YSwgaGVhZGVycz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz4pOiBQcm9taXNlPFQ+IHtcbiAgICBjb25zdCB1cGxvYWRUaW1lb3V0ID0gdGhpcy5jb25maWcuYXBpLnVwbG9hZFRpbWVvdXQgfHwgMTUgKiA2MCAqIDEwMDA7IC8vIGRlZmF1bHQgMTUgbWludXRlc1xuICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgdGhpcy5jbGllbnQucG9zdDxUPih1cmwsIGZvcm1EYXRhLCB7XG4gICAgICBoZWFkZXJzOiB7IC4uLmZvcm1EYXRhLmdldEhlYWRlcnMoKSwgLi4uaGVhZGVycyB9LFxuICAgICAgbWF4Q29udGVudExlbmd0aDogSW5maW5pdHksXG4gICAgICBtYXhCb2R5TGVuZ3RoOiBJbmZpbml0eSxcbiAgICAgIHRpbWVvdXQ6IHVwbG9hZFRpbWVvdXQsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3BvbnNlLmRhdGE7XG4gIH1cblxuICBhc3luYyBwdXQ8VCA9IHVua25vd24+KHVybDogc3RyaW5nLCBkYXRhPzogdW5rbm93biwgaGVhZGVycz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz4pOiBQcm9taXNlPFQ+IHtcbiAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IHRoaXMuY2xpZW50LnB1dDxUPih1cmwsIGRhdGEsIHsgaGVhZGVycyB9KTtcbiAgICByZXR1cm4gcmVzcG9uc2UuZGF0YTtcbiAgfVxuXG4gIGFzeW5jIGRlbGV0ZTxUID0gdW5rbm93bj4odXJsOiBzdHJpbmcsIGhlYWRlcnM/OiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+KTogUHJvbWlzZTxUPiB7XG4gICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCB0aGlzLmNsaWVudC5kZWxldGU8VD4odXJsLCB7IGhlYWRlcnMgfSk7XG4gICAgcmV0dXJuIHJlc3BvbnNlLmRhdGE7XG4gIH1cblxuICBhc3luYyBwYXRjaDxUID0gdW5rbm93bj4odXJsOiBzdHJpbmcsIGRhdGE/OiB1bmtub3duLCBoZWFkZXJzPzogUmVjb3JkPHN0cmluZywgc3RyaW5nPik6IFByb21pc2U8VD4ge1xuICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgdGhpcy5jbGllbnQucGF0Y2g8VD4odXJsLCBkYXRhLCB7IGhlYWRlcnMgfSk7XG4gICAgcmV0dXJuIHJlc3BvbnNlLmRhdGE7XG4gIH1cblxuICBnZXRDb25maWcoKTogQ29uZmlnIHsgcmV0dXJuIHRoaXMuY29uZmlnOyB9XG4gIGdldEJhc2VVcmwoKTogc3RyaW5nIHsgcmV0dXJuIHRoaXMuY29uZmlnLmFwaS5iYXNlVXJsOyB9XG4gIGlzQXV0aGVudGljYXRlZCgpOiBib29sZWFuIHsgcmV0dXJuICEhdGhpcy5jb25maWcuYXV0aD8udG9rZW47IH1cblxuICAvKipcbiAgICogQWR2aXNvcnkgY2hlY2s6IGRlY29kZSBKV1QgZXhwIGNsYWltIGFuZCB3YXJuIGlmIGV4cGlyZWQuXG4gICAqIERvZXMgTk9UIHZlcmlmeSBzaWduYXR1cmUg4oCUIHNlcnZlciBoYW5kbGVzIHRoYXQuXG4gICAqL1xuICBwcml2YXRlIGNoZWNrVG9rZW5FeHBpcnkodG9rZW46IHN0cmluZyk6IHZvaWQge1xuICAgIGNvbnN0IHBheWxvYWQgPSBkZWNvZGVUb2tlblBheWxvYWQodG9rZW4pO1xuICAgIGlmIChwYXlsb2FkICYmIHR5cGVvZiBwYXlsb2FkLmV4cCA9PT0gJ251bWJlcicpIHtcbiAgICAgIGNvbnN0IGV4cGlyZXNBdCA9IG5ldyBEYXRlKHBheWxvYWQuZXhwICogMTAwMCk7XG4gICAgICBpZiAoZXhwaXJlc0F0LmdldFRpbWUoKSA8IERhdGUubm93KCkpIHtcbiAgICAgICAgcHJpbnRXYXJuaW5nKGBUb2tlbiBleHBpcmVkIGF0ICR7ZXhwaXJlc0F0LnRvSVNPU3RyaW5nKCl9IOKAlCBydW4gXCJwaXBlbGluZS1tYW5hZ2VyIGF1dGggbG9naW5cIiB0byByZWZyZXNoYCk7XG4gICAgICB9XG4gICAgfVxuICB9XG59XG4iXX0=

package/dist/utils/audit-log.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Log a sensitive operation to the local audit file.
+ *
+ * @param command - The command name (e.g., 'store-token', 'deploy', 'bootstrap')
+ * @param details - Non-sensitive metadata about the operation
+ */
+export declare function auditLog(command: string, details?: Record<string, unknown>): void;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/utils/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/utils/audit-log.ts"],"names":[],"mappings":"AAqCA;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAwBjF"}

