@dbx-tools/cli-tunnel 0.6.59 → 0.6.85

package/lib/src/plugin.d.ts

@@ -1,147 +0,0 @@
-/**
- * `authGate()` - the AppKit plugin behind the tunnel's email-OTP gate.
- *
- * It has NO routes of its own: the tunnel PROXY (not an HTTP server) calls the
- * handlers this plugin exposes via {@link AuthGatePlugin.exports}. The plugin
- * owns the allow-list, the per-email/per-IP rate limiters, the CacheManager-backed
- * one-time-code store, and the session JWT. `createApp` (with no `server()`) is
- * used only to auto-init `CacheManager` + prime the sibling `email` transport;
- * this plugin is where the gate logic lives.
- *
- * Options come from CLI flags OR env, with sensible defaults - see
- * {@link resolveAuthGateConfig}. The one runtime dependency the plugin can't
- * resolve itself is HOW to email the code, so it takes a `sendCode` callback the
- * app wires to the email plugin.
- *
- * @module
- */
-import { Plugin, type BasePluginConfig } from "@databricks/appkit";
-import type { AuthStatus } from "@dbx-tools/shared-email";
-/** Options for the {@link authGate} plugin (all resolvable from env - see below). */
-export interface AuthGateConfig extends BasePluginConfig {
-    /** Allow-list patterns (domain / glob / `/regex/`). Empty = allow nobody. Env TUNNEL_AUTH_ALLOW. */
-    allow?: string | string[];
-    /**
-     * Subject line for the code email. Env TUNNEL_AUTH_SUBJECT.
-     *
-     * Defaults to "Your verification code". The wording of the subject and
-     * {@link message} is deliberately the conventional phrasing rather than
-     * anything branded: iOS, Gmail, Outlook, and Android all detect a one-time
-     * code from this shape and offer to autofill it, and a novel phrasing is what
-     * breaks that detection.
-     *
-     * This is the subject TEMPLATE, not the literal line sent: the code is spliced
-     * into it (`"123456 is your verification code"`) because a push notification
-     * shows only the subject and preheader, and that notification is what mobile
-     * autofill reads. See `codeEmailSubject` in `./app.ts`.
-     */
-    subject?: string;
-    /**
-     * Display name used in the code email copy. Env TUNNEL_AUTH_BRAND_NAME.
-     *
-     * Defaults to the brand context's `name` - the app's own `branding/brand.yaml`
-     * when it has one, else the dbx-tools default. Set this only to override the
-     * brand for this gate.
-     */
-    brandName?: string;
-    /**
-     * Line shown immediately above the code in the email. Env TUNNEL_AUTH_MESSAGE.
-     *
-     * Keep the code on its OWN line directly after this text - that adjacency is
-     * what the platform code-detection heuristics key on.
-     */
-    message?: string;
-    /**
-     * Session lifetime (seconds). Env TUNNEL_AUTH_SESSION_TTL. Default 2592000 (30d).
-     *
-     * Matched to the cache-backed signing key's own 30-day TTL (see
-     * `./signing-key.ts`): the cookie and the key that validates it should expire
-     * together, or one silently outlives the other.
-     */
-    sessionTtlSeconds?: number;
-    /** One-time-code lifetime (seconds). Env TUNNEL_AUTH_CODE_TTL. Default 600 (10m). */
-    codeTtlSeconds?: number;
-    /** Max verify attempts per issued code. Default 5. */
-    maxAttempts?: number;
-    /**
-     * Force-clear cutoff: every session issued BEFORE it stops verifying, so moving
-     * it forward signs everyone out. Env TUNNEL_AUTH_SESSION_CUTOFF.
-     *
-     * Anything `object.toDate` accepts: a `Date`, `2026-08-02`, an ISO instant,
-     * epoch seconds/millis, or a relative duration (`-30d`, `7 days ago`). Unset
-     * means no cutoff.
-     */
-    sessionCutoff?: string | number | Date;
-    /** Deliver a code to an address. Wired by the app to the email plugin. */
-    sendCode?: (email: string, code: string, opts: SendCodeOptions) => Promise<void>;
-}
-/** Branding/messaging passed to {@link AuthGateConfig.sendCode}. */
-export interface SendCodeOptions {
-    subject: string;
-    brandName: string;
-    message: string;
-    /**
-     * Lifetime of the code being sent, in seconds - the RESOLVED
-     * {@link AuthGateConfig.codeTtlSeconds}, so the email can state the real
-     * expiry ("This code expires in 10 minutes") instead of a vague "shortly"
-     * that drifts from the configured TTL.
-     */
-    codeTtlSeconds: number;
-}
-/** Resolved gate config with env fallbacks + defaults applied. */
-export interface ResolvedAuthGateConfig {
-    allow: string[];
-    subject: string;
-    brandName: string;
-    message: string;
-    sessionTtlSeconds: number;
-    codeTtlSeconds: number;
-    maxAttempts: number;
-    /** Force-clear cutoff in epoch ms; `0` when unset. */
-    sessionCutoffMs: number;
-}
-/** Merge {@link AuthGateConfig} over env over defaults into a resolved config. */
-export declare function resolveAuthGateConfig(config: AuthGateConfig): ResolvedAuthGateConfig;
-/** The handlers the proxy calls in-process (returned by {@link AuthGatePlugin.exports}). */
-export interface AuthGateApi {
-    /** Handle a code request. Always resolves `{ ok: true }` (anti-enumeration). */
-    request(email: string, ip: string): Promise<{
-        ok: true;
-        retryAfter?: number;
-    }>;
-    /** Handle a code verification. On success returns the session token to cookie. */
-    verify(email: string, code: string, ip: string): Promise<{
-        ok: boolean;
-        token?: string;
-        retryAfter?: number;
-    }>;
-    /** Resolve the authenticated email for a session token, or undefined. */
-    session(token: string | undefined): Promise<string | undefined>;
-    /** Session TTL in seconds (for the cookie Max-Age). */
-    readonly sessionTtlSeconds: number;
-    /** The gate status payload (`enabled` is always true when this plugin runs). */
-    status(token: string | undefined): Promise<AuthStatus>;
-}
-/** AppKit plugin owning the email-OTP gate's logic (no HTTP routes; proxy-driven). */
-export declare class AuthGatePlugin extends Plugin<AuthGateConfig> {
-    static manifest: {
-        name: "authGate";
-        displayName: string;
-        description: string;
-        stability: "beta";
-        resources: {
-            required: never[];
-            optional: never[];
-        };
-    };
-    private resolved;
-    private codes;
-    private readonly requestLimiter;
-    private readonly verifyLimiter;
-    setup(): Promise<void>;
-    exports(): AuthGateApi;
-    private handleRequest;
-    private handleVerify;
-}
-/** Factory: `authGate({ allow, subject, ... })` for an AppKit `plugins` array. */
-export declare const authGate: import("@databricks/appkit").ToPlugin<typeof AuthGatePlugin, AuthGateConfig, "authGate">;

package/lib/src/plugin.js

@@ -1,138 +0,0 @@
-/**
- * `authGate()` - the AppKit plugin behind the tunnel's email-OTP gate.
- *
- * It has NO routes of its own: the tunnel PROXY (not an HTTP server) calls the
- * handlers this plugin exposes via {@link AuthGatePlugin.exports}. The plugin
- * owns the allow-list, the per-email/per-IP rate limiters, the CacheManager-backed
- * one-time-code store, and the session JWT. `createApp` (with no `server()`) is
- * used only to auto-init `CacheManager` + prime the sibling `email` transport;
- * this plugin is where the gate logic lives.
- *
- * Options come from CLI flags OR env, with sensible defaults - see
- * {@link resolveAuthGateConfig}. The one runtime dependency the plugin can't
- * resolve itself is HOW to email the code, so it takes a `sendCode` callback the
- * app wires to the email plugin.
- *
- * @module
- */
-import { Plugin, toPlugin } from "@databricks/appkit";
-import { brand, env, log, object, string } from "@dbx-tools/shared-core";
-import { looksLikeEmail, matchesAllowlist } from "./allowlist.js";
-import { ALLOW_ENV, BRAND_NAME_ENV, CODE_TTL_ENV, MESSAGE_ENV, SESSION_TTL_ENV, SUBJECT_ENV, } from "./env.js";
-import { CodeStore, signSession, verifySession } from "./otp.js";
-import { RateLimiter } from "./rate-limit.js";
-import { KEY_TTL_SECONDS, resolveSessionCutoff, signingKey } from "./signing-key.js";
-const logger = log.logger("tunnel:auth");
-const DEFAULTS = {
-    subject: "Your verification code",
-    // The repo-wide brand context's display name, NOT a hardcoded product string:
-    // this name is what the recipient reads in the code email, so it has to be the
-    // same identity the rest of the app presents. A host with its own
-    // `branding/brand.yaml` overrides it by passing `brandName` (see
-    // {@link startGateApp}, which resolves the on-disk context); the shared default
-    // is the fallback when nothing is configured.
-    brandName: brand.defaultBrandContext.name,
-    message: "Your verification code is:",
-    // 30 days, the same window the cache-backed signing key is stored for.
-    sessionTtlSeconds: KEY_TTL_SECONDS,
-    codeTtlSeconds: 600,
-    maxAttempts: 5,
-};
-/** Merge {@link AuthGateConfig} over env over defaults into a resolved config. */
-export function resolveAuthGateConfig(config) {
-    return {
-        // Both sources are unioned rather than one overriding: a deployment-wide
-        // TUNNEL_AUTH_ALLOW and a per-invocation `--allow` should both grant access.
-        // Hence `parseList` on each rather than `env.list`, which stops at the first
-        // source that yields anything.
-        allow: [...string.parseList(config.allow), ...string.parseList(env.text(ALLOW_ENV))],
-        subject: env.string(config.subject, SUBJECT_ENV) ?? DEFAULTS.subject,
-        brandName: env.string(config.brandName, BRAND_NAME_ENV) ?? DEFAULTS.brandName,
-        message: env.string(config.message, MESSAGE_ENV) ?? DEFAULTS.message,
-        sessionTtlSeconds: env.positiveInt(config.sessionTtlSeconds, SESSION_TTL_ENV, DEFAULTS.sessionTtlSeconds),
-        codeTtlSeconds: env.positiveInt(config.codeTtlSeconds, CODE_TTL_ENV, DEFAULTS.codeTtlSeconds),
-        maxAttempts: config.maxAttempts ?? DEFAULTS.maxAttempts,
-        sessionCutoffMs: resolveSessionCutoff(config.sessionCutoff),
-    };
-}
-/** AppKit plugin owning the email-OTP gate's logic (no HTTP routes; proxy-driven). */
-export class AuthGatePlugin extends Plugin {
-    static manifest = {
-        name: "authGate",
-        displayName: "Auth Gate",
-        description: "Email one-time-password access gate for a public tunnel.",
-        stability: "beta",
-        resources: { required: [], optional: [] },
-    };
-    resolved;
-    codes;
-    // Requesting a code is email-spam-prone; verifying is a brute-force surface.
-    // Per-email AND per-IP so neither axis alone is a bypass.
