@dbx-tools/cli-tunnel 0.6.50 → 0.6.52

package/README.md

@@ -34,8 +34,12 @@ address against an allow-list, verified by a code sent over
   attempt counter, verified in constant time, in AppKit's `CacheManager` (memory
   by default, Lakebase when the app configures persistent `CacheStorage`) so TTL
   expiry and eviction are the cache's job.
-- Short-lived HS256 session JWT (via `jose`) carrying only the email, signed with
-  `AUTH_JWT_SECRET`.
+- HS256 session JWT (via `jose`) carrying only the email, signed with a key that
+  is PERSISTED in AppKit's cache for 30 days - so a signed-in browser stays signed
+  in across the restarts a tunnel sees whenever the app it wraps reloads. An
+  operator-held `TUNNEL_AUTH_JWT_SECRET` still wins. `TUNNEL_AUTH_SESSION_CUTOFF`
+  is the log-everyone-out switch, and takes a relative duration (`-30d`) as
+  readily as a date.
 - Allow-list patterns in three shapes, matched in order: a domain shortcut
   (`example.com`, `@example.com`), a shell-style glob (`*@example.com`), or a
   regex literal (`/^ops-.*@example\.com$/`). An empty list allows nobody.
@@ -92,25 +96,27 @@ original public port itself.
 Every flag has an environment fallback, so a deployment can configure the gate
 with no change to its start command.
 
-| Flag                | Env                       | Default                        |
-| ------------------- | ------------------------- | ------------------------------ |
-| `--allow`           | `TUNNEL_AUTH_ALLOW`       | empty (allow nobody)           |
-| `--subject`         | `TUNNEL_AUTH_SUBJECT`     | `Your verification code`       |
-| `--brand-name`      | `TUNNEL_AUTH_BRAND_NAME`  | the brand context `name`       |
-| `--message`         | `TUNNEL_AUTH_MESSAGE`     | `Your verification code is:`   |
-| `--session-ttl`     | `TUNNEL_AUTH_SESSION_TTL` | `43200` (12 hours)             |
-| `--code-ttl`        | `TUNNEL_AUTH_CODE_TTL`    | `600` (10 minutes)             |
-| `--subdomain`       | -                         | derived from the public domain |
-| `--public-domain`   | `TUNNEL_PUBLIC_DOMAIN`    | -                              |
-| `--forward-headers` | `TUNNEL_FORWARD_HEADERS`  | the built-in `x-` allow-list   |
-| `--insecure`        | `TUNNEL_INSECURE`         | off (the gate is required)     |
-| -                   | `TUNNEL_AUTH_JWT_SECRET`  | an ephemeral per-process key   |
+| Flag                | Env                          | Default                        |
+| ------------------- | ---------------------------- | ------------------------------ |
+| `--allow`           | `TUNNEL_AUTH_ALLOW`          | empty (allow nobody)           |
+| `--subject`         | `TUNNEL_AUTH_SUBJECT`        | `Your verification code`       |
+| `--brand-name`      | `TUNNEL_AUTH_BRAND_NAME`     | the brand context `name`       |
+| `--message`         | `TUNNEL_AUTH_MESSAGE`        | `Your verification code is:`   |
+| `--session-ttl`     | `TUNNEL_AUTH_SESSION_TTL`    | `2592000` (30 days)            |
+| `--code-ttl`        | `TUNNEL_AUTH_CODE_TTL`       | `600` (10 minutes)             |
+| `--session-cutoff`  | `TUNNEL_AUTH_SESSION_CUTOFF` | unset (no cutoff)              |
+| `--subdomain`       | -                            | derived from the public domain |
+| `--public-domain`   | `TUNNEL_PUBLIC_DOMAIN`       | -                              |
+| `--forward-headers` | `TUNNEL_FORWARD_HEADERS`     | the built-in `x-` allow-list   |
+| `--insecure`        | `TUNNEL_INSECURE`            | off (the gate is required)     |
+| -                   | `TUNNEL_AUTH_JWT_SECRET`     | an ephemeral per-process key   |
 
 Every variable is `TUNNEL_`-prefixed because the gate runs as a WRAPPER: it and
 the app it wraps share one environment, so a generic name is one the app may
 already be using. The earlier unprefixed spellings - `AUTH_SUBJECT`,
 `AUTH_BRAND_NAME`, `AUTH_MESSAGE`, `AUTH_SESSION_TTL`, `AUTH_CODE_TTL`,
-`AUTH_JWT_SECRET`, `EMAIL_AUTH_ALLOW`, `PUBLIC_DOMAIN` - are still read as
+`AUTH_JWT_SECRET`, `EMAIL_AUTH_ALLOW`, `PUBLIC_DOMAIN`, plus
+`TUNNEL_AUTH_SESSION_EPOCH` from before the cutoff rename - are still read as
 deprecated aliases, with the `TUNNEL_` name winning when both are set, so an
 existing deployment needs no coordinated rename. `PORTR_TOKEN` / `PORTR_SERVER`
 keep their names: that namespace belongs to portr itself, as does
@@ -118,10 +124,60 @@ keep their names: that namespace belongs to portr itself, as does
 
 `--allow` and `TUNNEL_AUTH_ALLOW` are UNIONED rather than one overriding the
 other, so a deployment-wide allow-list and a per-invocation addition both grant
-access. Session signing reads `TUNNEL_AUTH_JWT_SECRET`; when it is unset the gate
-mints an ephemeral per-process key, so sessions simply do not survive a restart
-rather than the gate refusing to serve. Set it in any deployment running more than
-one instance, or a session minted by one will not verify on another.
+access.
+
+## Sessions That Survive A Restart
+
+The signing key decides whether an already-issued session COOKIE still verifies,
+so where that key comes from is what decides whether a restart signs everyone out.
+Resolution order:
+
+1. **`TUNNEL_AUTH_JWT_SECRET`**, when set. The right answer for a fleet: an
+   operator-held secret needs no shared cache, and it survives a cache flush.
+2. **A key persisted in AppKit's cache for 30 days.** With a persistent
+   `CacheStorage` (Lakebase) the key outlives the process, so cookies stay valid
+   across restarts - which a tunnel does often, since it restarts whenever the app
+   it wraps reloads. On the default in-memory cache the key is per-process, the
+   same as having no secret at all.
+3. **An ephemeral per-process key**, when there is no secret and no reachable
+   cache. Sessions do not survive a restart, but the gate still serves: the key
+   only validates an ALREADY-issued session, so losing it costs sessions, never
+   admission. A caller still needs a code delivered to an allow-listed address.
+
+The cached key is read, generated-and-stored, then **re-read**. Two instances
+booting together both miss the cache, so both generate; adopting whatever is
+STORED afterwards is what makes them converge on one key instead of each trusting
+the one it minted. Set `TUNNEL_AUTH_JWT_SECRET` to remove the race entirely.
+
+`TUNNEL_AUTH_SESSION_TTL` defaults to the same 30 days the key is stored for, on
+purpose - a key that expired before the cookies it signed would sign everyone out
+for no reason.
+
+### Signing everyone out
+
+`--session-cutoff` / `TUNNEL_AUTH_SESSION_CUTOFF` invalidates every session issued
+before a given moment:
+
+```sh
+dbxt-tunnel --session-cutoff -30d -- bun src/server.ts
+dbxt-tunnel --session-cutoff 2026-08-02 -- bun src/server.ts
+TUNNEL_AUTH_SESSION_CUTOFF="now" dbxt-tunnel -- bun src/server.ts
+```
+
+The value goes through `@dbx-tools/shared-core`'s `object.toDate`, so a date, an
+ISO instant, epoch seconds or millis from `date +%s`, and a relative duration
+(`-30d`, `12 hours ago`) all work - the relative spelling being the one an
+operator usually wants, since "sign out anything older than a month" needs no
+timestamp arithmetic. It works two ways at once, so it holds however the key was
+resolved: the cutoff is part of the key's CACHE KEY (moving it orphans the
+previous key), and it is also checked against each token's `iat` (which is what
+makes it bite when `TUNNEL_AUTH_JWT_SECRET` is set and there is no key to
+rotate).
+
+A FUTURE date is clamped to now, because an unclamped one would refuse the
+sessions it is about to mint as well as the old ones - an app nobody can sign in
+to, from a mistyped year. An unparseable value is ignored with a warning rather
+than failing startup: this is the switch that gets a fleet back in.
 
 ## Inbound Header Policy
 
@@ -229,6 +285,8 @@ by hand.
 - `proxy` - the public-port reverse proxy: loopback-vs-platform classification,
   open login routes, session enforcement, and WebSocket forwarding.
 - `otp` - the `CacheManager`-backed code store and the session JWT.
+- `signingKey` - the cache-persisted HS256 session key (30-day TTL, get/generate/
+  re-read convergence) and the `TUNNEL_AUTH_SESSION_CUTOFF` force-clear cutoff.
 - `allowlist` - email domain / glob / regex matching and `looksLikeEmail`.
 - `headers` - the inbound-header allow-list: `toHeaderPolicy()`,
   `DEFAULT_FORWARD_HEADERS`, and the `PROTECTED_HEADERS` no pattern can forward.

package/index.ts

@@ -12,8 +12,9 @@ export * as plugin from "./src/plugin.ts";
 export * as portr from "./src/portr.ts";
 export * as proxy from "./src/proxy.ts";
 export * as rateLimit from "./src/rate-limit.ts";
+export * as signingKey from "./src/signing-key.ts";
 export { CommanderError } from "./src/cli.ts";
-export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.ts";
+export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, SESSION_CUTOFF_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.ts";
 export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.ts";
 export type { HeaderPolicy } from "./src/headers.ts";
 export { CodeStore } from "./src/otp.ts";
@@ -23,3 +24,5 @@ export type { AuthGateConfig, SendCodeOptions, ResolvedAuthGateConfig, AuthGateA
 export type { PortrConfig } from "./src/portr.ts";
 export type { ProxyOptions } from "./src/proxy.ts";
 export { RateLimiter } from "./src/rate-limit.ts";
+export { KEY_TTL_SECONDS } from "./src/signing-key.ts";
+export type { SigningKey } from "./src/signing-key.ts";

package/lib/index.d.ts

@@ -8,8 +8,9 @@ export * as plugin from "./src/plugin.ts";
 export * as portr from "./src/portr.ts";
 export * as proxy from "./src/proxy.ts";
 export * as rateLimit from "./src/rate-limit.ts";
+export * as signingKey from "./src/signing-key.ts";
 export { CommanderError } from "./src/cli.ts";
-export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.ts";
+export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, SESSION_CUTOFF_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.ts";
 export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.ts";
 export type { HeaderPolicy } from "./src/headers.ts";
 export { CodeStore } from "./src/otp.ts";
@@ -19,3 +20,5 @@ export type { AuthGateConfig, SendCodeOptions, ResolvedAuthGateConfig, AuthGateA
 export type { PortrConfig } from "./src/portr.ts";
 export type { ProxyOptions } from "./src/proxy.ts";
 export { RateLimiter } from "./src/rate-limit.ts";
+export { KEY_TTL_SECONDS } from "./src/signing-key.ts";
+export type { SigningKey } from "./src/signing-key.ts";

package/lib/index.js

@@ -11,10 +11,12 @@ export * as plugin from "./src/plugin.js";
 export * as portr from "./src/portr.js";
 export * as proxy from "./src/proxy.js";
 export * as rateLimit from "./src/rate-limit.js";
+export * as signingKey from "./src/signing-key.js";
 export { CommanderError } from "./src/cli.js";
-export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.js";
+export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, SESSION_CUTOFF_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.js";
 export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.js";
 export { CodeStore } from "./src/otp.js";
 export { AuthGatePlugin, authGate } from "./src/plugin.js";
 export { RateLimiter } from "./src/rate-limit.js";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxPQUFPLEtBQUssU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxLQUFLLEdBQUcsTUFBTSxjQUFjLENBQUM7QUFDcEMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssS0FBSyxNQUFNLGdCQUFnQixDQUFDO0FBQ3hDLE9BQU8sS0FBSyxLQUFLLE1BQU0sZ0JBQWdCLENBQUM7QUFDeEMsT0FBTyxLQUFLLFNBQVMsTUFBTSxxQkFBcUIsQ0FBQztBQUNqRCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQzlDLE9BQU8sRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxjQUFjLEVBQUUsaUJBQWlCLEVBQUUsWUFBWSxFQUFFLG1CQUFtQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQ3hMLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRTlFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFekMsT0FBTyxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUkzRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0scUJBQXFCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBHRU5FUkFURUQgYnkgcHJvamVuIHdhdGNoIC0gRE8gTk9UIEVESVQuXG4vLyBSZWdlbmVyYXRlZCBmcm9tIHRoZSBleHBvcnRpbmcgbW9kdWxlcyBpbiAuL3NyYy5cbi8vIEhhbmQgZWRpdHMgYXJlIG92ZXJ3cml0dGVuIG9uIHRoZSBuZXh0IHdhdGNoOyB0aGlzIGZpbGUgaXMgcmVhZC1vbmx5LlxuXG5leHBvcnQgKiBhcyBhbGxvd2xpc3QgZnJvbSBcIi4vc3JjL2FsbG93bGlzdC50c1wiO1xuZXhwb3J0ICogYXMgYXBwIGZyb20gXCIuL3NyYy9hcHAudHNcIjtcbmV4cG9ydCAqIGFzIGNsaSBmcm9tIFwiLi9zcmMvY2xpLnRzXCI7XG5leHBvcnQgKiBhcyBlbnYgZnJvbSBcIi4vc3JjL2Vudi50c1wiO1xuZXhwb3J0ICogYXMgaGVhZGVycyBmcm9tIFwiLi9zcmMvaGVhZGVycy50c1wiO1xuZXhwb3J0ICogYXMgb3RwIGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCAqIGFzIHBsdWdpbiBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgKiBhcyBwb3J0ciBmcm9tIFwiLi9zcmMvcG9ydHIudHNcIjtcbmV4cG9ydCAqIGFzIHByb3h5IGZyb20gXCIuL3NyYy9wcm94eS50c1wiO1xuZXhwb3J0ICogYXMgcmF0ZUxpbWl0IGZyb20gXCIuL3NyYy9yYXRlLWxpbWl0LnRzXCI7XG5leHBvcnQgeyBDb21tYW5kZXJFcnJvciB9IGZyb20gXCIuL3NyYy9jbGkudHNcIjtcbmV4cG9ydCB7IEFMTE9XX0VOViwgU1VCSkVDVF9FTlYsIEJSQU5EX05BTUVfRU5WLCBNRVNTQUdFX0VOViwgU0VTU0lPTl9UVExfRU5WLCBDT0RFX1RUTF9FTlYsIEpXVF9TRUNSRVRfRU5WLCBQVUJMSUNfRE9NQUlOX0VOViwgSU5TRUNVUkVfRU5WLCBGT1JXQVJEX0hFQURFUlNfRU5WIH0gZnJvbSBcIi4vc3JjL2Vudi50c1wiO1xuZXhwb3J0IHsgUFJPVEVDVEVEX0hFQURFUlMsIERFRkFVTFRfRk9SV0FSRF9IRUFERVJTIH0gZnJvbSBcIi4vc3JjL2hlYWRlcnMudHNcIjtcbmV4cG9ydCB0eXBlIHsgSGVhZGVyUG9saWN5IH0gZnJvbSBcIi4vc3JjL2hlYWRlcnMudHNcIjtcbmV4cG9ydCB7IENvZGVTdG9yZSB9IGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCB0eXBlIHsgVmVyaWZ5T3V0Y29tZSB9IGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCB7IEF1dGhHYXRlUGx1Z2luLCBhdXRoR2F0ZSB9IGZyb20gXCIuL3NyYy9wbHVnaW4udHNcIjtcbmV4cG9ydCB0eXBlIHsgQXV0aEdhdGVDb25maWcsIFNlbmRDb2RlT3B0aW9ucywgUmVzb2x2ZWRBdXRoR2F0ZUNvbmZpZywgQXV0aEdhdGVBcGkgfSBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgdHlwZSB7IFBvcnRyQ29uZmlnIH0gZnJvbSBcIi4vc3JjL3BvcnRyLnRzXCI7XG5leHBvcnQgdHlwZSB7IFByb3h5T3B0aW9ucyB9IGZyb20gXCIuL3NyYy9wcm94eS50c1wiO1xuZXhwb3J0IHsgUmF0ZUxpbWl0ZXIgfSBmcm9tIFwiLi9zcmMvcmF0ZS1saW1pdC50c1wiO1xuIl19
+export { KEY_TTL_SECONDS } from "./src/signing-key.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxPQUFPLEtBQUssU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxLQUFLLEdBQUcsTUFBTSxjQUFjLENBQUM7QUFDcEMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssS0FBSyxNQUFNLGdCQUFnQixDQUFDO0FBQ3hDLE9BQU8sS0FBSyxLQUFLLE1BQU0sZ0JBQWdCLENBQUM7QUFDeEMsT0FBTyxLQUFLLFNBQVMsTUFBTSxxQkFBcUIsQ0FBQztBQUNqRCxPQUFPLEtBQUssVUFBVSxNQUFNLHNCQUFzQixDQUFDO0FBQ25ELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDOUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxpQkFBaUIsRUFBRSxZQUFZLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDNU0sT0FBTyxFQUFFLGlCQUFpQixFQUFFLHVCQUF1QixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFOUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUV6QyxPQUFPLEVBQUUsY0FBYyxFQUFFLFFBQVEsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBSTNELE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNsRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sc0JBQXNCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBHRU5FUkFURUQgYnkgcHJvamVuIHdhdGNoIC0gRE8gTk9UIEVESVQuXG4vLyBSZWdlbmVyYXRlZCBmcm9tIHRoZSBleHBvcnRpbmcgbW9kdWxlcyBpbiAuL3NyYy5cbi8vIEhhbmQgZWRpdHMgYXJlIG92ZXJ3cml0dGVuIG9uIHRoZSBuZXh0IHdhdGNoOyB0aGlzIGZpbGUgaXMgcmVhZC1vbmx5LlxuXG5leHBvcnQgKiBhcyBhbGxvd2xpc3QgZnJvbSBcIi4vc3JjL2FsbG93bGlzdC50c1wiO1xuZXhwb3J0ICogYXMgYXBwIGZyb20gXCIuL3NyYy9hcHAudHNcIjtcbmV4cG9ydCAqIGFzIGNsaSBmcm9tIFwiLi9zcmMvY2xpLnRzXCI7XG5leHBvcnQgKiBhcyBlbnYgZnJvbSBcIi4vc3JjL2Vudi50c1wiO1xuZXhwb3J0ICogYXMgaGVhZGVycyBmcm9tIFwiLi9zcmMvaGVhZGVycy50c1wiO1xuZXhwb3J0ICogYXMgb3RwIGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCAqIGFzIHBsdWdpbiBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgKiBhcyBwb3J0ciBmcm9tIFwiLi9zcmMvcG9ydHIudHNcIjtcbmV4cG9ydCAqIGFzIHByb3h5IGZyb20gXCIuL3NyYy9wcm94eS50c1wiO1xuZXhwb3J0ICogYXMgcmF0ZUxpbWl0IGZyb20gXCIuL3NyYy9yYXRlLWxpbWl0LnRzXCI7XG5leHBvcnQgKiBhcyBzaWduaW5nS2V5IGZyb20gXCIuL3NyYy9zaWduaW5nLWtleS50c1wiO1xuZXhwb3J0IHsgQ29tbWFuZGVyRXJyb3IgfSBmcm9tIFwiLi9zcmMvY2xpLnRzXCI7XG5leHBvcnQgeyBBTExPV19FTlYsIFNVQkpFQ1RfRU5WLCBCUkFORF9OQU1FX0VOViwgTUVTU0FHRV9FTlYsIFNFU1NJT05fVFRMX0VOViwgQ09ERV9UVExfRU5WLCBKV1RfU0VDUkVUX0VOViwgU0VTU0lPTl9DVVRPRkZfRU5WLCBQVUJMSUNfRE9NQUlOX0VOViwgSU5TRUNVUkVfRU5WLCBGT1JXQVJEX0hFQURFUlNfRU5WIH0gZnJvbSBcIi4vc3JjL2Vudi50c1wiO1xuZXhwb3J0IHsgUFJPVEVDVEVEX0hFQURFUlMsIERFRkFVTFRfRk9SV0FSRF9IRUFERVJTIH0gZnJvbSBcIi4vc3JjL2hlYWRlcnMudHNcIjtcbmV4cG9ydCB0eXBlIHsgSGVhZGVyUG9saWN5IH0gZnJvbSBcIi4vc3JjL2hlYWRlcnMudHNcIjtcbmV4cG9ydCB7IENvZGVTdG9yZSB9IGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCB0eXBlIHsgVmVyaWZ5T3V0Y29tZSB9IGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCB7IEF1dGhHYXRlUGx1Z2luLCBhdXRoR2F0ZSB9IGZyb20gXCIuL3NyYy9wbHVnaW4udHNcIjtcbmV4cG9ydCB0eXBlIHsgQXV0aEdhdGVDb25maWcsIFNlbmRDb2RlT3B0aW9ucywgUmVzb2x2ZWRBdXRoR2F0ZUNvbmZpZywgQXV0aEdhdGVBcGkgfSBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgdHlwZSB7IFBvcnRyQ29uZmlnIH0gZnJvbSBcIi4vc3JjL3BvcnRyLnRzXCI7XG5leHBvcnQgdHlwZSB7IFByb3h5T3B0aW9ucyB9IGZyb20gXCIuL3NyYy9wcm94eS50c1wiO1xuZXhwb3J0IHsgUmF0ZUxpbWl0ZXIgfSBmcm9tIFwiLi9zcmMvcmF0ZS1saW1pdC50c1wiO1xuZXhwb3J0IHsgS0VZX1RUTF9TRUNPTkRTIH0gZnJvbSBcIi4vc3JjL3NpZ25pbmcta2V5LnRzXCI7XG5leHBvcnQgdHlwZSB7IFNpZ25pbmdLZXkgfSBmcm9tIFwiLi9zcmMvc2lnbmluZy1rZXkudHNcIjtcbiJdfQ==