package/dist/utils/audit-log.js

@@ -0,0 +1,57 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { printDebug } from './output-utils.js';
+/**
+ * Local audit logger for sensitive CLI operations.
+ * Writes timestamped entries to ~/.pipeline-manager/audit.log.
+ * Never logs credentials or tokens — only operation metadata.
+ */
+const AUDIT_DIR = path.join(os.homedir(), '.pipeline-manager');
+const AUDIT_FILE = path.join(AUDIT_DIR, 'audit.log');
+const MAX_AUDIT_SIZE = 1024 * 1024; // 1MB — rotate when exceeded
+const MAX_ROTATED = 5; // keep audit.log.1 .. .5 (history isn't lost on repeated rotations)
+/** Shift audit.log.{n} → .{n+1} (dropping the oldest), then audit.log → .1. */
+function rotate() {
+    const oldest = `${AUDIT_FILE}.${MAX_ROTATED}`;
+    if (fs.existsSync(oldest))
+        fs.unlinkSync(oldest);
+    for (let i = MAX_ROTATED - 1; i >= 1; i--) {
+        const src = `${AUDIT_FILE}.${i}`;
+        if (fs.existsSync(src))
+            fs.renameSync(src, `${AUDIT_FILE}.${i + 1}`);
+    }
+    fs.renameSync(AUDIT_FILE, `${AUDIT_FILE}.1`);
+}
+/**
+ * Log a sensitive operation to the local audit file.
+ *
+ * @param command - The command name (e.g., 'store-token', 'deploy', 'bootstrap')
+ * @param details - Non-sensitive metadata about the operation
+ */
+export function auditLog(command, details) {
+    try {
+        if (!fs.existsSync(AUDIT_DIR)) {
+            fs.mkdirSync(AUDIT_DIR, { recursive: true, mode: 0o700 });
+        }
+        // Rotate if file is too large (keeps MAX_ROTATED archives)
+        if (fs.existsSync(AUDIT_FILE) && fs.statSync(AUDIT_FILE).size > MAX_AUDIT_SIZE) {
+            rotate();
+        }
+        const entry = {
+            timestamp: new Date().toISOString(),
+            command,
+            user: os.userInfo().username,
+            details,
+        };
+        fs.appendFileSync(AUDIT_FILE, JSON.stringify(entry) + '\n', { mode: 0o600 });
+    }
+    catch (err) {
+        // Audit logging is best-effort — never block the CLI — but surface the failure
+        // in debug so a silently-unrecorded sensitive op is at least diagnosable.
+        printDebug('Audit log write failed', { command, error: err instanceof Error ? err.message : String(err) });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXVkaXQtbG9nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3V0aWxzL2F1ZGl0LWxvZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQztBQUNwQixPQUFPLEVBQUUsTUFBTSxJQUFJLENBQUM7QUFDcEIsT0FBTyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQ3hCLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUUvQzs7OztHQUlHO0FBRUgsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsbUJBQW1CLENBQUMsQ0FBQztBQUMvRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUNyRCxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsSUFBSSxDQUFDLENBQUMsNkJBQTZCO0FBQ2pFLE1BQU0sV0FBVyxHQUFHLENBQUMsQ0FBQyxDQUFDLG9FQUFvRTtBQUUzRiwrRUFBK0U7QUFDL0UsU0FBUyxNQUFNO0lBQ2IsTUFBTSxNQUFNLEdBQUcsR0FBRyxVQUFVLElBQUksV0FBVyxFQUFFLENBQUM7SUFDOUMsSUFBSSxFQUFFLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztRQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDakQsS0FBSyxJQUFJLENBQUMsR0FBRyxXQUFXLEdBQUcsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUMxQyxNQUFNLEdBQUcsR0FBRyxHQUFHLFVBQVUsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqQyxJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1lBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxVQUFVLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELEVBQUUsQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLEdBQUcsVUFBVSxJQUFJLENBQUMsQ0FBQztBQUMvQyxDQUFDO0FBU0Q7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFDLE9BQWUsRUFBRSxPQUFpQztJQUN6RSxJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQzlCLEVBQUUsQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBRUQsMkRBQTJEO1FBQzNELElBQUksRUFBRSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksR0FBRyxjQUFjLEVBQUUsQ0FBQztZQUMvRSxNQUFNLEVBQUUsQ0FBQztRQUNYLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBZTtZQUN4QixTQUFTLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7WUFDbkMsT0FBTztZQUNQLElBQUksRUFBRSxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUTtZQUM1QixPQUFPO1NBQ1IsQ0FBQztRQUVGLEVBQUUsQ0FBQyxjQUFjLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7UUFDYiwrRUFBK0U7UUFDL0UsMEVBQTBFO1FBQzFFLFVBQVUsQ0FBQyx3QkFBd0IsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsR0FBRyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RyxDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgZnMgZnJvbSAnZnMnO1xuaW1wb3J0IG9zIGZyb20gJ29zJztcbmltcG9ydCBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHsgcHJpbnREZWJ1ZyB9IGZyb20gJy4vb3V0cHV0LXV0aWxzLmpzJztcblxuLyoqXG4gKiBMb2NhbCBhdWRpdCBsb2dnZXIgZm9yIHNlbnNpdGl2ZSBDTEkgb3BlcmF0aW9ucy5cbiAqIFdyaXRlcyB0aW1lc3RhbXBlZCBlbnRyaWVzIHRvIH4vLnBpcGVsaW5lLW1hbmFnZXIvYXVkaXQubG9nLlxuICogTmV2ZXIgbG9ncyBjcmVkZW50aWFscyBvciB0b2tlbnMg4oCUIG9ubHkgb3BlcmF0aW9uIG1ldGFkYXRhLlxuICovXG5cbmNvbnN0IEFVRElUX0RJUiA9IHBhdGguam9pbihvcy5ob21lZGlyKCksICcucGlwZWxpbmUtbWFuYWdlcicpO1xuY29uc3QgQVVESVRfRklMRSA9IHBhdGguam9pbihBVURJVF9ESVIsICdhdWRpdC5sb2cnKTtcbmNvbnN0IE1BWF9BVURJVF9TSVpFID0gMTAyNCAqIDEwMjQ7IC8vIDFNQiDigJQgcm90YXRlIHdoZW4gZXhjZWVkZWRcbmNvbnN0IE1BWF9ST1RBVEVEID0gNTsgLy8ga2VlcCBhdWRpdC5sb2cuMSAuLiAuNSAoaGlzdG9yeSBpc24ndCBsb3N0IG9uIHJlcGVhdGVkIHJvdGF0aW9ucylcblxuLyoqIFNoaWZ0IGF1ZGl0LmxvZy57bn0g4oaSIC57bisxfSAoZHJvcHBpbmcgdGhlIG9sZGVzdCksIHRoZW4gYXVkaXQubG9nIOKGkiAuMS4gKi9cbmZ1bmN0aW9uIHJvdGF0ZSgpOiB2b2lkIHtcbiAgY29uc3Qgb2xkZXN0ID0gYCR7QVVESVRfRklMRX0uJHtNQVhfUk9UQVRFRH1gO1xuICBpZiAoZnMuZXhpc3RzU3luYyhvbGRlc3QpKSBmcy51bmxpbmtTeW5jKG9sZGVzdCk7XG4gIGZvciAobGV0IGkgPSBNQVhfUk9UQVRFRCAtIDE7IGkgPj0gMTsgaS0tKSB7XG4gICAgY29uc3Qgc3JjID0gYCR7QVVESVRfRklMRX0uJHtpfWA7XG4gICAgaWYgKGZzLmV4aXN0c1N5bmMoc3JjKSkgZnMucmVuYW1lU3luYyhzcmMsIGAke0FVRElUX0ZJTEV9LiR7aSArIDF9YCk7XG4gIH1cbiAgZnMucmVuYW1lU3luYyhBVURJVF9GSUxFLCBgJHtBVURJVF9GSUxFfS4xYCk7XG59XG5cbmludGVyZmFjZSBBdWRpdEVudHJ5IHtcbiAgdGltZXN0YW1wOiBzdHJpbmc7XG4gIGNvbW1hbmQ6IHN0cmluZztcbiAgdXNlcj86IHN0cmluZztcbiAgZGV0YWlscz86IFJlY29yZDxzdHJpbmcsIHVua25vd24+O1xufVxuXG4vKipcbiAqIExvZyBhIHNlbnNpdGl2ZSBvcGVyYXRpb24gdG8gdGhlIGxvY2FsIGF1ZGl0IGZpbGUuXG4gKlxuICogQHBhcmFtIGNvbW1hbmQgLSBUaGUgY29tbWFuZCBuYW1lIChlLmcuLCAnc3RvcmUtdG9rZW4nLCAnZGVwbG95JywgJ2Jvb3RzdHJhcCcpXG4gKiBAcGFyYW0gZGV0YWlscyAtIE5vbi1zZW5zaXRpdmUgbWV0YWRhdGEgYWJvdXQgdGhlIG9wZXJhdGlvblxuICovXG5leHBvcnQgZnVuY3Rpb24gYXVkaXRMb2coY29tbWFuZDogc3RyaW5nLCBkZXRhaWxzPzogUmVjb3JkPHN0cmluZywgdW5rbm93bj4pOiB2b2lkIHtcbiAgdHJ5IHtcbiAgICBpZiAoIWZzLmV4aXN0c1N5bmMoQVVESVRfRElSKSkge1xuICAgICAgZnMubWtkaXJTeW5jKEFVRElUX0RJUiwgeyByZWN1cnNpdmU6IHRydWUsIG1vZGU6IDBvNzAwIH0pO1xuICAgIH1cblxuICAgIC8vIFJvdGF0ZSBpZiBmaWxlIGlzIHRvbyBsYXJnZSAoa2VlcHMgTUFYX1JPVEFURUQgYXJjaGl2ZXMpXG4gICAgaWYgKGZzLmV4aXN0c1N5bmMoQVVESVRfRklMRSkgJiYgZnMuc3RhdFN5bmMoQVVESVRfRklMRSkuc2l6ZSA+IE1BWF9BVURJVF9TSVpFKSB7XG4gICAgICByb3RhdGUoKTtcbiAgICB9XG5cbiAgICBjb25zdCBlbnRyeTogQXVkaXRFbnRyeSA9IHtcbiAgICAgIHRpbWVzdGFtcDogbmV3IERhdGUoKS50b0lTT1N0cmluZygpLFxuICAgICAgY29tbWFuZCxcbiAgICAgIHVzZXI6IG9zLnVzZXJJbmZvKCkudXNlcm5hbWUsXG4gICAgICBkZXRhaWxzLFxuICAgIH07XG5cbiAgICBmcy5hcHBlbmRGaWxlU3luYyhBVURJVF9GSUxFLCBKU09OLnN0cmluZ2lmeShlbnRyeSkgKyAnXFxuJywgeyBtb2RlOiAwbzYwMCB9KTtcbiAgfSBjYXRjaCAoZXJyKSB7XG4gICAgLy8gQXVkaXQgbG9nZ2luZyBpcyBiZXN0LWVmZm9ydCDigJQgbmV2ZXIgYmxvY2sgdGhlIENMSSDigJQgYnV0IHN1cmZhY2UgdGhlIGZhaWx1cmVcbiAgICAvLyBpbiBkZWJ1ZyBzbyBhIHNpbGVudGx5LXVucmVjb3JkZWQgc2Vuc2l0aXZlIG9wIGlzIGF0IGxlYXN0IGRpYWdub3NhYmxlLlxuICAgIHByaW50RGVidWcoJ0F1ZGl0IGxvZyB3cml0ZSBmYWlsZWQnLCB7IGNvbW1hbmQsIGVycm9yOiBlcnIgaW5zdGFuY2VvZiBFcnJvciA/IGVyci5tZXNzYWdlIDogU3RyaW5nKGVycikgfSk7XG4gIH1cbn1cbiJdfQ==