-    requestLimiter = new RateLimiter(5, 15 * 60 * 1000);
-    verifyLimiter = new RateLimiter(10, 15 * 60 * 1000);
-    async setup() {
-        this.resolved = resolveAuthGateConfig(this.config);
-        this.codes = new CodeStore(this.resolved.codeTtlSeconds, this.resolved.maxAttempts);
-        // Resolve the signing key HERE rather than lazily on the first sign-in, so a
-        // cache that cannot hold it (and the resulting "sessions won't survive a
-        // restart" warning) shows up in the startup log, not hours later.
-        const { cutoffMs } = await signingKey(this.resolved.sessionCutoffMs);
-        logger.info("ready", {
-            patterns: this.resolved.allow.length,
-            sessionTtlSeconds: this.resolved.sessionTtlSeconds,
-            ...object.optional("sessionCutoff", cutoffMs > 0 ? new Date(cutoffMs).toISOString() : null),
-        });
-    }
-    exports() {
-        return {
-            sessionTtlSeconds: this.resolved.sessionTtlSeconds,
-            request: (email, ip) => this.handleRequest(email, ip),
-            verify: (email, code, ip) => this.handleVerify(email, code, ip),
-            session: (token) => verifySession(token),
-            status: async (token) => ({
-                authenticated: Boolean(await verifySession(token)),
-                email: (await verifySession(token)) ?? undefined,
-                enabled: true,
-            }),
-        };
-    }
-    async handleRequest(email, ip) {
-        const address = email.trim().toLowerCase();
-        const byIp = this.requestLimiter.hit(`ip:${ip}`);
-        const byEmail = this.requestLimiter.hit(`email:${address}`);
-        if (!byIp.allowed || !byEmail.allowed) {
-            return { ok: true, retryAfter: byIp.retryAfter ?? byEmail.retryAfter };
-        }
-        if (looksLikeEmail(address) && matchesAllowlist(address, this.resolved.allow)) {
-            const code = await this.codes.issue(address);
-            try {
-                await this.config.sendCode?.(address, code, {
-                    subject: this.resolved.subject,
-                    brandName: this.resolved.brandName,
-                    message: this.resolved.message,
-                    codeTtlSeconds: this.resolved.codeTtlSeconds,
-                });
-            }
-            catch (error) {
-                logger.warn("failed to send OTP email", { error });
-            }
-        }
-        return { ok: true };
-    }
-    async handleVerify(email, code, ip) {
-        const address = email.trim().toLowerCase();
-        const byIp = this.verifyLimiter.hit(`ip:${ip}`);
-        const byEmail = this.verifyLimiter.hit(`email:${address}`);
-        if (!byIp.allowed || !byEmail.allowed) {
-            return { ok: false, retryAfter: byIp.retryAfter ?? byEmail.retryAfter };
-        }
-        if ((await this.codes.verify(address, code.trim())) !== "ok")
-            return { ok: false };
-        this.requestLimiter.reset(`email:${address}`);
-        this.verifyLimiter.reset(`email:${address}`);
-        return { ok: true, token: await signSession(address, this.resolved.sessionTtlSeconds) };
-    }
-}
-/** Factory: `authGate({ allow, subject, ... })` for an AppKit `plugins` array. */
-export const authGate = toPlugin(AuthGatePlugin);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3BsdWdpbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7OztHQWdCRztBQUVILE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUE4QyxNQUFNLG9CQUFvQixDQUFDO0FBQ2xHLE9BQU8sRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFFekUsT0FBTyxFQUFFLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ2xFLE9BQU8sRUFDTCxTQUFTLEVBQ1QsY0FBYyxFQUNkLFlBQVksRUFDWixXQUFXLEVBQ1gsZUFBZSxFQUNmLFdBQVcsR0FDWixNQUFNLFVBQVUsQ0FBQztBQUNsQixPQUFPLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFDakUsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzlDLE9BQU8sRUFBRSxlQUFlLEVBQUUsb0JBQW9CLEVBQUUsVUFBVSxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFckYsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQztBQXdGekMsTUFBTSxRQUFRLEdBQUc7SUFDZixPQUFPLEVBQUUsd0JBQXdCO0lBQ2pDLDhFQUE4RTtJQUM5RSwrRUFBK0U7SUFDL0Usa0VBQWtFO0lBQ2xFLGlFQUFpRTtJQUNqRSxnRkFBZ0Y7SUFDaEYsOENBQThDO0lBQzlDLFNBQVMsRUFBRSxLQUFLLENBQUMsbUJBQW1CLENBQUMsSUFBSTtJQUN6QyxPQUFPLEVBQUUsNEJBQTRCO0lBQ3JDLHVFQUF1RTtJQUN2RSxpQkFBaUIsRUFBRSxlQUFlO0lBQ2xDLGNBQWMsRUFBRSxHQUFHO0lBQ25CLFdBQVcsRUFBRSxDQUFDO0NBQ2YsQ0FBQztBQUVGLGtGQUFrRjtBQUNsRixNQUFNLFVBQVUscUJBQXFCLENBQUMsTUFBc0I7SUFDMUQsT0FBTztRQUNMLHlFQUF5RTtRQUN6RSw2RUFBNkU7UUFDN0UsNkVBQTZFO1FBQzdFLCtCQUErQjtRQUMvQixLQUFLLEVBQUUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDcEYsT0FBTyxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTztRQUNwRSxTQUFTLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLGNBQWMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxTQUFTO1FBQzdFLE9BQU8sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDLElBQUksUUFBUSxDQUFDLE9BQU87UUFDcEUsaUJBQWlCLEVBQUUsR0FBRyxDQUFDLFdBQVcsQ0FDaEMsTUFBTSxDQUFDLGlCQUFpQixFQUN4QixlQUFlLEVBQ2YsUUFBUSxDQUFDLGlCQUFpQixDQUMzQjtRQUNELGNBQWMsRUFBRSxHQUFHLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxjQUFjLENBQUM7UUFDN0YsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLElBQUksUUFBUSxDQUFDLFdBQVc7UUFDdkQsZUFBZSxFQUFFLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUM7S0FDNUQsQ0FBQztBQUNKLENBQUM7QUFvQkQsc0ZBQXNGO0FBQ3RGLE1BQU0sT0FBTyxjQUFlLFNBQVEsTUFBc0I7SUFDeEQsTUFBTSxDQUFDLFFBQVEsR0FBRztRQUNoQixJQUFJLEVBQUUsVUFBVTtRQUNoQixXQUFXLEVBQUUsV0FBVztRQUN4QixXQUFXLEVBQUUsMERBQTBEO1FBQ3ZFLFNBQVMsRUFBRSxNQUFNO1FBQ2pCLFNBQVMsRUFBRSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRTtLQUNMLENBQUM7SUFFL0IsUUFBUSxDQUEwQjtJQUNsQyxLQUFLLENBQWE7SUFDMUIsNkVBQTZFO0lBQzdFLDBEQUEwRDtJQUN6QyxjQUFjLEdBQUcsSUFBSSxXQUFXLENBQUMsQ0FBQyxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDcEQsYUFBYSxHQUFHLElBQUksV0FBVyxDQUFDLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO0lBRTVELEtBQUssQ0FBQyxLQUFLO1FBQ2xCLElBQUksQ0FBQyxRQUFRLEdBQUcscUJBQXFCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ25ELElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNwRiw2RUFBNkU7UUFDN0UseUVBQXlFO1FBQ3pFLGtFQUFrRTtRQUNsRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRTtZQUNuQixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTTtZQUNwQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLGlCQUFpQjtZQUNsRCxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUFFLFFBQVEsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7U0FDNUYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVRLE9BQU87UUFDZCxPQUFPO1lBQ0wsaUJBQWlCLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxpQkFBaUI7WUFDbEQsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3JELE1BQU0sRUFBRSxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQy9ELE9BQU8sRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQztZQUN4QyxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDeEIsYUFBYSxFQUFFLE9BQU8sQ0FBQyxNQUFNLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDbEQsS0FBSyxFQUFFLENBQUMsTUFBTSxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxTQUFTO2dCQUNoRCxPQUFPLEVBQUUsSUFBSTthQUNkLENBQUM7U0FDSCxDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxhQUFhLENBQ3pCLEtBQWEsRUFDYixFQUFVO1FBRVYsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxTQUFTLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDNUQsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEMsT0FBTyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3pFLENBQUM7UUFDRCxJQUFJLGNBQWMsQ0FBQyxPQUFPLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDN0MsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFO29CQUMxQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPO29CQUM5QixTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTO29CQUNsQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPO29CQUM5QixjQUFjLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjO2lCQUM3QyxDQUFDLENBQUM7WUFDTCxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixNQUFNLENBQUMsSUFBSSxDQUFDLDBCQUEwQixFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNyRCxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEIsQ0FBQztJQUVPLEtBQUssQ0FBQyxZQUFZLENBQ3hCLEtBQWEsRUFDYixJQUFZLEVBQ1osRUFBVTtRQUVWLE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUMzQyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDaEQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsU0FBUyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQzNELElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3RDLE9BQU8sRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUMxRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssSUFBSTtZQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFDbkYsSUFBSSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM3QyxPQUFPLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsTUFBTSxXQUFXLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO0lBQzFGLENBQUM7O0FBR0gsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIGBhdXRoR2F0ZSgpYCAtIHRoZSBBcHBLaXQgcGx1Z2luIGJlaGluZCB0aGUgdHVubmVsJ3MgZW1haWwtT1RQIGdhdGUuXG4gKlxuICogSXQgaGFzIE5PIHJvdXRlcyBvZiBpdHMgb3duOiB0aGUgdHVubmVsIFBST1hZIChub3QgYW4gSFRUUCBzZXJ2ZXIpIGNhbGxzIHRoZVxuICogaGFuZGxlcnMgdGhpcyBwbHVnaW4gZXhwb3NlcyB2aWEge0BsaW5rIEF1dGhHYXRlUGx1Z2luLmV4cG9ydHN9LiBUaGUgcGx1Z2luXG4gKiBvd25zIHRoZSBhbGxvdy1saXN0LCB0aGUgcGVyLWVtYWlsL3Blci1JUCByYXRlIGxpbWl0ZXJzLCB0aGUgQ2FjaGVNYW5hZ2VyLWJhY2tlZFxuICogb25lLXRpbWUtY29kZSBzdG9yZSwgYW5kIHRoZSBzZXNzaW9uIEpXVC4gYGNyZWF0ZUFwcGAgKHdpdGggbm8gYHNlcnZlcigpYCkgaXNcbiAqIHVzZWQgb25seSB0byBhdXRvLWluaXQgYENhY2hlTWFuYWdlcmAgKyBwcmltZSB0aGUgc2libGluZyBgZW1haWxgIHRyYW5zcG9ydDtcbiAqIHRoaXMgcGx1Z2luIGlzIHdoZXJlIHRoZSBnYXRlIGxvZ2ljIGxpdmVzLlxuICpcbiAqIE9wdGlvbnMgY29tZSBmcm9tIENMSSBmbGFncyBPUiBlbnYsIHdpdGggc2Vuc2libGUgZGVmYXVsdHMgLSBzZWVcbiAqIHtAbGluayByZXNvbHZlQXV0aEdhdGVDb25maWd9LiBUaGUgb25lIHJ1bnRpbWUgZGVwZW5kZW5jeSB0aGUgcGx1Z2luIGNhbid0XG4gKiByZXNvbHZlIGl0c2VsZiBpcyBIT1cgdG8gZW1haWwgdGhlIGNvZGUsIHNvIGl0IHRha2VzIGEgYHNlbmRDb2RlYCBjYWxsYmFjayB0aGVcbiAqIGFwcCB3aXJlcyB0byB0aGUgZW1haWwgcGx1Z2luLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBQbHVnaW4sIHRvUGx1Z2luLCB0eXBlIEJhc2VQbHVnaW5Db25maWcsIHR5cGUgUGx1Z2luTWFuaWZlc3QgfSBmcm9tIFwiQGRhdGFicmlja3MvYXBwa2l0XCI7XG5pbXBvcnQgeyBicmFuZCwgZW52LCBsb2csIG9iamVjdCwgc3RyaW5nIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB0eXBlIHsgQXV0aFN0YXR1cyB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1lbWFpbFwiO1xuaW1wb3J0IHsgbG9va3NMaWtlRW1haWwsIG1hdGNoZXNBbGxvd2xpc3QgfSBmcm9tIFwiLi9hbGxvd2xpc3QudHNcIjtcbmltcG9ydCB7XG4gIEFMTE9XX0VOVixcbiAgQlJBTkRfTkFNRV9FTlYsXG4gIENPREVfVFRMX0VOVixcbiAgTUVTU0FHRV9FTlYsXG4gIFNFU1NJT05fVFRMX0VOVixcbiAgU1VCSkVDVF9FTlYsXG59IGZyb20gXCIuL2Vudi50c1wiO1xuaW1wb3J0IHsgQ29kZVN0b3JlLCBzaWduU2Vzc2lvbiwgdmVyaWZ5U2Vzc2lvbiB9IGZyb20gXCIuL290cC50c1wiO1xuaW1wb3J0IHsgUmF0ZUxpbWl0ZXIgfSBmcm9tIFwiLi9yYXRlLWxpbWl0LnRzXCI7XG5pbXBvcnQgeyBLRVlfVFRMX1NFQ09ORFMsIHJlc29sdmVTZXNzaW9uQ3V0b2ZmLCBzaWduaW5nS2V5IH0gZnJvbSBcIi4vc2lnbmluZy1rZXkudHNcIjtcblxuY29uc3QgbG9nZ2VyID0gbG9nLmxvZ2dlcihcInR1bm5lbDphdXRoXCIpO1xuXG4vKiogT3B0aW9ucyBmb3IgdGhlIHtAbGluayBhdXRoR2F0ZX0gcGx1Z2luIChhbGwgcmVzb2x2YWJsZSBmcm9tIGVudiAtIHNlZSBiZWxvdykuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhHYXRlQ29uZmlnIGV4dGVuZHMgQmFzZVBsdWdpbkNvbmZpZyB7XG4gIC8qKiBBbGxvdy1saXN0IHBhdHRlcm5zIChkb21haW4gLyBnbG9iIC8gYC9yZWdleC9gKS4gRW1wdHkgPSBhbGxvdyBub2JvZHkuIEVudiBUVU5ORUxfQVVUSF9BTExPVy4gKi9cbiAgYWxsb3c/OiBzdHJpbmcgfCBzdHJpbmdbXTtcbiAgLyoqXG4gICAqIFN1YmplY3QgbGluZSBmb3IgdGhlIGNvZGUgZW1haWwuIEVudiBUVU5ORUxfQVVUSF9TVUJKRUNULlxuICAgKlxuICAgKiBEZWZhdWx0cyB0byBcIllvdXIgdmVyaWZpY2F0aW9uIGNvZGVcIi4gVGhlIHdvcmRpbmcgb2YgdGhlIHN1YmplY3QgYW5kXG4gICAqIHtAbGluayBtZXNzYWdlfSBpcyBkZWxpYmVyYXRlbHkgdGhlIGNvbnZlbnRpb25hbCBwaHJhc2luZyByYXRoZXIgdGhhblxuICAgKiBhbnl0aGluZyBicmFuZGVkOiBpT1MsIEdtYWlsLCBPdXRsb29rLCBhbmQgQW5kcm9pZCBhbGwgZGV0ZWN0IGEgb25lLXRpbWVcbiAgICogY29kZSBmcm9tIHRoaXMgc2hhcGUgYW5kIG9mZmVyIHRvIGF1dG9maWxsIGl0LCBhbmQgYSBub3ZlbCBwaHJhc2luZyBpcyB3aGF0XG4gICAqIGJyZWFrcyB0aGF0IGRldGVjdGlvbi5cbiAgICpcbiAgICogVGhpcyBpcyB0aGUgc3ViamVjdCBURU1QTEFURSwgbm90IHRoZSBsaXRlcmFsIGxpbmUgc2VudDogdGhlIGNvZGUgaXMgc3BsaWNlZFxuICAgKiBpbnRvIGl0IChgXCIxMjM0NTYgaXMgeW91ciB2ZXJpZmljYXRpb24gY29kZVwiYCkgYmVjYXVzZSBhIHB1c2ggbm90aWZpY2F0aW9uXG4gICAqIHNob3dzIG9ubHkgdGhlIHN1YmplY3QgYW5kIHByZWhlYWRlciwgYW5kIHRoYXQgbm90aWZpY2F0aW9uIGlzIHdoYXQgbW9iaWxlXG4gICAqIGF1dG9maWxsIHJlYWRzLiBTZWUgYGNvZGVFbWFpbFN1YmplY3RgIGluIGAuL2FwcC50c2AuXG4gICAqL1xuICBzdWJqZWN0Pzogc3RyaW5nO1xuICAvKipcbiAgICogRGlzcGxheSBuYW1lIHVzZWQgaW4gdGhlIGNvZGUgZW1haWwgY29weS4gRW52IFRVTk5FTF9BVVRIX0JSQU5EX05