@dbx-tools/shared-core 0.6.46 → 0.6.49

package/lib/src/token.js

@@ -12,6 +12,20 @@ import { isLevelEnabled, logger } from "./log.js";
 const BEARER_PREFIX_REGEX = /^bearer\s+/i;
 const SPLIT_REGEX = /\s+|\s*,\s*/;
 const log = logger("shared/token");
+/**
+ * Header the Databricks Apps front door forwards the caller's OAuth (OBO) token
+ * on - the default source for every helper here.
+ *
+ * Exported because it is a wire contract several packages branch on, not just a
+ * default argument: `@dbx-tools/appkit`'s `identity` module decides whether a
+ * request can use OBO auth at all by its presence, and `@dbx-tools/cli-tunnel`
+ * must know the name to strip inbound copies of it. One spelling, one place.
+ */
+export const ACCESS_TOKEN_HEADER = "x-forwarded-access-token";
+/** Header the front door forwards the caller's user id on. */
+export const USER_ID_HEADER = "x-forwarded-user";
+/** Header the front door forwards the caller's email on. */
+export const USER_EMAIL_HEADER = "x-forwarded-email";
 /**
  * Decode a JWT segment (base64url with standard base64 padding), or
  * `undefined` when the segment is not valid base64.
@@ -34,7 +48,7 @@ function decodeJwtSegment(segment) {
  * When `input` is header-like, walks every value for `headerName` (default
  * `x-forwarded-access-token`) and merges claim keys left-to-right.
  */
-export function getAccessTokenPayload(input, headerName = "x-forwarded-access-token") {
+export function getAccessTokenPayload(input, headerName = ACCESS_TOKEN_HEADER) {
     let accessTokenPayload;
     if (!(typeof input === "string")) {
         if (headerName) {
@@ -123,4 +137,4 @@ function* iterateClaims(input, distinct = true) {
     }
     yield* visit(input);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9rZW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7R0FPRztBQUVILE9BQU8sRUFBRSxrQkFBa0IsRUFBbUIsTUFBTSxXQUFXLENBQUM7QUFDaEUsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFDbEMsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFbEQsTUFBTSxtQkFBbUIsR0FBRyxhQUFhLENBQUM7QUFDMUMsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDO0FBQ2xDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQztBQUVuQzs7O0dBR0c7QUFDSCxTQUFTLGdCQUFnQixDQUFDLE9BQWU7SUFDdkMsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQztJQUNqRSxNQUFNLE1BQU0sR0FBRyxVQUFVLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMxRSxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDNUIsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNoRSxPQUFPLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0FBQ0gsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHFCQUFxQixDQUNuQyxLQUEwQixFQUMxQixhQUFpQywwQkFBMEI7SUFFM0QsSUFBSSxrQkFBdUQsQ0FBQztJQUM1RCxJQUFJLENBQUMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2pDLElBQUksVUFBVSxFQUFFLENBQUM7WUFDZixrQkFBa0IsQ0FBQyxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUU7Z0JBQ3RELEtBQUssTUFBTSxDQUFDLFVBQVUsRUFBRSxZQUFZLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLHFCQUFxQixDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztvQkFDdEYsSUFBSSxDQUFDLGtCQUFrQixJQUFJLENBQUMsQ0FBQyxVQUFVLElBQUksa0JBQWtCLENBQUMsRUFBRSxDQUFDO3dCQUMvRCxJQUFJLENBQUMsa0JBQWtCOzRCQUFFLGtCQUFrQixHQUFHLEVBQUUsQ0FBQzt3QkFDakQsa0JBQWtCLENBQUMsVUFBVSxDQUFDLEdBQUcsWUFBWSxDQUFDO29CQUNoRCxDQUFDO2dCQUNILENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDckIsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNWLE1BQU0sS0FBSyxHQUFHLG1CQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUM5QyxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztnQkFDL0MsS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDaEMsQ0FBQztZQUNELE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ2xDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDN0Msc0VBQXNFO2dCQUN0RSxrQkFBa0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUUsQ0FBQyxDQUFDLENBQUM7WUFDckUsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLGtCQUFrQjtRQUFFLGtCQUFrQixHQUFHLEVBQUUsQ0FBQztJQUNqRCxHQUFHLENBQUMsS0FBSyxDQUFDLHVCQUF1QixFQUFFLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDO0lBQzNELE9BQU8sa0JBQWtCLENBQUM7QUFDNUIsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLG9CQUFvQixDQUNsQyxLQUEwQixFQUMxQixVQUFtQjtJQUVuQixNQUFNLE9BQU8sR0FBRyxxQkFBcUIsQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsSUFBSSxpQkFBaUIsR0FBcUIsYUFBYSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RSxJQUFJLGNBQWMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzVCLGlCQUFpQixHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNsRCxHQUFHLENBQUMsS0FBSyxDQUFDLHNCQUFzQixFQUFFLEVBQUUsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxPQUFPLGlCQUFpQixDQUFDO0FBQzNCLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSx3QkFBd0IsQ0FBQyxNQUFlLEVBQUUsT0FBMEI7SUFDbEYsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsS0FBSyxNQUFNLEtBQUssSUFBSSxhQUFhLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUMxQyxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDNUIsR0FBRyxDQUFDLEtBQUssQ0FBQywwQkFBMEIsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUMxRCxPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELDhFQUE4RTtBQUM5RSxRQUFRLENBQUMsQ0FBQyxhQUFhLENBQUMsS0FBYyxFQUFFLFFBQVEsR0FBRyxJQUFJO0lBQ3JELE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxHQUFHLEVBQVUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBRXRELFFBQVEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFjO1FBQzVCLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDOUIsS0FBSyxNQUFNLEtBQUssSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7Z0JBQzdDLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDM0IsSUFBSSxDQUFDLEtBQUssSUFBSSxJQUFJLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQy9CLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxJQUFJLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNqQixNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO2FBQU0sSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDaEMsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztnQkFDekIsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3JCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVELEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUN0QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBKV1QgYWNjZXNzLXRva2VuIGhlbHBlcnMgZm9yIERhdGFicmlja3MgQXBwcy5cbiAqXG4gKiBQYXJzZXMgYmVhcmVyIHRva2VucyBhbmQgYHgtZm9yd2FyZGVkLWFjY2Vzcy10b2tlbmAgcGF5bG9hZHMgdG8gcmVhZFxuICogT0F1dGggc2NvcGVzIGFuZCBvdGhlciBjbGFpbXMgZnJvbSBpbmNvbWluZyBIVFRQIHJlcXVlc3RzLlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbXBvcnQgeyBmb3JFYWNoSGVhZGVyVmFsdWUsIHR5cGUgSGVhZGVyTGlrZSB9IGZyb20gXCIuL2h0dHAudHNcIjtcbmltcG9ydCAqIGFzIGpzb24gZnJvbSBcIi4vanNvbi50c1wiO1xuaW1wb3J0IHsgaXNMZXZlbEVuYWJsZWQsIGxvZ2dlciB9IGZyb20gXCIuL2xvZy50c1wiO1xuXG5jb25zdCBCRUFSRVJfUFJFRklYX1JFR0VYID0gL15iZWFyZXJcXHMrL2k7XG5jb25zdCBTUExJVF9SRUdFWCA9IC9cXHMrfFxccyosXFxzKi87XG5jb25zdCBsb2cgPSBsb2dnZXIoXCJzaGFyZWQvdG9rZW5cIik7XG5cbi8qKlxuICogRGVjb2RlIGEgSldUIHNlZ21lbnQgKGJhc2U2NHVybCB3aXRoIHN0YW5kYXJkIGJhc2U2NCBwYWRkaW5nKSwgb3JcbiAqIGB1bmRlZmluZWRgIHdoZW4gdGhlIHNlZ21lbnQgaXMgbm90IHZhbGlkIGJhc2U2NC5cbiAqL1xuZnVuY3Rpb24gZGVjb2RlSnd0U2VnbWVudChzZWdtZW50OiBzdHJpbmcpOiBzdHJpbmcgfCB1bmRlZmluZWQge1xuICBjb25zdCBub3JtYWxpemVkID0gc2VnbWVudC5yZXBsYWNlKC8tL2csIFwiK1wiKS5yZXBsYWNlKC9fL2csIFwiL1wiKTtcbiAgY29uc3QgcGFkZGVkID0gbm9ybWFsaXplZCArIFwiPVwiLnJlcGVhdCgoNCAtIChub3JtYWxpemVkLmxlbmd0aCAlIDQpKSAlIDQpO1xuICB0cnkge1xuICAgIGNvbnN0IGJpbmFyeSA9IGF0b2IocGFkZGVkKTtcbiAgICBjb25zdCBieXRlcyA9IFVpbnQ4QXJyYXkuZnJvbShiaW5hcnksIChjaCkgPT4gY2guY2hhckNvZGVBdCgwKSk7XG4gICAgcmV0dXJuIG5ldyBUZXh0RGVjb2RlcigpLmRlY29kZShieXRlcyk7XG4gIH0gY2F0Y2gge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cblxuLyoqXG4gKiBEZWNvZGUgdGhlIEpXVCBwYXlsb2FkIGZyb20gYSBiZWFyZXIgdG9rZW4gc3RyaW5nIG9yIHJlcXVlc3QgaGVhZGVycy5cbiAqXG4gKiBXaGVuIGBpbnB1dGAgaXMgaGVhZGVyLWxpa2UsIHdhbGtzIGV2ZXJ5IHZhbHVlIGZvciBgaGVhZGVyTmFtZWAgKGRlZmF1bHRcbiAqIGB4LWZvcndhcmRlZC1hY2Nlc3MtdG9rZW5gKSBhbmQgbWVyZ2VzIGNsYWltIGtleXMgbGVmdC10by1yaWdodC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldEFjY2Vzc1Rva2VuUGF5bG9hZChcbiAgaW5wdXQ6IEhlYWRlckxpa2UgfCBzdHJpbmcsXG4gIGhlYWRlck5hbWU6IHN0cmluZyB8IHVuZGVmaW5lZCA9IFwieC1mb3J3YXJkZWQtYWNjZXNzLXRva2VuXCIsXG4pOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiB7XG4gIGxldCBhY2Nlc3NUb2tlblBheWxvYWQ6IFJlY29yZDxzdHJpbmcsIHVua25vd24+IHwgdW5kZWZpbmVkO1xuICBpZiAoISh0eXBlb2YgaW5wdXQgPT09IFwic3RyaW5nXCIpKSB7XG4gICAgaWYgKGhlYWRlck5hbWUpIHtcbiAgICAgIGZvckVhY2hIZWFkZXJWYWx1ZShpbnB1dCwgaGVhZGVyTmFtZSwgKHZhbHVlOiBzdHJpbmcpID0+IHtcbiAgICAgICAgZm9yIChjb25zdCBbcGF5bG9hZEtleSwgcGF5bG9hZFZhbHVlXSBvZiBPYmplY3QuZW50cmllcyhnZXRBY2Nlc3NUb2tlblBheWxvYWQodmFsdWUpKSkge1xuICAgICAgICAgIGlmICghYWNjZXNzVG9rZW5QYXlsb2FkIHx8ICEocGF5bG9hZEtleSBpbiBhY2Nlc3NUb2tlblBheWxvYWQpKSB7XG4gICAgICAgICAgICBpZiAoIWFjY2Vzc1Rva2VuUGF5bG9hZCkgYWNjZXNzVG9rZW5QYXlsb2FkID0ge307XG4gICAgICAgICAgICBhY2Nlc3NUb2tlblBheWxvYWRbcGF5bG9hZEtleV0gPSBwYXlsb2FkVmFsdWU7XG4gICAgICAgICAgfVxuICAgICAgICB9XG4gICAgICB9KTtcbiAgICB9XG4gIH0gZWxzZSB7XG4gICAgaW5wdXQgPSBpbnB1dC50cmltKCk7XG4gICAgaWYgKGlucHV0KSB7XG4gICAgICBjb25zdCBtYXRjaCA9IEJFQVJFUl9QUkVGSVhfUkVHRVguZXhlYyhpbnB1dCk7XG4gICAgICBpZiAobWF0Y2gpIHtcbiAgICAgICAgY29uc3QgZW5kSW5kZXggPSBtYXRjaC5pbmRleCArIG1hdGNoWzBdLmxlbmd0aDtcbiAgICAgICAgaW5wdXQgPSBpbnB1dC5zbGljZShlbmRJbmRleCk7XG4gICAgICB9XG4gICAgICBjb25zdCBwYXJ0cyA9IGlucHV0LnNwbGl0KFwiLlwiLCA0KTtcbiAgICAgIGlmIChwYXJ0cy5sZW5ndGggPT09IDIgfHwgcGFydHMubGVuZ3RoID09PSAzKSB7XG4gICAgICAgIC8vIEEgbWFsZm9ybWVkIHNlZ21lbnQgeWllbGRzIHVuZGVmaW5lZDsgZmFsbCB0aHJvdWdoIHRvIGVtcHR5IG9iamVjdC5cbiAgICAgICAgYWNjZXNzVG9rZW5QYXlsb2FkID0ganNvbi5wYXJzZVJlY29yZChkZWNvZGVKd3RTZWdtZW50KHBhcnRzWzFdISkpO1xuICAgICAgfVxuICAgIH1cbiAgfVxuICBpZiAoIWFjY2Vzc1Rva2VuUGF5bG9