@dbx-tools/cli-tunnel 0.6.51 → 0.6.52

package/lib/src/signing-key.d.ts

@@ -31,11 +31,11 @@
  *
  * ## Forcing every session to end
  *
- * {@link resolveSessionEpoch} reads a date from `TUNNEL_AUTH_SESSION_EPOCH` (or
- * `--session-epoch`), and that date is part of the cache KEY. Moving it forward
+ * {@link resolveSessionCutoff} reads a date from `TUNNEL_AUTH_SESSION_CUTOFF` (or
+ * `--session-cutoff`), and that date is part of the cache KEY. Moving it forward
  * makes every prior key unreachable, so every cookie signed against it stops
  * verifying - the log-everyone-out switch, without having to find and flush a
- * cache entry. The epoch is also asserted against each token's `iat`, so a
+ * cache entry. The cutoff is also asserted against each token's `iat`, so a
  * cookie that predates it is refused even if it was signed with the key that is
  * somehow still current.
  *
@@ -50,25 +50,28 @@
  */
 export declare const KEY_TTL_SECONDS: number;
 /**
- * Resolve the force-clear epoch as epoch MILLISECONDS, or `0` when unset.
+ * Resolve the force-clear cutoff as epoch MILLISECONDS, or `0` when unset.
+ *
+ * Accepts whatever `object.toDate` accepts - a `Date`, `2026-08-02`, an ISO
+ * instant, epoch seconds or millis from `date +%s`, or a relative duration
+ * (`-30d`, `7 days ago`), which is the spelling an operator reaching for this
+ * usually wants: sign out everyone who signed in more than a month ago.
  *
- * Accepts anything `Date` parses (`2026-08-02`, an ISO timestamp) plus a bare
- * epoch-seconds / epoch-millis number, so a value pasted from `date +%s` works.
  * An UNPARSEABLE value is ignored with a warning rather than throwing: this is
  * the switch that logs a fleet back in, and failing to boot over a typo is worse
  * than not rotating.
  */
-export declare function resolveSessionEpoch(configured?: string | number | Date): number;
-/** A resolved key plus the epoch it is scoped to. */
+export declare function resolveSessionCutoff(configured?: string | number | Date): number;
+/** A resolved key plus the cutoff it is scoped to. */
 export interface SigningKey {
     key: Uint8Array;
-    /** Force-clear epoch in ms; `0` when unset. Tokens older than this are refused. */
-    epochMs: number;
+    /** Force-clear cutoff in ms; `0` when unset. Tokens older than this are refused. */
+    cutoffMs: number;
 }
 /**
  * The signing key for this gate, resolved once per process.
  *
- * Resolved ONCE, so `configuredEpoch` is honoured only on the first call - the
+ * Resolved ONCE, so `configuredCutoff` is honoured only on the first call - the
  * plugin's `setup()` passes its resolved value there, before any request can
  * reach the lazy path.
  *
@@ -78,6 +81,6 @@ export interface SigningKey {
  * so losing it costs sessions, never admission - a caller still needs a code
  * delivered to an allow-listed address.
  */
-export declare function signingKey(configuredEpoch?: string | number | Date): Promise<SigningKey>;
+export declare function signingKey(configuredCutoff?: string | number | Date): Promise<SigningKey>;
 /** Reset the per-process key (tests, or after changing the env in-process). */
 export declare function resetSigningKey(): void;