BTUUuXG4gICAqXG4gICAqIERlZmF1bHRzIHRvIHRoZSBicmFuZCBjb250ZXh0J3MgYG5hbWVgIC0gdGhlIGFwcCdzIG93biBgYnJhbmRpbmcvYnJhbmQueWFtbGBcbiAgICogd2hlbiBpdCBoYXMgb25lLCBlbHNlIHRoZSBkYngtdG9vbHMgZGVmYXVsdC4gU2V0IHRoaXMgb25seSB0byBvdmVycmlkZSB0aGVcbiAgICogYnJhbmQgZm9yIHRoaXMgZ2F0ZS5cbiAgICovXG4gIGJyYW5kTmFtZT86IHN0cmluZztcbiAgLyoqXG4gICAqIExpbmUgc2hvd24gaW1tZWRpYXRlbHkgYWJvdmUgdGhlIGNvZGUgaW4gdGhlIGVtYWlsLiBFbnYgVFVOTkVMX0FVVEhfTUVTU0FHRS5cbiAgICpcbiAgICogS2VlcCB0aGUgY29kZSBvbiBpdHMgT1dOIGxpbmUgZGlyZWN0bHkgYWZ0ZXIgdGhpcyB0ZXh0IC0gdGhhdCBhZGphY2VuY3kgaXNcbiAgICogd2hhdCB0aGUgcGxhdGZvcm0gY29kZS1kZXRlY3Rpb24gaGV1cmlzdGljcyBrZXkgb24uXG4gICAqL1xuICBtZXNzYWdlPzogc3RyaW5nO1xuICAvKipcbiAgICogU2Vzc2lvbiBsaWZldGltZSAoc2Vjb25kcykuIEVudiBUVU5ORUxfQVVUSF9TRVNTSU9OX1RUTC4gRGVmYXVsdCAyNTkyMDAwICgzMGQpLlxuICAgKlxuICAgKiBNYXRjaGVkIHRvIHRoZSBjYWNoZS1iYWNrZWQgc2lnbmluZyBrZXkncyBvd24gMzAtZGF5IFRUTCAoc2VlXG4gICAqIGAuL3NpZ25pbmcta2V5LnRzYCk6IHRoZSBjb29raWUgYW5kIHRoZSBrZXkgdGhhdCB2YWxpZGF0ZXMgaXQgc2hvdWxkIGV4cGlyZVxuICAgKiB0b2dldGhlciwgb3Igb25lIHNpbGVudGx5IG91dGxpdmVzIHRoZSBvdGhlci5cbiAgICovXG4gIHNlc3Npb25UdGxTZWNvbmRzPzogbnVtYmVyO1xuICAvKiogT25lLXRpbWUtY29kZSBsaWZldGltZSAoc2Vjb25kcykuIEVudiBUVU5ORUxfQVVUSF9DT0RFX1RUTC4gRGVmYXVsdCA2MDAgKDEwbSkuICovXG4gIGNvZGVUdGxTZWNvbmRzPzogbnVtYmVyO1xuICAvKiogTWF4IHZlcmlmeSBhdHRlbXB0cyBwZXIgaXNzdWVkIGNvZGUuIERlZmF1bHQgNS4gKi9cbiAgbWF4QXR0ZW1wdHM/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBGb3JjZS1jbGVhciBjdXRvZmY6IGV2ZXJ5IHNlc3Npb24gaXNzdWVkIEJFRk9SRSBpdCBzdG9wcyB2ZXJpZnlpbmcsIHNvIG1vdmluZ1xuICAgKiBpdCBmb3J3YXJkIHNpZ25zIGV2ZXJ5b25lIG91dC4gRW52IFRVTk5FTF9BVVRIX1NFU1NJT05fQ1VUT0ZGLlxuICAgKlxuICAgKiBBbnl0aGluZyBgb2JqZWN0LnRvRGF0ZWAgYWNjZXB0czogYSBgRGF0ZWAsIGAyMDI2LTA4LTAyYCwgYW4gSVNPIGluc3RhbnQsXG4gICAqIGVwb2NoIHNlY29uZHMvbWlsbGlzLCBvciBhIHJlbGF0aXZlIGR1cmF0aW9uIChgLTMwZGAsIGA3IGRheXMgYWdvYCkuIFVuc2V0XG4gICAqIG1lYW5zIG5vIGN1dG9mZi5cbiAgICovXG4gIHNlc3Npb25DdXRvZmY/OiBzdHJpbmcgfCBudW1iZXIgfCBEYXRlO1xuICAvKiogRGVsaXZlciBhIGNvZGUgdG8gYW4gYWRkcmVzcy4gV2lyZWQgYnkgdGhlIGFwcCB0byB0aGUgZW1haWwgcGx1Z2luLiAqL1xuICBzZW5kQ29kZT86IChlbWFpbDogc3RyaW5nLCBjb2RlOiBzdHJpbmcsIG9wdHM6IFNlbmRDb2RlT3B0aW9ucykgPT4gUHJvbWlzZTx2b2lkPjtcbn1cblxuLyoqIEJyYW5kaW5nL21lc3NhZ2luZyBwYXNzZWQgdG8ge0BsaW5rIEF1dGhHYXRlQ29uZmlnLnNlbmRDb2RlfS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2VuZENvZGVPcHRpb25zIHtcbiAgc3ViamVjdDogc3RyaW5nO1xuICBicmFuZE5hbWU6IHN0cmluZztcbiAgbWVzc2FnZTogc3RyaW5nO1xuICAvKipcbiAgICogTGlmZXRpbWUgb2YgdGhlIGNvZGUgYmVpbmcgc2VudCwgaW4gc2Vjb25kcyAtIHRoZSBSRVNPTFZFRFxuICAgKiB7QGxpbmsgQXV0aEdhdGVDb25maWcuY29kZVR0bFNlY29uZHN9LCBzbyB0aGUgZW1haWwgY2FuIHN0YXRlIHRoZSByZWFsXG4gICAqIGV4cGlyeSAoXCJUaGlzIGNvZGUgZXhwaXJlcyBpbiAxMCBtaW51dGVzXCIpIGluc3RlYWQgb2YgYSB2YWd1ZSBcInNob3J0bHlcIlxuICAgKiB0aGF0IGRyaWZ0cyBmcm9tIHRoZSBjb25maWd1cmVkIFRUTC5cbiAgICovXG4gIGNvZGVUdGxTZWNvbmRzOiBudW1iZXI7XG59XG5cbi8qKiBSZXNvbHZlZCBnYXRlIGNvbmZpZyB3aXRoIGVudiBmYWxsYmFja3MgKyBkZWZhdWx0cyBhcHBsaWVkLiAqL1xuZXhwb3J0IGludGVyZmFjZSBSZXNvbHZlZEF1dGhHYXRlQ29uZmlnIHtcbiAgYWxsb3c6IHN0cmluZ1tdO1xuICBzdWJqZWN0OiBzdHJpbmc7XG4gIGJyYW5kTmFtZTogc3RyaW5nO1xuICBtZXNzYWdlOiBzdHJpbmc7XG4gIHNlc3Npb25UdGxTZWNvbmRzOiBudW1iZXI7XG4gIGNvZGVUdGxTZWNvbmRzOiBudW1iZXI7XG4gIG1heEF0dGVtcHRzOiBudW1iZXI7XG4gIC8qKiBGb3JjZS1jbGVhciBjdXRvZmYgaW4gZXBvY2ggbXM7IGAwYCB3aGVuIHVuc2V0LiAqL1xuICBzZXNzaW9uQ3V0b2ZmTXM6IG51bWJlcjtcbn1cblxuY29uc3QgREVGQVVMVFMgPSB7XG4gIHN1YmplY3Q6IFwiWW91ciB2ZXJpZmljYXRpb24gY29kZVwiLFxuICAvLyBUaGUgcmVwby13aWRlIGJyYW5kIGNvbnRleHQncyBkaXNwbGF5IG5hbWUsIE5PVCBhIGhhcmRjb2RlZCBwcm9kdWN0IHN0cmluZzpcbiAgLy8gdGhpcyBuYW1lIGlzIHdoYXQgdGhlIHJlY2lwaWVudCByZWFkcyBpbiB0aGUgY29kZSBlbWFpbCwgc28gaXQgaGFzIHRvIGJlIHRoZVxuICAvLyBzYW1lIGlkZW50aXR5IHRoZSByZXN0IG9mIHRoZSBhcHAgcHJlc2VudHMuIEEgaG9zdCB3aXRoIGl0cyBvd25cbiAgLy8gYGJyYW5kaW5nL2JyYW5kLnlhbWxgIG92ZXJyaWRlcyBpdCBieSBwYXNzaW5nIGBicmFuZE5hbWVgIChzZWVcbiAgLy8ge0BsaW5rIHN0YXJ0R2F0ZUFwcH0sIHdoaWNoIHJlc29sdmVzIHRoZSBvbi1kaXNrIGNvbnRleHQpOyB0aGUgc2hhcmVkIGRlZmF1bHRcbiAgLy8gaXMgdGhlIGZhbGxiYWNrIHdoZW4gbm90aGluZyBpcyBjb25maWd1cmVkLlxuICBicmFuZE5hbWU6IGJyYW5kLmRlZmF1bHRCcmFuZENvbnRleHQubmFtZSxcbiAgbWVzc2FnZTogXCJZb3VyIHZlcmlmaWNhdGlvbiBjb2RlIGlzOlwiLFxuICAvLyAzMCBkYXlzLCB0aGUgc2FtZSB3aW5kb3cgdGhlIGNhY2hlLWJhY2tlZCBzaWduaW5nIGtleSBpcyBzdG9yZWQgZm9yLlxuICBzZXNzaW9uVHRsU2Vjb25kczogS0VZX1RUTF9TRUNPTkRTLFxuICBjb2RlVHRsU2Vjb25kczogNjAwLFxuICBtYXhBdHRlbXB0czogNSxcbn07XG5cbi8qKiBNZXJnZSB7QGxpbmsgQXV0aEdhdGVDb25maWd9IG92ZXIgZW52IG92ZXIgZGVmYXVsdHMgaW50byBhIHJlc29sdmVkIGNvbmZpZy4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlQXV0aEdhdGVDb25maWcoY29uZmlnOiBBdXRoR2F0ZUNvbmZpZyk6IFJlc29sdmVkQXV0aEdhdGVDb25maWcge1xuICByZXR1cm4ge1xuICAgIC8vIEJvdGggc291cmNlcyBhcmUgdW5pb25lZCByYXRoZXIgdGhhbiBvbmUgb3ZlcnJpZGluZzogYSBkZXBsb3ltZW50LXdpZGVcbiAgICAvLyBUVU5ORUxfQVVUSF9BTExPVyBhbmQgYSBwZXItaW52b2NhdGlvbiBgLS1hbGxvd2Agc2hvdWxkIGJvdGggZ3JhbnQgYWNjZXNzLlxuICAgIC8vIEhlbmNlIGBwYXJzZUxpc3RgIG9uIGVhY2ggcmF0aGVyIHRoYW4gYGVudi5saXN0YCwgd2hpY2ggc3RvcHMgYXQgdGhlIGZpcnN0XG4gICAgLy8gc291cmNlIHRoYXQgeWllbGRzIGFueXRoaW5nLlxuICAgIGFsbG93OiBbLi4uc3RyaW5nLnBhcnNlTGlzdChjb25maWcuYWxsb3cpLCAuLi5zdHJpbmcucGFyc2VMaXN0KGVudi50ZXh0KEFMTE9XX0VOVikpXSxcbiAgICBzdWJqZWN0OiBlbnYuc3RyaW5nKGNvbmZpZy5zdWJqZWN0LCBTVUJKRUNUX0VOVikgPz8gREVGQVVMVFMuc3ViamVjdCxcbiAgICBicmFuZE5hbWU6IGVudi5zdHJpbmcoY29uZmlnLmJyYW5kTmFtZSwgQlJBTkRfTkFNRV9FTlYpID8/IERFRkFVTFRTLmJyYW5kTmFtZSxcbiAgICBtZXNzYWdlOiBlbnYuc3RyaW5nKGNvbmZpZy5tZXNzYWdlLCBNRVNTQUdFX0VOVikgPz8gREVGQVVMVFMubWVzc2FnZSxcbiAgICBzZXNzaW9uVHRsU2Vjb25kczogZW52LnBvc2l0aXZlSW50KFxuICAgICAgY29uZmlnLnNlc3Npb25UdGxTZWNvbmRzLFxuICAgICAgU0VTU0lPTl9UVExfRU5WLFxuICAgICAgREVGQVVMVFMuc2Vzc2lvblR0bFNlY29uZHMsXG4gICAgKSxcbiAgICBjb2RlVHRsU2Vjb25kczogZW52LnBvc2l0aXZlSW50KGNvbmZpZy5jb2RlVHRsU2Vjb25kcywgQ09ERV9UVExfRU5WLCBERUZBVUxUUy5jb2RlVHRsU2Vjb25kcyksXG4gICAgbWF4QXR0ZW1wdHM6IGNvbmZpZy5tYXhBdHRlbXB0cyA/PyBERUZBVUxUUy5tYXhBdHRlbXB0cyxcbiAgICBzZXNzaW9uQ3V0b2ZmTXM6IHJlc29sdmVTZXNzaW9uQ3V0b2ZmKGNvbmZpZy5zZXNzaW9uQ3V0b2ZmKSxcbiAgfTtcbn1cblxuLyoqIFRoZSBoYW5kbGVycyB0aGUgcHJveHkgY2FsbHMgaW4tcHJvY2VzcyAocmV0dXJuZWQgYnkge0BsaW5rIEF1dGhHYXRlUGx1Z2luLmV4cG9ydHN9KS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXV0aEdhdGVBcGkge1xuICAvKiogSGFuZGxlIGEgY29kZSByZXF1ZXN0LiBBbHdheXMgcmVzb2x2ZXMgYHsgb2s6IHRydWUgfWAgKGFudGktZW51bWVyYXRpb24pLiAqL1xuICByZXF1ZXN0KGVtYWlsOiBzdHJpbmcsIGlwOiBzdHJpbmcpOiBQcm9taXNlPHsgb2