Release 2019.9.0

TUN-2279: Revert path encoding fix
This reverts commit f6c7f8a96c.
2026-08-07 23:31:56 +00:00 · 2019-09-05 22:15:19 -05:00 · 2019-09-05 22:03:31 -05:00 · 2019-09-05 15:36:16 +00:00 · 2019-09-05 15:23:41 +00:00 · 2019-09-03 13:54:29 -05:00
686 changed files with 62865 additions and 363200 deletions
@@ -9,4 +9,5 @@ guide/public
 \#*\#
 cscope.*
 cloudflared
-!cmd/cloudflared/
+!cmd/cloudflared/
+.DS_Store
@@ -1,14 +1,6 @@
 # This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.


-[[projects]]
-  digest = "1:3d3a509c5ba327e8573bb57f9da8430c63a46a06886eb1d2ffc8af4e76f31c72"
-  name = "cloud.google.com/go"
-  packages = ["civil"]
-  pruneopts = "UT"
-  revision = "cdaaf98f9226c39dc162b8e55083b2fbc67b4674"
-  version = "v0.43.0"
-
 [[projects]]
  digest = "1:9f3b30d9f8e0d7040f729b82dcbc8f0dead820a133b3147ce355fc451f32d761"
  name = "github.com/BurntSushi/toml"
@@ -18,12 +10,57 @@
  version = "v0.3.1"

 [[projects]]
-  digest = "1:c84a587136cb69cecc11f3dbe9f9001444044c0dba74997b07f7e4c150b07cda"
-  name = "github.com/DATA-DOG/go-sqlmock"
+  branch = "master"
+  digest = "1:1a200e7e73293b75eb8e5c93d023b5472663432da0b663e1532624fcfede9ca8"
+  name = "github.com/anmitsu/go-shlex"
  packages = ["."]
  pruneopts = "UT"
-  revision = "3f9954f6f6697845b082ca57995849ddf614f450"
-  version = "v1.3.3"
+  revision = "648efa622239a2f6ff949fed78ee37b48d499ba4"
+
+[[projects]]
+  digest = "1:4a296b8f487dab7ea37c4558d6e84be8103eb6bd297202e870266ff99ebd769d"
+  name = "github.com/aws/aws-sdk-go"
+  packages = [
+    "aws",
+    "aws/awserr",
+    "aws/awsutil",
+    "aws/client",
+    "aws/client/metadata",
+    "aws/corehandlers",
+    "aws/credentials",
+    "aws/credentials/ec2rolecreds",
+    "aws/credentials/endpointcreds",
+    "aws/credentials/processcreds",
+    "aws/credentials/stscreds",
+    "aws/csm",
+    "aws/defaults",
+    "aws/ec2metadata",
+    "aws/endpoints",
+    "aws/request",
+    "aws/session",
+    "aws/signer/v4",
+    "internal/ini",
+    "internal/s3err",
+    "internal/sdkio",
+    "internal/sdkrand",
+    "internal/sdkuri",
+    "internal/shareddefaults",
+    "private/protocol",
+    "private/protocol/eventstream",
+    "private/protocol/eventstream/eventstreamapi",
+    "private/protocol/json/jsonutil",
+    "private/protocol/query",
+    "private/protocol/query/queryutil",
+    "private/protocol/rest",
+    "private/protocol/restxml",
+    "private/protocol/xml/xmlutil",
+    "service/s3",
+    "service/sts",
+    "service/sts/stsiface",
+  ]
+  pruneopts = "UT"
+  revision = "2eb9a651f22769d792f974e8a8efe16afea3370f"
+  version = "v1.23.9"

 [[projects]]
  digest = "1:d6afaeed1502aa28e80a4ed0981d570ad91b2579193404256ce672ed0a609e0d"
@@ -55,14 +92,6 @@
  pruneopts = "UT"
  revision = "333127dbecfcc23a8db7d9a4f52785d23aff44a1"

-[[projects]]
-  branch = "master"
-  digest = "1:05756b73bf7eae03d6f6c5f0ae83de42ce296e7d83336563dd9ce2072106d5e6"
-  name = "github.com/cloudflare/golz4"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "ef862a3cdc58a6f1fee4e3af3d44fbe279194cde"
-
 [[projects]]
  digest = "1:3f9506ee991cdee1f05bf0cd3e34b5cd922dc00d6a950fb4beb4e07ab1c4d3d1"
  name = "github.com/coredns/coredns"
@@ -97,12 +126,11 @@
  version = "v1.2.0"

 [[projects]]
-  branch = "v2"
-  digest = "1:ca6ce07b0d28c6044411b9c966cd845233e27c2ff91d08a3a869631f329c9918"
+  digest = "1:6f70106e7bc1c803e8a0a4519e09c12d154771acfa2559206e97b033bbd1dd38"
  name = "github.com/coreos/go-oidc"
-  packages = ["."]
+  packages = ["jose"]
  pruneopts = "UT"
-  revision = "274971e2c94cd6fb17614979e2899edbc81af146"
+  revision = "a93f71fdfe73d2c0f5413c0565eea0af6523a6df"