package/lib/src/cli.js

@@ -50,6 +50,7 @@ function program() {
         .option("--message <text>", "Line shown above the code in the email (env TUNNEL_AUTH_MESSAGE)")
         .option("--session-ttl <seconds>", "Session lifetime (env TUNNEL_AUTH_SESSION_TTL)")
         .option("--code-ttl <seconds>", "One-time-code lifetime (env TUNNEL_AUTH_CODE_TTL)")
+        .option("--session-cutoff <when>", "Invalidate sessions issued before this point, signing everyone out: a date, ISO instant, epoch seconds, or relative duration like -30d (env TUNNEL_AUTH_SESSION_CUTOFF)")
         .option("--forward-headers <patterns>", "Extra x- request headers tunnel traffic may forward: literal / glob / /regex/ (env TUNNEL_FORWARD_HEADERS)")
         .option("--insecure", "Run the tunnel OPEN with no gate (env TUNNEL_INSECURE=true). Otherwise the CLI fails fast when email SMTP is not configured.")
         .allowExcessArguments(true)
@@ -100,6 +101,7 @@ export async function runCli(argv) {
         message: opts.message,
         sessionTtlSeconds: opts.sessionTtl ? Number(opts.sessionTtl) : undefined,
         codeTtlSeconds: opts.codeTtl ? Number(opts.codeTtl) : undefined,
+        sessionCutoff: opts.sessionCutoff,
     };
     // 1. Spawn the wrapped app with the PRIVATE port. It binds loopback; only the
     //    proxy reaches it.
@@ -154,4 +156,4 @@ export async function runCli(argv) {
     // Any child exit (or a signal) tears the whole thing down.
     superviseExit(children);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXlCRztBQUVILE9BQU8sRUFBcUIsS0FBSyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDOUQsT0FBTyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUNwRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxZQUFZLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFN0QsT0FBTyxFQUFFLFlBQVksRUFBRSxrQkFBa0IsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxZQUFZLENBQUM7QUFDNUYsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUV4QyxPQUFPLEVBQUUsY0FBYyxFQUFFLENBQUM7QUFFMUIsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVwQyxxRkFBcUY7QUFDckYsU0FBUyxVQUFVO0lBQ2pCLE9BQU8sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxDQUFDO0FBQ25ELENBQUM7QUFlRCxvRkFBb0Y7QUFDcEYsU0FBUyxPQUFPO0lBQ2QsT0FBTyxJQUFJLE9BQU8sRUFBRTtTQUNqQixJQUFJLENBQUMsa0JBQWtCLENBQUM7U0FDeEIsV0FBVyxDQUFDLDBEQUEwRCxDQUFDO1NBQ3ZFLE1BQU0sQ0FBQyxrQkFBa0IsRUFBRSwyREFBMkQsQ0FBQztTQUN2RixNQUFNLENBQ0wsb0JBQW9CLEVBQ3BCLG1GQUFtRixDQUNwRjtTQUNBLE1BQU0sQ0FBQyxvQkFBb0IsRUFBRSwwREFBMEQsQ0FBQztTQUN4RixNQUFNLENBQUMsd0JBQXdCLEVBQUUsdURBQXVELENBQUM7U0FDekYsTUFBTSxDQUNMLHFCQUFxQixFQUNyQixzR0FBc0csQ0FDdkc7U0FDQSxNQUFNLENBQUMsa0JBQWtCLEVBQUUsa0VBQWtFLENBQUM7U0FDOUYsTUFBTSxDQUFDLHlCQUF5QixFQUFFLGdEQUFnRCxDQUFDO1NBQ25GLE1BQU0sQ0FBQyxzQkFBc0IsRUFBRSxtREFBbUQsQ0FBQztTQUNuRixNQUFNLENBQ0wsOEJBQThCLEVBQzlCLDRHQUE0RyxDQUM3RztTQUNBLE1BQU0sQ0FDTCxZQUFZLEVBQ1osOEhBQThILENBQy9IO1NBQ0Esb0JBQW9CLENBQUMsSUFBSSxDQUFDO1NBQzFCLFVBQVUsQ0FBQyxZQUFZLEVBQUUsV0FBVyxDQUFDLENBQUM7QUFDM0MsQ0FBQztBQUVELGtGQUFrRjtBQUNsRixTQUFTLGFBQWEsQ0FBQyxRQUF3QjtJQUM3QyxJQUFJLFlBQVksR0FBRyxLQUFLLENBQUM7SUFDekIsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFZLEVBQVEsRUFBRTtRQUN0QyxJQUFJLFlBQVk7WUFBRSxPQUFPO1FBQ3pCLFlBQVksR0FBRyxJQUFJLENBQUM7UUFDcEIsS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUM3QixJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU07Z0JBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzQyxDQUFDO1FBQ0QsdUVBQXVFO1FBQ3ZFLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3JELENBQUMsQ0FBQztJQUNGLEtBQUssTUFBTSxLQUFLLElBQUksUUFBUSxFQUFFLENBQUM7UUFDN0IsS0FBSyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRTtZQUN4QixNQUFNLENBQUMsSUFBSSxDQUFDLGlCQUFpQixJQUFJLElBQUksUUFBUSx5QkFBeUIsQ0FBQyxDQUFDO1lBQ3hFLFFBQVEsQ0FBQyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDdEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFVLEVBQUUsQ0FBQztRQUMzRCxPQUFPLENBQUMsRUFBRSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNyQyxDQUFDO0FBQ0gsQ0FBQztBQUVELHFDQUFxQztBQUNyQyxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FBQyxJQUFjO0lBQ3pDLDBEQUEwRDtJQUMxRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQy9CLE1BQU0sS0FBSyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDbkQsTUFBTSxPQUFPLEdBQUcsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUVwRCxNQUFNLElBQUksR0FBRyxPQUFPLEVBQUUsQ0FBQztJQUN2QixJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQWMsQ0FBQztJQUVyQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFJLGNBQWMsQ0FBQyxDQUFDLEVBQUUsbUJBQW1CLEVBQUUsbUNBQW1DLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLElBQUksSUFBSSxDQUFDLENBQUM7SUFDbkUsTUFBTSxPQUFPLEdBQUcsVUFBVSxFQUFFLENBQUM7SUFFN0IsTUFBTSxVQUFVLEdBQW1CO1FBQ2pDLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztRQUNqQixPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU87UUFDckIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO1FBQ3pCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztRQUNyQixpQkFBaUIsRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTO1FBQ3hFLGNBQWMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTO0tBQ2hFLENBQUM7SUFFRiw4RUFBOEU7SUFDOUUsdUJBQXVCO0lBQ3ZCLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0NBQWdDLE9BQU8sS0FBSyxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RSxNQUFNLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEdBQUcsT0FBTyxDQUFDO0lBQy9CLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxHQUFJLEVBQUUsSUFBSSxFQUFFO1FBQzVCLEdBQUcsRUFBRSxFQUFFLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxtQkFBbUIsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRTtRQUNoRixLQUFLLEVBQUUsU0FBUztLQUNqQixDQUFDLENBQUM7SUFFSCw0RUFBNEU7SUFDNUUscUVBQXFFO0lBQ3JFLCtFQUErRTtJQUMvRSxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsWUFBWSxDQUFDLElBQUksS0FBSyxDQUFDO0lBQ25FLElBQUksSUFBMEQsQ0FBQztJQUMvRCxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ2IsTUFBTSxDQUFDLElBQUksQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7U0FBTSxDQUFDO1FBQ04sSUFBSSxDQUFDO1lBQ0gsSUFBSSxHQUFHLE1BQU0sWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3hDLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsNEVBQTRFO1lBQzVFLDRDQUE0QztZQUM1QyxNQUFNLENBQUMsS0FBSyxDQUFDLDJCQUEyQixFQUFFLEVBQUUsS0FBSyxFQUFHLEtBQWUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQy9FLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFRCw4RUFBOEU7SUFDOUUsZ0ZBQWdGO0lBQ2hGLE1BQU0sVUFBVSxDQUFDO1FBQ2YsVUFBVTtRQUNWLE9BQU87UUFDUCxJQUFJO1FBQ0osY0FBYyxFQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxtQkFBbUIsQ0FBQztLQUNuRSxDQUFDLENBQUM7SUFFSCxzREFBc0Q7SUFDdEQsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUM7UUFDckMsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQy9CLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztRQUN6QixJQUFJLEVBQUUsVUFBVTtLQUNqQixDQUFDLENBQUM7SUFDSCxNQUFNLFFBQVEsR0FBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN2QyxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sUUFBUSxHQUFHLFlBQVksRUFBRSxDQUFDO1FBQ2hDLGdCQUFnQixDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUN4QyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNuRCxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsc0ZBQXNGLENBQ3ZGLENBQUM7SUFDSixDQUFDO0lBRUQsMkRBQTJEO0lBQzNELGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUMxQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBgZGJ4LXRvb2xzLXR1bm5lbGAgLyBgZGJ4dC10dW5uZWxgIENMSS5cbiAqXG4gKiBXcmFwcyBhbiBhcHAncyBzdGFydCBjb21tYW5kIHdpdGggYSBwdWJsaWMgcG9ydHIgdHVubmVsIGFuZCBhbiBlbWFpbC1PVFBcbiAqIGFjY2VzcyBnYXRlLiBFdmVyeXRoaW5nIGFmdGVyIGAtLWAgaXMgdGhlIFJFQUwgYXBwIHN0YXJ0IGNvbW1hbmQ6XG4gKlxuICogICBkYnh0LXR1bm5lbCAtLXN1YmplY3QgXCJIZXJlJ3MgeW91ciBPVFBcIiAtLWFsbG93IGV4YW1wbGUuY29tIC0tIGJ1biBzcmMvc2VydmVyLnRzXG4gKlxuICogQm9vdCBzZXF1ZW5jZTpcbiAqICAgMS4gUGljayBhIHJhbmRvbSBQUklWQVRFIHBvcnQgYW5kIHNwYXduIHRoZSBhcHAgY29tbWFuZCB3aXRoXG4gKiAgICAgIGBEQVRBQlJJQ0tTX0FQUF9QT1JUYCBzZXQgdG8gaXQgKHNvIHRoZSBhcHAgYmluZHMgbG9vcGJhY2stcHJpdmF0ZSkuIFRoYXRcbiAqICAgICAgdmFyaWFibGUgbmFtZSBpcyB0aGUgRGF0YWJyaWNrcyBBcHBzIHJ1bnRpbWUgY29udHJhY3Q7IHRoZSBnYXRlIGl0c2VsZiBpc1xuICogICAgICBwbGF0Zm9ybS1uZXV0cmFsIGFuZCBob25vdXJzIHdoYXRldmVyIHBvcnQgaXQgZmluZHMgdGhlcmUuXG4gKiAgIDIuIEJvb3QgdGhlIHRpbnkgZ2F0ZSBBcHBLaXQgYXBwIChubyBzZXJ2ZXIpOiBpbml0cyBgQ2FjaGVNYW5hZ2VyYCArIHRoZVxuICogICAgICBlbWFpbCB0cmFuc3BvcnQsIHlpZWxkcyB0aGUgaW4tcHJvY2VzcyBnYXRlIEFQSS5cbiAqICAgMy4gU3RhcnQgdGhlIGdhdGUgUFJPWFkgb24gdGhlIE9SSUdJTkFMIHB1YmxpYyBwb3J0LCBmb3J3YXJkaW5nIHRvIHRoZSBhcHAuXG4gKiAgIDQuIEluc3RhbGwgKyBydW4gcG9ydHIgcG9pbnRlZCBhdCB0aGUgcHVibGljIHBvcnQgKHdoZW4gYSB0dW5uZWwgaXNcbiAqICAgICAgY29uZmlndXJlZDsgb3RoZXJ3aXNlIHRoZSBwcm94eSBzdGlsbCBnYXRlcyBub3RoaW5nIGFuZCBmb3J3YXJkcykuXG4gKlxuICogU3VwZXJ2aXNpb246IHRoZSBhcHAgY2hpbGQsIHBvcnRyIGNoaWxkLCBhbmQgdGhpcyBwcm9jZXNzIGFyZSB0aWVkIHRvZ2V0aGVyIC1cbiAqIGlmIEFOWSBleGl0cywgZXZlcnl0aGluZyBjb21lcyBkb3duIChjb25jdXJyZW50bHktc3R5bGUgYGtpbGxPdGhlcnNgKS5cbiAqXG4gKiBPcHRpb25zIGNvbWUgZnJvbSBmbGFncyBPUiBlbnY7IHNlZSB0aGUgb3B0aW9uIGRlZmluaXRpb25zIGJlbG93LlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyB0eXBlIENoaWxkUHJvY2Vzcywgc3Bhd24gfSBmcm9tIFwibm9kZTpjaGlsZF9wcm9jZXNzXCI7XG5pbXBvcnQgeyBlbnYsIGxvZyB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlXCI7XG5pbXBvcnQgeyBDb21tYW5kLCBDb21tYW5kZXJFcnJvciB9IGZyb20gXCJjb21tYW5kZXJcIjtcbmltcG9ydCB7IHN0YXJ0R2F0ZUFwcCB9IGZyb20gXCIuL2FwcC50c1wiO1xuaW1wb3J0IHsgRk9SV0FSRF9IRUFERVJTX0VOViwgSU5TRUNVUkVfRU5WIH0gZnJvbSBcIi4vZW52LnRzXCI7XG5pbXBvcnQgdHlwZSB7IEF1dGhHYXRlQ29uZmlnIH0gZnJvbSBcIi4vcGx1Z2luLnRzXCI7XG5pbXBvcnQgeyBpbnN0YWxsUG9ydHIsIHJlc29sdmVQb3J0ckNvbmZpZywgc3RhcnRQb3J0ciwgd3JpdGVQb3J0ckNvbmZpZyB9IGZyb20gXCIuL3BvcnRyLnRzXCI7XG5pbXBvcnQgeyBzdGFydFByb3h5IH0gZnJvbSBcIi4vcHJveHkudHNcIjtcblxuZXhwb3J0IHsgQ29tbWFuZGVyRXJyb3IgfTtcblxuY29uc3QgbG9nZ2VyID0gbG9nLmxvZ2dlcihcInR1bm5lbFwiKTtcblxuLyoqIEEgcmFuZG9tIGVwaGVtZXJhbCBwb3J0IGZvciB0aGUgYXBwIHRvIGJpbmQgKHRoZSBwcm94eSBmcm9udHMgdGhlIHB1YmxpYyBvbmUpLiAqL1xuZnVuY3Rpb24gcmFuZG9tUG9ydCgpOiBudW1iZXIge1xuICByZXR1cm4gMjAwMDAgKyBNYXRoLmZsb29yKE1hdGgucmFuZG9tKCkgKiAyMDAwMCk7XG59XG5cbmludGVyZmFjZSBUdW5uZWxPcHRzIHtcbiAgc3ViamVjdD86IHN0cmluZztcbiAgYWxsb3c/OiBzdHJpbmc7XG4gIHN1YmRvbWFpbj86IHN0cmluZztcbiAgcHVibGljRG9tYWluPzogc3RyaW5nO1xuICBicmFuZE5hbWU/OiBzdHJpbmc7XG4gIG1lc3NhZ2U/OiBzdHJpbmc7XG4gIHNlc3Npb25UdGw/OiBzdHJpbmc7XG4gIGNvZGVUdGw/OiBzdHJpbmc7XG4gIGluc2VjdXJlPzogYm9vbGVhbjtcbiAgZm9yd2FyZEhlYWRlcnM/OiBzdHJpbmc7XG59XG5cbi8qKiBCdWlsZCB0aGUgY29tbWFuZGVyIHByb2dyYW0uIGAtLWAgc2VwYXJhdGVzIGZsYWdzIGZyb20gdGhlIGFwcCBzdGFydCBjb21tYW5kLiAqL1xuZnVuY3Rpb24gcHJvZ3JhbSgpOiBDb21tYW5kIHtcbiAgcmV0dXJuIG5ldyBDb21tYW5kKClcbiAgICAubmFtZShcImRieC10b29scy10dW5uZWxcIilcbiAgICAuZGVzY3JpcHRpb24oXCJGcm9udCBhbiBhcHAgd2l0aCBhIHB1YmxpYyBwb3J0ciB0dW5uZWwgKyBlbWFpbC1PVFAgZ2F0ZVwiKVxuICAgIC5vcHRpb24oXCItLXN1YmplY3QgPHRleHQ+XCIsIFwiU3ViamVjdCBsaW5lIGZvciB0aGUgY29kZSBlbWFpbCAoZW52IFRVTk5FTF9BVVRIX1NVQkpFQ1QpXCIpXG4gICAgLm9wdGlvbihcbiAgICAgIFwiLS1hbGxvdyA8cGF0dGVybnM+XCIsXG4gICAgICBcIkNvbW1hL3NwYWNlLXNlcGFyYXRlZCBhbGxvdy1saXN0OiBkb21haW4gLyBnbG9iIC8gL3JlZ2V4LyAoZW52IFRVTk5FTF9BVVRIX0FMTE9XKVwiLFxuICAgIClcbiAgICAub3B0aW9uKFwiLS1zdWJkb21haW4gPG5hbWU+XCIsIFwicG9ydHIgc3ViZG9tYWluIChlbHNlIGRlcml2ZWQgZnJvbSBUVU5ORUxfUFVCTElDX0RPTUFJTilcIilcbiAgICAub3B0aW9uKFwiLS1wdWJsaWMtZG9tYWluIDxob3N0PlwiLCBcInBvcnRyIDxzdWJkb21haW4+LjxzZXJ2ZXI+IChlbnYgVFVOTkVMX1BVQkxJQ19ET01BSU4pXCIpXG4gICAgLm9wdGlvbihcbiAgICAgIFwiLS1icmFuZC1uYW1lIDxuYW1lPlwiLFxuICAgICAgXCJEaXNwbGF5IG5hbWUgaW4gdGhlIGNvZGUgZW1haWwgY29weSAoZW52IFRVTk5FTF9BVVRIX0JSQU5EX05BTUU7IGRlZmF1bHRzIHRvIHRoZSBicmFuZCBjb250ZXh0IG5hbWUpXCIsXG4gICAgKVxuICAgIC5vcHRpb24oXCItLW1lc3NhZ2UgPHRleHQ+XCIsIFwiTGluZSBzaG93biBhYm92ZSB0aGUgY29kZSBpbiB0aGUgZW1haWwgKGVudiBUVU5ORUxfQVVUSF9NRVNTQUdFKVwiKVxuICAgIC5vcHRpb24oXCItLXNlc3Npb24tdHRsIDxzZWNvbmRzPlwiLCBcIlNlc3Npb24gbGlmZXRpbWUgKGVudiBUVU5ORUxfQVVUSF9TRVNTSU9OX1RUTClcIilcbiAgICAub3B0aW9uKFwiLS1jb2RlLXR0bCA8c2Vjb25kcz5cIiwgXCJPbmUtdGltZS1jb2RlIGxpZmV0aW1lIChlbnYgVFVOTkVMX0FVVEhfQ09ERV9UVEwpXCIpXG4gICAgLm9wdGlvbihcbiAgICAgIFwiLS1mb3J3YXJkLWhlYWRlcnMgPHBhdHRlcm5zPlwiLFxuICAgICAgXCJFeHRyYSB4LSByZXF1ZXN0IGhlYWRlcnMgdHVubmVsIHRyYWZmaWMgbWF5IGZvcndhcmQ6IGxpdGVyYWwgLyBnbG9iIC8gL3JlZ2V4LyAoZW52IFRVTk5FTF9GT1JXQVJEX0hFQURFUlMpXCIsXG4gICAgKVxuICAgIC5vcHRpb24oXG4gICAgICBcIi0taW5zZWN1cmVcIixcbiAgICAgIFwiUnVuIHRoZSB0dW5uZWwgT1BFTiB3aXRoIG5vIGdhdGUgKGVudiBUVU5ORUxfSU5TRUNVUkU9dHJ1ZSkuIE90aGVyd2lzZSB0aGUgQ0xJIGZhaWxzIGZhc3Qgd2hlbiBlbWFpbCBTTVRQIGlzIG5vdCBjb25maWd1cmVkLlwiLFxuICAgIClcbiAgICAuYWxsb3dFeGNlc3NBcmd1bWVudHModHJ1ZSlcbiAgICAuaGVscE9wdGlvbihcIi1oLCAtLWhlbHBcIiwgXCJTaG93IGhlbHBcIik7XG59XG5cbi8qKiBUaWUgYSBjaGlsZCdzIGV4aXQgdG8gZnVsbCB0ZWFyZG93bjogYW55IGV4aXQgYnJpbmdzIHRoZSB3aG9sZSB0dW5uZWwgZG93bi4gKi9cbmZ1bmN0aW9uIHN1cGVydmlzZUV4aXQoY2hpbGRyZW46IENoaWxkUHJvY2Vzc1tdKTogdm9pZCB7XG4gIGxldCBzaHV0dGluZ0Rvd24gPSBmYWxzZTtcbiAgY29uc3Qgc2h1dGRvd24gPSAoY29kZTogbnVtYmVyKTogdm9pZCA9PiB7XG4gICAgaWYgKHNodXR0aW5nRG93bikgcmV0dXJuO1xuICAgIHNodXR0aW5nRG93biA9IHRydWU7XG4gICAgZm9yIChjb25zdCBjaGlsZCBvZiBjaGlsZHJlbikge1xuICAgICAgaWYgKCFjaGlsZC5raWxsZWQpIGNoaWxkLmtpbGwoXCJTSUdURVJNXCIpO1xuICAgIH1cbiAgICAvLyBHaXZlIGNoaWxkcmVuIGEgbW9tZW50LCB0aGVuIGV4aXQgd2l0aCB0aGUgZmlyc3Qgbm9uLXplcm8gY29kZSBzZWVuLlxuICAgIHNldFRpbWVvdXQoKCkgPT4gcHJvY2Vzcy5leGl0KGNvZGUpLCAzMDAwKS51bnJlZigpO1xuICB9O1xuICBmb3IgKGNvbnN0IGNoaWxkIG9mIGNoaWxkcmVuKSB7XG4gICAgY2hpbGQub24oXCJleGl0XCIsIChjb2RlKSA9PiB7XG4gICAgICBsb2dnZXIud2FybihgY2hpbGQgZXhpdGVkICgke2NvZGUgPz8gXCJzaWduYWxcIn0pOyBicmluZ2luZyB0dW5uZWwgZG93bmApO1xuICAgICAgc2h1dGRvd24oY29kZSA/PyAxKTtcbiAgICB9KTtcbiAgfVxuICBmb3IgKGNvbnN0IHNpZyBvZiBbXCJTSUdURVJNXCIsIFwiU0lHSU5UXCIsIFwiU0lHSFVQXCJdIGFzIGNvbnN0KSB7XG4gICAgcHJvY2Vzcy5vbihzaWcsICgpID0+IHNodXRkb3duKDApKTtcbiAgfVxufVxuXG4vKiogUGFyc2UgYXJndiBhbmQgcnVuIHRoZSB0dW5uZWwuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcnVuQ2xpKGFyZ3Y6IHN0cmluZ1tdKTogUHJvbWlzZTx2b2lkPiB7XG4gIC8vIFNwbGl0IGZsYWdzIGZyb20gdGhlIHdyYXBwZWQgY29tbWFuZCBhdCB0aGUgZmlyc3QgYC0tYC5cbiAgY29uc3Qgc2VwID0gYXJndi5pbmRleE9mKFwiLS1cIik7XG4gIGNvbnN0IGZsYWdzID0gc2VwID49IDAgPyBhcmd2LnNsaWNlKDAsIHNlcCkgOiBhcmd2O1xuICBjb25zdCBjb21tYW5kID0gc2VwID49IDAgPyBhcmd2LnNsaWNlKHNlcCArIDEpIDogW107XG5cbiAgY29uc3QgcHJvZyA9IHByb2dyYW0oKTtcbiAgcHJvZy5wYXJzZShmbGFncyk7XG4gIGNvbnN0IG9wdHMgPSBwcm9nLm9wdHM8VHVubmVsT3B0cz4oKTtcblxuICBpZiAoY29tbWFuZC5sZW5ndGggPT09IDApIHtcbiAgICB0aHJvdyBuZXcgQ29tbWFuZGVyRXJyb3IoMSwgXCJ0dW5uZWwubm8tY29tbWFuZFwiLCBcIm5vIHN0YXJ0IGNvbW1hbmQgZ2l2ZW4gYWZ0ZXIgYC0tYFwiKTtcbiAgfVxuXG4gIGNvbnN0IHB1YmxpY1BvcnQgPSBOdW1iZXIocHJvY2Vzcy5lbnYuREFUQUJSSUNLU19BUFBfUE9SVCA/PyA4MDAwKTtcbiAgY29uc3QgYXBwUG9ydCA9IHJhbmRvbVBvcnQoKTtcblxuICBjb25zdCBnYXRlQ29uZmlnOiBBdXRoR2F0ZUNvbmZpZyA9IHtcbiAgICBhbGxvdzogb3B0cy5hbGxvdyxcbiAgICBzdWJqZWN0OiBvcHRzLnN1YmplY3QsXG4gICAgYnJhbmROYW1lOiBvcHRzLmJyYW5kTmFtZSxcbiAgICBtZXNzYWdlOiBvcHRzLm1lc3NhZ2UsXG4gICAgc2Vzc2lvblR0bFNlY29uZHM6IG9wdHMuc2Vzc2lvblR0bCA/IE51bWJlcihvcHRzLnNlc3Npb25UdGwpIDogdW5kZWZpbmVkLFxuICAgIGNvZGVUdGxTZWNvbmRzOiBvcHRzLmNvZGVUdGwgPyBOdW1iZXIob3B0cy5jb2RlVHRsKSA6IHVuZGVmaW5lZCxcbiAgfTtcblxuICAvLyAxLiBTcGF3biB0aGUgd3JhcHBlZCBhcHAgd2l0aCB0aGUgUFJJVkFURSBwb3J0LiBJdCBiaW5kcyBsb29wYmFjazsgb25seSB0aGVcbiAgLy8gICAgcHJveHkgcmVhY2hlcyBpdC5cbiAgbG9nZ2VyLmluZm8oYHNwYXduaW5nIGFwcCBvbiBwcml2YXRlIHBvcnQgJHthcHBQb3J0fTogJHtjb21tYW5kLmpvaW4oXCIgXCIpfWApO1xuICBjb25zdCBbY21kLCAuLi5hcmdzXSA9IGNvbW1hbmQ7XG4gIGNvbnN0IGFwcCA9IHNwYXduKGNtZCEsIGFyZ3MsIHtcbiAgICBlbnY6IHsgLi4ucHJvY2Vzcy5lbnYsIERBVEFCUklDS1NfQVBQX1BPUlQ6IFN0cmluZyhhcHBQb3J0KSwgSE9TVDogXCIxMjcuMC4wLjFcIiB9LFxuICAgIHN0ZGlvOiBcImluaGVyaXRcIixcbiAgfSk7XG5cbiAgLy8gMi4gQm9vdCB0aGUgZ2F0ZSBhcHAgKGNhY2hlICsgZW1haWwgdHJhbnNwb3J0ICsgZ2F0ZSBBUEkpLiBgc3RhcnRHYXRlQXBwYFxuICAvLyAgICBGQUlMUyBGQVNUIHdoZW4gZW1haWwgY2FuJ3Qgc2VuZCBjb2RlcyAobm8gU01UUCkuIEluc2VjdXJlIG1vZGVcbiAgLy8gICAgKGAtLWluc2VjdXJlYCAvIFRVTk5FTF9JTlNFQ1VSRSkgc2tpcHMgdGhlIGdhdGUgYW5kIHJ1bnMgdGhlIHR1bm5lbCBvcGVuLlxuICBjb25zdCBpbnNlY3VyZSA9IGVudi5ib29sZWFuKG9wdHMuaW5zZWN1cmUsIElOU0VDVVJFX0VOVikgPz8gZmFsc2U7XG4gIGxldCBnYXRlOiBBd2FpdGVkPFJldHVyblR5cGU8dHlwZW9mIHN0YXJ0R2F0ZUFwcD4+IHwgdW5kZWZpbmVkO1xuICBpZiAoaW5zZWN1cmUpIHtcbiAgICBsb2dnZXIud2FybihcImluc2VjdXJlIG1vZGUgLSB0dW5uZWwgcnVucyBPUEVOIHdpdGggbm8gZW1haWwtT1RQIGdhdGVcIik7XG4gIH0gZWxzZSB7XG4gICAgdHJ5IHtcbiAgICAgIGdhdGUgPSBhd2FpdCBzdGFydEdhdGVBcHAoZ2F0ZUNvbmZpZyk7XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIC8vIEZhaWwgZmFzdDogZG9uJ3Qgc2lsZW50bHkgZXhwb3NlIGFuIHVuZ2F0ZWQgdHVubmVsLiBUaGUgb3BlcmF0b3IgbXVzdCBmaXhcbiAgICAgIC8vIFNNVFAgb3IgZXhwbGljaXRseSBvcHQgaW50byBgLS1pbnNlY3VyZWAuXG4gICAgICBsb2dnZXIuZXJyb3IoXCJjYW5ub3Qgc3RhcnQgdGhlIE9UUCBnYXRlXCIsIHsgZXJyb3I6IChlcnJvciBhcyBFcnJvcikubWVzc2FnZSB9KTtcbiAgICAgIHRocm93IGVycm9yO1xuICAgIH1cbiAgfVxuXG4gIC8vIDMuIFN0YXJ0IHRoZSBnYXRlIHByb3h5IG9uIHRoZSBwdWJsaWMgcG9ydCAob3BlbiB3aGVuIGBnYXRlYCBpcyB1bmRlZmluZWQpLlxuICAvLyAgICBgZm9yd2FyZEhlYWRlcnNgIG9ubHkgQUREUyB0byB0aGUgYnVpbHQtaW4gYWxsb3ctbGlzdDsgc2VlIGAuL2hlYWRlcnMudHNgLlxuICBhd2FpdCBzdGFydFByb3h5KHtcbiAgICBwdWJsaWNQb3J0LFxuICAgIGFwcFBvcnQsXG4gICAgZ2F0ZSxcbiAgICBmb3J3YXJkSGVhZGVyczogZW52Lmxpc3Qob3B0cy5mb3J3YXJkSGVhZGVycywgRk9SV0FSRF9IRUFERVJTX0VOViksXG4gIH0pO1xuXG4gIC8vIDQuIEluc3RhbGwgKyBydW4gcG9ydHIgd2hlbiBhIHR1bm5lbCBpcyBjb25maWd1cmVkLlxuICBjb25zdCBwb3J0ckNvbmZpZyA9IHJlc29sdmVQb3J0ckNvbmZpZyh7XG4gICAgcHVibGljRG9tYWluOiBvcHRzLnB1YmxpY0RvbWFpbixcbiAgICBzdWJkb21haW46IG9wdHMuc3ViZG9tYWluLFxuICAgIHBvcnQ6IHB1YmxpY1BvcnQsXG4gIH0pO1xuICBjb25zdCBjaGlsZHJlbjogQ2hpbGRQcm9jZXNzW10gPSBbYXBwXTtcbiAgaWYgKHBvcnRyQ29uZmlnKSB7XG4gICAgY29uc3QgcG9ydHJFbnYgPSBpbnN0YWxsUG9ydHIoKTtcbiAgICB3cml0ZVBvcnRyQ29uZmlnKHBvcnRyQ29uZmlnLCBwb3J0ckVudik7XG4gICAgY2hpbGRyZW4ucHVzaChzdGFydFBvcnRyKHBvcnRyQ29uZmlnLCBwb3J0ckVudikpO1xuICB9IGVsc2Uge1xuICAgIGxvZ2dlci5pbmZvKFxuICAgICAgXCJubyBQT1JUUl9UT0tFTi9UVU5ORUxfUFVCTElDX0RPTUFJTiAtIHNlcnZpbmcgdGhlIGdhdGUgcHJveHkgd2l0aG91dCBhIHB1YmxpYyB0dW5uZWxcIixcbiAgICApO1xuICB9XG5cbiAgLy8gQW55IGNoaWxkIGV4aXQgKG9yIGEgc2lnbmFsKSB0ZWFycyB0aGUgd2hvbGUgdGhpbmcgZG93bi5cbiAgc3VwZXJ2aXNlRXhpdChjaGlsZHJlbik7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXlCRztBQUVILE9BQU8sRUFBcUIsS0FBSyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDOUQsT0FBTyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUNwRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxZQUFZLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFN0QsT0FBTyxFQUFFLFlBQVksRUFBRSxrQkFBa0IsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxZQUFZLENBQUM7QUFDNUYsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUV4QyxPQUFPLEVBQUUsY0FBYyxFQUFFLENBQUM7QUFFMUIsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVwQyxxRkFBcUY7QUFDckYsU0FBUyxVQUFVO0lBQ2pCLE9BQU8sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxDQUFDO0FBQ25ELENBQUM7QUFnQkQsb0ZBQW9GO0FBQ3BGLFNBQVMsT0FBTztJQUNkLE9BQU8sSUFBSSxPQUFPLEVBQUU7U0FDakIsSUFBSSxDQUFDLGtCQUFrQixDQUFDO1NBQ3hCLFdBQVcsQ0FBQywwREFBMEQsQ0FBQztTQUN2RSxNQUFNLENBQUMsa0JBQWtCLEVBQUUsMkRBQTJELENBQUM7U0FDdkYsTUFBTSxDQUNMLG9CQUFvQixFQUNwQixtRkFBbUYsQ0FDcEY7U0FDQSxNQUFNLENBQUMsb0JBQW9CLEVBQUUsMERBQTBELENBQUM7U0FDeEYsTUFBTSxDQUFDLHdCQUF3QixFQUFFLHVEQUF1RCxDQUFDO1NBQ3pGLE1BQU0sQ0FDTCxxQkFBcUIsRUFDckIsc0dBQXNHLENBQ3ZHO1NBQ0EsTUFBTSxDQUFDLGtCQUFrQixFQUFFLGtFQUFrRSxDQUFDO1NBQzlGLE1BQU0sQ0FBQyx5QkFBeUIsRUFBRSxnREFBZ0QsQ0FBQztTQUNuRixNQUFNLENBQUMsc0JBQXNCLEVBQUUsbURBQW1ELENBQUM7U0FDbkYsTUFBTSxDQUNMLHlCQUF5QixFQUN6Qix5S0FBeUssQ0FDMUs7U0FDQSxNQUFNLENBQ0wsOEJBQThCLEVBQzlCLDRHQUE0RyxDQUM3RztTQUNBLE1BQU0sQ0FDTCxZQUFZLEVBQ1osOEhBQThILENBQy9IO1NBQ0Esb0JBQW9CLENBQUMsSUFBSSxDQUFDO1NBQzFCLFVBQVUsQ0FBQyxZQUFZLEVBQUUsV0FBVyxDQUFDLENBQUM7QUFDM0MsQ0FBQztBQUVELGtGQUFrRjtBQUNsRixTQUFTLGFBQWEsQ0FBQyxRQUF3QjtJQUM3QyxJQUFJLFlBQVksR0FBRyxLQUFLLENBQUM7SUFDekIsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFZLEVBQVEsRUFBRTtRQUN0QyxJQUFJLFlBQVk7WUFBRSxPQUFPO1FBQ3pCLFlBQVksR0FBRyxJQUFJLENBQUM7UUFDcEIsS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUM3QixJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU07Z0JBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzQyxDQUFDO1FBQ0QsdUVBQXVFO1FBQ3ZFLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3JELENBQUMsQ0FBQztJQUNGLEtBQUssTUFBTSxLQUFLLElBQUksUUFBUSxFQUFFLENBQUM7UUFDN0IsS0FBSyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRTtZQUN4QixNQUFNLENBQUMsSUFBSSxDQUFDLGlCQUFpQixJQUFJLElBQUksUUFBUSx5QkFBeUIsQ0FBQyxDQUFDO1lBQ3hFLFFBQVEsQ0FBQyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDdEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFVLEVBQUUsQ0FBQztRQUMzRCxPQUFPLENBQUMsRUFBRSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNyQyxDQUFDO0FBQ0gsQ0FBQztBQUVELHFDQUFxQztBQUNyQyxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FBQyxJQUFjO0lBQ3pDLDBEQUEwRDtJQUMxRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQy9CLE1BQU0sS0FBSyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDbkQsTUFBTSxPQUFPLEdBQUcsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUVwRCxNQUFNLElBQUksR0FBRyxPQUFPLEVBQUUsQ0FBQztJQUN2QixJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQWMsQ0FBQztJQUVyQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFJLGNBQWMsQ0FBQyxDQUFDLEVBQUUsbUJBQW1CLEVBQUUsbUNBQW1DLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLElBQUksSUFBSSxDQUFDLENBQUM7SUFDbkUsTUFBTSxPQUFPLEdBQUcsVUFBVSxFQUFFLENBQUM7SUFFN0IsTUFBTSxVQUFVLEdBQW1CO1FBQ2pDLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztRQUNqQixPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU87UUFDckIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO1FBQ3pCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztRQUNyQixpQkFBaUIsRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTO1FBQ3hFLGNBQWMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTO1FBQy9ELGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtLQUNsQyxDQUFDO0lBRUYsOEVBQThFO0lBQzlFLHVCQUF1QjtJQUN2QixNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxPQUFPLEtBQUssT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDN0UsTUFBTSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLE9BQU8sQ0FBQztJQUMvQixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsR0FBSSxFQUFFLElBQUksRUFBRTtRQUM1QixHQUFHLEVBQUUsRUFBRSxHQUFHLE9BQU8sQ0FBQyxHQUFHLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUU7UUFDaEYsS0FBSyxFQUFFLFNBQVM7S0FDakIsQ0FBQyxDQUFDO0lBRUgsNEVBQTRFO0lBQzVFLHFFQUFxRTtJQUNyRSwrRUFBK0U7SUFDL0UsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxJQUFJLEtBQUssQ0FBQztJQUNuRSxJQUFJLElBQTBELENBQUM7SUFDL0QsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNiLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO1NBQU0sQ0FBQztRQUNOLElBQUksQ0FBQztZQUNILElBQUksR0FBRyxNQUFNLFlBQVksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4QyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLDRFQUE0RTtZQUM1RSw0Q0FBNEM7WUFDNUMsTUFBTSxDQUFDLEtBQUssQ0FBQywyQkFBMkIsRUFBRSxFQUFFLEtBQUssRUFBRyxLQUFlLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMvRSxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQsOEVBQThFO0lBQzlFLGdGQUFnRjtJQUNoRixNQUFNLFVBQVUsQ0FBQztRQUNmLFVBQVU7UUFDVixPQUFPO1FBQ1AsSUFBSTtRQUNKLGNBQWMsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsbUJBQW1CLENBQUM7S0FDbkUsQ0FBQyxDQUFDO0lBRUgsc0RBQXNEO0lBQ3RELE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDO1FBQ3JDLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUMvQixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7UUFDekIsSUFBSSxFQUFFLFVBQVU7S0FDakIsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxRQUFRLEdBQW1CLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDdkMsSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUNoQixNQUFNLFFBQVEsR0FBRyxZQUFZLEVBQUUsQ0FBQztRQUNoQyxnQkFBZ0IsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDeEMsUUFBUSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbkQsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLENBQUMsSUFBSSxDQUNULHNGQUFzRixDQUN2RixDQUFDO0lBQ0osQ0FBQztJQUVELDJEQUEyRDtJQUMzRCxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDMUIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogYGRieC10b29scy10dW5uZWxgIC8gYGRieHQtdHVubmVsYCBDTEkuXG4gKlxuICogV3JhcHMgYW4gYXBwJ3Mgc3RhcnQgY29tbWFuZCB3aXRoIGEgcHVibGljIHBvcnRyIHR1bm5lbCBhbmQgYW4gZW1haWwtT1RQXG4gKiBhY2Nlc3MgZ2F0ZS4gRXZlcnl0aGluZyBhZnRlciBgLS1gIGlzIHRoZSBSRUFMIGFwcCBzdGFydCBjb21tYW5kOlxuICpcbiAqICAgZGJ4dC10dW5uZWwgLS1zdWJqZWN0IFwiSGVyZSdzIHlvdXIgT1RQXCIgLS1hbGxvdyBleGFtcGxlLmNvbSAtLSBidW4gc3JjL3NlcnZlci50c1xuICpcbiAqIEJvb3Qgc2VxdWVuY2U6XG4gKiAgIDEuIFBpY2sgYSByYW5kb20gUFJJVkFURSBwb3J0IGFuZCBzcGF3biB0aGUgYXBwIGNvbW1hbmQgd2l0aFxuICogICAgICBgREFUQUJSSUNLU19BUFBfUE9SVGAgc2V0IHRvIGl0IChzbyB0aGUgYXBwIGJpbmRzIGxvb3BiYWNrLXByaXZhdGUpLiBUaGF0XG4gKiAgICAgIHZhcmlhYmxlIG5hbWUgaXMgdGhlIERhdGFicmlja3MgQXBwcyBydW50aW1lIGNvbnRyYWN0OyB0aGUgZ2F0ZSBpdHNlbGYgaXNcbiAqICAgICAgcGxhdGZvcm0tbmV1dHJhbCBhbmQgaG9ub3VycyB3aGF0ZXZlciBwb3J0IGl0IGZpbmRzIHRoZXJlLlxuICogICAyLiBCb290IHRoZSB0aW55IGdhdGUgQXBwS2l0IGFwcCAobm8gc2VydmVyKTogaW5pdHMgYENhY2hlTWFuYWdlcmAgKyB0aGVcbiAqICAgICAgZW1haWwgdHJhbnNwb3J0LCB5aWVsZHMgdGhlIGluLXByb2Nlc3MgZ2F0ZSBBUEkuXG4gKiAgIDMuIFN0YXJ0IHRoZSBnYXRlIFBST1hZIG9uIHRoZSBPUklHSU5BTCBwdWJsaWMgcG9ydCwgZm9yd2FyZGluZyB0byB0aGUgYXBwLlxuICogICA0LiBJbnN0YWxsICsgcnVuIHBvcnRyIHBvaW50ZWQgYXQgdGhlIHB1YmxpYyBwb3J0ICh3aGVuIGEgdHVubmVsIGlzXG4gKiAgICAgIGNvbmZpZ3VyZWQ7IG90aGVyd2lzZSB0aGUgcHJveHkgc3RpbGwgZ2F0ZXMgbm90aGluZyBhbmQgZm9yd2FyZHMpLlxuICpcbiAqIFN1cGVydmlzaW9uOiB0aGUgYXBwIGNoaWxkLCBwb3J0ciBjaGlsZCwgYW5kIHRoaXMgcHJvY2VzcyBhcmUgdGllZCB0b2dldGhlciAtXG4gKiBpZiBBTlkgZXhpdHMsIGV2ZXJ5dGhpbmcgY29tZXMgZG93biAoY29uY3VycmVudGx5LXN0eWxlIGBraWxsT3RoZXJzYCkuXG4gKlxuICogT3B0aW9ucyBjb21lIGZyb20gZmxhZ3MgT1IgZW52OyBzZWUgdGhlIG9wdGlvbiBkZWZpbml0aW9ucyBiZWxvdy5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgdHlwZSBDaGlsZFByb2Nlc3MsIHNwYXduIH0gZnJvbSBcIm5vZGU6Y2hpbGRfcHJvY2Vzc1wiO1xuaW1wb3J0IHsgZW52LCBsb2cgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHsgQ29tbWFuZCwgQ29tbWFuZGVyRXJyb3IgfSBmcm9tIFwiY29tbWFuZGVyXCI7XG5pbXBvcnQgeyBzdGFydEdhdGVBcHAgfSBmcm9tIFwiLi9hcHAudHNcIjtcbmltcG9ydCB7IEZPUldBUkRfSEVBREVSU19FTlYsIElOU0VDVVJFX0VOViB9IGZyb20gXCIuL2Vudi50c1wiO1xuaW1wb3J0IHR5cGUgeyBBdXRoR2F0ZUNvbmZpZyB9IGZyb20gXCIuL3BsdWdpbi50c1wiO1xuaW1wb3J0IHsgaW5zdGFsbFBvcnRyLCByZXNvbHZlUG9ydHJDb25maWcsIHN0YXJ0UG9ydHIsIHdyaXRlUG9ydHJDb25maWcgfSBmcm9tIFwiLi9wb3J0ci50c1wiO1xuaW1wb3J0IHsgc3RhcnRQcm94eSB9IGZyb20gXCIuL3Byb3h5LnRzXCI7XG5cbmV4cG9ydCB7IENvbW1hbmRlckVycm9yIH07XG5cbmNvbnN0IGxvZ2dlciA9IGxvZy5sb2dnZXIoXCJ0dW5uZWxcIik7XG5cbi8qKiBBIHJhbmRvbSBlcGhlbWVyYWwgcG9ydCBmb3IgdGhlIGFwcCB0byBiaW5kICh0aGUgcHJveHkgZnJvbnRzIHRoZSBwdWJsaWMgb25lKS4gKi9cbmZ1bmN0aW9uIHJhbmRvbVBvcnQoKTogbnVtYmVyIHtcbiAgcmV0dXJuIDIwMDAwICsgTWF0aC5mbG9vcihNYXRoLnJhbmRvbSgpICogMjAwMDApO1xufVxuXG5pbnRlcmZhY2UgVHVubmVsT3B0cyB7XG4gIHN1YmplY3Q/OiBzdHJpbmc7XG4gIGFsbG93Pzogc3RyaW5nO1xuICBzdWJkb21haW4/OiBzdHJpbmc7XG4gIHB1YmxpY0RvbWFpbj86IHN0cmluZztcbiAgYnJhbmROYW1lPzogc3RyaW5nO1xuICBtZXNzYWdlPzogc3RyaW5nO1xuICBzZXNzaW9uVHRsPzogc3RyaW5nO1xuICBjb2RlVHRsPzogc3RyaW5nO1xuICBzZXNzaW9uQ3V0b2ZmPzogc3RyaW5nO1xuICBpbnNlY3VyZT86IGJvb2xlYW47XG4gIGZvcndhcmRIZWFkZXJzPzogc3RyaW5nO1xufVxuXG4vKiogQnVpbGQgdGhlIGNvbW1hbmRlciBwcm9ncmFtLiBgLS1gIHNlcGFyYXRlcyBmbGFncyBmcm9tIHRoZSBhcHAgc3RhcnQgY29tbWFuZC4gKi9cbmZ1bmN0aW9uIHByb2dyYW0oKTogQ29tbWFuZCB7XG4gIHJldHVybiBuZXcgQ29tbWFuZCgpXG4gICAgLm5hbWUoXCJkYngtdG9vbHMtdHVubmVsXCIpXG4gICAgLmRlc2NyaXB0aW9uKFwiRnJvbnQgYW4gYXBwIHdpdGggYSBwdWJsaWMgcG9ydHIgdHVubmVsICsgZW1haWwtT1RQIGdhdGVcIilcbiAgICAub3B0aW9uKFwiLS1zdWJqZWN0IDx0ZXh0PlwiLCBcIlN1YmplY3QgbGluZSBmb3IgdGhlIGNvZGUgZW1haWwgKGVudiBUVU5ORUxfQVVUSF9TVUJKRUNUKVwiKVxuICAgIC5vcHRpb24oXG4gICAgICBcIi0tYWxsb3cgPHBhdHRlcm5zPlwiLFxuICAgICAgXCJDb21tYS9zcGFjZS1zZXBhcmF0ZWQgYWxsb3ctbGlzdDogZG9tYWluIC8gZ2xvYiAvIC9yZWdleC8gKGVudiBUVU5ORUxfQVVUSF9BTExPVylcIixcbiAgICApXG4gICAgLm9wdGlvbihcIi0tc3ViZG9tYWluIDxuYW1lPlwiLCBcInBvcnRyIHN1YmRvbWFpbiAoZWxzZSBkZXJpdmVkIGZyb20gVFVOTkVMX1BVQkxJQ19ET01BSU4pXCIpXG4gICAgLm9wdGlvbihcIi0tcHVibGljLWRvbWFpbiA8aG9zdD5cIiwgXCJwb3J0ciA8c3ViZG9tYWluPi48c2VydmVyPiAoZW52IFRVTk5FTF9QVUJMSUNfRE9NQUlOKVwiKVxuICAgIC5vcHRpb24oXG4gICAgICBcIi0tYnJhbmQtbmFtZSA8bmFtZT5cIixcbiAgICAgIFwiRGlzcGxheSBuYW1lIGluIHRoZSBjb2RlIGVtYWlsIGNvcHkgKGVudiBUVU5ORUxfQVVUSF9CUkFORF9OQU1FOyBkZWZhdWx0cyB0byB0aGUgYnJhbmQgY29udGV4dCBuYW1lKVwiLFxuICAgIClcbiAgICAub3B0aW9uKFwiLS1tZXNzYWdlIDx0ZXh0PlwiLCBcIkxpbmUgc2hvd24gYWJvdmUgdGhlIGNvZGUgaW4gdGhlIGVtYWlsIChlbnYgVFVOTkVMX0FVVEhfTUVTU0FHRSlcIilcbiAgICAub3B0aW9uKFwiLS1zZXNzaW9uLXR0bCA8c2Vjb25kcz5cIiwgXCJTZXNzaW9uIGxpZmV0aW1lIChlbnYgVFVOTkVMX0FVVEhfU0VTU0lPTl9UVEwpXCIpXG4gICAgLm9wdGlvbihcIi0tY29kZS10dGwgPHNlY29uZHM+XCIsIFwiT25lLXRpbWUtY29kZSBsaWZldGltZSAoZW52IFRVTk5FTF9BVVRIX0NPREVfVFRMKVwiKVxuICAgIC5vcHRpb24oXG4gICAgICBcIi0tc2Vzc2lvbi1jdXRvZmYgPHdoZW4+XCIsXG4gICAgICBcIkludmFsaWRhdGUgc2Vzc2lvbnMgaXNzdWVkIGJlZm9yZSB0aGlzIHBvaW50LCBzaWduaW5nIGV2ZXJ5b25lIG91dDogYSBkYXRlLCBJU08gaW5zdGFudCwgZXBvY2ggc2Vjb25kcywgb3IgcmVsYXRpdmUgZHVyYXRpb24gbGlrZSAtMzBkIChlbnYgVFVOTkVMX0FVVEhfU0VTU0lPTl9DVVRPRkYpXCIsXG4gICAgKVxuICAgIC5vcHRpb24oXG4gICAgICBcIi0tZm9yd2FyZC1oZWFkZXJzIDxwYXR0ZXJucz5cIixcbiAgICAgIFwiRXh0cmEgeC0gcmVxdWVzdCBoZWFkZXJzIHR1bm5lbCB0cmFmZmljIG1heSBmb3J3YXJkOiBsaXRlcmFsIC8gZ2xvYiAvIC9yZWdleC8gKGVudiBUVU5ORUxfRk9SV0FSRF9IRUFERVJTKVwiLFxuICAgIClcbiAgICAub3B0aW9uKFxuICAgICAgXCItLWluc2VjdXJlXCIsXG4gICAgICBcIlJ1biB0aGUgdHVubmVsIE9QRU4gd2l0aCBubyBnYXRlIChlbnYgVFVOTkVMX0lOU0VDVVJFPXRydWUpLiBPdGhlcndpc2UgdGhlIENMSSBmYWlscyBmYXN0IHdoZW4gZW1haWwgU01UUCBpcyBub3QgY29uZmlndXJlZC5cIixcbiAgICApXG4gICAgLmFsbG93RXhjZXNzQXJndW1lbnRzKHRydWUpXG4gICAgLmhlbHBPcHRpb24oXCItaCwgLS1oZWxwXCIsIFwiU2hvdyBoZWxwXCIpO1xufVxuXG4vKiogVGllIGEgY2hpbGQncyBleGl0IHRvIGZ1bGwgdGVhcmRvd246IGFueSBleGl0IGJyaW5ncyB0aGUgd2hvbGUgdHVubmVsIGRvd24uICovXG5mdW5jdGlvbiBzdXBlcnZpc2VFeGl0KGNoaWxkcmVuOiBDaGlsZFByb2Nlc3NbXSk6IHZvaWQge1xuICBsZXQgc2h1dHRpbmdEb3duID0gZmFsc2U7XG4gIGNvbnN0IHNodXRkb3duID0gKGNvZGU6IG51bWJlcik6IHZvaWQgPT4ge1xuICAgIGlmIChzaHV0dGluZ0Rvd24pIHJldHVybjtcbiAgICBzaHV0dGluZ0Rvd24gPSB0cnVlO1xuICAgIGZvciAoY29uc3QgY2hpbGQgb2YgY2hpbGRyZW4pIHtcbiAgICAgIGlmICghY2hpbGQua2lsbGVkKSBjaGlsZC5raWxsKFwiU0lHVEVSTVwiKTtcbiAgICB9XG4gICAgLy8gR2l2ZSBjaGlsZHJlbiBhIG1vbWVudCwgdGhlbiBleGl0IHdpdGggdGhlIGZpcnN0IG5vbi16ZXJvIGNvZGUgc2Vlbi5cbiAgICBzZXRUaW1lb3V0KCgpID0+IHByb2Nlc3MuZXhpdChjb2RlKSwgMzAwMCkudW5yZWYoKTtcbiAgfTtcbiAgZm9yIChjb25zdCBjaGlsZCBvZiBjaGlsZHJlbikge1xuICAgIGNoaWxkLm9uKFwiZXhpdFwiLCAoY29kZSkgPT4ge1xuICAgICAgbG9nZ2VyLndhcm4oYGNoaWxkIGV4aXRlZCAoJHtjb2RlID8/IFwic2lnbmFsXCJ9KTsgYnJpbmdpbmcgdHVubmVsIGRvd25gKTtcbiAgICAgIHNodXRkb3duKGNvZGUgPz8gMSk7XG4gICAgfSk7XG4gIH1cbiAgZm9yIChjb25zdCBzaWcgb2YgW1wiU0lHVEVSTVwiLCBcIlNJR0lOVFwiLCBcIlNJR0hVUFwiXSBhcyBjb25zdCkge1xuICAgIHByb2Nlc3Mub24oc2lnLCAoKSA9PiBzaHV0ZG93bigwKSk7XG4gIH1cbn1cblxuLyoqIFBhcnNlIGFyZ3YgYW5kIHJ1biB0aGUgdHVubmVsLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJ1bkNsaShhcmd2OiBzdHJpbmdbXSk6IFByb21pc2U8dm9pZD4ge1xuICAvLyBTcGxpdCBmbGFncyBmcm9tIHRoZSB3cmFwcGVkIGNvbW1hbmQgYXQgdGhlIGZpcnN0IGAtLWAuXG4gIGNvbnN0IHNlcCA9IGFyZ3YuaW5kZXhPZihcIi0tXCIpO1xuICBjb25zdCBmbGFncyA9IHNlcCA+PSAwID8gYXJndi5zbGljZSgwLCBzZXApIDogYXJndjtcbiAgY29uc3QgY29tbWFuZCA9IHNlcCA+PSAwID8gYXJndi5zbGljZShzZXAgKyAxKSA6IFtdO1xuXG4gIGNvbnN0IHByb2cgPSBwcm9ncmFtKCk7XG4gIHByb2cucGFyc2UoZmxhZ3MpO1xuICBjb25zdCBvcHRzID0gcHJvZy5vcHRzPFR1bm5lbE9wdHM+KCk7XG5cbiAgaWYgKGNvbW1hbmQubGVuZ3RoID09PSAwKSB7XG4gICAgdGhyb3cgbmV3IENvbW1hbmRlckVycm9yKDEsIFwidHVubmVsLm5vLWNvbW1hbmRcIiwgXCJubyBzdGFydCBjb21tYW5kIGdpdmVuIGFmdGVyIGAtLWBcIik7XG4gIH1cblxuICBjb25zdCBwdWJsaWNQb3J0ID0gTnVtYmVyKHByb2Nlc3MuZW52LkRBVEFCUklDS1NfQVBQX1BPUlQgPz8gODAwMCk7XG4gIGNvbnN0IGFwcFBvcnQgPSByYW5kb21Qb3J0KCk7XG5cbiAgY29uc3QgZ2F0ZUNvbmZpZzogQXV0aEdhdGVDb25maWcgPSB7XG4gICAgYWxsb3c6IG9wdHMuYWxsb3csXG4gICAgc3ViamVjdDogb3B0cy5zdWJqZWN0LFxuICAgIGJyYW5kTmFtZTogb3B0cy5icmFuZE5hbWUsXG4gICAgbWVzc2FnZTogb3B0cy5tZXNzYWdlLFxuICAgIHNlc3Npb25UdGxTZWNvbmRzOiBvcHRzLnNlc3Npb25UdGwgPyBOdW1iZXIob3B0cy5zZXNzaW9uVHRsKSA6IHVuZGVmaW5lZCxcbiAgICBjb2RlVHRsU2Vjb25kczogb3B0cy5jb2RlVHRsID8gTnVtYmVyKG9wdHMuY29kZVR0bCkgOiB1bmRlZmluZWQsXG4gICAgc2Vzc2lvbkN1dG9mZjogb3B0cy5zZXNzaW9uQ3V0b2ZmLFxuICB9O1xuXG4gIC8vIDEuIFNwYXduIHRoZSB3cmFwcGVkIGFwcCB3aXRoIHRoZSBQUklWQVRFIHBvcnQuIEl0IGJpbmRzIGxvb3BiYWNrOyBvbmx5IHRoZVxuICAvLyAgICBwcm94eSByZWFjaGVzIGl0LlxuICBsb2dnZXIuaW5mbyhgc3Bhd25pbmcgYXBwIG9uIHByaXZhdGUgcG9ydCAke2FwcFBvcnR9OiAke2NvbW1hbmQuam9pbihcIiBcIil9YCk7XG4gIGNvbnN0IFtjbWQsIC4uLmFyZ3NdID0gY29tbWFuZDtcbiAgY29uc3QgYXBwID0gc3Bhd24oY21kISwgYXJncywge1xuICAgIGVudjogeyAuLi5wcm9jZXNzLmVudiwgREFUQUJSSUNLU19BUFBfUE9SVDogU3RyaW5nKGFwcFBvcnQpLCBIT1NUOiBcIjEyNy4wLjAuMVwiIH0sXG4gICAgc3RkaW86IFwiaW5oZXJpdFwiLFxuICB9KTtcblxuICAvLyAyLiBCb290IHRoZSBnYXRlIGFwcCAoY2FjaGUgKyBlbWFpbCB0cmFuc3BvcnQgKyBnYXRlIEFQSSkuIGBzdGFydEdhdGVBcHBgXG4gIC8vICAgIEZBSUxTIEZBU1Qgd2hlbiBlbWFpbCBjYW4ndCBzZW5kIGNvZGVzIChubyBTTVRQKS4gSW5zZWN1cmUgbW9kZVxuICAvLyAgICAoYC0taW5zZWN1cmVgIC8gVFVOTkVMX0lOU0VDVVJFKSBza2lwcyB0aGUgZ2F0ZSBhbmQgcnVucyB0aGUgdHVubmVsIG9wZW4uXG4gIGNvbnN0IGluc2VjdXJlID0gZW52LmJvb2xlYW4ob3B0cy5pbnNlY3VyZSwgSU5TRUNVUkVfRU5WKSA/PyBmYWxzZTtcbiAgbGV0IGdhdGU6IEF3YWl0ZWQ8UmV0dXJuVHlwZTx0eXBlb2Ygc3RhcnRHYXRlQXBwPj4gfCB1bmRlZmluZWQ7XG4gIGlmIChpbnNlY3VyZSkge1xuICAgIGxvZ2dlci53YXJuKFwiaW5zZWN1cmUgbW9kZSAtIHR1bm5lbCBydW5zIE9QRU4gd2l0aCBubyBlbWFpbC1PVFAgZ2F0ZVwiKTtcbiAgfSBlbHNlIHtcbiAgICB0cnkge1xuICAgICAgZ2F0ZSA9IGF3YWl0IHN0YXJ0R2F0ZUFwcChnYXRlQ29uZmlnKTtcbiAgICB9IGNhdGNoIChlcnJvcikge1xuICAgICAgLy8gRmFpbCBmYXN0OiBkb24ndCBzaWxlbnRseSBleHBvc2UgYW4gdW5nYXRlZCB0dW5uZWwuIFRoZSBvcGVyYXRvciBtdXN0IGZpeFxuICAgICAgLy8gU01UUCBvciBleHBsaWNpdGx5IG9wdCBpbnRvIGAtLWluc2VjdXJlYC5cbiAgICAgIGxvZ2dlci5lcnJvcihcImNhbm5vdCBzdGFydCB0aGUgT1RQIGdhdGVcIiwgeyBlcnJvcjogKGVycm9yIGFzIEVycm9yKS5tZXNzYWdlIH0pO1xuICAgICAgdGhyb3cgZXJyb3I7XG4gICAgfVxuICB9XG5cbiAgLy8gMy4gU3RhcnQgdGhlIGdhdGUgcHJveHkgb24gdGhlIHB1YmxpYyBwb3J0IChvcGVuIHdoZW4gYGdhdGVgIGlzIHVuZGVmaW5lZCkuXG4gIC8vICAgIGBmb3J3YXJkSGVhZGVyc2Agb25seSBBRERTIHRvIHRoZSBidWlsdC1pbiBhbGxvdy1saXN0OyBzZWUgYC4vaGVhZGVycy50c2AuXG4gIGF3YWl0IHN0YXJ0UHJveHkoe1xuICAgIHB1YmxpY1BvcnQsXG4gICAgYXBwUG9ydCxcbiAgICBnYXRlLFxuICAgIGZvcndhcmRIZWFkZXJzOiBlbnYubGlzdChvcHRzLmZvcndhcmRIZWFkZXJzLCBGT1JXQVJEX0hFQURFUlNfRU5WKSxcbiAgfSk7XG5cbiAgLy8gNC4gSW5zdGFsbCArIHJ1biBwb3J0ciB3aGVuIGEgdHVubmVsIGlzIGNvbmZpZ3VyZWQuXG4gIGNvbnN0IHBvcnRyQ29uZmlnID0gcmVzb2x2ZVBvcnRyQ29uZmlnKHtcbiAgICBwdWJsaWNEb21haW46IG9wdHMucHVibGljRG9tYWluLFxuICAgIHN1YmRvbWFpbjogb3B0cy5zdWJkb21haW4sXG4gICAgcG9ydDogcHVibGljUG9ydCxcbiAgfSk7XG4gIGNvbnN0IGNoaWxkcmVuOiBDaGlsZFByb2Nlc3NbXSA9IFthcHBdO1xuICBpZiAocG9ydHJDb25maWcpIHtcbiAgICBjb25zdCBwb3J0ckVudiA9IGluc3RhbGxQb3J0cigpO1xuICAgIHdyaXRlUG9ydHJDb25maWcocG9ydHJDb25maWcsIHBvcnRyRW52KTtcbiAgICBjaGlsZHJlbi5wdXNoKHN0YXJ0UG9ydHIocG9ydHJDb25maWcsIHBvcnRyRW52KSk7XG4gIH0gZWxzZSB7XG4gICAgbG9nZ2VyLmluZm8oXG4gICAgICBcIm5vIFBPUlRSX1RPS0VOL1RVTk5FTF9QVUJMSUNfRE9NQUlOIC0gc2VydmluZyB0aGUgZ2F0ZSBwcm94eSB3aXRob3V0IGEgcHVibGljIHR1bm5lbFwiLFxuICAgICk7XG4gIH1cblxuICAvLyBBbnkgY2hpbGQgZXhpdCAob3IgYSBzaWduYWwpIHRlYXJzIHRoZSB3aG9sZSB0aGluZyBkb3duLlxuICBzdXBlcnZpc2VFeGl0KGNoaWxkcmVuKTtcbn1cbiJdfQ==

