@pipeline-builder/pipeline-manager 0.0.1

package/dist/utils/registry.js

@@ -0,0 +1,140 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { promises as fs } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { parsePlatformBaseUrl } from '@pipeline-builder/pipeline-core';
+import { resolveAwsRegion } from './aws-env.js';
+import { printInfo } from './output-utils.js';
+import { defaultPipelineName } from '../config/cli.constants.js';
+/**
+ * Helpers for registering a deployed pipeline ARN with the platform.
+ *
+ * The registry table maps deployed CodePipeline ARNs back to pipeline records
+ * and orgs. It's how the dashboard's "Deployed pipelines" panel and the event
+ * reporting Lambda resolve incoming events to a pipeline definition.
+ *
+ * Two failure modes are handled here:
+ *
+ *   1. Platform unreachable at deploy time. The CDK stack lands in AWS but the
+ *      registry POST fails. Without retry the deploy command would have to
+ *      re-run cdk-deploy (slow, sometimes blocked by stack state) just to
+ *      record the ARN. Instead, we write a pending intent to a local file;
+ *      `pipeline-manager pipeline register` drains them.
+ *
+ *   2. User explicitly invokes `pipeline-manager pipeline register --id <pipelineId>`
+ *      after a successful deploy that didn't register. Same path: rebuilds
+ *      the ARN from STS, POSTs to the platform.
+ *
+ * Pending intents store ONLY the registration payload — never tokens or URLs.
+ * Auth is supplied by whichever command drains the intent (deploy or register),
+ * so a stale intent file is never an authentication risk.
+ */
+/**
+ * Platform-sourced registry pull target for the CDK synth, derived from the
+ * platform base URL the CLI deploys against (the same host that serves the
+ * registry `/v2/` data path via nginx). Reuses pipeline-core's
+ * `parsePlatformBaseUrl` so host/port parsing stays identical on both sides.
+ * Returns `undefined` for an unparseable/absent URL. (Only the pull host/port
+ * are returned — `registry.http` describes the in-cluster push hop, which the
+ * synth never reads, so deriving it from the public URL would be misleading.)
+ */
+export function registryOverrideFromBaseUrl(baseUrl) {
+    const parsed = parsePlatformBaseUrl(baseUrl);
+    return parsed ? { pullHost: parsed.host, pullPort: parsed.port } : undefined;
+}
+/**
+ * Bake the platform-derived registry pull target into the synth props
+ * (`BuilderProps.registry`) so the CodeBuild image URIs use a host AWS CodeBuild
+ * can resolve — not the in-cluster `registry:5000` default. Shared by the
+ * `deploy` and `synth` commands.
+ *
+ * An explicit `IMAGE_REGISTRY_PULL_HOST` in the synth env takes precedence, so
+ * this is a no-op when it is set (the synth's `loadRegistryConfig` already
+ * honors it). Also a no-op for an unparseable/absent base URL.
+ */
+export function bakePlatformRegistry(props, baseUrl) {
+    if (process.env.IMAGE_REGISTRY_PULL_HOST)
+        return; // explicit env wins
+    const override = registryOverrideFromBaseUrl(baseUrl);
+    if (!override)
+        return;
+    props.registry = override;
+    printInfo('Registry pull target', { host: override.pullHost, port: override.pullPort });
+}
+/** Where pending registration intents are persisted between CLI invocations. */
+const PENDING_INTENTS_DIR = join(homedir(), '.pipeline-manager', 'pending-registrations');
+/**
+ * Build a RegistryPayload from the platform's pipeline metadata. No AWS calls
+ * and no ARN/account: the events Lambda attributes events via the pipeline's
+ * `pb.pipeline-id` tag (= pipelineId), so the registry only needs the stable
+ * pipelineId + display metadata.
+ */
+export async function buildRegistryPayload(pipeline, regionOverride) {
+    const region = resolveAwsRegion(regionOverride);
+    const pipelineName = pipeline.pipelineName
+        || defaultPipelineName(pipeline.organization, pipeline.project);
+    const stackName = `${pipeline.project}-${pipeline.organization}`.toLowerCase();
+    return {
+        pipelineId: pipeline.id,
+        orgId: pipeline.orgId,
+        pipelineName,
+        region,
+        project: pipeline.project,
+        organization: pipeline.organization,
+        stackName,
+    };
+}
+/**
+ * Persist a registration intent for later retry.
+ *
+ * Intent files are keyed by pipelineId so re-running deploy on the same
+ * pipeline overwrites rather than accumulates. We deliberately store the
+ * payload plain (not the full pipeline doc, not auth) so a stale file is
+ * safe to leave around indefinitely.
+ */
+export async function writePendingIntent(payload) {
+    await fs.mkdir(PENDING_INTENTS_DIR, { recursive: true });
+    const path = join(PENDING_INTENTS_DIR, `${payload.pipelineId}.json`);
+    await fs.writeFile(path, JSON.stringify(payload, null, 2), 'utf8');
+    return path;
+}
+/** Remove a pending intent after a successful drain. */
+export async function clearPendingIntent(pipelineId) {
+    const path = join(PENDING_INTENTS_DIR, `${pipelineId}.json`);
+    try {
+        await fs.unlink(path);
+    }
+    catch (err) {
+        // ENOENT is fine — already cleared. Anything else is a real problem.
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+}
+/** Read all pending intents currently on disk. Empty array if dir doesn't exist. */
+export async function readPendingIntents() {
+    let entries;
+    try {
+        entries = await fs.readdir(PENDING_INTENTS_DIR);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    const intents = [];
+    for (const file of entries) {
+        if (!file.endsWith('.json'))
+            continue;
+        try {
+            const text = await fs.readFile(join(PENDING_INTENTS_DIR, file), 'utf8');
+            intents.push(JSON.parse(text));
+        }
+        catch {
+            // Skip unreadable / malformed files — they'll need manual cleanup but
+            // shouldn't block valid intents from draining.
+        }
+    }