hZCkgYWNjZXNzVG9rZW5QYXlsb2FkID0ge307XG4gIGxvZy5kZWJ1ZyhcImdldEFjY2Vzc1Rva2VuUGF5bG9hZFwiLCB7IGFjY2Vzc1Rva2VuUGF5bG9hZCB9KTtcbiAgcmV0dXJuIGFjY2Vzc1Rva2VuUGF5bG9hZDtcbn1cblxuLyoqXG4gKiBPQXV0aCBzY29wZXMgZnJvbSB0aGUgYWNjZXNzLXRva2VuIEpXVCBvbiBgaW5wdXRgLlxuICpcbiAqIERlZmF1bHRzIHRvIHRoZSBgeC1mb3J3YXJkZWQtYWNjZXNzLXRva2VuYCBoZWFkZXIsIHdoaWNoIERhdGFicmlja3MgQXBwc1xuICogZm9yd2FyZCBmcm9tIHRoZSBicm93c2VyIHNlc3Npb24uXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBnZXRBY2Nlc3NUb2tlblNjb3BlcyhcbiAgaW5wdXQ6IEhlYWRlckxpa2UgfCBzdHJpbmcsXG4gIGhlYWRlck5hbWU/OiBzdHJpbmcsXG4pOiBJdGVyYWJsZTxzdHJpbmc+IHtcbiAgY29uc3QgcGF5bG9hZCA9IGdldEFjY2Vzc1Rva2VuUGF5bG9hZChpbnB1dCwgaGVhZGVyTmFtZSk7XG4gIGxldCBhY2Nlc3NUb2tlblNjb3BlczogSXRlcmFibGU8c3RyaW5nPiA9IGl0ZXJhdGVDbGFpbXMocGF5bG9hZC5zY29wZSk7XG4gIGlmIChpc0xldmVsRW5hYmxlZChcImRlYnVnXCIpKSB7XG4gICAgYWNjZXNzVG9rZW5TY29wZXMgPSBBcnJheS5mcm9tKGFjY2Vzc1Rva2VuU2NvcGVzKTtcbiAgICBsb2cuZGVidWcoXCJnZXRBY2Nlc3NUb2tlblNjb3Blc1wiLCB7IGFjY2Vzc1Rva2VuU2NvcGVzIH0pO1xuICB9XG4gIHJldHVybiBhY2Nlc3NUb2tlblNjb3Blcztcbn1cblxuLyoqXG4gKiBSZXR1cm4gdHJ1ZSB3aGVuIGBzY29wZXNgIGNvbnRhaW5zIGFueSB2YWx1ZSBmcm9tIGBhbGxvd2VkYC5cbiAqXG4gKiBBY2NlcHRzIHRoZSByYXcge0BsaW5rIE1BU1RSQV9TQ09QRVNfS0VZfSBhcnJheSBzdGFtcGVkIG9uXG4gKiBgUmVxdWVzdENvbnRleHRgIGFzIHdlbGwgYXMgaXRlcmFibGVzIGZyb20ge0BsaW5rIGdldEFjY2Vzc1Rva2VuU2NvcGVzfS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGluY2x1ZGVzQWNjZXNzVG9rZW5TY29wZShzY29wZXM6IHVua25vd24sIGFsbG93ZWQ6IHJlYWRvbmx5IHN0cmluZ1tdKTogYm9vbGVhbiB7XG4gIGlmIChhbGxvd2VkLmxlbmd0aCkge1xuICAgIGZvciAoY29uc3Qgc2NvcGUgb2YgaXRlcmF0ZUNsYWltcyhzY29wZXMpKSB7XG4gICAgICBpZiAoYWxsb3dlZC5pbmNsdWRlcyhzY29wZSkpIHtcbiAgICAgICAgbG9nLmRlYnVnKFwiaW5jbHVkZXNBY2Nlc3NUb2tlblNjb3BlXCIsIHsgc2NvcGUsIGFsbG93ZWQgfSk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgICAgfVxuICAgIH1cbiAgfVxuICByZXR1cm4gZmFsc2U7XG59XG5cbi8qKiBTcGxpdCBhIEpXVCBgc2NvcGVgIGNsYWltIHN0cmluZyBvciBhcnJheSBpbnRvIGluZGl2aWR1YWwgc2NvcGUgdG9rZW5zLiAqL1xuZnVuY3Rpb24qIGl0ZXJhdGVDbGFpbXMoaW5wdXQ6IHVua25vd24sIGRpc3RpbmN0ID0gdHJ1ZSk6IEl0ZXJhYmxlPHN0cmluZz4ge1xuICBjb25zdCBzZWVuID0gZGlzdGluY3QgPyBuZXcgU2V0PHN0cmluZz4oKSA6IHVuZGVmaW5lZDtcblxuICBmdW5jdGlvbiogdmlzaXQodmFsdWU6IHVua25vd24pOiBJdGVyYWJsZTxzdHJpbmc+IHtcbiAgICBpZiAodHlwZW9mIHZhbHVlID09PSBcInN0cmluZ1wiKSB7XG4gICAgICBmb3IgKGNvbnN0IGNsYWltIG9mIHZhbHVlLnNwbGl0KFNQTElUX1JFR0VYKSkge1xuICAgICAgICBjb25zdCB0b2tlbiA9IGNsYWltLnRyaW0oKTtcbiAgICAgICAgaWYgKCF0b2tlbiB8fCBzZWVuPy5oYXModG9rZW4pKSB7XG4gICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgc2Vlbj8uYWRkKHRva2VuKTtcbiAgICAgICAgeWllbGQgdG9rZW47XG4gICAgICB9XG4gICAgfSBlbHNlIGlmIChBcnJheS5pc0FycmF5KHZhbHVlKSkge1xuICAgICAgZm9yIChjb25zdCBpdGVtIG9mIHZhbHVlKSB7XG4gICAgICAgIHlpZWxkKiB2aXNpdChpdGVtKTtcbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICB5aWVsZCogdmlzaXQoaW5wdXQpO1xufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9rZW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7R0FPRztBQUVILE9BQU8sRUFBRSxrQkFBa0IsRUFBbUIsTUFBTSxXQUFXLENBQUM7QUFDaEUsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFDbEMsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFFbEQsTUFBTSxtQkFBbUIsR0FBRyxhQUFhLENBQUM7QUFDMUMsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDO0FBQ2xDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQztBQUVuQzs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLDBCQUEwQixDQUFDO0FBRTlELDhEQUE4RDtBQUM5RCxNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsa0JBQWtCLENBQUM7QUFFakQsNERBQTREO0FBQzVELE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLG1CQUFtQixDQUFDO0FBRXJEOzs7R0FHRztBQUNILFNBQVMsZ0JBQWdCLENBQUMsT0FBZTtJQUN2QyxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sTUFBTSxHQUFHLFVBQVUsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzFFLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM1QixNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLE9BQU8sSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQ25DLEtBQTBCLEVBQzFCLGFBQWlDLG1CQUFtQjtJQUVwRCxJQUFJLGtCQUF1RCxDQUFDO0lBQzVELElBQUksQ0FBQyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakMsSUFBSSxVQUFVLEVBQUUsQ0FBQztZQUNmLGtCQUFrQixDQUFDLEtBQUssRUFBRSxVQUFVLEVBQUUsQ0FBQyxLQUFhLEVBQUUsRUFBRTtnQkFDdEQsS0FBSyxNQUFNLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMscUJBQXFCLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO29CQUN0RixJQUFJLENBQUMsa0JBQWtCLElBQUksQ0FBQyxDQUFDLFVBQVUsSUFBSSxrQkFBa0IsQ0FBQyxFQUFFLENBQUM7d0JBQy9ELElBQUksQ0FBQyxrQkFBa0I7NEJBQUUsa0JBQWtCLEdBQUcsRUFBRSxDQUFDO3dCQUNqRCxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsR0FBRyxZQUFZLENBQUM7b0JBQ2hELENBQUM7Z0JBQ0gsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztJQUNILENBQUM7U0FBTSxDQUFDO1FBQ04sS0FBSyxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNyQixJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzlDLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ1YsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO2dCQUMvQyxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNoQyxDQUFDO1lBQ0QsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDbEMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUM3QyxzRUFBc0U7Z0JBQ3RFLGtCQUFrQixHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBRSxDQUFDLENBQUMsQ0FBQztZQUNyRSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsa0JBQWtCO1FBQUUsa0JBQWtCLEdBQUcsRUFBRSxDQUFDO0lBQ2pELEdBQUcsQ0FBQyxLQUFLLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxrQkFBa0IsRUFBRSxDQUFDLENBQUM7SUFDM0QsT0FBTyxrQkFBa0IsQ0FBQztBQUM1QixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsb0JBQW9CLENBQ2xDLEtBQTBCLEVBQzFCLFVBQW1CO0lBRW5CLE1BQU0sT0FBTyxHQUFHLHFCQUFxQixDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsQ0FBQztJQUN6RCxJQUFJLGlCQUFpQixHQUFxQixhQUFhLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZFLElBQUksY0FBYyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDNUIsaUJBQWlCLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ2xELEdBQUcsQ0FBQyxLQUFLLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELE9BQU8saUJBQWlCLENBQUM7QUFDM0IsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHdCQUF3QixDQUFDLE1BQWUsRUFBRSxPQUEwQjtJQUNsRixJQUFJLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuQixLQUFLLE1BQU0sS0FBSyxJQUFJLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQzFDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUM1QixHQUFHLENBQUMsS0FBSyxDQUFDLDBCQUEwQixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7Z0JBQzFELE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsOEVBQThFO0FBQzlFLFFBQVEsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxLQUFjLEVBQUUsUUFBUSxHQUFHLElBQUk7SUFDckQsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLEdBQUcsRUFBVSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFFdEQsUUFBUSxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQWM7UUFDNUIsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUM5QixLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUMzQixJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFDL0IsU0FBUztnQkFDWCxDQUFDO2dCQUNELElBQUksRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ2pCLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7YUFBTSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoQyxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUN6QixLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDckIsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ3RCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEpXVCBhY2Nlc3MtdG9rZW4gaGVscGVycyBmb3IgRGF0YWJyaWNrcyBBcHBzLlxuICpcbiAqIFBhcnNlcyBiZWFyZXIgdG9rZW5zIGFuZCBgeC1mb3J3YXJkZWQtYWNjZXNzLXRva2VuYCBwYXlsb2FkcyB0byByZWFkXG4gKiBPQXV0aCBzY29wZXMgYW5kIG90aGVyIGNsYWltcyBmcm9tIGluY29taW5nIEhUVFAgcmVxdWVzdHMuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IGZvckVhY2hIZWFkZXJWYWx1ZSwgdHlwZSBIZWFkZXJMaWtlIH0gZnJvbSBcIi4vaHR0cC50c1wiO1xuaW1wb3J0ICogYXMganNvbiBmcm9tIFwiLi9qc29uLnRzXCI7XG5pbXBvcnQgeyBpc0xldmVsRW5hYmxlZCwgbG9nZ2VyIH0gZnJvbSBcIi4vbG9nLnRzXCI7XG5cbmNvbnN0IEJFQVJFUl9QUkVGSVhfUkVHRVggPSAvXmJlYXJlclxccysvaTtcbmNvbnN0IFNQTElUX1JFR0VYID0gL1xccyt8XFxzKixcXHMqLztcbmNvbnN0IGxvZyA9IGxvZ2dlcihcInNoYXJlZC90b2tlblwiKTtcblxuLyoqXG4gKiBIZWFkZXIgdGhlIERhdGFicmlja3MgQXBwcyBmcm9udCBkb29yIGZvcndhcmRzIHRoZSBjYWxsZXIncyBPQXV0aCAoT0JPKSB0b2tlblxuICogb24gLSB0aGUgZGVmYXVsdCBzb3VyY2UgZm9yIGV2ZXJ5IGhlbHBlciBoZXJlLlxuICpcbiAqIEV4cG9ydGVkIGJlY2F1c2UgaXQgaXMgYSB3aXJlIGNvbnRyYWN0IHNldmVyYWwgcGFja2FnZXMgYnJhbmNoIG9uLCBub3QganVzdCBhXG4gKiBkZWZhdWx0IGFyZ3VtZW50OiBgQGRieC10b29scy9hcHBraXRgJ3MgYGlkZW50aXR5YCBtb2R1bGUgZGVjaWRlcyB3aGV0aGVyIGFcbiAqIHJlcXVlc3QgY2FuIHVzZSBPQk8gYXV0aCBhdCBhbGwgYnkgaXRzIHByZXNlbmNlLCBhbmQgYEBkYngtdG9vbHMvY2xpLXR1bm5lbGBcbiAqIG11c3Qga25vdyB0aGUgbmFtZSB0byBzdHJpcCBpbmJvdW5kIGNvcGllcyBvZiBpdC4gT25lIHNwZWxsaW5nLCBvbmUgcGxhY2UuXG4gKi9cbmV4cG9ydCBjb25zdCBBQ0NFU1NfVE9LRU5fSEVBREVSID0gXCJ4LWZvcndhcmRlZC1hY2Nlc3MtdG9rZW5cIjtcblxuLyoqIEhlYWRlciB0aGUgZnJvbnQgZG9vciBmb3J3YXJkcyB0aGUgY2FsbGVyJ3MgdXNlciBpZCBvbi4gKi9cbmV4cG9ydCBjb25zdCBVU0VSX0lEX0hFQURFUiA9IFwieC1mb3J3YXJkZWQtdXNlclwiO1xuXG4vKiogSGVhZGVyIHRoZSBmcm9udCBkb29yIGZvcndhcmRzIHRoZSBjYWxsZXIncyBlbWFpbCBvbi4gKi9cbmV4cG9ydCBjb25zdCBVU0VSX0VNQUlMX0hFQURFUiA9IFwieC1mb3J3YXJkZWQtZW1haWxcIjtcblxuLyoqXG4gKiBEZWNvZGUgYSBKV1Qgc2VnbWVudCAoYmFzZTY0dXJsIHdpdGggc3RhbmRhcmQgYmFzZTY0IHBhZGRpbmcpLCBvclxuICogYHVuZGVmaW5lZGAgd2hlbiB0aGUgc2VnbWVudCBpcyBub3QgdmFsaWQgYmFzZTY0LlxuICovXG5mdW5jdGlvbiBkZWNvZGVKd3RTZWdtZW50KHNlZ21lbnQ6IHN0cmluZyk6IHN0cmluZyB8IHVuZGVmaW5lZCB7XG4gIGNvbnN0IG5vcm1hbGl6ZWQgPSBzZWdtZW50LnJlcGxhY2UoLy0vZywgXCIrXCIpLnJlcGxhY2UoL18vZywgXCIvXCIpO1xuICBjb25zdCBwYWRkZWQgPSBub3JtYWxpemVkICsgXCI9XCIucmVwZWF0KCg0IC0gKG5vcm1hbGl6ZWQubGVuZ3RoICUgNCkpICUgNCk7XG4gIHRyeSB7XG4gICAgY29uc3QgYmluYXJ5ID0gYXRvYihwYWRkZWQpO1xuICAgIGNvbnN0IGJ5dGVzID0gVWludDhBcnJheS5mcm9tKGJpbmFyeSwgKGNoKSA9PiBjaC5jaGFyQ29kZUF0KDApKTtcbiAgICByZXR1cm4gbmV3IFRleHREZWNvZGVyKCkuZGVjb2RlKGJ5dGVzKTtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuXG4vKipcbiAqIERlY29kZSB0aGUgSldUIHBheWxvYWQgZnJvbSBhIGJlYXJlciB0b2tlbiBzdHJpbmcgb3IgcmVxdWVzdCBoZWFkZXJzLlxuICpcbiAqIFdoZW4gYGlucHV0YCBpcyBoZWFkZXItbGlrZSwgd2Fsa3MgZXZlcnkgdmFsdWUgZm9yIGBoZWFkZXJOYW1lYCAoZGVmYXVsdFxuICogYHgtZm9yd2FyZGVkLWFjY2Vzcy10b2tlbmApIGFuZCBtZXJnZXMgY2xhaW0ga2V5cyBsZWZ0LXRvLXJpZ2h0LlxuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0QWNjZXNzVG9rZW5QYXlsb2FkKFxuICBpbnB1dDogSGVhZGVyTGlrZSB8IHN0cmluZyxcbiAgaGVhZGVyTmFtZTogc3RyaW5nIHwgdW5kZWZpbmVkID0gQUNDRVNTX1RPS0VOX0hFQURFUixcbik6IFJlY29yZDxzdHJpbmcsIHVua25vd24+IHtcbiAgbGV0IGFjY2Vzc1Rva2VuUGF5bG9hZDogUmVjb3JkPHN0cmluZywgdW5rbm93bj4gfCB1bmRlZmluZWQ7XG4gIGlmICghKHR5cGVvZiBpbnB1dCA9PT0gXCJzdHJpbmdcIikpIHtcbiAgICBpZiAoaGVhZGVyTmFtZSkge1xuICAgICAgZm9yRWFjaEhlYWRlclZhbHVlKGlucHV0LCBoZWFkZXJOYW1lLCAodmFsdWU6IHN0cmluZykgPT4ge1xuICAgICAgICBmb3IgKGNvbnN0IFtwYXlsb2FkS2V5LCBwYXlsb2FkVmFsdWVdIG9mIE9iamVjdC5lbnRyaWVzKGdldEFjY2Vzc1Rva2VuUGF5bG9hZCh2YWx1ZSkpKSB7XG4gICAgICAgICAgaWYgKCFhY2Nlc3NUb2tlblBheWxvYWQgfHwgIShwYXlsb2FkS2V5IGluIGFjY2Vzc1Rva2VuUGF5bG9hZCkpIHtcbiAgICAgICAgICAgIGlmICghYWNjZXNzVG9rZW5QYXlsb2FkKSBhY2Nlc3NUb2tlblBheWxvYWQgPSB7fTtcbiAgICAgICAgICAgIGFjY2Vzc1Rva2VuUGF5bG9hZFtwYXlsb2FkS2V5XSA9IHBheWxvYWRWYWx1ZTtcbiAgICAgICAgICB9XG4gICAgICAgIH1cbiAgICAgIH0pO1xuICAgIH1cbiAgfSBlbHNlIHtcbiAgICBpbnB1dCA9IGlucHV0LnRyaW0oKTtcbiAgICBpZiAoaW5wdXQpIHtcbiAgICAgIGNvbnN0IG1hdGNoID0gQkVBUkVSX1BSRUZJWF9SRUdFWC5leGVjKGlucHV0KTtcbiAgICAgIGlmIChtYXRjaCkge1xuICAgICAgICBjb25zdCBlbmRJbmRleCA9IG1hdGNoLmluZGV4ICsgbWF0Y2hbMF0ubGVuZ3RoO1xuICAgICAgICBpbnB1dCA9IGlucHV0LnNsaWNlKGVuZEluZGV4KTtcbiAgICAgIH1cbiAgICAgIGNvbnN0IHBhcnRzID0gaW5wdXQuc3BsaXQoXCIuXCIsIDQpO1xuICAgICAgaWYgKHBhcnRzLmxlbmd0aCA9PT0gMiB8fCBwYXJ0cy5sZW5ndGggPT09IDMpIHtcbiAgICAgICAgLy8gQSBtYWxmb3JtZWQgc2VnbWVudCB5aWVsZHMgdW5kZWZpbmVkOyBmYWxsIHRocm91Z2ggdG8gZW1wdHkgb2JqZWN0LlxuICAgICAgICBhY2Nlc3NUb2tlblBheWxvYWQgPSBqc29uLnBhcnNlUmVjb3JkKGRlY29kZUp3dFNlZ21lbnQocGFydHNbMV0hKSk7XG4gICAgICB9XG4gICAgfVxuICB9XG4gIGlmICghYWNjZXNzVG9rZW5QYXlsb2FkKSBhY2Nlc3NUb2tlblBheWxvYWQgPSB7fTtcbiAgbG9nLmRlYnVnKFwiZ2V0QWNjZXNzVG9rZW5QYXlsb2FkXCIsIHsgYWNjZXNzVG9rZW5QYXlsb2FkIH0pO1xuICByZXR1cm4gYWNjZXNzVG9rZW5QYXlsb2FkO1xufVxuXG4vKipcbiAqIE9BdXRoIHNjb3BlcyBmcm9tIHRoZSBhY2Nlc3MtdG9rZW4gSldUIG9uIGBpbnB1dGAuXG4gKlxuICogRGVmYXVsdHMgdG8gdGhlIGB4LWZvcndhcmRlZC1hY2Nlc3MtdG9rZW5gIGhlYWRlciwgd2hpY2ggRGF0YWJyaWNrcyBBcHBzXG4gKiBmb3J3YXJkIGZyb20gdGhlIGJyb3dzZXIgc2Vzc2lvbi5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldEFjY2Vzc1Rva2VuU2NvcGVzKFxuICBpbnB1dDogSGVhZGVyTGlrZSB8IHN0cmluZyxcbiAgaGVhZGVyTmFtZT86IHN0cmluZyxcbik6IEl0ZXJhYmxlPHN0cmluZz4ge1xuICBjb25zdCBwYXlsb2FkID0gZ2V0QWNjZXNzVG9rZW5QYXlsb2FkKGlucHV0LCBoZWFkZXJOYW1lKTtcbiAgbGV0IGFjY2Vzc1Rva2VuU2NvcGVzOiBJdGVyYWJsZTxzdHJpbmc+ID0gaXRlcmF0ZUNsYWltcyhwYXlsb2FkLnNjb3BlKTtcbiAgaWYgKGlzTGV2ZWxFbmFibGVkKFwiZGVidWdcIikpIHtcbiAgICBhY2Nlc3NUb2tlblNjb3BlcyA9IEFycmF5LmZyb20oYWNjZXNzVG9rZW5TY29wZXMpO1xuICAgIGxvZy5kZWJ1ZyhcImdldEFjY2Vzc1Rva2VuU2NvcGVzXCIsIHsgYWNjZXNzVG9rZW5TY29wZXMgfSk7XG4gIH1cbiAgcmV0dXJuIGFjY2Vzc1Rva2VuU2NvcGVzO1xufVxuXG4vKipcbiAqIFJldHVybiB0cnVlIHdoZW4gYHNjb3Blc2AgY29udGFpbnMgYW55IHZhbHVlIGZyb20gYGFsbG93ZWRgLlxuICpcbiAqIEFjY2VwdHMgdGhlIHJhdyB7QGxpbmsgTUFTVFJBX1NDT1BFU19LRVl9IGFycmF5IHN0YW1wZWQgb25cbiAqIGBSZXF1ZXN0Q29udGV4dGAgYXMgd2VsbCBhcyBpdGVyYWJsZXMgZnJvbSB7QGxpbmsgZ2V0QWNjZXNzVG9rZW5TY29wZXN9LlxuICovXG5leHBvcnQgZnVuY3Rpb24gaW5jbHVkZXNBY2Nlc3NUb2tlblNjb3BlKHNjb3BlczogdW5rbm93biwgYWxsb3dlZDogcmVhZG9ubHkgc3RyaW5nW10pOiBib29sZWFuIHtcbiAgaWYgKGFsbG93ZWQubGVuZ3RoKSB7XG4gICAgZm9yIChjb25zdCBzY29wZSBvZiBpdGVyYXRlQ2xhaW1zKHNjb3BlcykpIHtcbiAgICAgIGlmIChhbGxvd2VkLmluY2x1ZGVzKHNjb3BlKSkge1xuICAgICAgICBsb2cuZGVidWcoXCJpbmNsdWRlc0FjY2Vzc1Rva2VuU2NvcGVcIiwgeyBzY29wZSwgYWxsb3dlZCB9KTtcbiAgICAgICAgcmV0dXJuIHRydWU7XG4gICAgICB9XG4gICAgfVxuICB9XG4gIHJldHVybiBmYWxzZTtcbn1cblxuLyoqIFNwbGl0IGEgSldUIGBzY29wZWAgY2xhaW0gc3RyaW5nIG9yIGFycmF5IGludG8gaW5kaXZpZHVhbCBzY29wZSB0b2tlbnMuICovXG5mdW5jdGlvbiogaXRlcmF0ZUNsYWltcyhpbnB1dDogdW5rbm93biwgZGlzdGluY3QgPSB0cnVlKTogSXRlcmFibGU8c3RyaW5nPiB7XG4gIGNvbnN0IHNlZW4gPSBkaXN0aW5jdCA/IG5ldyBTZXQ8c3RyaW5nPigpIDogdW5kZWZpbmVkO1xuXG4gIGZ1bmN0aW9uKiB2aXNpdCh2YWx1ZTogdW5rbm93bik6IEl0ZXJhYmxlPHN0cmluZz4ge1xuICAgIGlmICh0eXBlb2YgdmFsdWUgPT09IFwic3RyaW5nXCIpIHtcbiAgICAgIGZvciAoY29uc3QgY2xhaW0gb2YgdmFsdWUuc3BsaXQoU1BMSVRfUkVHRVgpKSB7XG4gICAgICAgIGNvbnN0IHRva2VuID0gY2xhaW0udHJpbSgpO1xuICAgICAgICBpZiAoIXRva2VuIHx8IHNlZW4/Lmhhcyh0b2tlbikpIHtcbiAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICBzZWVuPy5hZGQodG9rZW4pO1xuICAgICAgICB5aWVsZCB0b2tlbjtcbiAgICAgIH1cbiAgICB9IGVsc2UgaWYgKEFycmF5LmlzQXJyYXkodmFsdWUpKSB7XG4gICAgICBmb3IgKGNvbnN0IGl0ZW0gb2YgdmFsdWUpIHtcbiAgICAgICAgeWllbGQqIHZpc2l0KGl0ZW0pO1xuICAgICAgfVxuICAgIH1cbiAgfVxuXG4gIHlpZWxkKiB2aXNpdChpbnB1dCk7XG59XG4iXX0=