package/lib/src/signing-key.js

@@ -31,11 +31,11 @@
  *
  * ## Forcing every session to end
  *
- * {@link resolveSessionEpoch} reads a date from `TUNNEL_AUTH_SESSION_EPOCH` (or
- * `--session-epoch`), and that date is part of the cache KEY. Moving it forward
+ * {@link resolveSessionCutoff} reads a date from `TUNNEL_AUTH_SESSION_CUTOFF` (or
+ * `--session-cutoff`), and that date is part of the cache KEY. Moving it forward
  * makes every prior key unreachable, so every cookie signed against it stops
  * verifying - the log-everyone-out switch, without having to find and flush a
- * cache entry. The epoch is also asserted against each token's `iat`, so a
+ * cache entry. The cutoff is also asserted against each token's `iat`, so a
  * cookie that predates it is refused even if it was signed with the key that is
  * somehow still current.
  *
@@ -43,8 +43,8 @@
  */
 import { randomBytes } from "node:crypto";
 import { CacheManager } from "@databricks/appkit";
-import { env, log } from "@dbx-tools/shared-core";
-import { JWT_SECRET_ENV, SESSION_EPOCH_ENV } from "./env.js";
+import { env, log, object } from "@dbx-tools/shared-core";
+import { JWT_SECRET_ENV, SESSION_CUTOFF_ENV } from "./env.js";
 const logger = log.logger("tunnel:signing-key");
 /**
  * How long a cached signing key lives: 30 days.
@@ -59,69 +59,58 @@ const KEY_PREFIX = "tunnel:auth:signing-key:";
 /** Bytes of entropy in a generated key (256-bit, matching HS256's hash width). */
 const KEY_BYTES = 32;
 /**
- * Resolve the force-clear epoch as epoch MILLISECONDS, or `0` when unset.
+ * Resolve the force-clear cutoff as epoch MILLISECONDS, or `0` when unset.
+ *
+ * Accepts whatever `object.toDate` accepts - a `Date`, `2026-08-02`, an ISO
+ * instant, epoch seconds or millis from `date +%s`, or a relative duration
+ * (`-30d`, `7 days ago`), which is the spelling an operator reaching for this
+ * usually wants: sign out everyone who signed in more than a month ago.
  *
- * Accepts anything `Date` parses (`2026-08-02`, an ISO timestamp) plus a bare
- * epoch-seconds / epoch-millis number, so a value pasted from `date +%s` works.
  * An UNPARSEABLE value is ignored with a warning rather than throwing: this is
  * the switch that logs a fleet back in, and failing to boot over a typo is worse
  * than not rotating.
  */
-export function resolveSessionEpoch(configured) {
-    const raw = configured ?? env.text(SESSION_EPOCH_ENV) ?? undefined;
+export function resolveSessionCutoff(configured) {
+    const raw = configured ?? env.text(SESSION_CUTOFF_ENV) ?? undefined;
     if (raw === undefined || raw === null || raw === "")
         return 0;
-    return clampToPast(parseEpoch(raw));
-}
-/** Parse the accepted epoch spellings to ms, or `0` when unusable. */
-function parseEpoch(raw) {
-    if (raw instanceof Date)
-        return Number.isNaN(raw.getTime()) ? 0 : raw.getTime();
-    const text = String(raw).trim();
-    // A bare number is a timestamp, not a date string: `Date.parse("1785...")`
-    // would read it as a YEAR. Values below ~1e11 are seconds (any millis
-    // timestamp since 1973 is larger), which is what `date +%s` prints.
-    if (/^\d+$/.test(text)) {
-        const numeric = Number(text);
-        return numeric < 1e11 ? numeric * 1000 : numeric;
-    }
-    const parsed = Date.parse(text);
-    if (Number.isNaN(parsed)) {
-        logger.warn(`ignoring unparseable ${env.name(SESSION_EPOCH_ENV)}`, { value: text });
+    const date = object.toDate(raw);
+    if (!date) {
+        logger.warn(`ignoring unparseable ${env.name(SESSION_CUTOFF_ENV)}`, { value: String(raw) });
         return 0;
     }
-    return parsed;
+    return clampToPast(date.getTime());
 }
 /**
- * Hold the cutoff at "now", because a FUTURE epoch would refuse the sessions it
+ * Hold the cutoff at "now", because a FUTURE cutoff would refuse the sessions it
  * is about to mint as well as the old ones - an app nobody can sign in to, from a
  * mistyped year, with the fix hidden behind understanding this flag. Clamped, a
  * future date means what an operator setting it always meant: clear everything
  * outstanding, then carry on.
  */
-function clampToPast(epochMs) {
+function clampToPast(cutoffMs) {
     const now = Date.now();
-    if (epochMs <= now)
-        return epochMs;
-    logger.warn(`${env.name(SESSION_EPOCH_ENV)} is in the future - clamping to now`, {
-        configured: new Date(epochMs).toISOString(),
+    if (cutoffMs <= now)
+        return cutoffMs;
+    logger.warn(`${env.name(SESSION_CUTOFF_ENV)} is in the future - clamping to now`, {
+        configured: new Date(cutoffMs).toISOString(),
     });
     return now;
 }
-/** The cache key for one epoch, so moving the epoch orphans every earlier key. */
-function cacheKey(epochMs) {
-    return `${KEY_PREFIX}${epochMs}`;
+/** The cache key for one cutoff, so moving the cutoff orphans every earlier key. */
+function cacheKey(cutoffMs) {
+    return `${KEY_PREFIX}${cutoffMs}`;
 }
 function decode(stored) {
     return new Uint8Array(Buffer.from(stored.secret, "base64url"));
 }
 /**
- * Load the signing key for `epochMs` from the cache, minting and storing one when
- * absent. See the module docs for why the write is followed by a re-read.
+ * Load the signing key for `cutoffMs` from the cache, minting and storing one
+ * when absent. See the module docs for why the write is followed by a re-read.
  */
-async function loadFromCache(epochMs) {
+async function loadFromCache(cutoffMs) {
     const cache = CacheManager.getInstanceSync();
-    const key = cacheKey(epochMs);
+    const key = cacheKey(cutoffMs);
     const existing = await cache.get(key);
     if (existing?.secret) {
         logger.info("reusing cached signing key", { createdAt: existing.createdAt });
@@ -147,7 +136,7 @@ let pending;
 /**
  * The signing key for this gate, resolved once per process.
  *
- * Resolved ONCE, so `configuredEpoch` is honoured only on the first call - the
+ * Resolved ONCE, so `configuredCutoff` is honoured only on the first call - the
  * plugin's `setup()` passes its resolved value there, before any request can
  * reach the lazy path.
  *
@@ -157,19 +146,19 @@ let pending;
  * so losing it costs sessions, never admission - a caller still needs a code
  * delivered to an allow-listed address.
  */
-export function signingKey(configuredEpoch) {
+export function signingKey(configuredCutoff) {
     pending ??= (async () => {
-        const epochMs = resolveSessionEpoch(configuredEpoch);
+        const cutoffMs = resolveSessionCutoff(configuredCutoff);
         const configured = env.text(JWT_SECRET_ENV);
         if (configured) {
-            return { key: new TextEncoder().encode(configured), epochMs };
