@dbx-tools/cli 0.9.58 → 0.9.61

package/lib/src/tunnel/cli.js

@@ -0,0 +1,190 @@
+/**
+ * `dbx tunnel` - front a command with a public portr tunnel and passwordless gate.
+ *
+ * This is the WRAPPER path, and it exists for one case: a project that does not
+ * use `@dbx-tools/appkit`'s `createApp`, and therefore cannot register
+ * `tunnelInterceptor()` + the `authGate` plugin in-process. An AppKit app should
+ * still take the plugin path - one process, no proxy hop, no duplicated header
+ * handling.
+ *
+ * The wrapper claims the PUBLIC port (`DATABRICKS_APP_PORT`, the port the
+ * platform and portr route to), moves the wrapped app to a private one, and
+ * reverse-proxies between them so the gate sits in front of traffic it would
+ * otherwise have no way to intercept. Everything else is delegated: the gate
+ * config comes from `plugin.resolveAuthGateConfig`, the portr lifecycle from
+ * `portr.*` - both the same functions the in-process path uses.
+ *
+ * Ships no bin. `@dbx-tools/cli` mounts `buildProgram()` as `dbx tunnel` lazily,
+ * so `dbx dev` pays for none of this, and `--insecure` / `status` / `install`
+ * never load AppKit or the SMTP stack either (the gate app is behind a dynamic
+ * import).
+ *
+ * @module
+ */
+import { createServer } from "node:net";
+import { AppKitChildProcess } from "@dbx-tools/appkit/child-process";
+import { addArgs, parseArgs } from "@dbx-tools/cli-args";
+import { log } from "@dbx-tools/shared-core";
+import { frp, interceptor, portr } from "@dbx-tools/tunnel";
+import { Command, CommanderError } from "commander";
+import { resolveTunnelOptions, TunnelOptionsSchema } from "./options.js";
+import { startProxy } from "./proxy.js";
+export { CommanderError };
+const logger = log.logger("tunnel");
+/**
+ * A free loopback port, from the OS rather than a random guess: binding `0` and
+ * reading back what was assigned is the only way to know the port is actually
+ * available, so two tunnels can run side by side without colliding.
+ */
+function freePort() {
+    return new Promise((resolve, reject) => {
+        const probe = createServer();
+        probe.on("error", reject);
+        probe.listen(0, "127.0.0.1", () => {
+            const address = probe.address();
+            const port = typeof address === "object" && address ? address.port : 0;
+            probe.close(() => (port > 0 ? resolve(port) : reject(new Error("no free port"))));
+        });
+    });
+}
+/**
+ * Tie the wrapper's lifetime to its children's, in both directions: a child that
+ * exits takes the wrapper down with its code, and a signal to the wrapper is
+ * forwarded before it leaves. Without this a crashed app leaves a portr tunnel
+ * serving a dead port, which looks like a hang rather than a failure.
+ */
+function supervise(children) {
+    let stopping = false;
+    const stop = (code) => {
+        if (stopping)
+            return;
+        stopping = true;
+        void Promise.allSettled(children.map((child) => child.shutdown())).then(() => {
+            process.exit(code);
+        });
+    };
+    for (const child of children) {
+        void child.process?.on("exit", (code) => stop(code ?? 1));
+    }
+    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+        process.on(signal, () => stop(0));
+    }
+}
+async function run(raw, command) {
+    const [executable, ...args] = command;
+    const resolved = resolveTunnelOptions(raw);
+    const children = [];
+    // Two upstream modes:
+    //   - WRAP: a command after `--`. The wrapper spawns it on a private loopback
+    //     port and is the only thing that talks to it.
+    //   - ATTACH: no command, but `--app-port` names an already-running upstream
+    //     (e.g. a local reverse proxy). The gate fronts it without spawning a
+    //     child. This is what lets the gate sit on an interface in front of a
+    //     separately-supervised stack.
+    let appPort;
+    if (executable) {
+        appPort = resolved.appPort ?? (await freePort());
+        const app = new AppKitChildProcess([
+            executable,
+            args,
+            {
+                env: {
+                    ...process.env,
+                    DATABRICKS_APP_PORT: String(appPort),
+                    PORT: String(appPort),
+                    HOST: "127.0.0.1",
+                },
+                stdin: "inherit",
+                stdout: "inherit",
+                stderr: "inherit",
+            },
+        ], { gracefulTimeoutMs: 10_000 });
+        void app.start();
+        children.push(app);
+    }
+    else if (resolved.appPort) {
+        appPort = resolved.appPort;
+        logger.info("attaching gate to existing upstream", { appPort });
+    }
+    else {
+        throw new CommanderError(1, "tunnel.no-upstream", "no command given (pass it after `--`) and no --app-port to attach to");
+    }
+    // Dynamic import: the gate is the only thing here that needs AppKit + SMTP, so
+    // an `--insecure` run never loads either.
+    const gate = resolved.gate.insecure
+        ? undefined
+        : await (await import("./app.js")).startGateApp({
+            ...resolved.gateConfig,
+            publicDomain: resolved.gate.publicDomain ?? `localhost:${resolved.publicPort}`,
+        });
+    if (!gate)
+        logger.warn("running OPEN - no gate is in front of this tunnel");
+    await startProxy({
+        publicPort: resolved.publicPort,
+        appPort,
+        gate,
+        forwardHeaders: resolved.gate.forwardHeaders,
+        gatePaths: resolved.gate.gatePaths,
+        brandName: resolved.gate.brandName,
+        bindHosts: resolved.bindHosts,
+    });
+    if ((resolved.transport === "portr" || resolved.transport === "both") && resolved.portr) {
+        const portrEnv = await portr.installPortr();
+        await portr.writePortrConfig(resolved.portr, portrEnv);
+        children.push(await portr.startPortr(resolved.portr, portrEnv));
+    }
+    if ((resolved.transport === "frp" || resolved.transport === "both") && resolved.frp) {
+        const frpEnv = await frp.installFrp();
+        const configPath = await frp.writeFrpConfig(resolved.frp, frpEnv);
+        children.push(frp.startFrp(resolved.frp, frpEnv, configPath));
+    }
+    const activeTunnelCount = children.length - (executable ? 1 : 0);
+    if (!activeTunnelCount) {
+        logger.info("no selected public tunnel is configured", {
+            transport: resolved.transport,
+            publicPort: resolved.publicPort,
+        });
+    }
+    supervise(children);
+}
+/** The `dbx tunnel` program. No side effects until parsed. */
+export function buildProgram(name = "dbx tunnel") {
+    const program = addArgs(new Command()
+        .name(name)
+        .description("Front a command with a public tunnel and passwordless auth"), TunnelOptionsSchema);
+    // `run` is the DEFAULT action as well as a named subcommand, preserving the old
