@dbx-tools/cli-tunnel 0.6.58 → 0.6.85

package/lib/src/app.js

@@ -1,268 +1,30 @@
 /**
- * The tunnel gate's tiny AppKit "app" - `createApp` WITHOUT a `server()` plugin.
+ * The GATE half of the wrapper: a server-less AppKit app whose only job is to
+ * expose the `authGate` handlers the proxy calls.
  *
- * There is no HTTP server here: the tunnel proxy is the server, and it calls the
- * gate handlers in-process. `createApp` is used only for what it auto-wires:
- *   - `CacheManager` (Lakebase when this process can reach it, else memory) -
- *     which the OTP `CodeStore` and the session signing key use for storage + TTL
- *     eviction;
- *   - the `email()` transport (SMTP / outbox), primed from env, so `sendCode` can
- *     deliver the one-time code;
- *   - dbx-tools auto-configuration + branding via `@dbx-tools/appkit`.
+ * The in-process plugin path (`authGate` in the app's own `plugins`) has a real
+ * HTTP server to mount routes on. A wrapper does not - the app it fronts is a
+ * separate process it must not reach into - so the gate's login routes live on
+ * the proxy instead, and this app exists purely to give the plugin the runtime it
+ * needs: a `CacheManager` for the one-time-code store and signing key, and the
+ * sibling `email` plugin's transport for delivering a code.
  *
- * It returns the {@link AuthGateApi} the proxy drives. `sendCode` is wired here
- * (the plugin can't resolve HOW to send on its own) to the email plugin's
- * transport. A sign-in code is SYSTEM mail - no on-behalf-of user asked for it
- * and no reply to it reaches anyone - so it sends from the email config's
- * do-not-reply address (`no-reply@EMAIL_DOMAIN` unless EMAIL_SYSTEM_FROM names
- * another).
- *
- * FAIL FAST: a gate that can't email a code is useless, so if email does not
- * resolve to SMTP mode (real delivery), this throws - unless `insecure` is set
- * (`--insecure` / `TUNNEL_INSECURE=true`), in which case the caller runs the
- * tunnel OPEN with no gate.
+ * Lazily imported by `cli.ts`, so `dbx tunnel --insecure` (and `install` /
+ * `status`) never load AppKit, the Databricks SDK, or the SMTP stack.
  *
  * @module
  */
-import { getUsernameWithApiLookup } from "@databricks/appkit";
-import { createApp as createAppNs, lakebaseResolver } from "@dbx-tools/appkit";
-import { brand as nodeBrand } from "@dbx-tools/core";
-import { brand as emailBrand, email, sender, transport } from "@dbx-tools/email";
-import { env, log, string } from "@dbx-tools/shared-core";
-import { authGate } from "./plugin.js";
-const logger = log.logger("tunnel:app");
-/**
- * A code TTL as the plain phrase the email states ("10 minutes", "45 seconds").
- *
- * Whole minutes read as minutes; anything else stays in seconds rather than
- * rounding, so a 90-second TTL is not advertised as "1 minute" and a recipient is
- * never told the code lives longer than it does.
- */
-export function expiresIn(seconds) {
-    return seconds >= 60 && seconds % 60 === 0
-        ? string.pluralize(seconds / 60, "minute")
-        : string.pluralize(seconds, "second");
-}
-/** The reassurance line closing both parts. */
-const IGNORE_LINE = "If you did not request this code, you can ignore this email.";
-/**
- * The HTML part's source: the full branded template, with the code as a large
- * styled heading (`## ` is what makes it prominent in an inbox).
- */
-export function codeEmailHtmlBody(code, opts) {
-    return [
-        opts.message,
-        "",
-        `## ${code}`,
-        "",
-        `This code expires in ${expiresIn(opts.codeTtlSeconds)}.`,
-        "",
-        IGNORE_LINE,
-    ].join("\n");
-}
-/**
- * The `text/plain` part, supplied EXPLICITLY rather than rendered from the tree
- * above. Both parts say the same thing; only the line layout differs.
- *
- * The prompt and the code share ONE line ("Your verification code is: 123456").
- * That single-line shape is what iOS, Gmail, Outlook, and Android code detection
- * keys on most reliably - the heuristics look for a code in the same sentence as
- * a recognized prompt, so splitting them across lines makes detection dependent
- * on the client, and any blank line between them defeats it outright.
- *
- * The GENERATED text part cannot hold that shape at all: it is a rendering of the
- * HTML, so it carries the brand header/footer and turns the code heading's CSS
- * margin into blank lines, arriving as `prompt\n\n\ncode`.
- *
- * The code is visible text in BOTH parts, never an image, so a client scraping
- * either one finds it. No trailer line follows the copy - Apple's domain-bound
- * `@domain #code` footer is deliberately NOT emitted, since it constrains the
- * code to one origin and is not what the broadly-compatible shape needs.
- */
-export function codeEmailTextBody(code, opts) {
-    return [
-        `${opts.message} ${code}`,
-        `This code expires in ${expiresIn(opts.codeTtlSeconds)}.`,
-        "",
-        IGNORE_LINE,
-    ].join("\n");
-}
-/**
- * The SUBJECT line, with the code in it: `"123456 is your verification code"`.
- *
- * The code has to be here, not only in the body, because of what mobile autofill
- * actually reads. iOS offers a code from an incoming NOTIFICATION - natively for
- * Messages and Mail, and since iOS 26 for any app's notification text, which is
- * what finally made Gmail work - and a notification contains the sender, the
- * subject, and a short snippet. Nothing else. A code that lives in the body is
- * invisible to it, however cleanly the body is formatted, which is why a perfectly
- * shaped `text/plain` part still produced no autofill prompt in Gmail.
- *
- * `<code> is your <thing>` rather than `<thing>: <code>` because the leading code
- * survives TRUNCATION: a notification and an inbox list both cut the subject, and
- * the platform heuristics want the code in the same sentence as a recognized
- * prompt ("code", "verification"). Putting it first keeps both intact no matter
- * where the cut lands.
- *
- * `subject` is the configured line ("Your verification code"), lower-cased at its
- * first word so the sentence reads naturally, and left ALONE when it does not look
- * like the conventional phrasing - an operator who set a deliberate subject gets
- * theirs with the code prefixed, not a mangled hybrid.
- */
-export function codeEmailSubject(code, subject) {
-    const trimmed = subject.trim();
-    const conventional = /^your\s+/i.exec(trimmed);
-    const rest = conventional ? trimmed.slice(conventional[0].length) : trimmed;
-    return conventional ? `${code} is your ${rest}` : `${code} - ${trimmed}`;
-}
-/**
- * The PREHEADER: the snippet beside the subject in an inbox list, and the body of
- * the push notification. Carries the code for the same reason the subject does -
- * it is the other half of what a notification shows - and repeats the prompt
- * wording so a heuristic scanning the snippet alone finds a code next to a phrase
- * it recognizes.
- */
-export function codeEmailPreview(code, opts) {
-    return `${opts.message} ${code}`;
-}
-const { createApp } = createAppNs;
-const { applyLakebaseToEnv, resolveLakebaseConnection } = lakebaseResolver;
-const { resolveSystemSenderAddress } = sender;
-const { getEmailRuntime, sendEmail } = transport;
-const { emailBrandFromContext } = emailBrand;
-const { loadBrandContext } = nodeBrand;
-/**
- * Env vars whose presence means a Lakebase database was bound to this deployment.
- * `LAKEBASE_ENDPOINT` is what a Databricks App `postgres` resource binding sets;
- * `PGHOST` is the local/manual spelling.
- */
-const LAKEBASE_ENV = ["LAKEBASE_ENDPOINT", "PGHOST"];
-/**
- * Upper bound on resolving the Lakebase connection. The gate is in the request
- * path for every visitor, so a slow workspace API must not hold up boot
- * indefinitely; a memory cache is a degraded gate, an unbooted one is no gate.
- */
-const LAKEBASE_RESOLVE_TIMEOUT_MS = 60_000;
-/**
- * Fill in the Lakebase connection env AppKit's cache needs, so `CacheManager`
- * chooses PERSISTENT storage instead of memory.
- *
- * This is what makes the gate's session signing key and outstanding one-time
- * codes survive a restart, and it has to be done explicitly here. AppKit picks
- * Lakebase for the cache only when `createLakebasePool()` succeeds, and that pool
- * reads FOUR things off `process.env`: `LAKEBASE_ENDPOINT`, `PGHOST`,
- * `PGDATABASE`, and a username (`PGUSER`, or `DATABRICKS_CLIENT_ID` for a service
- * principal). A Databricks App `postgres` resource binding supplies only
- * `LAKEBASE_ENDPOINT`. The resolver turns that one value into the host and
- * database; the username is looked up separately, because missing it fails pool
- * construction just as hard as a missing host - and it is what a LOCAL run (a
- * developer on a PAT, with no `DATABRICKS_CLIENT_ID`) is always missing. Without
- * all four the pool cannot be built, the cache silently degrades to in-memory, and
- * every redeploy signs out every user (the exact symptom this exists to prevent).
- *
- * `@dbx-tools/appkit`'s `createApp` would normally do this via `autoConfigure`,
- * but it gates that on a `lakebase()` plugin being registered - and this app
- * registers none, because it has no server to mount Lakebase routes on. Calling
- * the resolver directly also lets the gate be stricter than `autoConfigure` is:
- *
- *   - It runs ONLY when a Lakebase env var is present. A tunnel is a wrapper
- *     around someone else's app and must not invent infrastructure, so with
- *     nothing bound it skips rather than falling through the resolver's
- *     list-or-CREATE-a-project path.