+            return { key: new TextEncoder().encode(configured), cutoffMs };
         }
         try {
-            return { key: await loadFromCache(epochMs), epochMs };
+            return { key: await loadFromCache(cutoffMs), cutoffMs };
         }
         catch (error) {
             logger.warn(`no ${env.name(JWT_SECRET_ENV)} and the cache is unavailable - using an ephemeral per-process key; sessions will not survive a restart`, { error });
-            return { key: new Uint8Array(randomBytes(KEY_BYTES)), epochMs };
+            return { key: new Uint8Array(randomBytes(KEY_BYTES)), cutoffMs };
         }
     })();
     return pending;
@@ -178,4 +167,4 @@ export function signingKey(configuredEpoch) {
 export function resetSigningKey() {
     pending = undefined;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmluZy1rZXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2lnbmluZy1rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQTBDRztBQUVILE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDMUMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDbEQsT0FBTyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLFVBQVUsQ0FBQztBQUU3RCxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLG9CQUFvQixDQUFDLENBQUM7QUFFaEQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQztBQUVqRCxrRkFBa0Y7QUFDbEYsTUFBTSxVQUFVLEdBQUcsMEJBQTBCLENBQUM7QUFFOUMsa0ZBQWtGO0FBQ2xGLE1BQU0sU0FBUyxHQUFHLEVBQUUsQ0FBQztBQVVyQjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxVQUFtQztJQUNyRSxNQUFNLEdBQUcsR0FBRyxVQUFVLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLFNBQVMsQ0FBQztJQUNuRSxJQUFJLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxLQUFLLElBQUksSUFBSSxHQUFHLEtBQUssRUFBRTtRQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzlELE9BQU8sV0FBVyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBQ3RDLENBQUM7QUFFRCxzRUFBc0U7QUFDdEUsU0FBUyxVQUFVLENBQUMsR0FBMkI7SUFDN0MsSUFBSSxHQUFHLFlBQVksSUFBSTtRQUFFLE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUM7SUFFaEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hDLDJFQUEyRTtJQUMzRSxzRUFBc0U7SUFDdEUsb0VBQW9FO0lBQ3BFLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixPQUFPLE9BQU8sR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztJQUNuRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNoQyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN6QixNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixHQUFHLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3BGLE9BQU8sQ0FBQyxDQUFDO0lBQ1gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxTQUFTLFdBQVcsQ0FBQyxPQUFlO0lBQ2xDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixJQUFJLE9BQU8sSUFBSSxHQUFHO1FBQUUsT0FBTyxPQUFPLENBQUM7SUFDbkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMscUNBQXFDLEVBQUU7UUFDL0UsVUFBVSxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRTtLQUM1QyxDQUFDLENBQUM7SUFDSCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsU0FBUyxRQUFRLENBQUMsT0FBZTtJQUMvQixPQUFPLEdBQUcsVUFBVSxHQUFHLE9BQU8sRUFBRSxDQUFDO0FBQ25DLENBQUM7QUFFRCxTQUFTLE1BQU0sQ0FBQyxNQUFpQjtJQUMvQixPQUFPLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBQ2pFLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxLQUFLLFVBQVUsYUFBYSxDQUFDLE9BQWU7SUFDMUMsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLGVBQWUsRUFBRSxDQUFDO0lBQzdDLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUU5QixNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLENBQVksR0FBRyxDQUFDLENBQUM7SUFDakQsSUFBSSxRQUFRLEVBQUUsTUFBTSxFQUFFLENBQUM7UUFDckIsTUFBTSxDQUFDLElBQUksQ0FBQyw0QkFBNEIsRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUM3RSxPQUFPLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMxQixDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQWM7UUFDeEIsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUNqRSxTQUFTLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7S0FDcEMsQ0FBQztJQUNGLE1BQU0sS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLGVBQWUsRUFBRSxDQUFDLENBQUM7SUFFdkQsK0VBQStFO0lBQy9FLGdGQUFnRjtJQUNoRix1QkFBdUI7SUFDdkIsTUFBTSxPQUFPLEdBQUcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxHQUFHLENBQVksR0FBRyxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUM7SUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQywwQkFBMEIsRUFBRTtRQUN0QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7UUFDNUIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsT0FBTyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxxQkFBcUI7S0FDaEYsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDekIsQ0FBQztBQVNELElBQUksT0FBd0MsQ0FBQztBQUU3Qzs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxNQUFNLFVBQVUsVUFBVSxDQUFDLGVBQXdDO0lBQ2pFLE9BQU8sS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFO1FBQ3RCLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ3JELE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDNUMsSUFBSSxVQUFVLEVBQUUsQ0FBQztZQUNmLE9BQU8sRUFBRSxHQUFHLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxhQUFhLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDeEQsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLENBQUMsSUFBSSxDQUNULE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMseUdBQXlHLEVBQ3ZJLEVBQUUsS0FBSyxFQUFFLENBQ1YsQ0FBQztZQUNGLE9BQU8sRUFBRSxHQUFHLEVBQUUsSUFBSSxVQUFVLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDbEUsQ0FBQztJQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDTCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDO0FBRUQsK0VBQStFO0FBQy9FLE1BQU0sVUFBVSxlQUFlO0lBQzdCLE9BQU8sR0FBRyxTQUFTLENBQUM7QUFDdEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogVGhlIGdhdGUncyBIUzI1NiBzZXNzaW9uLXNpZ25pbmcga2V5LCBwZXJzaXN0ZWQgaW4gQXBwS2l0J3MgY2FjaGUuXG4gKlxuICogVGhlIGtleSBkZWNpZGVzIHdoZXRoZXIgYSBzZXNzaW9uIENPT0tJRSBzdGlsbCB2ZXJpZmllcy4gQmVmb3JlIHRoaXMgbW9kdWxlIHRoZVxuICogZmFsbGJhY2sgd2FzIGByYW5kb21CeXRlcygzMilgIHBlciBwcm9jZXNzLCBzbyBldmVyeSByZXN0YXJ0IGludmFsaWRhdGVkIGV2ZXJ5XG4gKiBvdXRzdGFuZGluZyBjb29raWUgYW5kIGVhY2ggc2lnbmVkLWluIHVzZXIgaGFkIHRvIHJlcXVlc3QgYSBuZXcgY29kZSAtIHBhaW5mdWxcbiAqIGZvciBhIHR1bm5lbCwgd2hpY2ggcmVzdGFydHMgd2hlbmV2ZXIgdGhlIGFwcCBpdCB3cmFwcyBkb2VzLiBOb3cgdGhlIGtleSBpc1xuICogc3RvcmVkIGluIHRoZSBjYWNoZSBBcHBLaXQgYWxyZWFkeSBjb25maWd1cmVkIChtZW1vcnksIG9yIExha2ViYXNlIHdoZW4gdGhlXG4gKiBob3N0IHdpcmVzIGEgcGVyc2lzdGVudCBgQ2FjaGVTdG9yYWdlYCksIHNvIHdpdGggcGVyc2lzdGVudCBzdG9yYWdlIGEgcmVzdGFydFxuICoga2VlcHMgc2Vzc2lvbnMgYWxpdmUgZm9yIHtAbGluayBLRVlfVFRMX1NFQ09ORFN9LlxuICpcbiAqIEFuIGV4cGxpY2l0bHkgY29uZmlndXJlZCBgVFVOTkVMX0FVVEhfSldUX1NFQ1JFVGAgc3RpbGwgd2lucyBvdXRyaWdodC4gVGhhdCBpc1xuICogdGhlIHJpZ2h0IGFuc3dlciBmb3IgYSBmbGVldDogYW4gb3BlcmF0b3ItaGVsZCBzZWNyZXQgbmVlZHMgbm8gc2hhcmVkIGNhY2hlIGFuZFxuICogbm8gY29udmVyZ2VuY2UsIGFuZCBpdCBzdXJ2aXZlcyBhIGNhY2hlIGZsdXNoLlxuICpcbiAqICMjIGdldCAvIGdlbmVyYXRlIC8gZ2V0XG4gKlxuICogVHdvIGluc3RhbmNlcyBib290aW5nIGF0IG9uY2UgYm90aCBtaXNzLCBzbyBib3RoIHdvdWxkIGdlbmVyYXRlIC0gYW5kIHRoZSBsb3NlclxuICogd291bGQgc2lnbiBjb29raWVzIHdpdGggYSBrZXkgdGhlIHdpbm5lciByZWplY3RzLiBSZXNvbHV0aW9uIGlzIGEgcmUtUkVBRCBhZnRlclxuICogdGhlIHdyaXRlOiB3aGF0ZXZlciB0aGUgY2FjaGUgaG9sZHMgYWZ0ZXJ3YXJkcyBpcyB0aGUga2V5IGV2ZXJ5b25lIGFkb3B0cywgc29cbiAqIHRoZSBpbnN0YW5jZXMgY29udmVyZ2Ugb24gT05FIHZhbHVlIGluc3RlYWQgb2YgdHJ1c3RpbmcgdGhlIG9uZSB0aGV5IG1pbnRlZC5cbiAqIChgc2V0YCBpcyBub3QgY29uZGl0aW9uYWwgaW4gdGhlIGNhY2hlIEFQSSAtIHRoZXJlIGlzIG5vIGBzZXRueGAgdG8gbGVhbiBvbiAtXG4gKiBhbmQgdGhpcyBydW5zIG9uY2UgcGVyIHByb2Nlc3MsIHNvIHRoZSBleHRyYSByb3VuZC10cmlwIGlzIGZyZWUuKVxuICpcbiAqIEEgcGF0aG9sb2dpY2FsIGludGVybGVhdmUgY2FuIHN0aWxsIGNvc3QgYSBrZXk6IGlmIEEgd3JpdGVzIGJldHdlZW4gQidzIHdyaXRlXG4gKiBhbmQgQidzIHJlLXJlYWQsIEIgYWRvcHRzIEEncyBrZXkgd2hpbGUgQSBhZG9wdHMgaXRzIG93bi4gVGhlIGNvc3QgaXMgYm91bmRlZCAtXG4gKiBhIGNvb2tpZSBtaW50ZWQgaW4gdGhhdCB3aW5kb3cgZmFpbHMgdG8gdmVyaWZ5IGFuZCB0aGUgaG9sZGVyIHNpZ25zIGluIGFnYWluIC1cbiAqIGFuZCBpdCBjYW5ub3QgcHJvZHVjZSBhIGtleSBvbmUgaW5zdGFuY2UgVFJVU1RTIGJ1dCBhbm90aGVyIHJlamVjdHMgZm9yIGxvbmdlclxuICogdGhhbiB0aGUgd2luZG93IGl0c2VsZi4gU2V0IGBUVU5ORUxfQVVUSF9KV1RfU0VDUkVUYCB0byByZW1vdmUgdGhlIHJhY2VcbiAqIGVudGlyZWx5LlxuICpcbiAqICMjIEZvcmNpbmcgZXZlcnkgc2Vzc2lvbiB0byBlbmRcbiAqXG4gKiB7QGxpbmsgcmVzb2x2ZVNlc3Npb25FcG9jaH0gcmVhZHMgYSBkYXRlIGZyb20gYFRVTk5FTF9BVVRIX1NFU1NJT05fRVBPQ0hgIChvclxuICogYC0tc2Vzc2lvbi1lcG9jaGApLCBhbmQgdGhhdCBkYXRlIGlzIHBhcnQgb2YgdGhlIGNhY2hlIEtFWS4gTW92aW5nIGl0IGZvcndhcmRcbiAqIG1ha2VzIGV2ZXJ5IHByaW9yIGtleSB1bnJlYWNoYWJsZSwgc28gZXZlcnkgY29va2llIHNpZ25lZCBhZ2FpbnN0IGl0IHN0b3BzXG4gKiB2ZXJpZnlpbmcgLSB0aGUgbG9nLWV2ZXJ5b25lLW91dCBzd2l0Y2gsIHdpdGhvdXQgaGF2aW5nIHRvIGZpbmQgYW5kIGZsdXNoIGFcbiAqIGNhY2hlIGVudHJ5LiBUaGUgZXBvY2ggaXMgYWxzbyBhc3NlcnRlZCBhZ2FpbnN0IGVhY2ggdG9rZW4ncyBgaWF0YCwgc28gYVxuICogY29va2llIHRoYXQgcHJlZGF0ZXMgaXQgaXMgcmVmdXNlZCBldmVuIGlmIGl0IHdhcyBzaWduZWQgd2l0aCB0aGUga2V5IHRoYXQgaXNcbiAqIHNvbWVob3cgc3RpbGwgY3VycmVudC5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgcmFuZG9tQnl0ZXMgfSBmcm9tIFwibm9kZTpjcnlwdG9cIjtcbmltcG9ydCB7IENhY2hlTWFuYWdlciB9IGZyb20gXCJAZGF0YWJyaWNrcy9hcHBraXRcIjtcbmltcG9ydCB7IGVudiwgbG9nIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB7IEpXVF9TRUNSRVRfRU5WLCBTRVNTSU9OX0VQT0NIX0VOViB9IGZyb20gXCIuL2Vudi50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwidHVubmVsOnNpZ25pbmcta2V5XCIpO1xuXG4vKipcbiAqIEhvdyBsb25nIGEgY2FjaGVkIHNpZ25pbmcga2V5IGxpdmVzOiAzMCBkYXlzLlxuICpcbiAqIFRoaXMgaXMgdGhlIGNlaWxpbmcgb24gaG93IGxvbmcgYSBzZXNzaW9uIGNvb2tpZSBjYW4gc3RheSB2YWxpZCBhY3Jvc3NcbiAqIHJlc3RhcnRzLCBzbyBpdCBpcyBkZWxpYmVyYXRlbHkgPj0gdGhlIGRlZmF1bHQgc2Vzc2lvbiBUVEwgLSBhIGtleSB0aGF0IGV4cGlyZWRcbiAqIGJlZm9yZSB0aGUgY29va2llcyBpdCBzaWduZWQgd291bGQgbG9nIGV2ZXJ5b25lIG91dCBmb3Igbm8gcmVhc29uLlxuICovXG5leHBvcnQgY29uc3QgS0VZX1RUTF9TRUNPTkRTID0gMzAgKiAyNCAqIDYwICogNjA7XG5cbi8qKiBDYWNoZS1rZXkgcHJlZml4IGZvciB0aGUgc2lnbmluZyBrZXksIG5hbWVzcGFjZWQgYXdheSBmcm9tIG90aGVyIGNhY2hlIHVzZS4gKi9cbmNvbnN0IEtFWV9QUkVGSVggPSBcInR1bm5lbDphdXRoOnNpZ25pbmcta2V5OlwiO1xuXG4vKiogQnl0ZXMgb2YgZW50cm9weSBpbiBhIGdlbmVyYXRlZCBrZXkgKDI1Ni1iaXQsIG1hdGNoaW5nIEhTMjU2J3MgaGFzaCB3aWR0aCkuICovXG5jb25zdCBLRVlfQllURVMgPSAzMjtcblxuLyoqIFdoYXQgdGhlIGNhY2hlIHN0b3JlczogdGhlIGtleSBwbHVzIHdoZW4gaXQgd2FzIG1pbnRlZCwgZm9yIG9ic2VydmFiaWxpdHkuICovXG5pbnRlcmZhY2UgU3RvcmVkS2V5IHtcbiAgLyoqIEJhc2U2NHVybCBvZiB0aGUgcmF3IGtleSBieXRlcy4gKi9cbiAgc2VjcmV0OiBzdHJpbmc7XG4gIC8qKiBXaGVuIHRoaXMga2V5IHdhcyBnZW5lcmF0ZWQsIElTTy04NjAxLiAqL1xuICBjcmVhdGVkQXQ6IHN0cmluZztcbn1cblxuLyoqXG4gKiBSZXNvbHZlIHRoZSBmb3JjZS1jbGVhciBlcG9jaCBhcyBlcG9jaCBNSUxMSVNFQ09ORFMsIG9yIGAwYCB3aGVuIHVuc2V0LlxuICpcbiAqIEFjY2VwdHMgYW55dGhpbmcgYERhdGVgIHBhcnNlcyAoYDIwMjYtMDgtMDJgLCBhbiBJU08gdGltZXN0YW1wKSBwbHVzIGEgYmFyZVxuICogZXBvY2gtc2Vjb25kcyAvIGVwb2NoLW1pbGxpcyBudW1iZXIsIHNvIGEgdmFsdWUgcGFzdGVkIGZyb20gYGRhdGUgKyVzYCB3b3Jrcy5cbiAqIEFuIFVOUEFSU0VBQkxFIHZhbHVlIGlzIGlnbm9yZWQgd2l0aCBhIHdhcm5pbmcgcmF0aGVyIHRoYW4gdGhyb3dpbmc6IHRoaXMgaXNcbiAqIHRoZSBzd2l0Y2ggdGhhdCBsb2dzIGEgZmxlZXQgYmFjayBpbiwgYW5kIGZhaWxpbmcgdG8gYm9vdCBvdmVyIGEgdHlwbyBpcyB3b3JzZVxuICogdGhhbiBub3Qgcm90YXRpbmcuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlU2Vzc2lvbkVwb2NoKGNvbmZpZ3VyZWQ/OiBzdHJpbmcgfCBudW1iZXIgfCBEYXRlKTogbnVtYmVyIHtcbiAgY29uc3QgcmF3ID0gY29uZmlndXJlZCA/PyBlbnYudGV4dChTRVNTSU9OX0VQT0NIX0VOVikgPz8gdW5kZWZpbmVkO1xuICBpZiAocmF3ID09PSB1bmRlZmluZWQgfHwgcmF3ID09PSBudWxsIHx8IHJhdyA9PT0gXCJcIikgcmV0dXJuIDA7XG4gIHJldHVybiBjbGFtcFRvUGFzdChwYXJzZUVwb2NoKHJhdykpO1xufVxuXG4vKiogUGFyc2UgdGhlIGFjY2VwdGVkIGVwb2NoIHNwZWxsaW5ncyB0byBtcywgb3IgYDBgIHdoZW4gdW51c2FibGUuICovXG5mdW5jdGlvbiBwYXJzZUVwb2NoKHJhdzogc3RyaW5nIHwgbnVtYmVyIHwgRGF0ZSk6IG51bWJlciB7XG4gIGlmIChyYXcgaW5zdGFuY2VvZiBEYXRlKSByZXR1cm4gTnVtYmVyLmlzTmFOKHJhdy5nZXRUaW1lKCkpID8gMCA6IHJhdy5nZXRUaW1lKCk7XG5cbiAgY29uc3QgdGV4dCA9IFN0cmluZyhyYXcpLnRyaW0oKTtcbiAgLy8gQSBiYXJlIG51bWJlciBpcyBhIHRpbWVzdGFtcCwgbm90IGEgZGF0ZSBzdHJpbmc6IGBEYXRlLnBhcnNlKFwiMTc4NS4uLlwiKWBcbiAgLy8gd291bGQgcmVhZCBpdCBhcyBhIFlFQVIuIFZhbHVlcyBiZWxvdyB+MWUxMSBhcmUgc2Vjb25kcyAoYW55IG1pbGxpc1xuICAvLyB0aW1lc3RhbXAgc2luY2UgMTk3MyBpcyBsYXJnZXIpLCB3aGljaCBpcyB3aGF0IGBkYXRlICslc2AgcHJpbnRzLlxuICBpZiAoL15cXGQrJC8udGVzdCh0ZXh0KSkge1xuICAgIGNvbnN0IG51bWVyaWMgPSBOdW1iZXIodGV4dCk7XG4gICAgcmV0dXJuIG51bWVyaWMgPCAxZTExID8gbnVtZXJpYyAqIDEwMDAgOiBudW1lcmljO1xuICB9XG4gIGNvbnN0IHBhcnNlZCA9IERhdGUucGFyc2UodGV4dCk7XG4gIGlmIChOdW1iZXIuaXNOYU4ocGFyc2VkKSkge1xuICAgIGxvZ2dlci53YXJuKGBpZ25vcmluZyB1bnBhcnNlYWJsZSAke2Vudi5uYW1lKFNFU1NJT05fRVBPQ0hfRU5WKX1gLCB7IHZhbHVlOiB0ZXh0IH0pO1xuICAgIHJldHVybiAwO1xuICB9XG4gIHJldHVybiBwYXJzZWQ7XG59XG5cbi8qKlxuICogSG9sZCB0aGUgY3V0b2ZmIGF0IFwibm93XCIsIGJlY2F1c2UgYSBGVVRVUkUgZXBvY2ggd291bGQgcmVmdXNlIHRoZSBzZXNzaW9ucyBpdFxuICogaXMgYWJvdXQgdG8gbWludCBhcyB3ZWxsIGFzIHRoZSBvbGQgb25lcyAtIGFuIGFwcCBub2JvZHkgY2FuIHNpZ24gaW4gdG8sIGZyb20gYVxuICogbWlzdHlwZWQgeWVhciwgd2l0aCB0aGUgZml4IGhpZGRlbiBiZWhpbmQgdW5kZXJzdGFuZGluZyB0aGlzIGZsYWcuIENsYW1wZWQsIGFcbiAqIGZ1dHVyZSBkYXRlIG1lYW5zIHdoYXQgYW4gb3BlcmF0b3Igc2V0dGluZyBpdCBhbHdheXMgbWVhbnQ6IGNsZWFyIGV2ZXJ5dGhpbmdcbiAqIG91dHN0YW5kaW5nLCB0aGVuIGNhcnJ5IG9uLlxuICovXG5mdW5jdGlvbiBjbGFtcFRvUGFzdChlcG9jaE1zOiBudW1iZXIpOiBudW1iZXIge1xuICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICBpZiAoZXBvY2hNcyA8PSBub3cpIHJldHVybiBlcG9jaE1zO1xuICBsb2dnZXIud2FybihgJHtlbnYubmFtZShTRVNTSU9OX0VQT0NIX0VOVil9IGlzIGluIHRoZSBmdXR1cmUgLSBjbGFtcGluZyB0byBub3dgLCB7XG4gICAgY29uZmlndXJlZDogbmV3IERhdGUoZXBvY2hNcykudG9JU09TdHJpbmcoKSxcbiAgfSk7XG4gIHJldHVybiBub3c7XG59XG5cbi8qKiBUaGUgY2FjaGUga2V5IGZvciBvbmUgZXBvY2gsIHNvIG1vdmluZyB0aGUgZXBvY2ggb3JwaGFucyBldmVyeSBlYXJsaWVyIGtleS4gKi9cbmZ1bmN0aW9uIGNhY2hlS2V5KGVwb2NoTXM6IG51bWJlcik6IHN0cmluZyB7XG4gIHJldHVybiBgJHtLRVlfUFJFRklYfSR7ZXBvY2hNc31gO1xufVxuXG5mdW5jdGlvbiBkZWNvZGUoc3RvcmVkOiBTdG9yZWRLZXkpOiBVaW50OEFycmF5IHtcbiAgcmV0dXJuIG5ldyBVaW50OEFycmF5KEJ1ZmZlci5mcm9tKHN0b3JlZC5zZWNyZXQsIFwiYmFzZTY0dXJsXCIpKTtcbn1cblxuLyoqXG4gKiBMb2FkIHRoZSBzaWduaW5nIGtleSBmb3IgYGVwb2NoTXNgIGZyb20gdGhlIGNhY2hlLCBtaW50aW5nIGFuZCBzdG9yaW5nIG9uZSB3aGVuXG4gKiBhYnNlbnQuIFNlZSB0aGUgbW9kdWxlIGRvY3MgZm9yIHdoeSB0aGUgd3JpdGUgaXMgZm9sbG93ZWQgYnkgYSByZS1yZWFkLlxuICovXG5hc3luYyBmdW5jdGlvbiBsb2FkRnJvbUNhY2hlKGVwb2NoTXM6IG51bWJlcik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICBjb25zdCBjYWNoZSA9IENhY2hlTWFuYWdlci5nZXRJbnN0YW5jZVN5bmMoKTtcbiAgY29uc3Qga2V5ID0gY2FjaGVLZXkoZXBvY2hNcyk7XG5cbiAgY29uc3QgZXhpc3RpbmcgPSBhd2FpdCBjYWNoZS5nZXQ8U3RvcmVkS2V5PihrZXkpO1xuICBpZiAoZXhpc3Rpbmc/LnNlY3JldCkge1xuICAgIGxvZ2dlci5pbmZvKFwicmV1c2luZyBjYWNoZWQgc2lnbmluZyBrZXlcIiwgeyBjcmVhdGVkQXQ6IGV4aXN0aW5nLmNyZWF0ZWRBdCB9KTtcbiAgICByZXR1cm4gZGVjb2RlKGV4aXN0aW5nKTtcbiAgfVxuXG4gIGNvbnN0IG1pbnRlZDogU3RvcmVkS2V5ID0ge1xuICAgIHNlY3JldDogQnVmZmVyLmZyb20ocmFuZG9tQnl0ZXMoS0VZX0JZVEVTKSkudG9TdHJpbmcoXCJiYXNlNjR1cmxcIiksXG4gICAgY3JlYXRlZEF0OiBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCksXG4gIH07XG4gIGF3YWl0IGNhY2hlLnNldChrZXksIG1pbnRlZCwgeyB0dGw6IEtFWV9UVExfU0VDT05EUyB9KTtcblxuICAvLyBSZS1yZWFkIHJhdGhlciB0aGFuIHRydXN0aW5nIGBtaW50ZWRgOiBhbm90aGVyIGluc3RhbmNlIHRoYXQgcmFjZWQgdGhpcyBib290XG4gIC8vIG1heSBoYXZlIHdyaXR0ZW4gZmlyc3QsIGFuZCBhZG9wdGluZyB3aGF0ZXZlciBpcyBzdG9yZWQgaXMgd2hhdCBtYWtlcyB0aGUgdHdvXG4gIC8vIGNvbnZlcmdlIG9uIG9uZSBrZXkuXG4gIGNvbnN0IHNldHRsZWQgPSAoYXdhaXQgY2FjaGUuZ2V0PFN0b3JlZEtleT4oa2V5KSkgPz8gbWludGVkO1xuICBsb2dnZXIuaW5mbyhcInN0b3JlZCBhIG5ldyBzaWduaW5nIGtleVwiLCB7XG4gICAgY3JlYXRlZEF0OiBzZXR0bGVkLmNyZWF0ZWRBdCxcbiAgICB0dGxTZWNvbmRzOiBLRVlfVFRMX1NFQ09ORFMsXG4gICAgYWRvcHRlZDogc2V0dGxlZC5jcmVhdGVkQXQgPT09IG1pbnRlZC5jcmVhdGVkQXQgPyBcIm93blwiIDogXCJjb25jdXJyZW50LWluc3RhbmNlXCIsXG4gIH0pO1xuICByZXR1cm4gZGVjb2RlKHNldHRsZWQpO1xufVxuXG4vKiogQSByZXNvbHZlZCBrZXkgcGx1cyB0aGUgZXBvY2ggaXQgaXMgc2NvcGVkIHRvLiAqL1xuZXhwb3J0IGludGVyZmFjZSBTaWduaW5nS2V5IHtcbiAga2V5OiBVaW50OEFycmF5O1xuICAvKiogRm9yY2UtY2xlYXIgZXBvY2ggaW4gbXM7IGAwYCB3aGVuIHVuc2V0LiBUb2tlbnMgb2xkZXIgdGhhbiB0aGlzIGFyZSByZWZ1c2VkLiAqL1xuICBlcG9jaE1zOiBudW1iZXI7XG59XG5cbmxldCBwZW5kaW5nOiBQcm9taXNlPFNpZ25pbmdLZXk+IHwgdW5kZWZpbmVkO1xuXG4vKipcbiAqIFRoZSBzaWduaW5nIGtleSBmb3IgdGhpcyBnYXRlLCByZXNvbHZlZCBvbmNlIHBlciBwcm9jZXNzLlxuICpcbiAqIFJlc29sdmVkIE9OQ0UsIHNvIGBjb25maWd1cmVkRXBvY2hgIGlzIGhvbm91cmVkIG9ubHkgb24gdGhlIGZpcnN0IGNhbGwgLSB0aGVcbiAqIHBsdWdpbidzIGBzZXR1cCgpYCBwYXNzZXMgaXRzIHJlc29sdmVkIHZhbHVlIHRoZXJlLCBiZWZvcmUgYW55IHJlcXVlc3QgY2FuXG4gKiByZWFjaCB0aGUgbGF6eSBwYXRoLlxuICpcbiAqIGBUVU5ORUxfQVVUSF9KV1RfU0VDUkVUYCB3aGVuIHNldCwgZWxzZSB0aGUgY2FjaGUtYmFja2VkIGtleS4gQSBjYWNoZSB0aGF0IGlzXG4gKiB1bmF2YWlsYWJsZSBkZWdyYWRlcyB0byBhbiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5ICh0aGUgcHJldmlvdXMgYmVoYXZpb3VyKVxuICogcmF0aGVyIHRoYW4gcmVmdXNpbmcgdG8gc2lnbjogdGhlIGtleSBvbmx5IHZhbGlkYXRlcyBhbiBBTFJFQURZLWlzc3VlZCBzZXNzaW9uLFxuICogc28gbG9zaW5nIGl0IGNvc3RzIHNlc3Npb25zLCBuZXZlciBhZG1pc3Npb24gLSBhIGNhbGxlciBzdGlsbCBuZWVkcyBhIGNvZGVcbiAqIGRlbGl2ZXJlZCB0byBhbiBhbGxvdy1saXN0ZWQgYWRkcmVzcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNpZ25pbmdLZXkoY29uZmlndXJlZEVwb2NoPzogc3RyaW5nIHwgbnVtYmVyIHwgRGF0ZSk6IFByb21pc2U8U2lnbmluZ0tleT4ge1xuICBwZW5kaW5nID8/PSAoYXN5bmMgKCkgPT4ge1xuICAgIGNvbnN0IGVwb2NoTXMgPSByZXNvbHZlU2Vzc2lvbkVwb2NoKGNvbmZpZ3VyZWRFcG9jaCk7XG4gICAgY29uc3QgY29uZmlndXJlZCA9IGVudi50ZXh0KEpXVF9TRUNSRVRfRU5WKTtcbiAgICBpZiAoY29uZmlndXJlZCkge1xuICAgICAgcmV0dXJuIHsga2V5OiBuZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUoY29uZmlndXJlZCksIGVwb2NoTXMgfTtcbiAgICB9XG4gICAgdHJ5IHtcbiAgICAgIHJldHVybiB7IGtleTogYXdhaXQgbG9hZEZyb21DYWNoZShlcG9jaE1zKSwgZXBvY2hNcyB9O1xuICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICBsb2dnZXIud2FybihcbiAgICAgICAgYG5vICR7ZW52Lm5hbWUoSldUX1NFQ1JFVF9FTlYpfSBhbmQgdGhlIGNhY2hlIGlzIHVuYXZhaWxhYmxlIC0gdXNpbmcgYW4gZXBoZW1lcmFsIHBlci1wcm9jZXNzIGtleTsgc2Vzc2lvbnMgd2lsbCBub3Qgc3Vydml2ZSBhIHJlc3RhcnRgLFxuICAgICAgICB7IGVycm9yIH0sXG4gICAgICApO1xuICAgICAgcmV0dXJuIHsga2V5OiBuZXcgVWludDhBcnJheShyYW5kb21CeXRlcyhLRVlfQllURVMpKSwgZXBvY2hNcyB9O1xuICAgIH1cbiAgfSkoKTtcbiAgcmV0dXJuIHBlbmRpbmc7XG59XG5cbi8qKiBSZXNldCB0aGUgcGVyLXByb2Nlc3Mga2V5ICh0ZXN0cywgb3IgYWZ0ZXIgY2hhbmdpbmcgdGhlIGVudiBpbi1wcm9jZXNzKS4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNldFNpZ25pbmdLZXkoKTogdm9pZCB7XG4gIHBlbmRpbmcgPSB1bmRlZmluZWQ7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmluZy1rZXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2lnbmluZy1rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQTBDRztBQUVILE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDMUMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ2xELE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzFELE9BQU8sRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFOUQsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0FBRWhEOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUM7QUFFakQsa0ZBQWtGO0FBQ2xGLE1BQU0sVUFBVSxHQUFHLDBCQUEwQixDQUFDO0FBRTlDLGtGQUFrRjtBQUNsRixNQUFNLFNBQVMsR0FBRyxFQUFFLENBQUM7QUFVckI7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLFVBQVUsb0JBQW9CLENBQUMsVUFBbUM7SUFDdEUsTUFBTSxHQUFHLEdBQUcsVUFBVSxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDcEUsSUFBSSxHQUFHLEtBQUssU0FBUyxJQUFJLEdBQUcsS0FBSyxJQUFJLElBQUksR0FBRyxLQUFLLEVBQUU7UUFBRSxPQUFPLENBQUMsQ0FBQztJQUU5RCxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2hDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNWLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEdBQUcsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDNUYsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7QUFDckMsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILFNBQVMsV0FBVyxDQUFDLFFBQWdCO0lBQ25DLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixJQUFJLFFBQVEsSUFBSSxHQUFHO1FBQUUsT0FBTyxRQUFRLENBQUM7SUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMscUNBQXFDLEVBQUU7UUFDaEYsVUFBVSxFQUFFLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFdBQVcsRUFBRTtLQUM3QyxDQUFDLENBQUM7SUFDSCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRCxvRkFBb0Y7QUFDcEYsU0FBUyxRQUFRLENBQUMsUUFBZ0I7SUFDaEMsT0FBTyxHQUFHLFVBQVUsR0FBRyxRQUFRLEVBQUUsQ0FBQztBQUNwQyxDQUFDO0FBRUQsU0FBUyxNQUFNLENBQUMsTUFBaUI7SUFDL0IsT0FBTyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztBQUNqRSxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsS0FBSyxVQUFVLGFBQWEsQ0FBQyxRQUFnQjtJQUMzQyxNQUFNLEtBQUssR0FBRyxZQUFZLENBQUMsZUFBZSxFQUFFLENBQUM7SUFDN0MsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRS9CLE1BQU0sUUFBUSxHQUFHLE1BQU0sS0FBSyxDQUFDLEdBQUcsQ0FBWSxHQUFHLENBQUMsQ0FBQztJQUNqRCxJQUFJLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztRQUNyQixNQUFNLENBQUMsSUFBSSxDQUFDLDRCQUE0QixFQUFFLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQzdFLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBYztRQUN4QixNQUFNLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1FBQ2pFLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtLQUNwQyxDQUFDO0lBQ0YsTUFBTSxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsRUFBRSxHQUFHLEVBQUUsZUFBZSxFQUFFLENBQUMsQ0FBQztJQUV2RCwrRUFBK0U7SUFDL0UsZ0ZBQWdGO0lBQ2hGLHVCQUF1QjtJQUN2QixNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sS0FBSyxDQUFDLEdBQUcsQ0FBWSxHQUFHLENBQUMsQ0FBQyxJQUFJLE1BQU0sQ0FBQztJQUM1RCxNQUFNLENBQUMsSUFBSSxDQUFDLDBCQUEwQixFQUFFO1FBQ3RDLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztRQUM1QixVQUFVLEVBQUUsZUFBZTtRQUMzQixPQUFPLEVBQUUsT0FBTyxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLHFCQUFxQjtLQUNoRixDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUN6QixDQUFDO0FBU0QsSUFBSSxPQUF3QyxDQUFDO0FBRTdDOzs7Ozs7Ozs7Ozs7R0FZRztBQUNILE1BQU0sVUFBVSxVQUFVLENBQUMsZ0JBQXlDO0lBQ2xFLE9BQU8sS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFO1FBQ3RCLE1BQU0sUUFBUSxHQUFHLG9CQUFvQixDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDeEQsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUM1QyxJQUFJLFVBQVUsRUFBRSxDQUFDO1lBQ2YsT0FBTyxFQUFFLEdBQUcsRUFBRSxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsT0FBTyxFQUFFLEdBQUcsRUFBRSxNQUFNLGFBQWEsQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQztRQUMxRCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sQ0FBQyxJQUFJLENBQ1QsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyx5R0FBeUcsRUFDdkksRUFBRSxLQUFLLEVBQUUsQ0FDVixDQUFDO1lBQ0YsT0FBTyxFQUFFLEdBQUcsRUFBRSxJQUFJLFVBQVUsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQztRQUNuRSxDQUFDO0lBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNMLE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUM7QUFFRCwrRUFBK0U7QUFDL0UsTUFBTSxVQUFVLGVBQWU7SUFDN0IsT0FBTyxHQUFHLFNBQVMsQ0FBQztBQUN0QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBUaGUgZ2F0ZSdzIEhTMjU2IHNlc3Npb24tc2lnbmluZyBrZXksIHBlcnNpc3RlZCBpbiBBcHBLaXQncyBjYWNoZS5cbiAqXG4gKiBUaGUga2V5IGRlY2lkZXMgd2hldGhlciBhIHNlc3Npb24gQ09PS0lFIHN0aWxsIHZlcmlmaWVzLiBCZWZvcmUgdGhpcyBtb2R1bGUgdGhlXG4gKiBmYWxsYmFjayB3YXMgYHJhbmRvbUJ5dGVzKDMyKWAgcGVyIHByb2Nlc3MsIHNvIGV2ZXJ5IHJlc3RhcnQgaW52YWxpZGF0ZWQgZXZlcnlcbiAqIG91dHN0YW5kaW5nIGNvb2tpZSBhbmQgZWFjaCBzaWduZWQtaW4gdXNlciBoYWQgdG8gcmVxdWVzdCBhIG5ldyBjb2RlIC0gcGFpbmZ1bFxuICogZm9yIGEgdHVubmVsLCB3aGljaCByZXN0YXJ0cyB3aGVuZXZlciB0aGUgYXBwIGl0IHdyYXBzIGRvZXMuIE5vdyB0aGUga2V5IGlzXG4gKiBzdG9yZWQgaW4gdGhlIGNhY2hlIEFwcEtpdCBhbHJlYWR5IGNvbmZpZ3VyZWQgKG1lbW9yeSwgb3IgTGFrZWJhc2Ugd2hlbiB0aGVcbiAqIGhvc3Qgd2lyZXMgYSBwZXJzaXN0ZW50IGBDYWNoZVN0b3JhZ2VgKSwgc28gd2l0aCBwZXJzaXN0ZW50IHN0b3JhZ2UgYSByZXN0YXJ0XG4gKiBrZWVwcyBzZXNzaW9ucyBhbGl2ZSBmb3Ige0BsaW5rIEtFWV9UVExfU0VDT05EU30uXG4gKlxuICogQW4gZXhwbGljaXRseSBjb25maWd1cmVkIGBUVU5ORUxfQVVUSF9KV1RfU0VDUkVUYCBzdGlsbCB3aW5zIG91dHJpZ2h0LiBUaGF0IGlzXG4gKiB0aGUgcmlnaHQgYW5zd2VyIGZvciBhIGZsZWV0OiBhbiBvcGVyYXRvci1oZWxkIHNlY3JldCBuZWVkcyBubyBzaGFyZWQgY2FjaGUgYW5kXG4gKiBubyBjb252ZXJnZW5jZSwgYW5kIGl0IHN1cnZpdmVzIGEgY2FjaGUgZmx1c2guXG4gKlxuICogIyMgZ2V0IC8gZ2VuZXJhdGUgLyBnZXRcbiAqXG4gKiBUd28gaW5zdGFuY2VzIGJvb3RpbmcgYXQgb25jZSBib3RoIG1pc3MsIHNvIGJvdGggd291bGQgZ2VuZXJhdGUgLSBhbmQgdGhlIGxvc2VyXG4gKiB3b3VsZCBzaWduIGNvb2tpZXMgd2l0aCBhIGtleSB0aGUgd2lubmVyIHJlamVjdHMuIFJlc29sdXRpb24gaXMgYSByZS1SRUFEIGFmdGVyXG4gKiB0aGUgd3JpdGU6IHdoYXRldmVyIHRoZSBjYWNoZSBob2xkcyBhZnRlcndhcmRzIGlzIHRoZSBrZXkgZXZlcnlvbmUgYWRvcHRzLCBzb1xuICogdGhlIGluc3RhbmNlcyBjb252ZXJnZSBvbiBPTkUgdmFsdWUgaW5zdGVhZCBvZiB0cnVzdGluZyB0aGUgb25lIHRoZXkgbWludGVkLlxuICogKGBzZXRgIGlzIG5vdCBjb25kaXRpb25hbCBpbiB0aGUgY2FjaGUgQVBJIC0gdGhlcmUgaXMgbm8gYHNldG54YCB0byBsZWFuIG9uIC1cbiAqIGFuZCB0aGlzIHJ1bnMgb25jZSBwZXIgcHJvY2Vzcywgc28gdGhlIGV4dHJhIHJvdW5kLXRyaXAgaXMgZnJlZS4pXG4gKlxuICogQSBwYXRob2xvZ2ljYWwgaW50ZXJsZWF2ZSBjYW4gc3RpbGwgY29zdCBhIGtleTogaWYgQSB3cml0ZXMgYmV0d2VlbiBCJ3Mgd3JpdGVcbiAqIGFuZCBCJ3MgcmUtcmVhZCwgQiBhZG9wdHMgQSdzIGtleSB3aGlsZSBBIGFkb3B0cyBpdHMgb3duLiBUaGUgY29zdCBpcyBib3VuZGVkIC1cbiAqIGEgY29va2llIG1pbnRlZCBpbiB0aGF0IHdpbmRvdyBmYWlscyB0byB2ZXJpZnkgYW5kIHRoZSBob2xkZXIgc2lnbnMgaW4gYWdhaW4gLVxuICogYW5kIGl0IGNhbm5vdCBwcm9kdWNlIGEga2V5IG9uZSBpbnN0YW5jZSBUUlVTVFMgYnV0IGFub3RoZXIgcmVqZWN0cyBmb3IgbG9uZ2VyXG4gKiB0aGFuIHRoZSB3aW5kb3cgaXRzZWxmLiBTZXQgYFRVTk5FTF9BVVRIX0pXVF9TRUNSRVRgIHRvIHJlbW92ZSB0aGUgcmFjZVxuICogZW50aXJlbHkuXG4gKlxuICogIyMgRm9yY2luZyBldmVyeSBzZXNzaW9uIHRvIGVuZFxuICpcbiAqIHtAbGluayByZXNvbHZlU2Vzc2lvbkN1dG9mZn0gcmVhZHMgYSBkYXRlIGZyb20gYFRVTk5FTF9BVVRIX1NFU1NJT05fQ1VUT0ZGYCAob3JcbiAqIGAtLXNlc3Npb24tY3V0b2ZmYCksIGFuZCB0aGF0IGRhdGUgaXMgcGFydCBvZiB0aGUgY2FjaGUgS0VZLiBNb3ZpbmcgaXQgZm9yd2FyZFxuICogbWFrZXMgZXZlcnkgcHJpb3Iga2V5IHVucmVhY2hhYmxlLCBzbyBldmVyeSBjb29raWUgc2lnbmVkIGFnYWluc3QgaXQgc3RvcHNcbiAqIHZlcmlmeWluZyAtIHRoZSBsb2ctZXZlcnlvbmUtb3V0IHN3aXRjaCwgd2l0aG91dCBoYXZpbmcgdG8gZmluZCBhbmQgZmx1c2ggYVxuICogY2FjaGUgZW50cnkuIFRoZSBjdXRvZmYgaXMgYWxzbyBhc3NlcnRlZCBhZ2FpbnN0IGVhY2ggdG9rZW4ncyBgaWF0YCwgc28gYVxuICogY29va2llIHRoYXQgcHJlZGF0ZXMgaXQgaXMgcmVmdXNlZCBldmVuIGlmIGl0IHdhcyBzaWduZWQgd2l0aCB0aGUga2V5IHRoYXQgaXNcbiAqIHNvbWVob3cgc3RpbGwgY3VycmVudC5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgcmFuZG9tQnl0ZXMgfSBmcm9tIFwibm9kZTpjcnlwdG9cIjtcbmltcG9ydCB7IENhY2hlTWFuYWdlciB9IGZyb20gXCJAZGF0YWJyaWNrcy9hcHBraXRcIjtcbmltcG9ydCB7IGVudiwgbG9nLCBvYmplY3QgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHsgSldUX1NFQ1JFVF9FTlYsIFNFU1NJT05fQ1VUT0ZGX0VOViB9IGZyb20gXCIuL2Vudi50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwidHVubmVsOnNpZ25pbmcta2V5XCIpO1xuXG4vKipcbiAqIEhvdyBsb25nIGEgY2FjaGVkIHNpZ25pbmcga2V5IGxpdmVzOiAzMCBkYXlzLlxuICpcbiAqIFRoaXMgaXMgdGhlIGNlaWxpbmcgb24gaG93IGxvbmcgYSBzZXNzaW9uIGNvb2tpZSBjYW4gc3RheSB2YWxpZCBhY3Jvc3NcbiAqIHJlc3RhcnRzLCBzbyBpdCBpcyBkZWxpYmVyYXRlbHkgPj0gdGhlIGRlZmF1bHQgc2Vzc2lvbiBUVEwgLSBhIGtleSB0aGF0IGV4cGlyZWRcbiAqIGJlZm9yZSB0aGUgY29va2llcyBpdCBzaWduZWQgd291bGQgbG9nIGV2ZXJ5b25lIG91dCBmb3Igbm8gcmVhc29uLlxuICovXG5leHBvcnQgY29uc3QgS0VZX1RUTF9TRUNPTkRTID0gMzAgKiAyNCAqIDYwICogNjA7XG5cbi8qKiBDYWNoZS1rZXkgcHJlZml4IGZvciB0aGUgc2lnbmluZyBrZXksIG5hbWVzcGFjZWQgYXdheSBmcm9tIG90aGVyIGNhY2hlIHVzZS4gKi9cbmNvbnN0IEtFWV9QUkVGSVggPSBcInR1bm5lbDphdXRoOnNpZ25pbmcta2V5OlwiO1xuXG4vKiogQnl0ZXMgb2YgZW50cm9weSBpbiBhIGdlbmVyYXRlZCBrZXkgKDI1Ni1iaXQsIG1hdGNoaW5nIEhTMjU2J3MgaGFzaCB3aWR0aCkuICovXG5jb25zdCBLRVlfQllURVMgPSAzMjtcblxuLyoqIFdoYXQgdGhlIGNhY2hlIHN0b3JlczogdGhlIGtleSBwbHVzIHdoZW4gaXQgd2FzIG1pbnRlZCwgZm9yIG9ic2VydmFiaWxpdHkuICovXG5pbnRlcmZhY2UgU3RvcmVkS2V5IHtcbiAgLyoqIEJhc2U2NHVybCBvZiB0aGUgcmF3IGtleSBieXRlcy4gKi9cbiAgc2VjcmV0OiBzdHJpbmc7XG4gIC8qKiBXaGVuIHRoaXMga2V5IHdhcyBnZW5lcmF0ZWQsIElTTy04NjAxLiAqL1xuICBjcmVhdGVkQXQ6IHN0cmluZztcbn1cblxuLyoqXG4gKiBSZXNvbHZlIHRoZSBmb3JjZS1jbGVhciBjdXRvZmYgYXMgZXBvY2ggTUlMTElTRUNPTkRTLCBvciBgMGAgd2hlbiB1bnNldC5cbiAqXG4gKiBBY2NlcHRzIHdoYXRldmVyIGBvYmplY3QudG9EYXRlYCBhY2NlcHRzIC0gYSBgRGF0ZWAsIGAyMDI