+    return intents;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0cnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvcmVnaXN0cnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsUUFBUSxJQUFJLEVBQUUsRUFBRSxNQUFNLElBQUksQ0FBQztBQUNwQyxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQzdCLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxNQUFNLENBQUM7QUFDNUIsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDdkUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUM5QyxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUVqRTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXNCRztBQUVIOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxVQUFVLDJCQUEyQixDQUN6QyxPQUEyQjtJQUUzQixNQUFNLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM3QyxPQUFPLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDL0UsQ0FBQztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sVUFBVSxvQkFBb0IsQ0FBQyxLQUE4QixFQUFFLE9BQTJCO0lBQzlGLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyx3QkFBd0I7UUFBRSxPQUFPLENBQUMsb0JBQW9CO0lBQ3RFLE1BQU0sUUFBUSxHQUFHLDJCQUEyQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3RELElBQUksQ0FBQyxRQUFRO1FBQUUsT0FBTztJQUN0QixLQUFLLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztJQUMxQixTQUFTLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxJQUFJLEVBQUUsUUFBUSxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7QUFDMUYsQ0FBQztBQXNCRCxnRkFBZ0Y7QUFDaEYsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLEVBQUUsbUJBQW1CLEVBQUUsdUJBQXVCLENBQUMsQ0FBQztBQUUxRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsb0JBQW9CLENBQ3hDLFFBQTZCLEVBQzdCLGNBQXVCO0lBRXZCLE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBRWhELE1BQU0sWUFBWSxHQUFHLFFBQVEsQ0FBQyxZQUFZO1dBQ3JDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sU0FBUyxHQUFHLEdBQUcsUUFBUSxDQUFDLE9BQU8sSUFBSSxRQUFRLENBQUMsWUFBWSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFL0UsT0FBTztRQUNMLFVBQVUsRUFBRSxRQUFRLENBQUMsRUFBRTtRQUN2QixLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUs7UUFDckIsWUFBWTtRQUNaLE1BQU07UUFDTixPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU87UUFDekIsWUFBWSxFQUFFLFFBQVEsQ0FBQyxZQUFZO1FBQ25DLFNBQVM7S0FDVixDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUFDLE9BQXdCO0lBQy9ELE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxHQUFHLE9BQU8sQ0FBQyxVQUFVLE9BQU8sQ0FBQyxDQUFDO0lBQ3JFLE1BQU0sRUFBRSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ25FLE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQztBQUVELHdEQUF3RDtBQUN4RCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUFDLFVBQWtCO0lBQ3pELE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxHQUFHLFVBQVUsT0FBTyxDQUFDLENBQUM7SUFDN0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hCLENBQUM7SUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1FBQ2IscUVBQXFFO1FBQ3JFLElBQUssR0FBNkIsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUFFLE1BQU0sR0FBRyxDQUFDO0lBQ2xFLENBQUM7QUFDSCxDQUFDO0FBRUQsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxLQUFLLFVBQVUsa0JBQWtCO0lBQ3RDLElBQUksT0FBaUIsQ0FBQztJQUN0QixJQUFJLENBQUM7UUFDSCxPQUFPLEdBQUcsTUFBTSxFQUFFLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7UUFDYixJQUFLLEdBQTZCLENBQUMsSUFBSSxLQUFLLFFBQVE7WUFBRSxPQUFPLEVBQUUsQ0FBQztRQUNoRSxNQUFNLEdBQUcsQ0FBQztJQUNaLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBc0IsRUFBRSxDQUFDO0lBQ3RDLEtBQUssTUFBTSxJQUFJLElBQUksT0FBTyxFQUFFLENBQUM7UUFDM0IsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO1lBQUUsU0FBUztRQUN0QyxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3hFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQW9CLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1Asc0VBQXNFO1lBQ3RFLCtDQUErQztRQUNqRCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgcHJvbWlzZXMgYXMgZnMgfSBmcm9tICdmcyc7XG5pbXBvcnQgeyBob21lZGlyIH0gZnJvbSAnb3MnO1xuaW1wb3J0IHsgam9pbiB9IGZyb20gJ3BhdGgnO1xuaW1wb3J0IHsgcGFyc2VQbGF0Zm9ybUJhc2VVcmwgfSBmcm9tICdAcGlwZWxpbmUtYnVpbGRlci9waXBlbGluZS1jb3JlJztcbmltcG9ydCB7IHJlc29sdmVBd3NSZWdpb24gfSBmcm9tICcuL2F3cy1lbnYuanMnO1xuaW1wb3J0IHsgcHJpbnRJbmZvIH0gZnJvbSAnLi9vdXRwdXQtdXRpbHMuanMnO1xuaW1wb3J0IHsgZGVmYXVsdFBpcGVsaW5lTmFtZSB9IGZyb20gJy4uL2NvbmZpZy9jbGkuY29uc3RhbnRzLmpzJztcblxuLyoqXG4gKiBIZWxwZXJzIGZvciByZWdpc3RlcmluZyBhIGRlcGxveWVkIHBpcGVsaW5lIEFSTiB3aXRoIHRoZSBwbGF0Zm9ybS5cbiAqXG4gKiBUaGUgcmVnaXN0cnkgdGFibGUgbWFwcyBkZXBsb3llZCBDb2RlUGlwZWxpbmUgQVJOcyBiYWNrIHRvIHBpcGVsaW5lIHJlY29yZHNcbiAqIGFuZCBvcmdzLiBJdCdzIGhvdyB0aGUgZGFzaGJvYXJkJ3MgXCJEZXBsb3llZCBwaXBlbGluZXNcIiBwYW5lbCBhbmQgdGhlIGV2ZW50XG4gKiByZXBvcnRpbmcgTGFtYmRhIHJlc29sdmUgaW5jb21pbmcgZXZlbnRzIHRvIGEgcGlwZWxpbmUgZGVmaW5pdGlvbi5cbiAqXG4gKiBUd28gZmFpbHVyZSBtb2RlcyBhcmUgaGFuZGxlZCBoZXJlOlxuICpcbiAqICAgMS4gUGxhdGZvcm0gdW5yZWFjaGFibGUgYXQgZGVwbG95IHRpbWUuIFRoZSBDREsgc3RhY2sgbGFuZHMgaW4gQVdTIGJ1dCB0aGVcbiAqICAgICAgcmVnaXN0cnkgUE9TVCBmYWlscy4gV2l0aG91dCByZXRyeSB0aGUgZGVwbG95IGNvbW1hbmQgd291bGQgaGF2ZSB0b1xuICogICAgICByZS1ydW4gY2RrLWRlcGxveSAoc2xvdywgc29tZXRpbWVzIGJsb2NrZWQgYnkgc3RhY2sgc3RhdGUpIGp1c3QgdG9cbiAqICAgICAgcmVjb3JkIHRoZSBBUk4uIEluc3RlYWQsIHdlIHdyaXRlIGEgcGVuZGluZyBpbnRlbnQgdG8gYSBsb2NhbCBmaWxlO1xuICogICAgICBgcGlwZWxpbmUtbWFuYWdlciBwaXBlbGluZSByZWdpc3RlcmAgZHJhaW5zIHRoZW0uXG4gKlxuICogICAyLiBVc2VyIGV4cGxpY2l0bHkgaW52b2tlcyBgcGlwZWxpbmUtbWFuYWdlciBwaXBlbGluZSByZWdpc3RlciAtLWlkIDxwaXBlbGluZUlkPmBcbiAqICAgICAgYWZ0ZXIgYSBzdWNjZXNzZnVsIGRlcGxveSB0aGF0IGRpZG4ndCByZWdpc3Rlci4gU2FtZSBwYXRoOiByZWJ1aWxkc1xuICogICAgICB0aGUgQVJOIGZyb20gU1RTLCBQT1NUcyB0byB0aGUgcGxhdGZvcm0uXG4gKlxuICogUGVuZGluZyBpbnRlbnRzIHN0b3JlIE9OTFkgdGhlIHJlZ2lzdHJhdGlvbiBwYXlsb2FkIOKAlCBuZXZlciB0b2tlbnMgb3IgVVJMcy5cbiAqIEF1dGggaXMgc3VwcGxpZWQgYnkgd2hpY2hldmVyIGNvbW1hbmQgZHJhaW5zIHRoZSBpbnRlbnQgKGRlcGxveSBvciByZWdpc3RlciksXG4gKiBzbyBhIHN0YWxlIGludGVudCBmaWxlIGlzIG5ldmVyIGFuIGF1dGhlbnRpY2F0aW9uIHJpc2suXG4gKi9cblxuLyoqXG4gKiBQbGF0Zm9ybS1zb3VyY2VkIHJlZ2lzdHJ5IHB1bGwgdGFyZ2V0IGZvciB0aGUgQ0RLIHN5bnRoLCBkZXJpdmVkIGZyb20gdGhlXG4gKiBwbGF0Zm9ybSBiYXNlIFVSTCB0aGUgQ0xJIGRlcGxveXMgYWdhaW5zdCAodGhlIHNhbWUgaG9zdCB0aGF0IHNlcnZlcyB0aGVcbiAqIHJlZ2lzdHJ5IGAvdjIvYCBkYXRhIHBhdGggdmlhIG5naW54KS4gUmV1c2VzIHBpcGVsaW5lLWNvcmUnc1xuICogYHBhcnNlUGxhdGZvcm1CYXNlVXJsYCBzbyBob3N0L3BvcnQgcGFyc2luZyBzdGF5cyBpZGVudGljYWwgb24gYm90aCBzaWRlcy5cbiAqIFJldHVybnMgYHVuZGVmaW5lZGAgZm9yIGFuIHVucGFyc2VhYmxlL2Fic2VudCBVUkwuIChPbmx5IHRoZSBwdWxsIGhvc3QvcG9ydFxuICogYXJlIHJldHVybmVkIOKAlCBgcmVnaXN0cnkuaHR0cGAgZGVzY3JpYmVzIHRoZSBpbi1jbHVzdGVyIHB1c2ggaG9wLCB3aGljaCB0aGVcbiAqIHN5bnRoIG5ldmVyIHJlYWRzLCBzbyBkZXJpdmluZyBpdCBmcm9tIHRoZSBwdWJsaWMgVVJMIHdvdWxkIGJlIG1pc2xlYWRpbmcuKVxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVnaXN0cnlPdmVycmlkZUZyb21CYXNlVXJsKFxuICBiYXNlVXJsOiBzdHJpbmcgfCB1bmRlZmluZWQsXG4pOiB7IHB1bGxIb3N0OiBzdHJpbmc7IHB1bGxQb3J0OiBudW1iZXIgfSB8IHVuZGVmaW5lZCB7XG4gIGNvbnN0IHBhcnNlZCA9IHBhcnNlUGxhdGZvcm1CYXNlVXJsKGJhc2VVcmwpO1xuICByZXR1cm4gcGFyc2VkID8geyBwdWxsSG9zdDogcGFyc2VkLmhvc3QsIHB1bGxQb3J0OiBwYXJzZWQucG9ydCB9IDogdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIEJha2UgdGhlIHBsYXRmb3JtLWRlcml2ZWQgcmVnaXN0cnkgcHVsbCB0YXJnZXQgaW50byB0aGUgc3ludGggcHJvcHNcbiAqIChgQnVpbGRlclByb3BzLnJlZ2lzdHJ5YCkgc28gdGhlIENvZGVCdWlsZCBpbWFnZSBVUklzIHVzZSBhIGhvc3QgQVdTIENvZGVCdWlsZFxuICogY2FuIHJlc29sdmUg4oCUIG5vdCB0aGUgaW4tY2x1c3RlciBgcmVnaXN0cnk6NTAwMGAgZGVmYXVsdC4gU2hhcmVkIGJ5IHRoZVxuICogYGRlcGxveWAgYW5kIGBzeW50aGAgY29tbWFuZHMuXG4gKlxuICogQW4gZXhwbGljaXQgYElNQUdFX1JFR0lTVFJZX1BVTExfSE9TVGAgaW4gdGhlIHN5bnRoIGVudiB0YWtlcyBwcmVjZWRlbmNlLCBzb1xuICogdGhpcyBpcyBhIG5vLW9wIHdoZW4gaXQgaXMgc2V0ICh0aGUgc3ludGgncyBgbG9hZFJlZ2lzdHJ5Q29uZmlnYCBhbHJlYWR5XG4gKiBob25vcnMgaXQpLiBBbHNvIGEgbm8tb3AgZm9yIGFuIHVucGFyc2VhYmxlL2Fic2VudCBiYXNlIFVSTC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJha2VQbGF0Zm9ybVJlZ2lzdHJ5KHByb3BzOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiwgYmFzZVVybDogc3RyaW5nIHwgdW5kZWZpbmVkKTogdm9pZCB7XG4gIGlmIChwcm9jZXNzLmVudi5JTUFHRV9SRUdJU1RSWV9QVUxMX0hPU1QpIHJldHVybjsgLy8gZXhwbGljaXQgZW52IHdpbnNcbiAgY29uc3Qgb3ZlcnJpZGUgPSByZWdpc3RyeU92ZXJyaWRlRnJvbUJhc2VVcmwoYmFzZVVybCk7XG4gIGlmICghb3ZlcnJpZGUpIHJldHVybjtcbiAgcHJvcHMucmVnaXN0cnkgPSBvdmVycmlkZTtcbiAgcHJpbnRJbmZvKCdSZWdpc3RyeSBwdWxsIHRhcmdldCcsIHsgaG9zdDogb3ZlcnJpZGUucHVsbEhvc3QsIHBvcnQ6IG92ZXJyaWRlLnB1bGxQb3J0IH0pO1xufVxuXG4vKiogU2hhcGUgb2YgdGhlIGJvZHkgUE9TVGVkIHRvIC9hcGkvcGlwZWxpbmVzL3JlZ2lzdHJ5LiAqL1xuZXhwb3J0IGludGVyZmFjZSBSZWdpc3RyeVBheWxvYWQge1xuICBwaXBlbGluZUlkOiBzdHJpbmc7XG4gIG9yZ0lkOiBzdHJpbmc7XG4gIHBpcGVsaW5lTmFtZTogc3RyaW5nO1xuICByZWdpb246IHN0cmluZztcbiAgcHJvamVjdDogc3RyaW5nO1xuICBvcmdhbml6YXRpb246IHN0cmluZztcbiAgc3RhY2tOYW1lOiBzdHJpbmc7XG59XG5cbi8qKiBQaXBlbGluZSBmaWVsZHMgbmVlZGVkIHRvIGNvbnN0cnVjdCBhIFJlZ2lzdHJ5UGF5bG9hZC4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUGlwZWxpbmVGb3JSZWdpc3RyeSB7XG4gIGlkOiBzdHJpbmc7XG4gIG9yZ0lkOiBzdHJpbmc7XG4gIHBpcGVsaW5lTmFtZT86IHN0cmluZztcbiAgcHJvamVjdDogc3RyaW5nO1xuICBvcmdhbml6YXRpb246IHN0cmluZztcbn1cblxuLyoqIFdoZXJlIHBlbmRpbmcgcmVnaXN0cmF0aW9uIGludGVudHMgYXJlIHBlcnNpc3RlZCBiZXR3ZWVuIENMSSBpbnZvY2F0aW9ucy4gKi9cbmNvbnN0IFBFTkRJTkdfSU5URU5UU19ESVIgPSBqb2luKGhvbWVkaXIoKSwgJy5waXBlbGluZS1tYW5hZ2VyJywgJ3BlbmRpbmctcmVnaXN0cmF0aW9ucycpO1xuXG4vKipcbiAqIEJ1aWxkIGEgUmVnaXN0cnlQYXlsb2FkIGZyb20gdGhlIHBsYXRmb3JtJ3MgcGlwZWxpbmUgbWV0YWRhdGEuIE5vIEFXUyBjYWxsc1xuICogYW5kIG5vIEFSTi9hY2NvdW50OiB0aGUgZXZlbnRzIExhbWJkYSBhdHRyaWJ1dGVzIGV2ZW50cyB2aWEgdGhlIHBpcGVsaW5lJ3NcbiAqIGBwYi5waXBlbGluZS1pZGAgdGFnICg9IHBpcGVsaW5lSWQpLCBzbyB0aGUgcmVnaXN0cnkgb25seSBuZWVkcyB0aGUgc3RhYmxlXG4gKiBwaXBlbGluZUlkICsgZGlzcGxheSBtZXRhZGF0YS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGJ1aWxkUmVnaXN0cnlQYXlsb2FkKFxuICBwaXBlbGluZTogUGlwZWxpbmVGb3JSZWdpc3RyeSxcbiAgcmVnaW9uT3ZlcnJpZGU/OiBzdHJpbmcsXG4pOiBQcm9taXNlPFJlZ2lzdHJ5UGF5bG9hZD4ge1xuICBjb25zdCByZWdpb24gPSByZXNvbHZlQXdzUmVnaW9uKHJlZ2lvbk92ZXJyaWRlKTtcblxuICBjb25zdCBwaXBlbGluZU5hbWUgPSBwaXBlbGluZS5waXBlbGluZU5hbWVcbiAgICB8fCBkZWZhdWx0UGlwZWxpbmVOYW1lKHBpcGVsaW5lLm9yZ2FuaXphdGlvbiwgcGlwZWxpbmUucHJvamVjdCk7XG4gIGNvbnN0IHN0YWNrTmFtZSA9IGAke3BpcGVsaW5lLnByb2plY3R9LSR7cGlwZWxpbmUub3JnYW5pemF0aW9ufWAudG9Mb3dlckNhc2UoKTtcblxuICByZXR1cm4ge1xuICAgIHBpcGVsaW5lSWQ6IHBpcGVsaW5lLmlkLFxuICAgIG9yZ0lkOiBwaXBlbGluZS5vcmdJZCxcbiAgICBwaXBlbGluZU5hbWUsXG4gICAgcmVnaW9uLFxuICAgIHByb2plY3Q6IHBpcGVsaW5lLnByb2plY3QsXG4gICAgb3JnYW5pemF0aW9uOiBwaXBlbGluZS5vcmdhbml6YXRpb24sXG4gICAgc3RhY2tOYW1lLFxuICB9O1xufVxuXG4vKipcbiAqIFBlcnNpc3QgYSByZWdpc3RyYXRpb24gaW50ZW50IGZvciBsYXRlciByZXRyeS5cbiAqXG4gKiBJbnRlbnQgZmlsZXMgYXJlIGtleWVkIGJ5IHBpcGVsaW5lSWQgc28gcmUtcnVubmluZyBkZXBsb3kgb24gdGhlIHNhbWVcbiAqIHBpcGVsaW5lIG92ZXJ3cml0ZXMgcmF0aGVyIHRoYW4gYWNjdW11bGF0ZXMuIFdlIGRlbGliZXJhdGVseSBzdG9yZSB0aGVcbiAqIHBheWxvYWQgcGxhaW4gKG5vdCB0aGUgZnVsbCBwaXBlbGluZSBkb2MsIG5vdCBhdXRoKSBzbyBhIHN0YWxlIGZpbGUgaXNcbiAqIHNhZmUgdG8gbGVhdmUgYXJvdW5kIGluZGVmaW5pdGVseS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUGVuZGluZ0ludGVudChwYXlsb2FkOiBSZWdpc3RyeVBheWxvYWQpOiBQcm9taXNlPHN0cmluZz4ge1xuICBhd2FpdCBmcy5ta2RpcihQRU5ESU5HX0lOVEVOVFNfRElSLCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcbiAgY29uc3QgcGF0aCA9IGpvaW4oUEVORElOR19JTlRFTlRTX0RJUiwgYCR7cGF5bG9hZC5waXBlbGluZUlkfS5qc29uYCk7XG4gIGF3YWl0IGZzLndyaXRlRmlsZShwYXRoLCBKU09OLnN0cmluZ2lmeShwYXlsb2FkLCBudWxsLCAyKSwgJ3V0ZjgnKTtcbiAgcmV0dXJuIHBhdGg7XG59XG5cbi8qKiBSZW1vdmUgYSBwZW5kaW5nIGludGVudCBhZnRlciBhIHN1Y2Nlc3NmdWwgZHJhaW4uICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY2xlYXJQZW5kaW5nSW50ZW50KHBpcGVsaW5lSWQ6IHN0cmluZyk6IFByb21pc2U8dm9pZD4ge1xuICBjb25zdCBwYXRoID0gam9pbihQRU5ESU5HX0lOVEVOVFNfRElSLCBgJHtwaXBlbGluZUlkfS5qc29uYCk7XG4gIHRyeSB7XG4gICAgYXdhaXQgZnMudW5saW5rKHBhdGgpO1xuICB9IGNhdGNoIChlcnIpIHtcbiAgICAvLyBFTk9FTlQgaXMgZmluZSDigJQgYWxyZWFkeSBjbGVhcmVkLiBBbnl0aGluZyBlbHNlIGlzIGEgcmVhbCBwcm9ibGVtLlxuICAgIGlmICgoZXJyIGFzIE5vZGVKUy5FcnJub0V4Y2VwdGlvbikuY29kZSAhPT0gJ0VOT0VOVCcpIHRocm93IGVycjtcbiAgfVxufVxuXG4vKiogUmVhZCBhbGwgcGVuZGluZyBpbnRlbnRzIGN1cnJlbnRseSBvbiBkaXNrLiBFbXB0eSBhcnJheSBpZiBkaXIgZG9lc24ndCBleGlzdC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUGVuZGluZ0ludGVudHMoKTogUHJvbWlzZTxSZWdpc3RyeVBheWxvYWRbXT4ge1xuICBsZXQgZW50cmllczogc3RyaW5nW107XG4gIHRyeSB7XG4gICAgZW50cmllcyA9IGF3YWl0IGZzLnJlYWRkaXIoUEVORElOR19JTlRFTlRTX0RJUik7XG4gIH0gY2F0Y2ggKGVycikge1xuICAgIGlmICgoZXJyIGFzIE5vZGVKUy5FcnJub0V4Y2VwdGlvbikuY29kZSA9PT0gJ0VOT0VOVCcpIHJldHVybiBbXTtcbiAgICB0aHJvdyBlcnI7XG4gIH1cblxuICBjb25zdCBpbnRlbnRzOiBSZWdpc3RyeVBheWxvYWRbXSA9IFtdO1xuICBmb3IgKGNvbnN0IGZpbGUgb2YgZW50cmllcykge1xuICAgIGlmICghZmlsZS5lbmRzV2l0aCgnLmpzb24nKSkgY29udGludWU7XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHRleHQgPSBhd2FpdCBmcy5yZWFkRmlsZShqb2luKFBFTkRJTkdfSU5URU5UU19ESVIsIGZpbGUpLCAndXRmOCcpO1xuICAgICAgaW50ZW50cy5wdXNoKEpTT04ucGFyc2UodGV4dCkgYXMgUmVnaXN0cnlQYXlsb2FkKTtcbiAgICB9IGNhdGNoIHtcbiAgICAgIC8vIFNraXAgdW5yZWFkYWJsZSAvIG1hbGZvcm1lZCBmaWxlcyDigJQgdGhleSdsbCBuZWVkIG1hbnVhbCBjbGVhbnVwIGJ1dFxuICAgICAgLy8gc2hvdWxkbid0IGJsb2NrIHZhbGlkIGludGVudHMgZnJvbSBkcmFpbmluZy5cbiAgICB9XG4gIH1cbiAgcmV0dXJuIGludGVudHM7XG59XG4iXX0=

package/dist/utils/response-utils.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Unwrap a sendSuccess API envelope: { success, statusCode, data: { ... } }
+ * Returns the inner `data` object, or the original response if not wrapped.