package/dist/utils/auth-guard.d.ts

@@ -0,0 +1,20 @@
+interface TokenPayload {
+    role?: string;
+    isAdmin?: boolean;
+    sub?: string;
+    organizationId?: string;
+    /** Standard JWT expiry claim, in seconds since epoch. */
+    exp?: number;
+    /** Standard JWT issued-at claim, in seconds since epoch. */
+    iat?: number;
+}
+/**
+ * Decode a JWT token payload without signature verification.
+ *
+ * SECURITY: NO signature verification. The decoded payload MUST NOT be used
+ * for authorization decisions — the server validates the token on every API
+ * call. Use only for advisory UX hints.
+ */
+export declare function decodeTokenPayload(token: string): TokenPayload | null;
+export {};
+//# sourceMappingURL=auth-guard.d.ts.map

package/dist/utils/auth-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-guard.d.ts","sourceRoot":"","sources":["../../src/utils/auth-guard.ts"],"names":[],"mappings":"AAGA,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CASrE"}

package/dist/utils/auth-guard.js

@@ -0,0 +1,22 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Decode a JWT token payload without signature verification.
+ *
+ * SECURITY: NO signature verification. The decoded payload MUST NOT be used
+ * for authorization decisions — the server validates the token on every API
+ * call. Use only for advisory UX hints.
+ */
+export function decodeTokenPayload(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts[1])
+            return null;
+        const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');
+        return JSON.parse(payload);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC1ndWFyZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9hdXRoLWd1YXJkLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFhdEM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLGtCQUFrQixDQUFDLEtBQWE7SUFDOUMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMvQixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ2pELE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNyRSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFpQixDQUFDO0lBQzdDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmludGVyZmFjZSBUb2tlblBheWxvYWQge1xuICByb2xlPzogc3RyaW5nO1xuICBpc0FkbWluPzogYm9vbGVhbjtcbiAgc3ViPzogc3RyaW5nO1xuICBvcmdhbml6YXRpb25JZD86IHN0cmluZztcbiAgLyoqIFN0YW5kYXJkIEpXVCBleHBpcnkgY2xhaW0sIGluIHNlY29uZHMgc2luY2UgZXBvY2guICovXG4gIGV4cD86IG51bWJlcjtcbiAgLyoqIFN0YW5kYXJkIEpXVCBpc3N1ZWQtYXQgY2xhaW0sIGluIHNlY29uZHMgc2luY2UgZXBvY2guICovXG4gIGlhdD86IG51bWJlcjtcbn1cblxuLyoqXG4gKiBEZWNvZGUgYSBKV1QgdG9rZW4gcGF5bG9hZCB3aXRob3V0IHNpZ25hdHVyZSB2ZXJpZmljYXRpb24uXG4gKlxuICogU0VDVVJJVFk6IE5PIHNpZ25hdHVyZSB2ZXJpZmljYXRpb24uIFRoZSBkZWNvZGVkIHBheWxvYWQgTVVTVCBOT1QgYmUgdXNlZFxuICogZm9yIGF1dGhvcml6YXRpb24gZGVjaXNpb25zIOKAlCB0aGUgc2VydmVyIHZhbGlkYXRlcyB0aGUgdG9rZW4gb24gZXZlcnkgQVBJXG4gKiBjYWxsLiBVc2Ugb25seSBmb3IgYWR2aXNvcnkgVVggaGludHMuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZWNvZGVUb2tlblBheWxvYWQodG9rZW46IHN0cmluZyk6IFRva2VuUGF5bG9hZCB8IG51bGwge1xuICB0cnkge1xuICAgIGNvbnN0IHBhcnRzID0gdG9rZW4uc3BsaXQoJy4nKTtcbiAgICBpZiAocGFydHMubGVuZ3RoICE9PSAzIHx8ICFwYXJ0c1sxXSkgcmV0dXJuIG51bGw7XG4gICAgY29uc3QgcGF5bG9hZCA9IEJ1ZmZlci5mcm9tKHBhcnRzWzFdLCAnYmFzZTY0dXJsJykudG9TdHJpbmcoJ3V0Zi04Jyk7XG4gICAgcmV0dXJuIEpTT04ucGFyc2UocGF5bG9hZCkgYXMgVG9rZW5QYXlsb2FkO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxufVxuIl19

package/dist/utils/auth-utils.d.ts

@@ -0,0 +1,68 @@
+import https from 'https';
+/**
+ * Login / refresh / switch-org response — every platform auth endpoint returns
+ * the session tokens under this envelope.
+ */
+export interface AuthResponse {
+    success: boolean;
+    data: {
+        accessToken: string;
+        refreshToken: string;
+    };
+}
+/**
+ * Guard the credential-transmitting commands (`login`, `create-pat`) against
+ * disabling TLS verification in production. These POST plaintext passwords/JWTs,
+ * so a MITM on a `prod + --no-verify-ssl` run would harvest them.
+ *
+ * Unlike {@link assertSslDisableAllowed} (which throws — for paths already inside
+ * a try/catch), this prints and hard-exits, matching the pre-flight checks these
+ * commands run before their try block. In non-production it is a no-op, so
+ * `--no-verify-ssl` still works against self-signed dev platforms.
+ */
+export declare function assertCredentialTlsAllowed(verifySsl: boolean | undefined): void;
+/**
+ * Resolve credentials from flags, falling back to the
+ * PLATFORM_IDENTIFIER / PLATFORM_PASSWORD env vars (so the password need not
+ * appear in shell history / `ps`).
+ */
+export declare function resolveCredentials(options: {
+    identifier?: string;
+    password?: string;
+}): {
+    identifier?: string;
+    password?: string;
+};
+/**
+ * Build the https agent used by the credential commands. `--verify-ssl`
+ * defaults to on; only an explicit `--no-verify-ssl` relaxes it (and only
+ * outside production, enforced by {@link assertCredentialTlsAllowed}).
+ */
+export declare function credentialHttpsAgent(verifySsl: boolean | undefined): https.Agent;
+/**
+ * POST /api/auth/login and return the access token (or `undefined` if the
+ * response carried none). Rate-limit accounting (record success/failure) and
+ * the no-token exit are intentionally left to the caller so each command keeps
+ * its exact lockout semantics.
+ */
+export declare function postLogin(params: {
+    url: string;
+    identifier: string;
+    password: string;
+    httpsAgent: https.Agent;
+    timeout: number;
+}): Promise<string | undefined>;
+/**
+ * POST /api/auth/switch-org with the current access token and return the new,
+ * org-scoped access token. Prints a success line (unless `quiet`) and hard-exits
+ * on a missing token — both credential commands treat a failed switch the same.
+ */
+export declare function switchOrganization(params: {
+    url: string;
+    orgId: string;
+    accessToken: string;
+    httpsAgent: https.Agent;
+    timeout: number;
+    quiet: boolean;
+}): Promise<string>;
+//# sourceMappingURL=auth-utils.d.ts.map

package/dist/utils/auth-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-utils.d.ts","sourceRoot":"","sources":["../../src/utils/auth-utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAK/E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAKA;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,KAAK,CAAC,KAAK,CAEhF;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS9B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlB"}