2LTA4LTAyYCwgYW4gSVNPXG4gKiBpbnN0YW50LCBlcG9jaCBzZWNvbmRzIG9yIG1pbGxpcyBmcm9tIGBkYXRlICslc2AsIG9yIGEgcmVsYXRpdmUgZHVyYXRpb25cbiAqIChgLTMwZGAsIGA3IGRheXMgYWdvYCksIHdoaWNoIGlzIHRoZSBzcGVsbGluZyBhbiBvcGVyYXRvciByZWFjaGluZyBmb3IgdGhpc1xuICogdXN1YWxseSB3YW50czogc2lnbiBvdXQgZXZlcnlvbmUgd2hvIHNpZ25lZCBpbiBtb3JlIHRoYW4gYSBtb250aCBhZ28uXG4gKlxuICogQW4gVU5QQVJTRUFCTEUgdmFsdWUgaXMgaWdub3JlZCB3aXRoIGEgd2FybmluZyByYXRoZXIgdGhhbiB0aHJvd2luZzogdGhpcyBpc1xuICogdGhlIHN3aXRjaCB0aGF0IGxvZ3MgYSBmbGVldCBiYWNrIGluLCBhbmQgZmFpbGluZyB0byBib290IG92ZXIgYSB0eXBvIGlzIHdvcnNlXG4gKiB0aGFuIG5vdCByb3RhdGluZy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc29sdmVTZXNzaW9uQ3V0b2ZmKGNvbmZpZ3VyZWQ/OiBzdHJpbmcgfCBudW1iZXIgfCBEYXRlKTogbnVtYmVyIHtcbiAgY29uc3QgcmF3ID0gY29uZmlndXJlZCA/PyBlbnYudGV4dChTRVNTSU9OX0NVVE9GRl9FTlYpID8/IHVuZGVmaW5lZDtcbiAgaWYgKHJhdyA9PT0gdW5kZWZpbmVkIHx8IHJhdyA9PT0gbnVsbCB8fCByYXcgPT09IFwiXCIpIHJldHVybiAwO1xuXG4gIGNvbnN0IGRhdGUgPSBvYmplY3QudG9EYXRlKHJhdyk7XG4gIGlmICghZGF0ZSkge1xuICAgIGxvZ2dlci53YXJuKGBpZ25vcmluZyB1bnBhcnNlYWJsZSAke2Vudi5uYW1lKFNFU1NJT05fQ1VUT0ZGX0VOVil9YCwgeyB2YWx1ZTogU3RyaW5nKHJhdykgfSk7XG4gICAgcmV0dXJuIDA7XG4gIH1cbiAgcmV0dXJuIGNsYW1wVG9QYXN0KGRhdGUuZ2V0VGltZSgpKTtcbn1cblxuLyoqXG4gKiBIb2xkIHRoZSBjdXRvZmYgYXQgXCJub3dcIiwgYmVjYXVzZSBhIEZVVFVSRSBjdXRvZmYgd291bGQgcmVmdXNlIHRoZSBzZXNzaW9ucyBpdFxuICogaXMgYWJvdXQgdG8gbWludCBhcyB3ZWxsIGFzIHRoZSBvbGQgb25lcyAtIGFuIGFwcCBub2JvZHkgY2FuIHNpZ24gaW4gdG8sIGZyb20gYVxuICogbWlzdHlwZWQgeWVhciwgd2l0aCB0aGUgZml4IGhpZGRlbiBiZWhpbmQgdW5kZXJzdGFuZGluZyB0aGlzIGZsYWcuIENsYW1wZWQsIGFcbiAqIGZ1dHVyZSBkYXRlIG1lYW5zIHdoYXQgYW4gb3BlcmF0b3Igc2V0dGluZyBpdCBhbHdheXMgbWVhbnQ6IGNsZWFyIGV2ZXJ5dGhpbmdcbiAqIG91dHN0YW5kaW5nLCB0aGVuIGNhcnJ5IG9uLlxuICovXG5mdW5jdGlvbiBjbGFtcFRvUGFzdChjdXRvZmZNczogbnVtYmVyKTogbnVtYmVyIHtcbiAgY29uc3Qgbm93ID0gRGF0ZS5ub3coKTtcbiAgaWYgKGN1dG9mZk1zIDw9IG5vdykgcmV0dXJuIGN1dG9mZk1zO1xuICBsb2dnZXIud2FybihgJHtlbnYubmFtZShTRVNTSU9OX0NVVE9GRl9FTlYpfSBpcyBpbiB0aGUgZnV0dXJlIC0gY2xhbXBpbmcgdG8gbm93YCwge1xuICAgIGNvbmZpZ3VyZWQ6IG5ldyBEYXRlKGN1dG9mZk1zKS50b0lTT1N0cmluZygpLFxuICB9KTtcbiAgcmV0dXJuIG5vdztcbn1cblxuLyoqIFRoZSBjYWNoZSBrZXkgZm9yIG9uZSBjdXRvZmYsIHNvIG1vdmluZyB0aGUgY3V0b2ZmIG9ycGhhbnMgZXZlcnkgZWFybGllciBrZXkuICovXG5mdW5jdGlvbiBjYWNoZUtleShjdXRvZmZNczogbnVtYmVyKTogc3RyaW5nIHtcbiAgcmV0dXJuIGAke0tFWV9QUkVGSVh9JHtjdXRvZmZNc31gO1xufVxuXG5mdW5jdGlvbiBkZWNvZGUoc3RvcmVkOiBTdG9yZWRLZXkpOiBVaW50OEFycmF5IHtcbiAgcmV0dXJuIG5ldyBVaW50OEFycmF5KEJ1ZmZlci5mcm9tKHN0b3JlZC5zZWNyZXQsIFwiYmFzZTY0dXJsXCIpKTtcbn1cblxuLyoqXG4gKiBMb2FkIHRoZSBzaWduaW5nIGtleSBmb3IgYGN1dG9mZk1zYCBmcm9tIHRoZSBjYWNoZSwgbWludGluZyBhbmQgc3RvcmluZyBvbmVcbiAqIHdoZW4gYWJzZW50LiBTZWUgdGhlIG1vZHVsZSBkb2NzIGZvciB3aHkgdGhlIHdyaXRlIGlzIGZvbGxvd2VkIGJ5IGEgcmUtcmVhZC5cbiAqL1xuYXN5bmMgZnVuY3Rpb24gbG9hZEZyb21DYWNoZShjdXRvZmZNczogbnVtYmVyKTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gIGNvbnN0IGNhY2hlID0gQ2FjaGVNYW5hZ2VyLmdldEluc3RhbmNlU3luYygpO1xuICBjb25zdCBrZXkgPSBjYWNoZUtleShjdXRvZmZNcyk7XG5cbiAgY29uc3QgZXhpc3RpbmcgPSBhd2FpdCBjYWNoZS5nZXQ8U3RvcmVkS2V5PihrZXkpO1xuICBpZiAoZXhpc3Rpbmc/LnNlY3JldCkge1xuICAgIGxvZ2dlci5pbmZvKFwicmV1c2luZyBjYWNoZWQgc2lnbmluZyBrZXlcIiwgeyBjcmVhdGVkQXQ6IGV4aXN0aW5nLmNyZWF0ZWRBdCB9KTtcbiAgICByZXR1cm4gZGVjb2RlKGV4aXN0aW5nKTtcbiAgfVxuXG4gIGNvbnN0IG1pbnRlZDogU3RvcmVkS2V5ID0ge1xuICAgIHNlY3JldDogQnVmZmVyLmZyb20ocmFuZG9tQnl0ZXMoS0VZX0JZVEVTKSkudG9TdHJpbmcoXCJiYXNlNjR1cmxcIiksXG4gICAgY3JlYXRlZEF0OiBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCksXG4gIH07XG4gIGF3YWl0IGNhY2hlLnNldChrZXksIG1pbnRlZCwgeyB0dGw6IEtFWV9UVExfU0VDT05EUyB9KTtcblxuICAvLyBSZS1yZWFkIHJhdGhlciB0aGFuIHRydXN0aW5nIGBtaW50ZWRgOiBhbm90aGVyIGluc3RhbmNlIHRoYXQgcmFjZWQgdGhpcyBib290XG4gIC8vIG1heSBoYXZlIHdyaXR0ZW4gZmlyc3QsIGFuZCBhZG9wdGluZyB3aGF0ZXZlciBpcyBzdG9yZWQgaXMgd2hhdCBtYWtlcyB0aGUgdHdvXG4gIC8vIGNvbnZlcmdlIG9uIG9uZSBrZXkuXG4gIGNvbnN0IHNldHRsZWQgPSAoYXdhaXQgY2FjaGUuZ2V0PFN0b3JlZEtleT4oa2V5KSkgPz8gbWludGVkO1xuICBsb2dnZXIuaW5mbyhcInN0b3JlZCBhIG5ldyBzaWduaW5nIGtleVwiLCB7XG4gICAgY3JlYXRlZEF0OiBzZXR0bGVkLmNyZWF0ZWRBdCxcbiAgICB0dGxTZWNvbmRzOiBLRVlfVFRMX1NFQ09ORFMsXG4gICAgYWRvcHRlZDogc2V0dGxlZC5jcmVhdGVkQXQgPT09IG1pbnRlZC5jcmVhdGVkQXQgPyBcIm93blwiIDogXCJjb25jdXJyZW50LWluc3RhbmNlXCIsXG4gIH0pO1xuICByZXR1cm4gZGVjb2RlKHNldHRsZWQpO1xufVxuXG4vKiogQSByZXNvbHZlZCBrZXkgcGx1cyB0aGUgY3V0b2ZmIGl0IGlzIHNjb3BlZCB0by4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2lnbmluZ0tleSB7XG4gIGtleTogVWludDhBcnJheTtcbiAgLyoqIEZvcmNlLWNsZWFyIGN1dG9mZiBpbiBtczsgYDBgIHdoZW4gdW5zZXQuIFRva2VucyBvbGRlciB0aGFuIHRoaXMgYXJlIHJlZnVzZWQuICovXG4gIGN1dG9mZk1zOiBudW1iZXI7XG59XG5cbmxldCBwZW5kaW5nOiBQcm9taXNlPFNpZ25pbmdLZXk+IHwgdW5kZWZpbmVkO1xuXG4vKipcbiAqIFRoZSBzaWduaW5nIGtleSBmb3IgdGhpcyBnYXRlLCByZXNvbHZlZCBvbmNlIHBlciBwcm9jZXNzLlxuICpcbiAqIFJlc29sdmVkIE9OQ0UsIHNvIGBjb25maWd1cmVkQ3V0b2ZmYCBpcyBob25vdXJlZCBvbmx5IG9uIHRoZSBmaXJzdCBjYWxsIC0gdGhlXG4gKiBwbHVnaW4ncyBgc2V0dXAoKWAgcGFzc2VzIGl0cyByZXNvbHZlZCB2YWx1ZSB0aGVyZSwgYmVmb3JlIGFueSByZXF1ZXN0IGNhblxuICogcmVhY2ggdGhlIGxhenkgcGF0aC5cbiAqXG4gKiBgVFVOTkVMX0FVVEhfSldUX1NFQ1JFVGAgd2hlbiBzZXQsIGVsc2UgdGhlIGNhY2hlLWJhY2tlZCBrZXkuIEEgY2FjaGUgdGhhdCBpc1xuICogdW5hdmFpbGFibGUgZGVncmFkZXMgdG8gYW4gZXBoZW1lcmFsIHBlci1wcm9jZXNzIGtleSAodGhlIHByZXZpb3VzIGJlaGF2aW91cilcbiAqIHJhdGhlciB0aGFuIHJlZnVzaW5nIHRvIHNpZ246IHRoZSBrZXkgb25seSB2YWxpZGF0ZXMgYW4gQUxSRUFEWS1pc3N1ZWQgc2Vzc2lvbixcbiAqIHNvIGxvc2luZyBpdCBjb3N0cyBzZXNzaW9ucywgbmV2ZXIgYWRtaXNzaW9uIC0gYSBjYWxsZXIgc3RpbGwgbmVlZHMgYSBjb2RlXG4gKiBkZWxpdmVyZWQgdG8gYW4gYWxsb3ctbGlzdGVkIGFkZHJlc3MuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzaWduaW5nS2V5KGNvbmZpZ3VyZWRDdXRvZmY/OiBzdHJpbmcgfCBudW1iZXIgfCBEYXRlKTogUHJvbWlzZTxTaWduaW5nS2V5PiB7XG4gIHBlbmRpbmcgPz89IChhc3luYyAoKSA9PiB7XG4gICAgY29uc3QgY3V0b2ZmTXMgPSByZXNvbHZlU2Vzc2lvbkN1dG9mZihjb25maWd1cmVkQ3V0b2ZmKTtcbiAgICBjb25zdCBjb25maWd1cmVkID0gZW52LnRleHQoSldUX1NFQ1JFVF9FTlYpO1xuICAgIGlmIChjb25maWd1cmVkKSB7XG4gICAgICByZXR1cm4geyBrZXk6IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShjb25maWd1cmVkKSwgY3V0b2ZmTXMgfTtcbiAgICB9XG4gICAgdHJ5IHtcbiAgICAgIHJldHVybiB7IGtleTogYXdhaXQgbG9hZEZyb21DYWNoZShjdXRvZmZNcyksIGN1dG9mZk1zIH07XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIGxvZ2dlci53YXJuKFxuICAgICAgICBgbm8gJHtlbnYubmFtZShKV1RfU0VDUkVUX0VOVil9IGFuZCB0aGUgY2FjaGUgaXMgdW5hdmFpbGFibGUgLSB1c2luZyBhbiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5OyBzZXNzaW9ucyB3aWxsIG5vdCBzdXJ2aXZlIGEgcmVzdGFydGAsXG4gICAgICAgIHsgZXJyb3IgfSxcbiAgICAgICk7XG4gICAgICByZXR1cm4geyBrZXk6IG5ldyBVaW50OEFycmF5KHJhbmRvbUJ5dGVzKEtFWV9CWVRFUykpLCBjdXRvZmZNcyB9O1xuICAgIH1cbiAgfSkoKTtcbiAgcmV0dXJuIHBlbmRpbmc7XG59XG5cbi8qKiBSZXNldCB0aGUgcGVyLXByb2Nlc3Mga2V5ICh0ZXN0cywgb3IgYWZ0ZXIgY2hhbmdpbmcgdGhlIGVudiBpbi1wcm9jZXNzKS4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNldFNpZ25pbmdLZXkoKTogdm9pZCB7XG4gIHBlbmRpbmcgPSB1bmRlZmluZWQ7XG59XG4iXX0=