+ */
+export declare function unwrapEnvelope(response: unknown): Record<string, unknown>;
+/**
+ * Extract a single entity from an API response, handling envelope formats.
+ * Tries: payload[entityKey], payload directly (if identifierKey exists), or undefined.
+ */
+export declare function extractSingleResponse<T>(response: unknown, entityKey: string, identifierKey: string): T | undefined;
+export interface ListResponseResult<T> {
+    items: T[];
+    total?: number;
+    hasMore: boolean;
+}
+/**
+ * Extract items from an API list response, handling multiple response formats.
+ * Supports: `{ <key>: T[] }`, `{ items: T[] }`, `T[]`, or invalid formats.
+ */
+export declare function extractListResponse<T>(response: unknown, itemsKey: string): ListResponseResult<T>;
+//# sourceMappingURL=response-utils.d.ts.map

package/dist/utils/response-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-utils.d.ts","sourceRoot":"","sources":["../../src/utils/response-utils.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAQnH;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAoCjG"}

package/dist/utils/response-utils.js

@@ -0,0 +1,70 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+// API response-envelope parsing. Split out of output-utils (which is about
+// rendering) — this is purely about reading the `{ success, data }` shapes the
+// platform returns and pulling out single entities / lists.
+import { printError, printWarning } from './output-utils.js';
+/**
+ * Unwrap a sendSuccess API envelope: { success, statusCode, data: { ... } }
+ * Returns the inner `data` object, or the original response if not wrapped.
+ */
+export function unwrapEnvelope(response) {
+    if (response && typeof response === 'object') {
+        const obj = response;
+        if ('success' in obj && 'data' in obj && obj.data && typeof obj.data === 'object') {
+            return obj.data;
+        }
+        return obj;
+    }
+    return {};
+}
+/**
+ * Extract a single entity from an API response, handling envelope formats.
+ * Tries: payload[entityKey], payload directly (if identifierKey exists), or undefined.
+ */
+export function extractSingleResponse(response, entityKey, identifierKey) {
+    const payload = unwrapEnvelope(response);
+    // Direct entity: payload has the identifier (e.g. payload.id, payload.props, payload.name)
+    if (identifierKey in payload)
+        return payload;
+    // Nested under entity key: payload.pipeline, payload.plugin
+    const nested = payload[entityKey];
+    if (nested && typeof nested === 'object' && identifierKey in nested)
+        return nested;
+    return undefined;
+}
+/**
+ * Extract items from an API list response, handling multiple response formats.
+ * Supports: `{ <key>: T[] }`, `{ items: T[] }`, `T[]`, or invalid formats.
+ */
+export function extractListResponse(response, itemsKey) {
+    if (Array.isArray(response)) {
+        return { items: response, total: undefined, hasMore: false };
+    }
+    if (response && typeof response === 'object') {
+        const obj = unwrapEnvelope(response);
+        // A `{ success, data: [...] }` envelope unwraps to the bare array — return it directly
+        // (the `itemsKey in obj` / `'items' in obj` checks below are false for an array, so
+        // without this such list envelopes would silently yield zero items).
+        if (Array.isArray(obj)) {
+            return { items: obj, total: undefined, hasMore: false };
+        }
+        // Extract pagination metadata if present
+        const pagination = obj.pagination;
+        const total = (pagination?.total ?? obj.total);
+        const hasMore = (pagination?.hasMore ?? obj.hasMore) || false;
+        // Try primary key (e.g. 'pipelines', 'plugins')
+        if (itemsKey in obj && Array.isArray(obj[itemsKey])) {
+            return { items: obj[itemsKey], total, hasMore };
+        }
+        // Try generic 'items' key
+        if ('items' in obj && Array.isArray(obj.items)) {
+            return { items: obj.items, total, hasMore };
+        }
+        printWarning('Unexpected response format, attempting to handle');
+        return { items: [], total: undefined, hasMore: false };
+    }
+    printError('Invalid response format from API');
+    throw new Error('Unexpected API response format');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzcG9uc2UtdXRpbHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvcmVzcG9uc2UtdXRpbHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QywyRUFBMkU7QUFDM0UsK0VBQStFO0FBQy9FLDREQUE0RDtBQUU1RCxPQUFPLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRTdEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxjQUFjLENBQUMsUUFBaUI7SUFDOUMsSUFBSSxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDN0MsTUFBTSxHQUFHLEdBQUcsUUFBbUMsQ0FBQztRQUNoRCxJQUFJLFNBQVMsSUFBSSxHQUFHLElBQUksTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQUMsSUFBSSxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNsRixPQUFPLEdBQUcsQ0FBQyxJQUErQixDQUFDO1FBQzdDLENBQUM7UUFDRCxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQUksUUFBaUIsRUFBRSxTQUFpQixFQUFFLGFBQXFCO0lBQ2xHLE1BQU0sT0FBTyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN6QywyRkFBMkY7SUFDM0YsSUFBSSxhQUFhLElBQUksT0FBTztRQUFFLE9BQU8sT0FBdUIsQ0FBQztJQUM3RCw0REFBNEQ7SUFDNUQsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBd0MsQ0FBQztJQUN6RSxJQUFJLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksYUFBYSxJQUFJLE1BQU07UUFBRSxPQUFPLE1BQXNCLENBQUM7SUFDbkcsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQVFEOzs7R0FHRztBQUNILE1BQU0sVUFBVSxtQkFBbUIsQ0FBSSxRQUFpQixFQUFFLFFBQWdCO0lBQ3hFLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQy9ELENBQUM7SUFFRCxJQUFJLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUM3QyxNQUFNLEdBQUcsR0FBRyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFckMsdUZBQXVGO1FBQ3ZGLG9GQUFvRjtRQUNwRixxRUFBcUU7UUFDckUsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkIsT0FBTyxFQUFFLEtBQUssRUFBRSxHQUFVLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFDakUsQ0FBQztRQUVELHlDQUF5QztRQUN6QyxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsVUFBaUQsQ0FBQztRQUN6RSxNQUFNLEtBQUssR0FBRyxDQUFDLFVBQVUsRUFBRSxLQUFLLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBdUIsQ0FBQztRQUNyRSxNQUFNLE9BQU8sR0FBSSxDQUFDLFVBQVUsRUFBRSxPQUFPLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBYSxJQUFJLEtBQUssQ0FBQztRQUUzRSxnREFBZ0Q7UUFDaEQsSUFBSSxRQUFRLElBQUksR0FBRyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNwRCxPQUFPLEVBQUUsS0FBSyxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQVEsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDekQsQ0FBQztRQUVELDBCQUEwQjtRQUMxQixJQUFJLE9BQU8sSUFBSSxHQUFHLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEdBQUcsQ0FBQyxLQUFZLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDO1FBQ3JELENBQUM7UUFFRCxZQUFZLENBQUMsa0RBQWtELENBQUMsQ0FBQztRQUNqRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUN6RCxDQUFDO0lBRUQsVUFBVSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDL0MsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0FBQ3BELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLy8gQVBJIHJlc3BvbnNlLWVudmVsb3BlIHBhcnNpbmcuIFNwbGl0IG91dCBvZiBvdXRwdXQtdXRpbHMgKHdoaWNoIGlzIGFib3V0XG4vLyByZW5kZXJpbmcpIOKAlCB0aGlzIGlzIHB1cmVseSBhYm91dCByZWFkaW5nIHRoZSBgeyBzdWNjZXNzLCBkYXRhIH1gIHNoYXBlcyB0aGVcbi8vIHBsYXRmb3JtIHJldHVybnMgYW5kIHB1bGxpbmcgb3V0IHNpbmdsZSBlbnRpdGllcyAvIGxpc3RzLlxuXG5pbXBvcnQgeyBwcmludEVycm9yLCBwcmludFdhcm5pbmcgfSBmcm9tICcuL291dHB1dC11dGlscy5qcyc7XG5cbi8qKlxuICogVW53cmFwIGEgc2VuZFN1Y2Nlc3MgQVBJIGVudmVsb3BlOiB7IHN1Y2Nlc3MsIHN0YXR1c0NvZGUsIGRhdGE6IHsgLi4uIH0gfVxuICogUmV0dXJucyB0aGUgaW5uZXIgYGRhdGFgIG9iamVjdCwgb3IgdGhlIG9yaWdpbmFsIHJlc3BvbnNlIGlmIG5vdCB3cmFwcGVkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gdW53cmFwRW52ZWxvcGUocmVzcG9uc2U6IHVua25vd24pOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiB7XG4gIGlmIChyZXNwb25zZSAmJiB0eXBlb2YgcmVzcG9uc2UgPT09ICdvYmplY3QnKSB7XG4gICAgY29uc3Qgb2JqID0gcmVzcG9uc2UgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gICAgaWYgKCdzdWNjZXNzJyBpbiBvYmogJiYgJ2RhdGEnIGluIG9iaiAmJiBvYmouZGF0YSAmJiB0eXBlb2Ygb2JqLmRhdGEgPT09ICdvYmplY3QnKSB7XG4gICAgICByZXR1cm4gb2JqLmRhdGEgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gICAgfVxuICAgIHJldHVybiBvYmo7XG4gIH1cbiAgcmV0dXJuIHt9O1xufVxuXG4vKipcbiAqIEV4dHJhY3QgYSBzaW5nbGUgZW50aXR5IGZyb20gYW4gQVBJIHJlc3BvbnNlLCBoYW5kbGluZyBlbnZlbG9wZSBmb3JtYXRzLlxuICogVHJpZXM6IHBheWxvYWRbZW50aXR5S2V5XSwgcGF5bG9hZCBkaXJlY3RseSAoaWYgaWRlbnRpZmllcktleSBleGlzdHMpLCBvciB1bmRlZmluZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHRyYWN0U2luZ2xlUmVzcG9uc2U8VD4ocmVzcG9uc2U6IHVua25vd24sIGVudGl0eUtleTogc3RyaW5nLCBpZGVudGlmaWVyS2V5OiBzdHJpbmcpOiBUIHwgdW5kZWZpbmVkIHtcbiAgY29uc3QgcGF5bG9hZCA9IHVud3JhcEVudmVsb3BlKHJlc3BvbnNlKTtcbiAgLy8gRGlyZWN0IGVudGl0eTogcGF5bG9hZCBoYXMgdGhlIGlkZW50aWZpZXIgKGUuZy4gcGF5bG9hZC5pZCwgcGF5bG9hZC5wcm9wcywgcGF5bG9hZC5uYW1lKVxuICBpZiAoaWRlbnRpZmllcktleSBpbiBwYXlsb2FkKSByZXR1cm4gcGF5bG9hZCBhcyB1bmtub3duIGFzIFQ7XG4gIC8vIE5lc3RlZCB1bmRlciBlbnRpdHkga2V5OiBwYXlsb2FkLnBpcGVsaW5lLCBwYXlsb2FkLnBsdWdpblxuICBjb25zdCBuZXN0ZWQgPSBwYXlsb2FkW2VudGl0eUtleV0gYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj4gfCB1bmRlZmluZWQ7XG4gIGlmIChuZXN0ZWQgJiYgdHlwZW9mIG5lc3RlZCA9PT0gJ29iamVjdCcgJiYgaWRlbnRpZmllcktleSBpbiBuZXN0ZWQpIHJldHVybiBuZXN0ZWQgYXMgdW5rbm93biBhcyBUO1xuICByZXR1cm4gdW5kZWZpbmVkO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIExpc3RSZXNwb25zZVJlc3VsdDxUPiB7XG4gIGl0ZW1zOiBUW107XG4gIHRvdGFsPzogbnVtYmVyO1xuICBoYXNNb3JlOiBib29sZWFuO1xufVxuXG4vKipcbiAqIEV4dHJhY3QgaXRlbXMgZnJvbSBhbiBBUEkgbGlzdCByZXNwb25zZSwgaGFuZGxpbmcgbXVsdGlwbGUgcmVzcG9uc2UgZm9ybWF0cy5cbiAqIFN1cHBvcnRzOiBgeyA8a2V5PjogVFtdIH1gLCBgeyBpdGVtczogVFtdIH1gLCBgVFtdYCwgb3IgaW52YWxpZCBmb3JtYXRzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZXh0cmFjdExpc3RSZXNwb25zZTxUPihyZXNwb25zZTogdW5rbm93biwgaXRlbXNLZXk6IHN0cmluZyk6IExpc3RSZXNwb25zZVJlc3VsdDxUPiB7XG4gIGlmIChBcnJheS5pc0FycmF5KHJlc3BvbnNlKSkge1xuICAgIHJldHVybiB7IGl0ZW1zOiByZXNwb25zZSwgdG90YWw6IHVuZGVmaW5lZCwgaGFzTW9yZTogZmFsc2UgfTtcbiAgfVxuXG4gIGlmIChyZXNwb25zZSAmJiB0eXBlb2YgcmVzcG9uc2UgPT09ICdvYmplY3QnKSB7XG4gICAgY29uc3Qgb2JqID0gdW53cmFwRW52ZWxvcGUocmVzcG9uc2UpO1xuXG4gICAgLy8gQSBgeyBzdWNjZXNzLCBkYXRhOiBbLi4uXSB9YCBlbnZlbG9wZSB1bndyYXBzIHRvIHRoZSBiYXJlIGFycmF5IOKAlCByZXR1cm4gaXQgZGlyZWN0bHlcbiAgICAvLyAodGhlIGBpdGVtc0tleSBpbiBvYmpgIC8gYCdpdGVtcycgaW4gb2JqYCBjaGVja3MgYmVsb3cgYXJlIGZhbHNlIGZvciBhbiBhcnJheSwgc29cbiAgICAvLyB3aXRob3V0IHRoaXMgc3VjaCBsaXN0IGVudmVsb3BlcyB3b3VsZCBzaWxlbnRseSB5aWVsZCB6ZXJvIGl0ZW1zKS5cbiAgICBpZiAoQXJyYXkuaXNBcnJheShvYmopKSB7XG4gICAgICByZXR1cm4geyBpdGVtczogb2JqIGFzIFRbXSwgdG90YWw6IHVuZGVmaW5lZCwgaGFzTW9yZTogZmFsc2UgfTtcbiAgICB9XG5cbiAgICAvLyBFeHRyYWN0IHBhZ2luYXRpb24gbWV0YWRhdGEgaWYgcHJlc2VudFxuICAgIGNvbnN0IHBhZ2luYXRpb24gPSBvYmoucGFnaW5hdGlvbiBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiB8IHVuZGVmaW5lZDtcbiAgICBjb25zdCB0b3RhbCA9IChwYWdpbmF0aW9uPy50b3RhbCA/PyBvYmoudG90YWwpIGFzIG51bWJlciB8IHVuZGVmaW5lZDtcbiAgICBjb25zdCBoYXNNb3JlID0gKChwYWdpbmF0aW9uPy5oYXNNb3JlID8/IG9iai5oYXNNb3JlKSBhcyBib29sZWFuKSB8fCBmYWxzZTtcblxuICAgIC8vIFRyeSBwcmltYXJ5IGtleSAoZS5nLiAncGlwZWxpbmVzJywgJ3BsdWdpbnMnKVxuICAgIGlmIChpdGVtc0tleSBpbiBvYmogJiYgQXJyYXkuaXNBcnJheShvYmpbaXRlbXNLZXldKSkge1xuICAgICAgcmV0dXJuIHsgaXRlbXM6IG9ialtpdGVtc0tleV0gYXMgVFtdLCB0b3RhbCwgaGFzTW9yZSB9O1xuICAgIH1cblxuICAgIC8vIFRyeSBnZW5lcmljICdpdGVtcycga2V5XG4gICAgaWYgKCdpdGVtcycgaW4gb2JqICYmIEFycmF5LmlzQXJyYXkob2JqLml0ZW1zKSkge1xuICAgICAgcmV0dXJuIHsgaXRlbXM6IG9iai5pdGVtcyBhcyBUW10sIHRvdGFsLCBoYXNNb3JlIH07XG4gICAgfVxuXG4gICAgcHJpbnRXYXJuaW5nKCdVbmV4cGVjdGVkIHJlc3BvbnNlIGZvcm1hdCwgYXR0ZW1wdGluZyB0byBoYW5kbGUnKTtcbiAgICByZXR1cm4geyBpdGVtczogW10sIHRvdGFsOiB1bmRlZmluZWQsIGhhc01vcmU6IGZhbHNlIH07XG4gIH1cblxuICBwcmludEVycm9yKCdJbnZhbGlkIHJlc3BvbnNlIGZvcm1hdCBmcm9tIEFQSScpO1xuICB0aHJvdyBuZXcgRXJyb3IoJ1VuZXhwZWN0ZWQgQVBJIHJlc3BvbnNlIGZvcm1hdCcpO1xufVxuIl19

package/dist/utils/tls.d.ts

@@ -0,0 +1,52 @@
+import https from 'https';
+/**
+ * Hosts that legitimately front a self-signed certificate — local dev stacks and
+ * kubectl port-forwards. Everything else (a real deploy domain) is expected to
+ * present a valid (ACM) certificate and MUST be verified, so a post-deploy probe
+ * can't be silently MITM'd.
+ */
+export declare function isLocalHttpsHost(url: string): boolean;
+/**
+ * Return an https.Agent that skips certificate verification ONLY for local /
+ * self-signed hosts; returns `undefined` (Node's default verification) for real
+ * domains. Pass the result straight to axios' `httpsAgent` — `undefined` keeps the
+ * default secure behavior.
+ */
+export declare function httpsAgentForUrl(url: string): https.Agent | undefined;
+/**
+ * Single source of truth for "is this a production run?" — the whole CLI keys its
+ * TLS-disable refusal off `NODE_ENV=production`. Centralized here (rather than a
+ * bare `process.env.NODE_ENV === 'production'` copied into config-loader, login,
+ * platform-secret and the renew handler) so the policy can't drift between the
+ * paths that transmit passwords/JWTs and the paths that merely read config.
+ */
+export declare function isProductionEnv(): boolean;
+/**
+ * Guard for the credential-transmitting SSL-disable paths (login, inline-login,
+ * token renewal, and every authenticated command via `getConfigWithOptions`).
+ *
+ * When a caller asks to disable certificate verification AND the run is
+ * production, this THROWS a clear error rather than silently proceeding — a MITM
+ * on a "prod with --no-verify-ssl" run would otherwise harvest the very
+ * passwords/JWTs these paths send. In non-production it is a no-op, so
+ * `--no-verify-ssl` / `PLATFORM_VERIFY_SSL=false` still work against self-signed
+ * dev platforms.
+ *
+ * @param context - short description of the path being guarded, for the message.
+ * @throws Error in production; returns `void` otherwise.
+ */
+export declare function assertSslDisableAllowed(context?: string): void;
+/**
+ * Apply the `--no-verify-ssl` relaxation as a process-wide env flag
+ * (`NODE_TLS_REJECT_UNAUTHORIZED=0`) so spawned CDK subprocesses (Lambda,
+ * CodeBuild synth) inherit it — but REFUSE in production, mirroring the guard in
+ * config-loader. That flag disables certificate validation for ALL outbound TLS
+ * (including the AWS SDK), so it must never be silently enabled for a prod
+ * deploy/synth.
+ *
+ * @param verifySsl - the command's `--verify-ssl` value (`false` = user asked to disable).
+ * @param warn - warning sink (e.g. `printWarning`).
+ * @returns true if verification was disabled; false if left enabled.
+ */
+export declare function relaxTlsForCli(verifySsl: boolean | undefined, warn: (message: string) => void): boolean;
+//# sourceMappingURL=tls.d.ts.map

package/dist/utils/tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../src/utils/tls.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBrD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,SAAS,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,OAAO,CAQT"}

package/dist/utils/tls.js

@@ -0,0 +1,88 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import https from 'https';
+/**
+ * Hosts that legitimately front a self-signed certificate — local dev stacks and
+ * kubectl port-forwards. Everything else (a real deploy domain) is expected to
+ * present a valid (ACM) certificate and MUST be verified, so a post-deploy probe
+ * can't be silently MITM'd.
+ */
+export function isLocalHttpsHost(url) {
+    let hostname;
+    try {
+        hostname = new URL(url).hostname;
+    }
+    catch {
+        return false;
+    }
+    return (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1' ||
+        hostname.endsWith('.local') ||
+        /^10\./.test(hostname) ||
+        /^192\.168\./.test(hostname) ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(hostname));
+}
+/**
+ * Return an https.Agent that skips certificate verification ONLY for local /
+ * self-signed hosts; returns `undefined` (Node's default verification) for real
+ * domains. Pass the result straight to axios' `httpsAgent` — `undefined` keeps the
+ * default secure behavior.
+ */
+export function httpsAgentForUrl(url) {
+    return isLocalHttpsHost(url) ? new https.Agent({ rejectUnauthorized: false }) : undefined;
+}
+/**
+ * Single source of truth for "is this a production run?" — the whole CLI keys its
+ * TLS-disable refusal off `NODE_ENV=production`. Centralized here (rather than a
+ * bare `process.env.NODE_ENV === 'production'` copied into config-loader, login,
+ * platform-secret and the renew handler) so the policy can't drift between the
+ * paths that transmit passwords/JWTs and the paths that merely read config.
+ */
+export function isProductionEnv() {
+    return process.env.NODE_ENV === 'production';
+}
+/**
+ * Guard for the credential-transmitting SSL-disable paths (login, inline-login,
+ * token renewal, and every authenticated command via `getConfigWithOptions`).
+ *
+ * When a caller asks to disable certificate verification AND the run is
+ * production, this THROWS a clear error rather than silently proceeding — a MITM
+ * on a "prod with --no-verify-ssl" run would otherwise harvest the very
+ * passwords/JWTs these paths send. In non-production it is a no-op, so
+ * `--no-verify-ssl` / `PLATFORM_VERIFY_SSL=false` still work against self-signed
+ * dev platforms.
+ *
+ * @param context - short description of the path being guarded, for the message.
+ * @throws Error in production; returns `void` otherwise.
+ */
+export function assertSslDisableAllowed(context) {
+    if (isProductionEnv()) {
+        throw new Error(`Refusing to disable TLS certificate verification in production (NODE_ENV=production)${context ? ` — ${context}` : ''}. `
+            + 'Credentials and tokens must never be transmitted over an unverified TLS connection. '
+            + 'Use a platform with a valid certificate, or unset NODE_ENV for local/self-signed development.');
+    }
+}
+/**
+ * Apply the `--no-verify-ssl` relaxation as a process-wide env flag
+ * (`NODE_TLS_REJECT_UNAUTHORIZED=0`) so spawned CDK subprocesses (Lambda,
+ * CodeBuild synth) inherit it — but REFUSE in production, mirroring the guard in
+ * config-loader. That flag disables certificate validation for ALL outbound TLS
+ * (including the AWS SDK), so it must never be silently enabled for a prod
+ * deploy/synth.
+ *
+ * @param verifySsl - the command's `--verify-ssl` value (`false` = user asked to disable).
+ * @param warn - warning sink (e.g. `printWarning`).
+ * @returns true if verification was disabled; false if left enabled.