package/lib/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/async.ts","../src/brand.ts","../src/error.ts","../src/function.ts","../src/hash.ts","../src/http.ts","../src/json.ts","../src/log.ts","../src/net.ts","../src/object.ts","../src/predicate.ts","../src/string.ts","../src/token.ts","../index.ts"],"version":"5.9.3"}
+{"root":["../src/async.ts","../src/brand.ts","../src/env.ts","../src/error.ts","../src/execution.ts","../src/function.ts","../src/hash.ts","../src/http.ts","../src/json.ts","../src/log.ts","../src/net.ts","../src/object.ts","../src/pattern.ts","../src/predicate.ts","../src/string.ts","../src/token.ts","../index.ts"],"version":"5.9.3"}

package/package.json

@@ -43,7 +43,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.6.46",
+  "version": "0.6.49",
   "types": "./lib/index.d.ts",
   "type": "module",
   "exports": {

package/src/env.ts

@@ -0,0 +1,133 @@
+/**
+ * Reading configuration out of the environment.
+ *
+ * Every plugin config in this repo resolves the same way: take the typed
+ * config value when the caller set one, else fall back to one or more
+ * environment variables, else a default. Written by hand that becomes a
+ * `config.x ?? Number(process.env.X)` chain per field, and each package grew
+ * its own `fromEnv` / `resolvePositiveInt` helper with slightly different
+ * coercion rules. These are those helpers, once.
+ *
+ * Browser-safe: `process` is reached through `globalThis` and guarded, so this
+ * module needs no Node types and is inert in a browser (every lookup misses and
+ * the caller's fallback applies).
+ *
+ * @module
+ */
+
+import { toBoolean } from "./object.ts";
+import { parseList, trimToNull } from "./string.ts";
+
+/** `process`-shaped view off `globalThis`, so no node types are needed. */
+interface ProcessLike {
+  env?: Record<string, string | undefined>;
+}
+
+/** One env var name, or several tried in order. */
+export type EnvKey = string | readonly string[];
+
+/** The ambient environment, or `{}` off-process (a browser). */
+function environment(): Record<string, string | undefined> {
+  return (globalThis as { process?: ProcessLike }).process?.env ?? {};
+}
+
+/**
+ * First non-empty value among `keys`, trimmed, else `null`.
+ *
+ * Several names for one setting is the norm (a package-specific variable plus
+ * the Databricks-standard one), so `keys` is order-sensitive: earlier names win.
+ *
+ * @example
+ * env.text(["TEAMS_APP_ID", "MICROSOFT_APP_ID"]);
+ */
+export function text(keys: EnvKey): string | null {
+  const env = environment();
+  for (const key of typeof keys === "string" ? [keys] : keys) {
+    const value = trimToNull(env[key]);
+    if (value !== null) return value;
+  }
+  return null;
+}
+
+/**
+ * Resolve a string setting: `configured` when set and non-empty, else the first
+ * non-empty variable among `keys`, else `null`.
+ *
+ * @example
+ * env.string(config.host, "SMTP_HOST");
+ */
+export function string(configured: unknown, keys: EnvKey): string | null {
+  return trimToNull(configured) ?? text(keys);
+}
+
+/**
+ * Resolve a boolean setting through {@link toBoolean}, so the loose spellings an
+ * env var actually carries (`1`, `on`, `yes`, ...) are accepted. Returns
+ * `undefined` when neither source is interpretable, letting the caller pick a
+ * default with `??`.
+ *
+ * @example
+ * env.boolean(config.fuzzy, "WEB_SEARCH_FUZZY") ?? true;
+ */
+export function boolean(configured: unknown, keys: EnvKey): boolean | undefined {
+  return toBoolean(configured) ?? toBoolean(text(keys));
+}
+
+/**
+ * Resolve a positive-number setting that may be fractional (a score threshold,
+ * a ratio): `configured` when it is a finite number greater than zero, else the
+ * first variable among `keys` that parses that way, else `fallback`.
+ *
+ * {@link positiveInt} is the right choice for a count; this one keeps the
+ * fraction, so a `0.4` threshold does not floor to `0`.
+ *
+ * @example
+ * env.positiveNumber(config.fuzzyThreshold, "SEARCH_FUZZY_THRESHOLD", 0.4);
+ */
+export function positiveNumber(configured: unknown, keys: EnvKey, fallback: number): number {
+  return toPositiveNumber(configured) ?? toPositiveNumber(text(keys)) ?? fallback;
+}
+
+/**
+ * Resolve a positive-integer setting (a port, timeout, page size, or cap):
+ * `configured` when it is a finite number greater than zero, else the first
+ * variable among `keys` that parses that way, else `fallback`. Floored, so a
+ * fractional value can't leak into a count.
+ *
+ * A non-numeric or non-positive value is treated as absent rather than fatal -
+ * these are ceilings and timeouts where a sane default beats a boot failure.
+ *
+ * @example
+ * env.positiveInt(config.timeoutMs, "SEARCH_TIMEOUT_MS", 30_000);
+ */
+export function positiveInt(configured: unknown, keys: EnvKey, fallback: number): number {
+  return toPositiveInt(configured) ?? toPositiveInt(text(keys)) ?? fallback;
+}
+
+function toPositiveNumber(value: unknown): number | undefined {
+  if (value === null || value === undefined || value === "") return undefined;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+
+function toPositiveInt(value: unknown): number | undefined {
+  const parsed = toPositiveNumber(value);
+  return parsed === undefined ? undefined : Math.floor(parsed);
+}
+
+/**
+ * Resolve a list setting through {@link parseList}, so an array from typed
+ * config and a `"a, b c"` env string normalize identically. Returns `[]` when
+ * neither source has entries.
+ *
+ * @example
+ * env.list(config.modelFallbacks, "WEB_SEARCH_MODEL_FALLBACKS");
+ */
+export function list(
+  configured: string | readonly string[] | undefined | null,
+  keys: EnvKey,
+  transform?: (entry: string) => string,
+): string[] {
+  const fromConfig = parseList(configured, transform);
+  return fromConfig.length > 0 ? fromConfig : parseList(text(keys), transform);
+}