package/lib/src/env.d.ts

@@ -43,6 +43,12 @@ export declare const SESSION_TTL_ENV: EnvKey;
 export declare const CODE_TTL_ENV: EnvKey;
 /** HS256 signing secret for the session JWT. */
 export declare const JWT_SECRET_ENV: EnvKey;
+/**
+ * Force-clear cutoff: every session issued BEFORE it stops verifying. Anything
+ * `object.toDate` accepts - a date, an ISO instant, epoch seconds/millis, or a
+ * relative duration (`-30d`, `7 days ago`).
+ */
+export declare const SESSION_CUTOFF_ENV: EnvKey;
 /** The public `<subdomain>.<server>` portr should serve on. */
 export declare const PUBLIC_DOMAIN_ENV: EnvKey;
 /** Run the tunnel OPEN, with no gate. Ignored unless truthy. */

package/lib/src/env.js

@@ -42,10 +42,19 @@ export const SESSION_TTL_ENV = ["TUNNEL_AUTH_SESSION_TTL", "AUTH_SESSION_TTL"];
 export const CODE_TTL_ENV = ["TUNNEL_AUTH_CODE_TTL", "AUTH_CODE_TTL"];
 /** HS256 signing secret for the session JWT. */
 export const JWT_SECRET_ENV = ["TUNNEL_AUTH_JWT_SECRET", "AUTH_JWT_SECRET"];
+/**
+ * Force-clear cutoff: every session issued BEFORE it stops verifying. Anything
+ * `object.toDate` accepts - a date, an ISO instant, epoch seconds/millis, or a
+ * relative duration (`-30d`, `7 days ago`).
+ */
+export const SESSION_CUTOFF_ENV = [
+    "TUNNEL_AUTH_SESSION_CUTOFF",
+    "TUNNEL_AUTH_SESSION_EPOCH",
+];
 /** The public `<subdomain>.<server>` portr should serve on. */
 export const PUBLIC_DOMAIN_ENV = ["TUNNEL_PUBLIC_DOMAIN", "PUBLIC_DOMAIN"];
 /** Run the tunnel OPEN, with no gate. Ignored unless truthy. */
 export const INSECURE_ENV = "TUNNEL_INSECURE";
 /** Extra `x-` request headers tunnel traffic may forward. */
 export const FORWARD_HEADERS_ENV = "TUNNEL_FORWARD_HEADERS";
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2Vudi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0E2Qkc7QUFJSCw4REFBOEQ7QUFDOUQsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFXLENBQUMsbUJBQW1CLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztBQUUzRSx1Q0FBdUM7QUFDdkMsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFXLENBQUMscUJBQXFCLEVBQUUsY0FBYyxDQUFDLENBQUM7QUFFM0UsZ0RBQWdEO0FBQ2hELE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBVyxDQUFDLHdCQUF3QixFQUFFLGlCQUFpQixDQUFDLENBQUM7QUFFcEYsMERBQTBEO0FBQzFELE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBVyxDQUFDLHFCQUFxQixFQUFFLGNBQWMsQ0FBQyxDQUFDO0FBRTNFLG9DQUFvQztBQUNwQyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQVcsQ0FBQyx5QkFBeUIsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO0FBRXZGLDBDQUEwQztBQUMxQyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQVcsQ0FBQyxzQkFBc0IsRUFBRSxlQUFlLENBQUMsQ0FBQztBQUU5RSxnREFBZ0Q7QUFDaEQsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFXLENBQUMsd0JBQXdCLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztBQUVwRiwrREFBK0Q7QUFDL0QsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQVcsQ0FBQyxzQkFBc0IsRUFBRSxlQUFlLENBQUMsQ0FBQztBQUVuRixnRUFBZ0U7QUFDaEUsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFXLGlCQUFpQixDQUFDO0FBRXRELDZEQUE2RDtBQUM3RCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBVyx3QkFBd0IsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogRW52aXJvbm1lbnQtdmFyaWFibGUgbmFtZXMgdGhlIHR1bm5lbCByZWFkcy5cbiAqXG4gKiBFdmVyeSBzZXR0aW5nIGlzIGBUVU5ORUxfYC1wcmVmaXhlZCwgbWF0Y2hpbmcgdGhlIHJlcG8gY29udmVudGlvbiBvZiBuYW1pbmcgYVxuICogdmFyaWFibGUgYWZ0ZXIgdGhlIHBhY2thZ2UgdGhhdCBvd25zIGl0IChgTUFTVFJBXypgLCBgVEVBTVNfKmAsXG4gKiBgV0VCX1NFQVJDSF8qYCkuIFRoZSBnYXRlJ3Mgb3JpZ2luYWwgbmFtZXMgd2VyZSB1bnByZWZpeGVkIChgQVVUSF9TVUJKRUNUYCxcbiAqIGBQVUJMSUNfRE9NQUlOYCwgLi4uKSwgd2hpY2ggaXMgYSByZWFsIGhhemFyZCBmb3IgYSBwYWNrYWdlIHRoYXQgcnVucyBhcyBhXG4gKiBXUkFQUEVSOiB0aGUgdHVubmVsIGFuZCB0aGUgYXBwIGl0IHdyYXBzIHNoYXJlIG9uZSBlbnZpcm9ubWVudCwgc28gYSBnZW5lcmljXG4gKiBuYW1lIGlzIG9uZSB0aGUgd3JhcHBlZCBhcHAgbWF5IGFscmVhZHkgdXNlIGZvciBzb21ldGhpbmcgZWxzZSwgYW5kXG4gKiBgUFVCTElDX0RPTUFJTmAgaW4gcGFydGljdWxhciByZWFkcyBsaWtlIGFuIGFwcC13aWRlIHNldHRpbmcgcmF0aGVyIHRoYW4gYVxuICogcG9ydHIgZGV0YWlsLiBgRU1BSUxfQVVUSF9BTExPV2Agd2FzIHdvcnNlIHRoYW4gZ2VuZXJpYyAtIGl0IHNhdCBpblxuICogYEBkYngtdG9vbHMvZW1haWxgJ3MgYEVNQUlMXypgIG5hbWVzcGFjZSB3aGlsZSBjb25maWd1cmluZyB0aGUgZ2F0ZSwgbm90IGVtYWlsLlxuICpcbiAqIEVhY2ggZW50cnkgaXMgYW4ge0BsaW5rIEVudktleX0gbGlzdCwgRUFSTElFU1QtV0lOUywgd2hvc2UgZmlyc3QgZWxlbWVudCBpcyB0aGVcbiAqIGN1cnJlbnQgbmFtZSBhbmQgd2hvc2UgcmVtYWluaW5nIGVsZW1lbnRzIGFyZSB0aGUgZGVwcmVjYXRlZCBvcmlnaW5hbHMuIEFcbiAqIGRlcGxveW1lbnQgc2V0IHVwIGFnYWluc3QgdGhlIG9sZCBuYW1lcyBrZWVwcyB3b3JraW5nOyBub3RoaW5nIG5lZWRzIGFcbiAqIGNvb3JkaW5hdGVkIHJlbmFtZS4gUmVhZCB0aGVtIHRocm91Z2ggYGVudi5zdHJpbmdgIC8gYGVudi5wb3NpdGl2ZUludGAgL1xuICogYGVudi5saXN0YCwgd2hpY2ggYWNjZXB0IHRoZSBsaXN0IGRpcmVjdGx5LlxuICpcbiAqIE5vdCByZW5hbWVkOlxuICpcbiAqICAgLSBgREFUQUJSSUNLU19BUFBfUE9SVGAgLSB0aGUgRGF0YWJyaWNrcyBBcHBzIHJ1bnRpbWUgY29udHJhY3QuIFRoZSBwbGF0Zm9ybVxuICogICAgIHNldHMgaXQ7IHRoZSBnYXRlIGhvbm91cnMgaXQuXG4gKiAgIC0gYFBPUlRSX1RPS0VOYCAvIGBQT1JUUl9TRVJWRVJgIC8gYFBPUlRSX0FVVE9fQUREX1BBVEhgIC0gdXBzdHJlYW1cbiAqICAgICBbcG9ydHJdKGh0dHBzOi8vZ2l0aHViLmNvbS9hbWFsc2hhamkvcG9ydHIpJ3Mgb3duIG5hbWVzcGFjZSwgYW5kXG4gKiAgICAgYFBPUlRSX0FVVE9fQUREX1BBVEhgIGlzIHBhc3NlZCBzdHJhaWdodCB0byB0aGF0IGJpbmFyeS4gUmVuYW1pbmcgdGhlc2VcbiAqICAgICB3b3VsZCByZW5hbWUgc29tZW9uZSBlbHNlJ3MgY29udHJhY3QuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB0eXBlIHsgRW52S2V5IH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcblxuLyoqIEFjY2VzcyBhbGxvdy1saXN0IHBhdHRlcm5zIChkb21haW4gLyBnbG9iIC8gYC9yZWdleC9gKS4gKi9cbmV4cG9ydCBjb25zdCBBTExPV19FTlY6IEVudktleSA9IFtcIlRVTk5FTF9BVVRIX0FMTE9XXCIsIFwiRU1BSUxfQVVUSF9BTExPV1wiXTtcblxuLyoqIFN1YmplY3QgbGluZSBmb3IgdGhlIGNvZGUgZW1haWwuICovXG5leHBvcnQgY29uc3QgU1VCSkVDVF9FTlY6IEVudktleSA9IFtcIlRVTk5FTF9BVVRIX1NVQkpFQ1RcIiwgXCJBVVRIX1NVQkpFQ1RcIl07XG5cbi8qKiBEaXNwbGF5IG5hbWUgdXNlZCBpbiB0aGUgY29kZSBlbWFpbCBjb3B5LiAqL1xuZXhwb3J0IGNvbnN0IEJSQU5EX05BTUVfRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfQVVUSF9CUkFORF9OQU1FXCIsIFwiQVVUSF9CUkFORF9OQU1FXCJdO1xuXG4vKiogTGluZSBzaG93biBpbW1lZGlhdGVseSBhYm92ZSB0aGUgY29kZSBpbiB0aGUgZW1haWwuICovXG5leHBvcnQgY29uc3QgTUVTU0FHRV9FTlY6IEVudktleSA9IFtcIlRVTk5FTF9BVVRIX01FU1NBR0VcIiwgXCJBVVRIX01FU1NBR0VcIl07XG5cbi8qKiBTZXNzaW9uIGxpZmV0aW1lLCBpbiBzZWNvbmRzLiAqL1xuZXhwb3J0IGNvbnN0IFNFU1NJT05fVFRMX0VOVjogRW52S2V5ID0gW1wiVFVOTkVMX0FVVEhfU0VTU0lPTl9UVExcIiwgXCJBVVRIX1NFU1NJT05fVFRMXCJdO1xuXG4vKiogT25lLXRpbWUtY29kZSBsaWZldGltZSwgaW4gc2Vjb25kcy4gKi9cbmV4cG9ydCBjb25zdCBDT0RFX1RUTF9FTlY6IEVudktleSA9IFtcIlRVTk5FTF9BVVRIX0NPREVfVFRMXCIsIFwiQVVUSF9DT0RFX1RUTFwiXTtcblxuLyoqIEhTMjU2IHNpZ25pbmcgc2VjcmV0IGZvciB0aGUgc2Vzc2lvbiBKV1QuICovXG5leHBvcnQgY29uc3QgSldUX1NFQ1JFVF9FTlY6IEVudktleSA9IFtcIlRVTk5FTF9BVVRIX0pXVF9TRUNSRVRcIiwgXCJBVVRIX0pXVF9TRUNSRVRcIl07XG5cbi8qKiBUaGUgcHVibGljIGA8c3ViZG9tYWluPi48c2VydmVyPmAgcG9ydHIgc2hvdWxkIHNlcnZlIG9uLiAqL1xuZXhwb3J0IGNvbnN0IFBVQkxJQ19ET01BSU5fRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfUFVCTElDX0RPTUFJTlwiLCBcIlBVQkxJQ19ET01BSU5cIl07XG5cbi8qKiBSdW4gdGhlIHR1bm5lbCBPUEVOLCB3aXRoIG5vIGdhdGUuIElnbm9yZWQgdW5sZXNzIHRydXRoeS4gKi9cbmV4cG9ydCBjb25zdCBJTlNFQ1VSRV9FTlY6IEVudktleSA9IFwiVFVOTkVMX0lOU0VDVVJFXCI7XG5cbi8qKiBFeHRyYSBgeC1gIHJlcXVlc3QgaGVhZGVycyB0dW5uZWwgdHJhZmZpYyBtYXkgZm9yd2FyZC4gKi9cbmV4cG9ydCBjb25zdCBGT1JXQVJEX0hFQURFUlNfRU5WOiBFbnZLZXkgPSBcIlRVTk5FTF9GT1JXQVJEX0hFQURFUlNcIjtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2Vudi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0E2Qkc7QUFJSCw4REFBOEQ7QUFDOUQsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFXLENBQUMsbUJBQW1CLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztBQUUzRSx1Q0FBdUM7QUFDdkMsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFXLENBQUMscUJBQXFCLEVBQUUsY0FBYyxDQUFDLENBQUM7QUFFM0UsZ0RBQWdEO0FBQ2hELE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBVyxDQUFDLHdCQUF3QixFQUFFLGlCQUFpQixDQUFDLENBQUM7QUFFcEYsMERBQTBEO0FBQzFELE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBVyxDQUFDLHFCQUFxQixFQUFFLGNBQWMsQ0FBQyxDQUFDO0FBRTNFLG9DQUFvQztBQUNwQyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQVcsQ0FBQyx5QkFBeUIsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO0FBRXZGLDBDQUEwQztBQUMxQyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQVcsQ0FBQyxzQkFBc0IsRUFBRSxlQUFlLENBQUMsQ0FBQztBQUU5RSxnREFBZ0Q7QUFDaEQsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFXLENBQUMsd0JBQXdCLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztBQUVwRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQVc7SUFDeEMsNEJBQTRCO0lBQzVCLDJCQUEyQjtDQUM1QixDQUFDO0FBRUYsK0RBQStEO0FBQy9ELE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFXLENBQUMsc0JBQXNCLEVBQUUsZUFBZSxDQUFDLENBQUM7QUFFbkYsZ0VBQWdFO0FBQ2hFLE1BQU0sQ0FBQyxNQUFNLFlBQVksR0FBVyxpQkFBaUIsQ0FBQztBQUV0RCw2REFBNkQ7QUFDN0QsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQVcsd0JBQXdCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEVudmlyb25tZW50LXZhcmlhYmxlIG5hbWVzIHRoZSB0dW5uZWwgcmVhZHMuXG4gKlxuICogRXZlcnkgc2V0dGluZyBpcyBgVFVOTkVMX2AtcHJlZml4ZWQsIG1hdGNoaW5nIHRoZSByZXBvIGNvbnZlbnRpb24gb2YgbmFtaW5nIGFcbiAqIHZhcmlhYmxlIGFmdGVyIHRoZSBwYWNrYWdlIHRoYXQgb3ducyBpdCAoYE1BU1RSQV8qYCwgYFRFQU1TXypgLFxuICogYFdFQl9TRUFSQ0hfKmApLiBUaGUgZ2F0ZSdzIG9yaWdpbmFsIG5hbWVzIHdlcmUgdW5wcmVmaXhlZCAoYEFVVEhfU1VCSkVDVGAsXG4gKiBgUFVCTElDX0RPTUFJTmAsIC4uLiksIHdoaWNoIGlzIGEgcmVhbCBoYXphcmQgZm9yIGEgcGFja2FnZSB0aGF0IHJ1bnMgYXMgYVxuICogV1JBUFBFUjogdGhlIHR1bm5lbCBhbmQgdGhlIGFwcCBpdCB3cmFwcyBzaGFyZSBvbmUgZW52aXJvbm1lbnQsIHNvIGEgZ2VuZXJpY1xuICogbmFtZSBpcyBvbmUgdGhlIHdyYXBwZWQgYXBwIG1heSBhbHJlYWR5IHVzZSBmb3Igc29tZXRoaW5nIGVsc2UsIGFuZFxuICogYFBVQkxJQ19ET01BSU5gIGluIHBhcnRpY3VsYXIgcmVhZHMgbGlrZSBhbiBhcHAtd2lkZSBzZXR0aW5nIHJhdGhlciB0aGFuIGFcbiAqIHBvcnRyIGRldGFpbC4gYEVNQUlMX0FVVEhfQUxMT1dgIHdhcyB3b3JzZSB0aGFuIGdlbmVyaWMgLSBpdCBzYXQgaW5cbiAqIGBAZGJ4LXRvb2xzL2VtYWlsYCdzIGBFTUFJTF8qYCBuYW1lc3BhY2Ugd2hpbGUgY29uZmlndXJpbmcgdGhlIGdhdGUsIG5vdCBlbWFpbC5cbiAqXG4gKiBFYWNoIGVudHJ5IGlzIGFuIHtAbGluayBFbnZLZXl9IGxpc3QsIEVBUkxJRVNULVdJTlMsIHdob3NlIGZpcnN0IGVsZW1lbnQgaXMgdGhlXG4gKiBjdXJyZW50IG5hbWUgYW5kIHdob3NlIHJlbWFpbmluZyBlbGVtZW50cyBhcmUgdGhlIGRlcHJlY2F0ZWQgb3JpZ2luYWxzLiBBXG4gKiBkZXBsb3ltZW50IHNldCB1cCBhZ2FpbnN0IHRoZSBvbGQgbmFtZXMga2VlcHMgd29ya2luZzsgbm90aGluZyBuZWVkcyBhXG4gKiBjb29yZGluYXRlZCByZW5hbWUuIFJlYWQgdGhlbSB0aHJvdWdoIGBlbnYuc3RyaW5nYCAvIGBlbnYucG9zaXRpdmVJbnRgIC9cbiAqIGBlbnYubGlzdGAsIHdoaWNoIGFjY2VwdCB0aGUgbGlzdCBkaXJlY3RseS5cbiAqXG4gKiBOb3QgcmVuYW1lZDpcbiAqXG4gKiAgIC0gYERBVEFCUklDS1NfQVBQX1BPUlRgIC0gdGhlIERhdGFicmlja3MgQXBwcyBydW50aW1lIGNvbnRyYWN0LiBUaGUgcGxhdGZvcm1cbiAqICAgICBzZXRzIGl0OyB0aGUgZ2F0ZSBob25vdXJzIGl0LlxuICogICAtIGBQT1JUUl9UT0tFTmAgLyBgUE9SVFJfU0VSVkVSYCAvIGBQT1JUUl9BVVRPX0FERF9QQVRIYCAtIHVwc3RyZWFtXG4gKiAgICAgW3BvcnRyXShodHRwczovL2dpdGh1Yi5jb20vYW1hbHNoYWppL3BvcnRyKSdzIG93biBuYW1lc3BhY2UsIGFuZFxuICogICAgIGBQT1JUUl9BVVRPX0FERF9QQVRIYCBpcyBwYXNzZWQgc3RyYWlnaHQgdG8gdGhhdCBiaW5hcnkuIFJlbmFtaW5nIHRoZXNlXG4gKiAgICAgd291bGQgcmVuYW1lIHNvbWVvbmUgZWxzZSdzIGNvbnRyYWN0LlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgdHlwZSB7IEVudktleSB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlXCI7XG5cbi8qKiBBY2Nlc3MgYWxsb3ctbGlzdCBwYXR0ZXJucyAoZG9tYWluIC8gZ2xvYiAvIGAvcmVnZXgvYCkuICovXG5leHBvcnQgY29uc3QgQUxMT1dfRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfQVVUSF9BTExPV1wiLCBcIkVNQUlMX0FVVEhfQUxMT1dcIl07XG5cbi8qKiBTdWJqZWN0IGxpbmUgZm9yIHRoZSBjb2RlIGVtYWlsLiAqL1xuZXhwb3J0IGNvbnN0IFNVQkpFQ1RfRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfQVVUSF9TVUJKRUNUXCIsIFwiQVVUSF9TVUJKRUNUXCJdO1xuXG4vKiogRGlzcGxheSBuYW1lIHVzZWQgaW4gdGhlIGNvZGUgZW1haWwgY29weS4gKi9cbmV4cG9ydCBjb25zdCBCUkFORF9OQU1FX0VOVjogRW52S2V5ID0gW1wiVFVOTkVMX0FVVEhfQlJBTkRfTkFNRVwiLCBcIkFVVEhfQlJBTkRfTkFNRVwiXTtcblxuLyoqIExpbmUgc2hvd24gaW1tZWRpYXRlbHkgYWJvdmUgdGhlIGNvZGUgaW4gdGhlIGVtYWlsLiAqL1xuZXhwb3J0IGNvbnN0IE1FU1NBR0VfRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfQVVUSF9NRVNTQUdFXCIsIFwiQVVUSF9NRVNTQUdFXCJdO1xuXG4vKiogU2Vzc2lvbiBsaWZldGltZSwgaW4gc2Vjb25kcy4gKi9cbmV4cG9ydCBjb25zdCBTRVNTSU9OX1RUTF9FTlY6IEVudktleSA9IFtcIlRVTk5FTF9BVVRIX1NFU1NJT05fVFRMXCIsIFwiQVVUSF9TRVNTSU9OX1RUTFwiXTtcblxuLyoqIE9uZS10aW1lLWNvZGUgbGlmZXRpbWUsIGluIHNlY29uZHMuICovXG5leHBvcnQgY29uc3QgQ09ERV9UVExfRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfQVVUSF9DT0RFX1RUTFwiLCBcIkFVVEhfQ09ERV9UVExcIl07XG5cbi8qKiBIUzI1NiBzaWduaW5nIHNlY3JldCBmb3IgdGhlIHNlc3Npb24gSldULiAqL1xuZXhwb3J0IGNvbnN0IEpXVF9TRUNSRVRfRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfQVVUSF9KV1RfU0VDUkVUXCIsIFwiQVVUSF9KV1RfU0VDUkVUXCJdO1xuXG4vKipcbiAqIEZvcmNlLWNsZWFyIGN1dG9mZjogZXZlcnkgc2Vzc2lvbiBpc3N1ZWQgQkVGT1JFIGl0IHN0b3BzIHZlcmlmeWluZy4gQW55dGhpbmdcbiAqIGBvYmplY3QudG9EYXRlYCBhY2NlcHRzIC0gYSBkYXRlLCBhbiBJU08gaW5zdGFudCwgZXBvY2ggc2Vjb25kcy9taWxsaXMsIG9yIGFcbiAqIHJlbGF0aXZlIGR1cmF0aW9uIChgLTMwZGAsIGA3IGRheXMgYWdvYCkuXG4gKi9cbmV4cG9ydCBjb25zdCBTRVNTSU9OX0NVVE9GRl9FTlY6IEVudktleSA9IFtcbiAgXCJUVU5ORUxfQVVUSF9TRVNTSU9OX0NVVE9GRlwiLFxuICBcIlRVTk5FTF9BVVRIX1NFU1NJT05fRVBPQ0hcIixcbl07XG5cbi8qKiBUaGUgcHVibGljIGA8c3ViZG9tYWluPi48c2VydmVyPmAgcG9ydHIgc2hvdWxkIHNlcnZlIG9uLiAqL1xuZXhwb3J0IGNvbnN0IFBVQkxJQ19ET01BSU5fRU5WOiBFbnZLZXkgPSBbXCJUVU5ORUxfUFVCTElDX0RPTUFJTlwiLCBcIlBVQkxJQ19ET01BSU5cIl07XG5cbi8qKiBSdW4gdGhlIHR1bm5lbCBPUEVOLCB3aXRoIG5vIGdhdGUuIElnbm9yZWQgdW5sZXNzIHRydXRoeS4gKi9cbmV4cG9ydCBjb25zdCBJTlNFQ1VSRV9FTlY6IEVudktleSA9IFwiVFVOTkVMX0lOU0VDVVJFXCI7XG5cbi8qKiBFeHRyYSBgeC1gIHJlcXVlc3QgaGVhZGVycyB0dW5uZWwgdHJhZmZpYyBtYXkgZm9yd2FyZC4gKi9cbmV4cG9ydCBjb25zdCBGT1JXQVJEX0hFQURFUlNfRU5WOiBFbnZLZXkgPSBcIlRVTk5FTF9GT1JXQVJEX0hFQURFUlNcIjtcbiJdfQ==