s6IHRydWU7IHJldHJ5QWZ0ZXI/OiBudW1iZXIgfT47XG4gIC8qKiBIYW5kbGUgYSBjb2RlIHZlcmlmaWNhdGlvbi4gT24gc3VjY2VzcyByZXR1cm5zIHRoZSBzZXNzaW9uIHRva2VuIHRvIGNvb2tpZS4gKi9cbiAgdmVyaWZ5KFxuICAgIGVtYWlsOiBzdHJpbmcsXG4gICAgY29kZTogc3RyaW5nLFxuICAgIGlwOiBzdHJpbmcsXG4gICk6IFByb21pc2U8eyBvazogYm9vbGVhbjsgdG9rZW4/OiBzdHJpbmc7IHJldHJ5QWZ0ZXI/OiBudW1iZXIgfT47XG4gIC8qKiBSZXNvbHZlIHRoZSBhdXRoZW50aWNhdGVkIGVtYWlsIGZvciBhIHNlc3Npb24gdG9rZW4sIG9yIHVuZGVmaW5lZC4gKi9cbiAgc2Vzc2lvbih0b2tlbjogc3RyaW5nIHwgdW5kZWZpbmVkKTogUHJvbWlzZTxzdHJpbmcgfCB1bmRlZmluZWQ+O1xuICAvKiogU2Vzc2lvbiBUVEwgaW4gc2Vjb25kcyAoZm9yIHRoZSBjb29raWUgTWF4LUFnZSkuICovXG4gIHJlYWRvbmx5IHNlc3Npb25UdGxTZWNvbmRzOiBudW1iZXI7XG4gIC8qKiBUaGUgZ2F0ZSBzdGF0dXMgcGF5bG9hZCAoYGVuYWJsZWRgIGlzIGFsd2F5cyB0cnVlIHdoZW4gdGhpcyBwbHVnaW4gcnVucykuICovXG4gIHN0YXR1cyh0b2tlbjogc3RyaW5nIHwgdW5kZWZpbmVkKTogUHJvbWlzZTxBdXRoU3RhdHVzPjtcbn1cblxuLyoqIEFwcEtpdCBwbHVnaW4gb3duaW5nIHRoZSBlbWFpbC1PVFAgZ2F0ZSdzIGxvZ2ljIChubyBIVFRQIHJvdXRlczsgcHJveHktZHJpdmVuKS4gKi9cbmV4cG9ydCBjbGFzcyBBdXRoR2F0ZVBsdWdpbiBleHRlbmRzIFBsdWdpbjxBdXRoR2F0ZUNvbmZpZz4ge1xuICBzdGF0aWMgbWFuaWZlc3QgPSB7XG4gICAgbmFtZTogXCJhdXRoR2F0ZVwiLFxuICAgIGRpc3BsYXlOYW1lOiBcIkF1dGggR2F0ZVwiLFxuICAgIGRlc2NyaXB0aW9uOiBcIkVtYWlsIG9uZS10aW1lLXBhc3N3b3JkIGFjY2VzcyBnYXRlIGZvciBhIHB1YmxpYyB0dW5uZWwuXCIsXG4gICAgc3RhYmlsaXR5OiBcImJldGFcIixcbiAgICByZXNvdXJjZXM6IHsgcmVxdWlyZWQ6IFtdLCBvcHRpb25hbDogW10gfSxcbiAgfSBzYXRpc2ZpZXMgUGx1Z2luTWFuaWZlc3Q8XCJhdXRoR2F0ZVwiPjtcblxuICBwcml2YXRlIHJlc29sdmVkITogUmVzb2x2ZWRBdXRoR2F0ZUNvbmZpZztcbiAgcHJpdmF0ZSBjb2RlcyE6IENvZGVTdG9yZTtcbiAgLy8gUmVxdWVzdGluZyBhIGNvZGUgaXMgZW1haWwtc3BhbS1wcm9uZTsgdmVyaWZ5aW5nIGlzIGEgYnJ1dGUtZm9yY2Ugc3VyZmFjZS5cbiAgLy8gUGVyLWVtYWlsIEFORCBwZXItSVAgc28gbmVpdGhlciBheGlzIGFsb25lIGlzIGEgYnlwYXNzLlxuICBwcml2YXRlIHJlYWRvbmx5IHJlcXVlc3RMaW1pdGVyID0gbmV3IFJhdGVMaW1pdGVyKDUsIDE1ICogNjAgKiAxMDAwKTtcbiAgcHJpdmF0ZSByZWFkb25seSB2ZXJpZnlMaW1pdGVyID0gbmV3IFJhdGVMaW1pdGVyKDEwLCAxNSAqIDYwICogMTAwMCk7XG5cbiAgb3ZlcnJpZGUgYXN5bmMgc2V0dXAoKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgdGhpcy5yZXNvbHZlZCA9IHJlc29sdmVBdXRoR2F0ZUNvbmZpZyh0aGlzLmNvbmZpZyk7XG4gICAgdGhpcy5jb2RlcyA9IG5ldyBDb2RlU3RvcmUodGhpcy5yZXNvbHZlZC5jb2RlVHRsU2Vjb25kcywgdGhpcy5yZXNvbHZlZC5tYXhBdHRlbXB0cyk7XG4gICAgLy8gUmVzb2x2ZSB0aGUgc2lnbmluZyBrZXkgSEVSRSByYXRoZXIgdGhhbiBsYXppbHkgb24gdGhlIGZpcnN0IHNpZ24taW4sIHNvIGFcbiAgICAvLyBjYWNoZSB0aGF0IGNhbm5vdCBob2xkIGl0IChhbmQgdGhlIHJlc3VsdGluZyBcInNlc3Npb25zIHdvbid0IHN1cnZpdmUgYVxuICAgIC8vIHJlc3RhcnRcIiB3YXJuaW5nKSBzaG93cyB1cCBpbiB0aGUgc3RhcnR1cCBsb2csIG5vdCBob3VycyBsYXRlci5cbiAgICBjb25zdCB7IGN1dG9mZk1zIH0gPSBhd2FpdCBzaWduaW5nS2V5KHRoaXMucmVzb2x2ZWQuc2Vzc2lvbkN1dG9mZk1zKTtcbiAgICBsb2dnZXIuaW5mbyhcInJlYWR5XCIsIHtcbiAgICAgIHBhdHRlcm5zOiB0aGlzLnJlc29sdmVkLmFsbG93Lmxlbmd0aCxcbiAgICAgIHNlc3Npb25UdGxTZWNvbmRzOiB0aGlzLnJlc29sdmVkLnNlc3Npb25UdGxTZWNvbmRzLFxuICAgICAgLi4ub2JqZWN0Lm9wdGlvbmFsKFwic2Vzc2lvbkN1dG9mZlwiLCBjdXRvZmZNcyA+IDAgPyBuZXcgRGF0ZShjdXRvZmZNcykudG9JU09TdHJpbmcoKSA6IG51bGwpLFxuICAgIH0pO1xuICB9XG5cbiAgb3ZlcnJpZGUgZXhwb3J0cygpOiBBdXRoR2F0ZUFwaSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIHNlc3Npb25UdGxTZWNvbmRzOiB0aGlzLnJlc29sdmVkLnNlc3Npb25UdGxTZWNvbmRzLFxuICAgICAgcmVxdWVzdDogKGVtYWlsLCBpcCkgPT4gdGhpcy5oYW5kbGVSZXF1ZXN0KGVtYWlsLCBpcCksXG4gICAgICB2ZXJpZnk6IChlbWFpbCwgY29kZSwgaXApID0+IHRoaXMuaGFuZGxlVmVyaWZ5KGVtYWlsLCBjb2RlLCBpcCksXG4gICAgICBzZXNzaW9uOiAodG9rZW4pID0+IHZlcmlmeVNlc3Npb24odG9rZW4pLFxuICAgICAgc3RhdHVzOiBhc3luYyAodG9rZW4pID0+ICh7XG4gICAgICAgIGF1dGhlbnRpY2F0ZWQ6IEJvb2xlYW4oYXdhaXQgdmVyaWZ5U2Vzc2lvbih0b2tlbikpLFxuICAgICAgICBlbWFpbDogKGF3YWl0IHZlcmlmeVNlc3Npb24odG9rZW4pKSA/PyB1bmRlZmluZWQsXG4gICAgICAgIGVuYWJsZWQ6IHRydWUsXG4gICAgICB9KSxcbiAgICB9O1xuICB9XG5cbiAgcHJpdmF0ZSBhc3luYyBoYW5kbGVSZXF1ZXN0KFxuICAgIGVtYWlsOiBzdHJpbmcsXG4gICAgaXA6IHN0cmluZyxcbiAgKTogUHJvbWlzZTx7IG9rOiB0cnVlOyByZXRyeUFmdGVyPzogbnVtYmVyIH0+IHtcbiAgICBjb25zdCBhZGRyZXNzID0gZW1haWwudHJpbSgpLnRvTG93ZXJDYXNlKCk7XG4gICAgY29uc3QgYnlJcCA9IHRoaXMucmVxdWVzdExpbWl0ZXIuaGl0KGBpcDoke2lwfWApO1xuICAgIGNvbnN0IGJ5RW1haWwgPSB0aGlzLnJlcXVlc3RMaW1pdGVyLmhpdChgZW1haWw6JHthZGRyZXNzfWApO1xuICAgIGlmICghYnlJcC5hbGxvd2VkIHx8ICFieUVtYWlsLmFsbG93ZWQpIHtcbiAgICAgIHJldHVybiB7IG9rOiB0cnVlLCByZXRyeUFmdGVyOiBieUlwLnJldHJ5QWZ0ZXIgPz8gYnlFbWFpbC5yZXRyeUFmdGVyIH07XG4gICAgfVxuICAgIGlmIChsb29rc0xpa2VFbWFpbChhZGRyZXNzKSAmJiBtYXRjaGVzQWxsb3dsaXN0KGFkZHJlc3MsIHRoaXMucmVzb2x2ZWQuYWxsb3cpKSB7XG4gICAgICBjb25zdCBjb2RlID0gYXdhaXQgdGhpcy5jb2Rlcy5pc3N1ZShhZGRyZXNzKTtcbiAgICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IHRoaXMuY29uZmlnLnNlbmRDb2RlPy4oYWRkcmVzcywgY29kZSwge1xuICAgICAgICAgIHN1YmplY3Q6IHRoaXMucmVzb2x2ZWQuc3ViamVjdCxcbiAgICAgICAgICBicmFuZE5hbWU6IHRoaXMucmVzb2x2ZWQuYnJhbmROYW1lLFxuICAgICAgICAgIG1lc3NhZ2U6IHRoaXMucmVzb2x2ZWQubWVzc2FnZSxcbiAgICAgICAgICBjb2RlVHRsU2Vjb25kczogdGhpcy5yZXNvbHZlZC5jb2RlVHRsU2Vjb25kcyxcbiAgICAgICAgfSk7XG4gICAgICB9IGNhdGNoIChlcnJvcikge1xuICAgICAgICBsb2dnZXIud2FybihcImZhaWxlZCB0byBzZW5kIE9UUCBlbWFpbFwiLCB7IGVycm9yIH0pO1xuICAgICAgfVxuICAgIH1cbiAgICByZXR1cm4geyBvazogdHJ1ZSB9O1xuICB9XG5cbiAgcHJpdmF0ZSBhc3luYyBoYW5kbGVWZXJpZnkoXG4gICAgZW1haWw6IHN0cmluZyxcbiAgICBjb2RlOiBzdHJpbmcsXG4gICAgaXA6IHN0cmluZyxcbiAgKTogUHJvbWlzZTx7IG9rOiBib29sZWFuOyB0b2tlbj86IHN0cmluZzsgcmV0cnlBZnRlcj86IG51bWJlciB9PiB7XG4gICAgY29uc3QgYWRkcmVzcyA9IGVtYWlsLnRyaW0oKS50b0xvd2VyQ2FzZSgpO1xuICAgIGNvbnN0IGJ5SXAgPSB0aGlzLnZlcmlmeUxpbWl0ZXIuaGl0KGBpcDoke2lwfWApO1xuICAgIGNvbnN0IGJ5RW1haWwgPSB0aGlzLnZlcmlmeUxpbWl0ZXIuaGl0KGBlbWFpbDoke2FkZHJlc3N9YCk7XG4gICAgaWYgKCFieUlwLmFsbG93ZWQgfHwgIWJ5RW1haWwuYWxsb3dlZCkge1xuICAgICAgcmV0dXJuIHsgb2s6IGZhbHNlLCByZXRyeUFmdGVyOiBieUlwLnJldHJ5QWZ0ZXIgPz8gYnlFbWFpbC5yZXRyeUFmdGVyIH07XG4gICAgfVxuICAgIGlmICgoYXdhaXQgdGhpcy5jb2Rlcy52ZXJpZnkoYWRkcmVzcywgY29kZS50cmltKCkpKSAhPT0gXCJva1wiKSByZXR1cm4geyBvazogZmFsc2UgfTtcbiAgICB0aGlzLnJlcXVlc3RMaW1pdGVyLnJlc2V0KGBlbWFpbDoke2FkZHJlc3N9YCk7XG4gICAgdGhpcy52ZXJpZnlMaW1pdGVyLnJlc2V0KGBlbWFpbDoke2FkZHJlc3N9YCk7XG4gICAgcmV0dXJuIHsgb2s6IHRydWUsIHRva2VuOiBhd2FpdCBzaWduU2Vzc2lvbihhZGRyZXNzLCB0aGlzLnJlc29sdmVkLnNlc3Npb25UdGxTZWNvbmRzKSB9O1xuICB9XG59XG5cbi8qKiBGYWN0b3J5OiBgYXV0aEdhdGUoeyBhbGxvdywgc3ViamVjdCwgLi4uIH0pYCBmb3IgYW4gQXBwS2l0IGBwbHVnaW5zYCBhcnJheS4gKi9cbmV4cG9ydCBjb25zdCBhdXRoR2F0ZSA9IHRvUGx1Z2luKEF1dGhHYXRlUGx1Z2luKTtcbiJdfQ==

package/lib/src/portr.d.ts

@@ -1,40 +0,0 @@
-/**
- * portr install + config + launch for the tunnel CLI.