package/src/execution.ts

@@ -0,0 +1,71 @@
+/** Generic helpers for AppKit-style intercepted execution. */
+import * as async from "./async.ts";
+import * as error from "./error.ts";
+import * as object from "./object.ts";
+
+/** Success/failure shape returned by an interceptor-backed executor. */
+export type ExecutionResult<T> =
+  { ok: true; data: T } | { ok: false; status: number; message: string };
+
+/** Function signature shared by AppKit plugin executors. */
+export type Executor<Settings> = <T>(
+  fn: (signal?: AbortSignal) => Promise<T>,
+  settings: Settings,
+) => Promise<ExecutionResult<T>>;
+
+/** Failure details supplied when an intercepted operation cannot complete. */
+export interface ExecutionFailure {
+  operation: string;
+  status: number;
+  message: string;
+}
+
+/** Options for running and unwrapping one intercepted operation. */
+export interface RunOptions<T, Settings> {
+  operation: string;
+  settings: Settings;
+  execute: Executor<Settings>;
+  fn: (signal?: AbortSignal) => Promise<T>;
+  signal?: AbortSignal;
+  canceled: () => Error;
+  failed: (failure: ExecutionFailure) => Error;
+}
+
+function errorStatus(value: unknown): number {
+  if (!object.isRecord(value)) return 500;
+  const status = value.statusCode;
+  return typeof status === "number" && Number.isFinite(status) ? status : 500;
+}
+
+/**
+ * Build the executor used before a plugin installs its interceptor chain.
+ * Errors are mapped onto the same result shape as AppKit's `Plugin.execute()`.
+ */
+export function directExecutor<Settings>(): Executor<Settings> {
+  return async (fn) => {
+    try {
+      return { ok: true, data: await fn() };
+    } catch (cause) {
+      return {
+        ok: false,
+        status: errorStatus(cause),
+        message: error.errorMessage(cause),
+      };
+    }
+  };
+}
+
+/** Run an operation through an executor, merge cancellation, and unwrap its result. */
+export async function run<T, Settings>(options: RunOptions<T, Settings>): Promise<T> {
+  const result = await options.execute(
+    (executeSignal) => options.fn(async.combineAbortSignals(executeSignal, options.signal)),
+    options.settings,
+  );
+  if (result.ok) return result.data;
+  if (options.signal?.aborted) throw options.canceled();
+  throw options.failed({
+    operation: options.operation,
+    status: result.status,
+    message: result.message,
+  });
+}

package/src/object.ts

@@ -3,8 +3,9 @@
  *
  * Value guards / coercions / shape types: {@link isRecord} narrows parsed JSON
  * to a record, {@link toBoolean} coerces loose truthy/falsy values, {@link
- * deepEqual} compares structurally, and {@link NameLike}/{@link NonFunctionKeys}
- * describe object shapes.
+ * optional} spreads a field only when it is present, {@link deepEqual} compares
+ * structurally, and {@link NameLike}/{@link NonFunctionKeys} describe object
+ * shapes.
  *
  * Iterable helpers: {@link generator} flattens mixed arguments; {@link sequence}
  * wraps source(s) in a lazy, `Array`-compatible {@link Sequence}. Every
@@ -812,6 +813,28 @@ export function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/**
+ * `{ [key]: value }` when `value` is present, otherwise `undefined` - so an
+ * absent optional field stays ABSENT when spread, rather than becoming an
+ * explicit `undefined` that `exactOptionalPropertyTypes` rejects.
+ *
+ * Spelling that inline costs a repeated, double-evaluated ternary per field
+ * (`...(v ? { key: v } : {})`), which is how config resolvers end up computing
+ * the same value twice.
+ *
+ * @example
+ * return {
+ *   ...optional("appId", env.text("MICROSOFT_APP_ID")),
+ *   ...optional("endpoint", config.endpoint),
+ * };
+ */
+export function optional<K extends string, V>(
+  key: K,
+  value: V | null | undefined,
+): Record<K, V> | undefined {
+  return value === null || value === undefined ? undefined : ({ [key]: value } as Record<K, V>);
+}
+
 /**
  * Coerce a loose boolean-ish value to a real `boolean`, or `undefined`
  * when it can't be interpreted. Recognizes `true`/`t`/`on`/`1`/`yes`/`y`