package/lib/src/otp.d.ts

@@ -8,14 +8,12 @@
  * counter (never the plaintext, never in the JWT); `verify` is constant-time on
  * the hash, and the entry is deleted on success or once attempts are exhausted.
  *
- * The session JWT is a short-lived HS256 token (via `jose`) carrying only the
- * email. Its signing key comes from `TUNNEL_AUTH_JWT_SECRET`; when unset the gate uses an
- * ephemeral per-process key rather than refusing service, so an unset secret
- * degrades to "sessions don't survive a restart", not "nobody can log in". Note
- * what this does NOT weaken: a caller still needs a code delivered to an
- * allow-listed address, because the signing key only validates an ALREADY-issued
- * session. Set it in any deployment running more than one instance, or sessions
- * minted by one will not verify on another.
+ * The session JWT is an HS256 token (via `jose`) carrying only the email. Its
+ * signing key is resolved by `./signing-key.ts`: `TUNNEL_AUTH_JWT_SECRET` when
+ * set, else a key persisted in the cache for 30 days so cookies survive the
+ * restarts a tunnel sees whenever the app it wraps reloads. A cookie signed
+ * before `TUNNEL_AUTH_SESSION_CUTOFF` is refused here as well as being orphaned
+ * by the cache key, so the force-clear switch holds even for a still-current key.
  *
  * @module
  */
@@ -45,9 +43,7 @@ export declare class CodeStore {
      */
     verify(email: string, code: string): Promise<VerifyOutcome>;
 }
-/** Reset the memoized key (tests, or after changing the env in-process). */
-export declare function resetSigningKey(): void;
-/** Mint a short-lived session JWT for `email`, expiring in `ttlSeconds`. */
+/** Mint a session JWT for `email`, expiring in `ttlSeconds`. */
 export declare function signSession(email: string, ttlSeconds: number): Promise<string>;
 /** Validate a session JWT, returning the email it was minted for, or `undefined`. */
 export declare function verifySession(token: string | undefined): Promise<string | undefined>;