+    // wrapper's ergonomics (`dbx tunnel --allow x -- bun src/server.ts`) while
+    // leaving somewhere for `status` and `install` to live.
+    program
+        .argument("[command...]", "the command to wrap, after `--`")
+        .action(async (command) => {
+        await run(parseArgs(program, TunnelOptionsSchema), command);
+    });
+    const runCommand = addArgs(program.command("run").description("Wrap a command (the default action)"), TunnelOptionsSchema);
+    runCommand
+        .argument("<command...>", "the command to wrap, after `--`")
+        .action(async (command) => {
+        await run(parseArgs(runCommand, TunnelOptionsSchema), command);
+    });
+    // Worth its own command: the most common failure is a tunnel that silently
+    // does nothing because no token or domain resolved, and this prints exactly
+    // what would happen without starting anything.
+    const statusCommand = addArgs(program.command("status").description("Resolve the configuration and print it"), TunnelOptionsSchema);
+    statusCommand.action(() => {
+        const resolved = resolveTunnelOptions(parseArgs(statusCommand, TunnelOptionsSchema));
+        process.stdout.write(`${JSON.stringify(resolved, null, 2)}\n`);
+    });
+    program
+        .command("install")
+        .argument("[transport]", "portr, frp, or both", "portr")
+        .description("Install public tunnel client binaries and exit")
+        .action(async (transport) => {
+        const parsed = interceptor.TunnelTransportSchema.parse(transport);
+        if (parsed === "portr" || parsed === "both")
+            await portr.installPortr();
+        if (parsed === "frp" || parsed === "both")
+            await frp.installFrp();
+    });
+    return program;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3R1bm5lbC9jbGkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FzQkc7QUFFSCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3JFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDekQsT0FBTyxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzdDLE9BQU8sRUFBRSxHQUFHLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQzVELE9BQU8sRUFBRSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sV0FBVyxDQUFDO0FBRXBELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxtQkFBbUIsRUFBc0IsTUFBTSxjQUFjLENBQUM7QUFDN0YsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUV4QyxPQUFPLEVBQUUsY0FBYyxFQUFFLENBQUM7QUFFMUIsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVwQzs7OztHQUlHO0FBQ0gsU0FBUyxRQUFRO0lBQ2YsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtRQUNyQyxNQUFNLEtBQUssR0FBRyxZQUFZLEVBQUUsQ0FBQztRQUM3QixLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUMxQixLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsR0FBRyxFQUFFO1lBQ2hDLE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNoQyxNQUFNLElBQUksR0FBRyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdkUsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3BGLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxTQUFTLFNBQVMsQ0FBQyxRQUF1QztJQUN4RCxJQUFJLFFBQVEsR0FBRyxLQUFLLENBQUM7SUFDckIsTUFBTSxJQUFJLEdBQUcsQ0FBQyxJQUFZLEVBQVEsRUFBRTtRQUNsQyxJQUFJLFFBQVE7WUFBRSxPQUFPO1FBQ3JCLFFBQVEsR0FBRyxJQUFJLENBQUM7UUFDaEIsS0FBSyxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtZQUMzRSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3JCLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUM3QixLQUFLLEtBQUssQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxLQUFLLE1BQU0sTUFBTSxJQUFJLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQVUsRUFBRSxDQUFDO1FBQzlELE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7QUFDSCxDQUFDO0FBRUQsS0FBSyxVQUFVLEdBQUcsQ0FBQyxHQUFrQixFQUFFLE9BQTBCO0lBQy9ELE1BQU0sQ0FBQyxVQUFVLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUM7SUFDdEMsTUFBTSxRQUFRLEdBQUcsb0JBQW9CLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDM0MsTUFBTSxRQUFRLEdBQXlCLEVBQUUsQ0FBQztJQUUxQyxzQkFBc0I7SUFDdEIsOEVBQThFO0lBQzlFLG1EQUFtRDtJQUNuRCw2RUFBNkU7SUFDN0UsMEVBQTBFO0lBQzFFLDBFQUEwRTtJQUMxRSxtQ0FBbUM7SUFDbkMsSUFBSSxPQUFlLENBQUM7SUFDcEIsSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUNmLE9BQU8sR0FBRyxRQUFRLENBQUMsT0FBTyxJQUFJLENBQUMsTUFBTSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQ2pELE1BQU0sR0FBRyxHQUFHLElBQUksa0JBQWtCLENBQ2hDO1lBQ0UsVUFBVTtZQUNWLElBQUk7WUFDSjtnQkFDRSxHQUFHLEVBQUU7b0JBQ0gsR0FBRyxPQUFPLENBQUMsR0FBRztvQkFDZCxtQkFBbUIsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDO29CQUNwQyxJQUFJLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQztvQkFDckIsSUFBSSxFQUFFLFdBQVc7aUJBQ2xCO2dCQUNELEtBQUssRUFBRSxTQUFTO2dCQUNoQixNQUFNLEVBQUUsU0FBUztnQkFDakIsTUFBTSxFQUFFLFNBQVM7YUFDbEI7U0FDRixFQUNELEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLENBQzlCLENBQUM7UUFDRixLQUFLLEdBQUcsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNqQixRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3JCLENBQUM7U0FBTSxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUM1QixPQUFPLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQztRQUMzQixNQUFNLENBQUMsSUFBSSxDQUFDLHFDQUFxQyxFQUFFLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sSUFBSSxjQUFjLENBQ3RCLENBQUMsRUFDRCxvQkFBb0IsRUFDcEIsc0VBQXNFLENBQ3ZFLENBQUM7SUFDSixDQUFDO0lBRUQsK0VBQStFO0lBQy9FLDBDQUEwQztJQUMxQyxNQUFNLElBQUksR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVE7UUFDakMsQ0FBQyxDQUFDLFNBQVM7UUFDWCxDQUFDLENBQUMsTUFBTSxDQUNKLE1BQU0sTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUN6QixDQUFDLFlBQVksQ0FBQztZQUNiLEdBQUcsUUFBUSxDQUFDLFVBQVU7WUFDdEIsWUFBWSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxJQUFJLGFBQWEsUUFBUSxDQUFDLFVBQVUsRUFBRTtTQUMvRSxDQUFDLENBQUM7SUFDUCxJQUFJLENBQUMsSUFBSTtRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUU1RSxNQUFNLFVBQVUsQ0FBQztRQUNmLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVTtRQUMvQixPQUFPO1FBQ1AsSUFBSTtRQUNKLGNBQWMsRUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLGNBQWM7UUFDNUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUztRQUNsQyxTQUFTLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTO1FBQ2xDLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUztLQUM5QixDQUFDLENBQUM7SUFFSCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDeEYsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDNUMsTUFBTSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztRQUN2RCxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxJQUFJLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNwRixNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUN0QyxNQUFNLFVBQVUsR0FBRyxNQUFNLEdBQUcsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNsRSxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsTUFBTSxpQkFBaUIsR0FBRyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sQ0FBQyxJQUFJLENBQUMseUNBQXlDLEVBQUU7WUFDckQsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTO1lBQzdCLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVTtTQUNoQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ3RCLENBQUM7QUFFRCw4REFBOEQ7QUFDOUQsTUFBTSxVQUFVLFlBQVksQ0FBQyxJQUFJLEdBQUcsWUFBWTtJQUM5QyxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQ3JCLElBQUksT0FBTyxFQUFFO1NBQ1YsSUFBSSxDQUFDLElBQUksQ0FBQztTQUNWLFdBQVcsQ0FBQyw0REFBNEQsQ0FBQyxFQUM1RSxtQkFBbUIsQ0FDcEIsQ0FBQztJQUVGLGdGQUFnRjtJQUNoRiwyRUFBMkU7SUFDM0Usd0RBQXdEO0lBQ3hELE9BQU87U0FDSixRQUFRLENBQUMsY0FBYyxFQUFFLGlDQUFpQyxDQUFDO1NBQzNELE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBaUIsRUFBRSxFQUFFO1FBQ2xDLE1BQU0sR0FBRyxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM5RCxDQUFDLENBQUMsQ0FBQztJQUVMLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FDeEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxXQUFXLENBQUMscUNBQXFDLENBQUMsRUFDekUsbUJBQW1CLENBQ3BCLENBQUM7SUFDRixVQUFVO1NBQ1AsUUFBUSxDQUFDLGNBQWMsRUFBRSxpQ0FBaUMsQ0FBQztTQUMzRCxNQUFNLENBQUMsS0FBSyxFQUFFLE9BQWlCLEVBQUUsRUFBRTtRQUNsQyxNQUFNLEdBQUcsQ0FBQyxTQUFTLENBQUMsVUFBVSxFQUFFLG1CQUFtQixDQUFDLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDakUsQ0FBQyxDQUFDLENBQUM7SUFFTCwyRUFBMkU7SUFDM0UsNEVBQTRFO0lBQzVFLCtDQUErQztJQUMvQyxNQUFNLGFBQWEsR0FBRyxPQUFPLENBQzNCLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsV0FBVyxDQUFDLHdDQUF3QyxDQUFDLEVBQy9FLG1CQUFtQixDQUNwQixDQUFDO0lBQ0YsYUFBYSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUU7UUFDeEIsTUFBTSxRQUFRLEdBQUcsb0JBQW9CLENBQUMsU0FBUyxDQUFDLGFBQWEsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDLENBQUM7UUFDckYsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2pFLENBQUMsQ0FBQyxDQUFDO0lBRUgsT0FBTztTQUNKLE9BQU8sQ0FBQyxTQUFTLENBQUM7U0FDbEIsUUFBUSxDQUFDLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxPQUFPLENBQUM7U0FDdkQsV0FBVyxDQUFDLGdEQUFnRCxDQUFDO1NBQzdELE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBaUIsRUFBRSxFQUFFO1FBQ2xDLE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxxQkFBcUIsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDbEUsSUFBSSxNQUFNLEtBQUssT0FBTyxJQUFJLE1BQU0sS0FBSyxNQUFNO1lBQUUsTUFBTSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDeEUsSUFBSSxNQUFNLEtBQUssS0FBSyxJQUFJLE1BQU0sS0FBSyxNQUFNO1lBQUUsTUFBTSxHQUFHLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDcEUsQ0FBQyxDQUFDLENBQUM7SUFFTCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBgZGJ4IHR1bm5lbGAgLSBmcm9udCBhIGNvbW1hbmQgd2l0aCBhIHB1YmxpYyBwb3J0ciB0dW5uZWwgYW5kIHBhc3N3b3JkbGVzcyBnYXRlLlxuICpcbiAqIFRoaXMgaXMgdGhlIFdSQVBQRVIgcGF0aCwgYW5kIGl0IGV4aXN0cyBmb3Igb25lIGNhc2U6IGEgcHJvamVjdCB0aGF0IGRvZXMgbm90XG4gKiB1c2UgYEBkYngtdG9vbHMvYXBwa2l0YCdzIGBjcmVhdGVBcHBgLCBhbmQgdGhlcmVmb3JlIGNhbm5vdCByZWdpc3RlclxuICogYHR1bm5lbEludGVyY2VwdG9yKClgICsgdGhlIGBhdXRoR2F0ZWAgcGx1Z2luIGluLXByb2Nlc3MuIEFuIEFwcEtpdCBhcHAgc2hvdWxkXG4gKiBzdGlsbCB0YWtlIHRoZSBwbHVnaW4gcGF0aCAtIG9uZSBwcm9jZXNzLCBubyBwcm94eSBob3AsIG5vIGR1cGxpY2F0ZWQgaGVhZGVyXG4gKiBoYW5kbGluZy5cbiAqXG4gKiBUaGUgd3JhcHBlciBjbGFpbXMgdGhlIFBVQkxJQyBwb3J0IChgREFUQUJSSUNLU19BUFBfUE9SVGAsIHRoZSBwb3J0IHRoZVxuICogcGxhdGZvcm0gYW5kIHBvcnRyIHJvdXRlIHRvKSwgbW92ZXMgdGhlIHdyYXBwZWQgYXBwIHRvIGEgcHJpdmF0ZSBvbmUsIGFuZFxuICogcmV2ZXJzZS1wcm94aWVzIGJldHdlZW4gdGhlbSBzbyB0aGUgZ2F0ZSBzaXRzIGluIGZyb250IG9mIHRyYWZmaWMgaXQgd291bGRcbiAqIG90aGVyd2lzZSBoYXZlIG5vIHdheSB0byBpbnRlcmNlcHQuIEV2ZXJ5dGhpbmcgZWxzZSBpcyBkZWxlZ2F0ZWQ6IHRoZSBnYXRlXG4gKiBjb25maWcgY29tZXMgZnJvbSBgcGx1Z2luLnJlc29sdmVBdXRoR2F0ZUNvbmZpZ2AsIHRoZSBwb3J0ciBsaWZlY3ljbGUgZnJvbVxuICogYHBvcnRyLipgIC0gYm90aCB0aGUgc2FtZSBmdW5jdGlvbnMgdGhlIGluLXByb2Nlc3MgcGF0aCB1c2VzLlxuICpcbiAqIFNoaXBzIG5vIGJpbi4gYEBkYngtdG9vbHMvY2xpYCBtb3VudHMgYGJ1aWxkUHJvZ3JhbSgpYCBhcyBgZGJ4IHR1bm5lbGAgbGF6aWx5LFxuICogc28gYGRieCBkZXZgIHBheXMgZm9yIG5vbmUgb2YgdGhpcywgYW5kIGAtLWluc2VjdXJlYCAvIGBzdGF0dXNgIC8gYGluc3RhbGxgXG4gKiBuZXZlciBsb2FkIEFwcEtpdCBvciB0aGUgU01UUCBzdGFjayBlaXRoZXIgKHRoZSBnYXRlIGFwcCBpcyBiZWhpbmQgYSBkeW5hbWljXG4gKiBpbXBvcnQpLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBjcmVhdGVTZXJ2ZXIgfSBmcm9tIFwibm9kZTpuZXRcIjtcbmltcG9ydCB7IEFwcEtpdENoaWxkUHJvY2VzcyB9IGZyb20gXCJAZGJ4LXRvb2xzL2FwcGtpdC9jaGlsZC1wcm9jZXNzXCI7XG5pbXBvcnQgeyBhZGRBcmdzLCBwYXJzZUFyZ3MgfSBmcm9tIFwiQGRieC10b29scy9jbGktYXJnc1wiO1xuaW1wb3J0IHsgbG9nIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB7IGZycCwgaW50ZXJjZXB0b3IsIHBvcnRyIH0gZnJvbSBcIkBkYngtdG9vbHMvdHVubmVsXCI7XG5pbXBvcnQgeyBDb21tYW5kLCBDb21tYW5kZXJFcnJvciB9IGZyb20gXCJjb21tYW5kZXJcIjtcblxuaW1wb3J0IHsgcmVzb2x2ZVR1bm5lbE9wdGlvbnMsIFR1bm5lbE9wdGlvbnNTY2hlbWEsIHR5cGUgVHVubmVsT3B0aW9ucyB9IGZyb20gXCIuL29wdGlvbnMudHNcIjtcbmltcG9ydCB7IHN0YXJ0UHJveHkgfSBmcm9tIFwiLi9wcm94eS50c1wiO1xuXG5leHBvcnQgeyBDb21tYW5kZXJFcnJvciB9O1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwidHVubmVsXCIpO1xuXG4vKipcbiAqIEEgZnJlZSBsb29wYmFjayBwb3J0LCBmcm9tIHRoZSBPUyByYXRoZXIgdGhhbiBhIHJhbmRvbSBndWVzczogYmluZGluZyBgMGAgYW5kXG4gKiByZWFkaW5nIGJhY2sgd2hhdCB3YXMgYXNzaWduZWQgaXMgdGhlIG9ubHkgd2F5IHRvIGtub3cgdGhlIHBvcnQgaXMgYWN0dWFsbHlcbiAqIGF2YWlsYWJsZSwgc28gdHdvIHR1bm5lbHMgY2FuIHJ1biBzaWRlIGJ5IHNpZGUgd2l0aG91dCBjb2xsaWRpbmcuXG4gKi9cbmZ1bmN0aW9uIGZyZWVQb3J0KCk6IFByb21pc2U8bnVtYmVyPiB7XG4gIHJldHVybiBuZXcgUHJvbWlzZSgocmVzb2x2ZSwgcmVqZWN0KSA9PiB7XG4gICAgY29uc3QgcHJvYmUgPSBjcmVhdGVTZXJ2ZXIoKTtcbiAgICBwcm9iZS5vbihcImVycm9yXCIsIHJlamVjdCk7XG4gICAgcHJvYmUubGlzdGVuKDAsIFwiMTI3LjAuMC4xXCIsICgpID0+IHtcbiAgICAgIGNvbnN0IGFkZHJlc3MgPSBwcm9iZS5hZGRyZXNzKCk7XG4gICAgICBjb25zdCBwb3J0ID0gdHlwZW9mIGFkZHJlc3MgPT09IFwib2JqZWN0XCIgJiYgYWRkcmVzcyA/IGFkZHJlc3MucG9ydCA6IDA7XG4gICAgICBwcm9iZS5jbG9zZSgoKSA9PiAocG9ydCA+IDAgPyByZXNvbHZlKHBvcnQpIDogcmVqZWN0KG5ldyBFcnJvcihcIm5vIGZyZWUgcG9ydFwiKSkpKTtcbiAgICB9KTtcbiAgfSk7XG59XG5cbi8qKlxuICogVGllIHRoZSB3cmFwcGVyJ3MgbGlmZXRpbWUgdG8gaXRzIGNoaWxkcmVuJ3MsIGluIGJvdGggZGlyZWN0aW9uczogYSBjaGlsZCB0aGF0XG4gKiBleGl0cyB0YWtlcyB0aGUgd3JhcHBlciBkb3duIHdpdGggaXRzIGNvZGUsIGFuZCBhIHNpZ25hbCB0byB0aGUgd3JhcHBlciBpc1xuICogZm9yd2FyZGVkIGJlZm9yZSBpdCBsZWF2ZXMuIFdpdGhvdXQgdGhpcyBhIGNyYXNoZWQgYXBwIGxlYXZlcyBhIHBvcnRyIHR1bm5lbFxuICogc2VydmluZyBhIGRlYWQgcG9ydCwgd2hpY2ggbG9va3MgbGlrZSBhIGhhbmcgcmF0aGVyIHRoYW4gYSBmYWlsdXJlLlxuICovXG5mdW5jdGlvbiBzdXBlcnZpc2UoY2hpbGRyZW46IHJlYWRvbmx5IEFwcEtpdENoaWxkUHJvY2Vzc1tdKTogdm9pZCB7XG4gIGxldCBzdG9wcGluZyA9IGZhbHNlO1xuICBjb25zdCBzdG9wID0gKGNvZGU6IG51bWJlcik6IHZvaWQgPT4ge1xuICAgIGlmIChzdG9wcGluZykgcmV0dXJuO1xuICAgIHN0b3BwaW5nID0gdHJ1ZTtcbiAgICB2b2lkIFByb21pc2UuYWxsU2V0dGxlZChjaGlsZHJlbi5tYXAoKGNoaWxkKSA9PiBjaGlsZC5zaHV0ZG93bigpKSkudGhlbigoKSA9PiB7XG4gICAgICBwcm9jZXNzLmV4aXQoY29kZSk7XG4gICAgfSk7XG4gIH07XG4gIGZvciAoY29uc3QgY2hpbGQgb2YgY2hpbGRyZW4pIHtcbiAgICB2b2lkIGNoaWxkLnByb2Nlc3M/Lm9uKFwiZXhpdFwiLCAoY29kZSkgPT4gc3RvcChjb2RlID8/IDEpKTtcbiAgfVxuICBmb3IgKGNvbnN0IHNpZ25hbCBvZiBbXCJTSUdURVJNXCIsIFwiU0lHSU5UXCIsIFwiU0lHSFVQXCJdIGFzIGNvbnN0KSB7XG4gICAgcHJvY2Vzcy5vbihzaWduYWwsICgpID0+IHN0b3AoMCkpO1xuICB9XG59XG5cbmFzeW5jIGZ1bmN0aW9uIHJ1bihyYXc6IFR1bm5lbE9wdGlvbnMsIGNvbW1hbmQ6IHJlYWRvbmx5IHN0cmluZ1tdKTogUHJvbWlzZTx2b2lkPiB7XG4gIGNvbnN0IFtleGVjdXRhYmxlLCAuLi5hcmdzXSA9IGNvbW1hbmQ7XG4gIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZVR1bm5lbE9wdGlvbnMocmF3KTtcbiAgY29uc3QgY2hpbGRyZW46IEFwcEtpdENoaWxkUHJvY2Vzc1tdID0gW107XG5cbiAgLy8gVHdvIHVwc3RyZWFtIG1vZGVzOlxuICAvLyAgIC0gV