 [[projects]]
  digest = "1:1da3a221f0bc090792d3a2a080ff09008427c0e0f0533a4ed6abd8994421da73"
@@ -112,6 +140,14 @@
  revision = "95778dfbb74eb7e4dbaf43bf7d71809650ef8076"
  version = "v19"

+[[projects]]
+  digest = "1:385dff5bf83bf1c9d40ef2b0f2e697f0d1973fc9e24ae9401cf41698612bbebc"
+  name = "github.com/creack/pty"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "2769f65a3a94eb8f876f44a0459d24ae7ad2e488"
+  version = "v1.1.7"
+
 [[projects]]
  digest = "1:ffe9824d294da03b391f44e1ae8281281b4afc1bdaa9588c9097785e3af10cec"
  name = "github.com/davecgh/go-spew"
@@ -122,15 +158,11 @@

 [[projects]]
  branch = "master"
-  digest = "1:27cbe99893a40975358d20736d80adc95ef395d3bf5923f802f3de259533c94a"
-  name = "github.com/denisenkom/go-mssqldb"
-  packages = [
-    ".",
-    "internal/cp",
-    "internal/querytext",
-  ]
+  digest = "1:c013ffc6e15f9f898078f9d38441c68b228aa7b899659452170250ccb27f5f1e"
+  name = "github.com/elgs/gosqljson"
+  packages = ["."]
  pruneopts = "UT"
-  revision = "11b2859924c1e3c3da056fd4e0976b93883f3545"
+  revision = "027aa4915315a0b2825c0f025cea347829b974fa"

 [[projects]]
  digest = "1:d4268b2a09b1f736633577c4ac93f2a5356c73742fff5344e2451aeec60a7ad0"
@@ -154,14 +186,6 @@
  pruneopts = "UT"
  revision = "75cf19382434e82df4dd84953f566b8ad23d6e9e"

-[[projects]]
-  digest = "1:296cda2c4a6a7a54964d7b3b0815e2aed215da75217b72033060ffb1c4e4b6ae"
-  name = "github.com/felixge/httpsnoop"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "eadd4fad6aac69ae62379194fe0219f3dbc80fd3"
-  version = "v1.0.0"
-
 [[projects]]
  branch = "master"
  digest = "1:50a46ab1d5edbbdd55125b4d37f1bf503d0807c26461f9ad7b358d6006641d09"
@@ -178,12 +202,12 @@
  revision = "ed7bcb39ff10f39ab08e317ce16df282845852fa"

 [[projects]]
-  digest = "1:ec6f9bf5e274c833c911923c9193867f3f18788c461f76f05f62bb1510e0ae65"
-  name = "github.com/go-sql-driver/mysql"
+  digest = "1:0a01355005024757ae2a1f62e8fe68a30b4f5fde7a08ac88b3685e7999ac354b"
+  name = "github.com/gliderlabs/ssh"
  packages = ["."]
  pruneopts = "UT"
-  revision = "72cd26f257d44c1114970e19afddcd812016007e"
-  version = "v1.4.1"
+  revision = "5b6cc7030f17095c0cf23bb063b0bfe824fe5f8b"
+  version = "v0.2.2"

 [[projects]]
  branch = "master"
@@ -193,14 +217,6 @@
  pruneopts = "UT"
  revision = "604e922904d35e97f98a774db7881f049cd8d970"

-[[projects]]
-  branch = "master"
-  digest = "1:01745416ed734d0dbd8f2a25344536e399ee60319654873da12b107e9e3cb309"
-  name = "github.com/golang/gddo"
-  packages = ["httputil/header"]
-  pruneopts = "UT"
-  revision = "af0f2af80721261f4d211b2c9563f7b46b2aab06"
-
 [[projects]]
  digest = "1:239c4c7fd2159585454003d9be7207167970194216193a8a210b8d29576f19c9"
  name = "github.com/golang/protobuf"
@@ -247,6 +263,13 @@
  pruneopts = "UT"
  revision = "8e809c8a86450a29b90dcc9efbf062d0fe6d9746"

+[[projects]]
+  digest = "1:bb81097a5b62634f3e9fec1014657855610c82d19b9a40c17612e32651e35dca"
+  name = "github.com/jmespath/go-jmespath"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "c2b33e84"
+
 [[projects]]
  digest = "1:6c41d4f998a03b6604227ccad36edaed6126c397e5d78709ef4814a1145a6757"
  name = "github.com/jmoiron/sqlx"
@@ -267,26 +290,7 @@
  version = "v1.0.2"