package/lib/src/otp.js

@@ -8,23 +8,19 @@
  * counter (never the plaintext, never in the JWT); `verify` is constant-time on
  * the hash, and the entry is deleted on success or once attempts are exhausted.
  *
- * The session JWT is a short-lived HS256 token (via `jose`) carrying only the
- * email. Its signing key comes from `TUNNEL_AUTH_JWT_SECRET`; when unset the gate uses an
- * ephemeral per-process key rather than refusing service, so an unset secret
- * degrades to "sessions don't survive a restart", not "nobody can log in". Note
- * what this does NOT weaken: a caller still needs a code delivered to an
- * allow-listed address, because the signing key only validates an ALREADY-issued
- * session. Set it in any deployment running more than one instance, or sessions
- * minted by one will not verify on another.
+ * The session JWT is an HS256 token (via `jose`) carrying only the email. Its
+ * signing key is resolved by `./signing-key.ts`: `TUNNEL_AUTH_JWT_SECRET` when
+ * set, else a key persisted in the cache for 30 days so cookies survive the
+ * restarts a tunnel sees whenever the app it wraps reloads. A cookie signed
+ * before `TUNNEL_AUTH_SESSION_CUTOFF` is refused here as well as being orphaned
+ * by the cache key, so the force-clear switch holds even for a still-current key.
  *
  * @module
  */
-import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
+import { createHash, randomInt, timingSafeEqual } from "node:crypto";
 import { CacheManager } from "@databricks/appkit";
-import { env, log } from "@dbx-tools/shared-core";
 import { jwtVerify, SignJWT } from "jose";
-import { JWT_SECRET_ENV } from "./env.js";
-const logger = log.logger("tunnel:otp");
+import { signingKey } from "./signing-key.js";
 /** JWT issuer/audience so a token minted for this gate isn't accepted elsewhere. */
 const JWT_AUD = "dbx-tools-tunnel-auth";
 /** Cache-key prefix for pending codes, namespaced away from any other cache use. */
@@ -91,48 +87,38 @@ export class CodeStore {
         return "invalid";
     }
 }
-/**
- * Resolve the HS256 signing key. Prefers `TUNNEL_AUTH_JWT_SECRET`; when unset, mints an
- * ephemeral per-process key (fail-open) and warns once. Memoized.
- */
-let cachedKey;
-function signingKey() {
-    if (cachedKey)
-        return cachedKey;
-    const secret = env.text(JWT_SECRET_ENV);
-    if (secret) {
-        cachedKey = new TextEncoder().encode(secret);
-    }
-    else {
-        logger.warn(`${JWT_SECRET_ENV[0]} is not set - using an ephemeral per-process key; sessions will not survive a restart`);
-        cachedKey = randomBytes(32);
-    }
-    return cachedKey;
-}
-/** Reset the memoized key (tests, or after changing the env in-process). */
-export function resetSigningKey() {
-    cachedKey = undefined;
-}
-/** Mint a short-lived session JWT for `email`, expiring in `ttlSeconds`. */
+/** Mint a session JWT for `email`, expiring in `ttlSeconds`. */
 export async function signSession(email, ttlSeconds) {
+    const { key } = await signingKey();
     return new SignJWT({ email })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(email)
         .setAudience(JWT_AUD)
         .setIssuedAt()
         .setExpirationTime(`${ttlSeconds}s`)
-        .sign(signingKey());
+        .sign(key);
 }
 /** Validate a session JWT, returning the email it was minted for, or `undefined`. */
 export async function verifySession(token) {
     if (!token)
         return undefined;
     try {
-        const { payload } = await jwtVerify(token, signingKey(), { audience: JWT_AUD });
+        const { key, cutoffMs } = await signingKey();
+        const { payload } = await jwtVerify(token, key, { audience: JWT_AUD });
+        // Belt and braces with the cutoff-scoped cache key: that alone already
+        // orphans older keys, but an operator who moved the cutoff while
+        // TUNNEL_AUTH_JWT_SECRET is set has no key rotation to rely on, and this
+        // check is what makes the switch work in that case too.
+        // Compared in whole SECONDS because `iat` has no finer resolution: against a
+        // millisecond cutoff, a cookie minted in the same second as it would be
+        // refused depending on sub-second rounding.
+        if (cutoffMs > 0 && (payload.iat === undefined || payload.iat < Math.floor(cutoffMs / 1000))) {
+            return undefined;
+        }
         return typeof payload.email === "string" ? payload.email : undefined;
     }
     catch {
         return undefined;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3RwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL290cC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FvQkc7QUFFSCxPQUFPLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQ2xGLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ2xELE9BQU8sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLE1BQU0sTUFBTSxDQUFDO0FBQzFDLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFMUMsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztBQUV4QyxvRkFBb0Y7QUFDcEYsTUFBTSxPQUFPLEdBQUcsdUJBQXVCLENBQUM7QUFFeEMsb0ZBQW9GO0FBQ3BGLE1BQU0sV0FBVyxHQUFHLGFBQWEsQ0FBQztBQUVsQyw4QkFBOEI7QUFDOUIsU0FBUyxNQUFNLENBQUMsS0FBYTtJQUMzQixPQUFPLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQzFELENBQUM7QUFFRCw2REFBNkQ7QUFDN0QsU0FBUyxZQUFZLENBQUMsQ0FBUyxFQUFFLENBQVM7SUFDeEMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxNQUFNO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDeEMsT0FBTyxlQUFlLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztBQUN2RSxDQUFDO0FBVUQ7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQVM7SUFFRDtJQUNBO0lBRm5CLFlBQ21CLFVBQWtCLEVBQ2xCLFdBQW1CO1FBRG5CLGVBQVUsR0FBVixVQUFVLENBQVE7UUFDbEIsZ0JBQVcsR0FBWCxXQUFXLENBQVE7SUFDbkMsQ0FBQztJQUVJLEtBQUs7UUFDWCxPQUFPLFlBQVksQ0FBQyxlQUFlLEVBQUUsQ0FBQztJQUN4QyxDQUFDO0lBRU8sR0FBRyxDQUFDLEtBQWE7UUFDdkIsT0FBTyxHQUFHLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztJQUNoRCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBYTtRQUN2QixNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDOUQsTUFBTSxLQUFLLEdBQWMsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUM3RCxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDekUsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSCxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQWEsRUFBRSxJQUFZO1FBQ3RDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxDQUFZLEdBQUcsQ0FBQyxDQUFDO1FBQ3JELElBQUksQ0FBQyxLQUFLO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFDN0IsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUM7UUFDcEMsSUFBSSxZQUFZLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzNDLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMvQixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLFFBQVEsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDakMsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQy9CLE9BQU8sbUJBQW1CLENBQUM7UUFDN0IsQ0FBQztRQUNELE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsRUFBRSxHQUFHLEtBQUssRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUM5RSxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0NBQ0Y7QUFFRDs7O0dBR0c7QUFDSCxJQUFJLFNBQWlDLENBQUM7QUFDdEMsU0FBUyxVQUFVO0lBQ2pCLElBQUksU0FBUztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ2hDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDeEMsSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUNYLFNBQVMsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMvQyxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sQ0FBQyxJQUFJLENBQ1QsR0FBRyxjQUFjLENBQUMsQ0FBQyxDQUFDLHVGQUF1RixDQUM1RyxDQUFDO1FBQ0YsU0FBUyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQUVELDRFQUE0RTtBQUM1RSxNQUFNLFVBQVUsZUFBZTtJQUM3QixTQUFTLEdBQUcsU0FBUyxDQUFDO0FBQ3hCLENBQUM7QUFFRCw0RUFBNEU7QUFDNUUsTUFBTSxDQUFDLEtBQUssVUFBVSxXQUFXLENBQUMsS0FBYSxFQUFFLFVBQWtCO0lBQ2pFLE9BQU8sSUFBSSxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQztTQUMxQixrQkFBa0IsQ0FBQyxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQztTQUNwQyxVQUFVLENBQUMsS0FBSyxDQUFDO1NBQ2pCLFdBQVcsQ0FBQyxPQUFPLENBQUM7U0FDcEIsV0FBVyxFQUFFO1NBQ2IsaUJBQWlCLENBQUMsR0FBRyxVQUFVLEdBQUcsQ0FBQztTQUNuQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztBQUN4QixDQUFDO0FBRUQscUZBQXFGO0FBQ3JGLE1BQU0sQ0FBQyxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQXlCO0lBQzNELElBQUksQ0FBQyxLQUFLO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDN0IsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sU0FBUyxDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLE9BQU8sT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3ZFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogT25lLXRpbWUtY29kZSBzdG9yZSArIHNlc3Npb24gSldUIGZvciB0aGUgZW1haWwtT1RQIHR1bm5lbCBnYXRlLlxuICpcbiAqIFRoZSBjb2RlIHN0b3JlIGlzIGJhY2tlZCBieSBBcHBLaXQncyBgQ2FjaGVNYW5hZ2VyYCAoYXV0by1jb25maWd1cmVkIHRvIG1lbW9yeSxcbiAqIG9yIExha2ViYXNlIHdoZW4gdGhlIGFwcCB3aXJlcyBhIHBlcnNpc3RlbnQgYENhY2hlU3RvcmFnZWApLCBzbyBUVEwgRVhQSVJZIGFuZFxuICogZXZpY3Rpb24gYXJlIHRoZSBjYWNoZSdzIGpvYiAtIG5vIGhhbmQtcm9sbGVkIE1hcCBvciB0aW1lcnMuIEEgNi1kaWdpdCBjb2RlIGlzXG4gKiBnZW5lcmF0ZWQgd2l0aCBgY3J5cHRvLnJhbmRvbUludGAgYW5kIHN0b3JlZCBhcyBhIFNIQS0yNTYgaGFzaCB3aXRoIGFuIGF0dGVtcHRcbiAqIGNvdW50ZXIgKG5ldmVyIHRoZSBwbGFpbnRleHQsIG5ldmVyIGluIHRoZSBKV1QpOyBgdmVyaWZ5YCBpcyBjb25zdGFudC10aW1lIG9uXG4gKiB0aGUgaGFzaCwgYW5kIHRoZSBlbnRyeSBpcyBkZWxldGVkIG9uIHN1Y2Nlc3Mgb3Igb25jZSBhdHRlbXB0cyBhcmUgZXhoYXVzdGVkLlxuICpcbiAqIFRoZSBzZXNzaW9uIEpXVCBpcyBhIHNob3J0LWxpdmVkIEhTMjU2IHRva2VuICh2aWEgYGpvc2VgKSBjYXJyeWluZyBvbmx5IHRoZVxuICogZW1haWwuIEl0cyBzaWduaW5nIGtleSBjb21lcyBmcm9tIGBUVU5ORUxfQVVUSF9KV1RfU0VDUkVUYDsgd2hlbiB1bnNldCB0aGUgZ2F0ZSB1c2VzIGFuXG4gKiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5IHJhdGhlciB0aGFuIHJlZnVzaW5nIHNlcnZpY2UsIHNvIGFuIHVuc2V0IHNlY3JldFxuICogZGVncmFkZXMgdG8gXCJzZXNzaW9ucyBkb24ndCBzdXJ2aXZlIGEgcmVzdGFydFwiLCBub3QgXCJub2JvZHkgY2FuIGxvZyBpblwiLiBOb3RlXG4gKiB3aGF0IHRoaXMgZG9lcyBOT1Qgd2Vha2VuOiBhIGNhbGxlciBzdGlsbCBuZWVkcyBhIGNvZGUgZGVsaXZlcmVkIHRvIGFuXG4gKiBhbGxvdy1saXN0ZWQgYWRkcmVzcywgYmVjYXVzZSB0aGUgc2lnbmluZyBrZXkgb25seSB2YWxpZGF0ZXMgYW4gQUxSRUFEWS1pc3N1ZWRcbiAqIHNlc3Npb24uIFNldCBpdCBpbiBhbnkgZGVwbG95bWVudCBydW5uaW5nIG1vcmUgdGhhbiBvbmUgaW5zdGFuY2UsIG9yIHNlc3Npb25zXG4gKiBtaW50ZWQgYnkgb25lIHdpbGwgbm90IHZlcmlmeSBvbiBhbm90aGVyLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBjcmVhdGVIYXNoLCByYW5kb21CeXRlcywgcmFuZG9tSW50LCB0aW1pbmdTYWZlRXF1YWwgfSBmcm9tIFwibm9kZTpjcnlwdG9cIjtcbmltcG9ydCB7IENhY2hlTWFuYWdlciB9IGZyb20gXCJAZGF0YWJyaWNrcy9hcHBraXRcIjtcbmltcG9ydCB7IGVudiwgbG9nIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB7IGp3dFZlcmlmeSwgU2lnbkpXVCB9IGZyb20gXCJqb3NlXCI7XG5pbXBvcnQgeyBKV1RfU0VDUkVUX0VOViB9IGZyb20gXCIuL2Vudi50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwidHVubmVsOm90cFwiKTtcblxuLyoqIEpXVCBpc3N1ZXIvYXVkaWVuY2Ugc28gYSB0b2tlbiBtaW50ZWQgZm9yIHRoaXMgZ2F0ZSBpc24ndCBhY2NlcHRlZCBlbHNld2hlcmUuICovXG5jb25zdCBKV1RfQVVEID0gXCJkYngtdG9vbHMtdHVubmVsLWF1dGhcIjtcblxuLyoqIENhY2hlLWtleSBwcmVmaXggZm9yIHBlbmRpbmcgY29kZXMsIG5hbWVzcGFjZWQgYXdheSBmcm9tIGFueSBvdGhlciBjYWNoZSB1c2UuICovXG5jb25zdCBDT0RFX1BSRUZJWCA9IFwidHVubmVsOm90cDpcIjtcblxuLyoqIFNIQS0yNTYgaGV4IG9mIGEgdmFsdWUuICovXG5mdW5jdGlvbiBzaGEyNTYodmFsdWU6IHN0cmluZyk6IHN0cmluZyB7XG4gIHJldHVybiBjcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZSh2YWx1ZSkuZGlnZXN0KFwiaGV4XCIpO1xufVxuXG4vKiogQ29uc3RhbnQtdGltZSBjb21wYXJlIG9mIHR3byBlcXVhbC1sZW5ndGggaGV4IGRpZ2VzdHMuICovXG5mdW5jdGlvbiBzYWZlRXF1YWxIZXgoYTogc3RyaW5nLCBiOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgaWYgKGEubGVuZ3RoICE9PSBiLmxlbmd0aCkgcmV0dXJuIGZhbHNlO1xuICByZXR1cm4gdGltaW5nU2FmZUVxdWFsKEJ1ZmZlci5mcm9tKGEsIFwiaGV4XCIpLCBCdWZmZXIuZnJvbShiLCBcImhleFwiKSk7XG59XG5cbmludGVyZmFjZSBDb2RlRW50cnkge1xuICBoYXNoOiBzdHJpbmc7XG4gIGF0dGVtcHRzOiBudW1iZXI7XG59XG5cbi8qKiBSZXN1bHQgb2Yge0BsaW5rIENvZGVTdG9yZS52ZXJpZnl9LiAqL1xuZXhwb3J0IHR5cGUgVmVyaWZ5T3V0Y29tZSA9IFwib2tcIiB8IFwiaW52YWxpZFwiIHwgXCJleHBpcmVkXCIgfCBcInRvby1tYW55LWF0dGVtcHRzXCI7XG5cbi8qKlxuICogUGVuZGluZyBvbmUtdGltZSBjb2Rlcywgc3RvcmVkIGluIEFwcEtpdCdzIGNhY2hlIGtleWVkIGJ5IGxvd2VyY2FzZWQgZW1haWwuXG4gKiBFeHBpcnkgaXMgdGhlIGNhY2hlJ3MgVFRMIChubyBtYW51YWwgY2xvY2spOyBhIG1pc3MgbWVhbnMgZXhwaXJlZC1vci1uZXZlci5cbiAqL1xuZXhwb3J0IGNsYXNzIENvZGVTdG9yZSB7XG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgdHRsU2Vjb25kczogbnVtYmVyLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgbWF4QXR0ZW1wdHM6IG51bWJlcixcbiAgKSB7fVxuXG4gIHByaXZhdGUgY2FjaGUoKTogQ2FjaGVNYW5hZ2VyIHtcbiAgICByZXR1cm4gQ2FjaGVNYW5hZ2VyLmdldEluc3RhbmNlU3luYygpO1xuICB9XG5cbiAgcHJpdmF0ZSBrZXkoZW1haWw6IHN0cmluZyk6IHN0cmluZyB7XG4gICAgcmV0dXJuIGAke0NPREVfUFJFRklYfSR7ZW1haWwudG9Mb3dlckNhc2UoKX1gO1xuICB9XG5cbiAgLyoqXG4gICAqIEdlbmVyYXRlLCBzdG9yZSAoaGFzaGVkLCB3aXRoIHRoZSBjYWNoZSBUVEwpLCBhbmQgUkVUVVJOIGEgZnJlc2ggNi1kaWdpdFxuICAgKiBjb2RlLiBUaGUgY2FsbGVyIGVtYWlscyB0aGUgcmV0dXJuZWQgcGxhaW50ZXh0OyBvbmx5IHRoZSBoYXNoIGlzIHJldGFpbmVkLlxuICAgKiBSZXBsYWNlcyBhbnkgcGVuZGluZyBjb2RlIGZvciB0aGUgYWRkcmVzcy5cbiAgICovXG4gIGFzeW5jIGlzc3VlKGVtYWlsOiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4ge1xuICAgIGNvbnN0IGNvZGUgPSBTdHJpbmcocmFuZG9tSW50KDAsIDFfMDAwXzAwMCkpLnBhZFN0YXJ0KDYsIFwiMFwiKTtcbiAgICBjb25zdCBlbnRyeTogQ29kZUVudHJ5ID0geyBoYXNoOiBzaGEyNTYoY29kZSksIGF0dGVtcHRzOiAwIH07XG4gICAgYXdhaXQgdGhpcy5jYWNoZSgpLnNldCh0aGlzLmtleShlbWFpbCksIGVudHJ5LCB7IHR0bDogdGhpcy50dGxTZWNvbmRzIH0pO1xuICAgIHJldHVybiBjb2RlO1xuICB9XG5cbiAgLyoqXG4gICAqIENoZWNrIGBjb2RlYCBmb3IgYGVtYWlsYC4gQSBjYWNoZSBtaXNzIGlzIGBleHBpcmVkYCAoVFRMIGVsYXBzZWQgb3IgbmV2ZXJcbiAgICogaXNzdWVkKS4gRGVsZXRlcyB0aGUgZW50cnkgb24gc3VjY2VzcyBvciB3aGVuIGF0dGVtcHRzIGFyZSBleGhhdXN0ZWQsIHNvIGFcbiAgICogY29kZSBpcyBzaW5nbGUtdXNlIGFuZCBjYW4ndCBiZSBicnV0ZS1mb3JjZWQgcGFzdCB0aGUgY2FwLiBBbiBhdHRlbXB0XG4gICAqIGluY3JlbWVudHMgdGhlIHN0b3JlZCBjb3VudGVyIChyZS1wZXJzaXN0ZWQgd2l0aCBhIGZyZXNoIFRUTCB3aW5kb3cpLlxuICAgKi9cbiAgYXN5bmMgdmVyaWZ5KGVtYWlsOiBzdHJpbmcsIGNvZGU6IHN0cmluZyk6IFByb21pc2U8VmVyaWZ5T3V0Y29tZT4ge1xuICAgIGNvbnN0IGtleSA9IHRoaXMua2V5KGVtYWlsKTtcbiAgICBjb25zdCBlbnRyeSA9IGF3YWl0IHRoaXMuY2FjaGUoKS5nZXQ8Q29kZUVudHJ5PihrZXkpO1xuICAgIGlmICghZW50cnkpIHJldHVybiBcImV4cGlyZWRcIjtcbiAgICBjb25zdCBhdHRlbXB0cyA9IGVudHJ5LmF0dGVtcHRzICsgMTtcbiAgICBpZiAoc2FmZUVxdWFsSGV4KGVudHJ5Lmhhc2gsIHNoYTI1Nihjb2RlKSkpIHtcbiAgICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5kZWxldGUoa2V5KTtcbiAgICAgIHJldHVybiBcIm9rXCI7XG4gICAgfVxuICAgIGlmIChhdHRlbXB0cyA+PSB0aGlzLm1heEF0dGVtcHRzKSB7XG4gICAgICBhd2FpdCB0aGlzLmNhY2hlKCkuZGVsZXRlKGtleSk7XG4gICAgICByZXR1cm4gXCJ0b28tbWFueS1hdHRlbXB0c1wiO1xuICAgIH1cbiAgICBhd2FpdCB0aGlzLmNhY2hlKCkuc2V0KGtleSwgeyAuLi5lbnRyeSwgYXR0ZW1wdHMgfSwgeyB0dGw6IHRoaXMudHRsU2Vjb25kcyB9KTtcbiAgICByZXR1cm4gXCJpbnZhbGlkXCI7XG4gIH1cbn1cblxuLyoqXG4gKiBSZXNvbHZlIHRoZSBIUzI1NiBzaWduaW5nIGtleS4gUHJlZmVycyBgVFVOTkVMX0FVVEhfSldUX1NFQ1JFVGA7IHdoZW4gdW5zZXQsIG1pbnRzIGFuXG4gKiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5IChmYWlsLW9wZW4pIGFuZCB3YXJucyBvbmNlLiBNZW1vaXplZC5cbiAqL1xubGV0IGNhY2hlZEtleTogVWludDhBcnJheSB8IHVuZGVmaW5lZDtcbmZ1bmN0aW9uIHNpZ25pbmdLZXkoKTogVWludDhBcnJheSB7XG4gIGlmIChjYWNoZWRLZXkpIHJldHVybiBjYWNoZWRLZXk7XG4gIGNvbnN0IHNlY3JldCA9IGVudi50ZXh0KEpXVF9TRUNSRVRfRU5WKTtcbiAgaWYgKHNlY3JldCkge1xuICAgIGNhY2hlZEtleSA9IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShzZWNyZXQpO1xuICB9IGVsc2Uge1xuICAgIGxvZ2dlci53YXJuKFxuICAgICAgYCR7SldUX1NFQ1JFVF9FTlZbMF19IGlzIG5vdCBzZXQgLSB1c2luZyBhbiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5OyBzZXNzaW9ucyB3aWxsIG5vdCBzdXJ2aXZlIGEgcmVzdGFydGAsXG4gICAgKTtcbiAgICBjYWNoZWRLZXkgPSByYW5kb21CeXRlcygzMik7XG4gIH1cbiAgcmV0dXJuIGNhY2hlZEtleTtcbn1cblxuLyoqIFJlc2V0IHRoZSBtZW1vaXplZCBrZXkgKHRlc3RzLCBvciBhZnRlciBjaGFuZ2luZyB0aGUgZW52IGluLXByb2Nlc3MpLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc2V0U2lnbmluZ0tleSgpOiB2b2lkIHtcbiAgY2FjaGVkS2V5ID0gdW5kZWZpbmVkO1xufVxuXG4vKiogTWludCBhIHNob3J0LWxpdmVkIHNlc3Npb24gSldUIGZvciBgZW1haWxgLCBleHBpcmluZyBpbiBgdHRsU2Vjb25kc2AuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gc2lnblNlc3Npb24oZW1haWw6IHN0cmluZywgdHRsU2Vjb25kczogbnVtYmVyKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgcmV0dXJuIG5ldyBTaWduSldUKHsgZW1haWwgfSlcbiAgICAuc2V0UHJvdGVjdGVkSGVhZGVyKHsgYWxnOiBcIkhTMjU2XCIgfSlcbiAgICAuc2V0U3ViamVjdChlbWFpbClcbiAgICAuc2V0QXVkaWVuY2UoSldUX0FVRClcbiAgICAuc2V0SXNzdWVkQXQoKVxuICAgIC5zZXRFeHBpcmF0aW9uVGltZShgJHt0dGxTZWNvbmRzfXNgKVxuICAgIC5zaWduKHNpZ25pbmdLZXkoKSk7XG59XG5cbi8qKiBWYWxpZGF0ZSBhIHNlc3Npb24gSldULCByZXR1cm5pbmcgdGhlIGVtYWlsIGl0IHdhcyBtaW50ZWQgZm9yLCBvciBgdW5kZWZpbmVkYC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiB2ZXJpZnlTZXNzaW9uKHRva2VuOiBzdHJpbmcgfCB1bmRlZmluZWQpOiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD4ge1xuICBpZiAoIXRva2VuKSByZXR1cm4gdW5kZWZpbmVkO1xuICB0cnkge1xuICAgIGNvbnN0IHsgcGF5bG9hZCB9ID0gYXdhaXQgand0VmVyaWZ5KHRva2VuLCBzaWduaW5nS2V5KCksIHsgYXVkaWVuY2U6IEpXVF9BVUQgfSk7XG4gICAgcmV0dXJuIHR5cGVvZiBwYXlsb2FkLmVtYWlsID09PSBcInN0cmluZ1wiID8gcGF5bG9hZC5lbWFpbCA6IHVuZGVmaW5lZDtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3RwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL290cC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBRUgsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQ3JFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxNQUFNLE1BQU0sQ0FBQztBQUMxQyxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFOUMsb0ZBQW9GO0FBQ3BGLE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDO0FBRXhDLG9GQUFvRjtBQUNwRixNQUFNLFdBQVcsR0FBRyxhQUFhLENBQUM7QUFFbEMsOEJBQThCO0FBQzlCLFNBQVMsTUFBTSxDQUFDLEtBQWE7SUFDM0IsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMxRCxDQUFDO0FBRUQsNkRBQTZEO0FBQzdELFNBQVMsWUFBWSxDQUFDLENBQVMsRUFBRSxDQUFTO0lBQ3hDLElBQUksQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3hDLE9BQU8sZUFBZSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFDdkUsQ0FBQztBQVVEOzs7R0FHRztBQUNILE1BQU0sT0FBTyxTQUFTO0lBRUQ7SUFDQTtJQUZuQixZQUNtQixVQUFrQixFQUNsQixXQUFtQjtRQURuQixlQUFVLEdBQVYsVUFBVSxDQUFRO1FBQ2xCLGdCQUFXLEdBQVgsV0FBVyxDQUFRO0lBQ25DLENBQUM7SUFFSSxLQUFLO1FBQ1gsT0FBTyxZQUFZLENBQUMsZUFBZSxFQUFFLENBQUM7SUFDeEMsQ0FBQztJQUVPLEdBQUcsQ0FBQyxLQUFhO1FBQ3ZCLE9BQU8sR0FBRyxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7SUFDaEQsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQWE7UUFDdkIsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQzlELE1BQU0sS0FBSyxHQUFjLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDN0QsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFhLEVBQUUsSUFBWTtRQUN0QyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVCLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLEdBQUcsQ0FBWSxHQUFHLENBQUMsQ0FBQztRQUNyRCxJQUFJLENBQUMsS0FBSztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3BDLElBQUksWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDL0IsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxRQUFRLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMvQixPQUFPLG1CQUFtQixDQUFDO1FBQzdCLENBQUM7UUFDRCxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEVBQUUsR0FBRyxLQUFLLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDOUUsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztDQUNGO0FBRUQsZ0VBQWdFO0FBQ2hFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsV0FBVyxDQUFDLEtBQWEsRUFBRSxVQUFrQjtJQUNqRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxVQUFVLEVBQUUsQ0FBQztJQUNuQyxPQUFPLElBQUksT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUM7U0FDMUIsa0JBQWtCLENBQUMsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUM7U0FDcEMsVUFBVSxDQUFDLEtBQUssQ0FBQztTQUNqQixXQUFXLENBQUMsT0FBTyxDQUFDO1NBQ3BCLFdBQVcsRUFBRTtTQUNiLGlCQUFpQixDQUFDLEdBQUcsVUFBVSxHQUFHLENBQUM7U0FDbkMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ2YsQ0FBQztBQUVELHFGQUFxRjtBQUNyRixNQUFNLENBQUMsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUF5QjtJQUMzRCxJQUFJLENBQUMsS0FBSztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQzdCLElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxVQUFVLEVBQUUsQ0FBQztRQUM3QyxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZFLHVFQUF1RTtRQUN2RSxpRUFBaUU7UUFDakUseUVBQXlFO1FBQ3pFLHdEQUF3RDtRQUN4RCw2RUFBNkU7UUFDN0Usd0VBQXdFO1FBQ3hFLDRDQUE0QztRQUM1QyxJQUFJLFFBQVEsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM3RixPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBQ0QsT0FBTyxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdkUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBPbmUtdGltZS1jb2RlIHN0b3JlICsgc2Vzc2lvbiBKV1QgZm9yIHRoZSBlbWFpbC1PVFAgdHVubmVsIGdhdGUuXG4gKlxuICogVGhlIGNvZGUgc3RvcmUgaXMgYmFja2VkIGJ5IEFwcEtpdCdzIGBDYWNoZU1hbmFnZXJgIChhdXRvLWNvbmZpZ3VyZWQgdG8gbWVtb3J5LFxuICogb3IgTGFrZWJhc2Ugd2hlbiB0aGUgYXBwIHdpcmVzIGEgcGVyc2lzdGVudCBgQ2FjaGVTdG9yYWdlYCksIHNvIFRUTCBFWFBJUlkgYW5kXG4gKiBldmljdGlvbiBhcmUgdGhlIGNhY2hlJ3Mgam9iIC0gbm8gaGFuZC1yb2xsZWQgTWFwIG9yIHRpbWVycy4gQSA2LWRpZ2l0IGNvZGUgaXNcbiAqIGdlbmVyYXRlZCB3aXRoIGBjcnlwdG8ucmFuZG9tSW50YCBhbmQgc3RvcmVkIGFzIGEgU0hBLTI1NiBoYXNoIHdpdGggYW4gYXR0ZW1wdFxuICogY291bnRlciAobmV2ZXIgdGhlIHBsYWludGV4dCwgbmV2ZXIgaW4gdGhlIEpXVCk7IGB2ZXJpZnlgIGlzIGNvbnN0YW50LXRpbWUgb25cbiAqIHRoZSBoYXNoLCBhbmQgdGhlIGVudHJ5IGlzIGRlbGV0ZWQgb24gc3VjY2VzcyBvciBvbmNlIGF0dGVtcHRzIGFyZSBleGhhdXN0ZWQuXG4gKlxuICogVGhlIHNlc3Npb24gSldUIGlzIGFuIEhTMjU2IHRva2VuICh2aWEgYGpvc2VgKSBjYXJyeWluZyBvbmx5IHRoZSBlbWFpbC4gSXRzXG4gKiBzaWduaW5nIGtleSBpcyByZXNvbHZlZCBieSBgLi9zaWduaW5nLWtleS50c2A6IGBUVU5ORUxfQVVUSF9KV1RfU0VDUkVUYCB3aGVuXG4gKiBzZXQsIGVsc2UgYSBrZXkgcGVyc2lzdGVkIGluIHRoZSBjYWNoZSBmb3IgMzAgZGF5cyBzbyBjb29raWVzIHN1cnZpdmUgdGhlXG4gKiByZXN0YXJ0cyBhIHR1bm5lbCBzZWVzIHdoZW5ldmVyIHRoZSBhcHAgaXQgd3JhcHMgcmVsb2Fkcy4gQSBjb29raWUgc2lnbmVkXG4gKiBiZWZvcmUgYFRVTk5FTF9BVVRIX1NFU1NJT05fQ1VUT0ZGYCBpcyByZWZ1c2VkIGhlcmUgYXMgd2VsbCBhcyBiZWluZyBvcnBoYW5lZFxuICogYnkgdGhlIGNhY2hlIGtleSwgc28gdGhlIGZvcmNlLWNsZWFyIHN3aXRjaCBob2xkcyBldmVuIGZvciBhIHN0aWxsLWN1cnJlbnQga2V5LlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBjcmVhdGVIYXNoLCByYW5kb21JbnQsIHRpbWluZ1NhZmVFcXVhbCB9IGZyb20gXCJub2RlOmNyeXB0b1wiO1xuaW1wb3J0IHsgQ2FjaGVNYW5hZ2VyIH0gZnJvbSBcIkBkYXRhYnJpY2tzL2FwcGtpdFwiO1xuaW1wb3J0IHsgand0VmVyaWZ5LCBTaWduSldUIH0gZnJvbSBcImpvc2VcIjtcbmltcG9ydCB7IHNpZ25pbmdLZXkgfSBmcm9tIFwiLi9zaWduaW5nLWtleS50c1wiO1xuXG4vKiogSldUIGlzc3Vlci9hdWRpZW5jZSBzbyBhIHRva2VuIG1pbnRlZCBmb3IgdGhpcyBnYXRlIGlzbid0IGFjY2VwdGVkIGVsc2V3aGVyZS4gKi9cbmNvbnN0IEpXVF9BVUQgPSBcImRieC10b29scy10dW5uZWwtYXV0aFwiO1xuXG4vKiogQ2FjaGUta2V5IHByZWZpeCBmb3IgcGVuZGluZyBjb2RlcywgbmFtZXNwYWNlZCBhd2F5IGZyb20gYW55IG90aGVyIGNhY2hlIHVzZS4gKi9cbmNvbnN0IENPREVfUFJFRklYID0gXCJ0dW5uZWw6b3RwOlwiO1xuXG4vKiogU0hBLTI1NiBoZXggb2YgYSB2YWx1ZS4gKi9cbmZ1bmN0aW9uIHNoYTI1Nih2YWx1ZTogc3RyaW5nKTogc3RyaW5nIHtcbiAgcmV0dXJuIGNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKHZhbHVlKS5kaWdlc3QoXCJoZXhcIik7XG59XG5cbi8qKiBDb25zdGFudC10aW1lIGNvbXBhcmUgb2YgdHdvIGVxdWFsLWxlbmd0aCBoZXggZGlnZXN0cy4gKi9cbmZ1bmN0aW9uIHNhZmVFcXVhbEhleChhOiBzdHJpbmcsIGI6IHN0cmluZyk6IGJvb2xlYW4ge1xuICBpZiAoYS5sZW5ndGggIT09IGIubGVuZ3RoKSByZXR1cm4gZmFsc2U7XG4gIHJldHVybiB0aW1pbmdTYWZlRXF1YWwoQnVmZmVyLmZyb20oYSwgXCJoZXhcIiksIEJ1ZmZlci5mcm9tKGIsIFwiaGV4XCIpKTtcbn1cblxuaW50ZXJmYWNlIENvZGVFbnRyeSB7XG4gIGhhc2g6IHN0cmluZztcbiAgYXR0ZW1wdHM6IG51bWJlcjtcbn1cblxuLyoqIFJlc3VsdCBvZiB7QGxpbmsgQ29kZVN0b3JlLnZlcmlmeX0uICovXG5leHBvcnQgdHlwZSBWZXJpZnlPdXRjb21lID0gXCJva1wiIHwgXCJpbnZhbGlkXCIgfCBcImV4cGlyZWRcIiB8IFwidG9vLW1hbnktYXR0ZW1wdHNcIjtcblxuLyoqXG4gKiBQZW5kaW5nIG9uZS10aW1lIGNvZGVzLCBzdG9yZWQgaW4gQXBwS2l0J3MgY2FjaGUga2V5ZWQgYnkgbG93ZXJjYXNlZCBlbWFpbC5cbiAqIEV4cGlyeSBpcyB0aGUgY2FjaGUncyBUVEwgKG5vIG1hbnVhbCBjbG9jayk7IGEgbWlzcyBtZWFucyBleHBpcmVkLW9yLW5ldmVyLlxuICovXG5leHBvcnQgY2xhc3MgQ29kZVN0b3JlIHtcbiAgY29uc3RydWN0b3IoXG4gICAgcHJpdmF0ZSByZWFkb25seSB0dGxTZWNvbmRzOiBudW1iZXIsXG4gICAgcHJpdmF0ZSByZWFkb25seSBtYXhBdHRlbXB0czogbnVtYmVyLFxuICApIHt9XG5cbiAgcHJpdmF0ZSBjYWNoZSgpOiBDYWNoZU1hbmFnZXIge1xuICAgIHJldHVybiBDYWNoZU1hbmFnZXIuZ2V0SW5zdGFuY2VTeW5jKCk7XG4gIH1cblxuICBwcml2YXRlIGtleShlbWFpbDogc3RyaW5nKTogc3RyaW5nIHtcbiAgICByZXR1cm4gYCR7Q09ERV9QUkVGSVh9JHtlbWFpbC50b0xvd2VyQ2FzZSgpfWA7XG4gIH1cblxuICAvKipcbiAgICogR2VuZXJhdGUsIHN0b3JlIChoYXNoZWQsIHdpdGggdGhlIGNhY2hlIFRUTCksIGFuZCBSRVRVUk4gYSBmcmVzaCA2LWRpZ2l0XG4gICAqIGNvZGUuIFRoZSBjYWxsZXIgZW1haWxzIHRoZSByZXR1cm5lZCBwbGFpbnRleHQ7IG9ubHkgdGhlIGhhc2ggaXMgcmV0YWluZWQuXG4gICAqIFJlcGxhY2VzIGFueSBwZW5kaW5nIGNvZGUgZm9yIHRoZSBhZGRyZXNzLlxuICAgKi9cbiAgYXN5bmMgaXNzdWUoZW1haWw6IHN0cmluZyk6IFByb21pc2U8c3RyaW5nPiB7XG4gICAgY29uc3QgY29kZSA9IFN0cmluZyhyYW5kb21JbnQoMCwgMV8wMDBfMDAwKSkucGFkU3RhcnQoNiwgXCIwXCIpO1xuICAgIGNvbnN0IGVudHJ5OiBDb2RlRW50cnkgPSB7IGhhc2g6IHNoYTI1Nihjb2RlKSwgYXR0ZW1wdHM6IDAgfTtcbiAgICBhd2FpdCB0aGlzLmNhY2hlKCkuc2V0KHRoaXMua2V5KGVtYWlsKSwgZW50cnksIHsgdHRsOiB0aGlzLnR0bFNlY29uZHMgfSk7XG4gICAgcmV0dXJuIGNvZGU7XG4gIH1cblxuICAvKipcbiAgICogQ2hlY2sgYGNvZGVgIGZvciBgZW1haWxgLiBBIGNhY2hlIG1pc3MgaXMgYGV4cGlyZWRgIChUVEwgZWxhcHNlZCBvciBuZXZlclxuICAgKiBpc3N1ZWQpLiBEZWxldGVzIHRoZSBlbnRyeSBvbiBzdWNjZXNzIG9yIHdoZW4gYXR0ZW1wdHMgYXJlIGV4aGF1c3RlZCwgc28gYVxuICAgKiBjb2RlIGlzIHNpbmdsZS11c2UgYW5kIGNhbid0IGJlIGJydXRlLWZvcmNlZCBwYXN0IHRoZSBjYXAuIEFuIGF0dGVtcHRcbiAgICogaW5jcmVtZW50cyB0aGUgc3RvcmVkIGNvdW50ZXIgKHJlLXBlcnNpc3RlZCB3aXRoIGEgZnJlc2ggVFRMIHdpbmRvdykuXG4gICAqL1xuICBhc3luYyB2ZXJpZnkoZW1haWw6IHN0cmluZywgY29kZTogc3RyaW5nKTogUHJvbWlzZTxWZXJpZnlPdXRjb21lPiB7XG4gICAgY29uc3Qga2V5ID0gdGhpcy5rZXkoZW1haWwpO1xuICAgIGNvbnN0IGVudHJ5ID0gYXdhaXQgdGhpcy5jYWNoZSgpLmdldDxDb2RlRW50cnk+KGtleSk7XG4gICAgaWYgKCFlbnRyeSkgcmV0dXJuIFwiZXhwaXJlZFwiO1xuICAgIGNvbnN0IGF0dGVtcHRzID0gZW50cnkuYXR0ZW1wdHMgKyAxO1xuICAgIGlmIChzYWZlRXF1YWxIZXgoZW50cnkuaGFzaCwgc2hhMjU2KGNvZGUpKSkge1xuICAgICAgYXdhaXQgdGhpcy5jYWNoZSgpLmRlbGV0ZShrZXkpO1xuICAgICAgcmV0dXJuIFwib2tcIjtcbiAgICB9XG4gICAgaWYgKGF0dGVtcHRzID49IHRoaXMubWF4QXR0ZW1wdHMpIHtcbiAgICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5kZWxldGUoa2V5KTtcbiAgICAgIHJldHVybiBcInRvby1tYW55LWF0dGVtcHRzXCI7XG4gICAgfVxuICAgIGF3YWl0IHRoaXMuY2FjaGUoKS5zZXQoa2V5LCB7IC4uLmVudHJ5LCBhdHRlbXB0cyB9LCB7IHR0bDogdGhpcy50dGxTZWNvbmRzIH0pO1xuICAgIHJldHVybiBcImludmFsaWRcIjtcbiAgfVxufVxuXG4vKiogTWludCBhIHNlc3Npb24gSldUIGZvciBgZW1haWxgLCBleHBpcmluZyBpbiBgdHRsU2Vjb25kc2AuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gc2lnblNlc3Npb24oZW1haWw6IHN0cmluZywgdHRsU2Vjb25kczogbnVtYmVyKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgeyBrZXkgfSA9IGF3YWl0IHNpZ25pbmdLZXkoKTtcbiAgcmV0dXJuIG5ldyBTaWduSldUKHsgZW1haWwgfSlcbiAgICAuc2V0UHJvdGVjdGVkSGVhZGVyKHsgYWxnOiBcIkhTMjU2XCIgfSlcbiAgICAuc2V0U3ViamVjdChlbWFpbClcbiAgICAuc2V0QXVkaWVuY2UoSldUX0FVRClcbiAgICAuc2V0SXNzdWVkQXQoKVxuICAgIC5zZXRFeHBpcmF0aW9uVGltZShgJHt0dGxTZWNvbmRzfXNgKVxuICAgIC5zaWduKGtleSk7XG59XG5cbi8qKiBWYWxpZGF0ZSBhIHNlc3Npb24gSldULCByZXR1cm5pbmcgdGhlIGVtYWlsIGl0IHdhcyBtaW50ZWQgZm9yLCBvciBgdW5kZWZpbmVkYC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiB2ZXJpZnlTZXNzaW9uKHRva2VuOiBzdHJpbmcgfCB1bmRlZmluZWQpOiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD4ge1xuICBpZiAoIXRva2VuKSByZXR1cm4gdW5kZWZpbmVkO1xuICB0cnkge1xuICAgIGNvbnN0IHsga2V5LCBjdXRvZmZNcyB9ID0gYXdhaXQgc2lnbmluZ0tleSgpO1xuICAgIGNvbnN0IHsgcGF5bG9hZCB9ID0gYXdhaXQgand0VmVyaWZ5KHRva2VuLCBrZXksIHsgYXVkaWVuY2U6IEpXVF9BVUQgfSk7XG4gICAgLy8gQmVsdCBhbmQgYnJhY2VzIHdpdGggdGhlIGN1dG9mZi1zY29wZWQgY2FjaGUga2V5OiB0aGF0IGFsb25lIGFscmVhZHlcbiAgICAvLyBvcnBoYW5zIG9sZGVyIGtleXMsIGJ1dCBhbiBvcGVyYXRvciB3aG8gbW92ZWQgdGhlIGN1dG9mZiB3aGlsZVxuICAgIC8vIFRVTk5FTF9BVVRIX0pXVF9TRUNSRVQgaXMgc2V0IGhhcyBubyBrZXkgcm90YXRpb24gdG8gcmVseSBvbiwgYW5kIHRoaXNcbiAgICAvLyBjaGVjayBpcyB3aGF0IG1ha2VzIHRoZSBzd2l0Y2ggd29yayBpbiB0aGF0IGNhc2UgdG9vLlxuICAgIC8vIENvbXBhcmVkIGluIHdob2xlIFNFQ09ORFMgYmVjYXVzZSBgaWF0YCBoYXMgbm8gZmluZXIgcmVzb2x1dGlvbjogYWdhaW5zdCBhXG4gICAgLy8gbWlsbGlzZWNvbmQgY3V0b2ZmLCBhIGNvb2tpZSBtaW50ZWQgaW4gdGhlIHNhbWUgc2Vjb25kIGFzIGl0IHdvdWxkIGJlXG4gICAgLy8gcmVmdXNlZCBkZXBlbmRpbmcgb24gc3ViLXNlY29uZCByb3VuZGluZy5cbiAgICBpZiAoY3V0b2ZmTXMgPiAwICYmIChwYXlsb2FkLmlhdCA9PT0gdW5kZWZpbmVkIHx8IHBheWxvYWQuaWF0IDwgTWF0aC5mbG9vcihjdXRvZmZNcyAvIDEwMDApKSkge1xuICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgcmV0dXJuIHR5cGVvZiBwYXlsb2FkLmVtYWlsID09PSBcInN0cmluZ1wiID8gcGF5bG9hZC5lbWFpbCA6IHVuZGVmaW5lZDtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuIl19