1JBUDogYSBjb21tYW5kIGFmdGVyIGAtLWAuIFRoZSB3cmFwcGVyIHNwYXducyBpdCBvbiBhIHByaXZhdGUgbG9vcGJhY2tcbiAgLy8gICAgIHBvcnQgYW5kIGlzIHRoZSBvbmx5IHRoaW5nIHRoYXQgdGFsa3MgdG8gaXQuXG4gIC8vICAgLSBBVFRBQ0g6IG5vIGNvbW1hbmQsIGJ1dCBgLS1hcHAtcG9ydGAgbmFtZXMgYW4gYWxyZWFkeS1ydW5uaW5nIHVwc3RyZWFtXG4gIC8vICAgICAoZS5nLiBhIGxvY2FsIHJldmVyc2UgcHJveHkpLiBUaGUgZ2F0ZSBmcm9udHMgaXQgd2l0aG91dCBzcGF3bmluZyBhXG4gIC8vICAgICBjaGlsZC4gVGhpcyBpcyB3aGF0IGxldHMgdGhlIGdhdGUgc2l0IG9uIGFuIGludGVyZmFjZSBpbiBmcm9udCBvZiBhXG4gIC8vICAgICBzZXBhcmF0ZWx5LXN1cGVydmlzZWQgc3RhY2suXG4gIGxldCBhcHBQb3J0OiBudW1iZXI7XG4gIGlmIChleGVjdXRhYmxlKSB7XG4gICAgYXBwUG9ydCA9IHJlc29sdmVkLmFwcFBvcnQgPz8gKGF3YWl0IGZyZWVQb3J0KCkpO1xuICAgIGNvbnN0IGFwcCA9IG5ldyBBcHBLaXRDaGlsZFByb2Nlc3MoXG4gICAgICBbXG4gICAgICAgIGV4ZWN1dGFibGUsXG4gICAgICAgIGFyZ3MsXG4gICAgICAgIHtcbiAgICAgICAgICBlbnY6IHtcbiAgICAgICAgICAgIC4uLnByb2Nlc3MuZW52LFxuICAgICAgICAgICAgREFUQUJSSUNLU19BUFBfUE9SVDogU3RyaW5nKGFwcFBvcnQpLFxuICAgICAgICAgICAgUE9SVDogU3RyaW5nKGFwcFBvcnQpLFxuICAgICAgICAgICAgSE9TVDogXCIxMjcuMC4wLjFcIixcbiAgICAgICAgICB9LFxuICAgICAgICAgIHN0ZGluOiBcImluaGVyaXRcIixcbiAgICAgICAgICBzdGRvdXQ6IFwiaW5oZXJpdFwiLFxuICAgICAgICAgIHN0ZGVycjogXCJpbmhlcml0XCIsXG4gICAgICAgIH0sXG4gICAgICBdLFxuICAgICAgeyBncmFjZWZ1bFRpbWVvdXRNczogMTBfMDAwIH0sXG4gICAgKTtcbiAgICB2b2lkIGFwcC5zdGFydCgpO1xuICAgIGNoaWxkcmVuLnB1c2goYXBwKTtcbiAgfSBlbHNlIGlmIChyZXNvbHZlZC5hcHBQb3J0KSB7XG4gICAgYXBwUG9ydCA9IHJlc29sdmVkLmFwcFBvcnQ7XG4gICAgbG9nZ2VyLmluZm8oXCJhdHRhY2hpbmcgZ2F0ZSB0byBleGlzdGluZyB1cHN0cmVhbVwiLCB7IGFwcFBvcnQgfSk7XG4gIH0gZWxzZSB7XG4gICAgdGhyb3cgbmV3IENvbW1hbmRlckVycm9yKFxuICAgICAgMSxcbiAgICAgIFwidHVubmVsLm5vLXVwc3RyZWFtXCIsXG4gICAgICBcIm5vIGNvbW1hbmQgZ2l2ZW4gKHBhc3MgaXQgYWZ0ZXIgYC0tYCkgYW5kIG5vIC0tYXBwLXBvcnQgdG8gYXR0YWNoIHRvXCIsXG4gICAgKTtcbiAgfVxuXG4gIC8vIER5bmFtaWMgaW1wb3J0OiB0aGUgZ2F0ZSBpcyB0aGUgb25seSB0aGluZyBoZXJlIHRoYXQgbmVlZHMgQXBwS2l0ICsgU01UUCwgc29cbiAgLy8gYW4gYC0taW5zZWN1cmVgIHJ1biBuZXZlciBsb2FkcyBlaXRoZXIuXG4gIGNvbnN0IGdhdGUgPSByZXNvbHZlZC5nYXRlLmluc2VjdXJlXG4gICAgPyB1bmRlZmluZWRcbiAgICA6IGF3YWl0IChcbiAgICAgICAgYXdhaXQgaW1wb3J0KFwiLi9hcHAudHNcIilcbiAgICAgICkuc3RhcnRHYXRlQXBwKHtcbiAgICAgICAgLi4ucmVzb2x2ZWQuZ2F0ZUNvbmZpZyxcbiAgICAgICAgcHVibGljRG9tYWluOiByZXNvbHZlZC5nYXRlLnB1YmxpY0RvbWFpbiA/PyBgbG9jYWxob3N0OiR7cmVzb2x2ZWQucHVibGljUG9ydH1gLFxuICAgICAgfSk7XG4gIGlmICghZ2F0ZSkgbG9nZ2VyLndhcm4oXCJydW5uaW5nIE9QRU4gLSBubyBnYXRlIGlzIGluIGZyb250IG9mIHRoaXMgdHVubmVsXCIpO1xuXG4gIGF3YWl0IHN0YXJ0UHJveHkoe1xuICAgIHB1YmxpY1BvcnQ6IHJlc29sdmVkLnB1YmxpY1BvcnQsXG4gICAgYXBwUG9ydCxcbiAgICBnYXRlLFxuICAgIGZvcndhcmRIZWFkZXJzOiByZXNvbHZlZC5nYXRlLmZvcndhcmRIZWFkZXJzLFxuICAgIGdhdGVQYXRoczogcmVzb2x2ZWQuZ2F0ZS5nYXRlUGF0aHMsXG4gICAgYnJhbmROYW1lOiByZXNvbHZlZC5nYXRlLmJyYW5kTmFtZSxcbiAgICBiaW5kSG9zdHM6IHJlc29sdmVkLmJpbmRIb3N0cyxcbiAgfSk7XG5cbiAgaWYgKChyZXNvbHZlZC50cmFuc3BvcnQgPT09IFwicG9ydHJcIiB8fCByZXNvbHZlZC50cmFuc3BvcnQgPT09IFwiYm90aFwiKSAmJiByZXNvbHZlZC5wb3J0cikge1xuICAgIGNvbnN0IHBvcnRyRW52ID0gYXdhaXQgcG9ydHIuaW5zdGFsbFBvcnRyKCk7XG4gICAgYXdhaXQgcG9ydHIud3JpdGVQb3J0ckNvbmZpZyhyZXNvbHZlZC5wb3J0ciwgcG9ydHJFbnYpO1xuICAgIGNoaWxkcmVuLnB1c2goYXdhaXQgcG9ydHIuc3RhcnRQb3J0cihyZXNvbHZlZC5wb3J0ciwgcG9ydHJFbnYpKTtcbiAgfVxuICBpZiAoKHJlc29sdmVkLnRyYW5zcG9ydCA9PT0gXCJmcnBcIiB8fCByZXNvbHZlZC50cmFuc3BvcnQgPT09IFwiYm90aFwiKSAmJiByZXNvbHZlZC5mcnApIHtcbiAgICBjb25zdCBmcnBFbnYgPSBhd2FpdCBmcnAuaW5zdGFsbEZycCgpO1xuICAgIGNvbnN0IGNvbmZpZ1BhdGggPSBhd2FpdCBmcnAud3JpdGVGcnBDb25maWcocmVzb2x2ZWQuZnJwLCBmcnBFbnYpO1xuICAgIGNoaWxkcmVuLnB1c2goZnJwLnN0YXJ0RnJwKHJlc29sdmVkLmZycCwgZnJwRW52LCBjb25maWdQYXRoKSk7XG4gIH1cbiAgY29uc3QgYWN0aXZlVHVubmVsQ291bnQgPSBjaGlsZHJlbi5sZW5ndGggLSAoZXhlY3V0YWJsZSA/IDEgOiAwKTtcbiAgaWYgKCFhY3RpdmVUdW5uZWxDb3VudCkge1xuICAgIGxvZ2dlci5pbmZvKFwibm8gc2VsZWN0ZWQgcHVibGljIHR1bm5lbCBpcyBjb25maWd1cmVkXCIsIHtcbiAgICAgIHRyYW5zcG9ydDogcmVzb2x2ZWQudHJhbnNwb3J0LFxuICAgICAgcHVibGljUG9ydDogcmVzb2x2ZWQucHVibGljUG9ydCxcbiAgICB9KTtcbiAgfVxuICBzdXBlcnZpc2UoY2hpbGRyZW4pO1xufVxuXG4vKiogVGhlIGBkYnggdHVubmVsYCBwcm9ncmFtLiBObyBzaWRlIGVmZmVjdHMgdW50aWwgcGFyc2VkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJ1aWxkUHJvZ3JhbShuYW1lID0gXCJkYnggdHVubmVsXCIpOiBDb21tYW5kIHtcbiAgY29uc3QgcHJvZ3JhbSA9IGFkZEFyZ3MoXG4gICAgbmV3IENvbW1hbmQoKVxuICAgICAgLm5hbWUobmFtZSlcbiAgICAgIC5kZXNjcmlwdGlvbihcIkZyb250IGEgY29tbWFuZCB3aXRoIGEgcHVibGljIHR1bm5lbCBhbmQgcGFzc3dvcmRsZXNzIGF1dGhcIiksXG4gICAgVHVubmVsT3B0aW9uc1NjaGVtYSxcbiAgKTtcblxuICAvLyBgcnVuYCBpcyB0aGUgREVGQVVMVCBhY3Rpb24gYXMgd2VsbCBhcyBhIG5hbWVkIHN1YmNvbW1hbmQsIHByZXNlcnZpbmcgdGhlIG9sZFxuICAvLyB3cmFwcGVyJ3MgZXJnb25vbWljcyAoYGRieCB0dW5uZWwgLS1hbGxvdyB4IC0tIGJ1biBzcmMvc2VydmVyLnRzYCkgd2hpbGVcbiAgLy8gbGVhdmluZyBzb21ld2hlcmUgZm9yIGBzdGF0dXNgIGFuZCBgaW5zdGFsbGAgdG8gbGl2ZS5cbiAgcHJvZ3JhbVxuICAgIC5hcmd1bWVudChcIltjb21tYW5kLi4uXVwiLCBcInRoZSBjb21tYW5kIHRvIHdyYXAsIGFmdGVyIGAtLWBcIilcbiAgICAuYWN0aW9uKGFzeW5jIChjb21tYW5kOiBzdHJpbmdbXSkgPT4ge1xuICAgICAgYXdhaXQgcnVuKHBhcnNlQXJncyhwcm9ncmFtLCBUdW5uZWxPcHRpb25zU2NoZW1hKSwgY29tbWFuZCk7XG4gICAgfSk7XG5cbiAgY29uc3QgcnVuQ29tbWFuZCA9IGFkZEFyZ3MoXG4gICAgcHJvZ3JhbS5jb21tYW5kKFwicnVuXCIpLmRlc2NyaXB0aW9uKFwiV3JhcCBhIGNvbW1hbmQgKHRoZSBkZWZhdWx0IGFjdGlvbilcIiksXG4gICAgVHVubmVsT3B0aW9uc1NjaGVtYSxcbiAgKTtcbiAgcnVuQ29tbWFuZFxuICAgIC5hcmd1bWVudChcIjxjb21tYW5kLi4uPlwiLCBcInRoZSBjb21tYW5kIHRvIHdyYXAsIGFmdGVyIGAtLWBcIilcbiAgICAuYWN0aW9uKGFzeW5jIChjb21tYW5kOiBzdHJpbmdbXSkgPT4ge1xuICAgICAgYXdhaXQgcnVuKHBhcnNlQXJncyhydW5Db21tYW5kLCBUdW5uZWxPcHRpb25zU2NoZW1hKSwgY29tbWFuZCk7XG4gICAgfSk7XG5cbiAgLy8gV29ydGggaXRzIG93biBjb21tYW5kOiB0aGUgbW9zdCBjb21tb24gZmFpbHVyZSBpcyBhIHR1bm5lbCB0aGF0IHNpbGVudGx5XG4gIC8vIGRvZXMgbm90aGluZyBiZWNhdXNlIG5vIHRva2VuIG9yIGRvbWFpbiByZXNvbHZlZCwgYW5kIHRoaXMgcHJpbnRzIGV4YWN0bHlcbiAgLy8gd2hhdCB3b3VsZCBoYXBwZW4gd2l0aG91dCBzdGFydGluZyBhbnl0aGluZy5cbiAgY29uc3Qgc3RhdHVzQ29tbWFuZCA9IGFkZEFyZ3MoXG4gICAgcHJvZ3JhbS5jb21tYW5kKFwic3RhdHVzXCIpLmRlc2NyaXB0aW9uKFwiUmVzb2x2ZSB0aGUgY29uZmlndXJhdGlvbiBhbmQgcHJpbnQgaXRcIiksXG4gICAgVHVubmVsT3B0aW9uc1NjaGVtYSxcbiAgKTtcbiAgc3RhdHVzQ29tbWFuZC5hY3Rpb24oKCkgPT4ge1xuICAgIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZVR1bm5lbE9wdGlvbnMocGFyc2VBcmdzKHN0YXR1c0NvbW1hbmQsIFR1bm5lbE9wdGlvbnNTY2hlbWEpKTtcbiAgICBwcm9jZXNzLnN0ZG91dC53cml0ZShgJHtKU09OLnN0cmluZ2lmeShyZXNvbHZlZCwgbnVsbCwgMil9XFxuYCk7XG4gIH0pO1xuXG4gIHByb2dyYW1cbiAgICAuY29tbWFuZChcImluc3RhbGxcIilcbiAgICAuYXJndW1lbnQoXCJbdHJhbnNwb3J0XVwiLCBcInBvcnRyLCBmcnAsIG9yIGJvdGhcIiwgXCJwb3J0clwiKVxuICAgIC5kZXNjcmlwdGlvbihcIkluc3RhbGwgcHVibGljIHR1bm5lbCBjbGllbnQgYmluYXJpZXMgYW5kIGV4aXRcIilcbiAgICAuYWN0aW9uKGFzeW5jICh0cmFuc3BvcnQ6IHN0cmluZykgPT4ge1xuICAgICAgY29uc3QgcGFyc2VkID0gaW50ZXJjZXB0b3IuVHVubmVsVHJhbnNwb3J0U2NoZW1hLnBhcnNlKHRyYW5zcG9ydCk7XG4gICAgICBpZiAocGFyc2VkID09PSBcInBvcnRyXCIgfHwgcGFyc2VkID09PSBcImJvdGhcIikgYXdhaXQgcG9ydHIuaW5zdGFsbFBvcnRyKCk7XG4gICAgICBpZiAocGFyc2VkID09PSBcImZycFwiIHx8IHBhcnNlZCA9PT0gXCJib3RoXCIpIGF3YWl0IGZycC5pbnN0YWxsRnJwKCk7XG4gICAgfSk7XG5cbiAgcmV0dXJuIHByb2dyYW07XG59XG4iXX0=

package/lib/src/tunnel/options.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Flag -> config -> default resolution for `dbx tunnel`.