package/dist/utils/auth-utils.js

@@ -0,0 +1,77 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import https from 'https';
+import axios from 'axios';
+import { ERROR_CODES } from './error-handler.js';
+import { printDebug, printError, printSuccess } from './output-utils.js';
+import { isProductionEnv } from './tls.js';
+/**
+ * Guard the credential-transmitting commands (`login`, `create-pat`) against
+ * disabling TLS verification in production. These POST plaintext passwords/JWTs,
+ * so a MITM on a `prod + --no-verify-ssl` run would harvest them.
+ *
+ * Unlike {@link assertSslDisableAllowed} (which throws — for paths already inside
+ * a try/catch), this prints and hard-exits, matching the pre-flight checks these
+ * commands run before their try block. In non-production it is a no-op, so
+ * `--no-verify-ssl` still works against self-signed dev platforms.
+ */
+export function assertCredentialTlsAllowed(verifySsl) {
+    if (verifySsl === false && isProductionEnv()) {
+        printError('Refusing to disable TLS verification in production (NODE_ENV=production) — credentials must not be transmitted over an unverified connection. Use a valid certificate, or unset NODE_ENV for local/self-signed development.');
+        process.exit(ERROR_CODES.AUTHENTICATION);
+    }
+}
+/**
+ * Resolve credentials from flags, falling back to the
+ * PLATFORM_IDENTIFIER / PLATFORM_PASSWORD env vars (so the password need not
+ * appear in shell history / `ps`).
+ */
+export function resolveCredentials(options) {
+    return {
+        identifier: options.identifier || process.env.PLATFORM_IDENTIFIER,
+        password: options.password || process.env.PLATFORM_PASSWORD,
+    };
+}
+/**
+ * Build the https agent used by the credential commands. `--verify-ssl`
+ * defaults to on; only an explicit `--no-verify-ssl` relaxes it (and only
+ * outside production, enforced by {@link assertCredentialTlsAllowed}).
+ */
+export function credentialHttpsAgent(verifySsl) {
+    return new https.Agent({ rejectUnauthorized: verifySsl ?? true });
+}
+/**
+ * POST /api/auth/login and return the access token (or `undefined` if the
+ * response carried none). Rate-limit accounting (record success/failure) and
+ * the no-token exit are intentionally left to the caller so each command keeps
+ * its exact lockout semantics.
+ */
+export async function postLogin(params) {
+    const loginUrl = `${params.url}/api/auth/login`;
+    printDebug('POST', { url: loginUrl });
+    const response = await axios.post(loginUrl, { identifier: params.identifier, password: params.password }, { headers: { 'Content-Type': 'application/json' }, httpsAgent: params.httpsAgent, timeout: params.timeout });
+    return response.data?.data?.accessToken;
+}
+/**
+ * POST /api/auth/switch-org with the current access token and return the new,
+ * org-scoped access token. Prints a success line (unless `quiet`) and hard-exits
+ * on a missing token — both credential commands treat a failed switch the same.
+ */
+export async function switchOrganization(params) {
+    const switchUrl = `${params.url}/api/auth/switch-org`;
+    printDebug('POST', { url: switchUrl });
+    const response = await axios.post(switchUrl, { organizationId: params.orgId }, {
+        headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${params.accessToken}` },
+        httpsAgent: params.httpsAgent,
+        timeout: params.timeout,
+    });
+    const switched = response.data?.data?.accessToken;
+    if (!switched) {
+        printError('Organization switch failed: no access token in response');
+        process.exit(ERROR_CODES.AUTHENTICATION);
+    }
+    if (!params.quiet)
+        printSuccess(`Switched to organization ${params.orgId}`);