+ */
+export function relaxTlsForCli(verifySsl, warn) {
+    if (verifySsl !== false)
+        return false;
+    if (isProductionEnv()) {
+        warn('Refusing to disable TLS verification in production (NODE_ENV=production) — certificate validation remains enabled.');
+        return false;
+    }
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+    return true;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGxzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3V0aWxzL3Rscy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sS0FBSyxNQUFNLE9BQU8sQ0FBQztBQUUxQjs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxHQUFXO0lBQzFDLElBQUksUUFBZ0IsQ0FBQztJQUNyQixJQUFJLENBQUM7UUFDSCxRQUFRLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDO0lBQ25DLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxPQUFPLENBQ0wsUUFBUSxLQUFLLFdBQVc7UUFDeEIsUUFBUSxLQUFLLFdBQVc7UUFDeEIsUUFBUSxLQUFLLEtBQUs7UUFDbEIsUUFBUSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFDM0IsT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDdEIsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDNUIsNEJBQTRCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUM1QyxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEdBQVc7SUFDMUMsT0FBTyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQzVGLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsZUFBZTtJQUM3QixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFlBQVksQ0FBQztBQUMvQyxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILE1BQU0sVUFBVSx1QkFBdUIsQ0FBQyxPQUFnQjtJQUN0RCxJQUFJLGVBQWUsRUFBRSxFQUFFLENBQUM7UUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FDYix1RkFBdUYsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUk7Y0FDdkgsc0ZBQXNGO2NBQ3RGLCtGQUErRixDQUNsRyxDQUFDO0lBQ0osQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sVUFBVSxjQUFjLENBQzVCLFNBQThCLEVBQzlCLElBQStCO0lBRS9CLElBQUksU0FBUyxLQUFLLEtBQUs7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN0QyxJQUFJLGVBQWUsRUFBRSxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLG9IQUFvSCxDQUFDLENBQUM7UUFDM0gsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyw0QkFBNEIsR0FBRyxHQUFHLENBQUM7SUFDL0MsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbmltcG9ydCBodHRwcyBmcm9tICdodHRwcyc7XG5cbi8qKlxuICogSG9zdHMgdGhhdCBsZWdpdGltYXRlbHkgZnJvbnQgYSBzZWxmLXNpZ25lZCBjZXJ0aWZpY2F0ZSDigJQgbG9jYWwgZGV2IHN0YWNrcyBhbmRcbiAqIGt1YmVjdGwgcG9ydC1mb3J3YXJkcy4gRXZlcnl0aGluZyBlbHNlIChhIHJlYWwgZGVwbG95IGRvbWFpbikgaXMgZXhwZWN0ZWQgdG9cbiAqIHByZXNlbnQgYSB2YWxpZCAoQUNNKSBjZXJ0aWZpY2F0ZSBhbmQgTVVTVCBiZSB2ZXJpZmllZCwgc28gYSBwb3N0LWRlcGxveSBwcm9iZVxuICogY2FuJ3QgYmUgc2lsZW50bHkgTUlUTSdkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNMb2NhbEh0dHBzSG9zdCh1cmw6IHN0cmluZyk6IGJvb2xlYW4ge1xuICBsZXQgaG9zdG5hbWU6IHN0cmluZztcbiAgdHJ5IHtcbiAgICBob3N0bmFtZSA9IG5ldyBVUkwodXJsKS5ob3N0bmFtZTtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHJldHVybiAoXG4gICAgaG9zdG5hbWUgPT09ICdsb2NhbGhvc3QnIHx8XG4gICAgaG9zdG5hbWUgPT09ICcxMjcuMC4wLjEnIHx8XG4gICAgaG9zdG5hbWUgPT09ICc6OjEnIHx8XG4gICAgaG9zdG5hbWUuZW5kc1dpdGgoJy5sb2NhbCcpIHx8XG4gICAgL14xMFxcLi8udGVzdChob3N0bmFtZSkgfHxcbiAgICAvXjE5MlxcLjE2OFxcLi8udGVzdChob3N0bmFtZSkgfHxcbiAgICAvXjE3MlxcLigxWzYtOV18MlxcZHwzWzAxXSlcXC4vLnRlc3QoaG9zdG5hbWUpXG4gICk7XG59XG5cbi8qKlxuICogUmV0dXJuIGFuIGh0dHBzLkFnZW50IHRoYXQgc2tpcHMgY2VydGlmaWNhdGUgdmVyaWZpY2F0aW9uIE9OTFkgZm9yIGxvY2FsIC9cbiAqIHNlbGYtc2lnbmVkIGhvc3RzOyByZXR1cm5zIGB1bmRlZmluZWRgIChOb2RlJ3MgZGVmYXVsdCB2ZXJpZmljYXRpb24pIGZvciByZWFsXG4gKiBkb21haW5zLiBQYXNzIHRoZSByZXN1bHQgc3RyYWlnaHQgdG8gYXhpb3MnIGBodHRwc0FnZW50YCDigJQgYHVuZGVmaW5lZGAga2VlcHMgdGhlXG4gKiBkZWZhdWx0IHNlY3VyZSBiZWhhdmlvci5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGh0dHBzQWdlbnRGb3JVcmwodXJsOiBzdHJpbmcpOiBodHRwcy5BZ2VudCB8IHVuZGVmaW5lZCB7XG4gIHJldHVybiBpc0xvY2FsSHR0cHNIb3N0KHVybCkgPyBuZXcgaHR0cHMuQWdlbnQoeyByZWplY3RVbmF1dGhvcml6ZWQ6IGZhbHNlIH0pIDogdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIFNpbmdsZSBzb3VyY2Ugb2YgdHJ1dGggZm9yIFwiaXMgdGhpcyBhIHByb2R1Y3Rpb24gcnVuP1wiIOKAlCB0aGUgd2hvbGUgQ0xJIGtleXMgaXRzXG4gKiBUTFMtZGlzYWJsZSByZWZ1c2FsIG9mZiBgTk9ERV9FTlY9cHJvZHVjdGlvbmAuIENlbnRyYWxpemVkIGhlcmUgKHJhdGhlciB0aGFuIGFcbiAqIGJhcmUgYHByb2Nlc3MuZW52Lk5PREVfRU5WID09PSAncHJvZHVjdGlvbidgIGNvcGllZCBpbnRvIGNvbmZpZy1sb2FkZXIsIGxvZ2luLFxuICogcGxhdGZvcm0tc2VjcmV0IGFuZCB0aGUgcmVuZXcgaGFuZGxlcikgc28gdGhlIHBvbGljeSBjYW4ndCBkcmlmdCBiZXR3ZWVuIHRoZVxuICogcGF0aHMgdGhhdCB0cmFuc21pdCBwYXNzd29yZHMvSldUcyBhbmQgdGhlIHBhdGhzIHRoYXQgbWVyZWx5IHJlYWQgY29uZmlnLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNQcm9kdWN0aW9uRW52KCk6IGJvb2xlYW4ge1xuICByZXR1cm4gcHJvY2Vzcy5lbnYuTk9ERV9FTlYgPT09ICdwcm9kdWN0aW9uJztcbn1cblxuLyoqXG4gKiBHdWFyZCBmb3IgdGhlIGNyZWRlbnRpYWwtdHJhbnNtaXR0aW5nIFNTTC1kaXNhYmxlIHBhdGhzIChsb2dpbiwgaW5saW5lLWxvZ2luLFxuICogdG9rZW4gcmVuZXdhbCwgYW5kIGV2ZXJ5IGF1dGhlbnRpY2F0ZWQgY29tbWFuZCB2aWEgYGdldENvbmZpZ1dpdGhPcHRpb25zYCkuXG4gKlxuICogV2hlbiBhIGNhbGxlciBhc2tzIHRvIGRpc2FibGUgY2VydGlmaWNhdGUgdmVyaWZpY2F0aW9uIEFORCB0aGUgcnVuIGlzXG4gKiBwcm9kdWN0aW9uLCB0aGlzIFRIUk9XUyBhIGNsZWFyIGVycm9yIHJhdGhlciB0aGFuIHNpbGVudGx5IHByb2NlZWRpbmcg4oCUIGEgTUlUTVxuICogb24gYSBcInByb2Qgd2l0aCAtLW5vLXZlcmlmeS1zc2xcIiBydW4gd291bGQgb3RoZXJ3aXNlIGhhcnZlc3QgdGhlIHZlcnlcbiAqIHBhc3N3b3Jkcy9KV1RzIHRoZXNlIHBhdGhzIHNlbmQuIEluIG5vbi1wcm9kdWN0aW9uIGl0IGlzIGEgbm8tb3AsIHNvXG4gKiBgLS1uby12ZXJpZnktc3NsYCAvIGBQTEFURk9STV9WRVJJRllfU1NMPWZhbHNlYCBzdGlsbCB3b3JrIGFnYWluc3Qgc2VsZi1zaWduZWRcbiAqIGRldiBwbGF0Zm9ybXMuXG4gKlxuICogQHBhcmFtIGNvbnRleHQgLSBzaG9ydCBkZXNjcmlwdGlvbiBvZiB0aGUgcGF0aCBiZWluZyBndWFyZGVkLCBmb3IgdGhlIG1lc3NhZ2UuXG4gKiBAdGhyb3dzIEVycm9yIGluIHByb2R1Y3Rpb247IHJldHVybnMgYHZvaWRgIG90aGVyd2lzZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFzc2VydFNzbERpc2FibGVBbGxvd2VkKGNvbnRleHQ/OiBzdHJpbmcpOiB2b2lkIHtcbiAgaWYgKGlzUHJvZHVjdGlvbkVudigpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYFJlZnVzaW5nIHRvIGRpc2FibGUgVExTIGNlcnRpZmljYXRlIHZlcmlmaWNhdGlvbiBpbiBwcm9kdWN0aW9uIChOT0RFX0VOVj1wcm9kdWN0aW9uKSR7Y29udGV4dCA/IGAg4oCUICR7Y29udGV4dH1gIDogJyd9LiBgXG4gICAgICArICdDcmVkZW50aWFscyBhbmQgdG9rZW5zIG11c3QgbmV2ZXIgYmUgdHJhbnNtaXR0ZWQgb3ZlciBhbiB1bnZlcmlmaWVkIFRMUyBjb25uZWN0aW9uLiAnXG4gICAgICArICdVc2UgYSBwbGF0Zm9ybSB3aXRoIGEgdmFsaWQgY2VydGlmaWNhdGUsIG9yIHVuc2V0IE5PREVfRU5WIGZvciBsb2NhbC9zZWxmLXNpZ25lZCBkZXZlbG9wbWVudC4nLFxuICAgICk7XG4gIH1cbn1cblxuLyoqXG4gKiBBcHBseSB0aGUgYC0tbm8tdmVyaWZ5LXNzbGAgcmVsYXhhdGlvbiBhcyBhIHByb2Nlc3Mtd2lkZSBlbnYgZmxhZ1xuICogKGBOT0RFX1RMU19SRUpFQ1RfVU5BVVRIT1JJWkVEPTBgKSBzbyBzcGF3bmVkIENESyBzdWJwcm9jZXNzZXMgKExhbWJkYSxcbiAqIENvZGVCdWlsZCBzeW50aCkgaW5oZXJpdCBpdCDigJQgYnV0IFJFRlVTRSBpbiBwcm9kdWN0aW9uLCBtaXJyb3JpbmcgdGhlIGd1YXJkIGluXG4gKiBjb25maWctbG9hZGVyLiBUaGF0IGZsYWcgZGlzYWJsZXMgY2VydGlmaWNhdGUgdmFsaWRhdGlvbiBmb3IgQUxMIG91dGJvdW5kIFRMU1xuICogKGluY2x1ZGluZyB0aGUgQVdTIFNESyksIHNvIGl0IG11c3QgbmV2ZXIgYmUgc2lsZW50bHkgZW5hYmxlZCBmb3IgYSBwcm9kXG4gKiBkZXBsb3kvc3ludGguXG4gKlxuICogQHBhcmFtIHZlcmlmeVNzbCAtIHRoZSBjb21tYW5kJ3MgYC0tdmVyaWZ5LXNzbGAgdmFsdWUgKGBmYWxzZWAgPSB1c2VyIGFza2VkIHRvIGRpc2FibGUpLlxuICogQHBhcmFtIHdhcm4gLSB3YXJuaW5nIHNpbmsgKGUuZy4gYHByaW50V2FybmluZ2ApLlxuICogQHJldHVybnMgdHJ1ZSBpZiB2ZXJpZmljYXRpb24gd2FzIGRpc2FibGVkOyBmYWxzZSBpZiBsZWZ0IGVuYWJsZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZWxheFRsc0ZvckNsaShcbiAgdmVyaWZ5U3NsOiBib29sZWFuIHwgdW5kZWZpbmVkLFxuICB3YXJuOiAobWVzc2FnZTogc3RyaW5nKSA9PiB2b2lkLFxuKTogYm9vbGVhbiB7XG4gIGlmICh2ZXJpZnlTc2wgIT09IGZhbHNlKSByZXR1cm4gZmFsc2U7XG4gIGlmIChpc1Byb2R1Y3Rpb25FbnYoKSkge1xuICAgIHdhcm4oJ1JlZnVzaW5nIHRvIGRpc2FibGUgVExTIHZlcmlmaWNhdGlvbiBpbiBwcm9kdWN0aW9uIChOT0RFX0VOVj1wcm9kdWN0aW9uKSDigJQgY2VydGlmaWNhdGUgdmFsaWRhdGlvbiByZW1haW5zIGVuYWJsZWQuJyk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIHByb2Nlc3MuZW52Lk5PREVfVExTX1JFSkVDVF9VTkFVVEhPUklaRUQgPSAnMCc7XG4gIHJldHVybiB0cnVlO1xufVxuIl19

package/package.json

@@ -0,0 +1,181 @@
+{
+  "name": "@pipeline-builder/pipeline-manager",
+  "description": "CLI for Pipeline Builder  self-service AWS CodePipeline platform with 125 reusable containerized plugins, per-org compliance enforcement, and per-organization (and team) isolation.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mwashburn160/pipeline-builder.git"
+  },
+  "bin": {
+    "pipeline-manager": "./dist/cli.js"
+  },
+  "devDependencies": {
+    "@jest/globals": "30.4.1",
+    "@stylistic/eslint-plugin": "^2",
+    "@types/figlet": "1.7.0",
+    "@types/node": "^24",
+    "@types/progress": "2.0.7",
+    "@typescript-eslint/eslint-plugin": "^8",
+    "@typescript-eslint/parser": "^8",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "copyfiles": "2.4.1",
+    "eslint": "^9",
+    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-plugin-import": "^2.32.0",
+    "jest": "30.4.2",
+    "jest-junit": "^17",
+    "ts-jest": "29.4.12",
+    "typescript": "npm:@typescript/typescript6@^6.0.2"
+  },
+  "dependencies": {
+    "@aws-sdk/client-cloudformation": "3.1101.0",
+    "@aws-sdk/client-lambda": "3.1101.0",
+    "@aws-sdk/client-secrets-manager": "3.1101.0",
+    "@aws-sdk/client-sqs": "3.1101.0",
+    "@aws-sdk/client-sts": "3.1101.0",
+    "aws-cdk-lib": "2.263.0",
+    "axios": "1.19.0",
+    "commander": "15.0.0",
+    "constructs": "10.7.0",
+    "figlet": "1.11.4",
+    "form-data": "4.0.6",
+    "ora": "9.4.1",
+    "picocolors": "1.1.1",
+    "progress": "2.0.3",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "yaml": "2.9.0",
+    "zod": "4.4.3",
+    "@pipeline-builder/ai-core": "0.0.1",
+    "@pipeline-builder/api-core": "0.0.1",
+    "@pipeline-builder/pipeline-core": "0.0.1"
+  },
+  "keywords": [
+    "ci-cd",
+    "cicd",
+    "continuous-delivery",
+    "devops",
+    "self-service",
+    "platform-engineering",
+    "internal-developer-platform",
+    "developer-platform",
+    "aws",
+    "aws-cdk",
+    "cdk",
+    "codepipeline",
+    "codebuild",
+    "cloudformation",
+    "pipeline",
+    "pipeline-as-code",
+    "infrastructure-as-code",
+    "iac",
+    "compliance",
+    "policy-as-code",
+    "governance",
+    "golden-paths",
+    "multi-tenant",
+    "rbac",
+    "ai",
+    "ai-pipeline-generation",
+    "llm",
+    "bedrock",
+    "plugins",
+    "plugin-marketplace",
+    "containerized",
+    "docker",
+    "kubernetes",
+    "typescript",
+    "cli"
+  ],
+  "engines": {
+    "node": ">= 24.14.0"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": ">=10",
+      "onFail": "ignore"
+    }
+  },
+  "license": "Apache-2.0",
+  "homepage": "https://mwashburn160.github.io/pipeline-builder/",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "version": "0.0.1",
+  "bugs": {
+    "url": "https://github.com/mwashburn160/pipeline-builder/issues"
+  },
+  "jest": {
+    "coverageProvider": "v8",
+    "testMatch": [
+      "<rootDir>/@(src|test)/**/*(*.)@(spec|test).[jt]s?(x)",
+      "<rootDir>/@(src|test)/**/__tests__/**/*.[jt]s?(x)"
+    ],
+    "clearMocks": true,
+    "collectCoverage": true,
+    "coverageReporters": [
+      "json",
+      "lcov",
+      "clover",
+      "cobertura",
+      "text"
+    ],
+    "coverageDirectory": "coverage",
+    "coveragePathIgnorePatterns": [
+      "/node_modules/"
+    ],
+    "testPathIgnorePatterns": [
+      "/node_modules/"
+    ],
+    "watchPathIgnorePatterns": [
+      "/node_modules/"
+    ],
+    "reporters": [
+      "default",
+      [
+        "jest-junit",
+        {
+          "outputDirectory": "test-reports"
+        }
+      ]
+    ],
+    "transform": {
+      "^.+\\.[t]sx?$": [
+        "ts-jest",
+        {
+          "useESM": true,
+          "tsconfig": "tsconfig.dev.json",
+          "diagnostics": {
+            "ignoreCodes": [
+              151002
+            ]
+          }
+        }
+      ]
+    },
+    "extensionsToTreatAsEsm": [
+      ".ts",
+      ".tsx"
+    ],
+    "moduleNameMapper": {
+      "^uuid$": "<rootDir>/../../jest-uuid-stub.js",
+      "^(\\.{1,2}/.*)\\.js$": "$1"
+    }
+  },
+  "type": "module",
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"pnpm dlx projen\".",
+  "scripts": {
+    "audit": "pnpm dlx projen audit",
+    "build": "pnpm dlx projen build",
+    "compile": "pnpm dlx projen compile",
+    "default": "pnpm dlx projen default",
+    "eslint": "pnpm dlx projen eslint",
+    "package": "pnpm dlx projen package",
+    "post-compile": "pnpm dlx projen post-compile",
+    "pre-compile": "pnpm dlx projen pre-compile",
+    "test": "pnpm dlx projen test",
+    "test:watch": "pnpm dlx projen test:watch",
+    "watch": "pnpm dlx projen watch",
+    "projen": "pnpm dlx projen"
+  }
+}