+ *
+ * The point of this module is that it does almost NOTHING itself: every gate
+ * setting is handed straight to `@dbx-tools/tunnel`'s own
+ * `plugin.resolveAuthGateConfig`, which is the same function the in-process
+ * plugin path calls. The CLI therefore cannot drift from the plugin on a default,
+ * an env name, or a coercion rule - a flag is just a value passed where the
+ * plugin's `config` object would go, and `config.*` fills the rest in from the
+ * environment, a `.env` file, or `databricks.yml`.
+ *
+ * @module
+ */
+import { type AuthGateConfig, frp, interceptor, plugin, portr } from "@dbx-tools/tunnel";
+import { z } from "zod";
+export declare const TunnelOptionsSchema: z.ZodObject<{
+    transport: z.ZodOptional<z.ZodEnum<{
+        both: "both";
+        portr: "portr";
+        frp: "frp";
+    }>>;
+    publicDomain: z.ZodOptional<z.ZodString>;
+    subdomain: z.ZodOptional<z.ZodString>;
+    port: z.ZodOptional<z.ZodCoercedNumber<number>>;
+    appPort: z.ZodOptional<z.ZodCoercedNumber<number>>;
+    allow: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodArray<z.ZodString>>>;
+    subject: z.ZodOptional<z.ZodString>;
+    brandName: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    sessionTtlSeconds: z.ZodOptional<z.ZodCoercedNumber<number>>;
+    codeTtlSeconds: z.ZodOptional<z.ZodCoercedNumber<number>>;
+    sessionCutoff: z.ZodOptional<z.ZodString>;
+    storage: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        lakebase: "lakebase";
+        sqlite: "sqlite";
+    }>>;
+    sqlitePath: z.ZodOptional<z.ZodString>;
+    forwardHeaders: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodArray<z.ZodString>>>;
+    gatePaths: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodArray<z.ZodString>>>;
+    bindHosts: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodArray<z.ZodString>>>;
+    insecure: z.ZodOptional<z.ZodBoolean>;
+    frpServer: z.ZodOptional<z.ZodString>;
+    frpPublicDomain: z.ZodOptional<z.ZodString>;
+    frpServerPort: z.ZodOptional<z.ZodCoercedNumber<number>>;
+    frpProtocol: z.ZodOptional<z.ZodString>;
+    frpToken: z.ZodOptional<z.ZodString>;
+    frpProxyName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type TunnelOptions = z.output<typeof TunnelOptionsSchema>;
+/** Fully resolved listener, gate, and transport settings used to start a tunnel. */
+export interface ResolvedTunnelOptions {
+    /** The port the wrapper itself listens on - what portr forwards to. */
+    publicPort: number;
+    /** The private port the wrapped app is told to bind. Unset means "pick one". */
+    appPort?: number;
+    /** Interface IPs the gate listens on. Empty means the default (0.0.0.0). */
+    bindHosts: string[];
+    transport: interceptor.TunnelTransport;
+    /**
+     * The gate config as the `authGate` PLUGIN takes it - flags only, nothing
+     * resolved. Passed straight to the plugin so it applies its own fallbacks
+     * exactly once, in the one place that owns them.
+     */
+    gateConfig: AuthGateConfig;
+    /** The same config after the plugin's resolution, for `status` and for routing. */
+    gate: plugin.ResolvedAuthGateConfig;
+    portr: ReturnType<typeof portr.resolvePortrConfig>;
+    frp: ReturnType<typeof frp.resolveFrpConfig>;
+}
+/** Resolve CLI flag values through the owning tunnel and auth-gate configuration rules. */
+export declare function resolveTunnelOptions(options: TunnelOptions): ResolvedTunnelOptions;

package/lib/src/tunnel/options.js

@@ -0,0 +1,138 @@
+/**
+ * Flag -> config -> default resolution for `dbx tunnel`.
+ *
+ * The point of this module is that it does almost NOTHING itself: every gate
+ * setting is handed straight to `@dbx-tools/tunnel`'s own
+ * `plugin.resolveAuthGateConfig`, which is the same function the in-process
+ * plugin path calls. The CLI therefore cannot drift from the plugin on a default,
+ * an env name, or a coercion rule - a flag is just a value passed where the
+ * plugin's `config` object would go, and `config.*` fills the rest in from the
+ * environment, a `.env` file, or `databricks.yml`.
+ *
+ * @module
+ */
+import { configUtils } from "@dbx-tools/core";
+import { options as sharedOptions, stringUtils } from "@dbx-tools/shared-core";
+import { frp, interceptor, plugin, portr } from "@dbx-tools/tunnel";
+import { z } from "zod";
+const text = (description) => z.string().trim().min(1).optional().describe(description);
+const port = (description) => sharedOptions.tcpPortOrZeroSchema.optional().describe(description);
+const list = (description) => z
+    .preprocess((value) => (typeof value === "string" ? stringUtils.parseList(value) : value), z.array(z.string().trim().min(1)))
+    .optional()
+    .describe(description);
+export const TunnelOptionsSchema = z
+    .object({
+    transport: interceptor.TunnelTransportSchema.optional()
+        .describe("Public tunnel transport.")
+        .meta({ env: "TUNNEL_TRANSPORT" }),
+    publicDomain: text("Public tunnel domain.").meta({ env: "TUNNEL_PUBLIC_DOMAIN" }),
+    subdomain: text("Portr subdomain."),
+    port: port("Public listener port.").meta({
+        env: sharedOptions.databricksEnvironmentNames.appPort,
+    }),
+    appPort: port("Private wrapped application port.").meta({
+        env: ["TUNNEL_APP_PORT", "APP_PORT"],
+    }),
+    allow: list("Email allow-list patterns.").meta({ env: "TUNNEL_AUTH_ALLOW" }),
+    subject: text("Verification email subject.").meta({ env: "TUNNEL_AUTH_SUBJECT" }),
+    brandName: text("Verification email brand name.").meta({ env: "TUNNEL_AUTH_BRAND_NAME" }),
+    message: text("Verification email message.").meta({ env: "TUNNEL_AUTH_MESSAGE" }),
+    sessionTtlSeconds: z.coerce
+        .number()
+        .positive()
+        .optional()
+        .describe("Session lifetime in seconds.")
+        .meta({ env: "TUNNEL_AUTH_SESSION_TTL" }),
+    codeTtlSeconds: z.coerce
+        .number()
+        .positive()
+        .optional()
+        .describe("One-time-code lifetime in seconds.")
+        .meta({ env: "TUNNEL_AUTH_CODE_TTL" }),
+    sessionCutoff: text("Invalidate sessions issued before this value.").meta({
+        env: "TUNNEL_AUTH_SESSION_CUTOFF",
+    }),
+    storage: z
+        .enum(["auto", "lakebase", "sqlite"])
+        .optional()
+        .describe("Authentication database mode.")
+        .meta({ env: "TUNNEL_AUTH_STORAGE" }),
+    sqlitePath: text("Local authentication SQLite file.").meta({
+        env: "TUNNEL_AUTH_SQLITE_PATH",
+    }),
+    forwardHeaders: list("Additional forwarded request header patterns.").meta({
+        env: "TUNNEL_FORWARD_HEADERS",
+    }),
+    gatePaths: list("Additional path prefixes requiring authentication.").meta({
+        env: "TUNNEL_GATE_PATHS",
+    }),
+    bindHosts: list("Interface IPs the gate listens on."),
+    insecure: z
+        .boolean()
+        .optional()
+        .describe("Run without an authentication gate.")
+        .meta({ env: "TUNNEL_INSECURE" }),
+    frpServer: text("FRP control host.").meta({ env: "FRP_SERVER" }),
+    frpPublicDomain: text("FRP public HTTP domain.").meta({
+        env: "TUNNEL_FRP_PUBLIC_DOMAIN",
+    }),
+    frpServerPort: port("FRP control port.").meta({ env: "FRP_SERVER_PORT" }),
+    frpProtocol: text("FRP transport protocol.").meta({ env: "FRP_PROTOCOL" }),
+    frpToken: text("FRP authentication token.").meta({ env: ["FRP_TOKEN", "TUNNEL_TOKEN"] }),
+    frpProxyName: text("FRP proxy registration name.").meta({ env: "FRP_PROXY_NAME" }),
+})
+    .strict()
+    .describe("Public tunnel wrapper command-line options.");
+/** Resolve CLI flag values through the owning tunnel and auth-gate configuration rules. */
+export function resolveTunnelOptions(options) {
+    // The Databricks Apps runtime contract: the platform routes to
+    // DATABRICKS_APP_PORT, so the WRAPPER claims it and the wrapped app is moved
+    // to a private one.
+    const publicPort = configUtils.port(options.port, "DATABRICKS_APP_PORT", 8000);
+    const appPort = configUtils.port(options.appPort, "APP_PORT", 0, { prefix: "TUNNEL" });
+    const gateConfig = {
+        allow: options.allow,
+        subject: options.subject,
+        brandName: options.brandName,
+        message: options.message,
+        // Coerced, not resolved: the plugin owns the env name and the default for
+        // these, so the flag is passed through as the `config` value it expects and
+        // only needs a string -> number nudge on the way.