+    return switched;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC11dGlscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9hdXRoLXV0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxLQUFLLE1BQU0sT0FBTyxDQUFDO0FBQzFCLE9BQU8sS0FBSyxNQUFNLE9BQU8sQ0FBQztBQUMxQixPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDakQsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDekUsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLFVBQVUsQ0FBQztBQWMzQzs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLFVBQVUsMEJBQTBCLENBQUMsU0FBOEI7SUFDdkUsSUFBSSxTQUFTLEtBQUssS0FBSyxJQUFJLGVBQWUsRUFBRSxFQUFFLENBQUM7UUFDN0MsVUFBVSxDQUFDLDZOQUE2TixDQUFDLENBQUM7UUFDMU8sT0FBTyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDM0MsQ0FBQztBQUNILENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLGtCQUFrQixDQUFDLE9BQW1EO0lBSXBGLE9BQU87UUFDTCxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVUsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQjtRQUNqRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQjtLQUM1RCxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLFVBQVUsb0JBQW9CLENBQUMsU0FBOEI7SUFDakUsT0FBTyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxTQUFTLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztBQUNwRSxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLFNBQVMsQ0FBQyxNQU0vQjtJQUNDLE1BQU0sUUFBUSxHQUFHLEdBQUcsTUFBTSxDQUFDLEdBQUcsaUJBQWlCLENBQUM7SUFDaEQsVUFBVSxDQUFDLE1BQU0sRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sUUFBUSxHQUFHLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FDL0IsUUFBUSxFQUNSLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLEVBQUUsRUFDNUQsRUFBRSxPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUUsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUM1RyxDQUFDO0lBQ0YsT0FBTyxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxXQUFXLENBQUM7QUFDMUMsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUFDLE1BT3hDO0lBQ0MsTUFBTSxTQUFTLEdBQUcsR0FBRyxNQUFNLENBQUMsR0FBRyxzQkFBc0IsQ0FBQztJQUN0RCxVQUFVLENBQUMsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDdkMsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUMvQixTQUFTLEVBQ1QsRUFBRSxjQUFjLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxFQUNoQztRQUNFLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxlQUFlLEVBQUUsVUFBVSxNQUFNLENBQUMsV0FBVyxFQUFFLEVBQUU7UUFDaEcsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1FBQzdCLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTztLQUN4QixDQUNGLENBQUM7SUFDRixNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxXQUFXLENBQUM7SUFDbEQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ2QsVUFBVSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7UUFDdEUsT0FBTyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSztRQUFFLFlBQVksQ0FBQyw0QkFBNEIsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDNUUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8vIENvcHlyaWdodCAyMDI2IFBpcGVsaW5lIEJ1aWxkZXIgQ29udHJpYnV0b3JzXG4vLyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMFxuXG5pbXBvcnQgaHR0cHMgZnJvbSAnaHR0cHMnO1xuaW1wb3J0IGF4aW9zIGZyb20gJ2F4aW9zJztcbmltcG9ydCB7IEVSUk9SX0NPREVTIH0gZnJvbSAnLi9lcnJvci1oYW5kbGVyLmpzJztcbmltcG9ydCB7IHByaW50RGVidWcsIHByaW50RXJyb3IsIHByaW50U3VjY2VzcyB9IGZyb20gJy4vb3V0cHV0LXV0aWxzLmpzJztcbmltcG9ydCB7IGlzUHJvZHVjdGlvbkVudiB9IGZyb20gJy4vdGxzLmpzJztcblxuLyoqXG4gKiBMb2dpbiAvIHJlZnJlc2ggLyBzd2l0Y2gtb3JnIHJlc3BvbnNlIOKAlCBldmVyeSBwbGF0Zm9ybSBhdXRoIGVuZHBvaW50IHJldHVybnNcbiAqIHRoZSBzZXNzaW9uIHRva2VucyB1bmRlciB0aGlzIGVudmVsb3BlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhSZXNwb25zZSB7XG4gIHN1Y2Nlc3M6IGJvb2xlYW47XG4gIGRhdGE6IHtcbiAgICBhY2Nlc3NUb2tlbjogc3RyaW5nO1xuICAgIHJlZnJlc2hUb2tlbjogc3RyaW5nO1xuICB9O1xufVxuXG4vKipcbiAqIEd1YXJkIHRoZSBjcmVkZW50aWFsLXRyYW5zbWl0dGluZyBjb21tYW5kcyAoYGxvZ2luYCwgYGNyZWF0ZS1wYXRgKSBhZ2FpbnN0XG4gKiBkaXNhYmxpbmcgVExTIHZlcmlmaWNhdGlvbiBpbiBwcm9kdWN0aW9uLiBUaGVzZSBQT1NUIHBsYWludGV4dCBwYXNzd29yZHMvSldUcyxcbiAqIHNvIGEgTUlUTSBvbiBhIGBwcm9kICsgLS1uby12ZXJpZnktc3NsYCBydW4gd291bGQgaGFydmVzdCB0aGVtLlxuICpcbiAqIFVubGlrZSB7QGxpbmsgYXNzZXJ0U3NsRGlzYWJsZUFsbG93ZWR9ICh3aGljaCB0aHJvd3Mg4oCUIGZvciBwYXRocyBhbHJlYWR5IGluc2lkZVxuICogYSB0cnkvY2F0Y2gpLCB0aGlzIHByaW50cyBhbmQgaGFyZC1leGl0cywgbWF0Y2hpbmcgdGhlIHByZS1mbGlnaHQgY2hlY2tzIHRoZXNlXG4gKiBjb21tYW5kcyBydW4gYmVmb3JlIHRoZWlyIHRyeSBibG9jay4gSW4gbm9uLXByb2R1Y3Rpb24gaXQgaXMgYSBuby1vcCwgc29cbiAqIGAtLW5vLXZlcmlmeS1zc2xgIHN0aWxsIHdvcmtzIGFnYWluc3Qgc2VsZi1zaWduZWQgZGV2IHBsYXRmb3Jtcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFzc2VydENyZWRlbnRpYWxUbHNBbGxvd2VkKHZlcmlmeVNzbDogYm9vbGVhbiB8IHVuZGVmaW5lZCk6IHZvaWQge1xuICBpZiAodmVyaWZ5U3NsID09PSBmYWxzZSAmJiBpc1Byb2R1Y3Rpb25FbnYoKSkge1xuICAgIHByaW50RXJyb3IoJ1JlZnVzaW5nIHRvIGRpc2FibGUgVExTIHZlcmlmaWNhdGlvbiBpbiBwcm9kdWN0aW9uIChOT0RFX0VOVj1wcm9kdWN0aW9uKSDigJQgY3JlZGVudGlhbHMgbXVzdCBub3QgYmUgdHJhbnNtaXR0ZWQgb3ZlciBhbiB1bnZlcmlmaWVkIGNvbm5lY3Rpb24uIFVzZSBhIHZhbGlkIGNlcnRpZmljYXRlLCBvciB1bnNldCBOT0RFX0VOViBmb3IgbG9jYWwvc2VsZi1zaWduZWQgZGV2ZWxvcG1lbnQuJyk7XG4gICAgcHJvY2Vzcy5leGl0KEVSUk9SX0NPREVTLkFVVEhFTlRJQ0FUSU9OKTtcbiAgfVxufVxuXG4vKipcbiAqIFJlc29sdmUgY3JlZGVudGlhbHMgZnJvbSBmbGFncywgZmFsbGluZyBiYWNrIHRvIHRoZVxuICogUExBVEZPUk1fSURFTlRJRklFUiAvIFBMQVRGT1JNX1BBU1NXT1JEIGVudiB2YXJzIChzbyB0aGUgcGFzc3dvcmQgbmVlZCBub3RcbiAqIGFwcGVhciBpbiBzaGVsbCBoaXN0b3J5IC8gYHBzYCkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlQ3JlZGVudGlhbHMob3B0aW9uczogeyBpZGVudGlmaWVyPzogc3RyaW5nOyBwYXNzd29yZD86IHN0cmluZyB9KToge1xuICBpZGVudGlmaWVyPzogc3RyaW5nO1xuICBwYXNzd29yZD86IHN0cmluZztcbn0ge1xuICByZXR1cm4ge1xuICAgIGlkZW50aWZpZXI6IG9wdGlvbnMuaWRlbnRpZmllciB8fCBwcm9jZXNzLmVudi5QTEFURk9STV9JREVOVElGSUVSLFxuICAgIHBhc3N3b3JkOiBvcHRpb25zLnBhc3N3b3JkIHx8IHByb2Nlc3MuZW52LlBMQVRGT1JNX1BBU1NXT1JELFxuICB9O1xufVxuXG4vKipcbiAqIEJ1aWxkIHRoZSBodHRwcyBhZ2VudCB1c2VkIGJ5IHRoZSBjcmVkZW50aWFsIGNvbW1hbmRzLiBgLS12ZXJpZnktc3NsYFxuICogZGVmYXVsdHMgdG8gb247IG9ubHkgYW4gZXhwbGljaXQgYC0tbm8tdmVyaWZ5LXNzbGAgcmVsYXhlcyBpdCAoYW5kIG9ubHlcbiAqIG91dHNpZGUgcHJvZHVjdGlvbiwgZW5mb3JjZWQgYnkge0BsaW5rIGFzc2VydENyZWRlbnRpYWxUbHNBbGxvd2VkfSkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVkZW50aWFsSHR0cHNBZ2VudCh2ZXJpZnlTc2w6IGJvb2xlYW4gfCB1bmRlZmluZWQpOiBodHRwcy5BZ2VudCB7XG4gIHJldHVybiBuZXcgaHR0cHMuQWdlbnQoeyByZWplY3RVbmF1dGhvcml6ZWQ6IHZlcmlmeVNzbCA/PyB0cnVlIH0pO1xufVxuXG4vKipcbiAqIFBPU1QgL2FwaS9hdXRoL2xvZ2luIGFuZCByZXR1cm4gdGhlIGFjY2VzcyB0b2tlbiAob3IgYHVuZGVmaW5lZGAgaWYgdGhlXG4gKiByZXNwb25zZSBjYXJyaWVkIG5vbmUpLiBSYXRlLWxpbWl0IGFjY291bnRpbmcgKHJlY29yZCBzdWNjZXNzL2ZhaWx1cmUpIGFuZFxuICogdGhlIG5vLXRva2VuIGV4aXQgYXJlIGludGVudGlvbmFsbHkgbGVmdCB0byB0aGUgY2FsbGVyIHNvIGVhY2ggY29tbWFuZCBrZWVwc1xuICogaXRzIGV4YWN0IGxvY2tvdXQgc2VtYW50aWNzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcG9zdExvZ2luKHBhcmFtczoge1xuICB1cmw6IHN0cmluZztcbiAgaWRlbnRpZmllcjogc3RyaW5nO1xuICBwYXNzd29yZDogc3RyaW5nO1xuICBodHRwc0FnZW50OiBodHRwcy5BZ2VudDtcbiAgdGltZW91dDogbnVtYmVyO1xufSk6IFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPiB7XG4gIGNvbnN0IGxvZ2luVXJsID0gYCR7cGFyYW1zLnVybH0vYXBpL2F1dGgvbG9naW5gO1xuICBwcmludERlYnVnKCdQT1NUJywgeyB1cmw6IGxvZ2luVXJsIH0pO1xuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGF4aW9zLnBvc3Q8QXV0aFJlc3BvbnNlPihcbiAgICBsb2dpblVybCxcbiAgICB7IGlkZW50aWZpZXI6IHBhcmFtcy5pZGVudGlmaWVyLCBwYXNzd29yZDogcGFyYW1zLnBhc3N3b3JkIH0sXG4gICAgeyBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSwgaHR0cHNBZ2VudDogcGFyYW1zLmh0dHBzQWdlbnQsIHRpbWVvdXQ6IHBhcmFtcy50aW1lb3V0IH0sXG4gICk7XG4gIHJldHVybiByZXNwb25zZS5kYXRhPy5kYXRhPy5hY2Nlc3NUb2tlbjtcbn1cblxuLyoqXG4gKiBQT1NUIC9hcGkvYXV0aC9zd2l0Y2gtb3JnIHdpdGggdGhlIGN1cnJlbnQgYWNjZXNzIHRva2VuIGFuZCByZXR1cm4gdGhlIG5ldyxcbiAqIG9yZy1zY29wZWQgYWNjZXNzIHRva2VuLiBQcmludHMgYSBzdWNjZXNzIGxpbmUgKHVubGVzcyBgcXVpZXRgKSBhbmQgaGFyZC1leGl0c1xuICogb24gYSBtaXNzaW5nIHRva2VuIOKAlCBib3RoIGNyZWRlbnRpYWwgY29tbWFuZHMgdHJlYXQgYSBmYWlsZWQgc3dpdGNoIHRoZSBzYW1lLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gc3dpdGNoT3JnYW5pemF0aW9uKHBhcmFtczoge1xuICB1cmw6IHN0cmluZztcbiAgb3JnSWQ6IHN0cmluZztcbiAgYWNjZXNzVG9rZW46IHN0cmluZztcbiAgaHR0cHNBZ2VudDogaHR0cHMuQWdlbnQ7XG4gIHRpbWVvdXQ6IG51bWJlcjtcbiAgcXVpZXQ6IGJvb2xlYW47XG59KTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3Qgc3dpdGNoVXJsID0gYCR7cGFyYW1zLnVybH0vYXBpL2F1dGgvc3dpdGNoLW9yZ2A7XG4gIHByaW50RGVidWcoJ1BPU1QnLCB7IHVybDogc3dpdGNoVXJsIH0pO1xuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGF4aW9zLnBvc3Q8QXV0aFJlc3BvbnNlPihcbiAgICBzd2l0Y2hVcmwsXG4gICAgeyBvcmdhbml6YXRpb25JZDogcGFyYW1zLm9yZ0lkIH0sXG4gICAge1xuICAgICAgaGVhZGVyczogeyAnQ29udGVudC1UeXBlJzogJ2FwcGxpY2F0aW9uL2pzb24nLCAnQXV0aG9yaXphdGlvbic6IGBCZWFyZXIgJHtwYXJhbXMuYWNjZXNzVG9rZW59YCB9LFxuICAgICAgaHR0cHNBZ2VudDogcGFyYW1zLmh0dHBzQWdlbnQsXG4gICAgICB0aW1lb3V0OiBwYXJhbXMudGltZW91dCxcbiAgICB9LFxuICApO1xuICBjb25zdCBzd2l0Y2hlZCA9IHJlc3BvbnNlLmRhdGE/LmRhdGE/LmFjY2Vzc1Rva2VuO1xuICBpZiAoIXN3aXRjaGVkKSB7XG4gICAgcHJpbnRFcnJvcignT3JnYW5pemF0aW9uIHN3aXRjaCBmYWlsZWQ6IG5vIGFjY2VzcyB0b2tlbiBpbiByZXNwb25zZScpO1xuICAgIHByb2Nlc3MuZXhpdChFUlJPUl9DT0RFUy5BVVRIRU5USUNBVElPTik7XG4gIH1cbiAgaWYgKCFwYXJhbXMucXVpZXQpIHByaW50U3VjY2VzcyhgU3dpdGNoZWQgdG8gb3JnYW5pemF0aW9uICR7cGFyYW1zLm9yZ0lkfWApO1xuICByZXR1cm4gc3dpdGNoZWQ7XG59XG4iXX0=