- *
- * Some hosts (Databricks Apps among them) mount the container's `$HOME` read-only
- * on cold start, so the portr binary and its config are placed under a writable,
- * cwd-rooted `.home` unconditionally - it costs nothing where `$HOME` is writable.
- * The install is idempotent (the installer skips when the on-PATH binary is
- * current). The config is rendered from `TUNNEL_PUBLIC_DOMAIN` (`<subdomain>.<server>`)
- * + `PORTR_TOKEN` and points portr at the PUBLIC port (the proxy listens there).
- *
- * @module
- */
-import { spawn } from "node:child_process";
-/** Resolved portr wiring, or `undefined` when no tunnel is configured. */
-export interface PortrConfig {
-    subdomain: string;
-    server: string;
-    token: string;
-    port: number;
-}
-/**
- * Resolve portr config from `TUNNEL_PUBLIC_DOMAIN` + `PORTR_TOKEN`, or an
- * explicit `subdomain`. The domain is `<subdomain>.<server>` (e.g.
- * `demo.apps.dbx.tools`). Returns `undefined` (no tunnel) when the token or a
- * usable domain is absent.
- */
-export declare function resolvePortrConfig(opts: {
-    publicDomain?: string;
-    subdomain?: string;
-    token?: string;
-    port: number;
-}): PortrConfig | undefined;
-/** Install portr (idempotent) into the cwd-rooted home and return the child env. */
-export declare function installPortr(): NodeJS.ProcessEnv;
-/** Render `~/.portr/config.yaml` for the resolved tunnel. */
-export declare function writePortrConfig(config: PortrConfig, env: NodeJS.ProcessEnv): void;
-/** Launch `portr start` as a child process (caller supervises + kills it). */
-export declare function startPortr(config: PortrConfig, env: NodeJS.ProcessEnv): ReturnType<typeof spawn>;
-/** True when the installed portr binary path exists (post-install sanity). */
-export declare function portrInstalled(env: NodeJS.ProcessEnv): boolean;

package/lib/src/portr.js

@@ -1,93 +0,0 @@
-/**
- * portr install + config + launch for the tunnel CLI.
- *
- * Some hosts (Databricks Apps among them) mount the container's `$HOME` read-only
- * on cold start, so the portr binary and its config are placed under a writable,
- * cwd-rooted `.home` unconditionally - it costs nothing where `$HOME` is writable.
- * The install is idempotent (the installer skips when the on-PATH binary is
- * current). The config is rendered from `TUNNEL_PUBLIC_DOMAIN` (`<subdomain>.<server>`)
- * + `PORTR_TOKEN` and points portr at the PUBLIC port (the proxy listens there).
- *
- * @module
- */
-import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { delimiter, join } from "node:path";
-import { env, log } from "@dbx-tools/shared-core";
-import { PUBLIC_DOMAIN_ENV } from "./env.js";
-const logger = log.logger("tunnel:portr");
-/**
- * Resolve portr config from `TUNNEL_PUBLIC_DOMAIN` + `PORTR_TOKEN`, or an
- * explicit `subdomain`. The domain is `<subdomain>.<server>` (e.g.
- * `demo.apps.dbx.tools`). Returns `undefined` (no tunnel) when the token or a
- * usable domain is absent.
- */
-export function resolvePortrConfig(opts) {
-    // PORTR_* is upstream portr's own namespace, so it keeps its name.
-    const token = env.string(opts.token, "PORTR_TOKEN");
-    const domain = env.string(opts.publicDomain, PUBLIC_DOMAIN_ENV);
-    if (!token)
-        return undefined;
-    let subdomain = opts.subdomain;
-    let server;
-    if (domain) {
-        subdomain ??= domain.split(".")[0];
-        server = domain.slice(domain.indexOf(".") + 1);
-    }
-    server ??= env.text("PORTR_SERVER") ?? undefined;
-    if (!subdomain || !server || server === domain)
-        return undefined;
-    return { subdomain, server, token, port: opts.port };
-}
-/** The writable home portr installs + configures under (Apps `$HOME` is read-only). */
-function portrHome() {
-    const home = join(process.cwd(), ".home");
-    mkdirSync(join(home, ".portr", "bin"), { recursive: true });
-    return home;
-}
-/** Install portr (idempotent) into the cwd-rooted home and return the child env. */
-export function installPortr() {
-    const home = portrHome();
-    const env = {
-        ...process.env,
-        HOME: home,
-        PORTR_AUTO_ADD_PATH: "no",
-        PATH: [join(home, ".portr", "bin"), process.env.PATH ?? ""].join(delimiter),
-    };
-    logger.info("installing portr (idempotent)");
-    const res = spawnSync("bash", ["-c", "curl -sSf https://install.portr.dev | sh"], {
-        env,
-        stdio: "inherit",
-    });
-    if (res.status !== 0)
-        throw new Error("portr install failed");
-    return env;
-}
-/** Render `~/.portr/config.yaml` for the resolved tunnel. */
-export function writePortrConfig(config, env) {
-    const path = join(env.HOME, ".portr", "config.yaml");
-    writeFileSync(path, [
-        `server_url: ${config.server}`,
-        `ssh_url: ${config.server}:4444`,
-        `secret_key: ${config.token}`,
-        "disable_dashboard: true",
-        "disable_tui: true",
-        "tunnels:",
-        `  - name: ${config.subdomain}`,
-        `    subdomain: ${config.subdomain}`,
-        `    port: ${config.port}`,
-        "",
-    ].join("\n"));
-}
-/** Launch `portr start` as a child process (caller supervises + kills it). */
-export function startPortr(config, env) {
-    // Reclaim the subdomain from any portr left by a previous boot in this container.
-    spawnSync("pkill", ["-x", "portr"], { stdio: "ignore" });
-    logger.info(`portr tunneling https://${config.subdomain}.${config.server} -> :${config.port}`);
-    return spawn("portr", ["start"], { env, stdio: "inherit" });
-}
-/** True when the installed portr binary path exists (post-install sanity). */
-export function portrInstalled(env) {
-    return existsSync(join(env.HOME, ".portr", "bin", "portr"));
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9ydHIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcG9ydHIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7O0dBV0c7QUFFSCxPQUFPLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQ3RELE9BQU8sRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLGFBQWEsRUFBRSxNQUFNLFNBQVMsQ0FBQztBQUMvRCxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQztBQUM1QyxPQUFPLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ2xELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLFVBQVUsQ0FBQztBQUU3QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUFDO0FBVTFDOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLGtCQUFrQixDQUFDLElBS2xDO0lBQ0MsbUVBQW1FO0lBQ25FLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxhQUFhLENBQUMsQ0FBQztJQUNwRCxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNoRSxJQUFJLENBQUMsS0FBSztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQzdCLElBQUksU0FBUyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7SUFDL0IsSUFBSSxNQUEwQixDQUFDO0lBQy9CLElBQUksTUFBTSxFQUFFLENBQUM7UUFDWCxTQUFTLEtBQUssTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNuQyxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDakQsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLEtBQUssTUFBTTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ2pFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO0FBQ3ZELENBQUM7QUFFRCx1RkFBdUY7QUFDdkYsU0FBUyxTQUFTO0lBQ2hCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDMUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUQsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDO0FBRUQsb0ZBQW9GO0FBQ3BGLE1BQU0sVUFBVSxZQUFZO0lBQzFCLE1BQU0sSUFBSSxHQUFHLFNBQVMsRUFBRSxDQUFDO0lBQ3pCLE1BQU0sR0FBRyxHQUFzQjtRQUM3QixHQUFHLE9BQU8sQ0FBQyxHQUFHO1FBQ2QsSUFBSSxFQUFFLElBQUk7UUFDVixtQkFBbUIsRUFBRSxJQUFJO1FBQ3pCLElBQUksRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7S0FDNUUsQ0FBQztJQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUM3QyxNQUFNLEdBQUcsR0FBRyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLDBDQUEwQyxDQUFDLEVBQUU7UUFDaEYsR0FBRztRQUNILEtBQUssRUFBRSxTQUFTO0tBQ2pCLENBQUMsQ0FBQztJQUNILElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO0lBQzlELE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQUVELDZEQUE2RDtBQUM3RCxNQUFNLFVBQVUsZ0JBQWdCLENBQUMsTUFBbUIsRUFBRSxHQUFzQjtJQUMxRSxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLElBQUssRUFBRSxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDdEQsYUFBYSxDQUNYLElBQUksRUFDSjtRQUNFLGVBQWUsTUFBTSxDQUFDLE1BQU0sRUFBRTtRQUM5QixZQUFZLE1BQU0sQ0FBQyxNQUFNLE9BQU87UUFDaEMsZUFBZSxNQUFNLENBQUMsS0FBSyxFQUFFO1FBQzdCLHlCQUF5QjtRQUN6QixtQkFBbUI7UUFDbkIsVUFBVTtRQUNWLGFBQWEsTUFBTSxDQUFDLFNBQVMsRUFBRTtRQUMvQixrQkFBa0IsTUFBTSxDQUFDLFNBQVMsRUFBRTtRQUNwQyxhQUFhLE1BQU0sQ0FBQyxJQUFJLEVBQUU7UUFDMUIsRUFBRTtLQUNILENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUNiLENBQUM7QUFDSixDQUFDO0FBRUQsOEVBQThFO0FBQzlFLE1BQU0sVUFBVSxVQUFVLENBQUMsTUFBbUIsRUFBRSxHQUFzQjtJQUNwRSxrRkFBa0Y7SUFDbEYsU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLE1BQU0sQ0FBQyxTQUFTLElBQUksTUFBTSxDQUFDLE1BQU0sUUFBUSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUMvRixPQUFPLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztBQUM5RCxDQUFDO0FBRUQsOEVBQThFO0FBQzlFLE1BQU0sVUFBVSxjQUFjLENBQUMsR0FBc0I7SUFDbkQsT0FBTyxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFLLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0FBQy9ELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIHBvcnRyIGluc3RhbGwgKyBjb25maWcgKyBsYXVuY2ggZm9yIHRoZSB0dW5uZWwgQ0xJLlxuICpcbiAqIFNvbWUgaG9zdHMgKERhdGFicmlja3MgQXBwcyBhbW9uZyB0aGVtKSBtb3VudCB0aGUgY29udGFpbmVyJ3MgYCRIT01FYCByZWFkLW9ubHlcbiAqIG9uIGNvbGQgc3RhcnQsIHNvIHRoZSBwb3J0ciBiaW5hcnkgYW5kIGl0cyBjb25maWcgYXJlIHBsYWNlZCB1bmRlciBhIHdyaXRhYmxlLFxuICogY3dkLXJvb3RlZCBgLmhvbWVgIHVuY29uZGl0aW9uYWxseSAtIGl0IGNvc3RzIG5vdGhpbmcgd2hlcmUgYCRIT01FYCBpcyB3cml0YWJsZS5cbiAqIFRoZSBpbnN0YWxsIGlzIGlkZW1wb3RlbnQgKHRoZSBpbnN0YWxsZXIgc2tpcHMgd2hlbiB0aGUgb24tUEFUSCBiaW5hcnkgaXNcbiAqIGN1cnJlbnQpLiBUaGUgY29uZmlnIGlzIHJlbmRlcmVkIGZyb20gYFRVTk5FTF9QVUJMSUNfRE9NQUlOYCAoYDxzdWJkb21haW4+LjxzZXJ2ZXI+YClcbiAqICsgYFBPUlRSX1RPS0VOYCBhbmQgcG9pbnRzIHBvcnRyIGF0IHRoZSBQVUJMSUMgcG9ydCAodGhlIHByb3h5IGxpc3RlbnMgdGhlcmUpLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBzcGF3biwgc3Bhd25TeW5jIH0gZnJvbSBcIm5vZGU6Y2hpbGRfcHJvY2Vzc1wiO1xuaW1wb3J0IHsgZXhpc3RzU3luYywgbWtkaXJTeW5jLCB3cml0ZUZpbGVTeW5jIH0gZnJvbSBcIm5vZGU6ZnNcIjtcbmltcG9ydCB7IGRlbGltaXRlciwgam9pbiB9IGZyb20gXCJub2RlOnBhdGhcIjtcbmltcG9ydCB7IGVudiwgbG9nIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB7IFBVQkxJQ19ET01BSU5fRU5WIH0gZnJvbSBcIi4vZW52LnRzXCI7XG5cbmNvbnN0IGxvZ2dlciA9IGxvZy5sb2dnZXIoXCJ0dW5uZWw6cG9ydHJcIik7XG5cbi8qKiBSZXNvbHZlZCBwb3J0ciB3aXJpbmcsIG9yIGB1bmRlZmluZWRgIHdoZW4gbm8gdHVubmVsIGlzIGNvbmZpZ3VyZWQuICovXG5leHBvcnQgaW50ZXJmYWNlIFBvcnRyQ29uZmlnIHtcbiAgc3ViZG9tYWluOiBzdHJpbmc7XG4gIHNlcnZlcjogc3RyaW5nO1xuICB0b2tlbjogc3RyaW5nO1xuICBwb3J0OiBudW1iZXI7XG59XG5cbi8qKlxuICogUmVzb2x2ZSBwb3J0ciBjb25maWcgZnJvbSBgVFVOTkVMX1BVQkxJQ19ET01BSU5gICsgYFBPUlRSX1RPS0VOYCwgb3IgYW5cbiAqIGV4cGxpY2l0IGBzdWJkb21haW5gLiBUaGUgZG9tYWluIGlzIGA8c3ViZG9tYWluPi48c2VydmVyPmAgKGUuZy5cbiAqIGBkZW1vLmFwcHMuZGJ4LnRvb2xzYCkuIFJldHVybnMgYHVuZGVmaW5lZGAgKG5vIHR1bm5lbCkgd2hlbiB0aGUgdG9rZW4gb3IgYVxuICogdXNhYmxlIGRvbWFpbiBpcyBhYnNlbnQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlUG9ydHJDb25maWcob3B0czoge1xuICBwdWJsaWNEb21haW4/OiBzdHJpbmc7XG4gIHN1YmRvbWFpbj86IHN0cmluZztcbiAgdG9rZW4/OiBzdHJpbmc7XG4gIHBvcnQ6IG51bWJlcjtcbn0pOiBQb3J0ckNvbmZpZyB8IHVuZGVmaW5lZCB7XG4gIC8vIFBPUlRSXyogaXMgdXBzdHJlYW0gcG9ydHIncyBvd24gbmFtZXNwYWNlLCBzbyBpdCBrZWVwcyBpdHMgbmFtZS5cbiAgY29uc3QgdG9rZW4gPSBlbnYuc3RyaW5nKG9wdHMudG9rZW4sIFwiUE9SVFJfVE9LRU5cIik7XG4gIGNvbnN0IGRvbWFpbiA9IGVudi5zdHJpbmcob3B0cy5wdWJsaWNEb21haW4sIFBVQkxJQ19ET01BSU5fRU5WKTtcbiAgaWYgKCF0b2tlbikgcmV0dXJuIHVuZGVmaW5lZDtcbiAgbGV0IHN1YmRvbWFpbiA9IG9wdHMuc3ViZG9tYWluO1xuICBsZXQgc2VydmVyOiBzdHJpbmcgfCB1bmRlZmluZWQ7XG4gIGlmIChkb21haW4pIHtcbiAgICBzdWJkb21haW4gPz89IGRvbWFpbi5zcGxpdChcIi5cIilbMF07XG4gICAgc2VydmVyID0gZG9tYWluLnNsaWNlKGRvbWFpbi5pbmRleE9mKFwiLlwiKSArIDEpO1xuICB9XG4gIHNlcnZlciA/Pz0gZW52LnRleHQoXCJQT1JUUl9TRVJWRVJcIikgPz8gdW5kZWZpbmVkO1xuICBpZiAoIXN1YmRvbWFpbiB8fCAhc2VydmVyIHx8IHNlcnZlciA9PT0gZG9tYWluKSByZXR1cm4gdW5kZWZpbmVkO1xuICByZXR1cm4geyBzdWJkb21haW4sIHNlcnZlciwgdG9rZW4sIHBvcnQ6IG9wdHMucG9ydCB9O1xufVxuXG4vKiogVGhlIHdyaXRhYmxlIGhvbWUgcG9ydHIgaW5zdGFsbHMgKyBjb25maWd1cmVzIHVuZGVyIChBcHBzIGAkSE9NRWAgaXMgcmVhZC1vbmx5KS4gKi9cbmZ1bmN0aW9uIHBvcnRySG9tZSgpOiBzdHJpbmcge1xuICBjb25zdCBob21lID0gam9pbihwcm9jZXNzLmN3ZCgpLCBcIi5ob21lXCIpO1xuICBta2RpclN5bmMoam9pbihob21lLCBcIi5wb3J0clwiLCBcImJpblwiKSwgeyByZWN1cnNpdmU6IHRydWUgfSk7XG4gIHJldHVybiBob21lO1xufVxuXG4vKiogSW5zdGFsbCBwb3J0ciAoaWRlbXBvdGVudCkgaW50byB0aGUgY3dkLXJvb3RlZCBob21lIGFuZCByZXR1cm4gdGhlIGNoaWxkIGVudi4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpbnN0YWxsUG9ydHIoKTogTm9kZUpTLlByb2Nlc3NFbnYge1xuICBjb25zdCBob21lID0gcG9ydHJIb21lKCk7XG4gIGNvbnN0IGVudjogTm9kZUpTLlByb2Nlc3NFbnYgPSB7XG4gICAgLi4ucHJvY2Vzcy5lbnYsXG4gICAgSE9NRTogaG9tZSxcbiAgICBQT1JUUl9BVVRPX0FERF9QQVRIOiBcIm5vXCIsXG4gICAgUEFUSDogW2pvaW4oaG9tZSwgXCIucG9ydHJcIiwgXCJiaW5cIiksIHByb2Nlc3MuZW52LlBBVEggPz8gXCJcIl0uam9pbihkZWxpbWl0ZXIpLFxuICB9O1xuICBsb2dnZXIuaW5mbyhcImluc3RhbGxpbmcgcG9ydHIgKGlkZW1wb3RlbnQpXCIpO1xuICBjb25zdCByZXMgPSBzcGF3blN5bmMoXCJiYXNoXCIsIFtcIi1jXCIsIFwiY3VybCAtc1NmIGh0dHBzOi8vaW5zdGFsbC5wb3J0ci5kZXYgfCBzaFwiXSwge1xuICAgIGVudixcbiAgICBzdGRpbzogXCJpbmhlcml0XCIsXG4gIH0pO1xuICBpZiAocmVzLnN0YXR1cyAhPT0gMCkgdGhyb3cgbmV3IEVycm9yKFwicG9ydHIgaW5zdGFsbCBmYWlsZWRcIik7XG4gIHJldHVybiBlbnY7XG59XG5cbi8qKiBSZW5kZXIgYH4vLnBvcnRyL2NvbmZpZy55YW1sYCBmb3IgdGhlIHJlc29sdmVkIHR1bm5lbC4gKi9cbmV4cG9ydCBmdW5jdGlvbiB3cml0ZVBvcnRyQ29uZmlnKGNvbmZpZzogUG9ydHJDb25maWcsIGVudjogTm9kZUpTLlByb2Nlc3NFbnYpOiB2b2lkIHtcbiAgY29uc3QgcGF0aCA9IGpvaW4oZW52LkhPTUUhLCBcIi5wb3J0clwiLCBcImNvbmZpZy55YW1sXCIpO1xuICB3cml0ZUZpbGVTeW5jKFxuICAgIHBhdGgsXG4gICAgW1xuICAgICAgYHNlcnZlcl91cmw6ICR7Y29uZmlnLnNlcnZlcn1gLFxuICAgICAgYHNzaF91cmw6ICR7Y29uZmlnLnNlcnZlcn06NDQ0NGAsXG4gICAgICBgc2VjcmV0X2tleTogJHtjb25maWcudG9rZW59YCxcbiAgICAgIFwiZGlzYWJsZV9kYXNoYm9hcmQ6IHRydWVcIixcbiAgICAgIFwiZGlzYWJsZV90dWk6IHRydWVcIixcbiAgICAgIFwidHVubmVsczpcIixcbiAgICAgIGAgIC0gbmFtZTogJHtjb25maWcuc3ViZG9tYWlufWAsXG4gICAgICBgICAgIHN1YmRvbWFpbjogJHtjb25maWcuc3ViZG9tYWlufWAsXG4gICAgICBgICAgIHBvcnQ6ICR7Y29uZmlnLnBvcnR9YCxcbiAgICAgIFwiXCIsXG4gICAgXS5qb2luKFwiXFxuXCIpLFxuICApO1xufVxuXG4vKiogTGF1bmNoIGBwb3J0ciBzdGFydGAgYXMgYSBjaGlsZCBwcm9jZXNzIChjYWxsZXIgc3VwZXJ2aXNlcyArIGtpbGxzIGl0KS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzdGFydFBvcnRyKGNvbmZpZzogUG9ydHJDb25maWcsIGVudjogTm9kZUpTLlByb2Nlc3NFbnYpOiBSZXR1cm5UeXBlPHR5cGVvZiBzcGF3bj4ge1xuICAvLyBSZWNsYWltIHRoZSBzdWJkb21haW4gZnJvbSBhbnkgcG9ydHIgbGVmdCBieSBhIHByZXZpb3VzIGJvb3QgaW4gdGhpcyBjb250YWluZXIuXG4gIHNwYXduU3luYyhcInBraWxsXCIsIFtcIi14XCIsIFwicG9ydHJcIl0sIHsgc3RkaW86IFwiaWdub3JlXCIgfSk7XG4gIGxvZ2dlci5pbmZvKGBwb3J0ciB0dW5uZWxpbmcgaHR0cHM6Ly8ke2NvbmZpZy5zdWJkb21haW59LiR7Y29uZmlnLnNlcnZlcn0gLT4gOiR7Y29uZmlnLnBvcnR9YCk7XG4gIHJldHVybiBzcGF3bihcInBvcnRyXCIsIFtcInN0YXJ0XCJdLCB7IGVudiwgc3RkaW86IFwiaW5oZXJpdFwiIH0pO1xufVxuXG4vKiogVHJ1ZSB3aGVuIHRoZSBpbnN0YWxsZWQgcG9ydHIgYmluYXJ5IHBhdGggZXhpc3RzIChwb3N0LWluc3RhbGwgc2FuaXR5KS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBwb3J0ckluc3RhbGxlZChlbnY6IE5vZGVKUy5Qcm9jZXNzRW52KTogYm9vbGVhbiB7XG4gIHJldHVybiBleGlzdHNTeW5jKGpvaW4oZW52LkhPTUUhLCBcIi5wb3J0clwiLCBcImJpblwiLCBcInBvcnRyXCIpKTtcbn1cbiJdfQ==

package/lib/src/rate-limit.d.ts

@@ -1,35 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-/** A fixed-window rate limiter over string keys. */
-export declare class RateLimiter {
-    private readonly max;
-    private readonly windowMs;
-    private readonly windows;
-    constructor(max: number, windowMs: number);
-    /**
-     * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-     * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-     * allowed), which lets a config turn it off without special-casing callers.