+        sessionTtlSeconds: options.sessionTtlSeconds,
+        codeTtlSeconds: options.codeTtlSeconds,
+        sessionCutoff: options.sessionCutoff,
+        storage: options.storage,
+        sqlitePath: options.sqlitePath,
+        forwardHeaders: options.forwardHeaders,
+        gatePaths: options.gatePaths,
+        insecure: options.insecure,
+        publicDomain: options.publicDomain,
+        publicDomains: options.frpPublicDomain ? [options.frpPublicDomain] : undefined,
+    };
+    const gate = plugin.resolveAuthGateConfig(gateConfig);
+    const transport = interceptor.resolveTunnelTransport(options.transport);
+    return {
+        publicPort,
+        ...(appPort > 0 ? { appPort } : {}),
+        bindHosts: options.bindHosts ?? [],
+        transport,
+        gateConfig,
+        gate,
+        portr: portr.resolvePortrConfig({
+            publicDomain: gate.publicDomain,
+            subdomain: options.subdomain,
+            port: publicPort,
+        }),
+        frp: frp.resolveFrpConfig({
+            publicDomain: options.frpPublicDomain,
+            server: options.frpServer,
+            serverPort: options.frpServerPort,
+            protocol: options.frpProtocol,
+            token: options.frpToken,
+            proxyName: options.frpProxyName,
+            port: publicPort,
+        }),
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3B0aW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy90dW5uZWwvb3B0aW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7O0dBWUc7QUFFSCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDOUMsT0FBTyxFQUFFLE9BQU8sSUFBSSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDL0UsT0FBTyxFQUF1QixHQUFHLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUN6RixPQUFPLEVBQUUsQ0FBQyxFQUFFLE1BQU0sS0FBSyxDQUFDO0FBRXhCLE1BQU0sSUFBSSxHQUFHLENBQUMsV0FBbUIsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFDaEcsTUFBTSxJQUFJLEdBQUcsQ0FBQyxXQUFtQixFQUFFLEVBQUUsQ0FDbkMsYUFBYSxDQUFDLG1CQUFtQixDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUNyRSxNQUFNLElBQUksR0FBRyxDQUFDLFdBQW1CLEVBQUUsRUFBRSxDQUNuQyxDQUFDO0tBQ0UsVUFBVSxDQUNULENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEVBQzdFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUNsQztLQUNBLFFBQVEsRUFBRTtLQUNWLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUUzQixNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxDQUFDO0tBQ2pDLE1BQU0sQ0FBQztJQUNOLFNBQVMsRUFBRSxXQUFXLENBQUMscUJBQXFCLENBQUMsUUFBUSxFQUFFO1NBQ3BELFFBQVEsQ0FBQywwQkFBMEIsQ0FBQztTQUNwQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztJQUNwQyxZQUFZLEVBQUUsSUFBSSxDQUFDLHVCQUF1QixDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLHNCQUFzQixFQUFFLENBQUM7SUFDakYsU0FBUyxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztJQUNuQyxJQUFJLEVBQUUsSUFBSSxDQUFDLHVCQUF1QixDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ3ZDLEdBQUcsRUFBRSxhQUFhLENBQUMsMEJBQTBCLENBQUMsT0FBTztLQUN0RCxDQUFDO0lBQ0YsT0FBTyxFQUFFLElBQUksQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN0RCxHQUFHLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxVQUFVLENBQUM7S0FDckMsQ0FBQztJQUNGLEtBQUssRUFBRSxJQUFJLENBQUMsNEJBQTRCLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQztJQUM1RSxPQUFPLEVBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLHFCQUFxQixFQUFFLENBQUM7SUFDakYsU0FBUyxFQUFFLElBQUksQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSx3QkFBd0IsRUFBRSxDQUFDO0lBQ3pGLE9BQU8sRUFBRSxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUscUJBQXFCLEVBQUUsQ0FBQztJQUNqRixpQkFBaUIsRUFBRSxDQUFDLENBQUMsTUFBTTtTQUN4QixNQUFNLEVBQVU7U0FDaEIsUUFBUSxFQUFFO1NBQ1YsUUFBUSxFQUFFO1NBQ1YsUUFBUSxDQUFDLDhCQUE4QixDQUFDO1NBQ3hDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSx5QkFBeUIsRUFBRSxDQUFDO0lBQzNDLGNBQWMsRUFBRSxDQUFDLENBQUMsTUFBTTtTQUNyQixNQUFNLEVBQVU7U0FDaEIsUUFBUSxFQUFFO1NBQ1YsUUFBUSxFQUFFO1NBQ1YsUUFBUSxDQUFDLG9DQUFvQyxDQUFDO1NBQzlDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxzQkFBc0IsRUFBRSxDQUFDO0lBQ3hDLGFBQWEsRUFBRSxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDeEUsR0FBRyxFQUFFLDRCQUE0QjtLQUNsQyxDQUFDO0lBQ0YsT0FBTyxFQUFFLENBQUM7U0FDUCxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1NBQ3BDLFFBQVEsRUFBRTtTQUNWLFFBQVEsQ0FBQywrQkFBK0IsQ0FBQztTQUN6QyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUscUJBQXFCLEVBQUUsQ0FBQztJQUN2QyxVQUFVLEVBQUUsSUFBSSxDQUFDLG1DQUFtQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ3pELEdBQUcsRUFBRSx5QkFBeUI7S0FDL0IsQ0FBQztJQUNGLGNBQWMsRUFBRSxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDekUsR0FBRyxFQUFFLHdCQUF3QjtLQUM5QixDQUFDO0lBQ0YsU0FBUyxFQUFFLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN6RSxHQUFHLEVBQUUsbUJBQW1CO0tBQ3pCLENBQUM7SUFDRixTQUFTLEVBQUUsSUFBSSxDQUFDLG9DQUFvQyxDQUFDO0lBQ3JELFFBQVEsRUFBRSxDQUFDO1NBQ1IsT0FBTyxFQUFFO1NBQ1QsUUFBUSxFQUFFO1NBQ1YsUUFBUSxDQUFDLHFDQUFxQyxDQUFDO1NBQy9DLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxpQkFBaUIsRUFBRSxDQUFDO0lBQ25DLFNBQVMsRUFBRSxJQUFJLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsWUFBWSxFQUFFLENBQUM7SUFDaEUsZUFBZSxFQUFFLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUNwRCxHQUFHLEVBQUUsMEJBQTBCO0tBQ2hDLENBQUM7SUFDRixhQUFhLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLGlCQUFpQixFQUFFLENBQUM7SUFDekUsV0FBVyxFQUFFLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxjQUFjLEVBQUUsQ0FBQztJQUMxRSxRQUFRLEVBQUUsSUFBSSxDQUFDLDJCQUEyQixDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUMsV0FBVyxFQUFFLGNBQWMsQ0FBQyxFQUFFLENBQUM7SUFDeEYsWUFBWSxFQUFFLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO0NBQ25GLENBQUM7S0FDRCxNQUFNLEVBQUU7S0FDUixRQUFRLENBQUMsNkNBQTZDLENBQUMsQ0FBQztBQXlCM0QsMkZBQTJGO0FBQzNGLE1BQU0sVUFBVSxvQkFBb0IsQ0FBQyxPQUFzQjtJQUN6RCwrREFBK0Q7SUFDL0QsNkVBQTZFO0lBQzdFLG9CQUFvQjtJQUNwQixNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUscUJBQXFCLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDL0UsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUN2RixNQUFNLFVBQVUsR0FBbUI7UUFDakMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLO1FBQ3BCLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztRQUN4QixTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7UUFDNUIsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO1FBQ3hCLDBFQUEwRTtRQUMxRSw0RUFBNEU7UUFDNUUsa0RBQWtEO1FBQ2xELGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxpQkFBaUI7UUFDNUMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjO1FBQ3RDLGFBQWEsRUFBRSxPQUFPLENBQUMsYUFBYTtRQUNwQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87UUFDeEIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1FBQzlCLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYztRQUN0QyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7UUFDNUIsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1FBQzFCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtRQUNsQyxhQUFhLEVBQUUsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVM7S0FDL0UsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN0RCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsc0JBQXNCLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3hFLE9BQU87UUFDTCxVQUFVO1FBQ1YsR0FBRyxDQUFDLE9BQU8sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNuQyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVMsSUFBSSxFQUFFO1FBQ2xDLFNBQVM7UUFDVCxVQUFVO1FBQ1YsSUFBSTtRQUNKLEtBQUssRUFBRSxLQUFLLENBQUMsa0JBQWtCLENBQUM7WUFDOUIsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1lBQy9CLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztZQUM1QixJQUFJLEVBQUUsVUFBVTtTQUNqQixDQUFDO1FBQ0YsR0FBRyxFQUFFLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQztZQUN4QixZQUFZLEVBQUUsT0FBTyxDQUFDLGVBQWU7WUFDckMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQ3pCLFVBQVUsRUFBRSxPQUFPLENBQUMsYUFBYTtZQUNqQyxRQUFRLEVBQUUsT0FBTyxDQUFDLFdBQVc7WUFDN0IsS0FBSyxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQ3ZCLFNBQVMsRUFBRSxPQUFPLENBQUMsWUFBWTtZQUMvQixJQUFJLEVBQUUsVUFBVTtTQUNqQixDQUFDO0tBQ0gsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEZsYWcgLT4gY29uZmlnIC0+IGRlZmF1bHQgcmVzb2x1dGlvbiBmb3IgYGRieCB0dW5uZWxgLlxuICpcbiAqIFRoZSBwb2ludCBvZiB0aGlzIG1vZHVsZSBpcyB0aGF0IGl0IGRvZXMgYWxtb3N0IE5PVEhJTkcgaXRzZWxmOiBldmVyeSBnYXRlXG4gKiBzZXR0aW5nIGlzIGhhbmRlZCBzdHJhaWdodCB0byBgQGRieC10b29scy90dW5uZWxgJ3Mgb3duXG4gKiBgcGx1Z2luLnJlc29sdmVBdXRoR2F0ZUNvbmZpZ2AsIHdoaWNoIGlzIHRoZSBzYW1lIGZ1bmN0aW9uIHRoZSBpbi1wcm9jZXNzXG4gKiBwbHVnaW4gcGF0aCBjYWxscy4gVGhlIENMSSB0aGVyZWZvcmUgY2Fubm90IGRyaWZ0IGZyb20gdGhlIHBsdWdpbiBvbiBhIGRlZmF1bHQsXG4gKiBhbiBlbnYgbmFtZSwgb3IgYSBjb2VyY2lvbiBydWxlIC0gYSBmbGFnIGlzIGp1c3QgYSB2YWx1ZSBwYXNzZWQgd2hlcmUgdGhlXG4gKiBwbHVnaW4ncyBgY29uZmlnYCBvYmplY3Qgd291bGQgZ28sIGFuZCBgY29uZmlnLipgIGZpbGxzIHRoZSByZXN0IGluIGZyb20gdGhlXG4gKiBlbnZpcm9ubWVudCwgYSBgLmVudmAgZmlsZSwgb3IgYGRhdGFicmlja3MueW1sYC5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgY29uZmlnVXRpbHMgfSBmcm9tIFwiQGRieC10b29scy9jb3JlXCI7XG5pbXBvcnQgeyBvcHRpb25zIGFzIHNoYXJlZE9wdGlvbnMsIHN0cmluZ1V0aWxzIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWNvcmVcIjtcbmltcG9ydCB7IHR5cGUgQXV0aEdhdGVDb25maWcsIGZycCwgaW50ZXJjZXB0b3IsIHBsdWdpbiwgcG9ydHIgfSBmcm9tIFwiQGRieC10b29scy90dW5uZWxcIjtcbmltcG9ydCB7IHogfSBmcm9tIFwiem9kXCI7XG5cbmNvbnN0IHRleHQgPSAoZGVzY3JpcHRpb246IHN0cmluZykgPT4gei5zdHJpbmcoKS50cmltKCkubWluKDEpLm9wdGlvbmFsKCkuZGVzY3JpYmUoZGVzY3JpcHRpb24pO1xuY29uc3QgcG9ydCA9IChkZXNjcmlwdGlvbjogc3RyaW5nKSA9PlxuICBzaGFyZWRPcHRpb25zLnRjcFBvcnRPclplcm9TY2hlbWEub3B0aW9uYWwoKS5kZXNjcmliZShkZXNjcmlwdGlvbik7XG5jb25zdCBsaXN0ID0gKGRlc2NyaXB0aW9uOiBzdHJpbmcpID0+XG4gIHpcbiAgICAucHJlcHJvY2VzcyhcbiAgICAgICh2YWx1ZSkgPT4gKHR5cGVvZiB2YWx1ZSA9PT0gXCJzdHJpbmdcIiA/IHN0cmluZ1V0aWxzLnBhcnNlTGlzdCh2YWx1ZSkgOiB2YWx1ZSksXG4gICAgICB6LmFycmF5KHouc3RyaW5nKCkudHJpbSgpLm1pbigxKSksXG4gICAgKVxuICAgIC5vcHRpb25hbCgpXG4gICAgLmRlc2NyaWJlKGRlc2NyaXB0aW9uKTtcblxuZXhwb3J0IGNvbnN0IFR1bm5lbE9wdGlvbnNTY2hlbWEgPSB6XG4gIC5vYmplY3Qoe1xuICAgIHRyYW5zcG9ydDogaW50ZXJjZXB0b3IuVHVubmVsVHJhbnNwb3J0U2NoZW1hLm9wdGlvbmFsKClcbiAgICAgIC5kZXNjcmliZShcIlB1YmxpYyB0dW5uZWwgdHJhbnNwb3J0LlwiKVxuICAgICAgLm1ldGEoeyBlbnY6IFwiVFVOTkVMX1RSQU5TUE9SVFwiIH0pLFxuICAgIHB1YmxpY0RvbWFpbjogdGV4dChcIlB1YmxpYyB0dW5uZWwgZG9tYWluLlwiKS5tZXRhKHsgZW52OiBcIlRVTk5FTF9QVUJMSUNfRE9NQUlOXCIgfSksXG4gICAgc3ViZG9tYWluOiB0ZXh0KFwiUG9ydHIgc3ViZG9tYWluLlwiKSxcbiAgICBwb3J0OiBwb3J0KFwiUHVibGljIGxpc3RlbmVyIHBvcnQuXCIpLm1ldGEoe1xuICAgICAgZW52OiBzaGFyZWRPcHRpb25zLmRhdGFicmlja3NFbnZpcm9ubWVudE5hbWVzLmFwcFBvcnQsXG4gICAgfSksXG4gICAgYXBwUG9ydDogcG9ydChcIlByaXZhdGUgd3JhcHBlZCBhcHBsaWNhdGlvbiBwb3J0LlwiKS5tZXRhKHtcbiAgICAgIGVudjogW1wiVFVOTkVMX0FQUF9QT1JUXCIsIFwiQVBQX1BPUlRcIl0sXG4gICAgfSksXG4gICAgYWxsb3c6IGxpc3QoXCJFbWFpbCBhbGxvdy1saXN0IHBhdHRlcm5zLlwiKS5tZXRhKHsgZW52OiBcIlRVTk5FTF9BVVRIX0FMTE9XXCIgfSksXG4gICAgc3ViamVjdDogdGV4dChcIlZlcmlmaWNhdGlvbiBlbWFpbCBzdWJqZWN0LlwiKS5tZXRhKHsgZW52OiBcIlRVTk5FTF9BVVRIX1NVQkpFQ1RcIiB9KSxcbiAgICBicmFuZE5hbWU6IHRleHQoXCJWZXJpZmljYXRpb24gZW1haWwgYnJhbmQgbmFtZS5cIikubWV0YSh7IGVudjogXCJUVU5ORUxfQVVUSF9CUkFORF9OQU1FXCIgfSksXG4gICAgbWVzc2FnZTogdGV4dChcIlZlcmlmaWNhdGlvbiBlbWFpbCBtZXNzYWdlLlwiKS5tZXRhKHsgZW52OiBcIlRVTk5FTF9BVVRIX01FU1NBR0VcIiB9KSxcbiAgICBzZXNzaW9uVHRsU2Vjb25kczogei5jb2VyY2VcbiAgICAgIC5udW1iZXI8bnVtYmVyPigpXG4gICAgICAucG9zaXRpdmUoKVxuICAgICAgLm9wdGlvbmFsKClcbiAgICAgIC5kZXNjcmliZShcIlNlc3Npb24gbGlmZXRpbWUgaW4gc2Vjb25kcy5cIilcbiAgICAgIC5tZXRhKHsgZW52OiBcIlRVTk5FTF9BVVRIX1NFU1NJT05fVFRMXCIgfSksXG4gICAgY29kZVR0bFNlY29uZHM6IHouY29lcmNlXG4gICAgICAubnVtYmVyPG51bWJlcj4oKVxuICAgICAgLnBvc2l0aXZlKClcbiAgICAgIC5vcHRpb25hbCgpXG4gICAgICAuZGVzY3JpYmUoXCJPbmUtdGltZS1jb2RlIGxpZmV0aW1lIGluIHNlY29uZHMuXCIpXG4gICAgICAubWV0YSh7IGVudjogXCJUVU5ORUxfQVVUSF9DT0RFX1RUTFwiIH0pLFxuICAgIHNlc3Npb25DdXRvZmY6IHRleHQoXCJJbnZhbGlkYXRlIHNlc3Npb25zIGlzc3VlZCBiZWZvcmUgdGhpcyB2YWx1ZS5cIikubWV0YSh7XG4gICAgICBlbnY6IFwiVFVOTkVMX0FVVEhfU0VTU0lPTl9DVVRPRkZcIixcbiAgICB9KSxcbiAgICBzdG9yYWdlOiB6XG4gICAgICAuZW51bShbXCJhdXRvXCIsIFwibGFrZWJhc2VcIiwgXCJzcWxpdGVcIl0pXG4gICAgICAub3B0aW9uYWwoKVxuICAgICAgLmRlc2NyaWJlKFwiQXV0aGVudGljYXRpb24gZGF0YWJhc2UgbW9kZS5cIilcbiAgICAgIC5tZXRhKHsgZW52OiBcIlRVTk5FTF9BVVRIX1NUT1JBR0VcIiB9KSxcbiAgICBzcWxpdGVQYXRoOiB0ZXh0KFwiTG9jYWwgYXV0aGVudGljYXRpb24gU1FMaXRlIGZpbGUuXCIpLm1ldGEoe1xuICAgICAgZW52OiBcIlRVTk5FTF9BVVRIX1NRTElURV9QQVRIXCIsXG4gICAgfSksXG4gICAgZm9yd2FyZEhlYWRlcnM6IGxpc3QoXCJBZGRpdGlvbmFsIGZvcndhcmRlZCByZXF1ZXN0IGhlYWRlciBwYXR0ZXJucy5cIikubWV0YSh7XG4gICAgICBlbnY6IFwiVFVOTkVMX0ZPUldBUkRfSEVBREVSU1wiLFxuICAgIH0pLFxuICAgIGdhdGVQYXRoczogbGlzdChcIkFkZGl0aW9uYWwgcGF0aCBwcmVmaXhlcyByZXF1aXJpbmcgYXV0aGVudGljYXRpb24uXCIpLm1ldGEoe1xuICAgICAgZW52OiBcIlRVTk5FTF9HQVRFX1BBVEhTXCIsXG4gICAgfSksXG4gICAgYmluZEhvc3RzOiBsaXN0KFwiSW50ZXJmYWNlIElQcyB0aGUgZ2F0ZSBsaXN0ZW5zIG9uLlwiKSxcbiAgICBpbnNlY3VyZTogelxuICAgICAgLmJvb2xlYW4oKVxuICAgICAgLm9wdGlvbmFsKClcbiAgICAgIC5kZXNjcmliZShcIlJ1biB3aXRob3V0IGFuIGF1dGhlbnRpY2F0aW9uIGdhdGUuXCIpXG4gICAgICAubWV0YSh7IGVudjogXCJUVU5ORUxfSU5TRUNVUkVcIiB9KSxcbiAgICBmcnBTZXJ2ZXI6IHRleHQoXCJGUlAgY29udHJvbCBob3N0LlwiKS5tZXRhKHsgZW52OiBcIkZSUF9TRVJWRVJcIiB9KSxcbiAgICBmcnBQdWJsaWNEb21haW46IHRleHQoXCJGUlAgcHVibGljIEhUVFAgZG9tYWluLlwiKS5tZXRhKHtcbiAgICAgIGVudjogXCJUVU5ORUxfRlJQX1BVQkxJQ19ET01BSU5cIixcbiAgICB9KSxcbiAgICBmcnBTZXJ2ZXJQb3J0OiBwb3J0KFwiRlJQIGNvbnRyb2wgcG9ydC5cIikubWV0YSh7IGVudjogXCJGUlBfU0VSVkVSX1BPUlRcIiB9KSxcbiAgICBmcnBQcm90b2NvbDogdGV4dChcIkZSUCB0cmFuc3BvcnQgcHJvdG9jb2wuXCIpLm1ldGEoeyBlbnY6IFwiRlJQX1BST1RPQ09MXCIgfSksXG4gICAgZnJwVG9rZW46IHRleHQoXCJGUlAgYXV0aGVudGljYXRpb24gdG9rZW4uXCIpLm1ldGEoeyBlbnY6IFtcIkZSUF9UT0tFTlwiLCBcIlRVTk5FTF9UT0tFTlwiXSB9KSxcbiAgICBmcnBQcm94eU5hbWU6IHRleHQoXCJGUlAgcHJveHkgcmVnaXN0cmF0aW9uIG5hbWUuXCIpLm1ldGEoeyBlbnY6IFwiRlJQX1BST1hZX05BTUVcIiB9KSxcbiAgfSlcbiAgLnN0cmljdCgpXG4gIC5kZXNjcmliZShcIlB1YmxpYyB0dW5uZWwgd3JhcHBlciBjb21tYW5kLWxpbmUgb3B0aW9ucy5cIik7XG5cbmV4cG9ydCB0eXBlIFR1bm5lbE9wdGlvbnMgPSB6Lm91dHB1dDx0eXBlb2YgVHVubmVsT3B0aW9uc1NjaGVtYT47XG5cbi8qKiBGdWxseSByZXNvbHZlZCBsaXN0ZW5lciwgZ2F0ZSwgYW5kIHRyYW5zcG9ydCBzZXR0aW5ncyB1c2VkIHRvIHN0YXJ0IGEgdHVubmVsLiAqL1xuZXhwb3J0IGludGVyZmFjZSBSZXNvbHZlZFR1bm5lbE9wdGlvbnMge1xuICAvKiogVGhlIHBvcnQgdGhlIHdyYXBwZXIgaXRzZWxmIGxpc3RlbnMgb24gLSB3aGF0IHBvcnRyIGZvcndhcmRzIHRvLiAqL1xuICBwdWJsaWNQb3J0OiBudW1iZXI7XG4gIC8qKiBUaGUgcHJpdmF0ZSBwb3J0IHRoZSB3cmFwcGVkIGFwcCBpcyB0b2xkIHRvIGJpbmQuIFVuc2V0IG1lYW5zIFwicGljayBvbmVcIi4gKi9cbiAgYXBwUG9ydD86IG51bWJlcjtcbiAgLyoqIEludGVyZmFjZSBJUHMgdGhlIGdhdGUgbGlzdGVucyBvbi4gRW1wdHkgbWVhbnMgdGhlIGRlZmF1bHQgKDAuMC4wLjApLiAqL1xuICBiaW5kSG9zdHM6IHN0cmluZ1tdO1xuICB0cmFuc3BvcnQ6IGludGVyY2VwdG9yLlR1bm5lbFRyYW5zcG9ydDtcbiAgLyoqXG4gICAqIFRoZSBnYXRlIGNvbmZpZyBhcyB0aGUgYGF1dGhHYXRlYCBQTFVHSU4gdGFrZXMgaXQgLSBmbGFncyBvbmx5LCBub3RoaW5nXG4gICAqIHJlc29sdmVkLiBQYXNzZWQgc3RyYWlnaHQgdG8gdGhlIHBsdWdpbiBzbyBpdCBhcHBsaWVzIGl0cyBvd24gZmFsbGJhY2tzXG4gICAqIGV4YWN0bHkgb25jZSwgaW4gdGhlIG9uZSBwbGFjZSB0aGF0IG93bnMgdGhlbS5cbiAgICovXG4gIGdhdGVDb25maWc6IEF1dGhHYXRlQ29uZmlnO1xuICAvKiogVGhlIHNhbWUgY29uZmlnIGFmdGVyIHRoZSBwbHVnaW4ncyByZXNvbHV0aW9uLCBmb3IgYHN0YXR1c2AgYW5kIGZvciByb3V0aW5nLiAqL1xuICBnYXRlOiBwbHVnaW4uUmVzb2x2ZWRBdXRoR2F0ZUNvbmZpZztcbiAgcG9ydHI6IFJldHVyblR5cGU8dHlwZW9mIHBvcnRyLnJlc29sdmVQb3J0ckNvbmZpZz47XG4gIGZycDogUmV0dXJuVHlwZTx0eXBlb2YgZnJwLnJlc29sdmVGcnBDb25maWc+O1xufVxuXG4vKiogUmVzb2x2ZSBDTEkgZmxhZyB2YWx1ZXMgdGhyb3VnaCB0aGUgb3duaW5nIHR1bm5lbCBhbmQgYXV0aC1nYXRlIGNvbmZpZ3VyYXRpb24gcnVsZXMuICovXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZVR1bm5lbE9wdGlvbnMob3B0aW9uczogVHVubmVsT3B0aW9ucyk6IFJlc29sdmVkVHVubmVsT3B0aW9ucyB7XG4gIC8vIFRoZSBEYXRhYnJpY2tzIEFwcHMgcnVudGltZSBjb250cmFjdDogdGhlIHBsYXRmb3JtIHJvdXRlcyB0b1xuICAvLyBEQVRBQlJJQ0tTX0FQUF9QT1JULCBzbyB0aGUgV1JBUFBFUiBjbGFpbXMgaXQgYW5kIHRoZSB3cmFwcGVkIGFwcCBpcyBtb3ZlZFxuICAvLyB0byBhIHByaXZhdGUgb25lLlxuICBjb25zdCBwdWJsaWNQb3J0ID0gY29uZmlnVXRpbHMucG9ydChvcHRpb25zLnBvcnQsIFwiREFUQUJSSUNLU19BUFBfUE9SVFwiLCA4MDAwKTtcbiAgY29uc3QgYXBwUG9ydCA9IGNvbmZpZ1V0aWxzLnBvcnQob3B0aW9ucy5hcHBQb3J0LCBcIkFQUF9QT1JUXCIsIDAsIHsgcHJlZml4OiBcIlRVTk5FTFwiIH0pO1xuICBjb25zdCBnYXRlQ29uZmlnOiBBdXRoR2F0ZUNvbmZpZyA9IHtcbiAgICBhbGxvdzogb3B0aW9ucy5hbGxvdyxcbiAgICBzdWJqZWN0OiBvcHRpb25zLnN1YmplY3QsXG4gICAgYnJhbmROYW1lOiBvcHRpb25zLmJyYW5kTmFtZSxcbiAgICBtZXNzYWdlOiBvcHRpb25zLm1lc3NhZ2UsXG4gICAgLy8gQ29lcmNlZCwgbm90IHJlc29sdmVkOiB0aGUgcGx1Z2luIG93bnMgdGhlIGVudiBuYW1lIGFuZCB0aGUgZGVmYXVsdCBmb3JcbiAgICAvLyB0aGVzZSwgc28gdGhlIGZsYWcgaXMgcGFzc2VkIHRocm91Z2ggYXMgdGhlIGBjb25maWdgIHZhbHVlIGl0IGV4cGVjdHMgYW5kXG4gICAgLy8gb25seSBuZWVkcyBhIHN0cmluZyAtPiBudW1iZXIgbnVkZ2Ugb24gdGhlIHdheS5cbiAgICBzZXNzaW9uVHRsU2Vjb25kczogb3B0aW9ucy5zZXNzaW9uVHRsU2Vjb25kcyxcbiAgICBjb2RlVHRsU2Vjb25kczogb3B0aW9ucy5jb2RlVHRsU2Vjb25kcyxcbiAgICBzZXNzaW9uQ3V0b2ZmOiBvcHRpb25zLnNlc3Npb25DdXRvZmYsXG4gICAgc3RvcmFnZTogb3B0aW9ucy5zdG9yYWdlLFxuICAgIHNxbGl0ZVBhdGg6IG9wdGlvbnMuc3FsaXRlUGF0aCxcbiAgICBmb3J3YXJkSGVhZGVyczogb3B0aW9ucy5mb3J3YXJkSGVhZGVycyxcbiAgICBnYXRlUGF0aHM6IG9wdGlvbnMuZ2F0ZVBhdGhzLFxuICAgIGluc2VjdXJlOiBvcHRpb25zLmluc2VjdXJlLFxuICAgIHB1YmxpY0RvbWFpbjogb3B0aW9ucy5wdWJsaWNEb21haW4sXG4gICAgcHVibGljRG9tYWluczogb3B0aW9ucy5mcnBQdWJsaWNEb21haW4gPyBbb3B0aW9ucy5mcnBQdWJsaWNEb21haW5dIDogdW5kZWZpbmVkLFxuICB9O1xuICBjb25zdCBnYXRlID0gcGx1Z2luLnJlc29sdmVBdXRoR2F0ZUNvbmZpZyhnYXRlQ29uZmlnKTtcbiAgY29uc3QgdHJhbnNwb3J0ID0gaW50ZXJjZXB0b3IucmVzb2x2ZVR1bm5lbFRyYW5zcG9ydChvcHRpb25zLnRyYW5zcG9ydCk7XG4gIHJldHVybiB7XG4gICAgcHVibGljUG9ydCxcbiAgICAuLi4oYXBwUG9ydCA+IDAgPyB7IGFwcFBvcnQgfSA6IHt9KSxcbiAgICBiaW5kSG9zdHM6IG9wdGlvbnMuYmluZEhvc3RzID8/IFtdLFxuICAgIHRyYW5zcG9ydCxcbiAgICBnYXRlQ29uZmlnLFxuICAgIGdhdGUsXG4gICAgcG9ydHI6IHBvcnRyLnJlc29sdmVQb3J0ckNvbmZpZyh7XG4gICAgICBwdWJsaWNEb21haW46IGdhdGUucHVibGljRG9tYWluLFxuICAgICAgc3ViZG9tYWluOiBvcHRpb25zLnN1YmRvbWFpbixcbiAgICAgIHBvcnQ6IHB1YmxpY1BvcnQsXG4gICAgfSksXG4gICAgZnJwOiBmcnAucmVzb2x2ZUZycENvbmZpZyh7XG4gICAgICBwdWJsaWNEb21haW46IG9wdGlvbnMuZnJwUHVibGljRG9tYWluLFxuICAgICAgc2VydmVyOiBvcHRpb25zLmZycFNlcnZlcixcbiAgICAgIHNlcnZlclBvcnQ6IG9wdGlvbnMuZnJwU2VydmVyUG9ydCxcbiAgICAgIHByb3RvY29sOiBvcHRpb25zLmZycFByb3RvY29sLFxuICAgICAgdG9rZW46IG9wdGlvbnMuZnJwVG9rZW4sXG4gICAgICBwcm94eU5hbWU6IG9wdGlvbnMuZnJwUHJveHlOYW1lLFxuICAgICAgcG9ydDogcHVibGljUG9ydCxcbiAgICB9KSxcbiAgfTtcbn1cbiJdfQ==

package/lib/src/tunnel/proxy.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The reverse proxy that makes the wrapper path possible.
+ *
+ * The wrapper claims the PUBLIC port and the wrapped app runs as a child process
+ * on a private loopback port, so - unlike the in-process plugin - there is no
+ * middleware chain to insert the gate into. This proxy is that insertion point: it
+ * answers the login routes itself, applies the gate to everything else, and
+ * forwards what survives to the child.
+ *
+ * The gating DECISION is not reimplemented here. `@dbx-tools/tunnel`'s
+ * `gate.gateRequest` makes it - the same function the Express middleware calls -
+ * and this module only differs in how the outcome is written: a proxied request
+ * instead of `next()`, a `writeHead` instead of `res.json`. That is deliberate:
+ * two independent implementations of "which requests are gated and which headers
+ * are stripped" is the one way this package could become a security bug.
+ *
+ * @module
+ */
+import { type AuthGateApi } from "@dbx-tools/tunnel";
+/** Listener, upstream application, and optional authentication settings for the wrapper proxy. */
+export interface ProxyOptions {
+    /** The port this proxy listens on - the port portr and the platform route to. */
+    publicPort: number;
+    /** The private loopback port the wrapped app listens on. */
+    appPort: number;
+    /** The gate handlers. Omitted (an `--insecure` run) forwards everything. */
+    gate?: AuthGateApi;
+    /** Extra `x-` headers tunnel traffic may forward. */
+    forwardHeaders?: readonly string[];
+    /** Path prefixes to gate beyond `/api/` (e.g. `/ws` for a WebSocket app). */
+    gatePaths?: readonly string[];
+    /** Brand name for the hosted login page shown on a denied browser navigation. */
+    brandName?: string;
+    /**
+     * Addresses to listen on. Defaults to a single `0.0.0.0` (every interface),
+     * the portr/platform case. Pass specific interface IPs to expose the gate on
+     * only those - e.g. an overlay/LAN address while loopback reaches the upstream
+     * directly and ungated.
+     */
+    bindHosts?: readonly string[];
+}
+/**
+ * Start the proxy and resolve once it is listening.
+ *
+ * `publicDomain` is intentionally NOT passed to `gateRequest`: on this path every
+ * request arrived on the public port, so it IS tunnel traffic by construction -
+ * whereas the in-process gate shares a port with the platform front door and has
+ * to tell them apart by `Host`. Passing the request's own host keeps the shared
+ * decision function's contract satisfied without weakening it.
+ */
+export declare function startProxy(options: ProxyOptions): Promise<void>;