package/dist/utils/aws-env.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Resolve the AWS region for an SDK/CLI call: explicit `--region` override →
+ * `AWS_REGION` → `CDK_DEFAULT_REGION` → `us-east-1`. Single source for the
+ * fallback that was previously copy-pasted across every AWS command and the
+ * secrets client.
+ */
+export declare function resolveAwsRegion(override?: string): string;
+/**
+ * Apply a `--profile` to the environment so the AWS SDK's default provider chain
+ * (which every client we build with `credentials` unset reads) selects that shared
+ * profile. **Call BEFORE constructing any SDK client**, or `--profile` is silently
+ * dropped and the client hits the default account — a silent split-brain when the
+ * accompanying CLI/`cdk` call *did* honor `--profile`.
+ *
+ * Precedence: ambient env credentials (`AWS_ACCESS_KEY_ID`) and an inherited
+ * `AWS_PROFILE` always win — we never clobber the caller's environment. An
+ * explicit non-default `--profile` that's overridden by ambient creds is surfaced
+ * as a warning so a silently-ignored flag isn't a surprise.
+ */
+export declare function applyAwsProfile(profile?: string): void;
+//# sourceMappingURL=aws-env.d.ts.map

package/dist/utils/aws-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-env.d.ts","sourceRoot":"","sources":["../../src/utils/aws-env.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAStD"}