-     */
-    hit(key: string, now?: number): {
-        allowed: boolean;
-        retryAfter?: number;
-    };
-    /** Forget a key (e.g. clear a caller's window after a successful verify). */
-    reset(key: string): void;
-    /** Drop every window (tests). */
-    clear(): void;
-}

package/lib/src/rate-limit.js

@@ -1,53 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-/** A fixed-window rate limiter over string keys. */
-export class RateLimiter {
-    max;
-    windowMs;
-    windows = new Map();
-    constructor(max, windowMs) {
-        this.max = max;
-        this.windowMs = windowMs;
-    }
-    /**
-     * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-     * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-     * allowed), which lets a config turn it off without special-casing callers.
-     */
-    hit(key, now = Date.now()) {
-        if (this.max <= 0)
-            return { allowed: true };
-        const existing = this.windows.get(key);
-        if (!existing || now >= existing.resetAt) {
-            this.windows.set(key, { count: 1, resetAt: now + this.windowMs });
-            return { allowed: true };
-        }
-        if (existing.count < this.max) {
-            existing.count += 1;
-            return { allowed: true };
-        }
-        return { allowed: false, retryAfter: Math.ceil((existing.resetAt - now) / 1000) };
-    }
-    /** Forget a key (e.g. clear a caller's window after a successful verify). */
-    reset(key) {
-        this.windows.delete(key);
-    }
-    /** Drop every window (tests). */
-    clear() {
-        this.windows.clear();
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmF0ZS1saW1pdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9yYXRlLWxpbWl0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBT0gsb0RBQW9EO0FBQ3BELE1BQU0sT0FBTyxXQUFXO0lBSUg7SUFDQTtJQUpGLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztJQUVyRCxZQUNtQixHQUFXLEVBQ1gsUUFBZ0I7UUFEaEIsUUFBRyxHQUFILEdBQUcsQ0FBUTtRQUNYLGFBQVEsR0FBUixRQUFRLENBQVE7SUFDaEMsQ0FBQztJQUVKOzs7O09BSUc7SUFDSCxHQUFHLENBQUMsR0FBVyxFQUFFLE1BQWMsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUN2QyxJQUFJLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQztZQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDNUMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLFFBQVEsSUFBSSxHQUFHLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3pDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLEdBQUcsR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztZQUNsRSxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO1FBQzNCLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxLQUFLLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQzlCLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFDO1lBQ3BCLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDM0IsQ0FBQztRQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sR0FBRyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3BGLENBQUM7SUFFRCw2RUFBNkU7SUFDN0UsS0FBSyxDQUFDLEdBQVc7UUFDZixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUMzQixDQUFDO0lBRUQsaUNBQWlDO0lBQ2pDLEtBQUs7UUFDSCxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3ZCLENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQSBzbWFsbCBpbi1tZW1vcnkgZml4ZWQtd2luZG93IHJhdGUgbGltaXRlciBmb3IgdGhlIGVtYWlsLU9UUCBnYXRlLlxuICpcbiAqIEtleWVkIGJ5IGFuIGFyYml0cmFyeSBzdHJpbmcgKGFuIGVtYWlsIGFkZHJlc3Mgb3IgYSBjbGllbnQgSVApLiBFYWNoIGtleSBnZXRzXG4gKiBgbWF4YCBoaXRzIHBlciBgd2luZG93TXNgOyB0aGUgd2luZG93IHJlc2V0cyBvbiBmaXJzdCB1c2UgYWZ0ZXIgaXQgZWxhcHNlcy5cbiAqIGBoaXQoKWAgcmV0dXJucyB3aGV0aGVyIHRoZSBjYWxsIGlzIGFsbG93ZWQgYW5kLCB3aGVuIG5vdCwgaG93IG1hbnkgc2Vjb25kc1xuICogdW50aWwgdGhlIHdpbmRvdyByZXNldHMgc28gYSBjYWxsZXIgY2FuIHN1cmZhY2UgYSBjb29sZG93bi5cbiAqXG4gKiBJbi1tZW1vcnkgaXMgaW50ZW50aW9uYWwgYW5kIHN1ZmZpY2llbnQgZm9yIGEgc2luZ2xlLWFwcC1pbnN0YW5jZSBnYXRlOiBhblxuICogYXBwIGJlaGluZCBhIHBvcnRyIHR1bm5lbCBzZXJ2ZXMgZnJvbSBvbmUgcHJvY2Vzcy4gSXQgaXMgTk9UIGEgZGlzdHJpYnV0ZWRcbiAqIGxpbWl0ZXI7IGEgbXVsdGktcmVwbGljYSBkZXBsb3ltZW50IHdvdWxkIG5lZWQgc2hhcmVkIHN0YXRlLiBFbnRyaWVzIGFyZVxuICogcHJ1bmVkIGxhemlseSBvbiBhY2Nlc3MsIHNvIGFuIGlkbGUga2V5IGNvc3RzIG5vdGhpbmcgYWZ0ZXIgaXRzIHdpbmRvdy5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW50ZXJmYWNlIFdpbmRvdyB7XG4gIGNvdW50OiBudW1iZXI7XG4gIHJlc2V0QXQ6IG51bWJlcjtcbn1cblxuLyoqIEEgZml4ZWQtd2luZG93IHJhdGUgbGltaXRlciBvdmVyIHN0cmluZyBrZXlzLiAqL1xuZXhwb3J0IGNsYXNzIFJhdGVMaW1pdGVyIHtcbiAgcHJpdmF0ZSByZWFkb25seSB3aW5kb3dzID0gbmV3IE1hcDxzdHJpbmcsIFdpbmRvdz4oKTtcblxuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IG1heDogbnVtYmVyLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgd2luZG93TXM6IG51bWJlcixcbiAgKSB7fVxuXG4gIC8qKlxuICAgKiBSZWNvcmQgYSBoaXQgZm9yIGBrZXlgLiBSZXR1cm5zIGB7IGFsbG93ZWQgfWAsIHBsdXMgYHJldHJ5QWZ0ZXJgIChzZWNvbmRzKVxuICAgKiB3aGVuIHRoZSBsaW1pdCBpcyBleGNlZWRlZC4gQSBsaW1pdCBvZiBgPD0gMGAgZGlzYWJsZXMgbGltaXRpbmcgKGFsd2F5c1xuICAgKiBhbGxvd2VkKSwgd2hpY2ggbGV0cyBhIGNvbmZpZyB0dXJuIGl0IG9mZiB3aXRob3V0IHNwZWNpYWwtY2FzaW5nIGNhbGxlcnMuXG4gICAqL1xuICBoaXQoa2V5OiBzdHJpbmcsIG5vdzogbnVtYmVyID0gRGF0ZS5ub3coKSk6IHsgYWxsb3dlZDogYm9vbGVhbjsgcmV0cnlBZnRlcj86IG51bWJlciB9IHtcbiAgICBpZiAodGhpcy5tYXggPD0gMCkgcmV0dXJuIHsgYWxsb3dlZDogdHJ1ZSB9O1xuICAgIGNvbnN0IGV4aXN0aW5nID0gdGhpcy53aW5kb3dzLmdldChrZXkpO1xuICAgIGlmICghZXhpc3RpbmcgfHwgbm93ID49IGV4aXN0aW5nLnJlc2V0QXQpIHtcbiAgICAgIHRoaXMud2luZG93cy5zZXQoa2V5LCB7IGNvdW50OiAxLCByZXNldEF0OiBub3cgKyB0aGlzLndpbmRvd01zIH0pO1xuICAgICAgcmV0dXJuIHsgYWxsb3dlZDogdHJ1ZSB9O1xuICAgIH1cbiAgICBpZiAoZXhpc3RpbmcuY291bnQgPCB0aGlzLm1heCkge1xuICAgICAgZXhpc3RpbmcuY291bnQgKz0gMTtcbiAgICAgIHJldHVybiB7IGFsbG93ZWQ6IHRydWUgfTtcbiAgICB9XG4gICAgcmV0dXJuIHsgYWxsb3dlZDogZmFsc2UsIHJldHJ5QWZ0ZXI6IE1hdGguY2VpbCgoZXhpc3RpbmcucmVzZXRBdCAtIG5vdykgLyAxMDAwKSB9O1xuICB9XG5cbiAgLyoqIEZvcmdldCBhIGtleSAoZS5nLiBjbGVhciBhIGNhbGxlcidzIHdpbmRvdyBhZnRlciBhIHN1Y2Nlc3NmdWwgdmVyaWZ5KS4gKi9cbiAgcmVzZXQoa2V5OiBzdHJpbmcpOiB2b2lkIHtcbiAgICB0aGlzLndpbmRvd3MuZGVsZXRlKGtleSk7XG4gIH1cblxuICAvKiogRHJvcCBldmVyeSB3aW5kb3cgKHRlc3RzKS4gKi9cbiAgY2xlYXIoKTogdm9pZCB7XG4gICAgdGhpcy53aW5kb3dzLmNsZWFyKCk7XG4gIH1cbn1cbiJdfQ==