- *   - `autoCreate: false` for the same reason, in case a project happens to exist.
- *   - Every failure is a WARNING, never a throw. The cache is an optimization for
- *     session durability; admission still requires a code delivered to an
- *     allow-listed address, so a gate with a memory cache is safe, just forgetful.
- */
-export async function resolveCacheStorageEnv() {
-    if (!env.text(LAKEBASE_ENV)) {
-        logger.info(`no ${env.name(LAKEBASE_ENV)} - the gate cache stays in memory; sessions and codes will not survive a restart`);
-        return false;
-    }
-    try {
-        const resolved = await resolveLakebaseConnection({ autoCreate: false }, AbortSignal.timeout(LAKEBASE_RESOLVE_TIMEOUT_MS));
-        applyLakebaseToEnv(resolved);
-        // `??=` so an explicitly configured PGUSER stays authoritative. The lookup
-        // falls back to the workspace API and returns undefined rather than throwing,
-        // so a failure here just leaves the pool to find its own username.
-        const user = await getUsernameWithApiLookup({});
-        if (user)
-            process.env.PGUSER ??= user;
-        logger.info("lakebase resolved for the gate cache", {
-            host: resolved.host,
-            database: resolved.database,
-            endpoint: resolved.endpoint,
-            user: process.env.PGUSER,
-        });
-        return true;
-    }
-    catch (error) {
-        logger.warn("could not resolve lakebase - the gate cache stays in memory; sessions and codes will not survive a restart", { error });
-        return false;
-    }
-}
-/**
- * Boot the gate app and return the API the proxy calls. Throws when email is not
- * in SMTP mode (no way to deliver a code) so a misconfigured gate fails fast at
- * startup rather than silently accepting nobody; the caller may catch this and
- * fall back to insecure/open mode when the operator opted in.
- */
+import { appkit } from "@dbx-tools/appkit";
+import { email } from "@dbx-tools/email";
+import { authGate } from "@dbx-tools/tunnel";
+/** Boot the gate app and return the handlers the proxy authenticates against. */
 export async function startGateApp(config) {
-    // The host app's own brand (`branding/brand.yaml` discovered from cwd) or the
-    // dbx-tools default. This is the ONE brand source for the gate: it styles the
-    // code email (accent band, font, logo) via the email plugin AND supplies the
-    // display name the copy uses, so a deployment that themes its app themes its
-    // sign-in email with it. An explicit `brandName` still wins (see below).
-    const context = await loadBrandContext();
-    // Before `createApp`, because AppKit resolves the cache's storage during it and
-    // reads the connection out of `process.env` when it does. See the function's
-    // docs for why the gate resolves this itself.
-    await resolveCacheStorageEnv();
-    // `sendCode` delivers the OTP through the email plugin's SHARED transport, which
-    // the `email()` plugin primes during its `setup()` (awaited by `createApp`
-    // below). Using the module-level `sendEmail` avoids a circular dependency on the
-    // app handle's inferred type. The `From` is the SYSTEM sender: a verification
-    // code is machine-generated and unanswerable, so it must not arrive from a
-    // person's address inviting a reply.
-    const sendCode = async (to, code, opts) => {
-        const from = resolveSystemSenderAddress(getEmailRuntime().config);
-        await sendEmail({
-            to: [to],
-            // The code rides in the SUBJECT and the preheader, not just the body:
-            // those two strings are the whole of a push notification, and a
-            // notification is what mobile autofill reads. See `codeEmailSubject`.
-            subject: codeEmailSubject(code, opts.subject),
-            body: codeEmailHtmlBody(code, opts),
-        }, from, undefined, { text: codeEmailTextBody(code, opts), preview: codeEmailPreview(code, opts) });
-    };
-    // `createApp` namespaces each plugin's exports on the handle by manifest name;
-    // `handle.authGate` is the in-process gate API the proxy drives.
-    //
-    // `autoConfigure: false` because {@link resolveCacheStorageEnv} above already
-    // did the one piece of it this app wants, on this app's terms.
-    const handle = await createApp({
-        autoConfigure: false,
-        plugins: [
-            // Brand the code email from the resolved context, the same bridge every
-            // other dbx-tools email surface uses (accent + font inlined, logo only when
-            // it is a fetchable URL - a package-export path cannot load in an inbox).
-            email({ brand: emailBrandFromContext(context) }),
-            // `brandName` falls back to the resolved context's display name, so the
-            // email copy names the app rather than a generic placeholder. Spelled as an
-            // explicit `??` rather than a key before `...config`: commander sets
-            // `brandName` on the options object whether or not the flag was passed, so
-            // spreading it would clobber the context name with `undefined`.
-            authGate({ ...config, brandName: config.brandName ?? context.name, sendCode }),
-        ],
-    });
-    // Fail fast: the gate needs SMTP to email codes. `getEmailRuntime()` resolves to
-    // `mode: "file"` (outbox) or throws when no SMTP creds are configured - neither