package/dist/utils/aws-env.js

@@ -0,0 +1,34 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { printWarning } from './output-utils.js';
+/**
+ * Resolve the AWS region for an SDK/CLI call: explicit `--region` override →
+ * `AWS_REGION` → `CDK_DEFAULT_REGION` → `us-east-1`. Single source for the
+ * fallback that was previously copy-pasted across every AWS command and the
+ * secrets client.
+ */
+export function resolveAwsRegion(override) {
+    return override || process.env.AWS_REGION || process.env.CDK_DEFAULT_REGION || 'us-east-1';
+}
+/**
+ * Apply a `--profile` to the environment so the AWS SDK's default provider chain
+ * (which every client we build with `credentials` unset reads) selects that shared
+ * profile. **Call BEFORE constructing any SDK client**, or `--profile` is silently
+ * dropped and the client hits the default account — a silent split-brain when the
+ * accompanying CLI/`cdk` call *did* honor `--profile`.
+ *
+ * Precedence: ambient env credentials (`AWS_ACCESS_KEY_ID`) and an inherited
+ * `AWS_PROFILE` always win — we never clobber the caller's environment. An
+ * explicit non-default `--profile` that's overridden by ambient creds is surfaced
+ * as a warning so a silently-ignored flag isn't a surprise.
+ */
+export function applyAwsProfile(profile) {
+    if (profile && !process.env.AWS_ACCESS_KEY_ID && !process.env.AWS_PROFILE) {
+        process.env.AWS_PROFILE = profile;
+    }
+    else if (profile && profile !== 'default') {
+        printWarning(`--profile ${profile} ignored: existing AWS credentials in the environment ` +
+            `(${process.env.AWS_ACCESS_KEY_ID ? 'AWS_ACCESS_KEY_ID' : 'AWS_PROFILE'}) take precedence.`);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXdzLWVudi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlscy9hd3MtZW52LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRWpEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLFFBQWlCO0lBQ2hELE9BQU8sUUFBUSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLElBQUksV0FBVyxDQUFDO0FBQzdGLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sVUFBVSxlQUFlLENBQUMsT0FBZ0I7SUFDOUMsSUFBSSxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQixJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUMxRSxPQUFPLENBQUMsR0FBRyxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUM7SUFDcEMsQ0FBQztTQUFNLElBQUksT0FBTyxJQUFJLE9BQU8sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM1QyxZQUFZLENBQ1YsYUFBYSxPQUFPLHdEQUF3RDtZQUM1RSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQyxhQUFhLG9CQUFvQixDQUM1RixDQUFDO0lBQ0osQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgcHJpbnRXYXJuaW5nIH0gZnJvbSAnLi9vdXRwdXQtdXRpbHMuanMnO1xuXG4vKipcbiAqIFJlc29sdmUgdGhlIEFXUyByZWdpb24gZm9yIGFuIFNESy9DTEkgY2FsbDogZXhwbGljaXQgYC0tcmVnaW9uYCBvdmVycmlkZSDihpJcbiAqIGBBV1NfUkVHSU9OYCDihpIgYENES19ERUZBVUxUX1JFR0lPTmAg4oaSIGB1cy1lYXN0LTFgLiBTaW5nbGUgc291cmNlIGZvciB0aGVcbiAqIGZhbGxiYWNrIHRoYXQgd2FzIHByZXZpb3VzbHkgY29weS1wYXN0ZWQgYWNyb3NzIGV2ZXJ5IEFXUyBjb21tYW5kIGFuZCB0aGVcbiAqIHNlY3JldHMgY2xpZW50LlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZUF3c1JlZ2lvbihvdmVycmlkZT86IHN0cmluZyk6IHN0cmluZyB7XG4gIHJldHVybiBvdmVycmlkZSB8fCBwcm9jZXNzLmVudi5BV1NfUkVHSU9OIHx8IHByb2Nlc3MuZW52LkNES19ERUZBVUxUX1JFR0lPTiB8fCAndXMtZWFzdC0xJztcbn1cblxuLyoqXG4gKiBBcHBseSBhIGAtLXByb2ZpbGVgIHRvIHRoZSBlbnZpcm9ubWVudCBzbyB0aGUgQVdTIFNESydzIGRlZmF1bHQgcHJvdmlkZXIgY2hhaW5cbiAqICh3aGljaCBldmVyeSBjbGllbnQgd2UgYnVpbGQgd2l0aCBgY3JlZGVudGlhbHNgIHVuc2V0IHJlYWRzKSBzZWxlY3RzIHRoYXQgc2hhcmVkXG4gKiBwcm9maWxlLiAqKkNhbGwgQkVGT1JFIGNvbnN0cnVjdGluZyBhbnkgU0RLIGNsaWVudCoqLCBvciBgLS1wcm9maWxlYCBpcyBzaWxlbnRseVxuICogZHJvcHBlZCBhbmQgdGhlIGNsaWVudCBoaXRzIHRoZSBkZWZhdWx0IGFjY291bnQg4oCUIGEgc2lsZW50IHNwbGl0LWJyYWluIHdoZW4gdGhlXG4gKiBhY2NvbXBhbnlpbmcgQ0xJL2BjZGtgIGNhbGwgKmRpZCogaG9ub3IgYC0tcHJvZmlsZWAuXG4gKlxuICogUHJlY2VkZW5jZTogYW1iaWVudCBlbnYgY3JlZGVudGlhbHMgKGBBV1NfQUNDRVNTX0tFWV9JRGApIGFuZCBhbiBpbmhlcml0ZWRcbiAqIGBBV1NfUFJPRklMRWAgYWx3YXlzIHdpbiDigJQgd2UgbmV2ZXIgY2xvYmJlciB0aGUgY2FsbGVyJ3MgZW52aXJvbm1lbnQuIEFuXG4gKiBleHBsaWNpdCBub24tZGVmYXVsdCBgLS1wcm9maWxlYCB0aGF0J3Mgb3ZlcnJpZGRlbiBieSBhbWJpZW50IGNyZWRzIGlzIHN1cmZhY2VkXG4gKiBhcyBhIHdhcm5pbmcgc28gYSBzaWxlbnRseS1pZ25vcmVkIGZsYWcgaXNuJ3QgYSBzdXJwcmlzZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFwcGx5QXdzUHJvZmlsZShwcm9maWxlPzogc3RyaW5nKTogdm9pZCB7XG4gIGlmIChwcm9maWxlICYmICFwcm9jZXNzLmVudi5BV1NfQUNDRVNTX0tFWV9JRCAmJiAhcHJvY2Vzcy5lbnYuQVdTX1BST0ZJTEUpIHtcbiAgICBwcm9jZXNzLmVudi5BV1NfUFJPRklMRSA9IHByb2ZpbGU7XG4gIH0gZWxzZSBpZiAocHJvZmlsZSAmJiBwcm9maWxlICE9PSAnZGVmYXVsdCcpIHtcbiAgICBwcmludFdhcm5pbmcoXG4gICAgICBgLS1wcm9maWxlICR7cHJvZmlsZX0gaWdub3JlZDogZXhpc3RpbmcgQVdTIGNyZWRlbnRpYWxzIGluIHRoZSBlbnZpcm9ubWVudCBgICtcbiAgICAgIGAoJHtwcm9jZXNzLmVudi5BV1NfQUNDRVNTX0tFWV9JRCA/ICdBV1NfQUNDRVNTX0tFWV9JRCcgOiAnQVdTX1BST0ZJTEUnfSkgdGFrZSBwcmVjZWRlbmNlLmAsXG4gICAgKTtcbiAgfVxufVxuIl19