package/lib/src/plugin.d.ts

@@ -46,12 +46,27 @@ export interface AuthGateConfig extends BasePluginConfig {
      * what the platform code-detection heuristics key on.
      */
     message?: string;
-    /** Session lifetime (seconds). Env TUNNEL_AUTH_SESSION_TTL. Default 43200 (12h). */
+    /**
+     * Session lifetime (seconds). Env TUNNEL_AUTH_SESSION_TTL. Default 2592000 (30d).
+     *
+     * Matched to the cache-backed signing key's own 30-day TTL (see
+     * `./signing-key.ts`): the cookie and the key that validates it should expire
+     * together, or one silently outlives the other.
+     */
     sessionTtlSeconds?: number;
     /** One-time-code lifetime (seconds). Env TUNNEL_AUTH_CODE_TTL. Default 600 (10m). */
     codeTtlSeconds?: number;
     /** Max verify attempts per issued code. Default 5. */
     maxAttempts?: number;
+    /**
+     * Force-clear cutoff: every session issued BEFORE it stops verifying, so moving
+     * it forward signs everyone out. Env TUNNEL_AUTH_SESSION_CUTOFF.
+     *
+     * Anything `object.toDate` accepts: a `Date`, `2026-08-02`, an ISO instant,
+     * epoch seconds/millis, or a relative duration (`-30d`, `7 days ago`). Unset
+     * means no cutoff.
+     */
+    sessionCutoff?: string | number | Date;
     /** Deliver a code to an address. Wired by the app to the email plugin. */
     sendCode?: (email: string, code: string, opts: SendCodeOptions) => Promise<void>;
 }
@@ -77,6 +92,8 @@ export interface ResolvedAuthGateConfig {
     sessionTtlSeconds: number;
     codeTtlSeconds: number;
     maxAttempts: number;
+    /** Force-clear cutoff in epoch ms; `0` when unset. */
+    sessionCutoffMs: number;
 }
 /** Merge {@link AuthGateConfig} over env over defaults into a resolved config. */
 export declare function resolveAuthGateConfig(config: AuthGateConfig): ResolvedAuthGateConfig;