package/src/pattern.ts

@@ -0,0 +1,148 @@
+/**
+ * Literal / glob / regex string matching, compiled to a composable
+ * {@link Predicate}.
+ *
+ * A configurable allow-list is the same shape everywhere in this repo: a list of
+ * patterns from a config field or an env var, where an operator reasonably
+ * expects to write a plain value, a `*` wildcard, or - when neither is enough -
+ * a real regex. Each consumer used to grow its own `globToRegExp` +
+ * `/pattern/flags` parser; this is that parser, once.
+ *
+ * Three shapes are recognized per entry, tried in order:
+ *
+ * - **regex** - wrapped in slashes (`/^x-mastra-/`, with optional trailing
+ *   flags). Compiled as written. An invalid regex never matches: it is skipped
+ *   with a warning rather than throwing, so one bad entry cannot take a process
+ *   down at startup.
+ * - **glob** - contains `*` or `?` (`x-mastra-*`). Shell-style, anchored at both
+ *   ends: `*` matches any run of characters, `?` exactly one.
+ * - **literal** - anything else. Whole-string equality.
+ *
+ * Matching is case-INSENSITIVE by default, which is what the callers want (HTTP
+ * header names and email addresses are both case-insensitive); pass
+ * `caseSensitive` to opt out. An empty pattern list matches NOTHING, so a
+ * caller that treats "no patterns" as "permit everything" must special-case it
+ * rather than relying on the matcher.
+ *
+ * Browser-safe: hand-compiled to `RegExp` with no glob dependency, so this stays
+ * usable from a client bundle. Node code that needs path-aware globbing
+ * (`/` as a segment boundary, `**`) wants `@dbx-tools/path`'s `toPathMatcher`
+ * instead - that one is `minimatch`-backed and understands path semantics.
+ *
+ * @example
+ * const allowed = toPatternMatcher(["x-mastra-*", "/^x-trace-/"]);
+ * allowed("x-mastra-thread-id"); // true
+ * allowed("x-forwarded-user");   // false
+ *
+ * @module
+ */
+
+import { logger } from "./log.ts";
+import * as predicate from "./predicate.ts";
+import { parseList } from "./string.ts";
+
+const log = logger("shared/pattern");
+
+/** Options for {@link toPattern} / {@link toPatternMatcher}. */
+export interface PatternOptions {
+  /** Match case-sensitively. Default `false` (case-insensitive). */
+  caseSensitive?: boolean;
+}
+
+/** Escape a string for literal use inside a `RegExp`. */
+export function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** True when `pattern` is a `/.../flags` regex literal. */
+function isRegexLiteral(pattern: string): boolean {
+  return pattern.length > 1 && pattern.startsWith("/") && /\/[a-z]*$/i.test(pattern);
+}
+
+/** True when `pattern` contains a glob wildcard. */
+function isGlob(pattern: string): boolean {
+  return pattern.includes("*") || pattern.includes("?");
+}
+
+/**
+ * Compile a `/pattern/flags` literal, or `undefined` when it is malformed or
+ * the body is not a valid regex.
+ */
+function compileRegexLiteral(pattern: string, caseSensitive: boolean): RegExp | undefined {
+  const parsed = /^\/(.+)\/([a-z]*)$/is.exec(pattern);
+  if (!parsed) return undefined;
+  const body = parsed[1]!;
+  const flags = parsed[2]!;
+  try {
+    return new RegExp(body, caseSensitive || flags.includes("i") ? flags : `${flags}i`);
+  } catch (error) {
+    log.warn("ignoring invalid regex pattern", { pattern, error });
+    return undefined;
+  }
+}
+
+/**
+ * Compile a shell-style glob (`*`, `?`) into an anchored `RegExp`. Every other
+ * character is escaped, so a glob can safely contain regex metacharacters
+ * (`x-app.*` matches a literal dot followed by anything).
+ */
+function compileGlob(pattern: string, caseSensitive: boolean): RegExp {
+  const body = pattern
+    .split(/([*?])/)
+    .map((part) => (part === "*" ? ".*" : part === "?" ? "." : escapeRegExp(part)))
+    .join("");
+  return new RegExp(`^${body}$`, caseSensitive ? "" : "i");
+}
+
+/**
+ * Compile ONE pattern into a predicate, or `undefined` when the entry is empty
+ * or an unparseable regex literal.
+ *
+ * Callers that want a whole list should use {@link toPatternMatcher}; this is
+ * exported for the case where a consumer applies its own semantics to some
+ * shapes and only wants the glob/regex handling (the email gate's bare-domain
+ * shortcut, for one).
+ */
+export function toPattern(
+  pattern: string,
+  options: PatternOptions = {},
+): predicate.Predicate<string> | undefined {
+  const trimmed = pattern.trim();
+  if (!trimmed) return undefined;
+  const caseSensitive = options.caseSensitive ?? false;
+
+  if (isRegexLiteral(trimmed)) {
+    const compiled = compileRegexLiteral(trimmed, caseSensitive);
+    return compiled && predicate.create<string>((value) => compiled.test(value));
+  }
+  if (isGlob(trimmed)) {
+    const compiled = compileGlob(trimmed, caseSensitive);
+    return predicate.create<string>((value) => compiled.test(value));
+  }
+  // Literal: whole-string equality.
+  const expected = caseSensitive ? trimmed : trimmed.toLowerCase();
+  return predicate.create<string>((value) =>
+    caseSensitive ? value === expected : value.toLowerCase() === expected,
+  );
+}
+
+/**
+ * Compile patterns into a single OR'd {@link Predicate}. Accepts the raw config
+ * shapes {@link parseList} does - an array, or one comma/whitespace-separated
+ * string - so a field and its env var need no separate handling.
+ *
+ * With no usable patterns the result always returns `false`.
+ *
+ * @example
+ * const forwardable = toPatternMatcher(process.env.TUNNEL_FORWARD_HEADERS);
+ */
+export function toPatternMatcher(
+  patterns: string | readonly string[] | undefined | null,
+  options: PatternOptions = {},
+): predicate.Predicate<string> {
+  const compiled = parseList(patterns)
+    .map((pattern) => toPattern(pattern, options))
+    .filter((value): value is predicate.Predicate<string> => value !== undefined);
+  if (compiled.length === 0) return predicate.create<string>(() => false);
+  return compiled.slice(1).reduce((acc, next) => acc.or(next), compiled[0]!);
+}

package/src/token.ts

@@ -15,6 +15,23 @@ const BEARER_PREFIX_REGEX = /^bearer\s+/i;
 const SPLIT_REGEX = /\s+|\s*,\s*/;
 const log = logger("shared/token");
 
+/**
+ * Header the Databricks Apps front door forwards the caller's OAuth (OBO) token
+ * on - the default source for every helper here.
+ *
+ * Exported because it is a wire contract several packages branch on, not just a
+ * default argument: `@dbx-tools/appkit`'s `identity` module decides whether a
+ * request can use OBO auth at all by its presence, and `@dbx-tools/cli-tunnel`
+ * must know the name to strip inbound copies of it. One spelling, one place.
+ */
+export const ACCESS_TOKEN_HEADER = "x-forwarded-access-token";
+
+/** Header the front door forwards the caller's user id on. */
+export const USER_ID_HEADER = "x-forwarded-user";
+
+/** Header the front door forwards the caller's email on. */
+export const USER_EMAIL_HEADER = "x-forwarded-email";
+
 /**
  * Decode a JWT segment (base64url with standard base64 padding), or
  * `undefined` when the segment is not valid base64.
@@ -39,7 +56,7 @@ function decodeJwtSegment(segment: string): string | undefined {
  */
 export function getAccessTokenPayload(
   input: HeaderLike | string,
-  headerName: string | undefined = "x-forwarded-access-token",
+  headerName: string | undefined = ACCESS_TOKEN_HEADER,
 ): Record<string, unknown> {
   let accessTokenPayload: Record<string, unknown> | undefined;
   if (!(typeof input === "string")) {