package/package.json

@@ -29,11 +29,11 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@databricks/appkit": "^0.43.0",
-    "@dbx-tools/appkit": "0.6.51",
-    "@dbx-tools/core": "0.6.51",
-    "@dbx-tools/email": "0.6.51",
-    "@dbx-tools/shared-core": "0.6.51",
-    "@dbx-tools/shared-email": "0.6.51",
+    "@dbx-tools/appkit": "0.6.52",
+    "@dbx-tools/core": "0.6.52",
+    "@dbx-tools/email": "0.6.52",
+    "@dbx-tools/shared-core": "0.6.52",
+    "@dbx-tools/shared-email": "0.6.52",
     "commander": "^15.0.0",
     "http-proxy-3": "^1.23.3",
     "jose": "^6.2.3"
@@ -100,7 +100,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.6.51",
+  "version": "0.6.52",
   "types": "./lib/index.d.ts",
   "type": "module",
   "exports": {

package/src/cli.ts

@@ -52,7 +52,7 @@ interface TunnelOpts {
   message?: string;
   sessionTtl?: string;
   codeTtl?: string;
-  sessionEpoch?: string;
+  sessionCutoff?: string;
   insecure?: boolean;
   forwardHeaders?: string;
 }
@@ -77,8 +77,8 @@ function program(): Command {
     .option("--session-ttl <seconds>", "Session lifetime (env TUNNEL_AUTH_SESSION_TTL)")
     .option("--code-ttl <seconds>", "One-time-code lifetime (env TUNNEL_AUTH_CODE_TTL)")
     .option(
-      "--session-epoch <date>",
-      "Invalidate sessions issued before this date, signing everyone out: a date, ISO timestamp, or epoch seconds (env TUNNEL_AUTH_SESSION_EPOCH)",
+      "--session-cutoff <when>",
+      "Invalidate sessions issued before this point, signing everyone out: a date, ISO instant, epoch seconds, or relative duration like -30d (env TUNNEL_AUTH_SESSION_CUTOFF)",
     )
     .option(
       "--forward-headers <patterns>",
@@ -140,7 +140,7 @@ export async function runCli(argv: string[]): Promise<void> {
     message: opts.message,
     sessionTtlSeconds: opts.sessionTtl ? Number(opts.sessionTtl) : undefined,
     codeTtlSeconds: opts.codeTtl ? Number(opts.codeTtl) : undefined,
-    sessionEpoch: opts.sessionEpoch,
+    sessionCutoff: opts.sessionCutoff,
   };
 
   // 1. Spawn the wrapped app with the PRIVATE port. It binds loopback; only the

package/src/env.ts

@@ -53,10 +53,14 @@ export const CODE_TTL_ENV: EnvKey = ["TUNNEL_AUTH_CODE_TTL", "AUTH_CODE_TTL"];
 export const JWT_SECRET_ENV: EnvKey = ["TUNNEL_AUTH_JWT_SECRET", "AUTH_JWT_SECRET"];
 
 /**
- * Force-clear date for sessions issued before it: every earlier cookie stops
- * verifying. Any `Date`-parseable value, or bare epoch seconds / millis.
+ * Force-clear cutoff: every session issued BEFORE it stops verifying. Anything
+ * `object.toDate` accepts - a date, an ISO instant, epoch seconds/millis, or a
+ * relative duration (`-30d`, `7 days ago`).
  */
-export const SESSION_EPOCH_ENV: EnvKey = "TUNNEL_AUTH_SESSION_EPOCH";
+export const SESSION_CUTOFF_ENV: EnvKey = [
+  "TUNNEL_AUTH_SESSION_CUTOFF",
+  "TUNNEL_AUTH_SESSION_EPOCH",
+];
 
 /** The public `<subdomain>.<server>` portr should serve on. */
 export const PUBLIC_DOMAIN_ENV: EnvKey = ["TUNNEL_PUBLIC_DOMAIN", "PUBLIC_DOMAIN"];

package/src/otp.ts

@@ -12,8 +12,8 @@
  * signing key is resolved by `./signing-key.ts`: `TUNNEL_AUTH_JWT_SECRET` when
  * set, else a key persisted in the cache for 30 days so cookies survive the
  * restarts a tunnel sees whenever the app it wraps reloads. A cookie signed
- * before `TUNNEL_AUTH_SESSION_EPOCH` is refused here as well as being orphaned by
- * the cache key, so the force-clear switch holds even for a still-current key.
+ * before `TUNNEL_AUTH_SESSION_CUTOFF` is refused here as well as being orphaned
+ * by the cache key, so the force-clear switch holds even for a still-current key.
  *
  * @module
  */
@@ -118,16 +118,16 @@ export async function signSession(email: string, ttlSeconds: number): Promise<st
 export async function verifySession(token: string | undefined): Promise<string | undefined> {
   if (!token) return undefined;
   try {
-    const { key, epochMs } = await signingKey();
+    const { key, cutoffMs } = await signingKey();
     const { payload } = await jwtVerify(token, key, { audience: JWT_AUD });
-    // Belt and braces with the epoch-scoped cache key: that alone already
-    // orphans older keys, but an operator who moved the epoch while
+    // Belt and braces with the cutoff-scoped cache key: that alone already
+    // orphans older keys, but an operator who moved the cutoff while
     // TUNNEL_AUTH_JWT_SECRET is set has no key rotation to rely on, and this
     // check is what makes the switch work in that case too.
     // Compared in whole SECONDS because `iat` has no finer resolution: against a
-    // millisecond epoch, a cookie minted in the same second as the cutoff would
-    // be refused depending on sub-second rounding.
-    if (epochMs > 0 && (payload.iat === undefined || payload.iat < Math.floor(epochMs / 1000))) {
+    // millisecond cutoff, a cookie minted in the same second as it would be
+    // refused depending on sub-second rounding.
+    if (cutoffMs > 0 && (payload.iat === undefined || payload.iat < Math.floor(cutoffMs / 1000))) {
       return undefined;
     }
     return typeof payload.email === "string" ? payload.email : undefined;

package/src/plugin.ts

@@ -17,7 +17,7 @@
  */
 
 import { Plugin, toPlugin, type BasePluginConfig, type PluginManifest } from "@databricks/appkit";
-import { brand, env, log, string } from "@dbx-tools/shared-core";
+import { brand, env, log, object, string } from "@dbx-tools/shared-core";
 import type { AuthStatus } from "@dbx-tools/shared-email";
 import { looksLikeEmail, matchesAllowlist } from "./allowlist.ts";
 import {
@@ -30,7 +30,7 @@ import {
 } from "./env.ts";
 import { CodeStore, signSession, verifySession } from "./otp.ts";
 import { RateLimiter } from "./rate-limit.ts";
-import { KEY_TTL_SECONDS, resolveSessionEpoch, signingKey } from "./signing-key.ts";
+import { KEY_TTL_SECONDS, resolveSessionCutoff, signingKey } from "./signing-key.ts";
 
 const logger = log.logger("tunnel:auth");
 
@@ -76,13 +76,14 @@ export interface AuthGateConfig extends BasePluginConfig {
   /** Max verify attempts per issued code. Default 5. */
   maxAttempts?: number;
   /**
-   * Force-clear date: every session issued BEFORE it stops verifying, so moving
-   * it forward signs everyone out. Env TUNNEL_AUTH_SESSION_EPOCH.
+   * Force-clear cutoff: every session issued BEFORE it stops verifying, so moving
+   * it forward signs everyone out. Env TUNNEL_AUTH_SESSION_CUTOFF.
    *
-   * Any `Date`-parseable value (`2026-08-02`, an ISO timestamp) or bare epoch
-   * seconds / millis. Unset means no cutoff.
+   * Anything `object.toDate` accepts: a `Date`, `2026-08-02`, an ISO instant,
+   * epoch seconds/millis, or a relative duration (`-30d`, `7 days ago`). Unset
+   * means no cutoff.
    */
-  sessionEpoch?: string | number | Date;
+  sessionCutoff?: string | number | Date;
   /** Deliver a code to an address. Wired by the app to the email plugin. */
   sendCode?: (email: string, code: string, opts: SendCodeOptions) => Promise<void>;
 }
@@ -111,7 +112,7 @@ export interface ResolvedAuthGateConfig {
   codeTtlSeconds: number;
   maxAttempts: number;
   /** Force-clear cutoff in epoch ms; `0` when unset. */
-  sessionEpochMs: number;
+  sessionCutoffMs: number;
 }
 
 const DEFAULTS = {
@@ -148,7 +149,7 @@ export function resolveAuthGateConfig(config: AuthGateConfig): ResolvedAuthGateC
     ),
     codeTtlSeconds: env.positiveInt(config.codeTtlSeconds, CODE_TTL_ENV, DEFAULTS.codeTtlSeconds),
     maxAttempts: config.maxAttempts ?? DEFAULTS.maxAttempts,
-    sessionEpochMs: resolveSessionEpoch(config.sessionEpoch),
+    sessionCutoffMs: resolveSessionCutoff(config.sessionCutoff),
   };
 }
 
@@ -193,11 +194,11 @@ export class AuthGatePlugin extends Plugin<AuthGateConfig> {
     // Resolve the signing key HERE rather than lazily on the first sign-in, so a
     // cache that cannot hold it (and the resulting "sessions won't survive a
     // restart" warning) shows up in the startup log, not hours later.
-    const { epochMs } = await signingKey(this.resolved.sessionEpochMs);
+    const { cutoffMs } = await signingKey(this.resolved.sessionCutoffMs);
     logger.info("ready", {
       patterns: this.resolved.allow.length,
       sessionTtlSeconds: this.resolved.sessionTtlSeconds,
-      ...(epochMs > 0 ? { sessionEpoch: new Date(epochMs).toISOString() } : {}),
+      ...object.optional("sessionCutoff", cutoffMs > 0 ? new Date(cutoffMs).toISOString() : null),
     });
   }