-    // can deliver to a real inbox, so refuse to bring up a gate that lets nobody in.
-    if (getEmailRuntime().config.mode !== "smtp") {
-        throw new Error("email is not configured for SMTP delivery - the OTP gate cannot send codes. " +
-            "Set SMTP_HOST/SMTP_USER/SMTP_PASSWORD, or pass --insecure / TUNNEL_INSECURE=true to run the tunnel open.");
-    }
-    logger.info("gate app ready (no server; proxy-driven)");
-    return handle.authGate;
+    // No `server()` plugin: nothing here listens. `plugins` order matters - `email`
+    // registers its transport before `authGate` looks for a sibling to send with.
+    const plugins = await appkit.createApp({ plugins: [email(), authGate(config)] });
+    const api = plugins.authGate;
+    if (!api)
+        throw new Error("the authGate plugin exposed no api");
+    return api;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXlCRztBQUVILE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzlELE9BQU8sRUFBRSxTQUFTLElBQUksV0FBVyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDL0UsT0FBTyxFQUFFLEtBQUssSUFBSSxTQUFTLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUsS0FBSyxJQUFJLFVBQVUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ2pGLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzFELE9BQU8sRUFBRSxRQUFRLEVBQStELE1BQU0sYUFBYSxDQUFDO0FBRXBHLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7QUFFeEM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLFNBQVMsQ0FBQyxPQUFlO0lBQ3ZDLE9BQU8sT0FBTyxJQUFJLEVBQUUsSUFBSSxPQUFPLEdBQUcsRUFBRSxLQUFLLENBQUM7UUFDeEMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxHQUFHLEVBQUUsRUFBRSxRQUFRLENBQUM7UUFDMUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0FBQzFDLENBQUM7QUFLRCwrQ0FBK0M7QUFDL0MsTUFBTSxXQUFXLEdBQUcsOERBQThELENBQUM7QUFFbkY7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGlCQUFpQixDQUFDLElBQVksRUFBRSxJQUFjO0lBQzVELE9BQU87UUFDTCxJQUFJLENBQUMsT0FBTztRQUNaLEVBQUU7UUFDRixNQUFNLElBQUksRUFBRTtRQUNaLEVBQUU7UUFDRix3QkFBd0IsU0FBUyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRztRQUN6RCxFQUFFO1FBQ0YsV0FBVztLQUNaLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ2YsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSCxNQUFNLFVBQVUsaUJBQWlCLENBQUMsSUFBWSxFQUFFLElBQWM7SUFDNUQsT0FBTztRQUNMLEdBQUcsSUFBSSxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUU7UUFDekIsd0JBQXdCLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUc7UUFDekQsRUFBRTtRQUNGLFdBQVc7S0FDWixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUNmLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBcUJHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLElBQVksRUFBRSxPQUFlO0lBQzVELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMvQixNQUFNLFlBQVksR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQy9DLE1BQU0sSUFBSSxHQUFHLFlBQVksQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztJQUM1RSxPQUFPLFlBQVksQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLFlBQVksSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxNQUFNLE9BQU8sRUFBRSxDQUFDO0FBQzNFLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLFVBQVUsZ0JBQWdCLENBQUMsSUFBWSxFQUFFLElBQWM7SUFDM0QsT0FBTyxHQUFHLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxFQUFFLENBQUM7QUFDbkMsQ0FBQztBQUVELE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxXQUFXLENBQUM7QUFDbEMsTUFBTSxFQUFFLGtCQUFrQixFQUFFLHlCQUF5QixFQUFFLEdBQUcsZ0JBQWdCLENBQUM7QUFDM0UsTUFBTSxFQUFFLDBCQUEwQixFQUFFLEdBQUcsTUFBTSxDQUFDO0FBQzlDLE1BQU0sRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUFFLEdBQUcsU0FBUyxDQUFDO0FBQ2pELE1BQU0sRUFBRSxxQkFBcUIsRUFBRSxHQUFHLFVBQVUsQ0FBQztBQUM3QyxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxTQUFTLENBQUM7QUFFdkM7Ozs7R0FJRztBQUNILE1BQU0sWUFBWSxHQUFHLENBQUMsbUJBQW1CLEVBQUUsUUFBUSxDQUFVLENBQUM7QUFFOUQ7Ozs7R0FJRztBQUNILE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDO0FBRTNDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0E4Qkc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLHNCQUFzQjtJQUMxQyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzVCLE1BQU0sQ0FBQyxJQUFJLENBQ1QsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxrRkFBa0YsQ0FDL0csQ0FBQztRQUNGLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0seUJBQXlCLENBQzlDLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxFQUNyQixXQUFXLENBQUMsT0FBTyxDQUFDLDJCQUEyQixDQUFDLENBQ2pELENBQUM7UUFDRixrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM3QiwyRUFBMkU7UUFDM0UsOEVBQThFO1FBQzlFLG1FQUFtRTtRQUNuRSxNQUFNLElBQUksR0FBRyxNQUFNLHdCQUF3QixDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ2hELElBQUksSUFBSTtZQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQztRQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLHNDQUFzQyxFQUFFO1lBQ2xELElBQUksRUFBRSxRQUFRLENBQUMsSUFBSTtZQUNuQixRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7WUFDM0IsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO1lBQzNCLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU07U0FDekIsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sQ0FBQyxJQUFJLENBQ1QsNEdBQTRHLEVBQzVHLEVBQUUsS0FBSyxFQUFFLENBQ1YsQ0FBQztRQUNGLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsWUFBWSxDQUFDLE1BQXNCO0lBQ3ZELDhFQUE4RTtJQUM5RSw4RUFBOEU7SUFDOUUsNkVBQTZFO0lBQzdFLDZFQUE2RTtJQUM3RSx5RUFBeUU7SUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxnQkFBZ0IsRUFBRSxDQUFDO0lBRXpDLGdGQUFnRjtJQUNoRiw2RUFBNkU7SUFDN0UsOENBQThDO0lBQzlDLE1BQU0sc0JBQXNCLEVBQUUsQ0FBQztJQUUvQixpRkFBaUY7SUFDakYsMkVBQTJFO0lBQzNFLGlGQUFpRjtJQUNqRiw4RUFBOEU7SUFDOUUsMkVBQTJFO0lBQzNFLHFDQUFxQztJQUNyQyxNQUFNLFFBQVEsR0FBNEMsS0FBSyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUU7UUFDakYsTUFBTSxJQUFJLEdBQUcsMEJBQTBCLENBQUMsZUFBZSxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbEUsTUFBTSxTQUFTLENBQ2I7WUFDRSxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDUixzRUFBc0U7WUFDdEUsZ0VBQWdFO1lBQ2hFLHNFQUFzRTtZQUN0RSxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUM7WUFDN0MsSUFBSSxFQUFFLGlCQUFpQixDQUFDLElBQUksRUFBRSxJQUFJLENBQUM7U0FDcEMsRUFDRCxJQUFJLEVBQ0osU0FBUyxFQUNULEVBQUUsSUFBSSxFQUFFLGlCQUFpQixDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxFQUFFLENBQy9FLENBQUM7SUFDSixDQUFDLENBQUM7SUFFRiwrRUFBK0U7SUFDL0UsaUVBQWlFO0lBQ2pFLEVBQUU7SUFDRiw4RUFBOEU7SUFDOUUsK0RBQStEO0lBQy9ELE1BQU0sTUFBTSxHQUFHLE1BQU0sU0FBUyxDQUFDO1FBQzdCLGFBQWEsRUFBRSxLQUFLO1FBQ3BCLE9BQU8sRUFBRTtZQUNQLHdFQUF3RTtZQUN4RSw0RUFBNEU7WUFDNUUsMEVBQTBFO1lBQzFFLEtBQUssQ0FBQyxFQUFFLEtBQUssRUFBRSxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ2hELHdFQUF3RTtZQUN4RSw0RUFBNEU7WUFDNUUscUVBQXFFO1lBQ3JFLDJFQUEyRTtZQUMzRSxnRUFBZ0U7WUFDaEUsUUFBUSxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLElBQUksT0FBTyxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQztTQUMvRTtLQUNGLENBQUMsQ0FBQztJQUVILGlGQUFpRjtJQUNqRixnRkFBZ0Y7SUFDaEYsaUZBQWlGO0lBQ2pGLElBQUksZUFBZSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUNiLDhFQUE4RTtZQUM1RSwwR0FBMEcsQ0FDN0csQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLENBQUMsSUFBSSxDQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFDeEQsT0FBTyxNQUFNLENBQUMsUUFBdUIsQ0FBQztBQUN4QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBUaGUgdHVubmVsIGdhdGUncyB0aW55IEFwcEtpdCBcImFwcFwiIC0gYGNyZWF0ZUFwcGAgV0lUSE9VVCBhIGBzZXJ2ZXIoKWAgcGx1Z2luLlxuICpcbiAqIFRoZXJlIGlzIG5vIEhUVFAgc2VydmVyIGhlcmU6IHRoZSB0dW5uZWwgcHJveHkgaXMgdGhlIHNlcnZlciwgYW5kIGl0IGNhbGxzIHRoZVxuICogZ2F0ZSBoYW5kbGVycyBpbi1wcm9jZXNzLiBgY3JlYXRlQXBwYCBpcyB1c2VkIG9ubHkgZm9yIHdoYXQgaXQgYXV0by13aXJlczpcbiAqICAgLSBgQ2FjaGVNYW5hZ2VyYCAoTGFrZWJhc2Ugd2hlbiB0aGlzIHByb2Nlc3MgY2FuIHJlYWNoIGl0LCBlbHNlIG1lbW9yeSkgLVxuICogICAgIHdoaWNoIHRoZSBPVFAgYENvZGVTdG9yZWAgYW5kIHRoZSBzZXNzaW9uIHNpZ25pbmcga2V5IHVzZSBmb3Igc3RvcmFnZSArIFRUTFxuICogICAgIGV2aWN0aW9uO1xuICogICAtIHRoZSBgZW1haWwoKWAgdHJhbnNwb3J0IChTTVRQIC8gb3V0Ym94KSwgcHJpbWVkIGZyb20gZW52LCBzbyBgc2VuZENvZGVgIGNhblxuICogICAgIGRlbGl2ZXIgdGhlIG9uZS10aW1lIGNvZGU7XG4gKiAgIC0gZGJ4LXRvb2xzIGF1dG8tY29uZmlndXJhdGlvbiArIGJyYW5kaW5nIHZpYSBgQGRieC10b29scy9hcHBraXRgLlxuICpcbiAqIEl0IHJldHVybnMgdGhlIHtAbGluayBBdXRoR2F0ZUFwaX0gdGhlIHByb3h5IGRyaXZlcy4gYHNlbmRDb2RlYCBpcyB3aXJlZCBoZXJlXG4gKiAodGhlIHBsdWdpbiBjYW4ndCByZXNvbHZlIEhPVyB0byBzZW5kIG9uIGl0cyBvd24pIHRvIHRoZSBlbWFpbCBwbHVnaW4nc1xuICogdHJhbnNwb3J0LiBBIHNpZ24taW4gY29kZSBpcyBTWVNURU0gbWFpbCAtIG5vIG9uLWJlaGFsZi1vZiB1c2VyIGFza2VkIGZvciBpdFxuICogYW5kIG5vIHJlcGx5IHRvIGl0IHJlYWNoZXMgYW55b25lIC0gc28gaXQgc2VuZHMgZnJvbSB0aGUgZW1haWwgY29uZmlnJ3NcbiAqIGRvLW5vdC1yZXBseSBhZGRyZXNzIChgbm8tcmVwbHlARU1BSUxfRE9NQUlOYCB1bmxlc3MgRU1BSUxfU1lTVEVNX0ZST00gbmFtZXNcbiAqIGFub3RoZXIpLlxuICpcbiAqIEZBSUwgRkFTVDogYSBnYXRlIHRoYXQgY2FuJ3QgZW1haWwgYSBjb2RlIGlzIHVzZWxlc3MsIHNvIGlmIGVtYWlsIGRvZXMgbm90XG4gKiByZXNvbHZlIHRvIFNNVFAgbW9kZSAocmVhbCBkZWxpdmVyeSksIHRoaXMgdGhyb3dzIC0gdW5sZXNzIGBpbnNlY3VyZWAgaXMgc2V0XG4gKiAoYC0taW5zZWN1cmVgIC8gYFRVTk5FTF9JTlNFQ1VSRT10cnVlYCksIGluIHdoaWNoIGNhc2UgdGhlIGNhbGxlciBydW5zIHRoZVxuICogdHVubmVsIE9QRU4gd2l0aCBubyBnYXRlLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBnZXRVc2VybmFtZVdpdGhBcGlMb29rdXAgfSBmcm9tIFwiQGRhdGFicmlja3MvYXBwa2l0XCI7XG5pbXBvcnQgeyBjcmVhdGVBcHAgYXMgY3JlYXRlQXBwTnMsIGxha2ViYXNlUmVzb2x2ZXIgfSBmcm9tIFwiQGRieC10b29scy9hcHBraXRcIjtcbmltcG9ydCB7IGJyYW5kIGFzIG5vZGVCcmFuZCB9IGZyb20gXCJAZGJ4LXRvb2xzL2NvcmVcIjtcbmltcG9ydCB7IGJyYW5kIGFzIGVtYWlsQnJhbmQsIGVtYWlsLCBzZW5kZXIsIHRyYW5zcG9ydCB9IGZyb20gXCJAZGJ4LXRvb2xzL2VtYWlsXCI7XG5pbXBvcnQgeyBlbnYsIGxvZywgc3RyaW5nIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB7IGF1dGhHYXRlLCB0eXBlIEF1dGhHYXRlQXBpLCB0eXBlIEF1dGhHYXRlQ29uZmlnLCB0eXBlIFNlbmRDb2RlT3B0aW9ucyB9IGZyb20gXCIuL3BsdWdpbi50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwidHVubmVsOmFwcFwiKTtcblxuLyoqXG4gKiBBIGNvZGUgVFRMIGFzIHRoZSBwbGFpbiBwaHJhc2UgdGhlIGVtYWlsIHN0YXRlcyAoXCIxMCBtaW51dGVzXCIsIFwiNDUgc2Vjb25kc1wiKS5cbiAqXG4gKiBXaG9sZSBtaW51dGVzIHJlYWQgYXMgbWludXRlczsgYW55dGhpbmcgZWxzZSBzdGF5cyBpbiBzZWNvbmRzIHJhdGhlciB0aGFuXG4gKiByb3VuZGluZywgc28gYSA5MC1zZWNvbmQgVFRMIGlzIG5vdCBhZHZlcnRpc2VkIGFzIFwiMSBtaW51dGVcIiBhbmQgYSByZWNpcGllbnQgaXNcbiAqIG5ldmVyIHRvbGQgdGhlIGNvZGUgbGl2ZXMgbG9uZ2VyIHRoYW4gaXQgZG9lcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGV4cGlyZXNJbihzZWNvbmRzOiBudW1iZXIpOiBzdHJpbmcge1xuICByZXR1cm4gc2Vjb25kcyA+PSA2MCAmJiBzZWNvbmRzICUgNjAgPT09IDBcbiAgICA/IHN0cmluZy5wbHVyYWxpemUoc2Vjb25kcyAvIDYwLCBcIm1pbnV0ZVwiKVxuICAgIDogc3RyaW5nLnBsdXJhbGl6ZShzZWNvbmRzLCBcInNlY29uZFwiKTtcbn1cblxuLyoqIFRoZSBwYXJ0cyBvZiB7QGxpbmsgU2VuZENvZGVPcHRpb25zfSB0aGUgY29kZSBlbWFpbCdzIGNvcHkgaXMgYnVpbHQgZnJvbS4gKi9cbnR5cGUgQ29kZUNvcHkgPSBQaWNrPFNlbmRDb2RlT3B0aW9ucywgXCJtZXNzYWdlXCIgfCBcImNvZGVUdGxTZWNvbmRzXCI+O1xuXG4vKiogVGhlIHJlYXNzdXJhbmNlIGxpbmUgY2xvc2luZyBib3RoIHBhcnRzLiAqL1xuY29uc3QgSUdOT1JFX0xJTkUgPSBcIklmIHlvdSBkaWQgbm90IHJlcXVlc3QgdGhpcyBjb2RlLCB5b3UgY2FuIGlnbm9yZSB0aGlzIGVtYWlsLlwiO1xuXG4vKipcbiAqIFRoZSBIVE1MIHBhcnQncyBzb3VyY2U6IHRoZSBmdWxsIGJyYW5kZWQgdGVtcGxhdGUsIHdpdGggdGhlIGNvZGUgYXMgYSBsYXJnZVxuICogc3R5bGVkIGhlYWRpbmcgKGAjIyBgIGlzIHdoYXQgbWFrZXMgaXQgcHJvbWluZW50IGluIGFuIGluYm94KS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNvZGVFbWFpbEh0bWxCb2R5KGNvZGU6IHN0cmluZywgb3B0czogQ29kZUNvcHkpOiBzdHJpbmcge1xuICByZXR1cm4gW1xuICAgIG9wdHMubWVzc2FnZSxcbiAgICBcIlwiLFxuICAgIGAjIyAke2NvZGV9YCxcbiAgICBcIlwiLFxuICAgIGBUaGlzIGNvZGUgZXhwaXJlcyBpbiAke2V4cGlyZXNJbihvcHRzLmNvZGVUdGxTZWNvbmRzKX0uYCxcbiAgICBcIlwiLFxuICAgIElHTk9SRV9MSU5FLFxuICBdLmpvaW4oXCJcXG5cIik7XG59XG5cbi8qKlxuICogVGhlIGB0ZXh0L3BsYWluYCBwYXJ0LCBzdXBwbGllZCBFWFBMSUNJVExZIHJhdGhlciB0aGFuIHJlbmRlcmVkIGZyb20gdGhlIHRyZWVcbiAqIGFib3ZlLiBCb3RoIHBhcnRzIHNheSB0aGUgc2FtZSB0aGluZzsgb25seSB0aGUgbGluZSBsYXlvdXQgZGlmZmVycy5cbiAqXG4gKiBUaGUgcHJvbXB0IGFuZCB0aGUgY29kZSBzaGFyZSBPTkUgbGluZSAoXCJZb3VyIHZlcmlmaWNhdGlvbiBjb2RlIGlzOiAxMjM0NTZcIikuXG4gKiBUaGF0IHNpbmdsZS1saW5lIHNoYXBlIGlzIHdoYXQgaU9TLCBHbWFpbCwgT3V0bG9vaywgYW5kIEFuZHJvaWQgY29kZSBkZXRlY3Rpb25cbiAqIGtleXMgb24gbW9zdCByZWxpYWJseSAtIHRoZSBoZXVyaXN0aWNzIGxvb2sgZm9yIGEgY29kZSBpbiB0aGUgc2FtZSBzZW50ZW5jZSBhc1xuICogYSByZWNvZ25pemVkIHByb21wdCwgc28gc3BsaXR0aW5nIHRoZW0gYWNyb3NzIGxpbmVzIG1ha2VzIGRldGVjdGlvbiBkZXBlbmRlbnRcbiAqIG9uIHRoZSBjbGllbnQsIGFuZCBhbnkgYmxhbmsgbGluZSBiZXR3ZWVuIHRoZW0gZGVmZWF0cyBpdCBvdXRyaWdodC5cbiAqXG4gKiBUaGUgR0VORVJBVEVEIHRleHQgcGFydCBjYW5ub3QgaG9sZCB0aGF0IHNoYXBlIGF0IGFsbDogaXQgaXMgYSByZW5kZXJpbmcgb2YgdGhlXG4gKiBIVE1MLCBzbyBpdCBjYXJyaWVzIHRoZSBicmFuZCBoZWFkZXIvZm9vdGVyIGFuZCB0dXJucyB0aGUgY29kZSBoZWFkaW5nJ3MgQ1NTXG4gKiBtYXJnaW4gaW50byBibGFuayBsaW5lcywgYXJyaXZpbmcgYXMgYHByb21wdFxcblxcblxcbmNvZGVgLlxuICpcbiAqIFRoZSBjb2RlIGlzIHZpc2libGUgdGV4dCBpbiBCT1RIIHBhcnRzLCBuZXZlciBhbiBpbWFnZSwgc28gYSBjbGllbnQgc2NyYXBpbmdcbiAqIGVpdGhlciBvbmUgZmluZHMgaXQuIE5vIHRyYWlsZXIgbGluZSBmb2xsb3dzIHRoZSBjb3B5IC0gQXBwbGUncyBkb21haW4tYm91bmRcbiAqIGBAZG9tYWluICNjb2RlYCBmb290ZXIgaXMgZGVsaWJlcmF0ZWx5IE5PVCBlbWl0dGVkLCBzaW5jZSBpdCBjb25zdHJhaW5zIHRoZVxuICogY29kZSB0byBvbmUgb3JpZ2luIGFuZCBpcyBub3Qgd2hhdCB0aGUgYnJvYWRseS1jb21wYXRpYmxlIHNoYXBlIG5lZWRzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY29kZUVtYWlsVGV4dEJvZHkoY29kZTogc3RyaW5nLCBvcHRzOiBDb2RlQ29weSk6IHN0cmluZyB7XG4gIHJldHVybiBbXG4gICAgYCR7b3B0cy5tZXNzYWdlfSAke2NvZGV9YCxcbiAgICBgVGhpcyBjb2RlIGV4cGlyZXMgaW4gJHtleHBpcmVzSW4ob3B0cy5jb2RlVHRsU2Vjb25kcyl9LmAsXG4gICAgXCJcIixcbiAgICBJR05PUkVfTElORSxcbiAgXS5qb2luKFwiXFxuXCIpO1xufVxuXG4vKipcbiAqIFRoZSBTVUJKRUNUIGxpbmUsIHdpdGggdGhlIGNvZGUgaW4gaXQ6IGBcIjEyMzQ1NiBpcyB5b3VyIHZlcmlmaWNhdGlvbiBjb2RlXCJgLlxuICpcbiAqIFRoZSBjb2RlIGhhcyB0byBiZSBoZXJlLCBub3Qgb25seSBpbiB0aGUgYm9keSwgYmVjYXVzZSBvZiB3aGF0IG1vYmlsZSBhdXRvZmlsbFxuICogYWN0dWFsbHkgcmVhZHMuIGlPUyBvZmZlcnMgYSBjb2RlIGZyb20gYW4gaW5jb21pbmcgTk9USUZJQ0FUSU9OIC0gbmF0aXZlbHkgZm9yXG4gKiBNZXNzYWdlcyBhbmQgTWFpbCwgYW5kIHNpbmNlIGlPUyAyNiBmb3IgYW55IGFwcCdzIG5vdGlmaWNhdGlvbiB0ZXh0LCB3aGljaCBpc1xuICogd2hhdCBmaW5hbGx5IG1hZGUgR21haWwgd29yayAtIGFuZCBhIG5vdGlmaWNhdGlvbiBjb250YWlucyB0aGUgc2VuZGVyLCB0aGVcbiAqIHN1YmplY3QsIGFuZCBhIHNob3J0IHNuaXBwZXQuIE5vdGhpbmcgZWxzZS4gQSBjb2RlIHRoYXQgbGl2ZXMgaW4gdGhlIGJvZHkgaXNcbiAqIGludmlzaWJsZSB0byBpdCwgaG93ZXZlciBjbGVhbmx5IHRoZSBib2R5IGlzIGZvcm1hdHRlZCwgd2hpY2ggaXMgd2h5IGEgcGVyZmVjdGx5XG4gKiBzaGFwZWQgYHRleHQvcGxhaW5gIHBhcnQgc3RpbGwgcHJvZHVjZWQgbm8gYXV0b2ZpbGwgcHJvbXB0IGluIEdtYWlsLlxuICpcbiAqIGA8Y29kZT4gaXMgeW91ciA8dGhpbmc+YCByYXRoZXIgdGhhbiBgPHRoaW5nPjogPGNvZGU+YCBiZWNhdXNlIHRoZSBsZWFkaW5nIGNvZGVcbiAqIHN1cnZpdmVzIFRSVU5DQVRJT046IGEgbm90aWZpY2F0aW9uIGFuZCBhbiBpbmJveCBsaXN0IGJvdGggY3V0IHRoZSBzdWJqZWN0LCBhbmRcbiAqIHRoZSBwbGF0Zm9ybSBoZXVyaXN0aWNzIHdhbnQgdGhlIGNvZGUgaW4gdGhlIHNhbWUgc2VudGVuY2UgYXMgYSByZWNvZ25pemVkXG4gKiBwcm9tcHQgKFwiY29kZVwiLCBcInZlcmlmaWNhdGlvblwiKS4gUHV0dGluZyBpdCBmaXJzdCBrZWVwcyBib3RoIGludGFjdCBubyBtYXR0ZXJcbiAqIHdoZXJlIHRoZSBjdXQgbGFuZHMuXG4gKlxuICogYHN1YmplY3RgIGlzIHRoZSBjb25maWd1cmVkIGxpbmUgKFwiWW91ciB2ZXJpZmljYXRpb24gY29kZVwiKSwgbG93ZXItY2FzZWQgYXQgaXRzXG4gKiBmaXJzdCB3b3JkIHNvIHRoZSBzZW50ZW5jZSByZWFkcyBuYXR1cmFsbHksIGFuZCBsZWZ0IEFMT05FIHdoZW4gaXQgZG9lcyBub3QgbG9va1xuICogbGlrZSB0aGUgY29udmVudGlvbmFsIHBocmFzaW5nIC0gYW4gb3BlcmF0b3Igd2hvIHNldCBhIGRlbGliZXJhdGUgc3ViamVjdCBnZXRzXG4gKiB0aGVpcnMgd2l0aCB0aGUgY29kZSBwcmVmaXhlZCwgbm90IGEgbWFuZ2xlZCBoeWJyaWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjb2RlRW1haWxTdWJqZWN0KGNvZGU6IHN0cmluZywgc3ViamVjdDogc3RyaW5nKTogc3RyaW5nIHtcbiAgY29uc3QgdHJpbW1lZCA9IHN1YmplY3QudHJpbSgpO1xuICBjb25zdCBjb252ZW50aW9uYWwgPSAvXnlvdXJcXHMrL2kuZXhlYyh0cmltbWVkKTtcbiAgY29uc3QgcmVzdCA9IGNvbnZlbnRpb25hbCA/IHRyaW1tZWQuc2xpY2UoY29udmVudGlvbmFsWzBdLmxlbmd0aCkgOiB0cmltbWVkO1xuICByZXR1cm4gY29udmVudGlvbmFsID8gYCR7Y29kZX0gaXMgeW91ciAke3Jlc3R9YCA6IGAke2NvZGV9IC0gJHt0cmltbWVkfWA7XG59XG5cbi8qKlxuICogVGhlIFBSRUhFQURFUjogdGhlIHNuaXBwZXQgYmVzaWRlIHRoZSBzdWJqZWN0IGluIGFuIGluYm94IGxpc3QsIGFuZCB0aGUgYm9keSBvZlxuICogdGhlIHB1c2ggbm90aWZpY2F0aW9uLiBDYXJyaWVzIHRoZSBjb2RlIGZvciB0aGUgc2FtZSByZWFzb24gdGhlIHN1YmplY3QgZG9lcyAtXG4gKiBpdCBpcyB0aGUgb3RoZXIgaGFsZiBvZiB3aGF0IGEgbm90aWZpY2F0aW9uIHNob3dzIC0gYW5kIHJlcGVhdHMgdGhlIHByb21wdFxuICogd29yZGluZyBzbyBhIGhldXJpc3RpYyBzY2FubmluZyB0aGUgc25pcHBldCBhbG9uZSBmaW5kcyBhIGNvZGUgbmV4dCB0byBhIHBocmFzZVxuICogaXQgcmVjb2duaXplcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGNvZGVFbWFpbFByZXZpZXcoY29kZTogc3RyaW5nLCBvcHRzOiBDb2RlQ29weSk6IHN0cmluZyB7XG4gIHJldHVybiBgJHtvcHRzLm1lc3NhZ2V9ICR7Y29kZX1gO1xufVxuXG5jb25zdCB7IGNyZWF0ZUFwcCB9ID0gY3JlYXRlQXBwTnM7XG5jb25zdCB7IGFwcGx5TGFrZWJhc2VUb0VudiwgcmVzb2x2ZUxha2ViYXNlQ29ubmVjdGlvbiB9ID0gbGFrZWJhc2VSZXNvbHZlcjtcbmNvbnN0IHsgcmVzb2x2ZVN5c3RlbVNlbmRlckFkZHJlc3MgfSA9IHNlbmRlcjtcbmNvbnN0IHsgZ2V0RW1haWxSdW50aW1lLCBzZW5kRW1haWwgfSA9IHRyYW5zcG9ydDtcbmNvbnN0IHsgZW1haWxCcmFuZEZyb21Db250ZXh0IH0gPSBlbWFpbEJyYW5kO1xuY29uc3QgeyBsb2FkQnJhbmRDb250ZXh0IH0gPSBub2RlQnJhbmQ7XG5cbi8qKlxuICogRW52IHZhcnMgd2hvc2UgcHJlc2VuY2UgbWVhbnMgYSBMYWtlYmFzZSBkYXRhYmFzZSB3YXMgYm91bmQgdG8gdGhpcyBkZXBsb3ltZW50LlxuICogYExBS0VCQVNFX0VORFBPSU5UYCBpcyB3aGF0IGEgRGF0YWJyaWNrcyBBcHAgYHBvc3RncmVzYCByZXNvdXJjZSBiaW5kaW5nIHNldHM7XG4gKiBgUEdIT1NUYCBpcyB0aGUgbG9jYWwvbWFudWFsIHNwZWxsaW5nLlxuICovXG5jb25zdCBMQUtFQkFTRV9FTlYgPSBbXCJMQUtFQkFTRV9FTkRQT0lOVFwiLCBcIlBHSE9TVFwiXSBhcyBjb25zdDtcblxuLyoqXG4gKiBVcHBlciBib3VuZCBvbiByZXNvbHZpbmcgdGhlIExha2ViYXNlIGNvbm5lY3Rpb24uIFRoZSBnYXRlIGlzIGluIHRoZSByZXF1ZXN0XG4gKiBwYXRoIGZvciBldmVyeSB2aXNpdG9yLCBzbyBhIHNsb3cgd29ya3NwYWNlIEFQSSBtdXN0IG5vdCBob2xkIHVwIGJvb3RcbiAqIGluZGVmaW5pdGVseTsgYSBtZW1vcnkgY2FjaGUgaXMgYSBkZWdyYWRlZCBnYXRlLCBhbiB1bmJvb3RlZCBvbmUgaXMgbm8gZ2F0ZS5cbiAqL1xuY29uc3QgTEFLRUJBU0VfUkVTT0xWRV9USU1FT1VUX01TID0gNjBfMDAwO1xuXG4vKipcbiAqIEZpbGwgaW4gdGhlIExha2ViYXNlIGNvbm5lY3Rpb24gZW52IEFwcEtpdCdzIGNhY2hlIG5lZWRzLCBzbyBgQ2FjaGVNYW5hZ2VyYFxuICogY2hvb3NlcyBQRVJTSVNURU5UIHN0b3JhZ2UgaW5zdGVhZCBvZiBtZW1vcnkuXG4gKlxuICogVGhpcyBpcyB3aGF0IG1ha2VzIHRoZSBnYXRlJ3Mgc2Vzc2lvbiBzaWduaW5nIGtleSBhbmQgb3V0c3RhbmRpbmcgb25lLXRpbWVcbiAqIGNvZGVzIHN1cnZpdmUgYSByZXN0YXJ0LCBhbmQgaXQgaGFzIHRvIGJlIGRvbmUgZXhwbGljaXRseSBoZXJlLiBBcHBLaXQgcGlja3NcbiAqIExha2ViYXNlIGZvciB0aGUgY2FjaGUgb25seSB3aGVuIGBjcmVhdGVMYWtlYmFzZVBvb2woKWAgc3VjY2VlZHMsIGFuZCB0aGF0IHBvb2xcbiAqIHJlYWRzIEZPVVIgdGhpbmdzIG9mZiBgcHJvY2Vzcy5lbnZgOiBgTEFLRUJBU0VfRU5EUE9JTlRgLCBgUEdIT1NUYCxcbiAqIGBQR0RBVEFCQVNFYCwgYW5kIGEgdXNlcm5hbWUgKGBQR1VTRVJgLCBvciBgREFUQUJSSUNLU19DTElFTlRfSURgIGZvciBhIHNlcnZpY2VcbiAqIHByaW5jaXBhbCkuIEEgRGF0YWJyaWNrcyBBcHAgYHBvc3RncmVzYCByZXNvdXJjZSBiaW5kaW5nIHN1cHBsaWVzIG9ubHlcbiAqIGBMQUtFQkFTRV9FTkRQT0lOVGAuIFRoZSByZXNvbHZlciB0dXJucyB0aGF0IG9uZSB2YWx1ZSBpbnRvIHRoZSBob3N0IGFuZFxuICogZGF0YWJhc2U7IHRoZSB1c2VybmFtZSBpcyBsb29rZWQgdXAgc2VwYXJhdGVseSwgYmVjYXVzZSBtaXNzaW5nIGl0IGZhaWxzIHBvb2xcbiAqIGNvbnN0cnVjdGlvbiBqdXN0IGFzIGhhcmQgYXMgYSBtaXNzaW5nIGhvc3QgLSBhbmQgaXQgaXMgd2hhdCBhIExPQ0FMIHJ1biAoYVxuICogZGV2ZWxvcGVyIG9uIGEgUEFULCB3aXRoIG5vIGBEQVRBQlJJQ0tTX0NMSUVOVF9JRGApIGlzIGFsd2F5cyBtaXNzaW5nLiBXaXRob3V0XG4gKiBhbGwgZm91ciB0aGUgcG9vbCBjYW5ub3QgYmUgYnVpbHQsIHRoZSBjYWNoZSBzaWxlbnRseSBkZWdyYWRlcyB0byBpbi1tZW1vcnksIGFuZFxuICogZXZlcnkgcmVkZXBsb3kgc2lnbnMgb3V0IGV2ZXJ5IHVzZXIgKHRoZSBleGFjdCBzeW1wdG9tIHRoaXMgZXhpc3RzIHRvIHByZXZlbnQpLlxuICpcbiAqIGBAZGJ4LXRvb2xzL2FwcGtpdGAncyBgY3JlYXRlQXBwYCB3b3VsZCBub3JtYWxseSBkbyB0aGlzIHZpYSBgYXV0b0NvbmZpZ3VyZWAsXG4gKiBidXQgaXQgZ2F0ZXMgdGhhdCBvbiBhIGBsYWtlYmFzZSgpYCBwbHVnaW4gYmVpbmcgcmVnaXN0ZXJlZCAtIGFuZCB0aGlzIGFwcFxuICogcmVnaXN0ZXJzIG5vbmUsIGJlY2F1c2UgaXQgaGFzIG5vIHNlcnZlciB0byBtb3VudCBMYWtlYmFzZSByb3V0ZXMgb24uIENhbGxpbmdcbiAqIHRoZSByZXNvbHZlciBkaXJlY3RseSBhbHNvIGxldHMgdGhlIGdhdGUgYmUgc3RyaWN0ZXIgdGhhbiBgYXV0b0NvbmZpZ3VyZWAgaXM6XG4gKlxuICogICAtIEl0IHJ1bnMgT05MWSB3aGVuIGEgTGFrZWJhc2UgZW52IHZhciBpcyBwcmVzZW50LiBBIHR1bm5lbCBpcyBhIHdyYXBwZXJcbiAqICAgICBhcm91bmQgc29tZW9uZSBlbHNlJ3MgYXBwIGFuZCBtdXN0IG5vdCBpbnZlbnQgaW5mcmFzdHJ1Y3R1cmUsIHNvIHdpdGhcbiAqICAgICBub3RoaW5nIGJvdW5kIGl0IHNraXBzIHJhdGhlciB0aGFuIGZhbGxpbmcgdGhyb3VnaCB0aGUgcmVzb2x2ZXInc1xuICogICAgIGxpc3Qtb3ItQ1JFQVRFLWEtcHJvamVjdCBwYXRoLlxuICogICAtIGBhdXRvQ3JlYXRlOiBmYWxzZWAgZm9yIHRoZSBzYW1lIHJlYXNvbiwgaW4gY2FzZSBhIHByb2plY3QgaGFwcGVucyB0byBleGlzdC5cbiAqICAgLSBFdmVyeSBmYWlsdXJlIGlzIGEgV0FSTklORywgbmV2ZXIgYSB0aHJvdy4gVGhlIGNhY2hlIGlzIGFuIG9wdGltaXphdGlvbiBmb3JcbiAqICAgICBzZXNzaW9uIGR1cmFiaWxpdHk7IGFkbWlzc2lvbiBzdGlsbCByZXF1aXJlcyBhIGNvZGUgZGVsaXZlcmVkIHRvIGFuXG4gKiAgICAgYWxsb3ctbGlzdGVkIGFkZHJlc3MsIHNvIGEgZ2F0ZSB3aXRoIGEgbWVtb3J5IGNhY2hlIGlzIHNhZmUsIGp1c3QgZm9yZ2V0ZnVsLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZUNhY2hlU3RvcmFnZUVudigpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCFlbnYudGV4dChMQUtFQkFTRV9FTlYpKSB7XG4gICAgbG9nZ2VyLmluZm8oXG4gICAgICBgbm8gJHtlbnYubmFtZShMQUtFQkFTRV9FTlYpfSAtIHRoZSBnYXRlIGNhY2hlIHN0YXlzIGluIG1lbW9yeTsgc2Vzc2lvbnMgYW5kIGNvZGVzIHdpbGwgbm90IHN1cnZpdmUgYSByZXN0YXJ0YCxcbiAgICApO1xuICAgIHJldHVybiBmYWxzZTtcbiAgfVxuICB0cnkge1xuICAgIGNvbnN0IHJlc29sdmVkID0gYXdhaXQgcmVzb2x2ZUxha2ViYXNlQ29ubmVjdGlvbihcbiAgICAgIHsgYXV0b0NyZWF0ZTogZmFsc2UgfSxcbiAgICAgIEFib3J0U2lnbmFsLnRpbWVvdXQoTEFLRUJBU0VfUkVTT0xWRV9USU1FT1VUX01TKSxcbiAgICApO1xuICAgIGFwcGx5TGFrZWJhc2VUb0VudihyZXNvbHZlZCk7XG4gICAgLy8gYD8/PWAgc28gYW4gZXhwbGljaXRseSBjb25maWd1cmVkIFBHVVNFUiBzdGF5cyBhdXRob3JpdGF0aXZlLiBUaGUgbG9va3VwXG4gICAgLy8gZmFsbHMgYmFjayB0byB0aGUgd29ya3NwYWNlIEFQSSBhbmQgcmV0dXJucyB1bmRlZmluZWQgcmF0aGVyIHRoYW4gdGhyb3dpbmcsXG4gICAgLy8gc28gYSBmYWlsdXJlIGhlcmUganVzdCBsZWF2ZXMgdGhlIHBvb2wgdG8gZmluZCBpdHMgb3duIHVzZXJuYW1lLlxuICAgIGNvbnN0IHVzZXIgPSBhd2FpdCBnZXRVc2VybmFtZVdpdGhBcGlMb29rdXAoe30pO1xuICAgIGlmICh1c2VyKSBwcm9jZXNzLmVudi5QR1VTRVIgPz89IHVzZXI7XG4gICAgbG9nZ2VyLmluZm8oXCJsYWtlYmFzZSByZXNvbHZlZCBmb3IgdGhlIGdhdGUgY2FjaGVcIiwge1xuICAgICAgaG9zdDogcmVzb2x2ZWQuaG9zdCxcbiAgICAgIGRhdGFiYXNlOiByZXNvbHZlZC5kYXRhYmFzZSxcbiAgICAgIGVuZHBvaW50OiByZXNvbHZlZC5lbmRwb2ludCxcbiAgICAgIHVzZXI6IHByb2Nlc3MuZW52LlBHVVNFUixcbiAgICB9KTtcbiAgICByZXR1cm4gdHJ1ZTtcbiAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICBsb2dnZXIud2FybihcbiAgICAgIFwiY291bGQgbm90IHJlc29sdmUgbGFrZWJhc2UgLSB0aGUgZ2F0ZSBjYWNoZSBzdGF5cyBpbiBtZW1vcnk7IHNlc3Npb25zIGFuZCBjb2RlcyB3aWxsIG5vdCBzdXJ2aXZlIGEgcmVzdGFydFwiLFxuICAgICAgeyBlcnJvciB9LFxuICAgICk7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG59XG5cbi8qKlxuICogQm9vdCB0aGUgZ2F0ZSBhcHAgYW5kIHJldHVybiB0aGUgQVBJIHRoZSBwcm94eSBjYWxscy4gVGhyb3dzIHdoZW4gZW1haWwgaXMgbm90XG4gKiBpbiBTTVRQIG1vZGUgKG5vIHdheSB0byBkZWxpdmVyIGEgY29kZSkgc28gYSBtaXNjb25maWd1cmVkIGdhdGUgZmFpbHMgZmFzdCBhdFxuICogc3RhcnR1cCByYXRoZXIgdGhhbiBzaWxlbnRseSBhY2NlcHRpbmcgbm9ib2R5OyB0aGUgY2FsbGVyIG1heSBjYXRjaCB0aGlzIGFuZFxuICogZmFsbCBiYWNrIHRvIGluc2VjdXJlL29wZW4gbW9kZSB3aGVuIHRoZSBvcGVyYXRvciBvcHRlZCBpbi5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHN0YXJ0R2F0ZUFwcChjb25maWc6IEF1dGhHYXRlQ29uZmlnKTogUHJvbWlzZTxBdXRoR2F0ZUFwaT4ge1xuICAvLyBUaGUgaG9zdCBhcHAncyBvd24gYnJhbmQgKGBicmFuZGluZy9icmFuZC55YW1sYCBkaXNjb3ZlcmVkIGZyb20gY3dkKSBvciB0aGVcbiAgLy8gZGJ4LXRvb2xzIGRlZmF1bHQuIFRoaXMgaXMgdGhlIE9ORSBicmFuZCBzb3VyY2UgZm9yIHRoZSBnYXRlOiBpdCBzdHlsZXMgdGhlXG4gIC8vIGNvZGUgZW1haWwgKGFjY2VudCBiYW5kLCBmb250LCBsb2dvKSB2aWEgdGhlIGVtYWlsIHBsdWdpbiBBTkQgc3VwcGxpZXMgdGhlXG4gIC8vIGRpc3BsYXkgbmFtZSB0aGUgY29weSB1c2VzLCBzbyBhIGRlcGxveW1lbnQgdGhhdCB0aGVtZXMgaXRzIGFwcCB0aGVtZXMgaXRzXG4gIC8vIHNpZ24taW4gZW1haWwgd2l0aCBpdC4gQW4gZXhwbGljaXQgYGJyYW5kTmFtZWAgc3RpbGwgd2lucyAoc2VlIGJlbG93KS5cbiAgY29uc3QgY29udGV4dCA9IGF3YWl0IGxvYWRCcmFuZENvbnRleHQoKTtcblxuICAvLyBCZWZvcmUgYGNyZWF0ZUFwcGAsIGJlY2F1c2UgQXBwS2l0IHJlc29sdmVzIHRoZSBjYWNoZSdzIHN0b3JhZ2UgZHVyaW5nIGl0IGFuZFxuICAvLyByZWFkcyB0aGUgY29ubmVjdGlvbiBvdXQgb2YgYHByb2Nlc3MuZW52YCB3aGVuIGl0IGRvZXMuIFNlZSB0aGUgZnVuY3Rpb24nc1xuICAvLyBkb2NzIGZvciB3aHkgdGhlIGdhdGUgcmVzb2x2ZXMgdGhpcyBpdHNlbGYuXG4gIGF3YWl0IHJlc29sdmVDYWNoZVN0b3JhZ2VFbnYoKTtcblxuICAvLyBgc2VuZENvZGVgIGRlbGl2ZXJzIHRoZSBPVFAgdGhyb3VnaCB0aGUgZW1haWwgcGx1Z2luJ3MgU0hBUkVEIHRyYW5zcG9ydCwgd2hpY2hcbiAgLy8gdGhlIGBlbWFpbCgpYCBwbHVnaW4gcHJpbWVzIGR1cmluZyBpdHMgYHNldHVwKClgIChhd2FpdGVkIGJ5IGBjcmVhdGVBcHBgXG4gIC8vIGJlbG93KS4gVXNpbmcgdGhlIG1vZHVsZS1sZXZlbCBgc2VuZEVtYWlsYCBhdm9pZHMgYSBjaXJjdWxhciBkZXBlbmRlbmN5IG9uIHRoZVxuICAvLyBhcHAgaGFuZGxlJ3MgaW5mZXJyZWQgdHlwZS4gVGhlIGBGcm9tYCBpcyB0aGUgU1lTVEVNIHNlbmRlcjogYSB2ZXJpZmljYXRpb25cbiAgLy8gY29kZSBpcyBtYWNoaW5lLWdlbmVyYXRlZCBhbmQgdW5hbnN3ZXJhYmxlLCBzbyBpdCBtdXN0IG5vdCBhcnJpdmUgZnJvbSBhXG4gIC8vIHBlcnNvbidzIGFkZHJlc3MgaW52aXRpbmcgYSByZXBseS5cbiAgY29uc3Qgc2VuZENvZGU6IE5vbk51bGxhYmxlPEF1dGhHYXRlQ29uZmlnW1wic2VuZENvZGVcIl0+ID0gYXN5bmMgKHRvLCBjb2RlLCBvcHRzKSA9PiB7XG4gICAgY29uc3QgZnJvbSA9IHJlc29sdmVTeXN0ZW1TZW5kZXJBZGRyZXNzKGdldEVtYWlsUnVudGltZSgpLmNvbmZpZyk7XG4gICAgYXdhaXQgc2VuZEVtYWlsKFxuICAgICAge1xuICAgICAgICB0bzogW3RvXSxcbiAgICAgICAgLy8gVGhlIGNvZGUgcmlkZXMgaW4gdGhlIFNVQkpFQ1QgYW5kIHRoZSBwcmVoZWFkZXIsIG5vdCBqdXN0IHRoZSBib2R5OlxuICAgICAgICAvLyB0aG9zZSB0d28gc3RyaW5ncyBhcmUgdGhlIHdob2xlIG9mIGEgcHVzaCBub3RpZmljYXRpb24sIGFuZCBhXG4gICAgICAgIC8vIG5vdGlmaWNhdGlvbiBpcyB3aGF0IG1vYmlsZSBhdXRvZmlsbCByZWFkcy4gU2VlIGBjb2RlRW1haWxTdWJqZWN0YC5cbiAgICAgICAgc3ViamVjdDogY29kZUVtYWlsU3ViamVjdChjb2RlLCBvcHRzLnN1YmplY3QpLFxuICAgICAgICBib2R5OiBjb2RlRW1haWxIdG1sQm9keShjb2RlLCBvcHRzKSxcbiAgICAgIH0sXG4gICAgICBmcm9tLFxuICAgICAgdW5kZWZpbmVkLFxuICAgICAgeyB0ZXh0OiBjb2RlRW1haWxUZXh0Qm9keShjb2RlLCBvcHRzKSwgcHJldmlldzogY29kZUVtYWlsUHJldmlldyhjb2RlLCBvcHRzKSB9LFxuICAgICk7XG4gIH07XG5cbiAgLy8gYGNyZWF0ZUFwcGAgbmFtZXNwYWNlcyBlYWNoIHBsdWdpbidzIGV4cG9ydHMgb24gdGhlIGhhbmRsZSBieSBtYW5pZmVzdCBuYW1lO1xuICAvLyBgaGFuZGxlLmF1dGhHYXRlYCBpcyB0aGUgaW4tcHJvY2VzcyBnYXRlIEFQSSB0aGUgcHJveHkgZHJpdmVzLlxuICAvL1xuICAvLyBgYXV0b0NvbmZpZ3VyZTogZmFsc2VgIGJlY2F1c2Uge0BsaW5rIHJlc29sdmVDYWNoZVN0b3JhZ2VFbnZ9IGFib3ZlIGFscmVhZHlcbiAgLy8gZGlkIHRoZSBvbmUgcGllY2Ugb2YgaXQgdGhpcyBhcHAgd2FudHMsIG9uIHRoaXMgYXBwJ3MgdGVybXMuXG4gIGNvbnN0IGhhbmRsZSA9IGF3YWl0IGNyZWF0ZUFwcCh7XG4gICAgYXV0b0NvbmZpZ3VyZTogZmFsc2UsXG4gICAgcGx1Z2luczogW1xuICAgICAgLy8gQnJhbmQgdGhlIGNvZGUgZW1haWwgZnJvbSB0aGUgcmVzb2x2ZWQgY29udGV4dCwgdGhlIHNhbWUgYnJpZGdlIGV2ZXJ5XG4gICAgICAvLyBvdGhlciBkYngtdG9vbHMgZW1haWwgc3VyZmFjZSB1c2VzIChhY2NlbnQgKyBmb250IGlubGluZWQsIGxvZ28gb25seSB3aGVuXG4gICAgICAvLyBpdCBpcyBhIGZldGNoYWJsZSBVUkwgLSBhIHBhY2thZ2UtZXhwb3J0IHBhdGggY2Fubm90IGxvYWQgaW4gYW4gaW5ib3gpLlxuICAgICAgZW1haWwoeyBicmFuZDogZW1haWxCcmFuZEZyb21Db250ZXh0KGNvbnRleHQpIH0pLFxuICAgICAgLy8gYGJyYW5kTmFtZWAgZmFsbHMgYmFjayB0byB0aGUgcmVzb2x2ZWQgY29udGV4dCdzIGRpc3BsYXkgbmFtZSwgc28gdGhlXG4gICAgICAvLyBlbWFpbCBjb3B5IG5hbWVzIHRoZSBhcHAgcmF0aGVyIHRoYW4gYSBnZW5lcmljIHBsYWNlaG9sZGVyLiBTcGVsbGVkIGFzIGFuXG4gICAgICAvLyBleHBsaWNpdCBgPz9gIHJhdGhlciB0aGFuIGEga2V5IGJlZm9yZSBgLi4uY29uZmlnYDogY29tbWFuZGVyIHNldHNcbiAgICAgIC8vIGBicmFuZE5hbWVgIG9uIHRoZSBvcHRpb25zIG9iamVjdCB3aGV0aGVyIG9yIG5vdCB0aGUgZmxhZyB3YXMgcGFzc2VkLCBzb1xuICAgICAgLy8gc3ByZWFkaW5nIGl0IHdvdWxkIGNsb2JiZXIgdGhlIGNvbnRleHQgbmFtZSB3aXRoIGB1bmRlZmluZWRgLlxuICAgICAgYXV0aEdhdGUoeyAuLi5jb25maWcsIGJyYW5kTmFtZTogY29uZmlnLmJyYW5kTmFtZSA/PyBjb250ZXh0Lm5hbWUsIHNlbmRDb2RlIH0pLFxuICAgIF0sXG4gIH0pO1xuXG4gIC8vIEZhaWwgZmFzdDogdGhlIGdhdGUgbmVlZHMgU01UUCB0byBlbWFpbCBjb2Rlcy4gYGdldEVtYWlsUnVudGltZSgpYCByZXNvbHZlcyB0b1xuICAvLyBgbW9kZTogXCJmaWxlXCJgIChvdXRib3gpIG9yIHRocm93cyB3aGVuIG5vIFNNVFAgY3JlZHMgYXJlIGNvbmZpZ3VyZWQgLSBuZWl0aGVyXG4gIC8vIGNhbiBkZWxpdmVyIHRvIGEgcmVhbCBpbmJveCwgc28gcmVmdXNlIHRvIGJyaW5nIHVwIGEgZ2F0ZSB0aGF0IGxldHMgbm9ib2R5IGluLlxuICBpZiAoZ2V0RW1haWxSdW50aW1lKCkuY29uZmlnLm1vZGUgIT09IFwic210cFwiKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgXCJlbWFpbCBpcyBub3QgY29uZmlndXJlZCBmb3IgU01UUCBkZWxpdmVyeSAtIHRoZSBPVFAgZ2F0ZSBjYW5ub3Qgc2VuZCBjb2Rlcy4gXCIgK1xuICAgICAgICBcIlNldCBTTVRQX0hPU1QvU01UUF9VU0VSL1NNVFBfUEFTU1dPUkQsIG9yIHBhc3MgLS1pbnNlY3VyZSAvIFRVTk5FTF9JTlNFQ1VSRT10cnVlIHRvIHJ1biB0aGUgdHVubmVsIG9wZW4uXCIsXG4gICAgKTtcbiAgfVxuXG4gIGxvZ2dlci5pbmZvKFwiZ2F0ZSBhcHAgcmVhZHkgKG5vIHNlcnZlcjsgcHJveHktZHJpdmVuKVwiKTtcbiAgcmV0dXJuIGhhbmRsZS5hdXRoR2F0ZSBhcyBBdXRoR2F0ZUFwaTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFFSCxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDM0MsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ3pDLE9BQU8sRUFBRSxRQUFRLEVBQXlDLE1BQU0sbUJBQW1CLENBQUM7QUFFcEYsaUZBQWlGO0FBQ2pGLE1BQU0sQ0FBQyxLQUFLLFVBQVUsWUFBWSxDQUFDLE1BQXNCO0lBQ3ZELGdGQUFnRjtJQUNoRiw4RUFBOEU7SUFDOUUsTUFBTSxPQUFPLEdBQUcsTUFBTSxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2pGLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxRQUFtQyxDQUFDO0lBQ3hELElBQUksQ0FBQyxHQUFHO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ2hFLE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogVGhlIEdBVEUgaGFsZiBvZiB0aGUgd3JhcHBlcjogYSBzZXJ2ZXItbGVzcyBBcHBLaXQgYXBwIHdob3NlIG9ubHkgam9iIGlzIHRvXG4gKiBleHBvc2UgdGhlIGBhdXRoR2F0ZWAgaGFuZGxlcnMgdGhlIHByb3h5IGNhbGxzLlxuICpcbiAqIFRoZSBpbi1wcm9jZXNzIHBsdWdpbiBwYXRoIChgYXV0aEdhdGVgIGluIHRoZSBhcHAncyBvd24gYHBsdWdpbnNgKSBoYXMgYSByZWFsXG4gKiBIVFRQIHNlcnZlciB0byBtb3VudCByb3V0ZXMgb24uIEEgd3JhcHBlciBkb2VzIG5vdCAtIHRoZSBhcHAgaXQgZnJvbnRzIGlzIGFcbiAqIHNlcGFyYXRlIHByb2Nlc3MgaXQgbXVzdCBub3QgcmVhY2ggaW50byAtIHNvIHRoZSBnYXRlJ3MgbG9naW4gcm91dGVzIGxpdmUgb25cbiAqIHRoZSBwcm94eSBpbnN0ZWFkLCBhbmQgdGhpcyBhcHAgZXhpc3RzIHB1cmVseSB0byBnaXZlIHRoZSBwbHVnaW4gdGhlIHJ1bnRpbWUgaXRcbiAqIG5lZWRzOiBhIGBDYWNoZU1hbmFnZXJgIGZvciB0aGUgb25lLXRpbWUtY29kZSBzdG9yZSBhbmQgc2lnbmluZyBrZXksIGFuZCB0aGVcbiAqIHNpYmxpbmcgYGVtYWlsYCBwbHVnaW4ncyB0cmFuc3BvcnQgZm9yIGRlbGl2ZXJpbmcgYSBjb2RlLlxuICpcbiAqIExhemlseSBpbXBvcnRlZCBieSBgY2xpLnRzYCwgc28gYGRieCB0dW5uZWwgLS1pbnNlY3VyZWAgKGFuZCBgaW5zdGFsbGAgL1xuICogYHN0YXR1c2ApIG5ldmVyIGxvYWQgQXBwS2l0LCB0aGUgRGF0YWJyaWNrcyBTREssIG9yIHRoZSBTTVRQIHN0YWNrLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBhcHBraXQgfSBmcm9tIFwiQGRieC10b29scy9hcHBraXRcIjtcbmltcG9ydCB7IGVtYWlsIH0gZnJvbSBcIkBkYngtdG9vbHMvZW1haWxcIjtcbmltcG9ydCB7IGF1dGhHYXRlLCB0eXBlIEF1dGhHYXRlQXBpLCB0eXBlIEF1dGhHYXRlQ29uZmlnIH0gZnJvbSBcIkBkYngtdG9vbHMvdHVubmVsXCI7XG5cbi8qKiBCb290IHRoZSBnYXRlIGFwcCBhbmQgcmV0dXJuIHRoZSBoYW5kbGVycyB0aGUgcHJveHkgYXV0aGVudGljYXRlcyBhZ2FpbnN0LiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHN0YXJ0R2F0ZUFwcChjb25maWc6IEF1dGhHYXRlQ29uZmlnKTogUHJvbWlzZTxBdXRoR2F0ZUFwaT4ge1xuICAvLyBObyBgc2VydmVyKClgIHBsdWdpbjogbm90aGluZyBoZXJlIGxpc3RlbnMuIGBwbHVnaW5zYCBvcmRlciBtYXR0ZXJzIC0gYGVtYWlsYFxuICAvLyByZWdpc3RlcnMgaXRzIHRyYW5zcG9ydCBiZWZvcmUgYGF1dGhHYXRlYCBsb29rcyBmb3IgYSBzaWJsaW5nIHRvIHNlbmQgd2l0aC5cbiAgY29uc3QgcGx1Z2lucyA9IGF3YWl0IGFwcGtpdC5jcmVhdGVBcHAoeyBwbHVnaW5zOiBbZW1haWwoKSwgYXV0aEdhdGUoY29uZmlnKV0gfSk7XG4gIGNvbnN0IGFwaSA9IHBsdWdpbnMuYXV0aEdhdGUgYXMgQXV0aEdhdGVBcGkgfCB1bmRlZmluZWQ7XG4gIGlmICghYXBpKSB0aHJvdyBuZXcgRXJyb3IoXCJ0aGUgYXV0aEdhdGUgcGx1Z2luIGV4cG9zZWQgbm8gYXBpXCIpO1xuICByZXR1cm4gYXBpO1xufVxuIl19

package/lib/src/cli.d.ts

@@ -1,30 +1,27 @@
 /**
- * `dbx-tools-tunnel` / `dbxt-tunnel` CLI.
+ * `dbx tunnel` - front a command with a public portr tunnel and an email-OTP gate.
  *
- * Wraps an app's start command with a public portr tunnel and an email-OTP
- * access gate. Everything after `--` is the REAL app start command:
+ * This is the WRAPPER path, and it exists for one case: a project that does not
+ * use `@dbx-tools/appkit`'s `createApp`, and therefore cannot register
+ * `tunnelInterceptor()` + the `authGate` plugin in-process. An AppKit app should
+ * still take the plugin path - one process, no proxy hop, no duplicated header
+ * handling.
  *
- *   dbxt-tunnel --subject "Here's your OTP" --allow example.com -- bun src/server.ts
+ * The wrapper claims the PUBLIC port (`DATABRICKS_APP_PORT`, the port the
+ * platform and portr route to), moves the wrapped app to a private one, and
+ * reverse-proxies between them so the gate sits in front of traffic it would
+ * otherwise have no way to intercept. Everything else is delegated: the gate
+ * config comes from `plugin.resolveAuthGateConfig`, the portr lifecycle from
+ * `portr.*` - both the same functions the in-process path uses.
  *
- * Boot sequence:
- *   1. Pick a random PRIVATE port and spawn the app command with
- *      `DATABRICKS_APP_PORT` set to it (so the app binds loopback-private). That
- *      variable name is the Databricks Apps runtime contract; the gate itself is
- *      platform-neutral and honours whatever port it finds there.
- *   2. Boot the tiny gate AppKit app (no server): inits `CacheManager` + the
- *      email transport, yields the in-process gate API.
- *   3. Start the gate PROXY on the ORIGINAL public port, forwarding to the app.
- *   4. Install + run portr pointed at the public port (when a tunnel is
- *      configured; otherwise the proxy still gates nothing and forwards).
- *
- * Supervision: the app child, portr child, and this process are tied together -
- * if ANY exits, everything comes down (concurrently-style `killOthers`).
- *
- * Options come from flags OR env; see the option definitions below.
+ * Ships no bin. `@dbx-tools/cli` mounts `buildProgram()` as `dbx tunnel` lazily,
+ * so `dbx dev` pays for none of this, and `--insecure` / `status` / `install`
+ * never load AppKit or the SMTP stack either (the gate app is behind a dynamic
+ * import).
  *
  * @module
  */
-import { CommanderError } from "commander";
+import { Command, CommanderError } from "commander";
 export { CommanderError };
-/** Parse argv and run the tunnel. */
-export declare function runCli(argv: string[]): Promise<void>;
+/** The `dbx tunnel` program. No side effects until parsed. */
+export declare function buildProgram(name?: string): Command;