 [[projects]]
-  digest = "1:177a18252d40bf39a867876456854717780b0b1212fdae231d31e93b6f885d80"
-  name = "github.com/kshvakov/clickhouse"
-  packages = [
-    ".",
-    "lib/binary",
-    "lib/cityhash102",
-    "lib/column",
-    "lib/data",
-    "lib/leakypool",
-    "lib/lz4",
-    "lib/protocol",
-    "lib/types",
-    "lib/writebuffer",
-  ]
-  pruneopts = "UT"
-  revision = "43e176a8d165376662f4d67203c71cc8a027c86b"
-  version = "v1.3.9"
-
-[[projects]]
-  digest = "1:12cb143f2148bf54bcd9fe622abac17325e85eeb1d84b8ec6caf1c80232108fd"
+  digest = "1:bc1c0be40c67b6b4aee09d7508d5a2a52c1c116b1fa43806dad2b0d6b4d4003b"
  name = "github.com/lib/pq"
  packages = [
    ".",
@@ -294,8 +298,8 @@
    "scram",
  ]
  pruneopts = "UT"
-  revision = "3427c32cb71afc948325f299f040e53c1dd78979"
-  version = "v1.2.0"
+  revision = "51e2106eed1cea199c802d2a49e91e2491b02056"
+  version = "v1.1.0"

 [[projects]]
  digest = "1:2fa7b0155cd54479a755c629de26f888a918e13f8857a2c442205d825368e084"
@@ -313,14 +317,6 @@
  revision = "c2a7a6ca930a4cd0bc33a3f298eb71960732a3a7"
  version = "v0.0.7"

-[[projects]]
-  digest = "1:79e87abf06b873987dee86598950f5b51732ac454d5a5cab6445a14330e6c9e3"
-  name = "github.com/mattn/go-sqlite3"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "b612a2feea6aa87c6d052d9086572551df06497e"
-  version = "v1.11.0"
-
 [[projects]]
  digest = "1:ff5ebae34cfbf047d505ee150de27e60570e8c394b3b8fdbb720ff6ac71985fc"
  name = "github.com/matttproud/golang_protobuf_extensions"
@@ -356,14 +352,6 @@
  revision = "af06845cf3004701891bf4fdb884bfe4920b3727"
  version = "v1.1.0"

-[[projects]]
-  digest = "1:dd3d50b46f8d3c88a8d3986f2e5344db582c457469a7cb3a0dda953c669cdf9a"
-  name = "github.com/mitchellh/go-server-timing"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "1ca01db910d57d64ec1c68f27105614b77558e28"
-  version = "v1.0.0"
-
 [[projects]]
  digest = "1:53bc4cd4914cd7cd52139990d5170d6dc99067ae31c56530621b18b35fc30318"
  name = "github.com/mitchellh/mapstructure"
@@ -400,17 +388,6 @@
  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
  version = "v1.0.0"

-[[projects]]
-  branch = "master"
-  digest = "1:bd9efe4e0b0f768302a1e2f0c22458149278de533e521206e5ddc71848c269a0"
-  name = "github.com/pquerna/cachecontrol"
-  packages = [
-    ".",
-    "cacheobject",
-  ]
-  pruneopts = "UT"
-  revision = "1555304b9b35fdd2b425bccf1a5613677705e7d0"
-
 [[projects]]
  digest = "1:c968b29db5d68ec97de404b6d058d5937fa015a141b3b4f7a0d87d5f8226f04c"
  name = "github.com/prometheus/client_golang"
@@ -459,9 +436,12 @@
  version = "v2.4"

 [[projects]]
-  digest = "1:04457f9f6f3ffc5fea48e71d62f2ca256637dee0a04d710288e27e05c8b41976"
+  digest = "1:31538f8d774e8bf2fb9380d2d2a82d69e206a7d0603946586926f1819c546c26"
  name = "github.com/sirupsen/logrus"
-  packages = ["."]
+  packages = [
+    ".",
+    "hooks/test",
+  ]
  pruneopts = "UT"
  revision = "839c75faf7f98a33d445d181f3018b5c3409a45e"
  version = "v1.4.2"
@@ -479,15 +459,7 @@

 [[projects]]
  branch = "master"
-  digest = "1:cac263b8eb2e9ad2327b70e03be1de1227040bfb3be26b49c4b56cbed568afc7"
-  name = "github.com/xo/dburl"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "98997a05b24fc069c79fa13b05ccf376c22a326c"
-
-[[projects]]
-  branch = "master"
-  digest = "1:1a9391a80fe548ffcf90aee8ae35bfb0b188198b57a3fe2ef5bb099ba4b4f610"
+  digest = "1:a84d5ec8b40a827962ea250f2cf03434138ccae9d83fcac12fb49b70c70b80cc"
  name = "golang.org/x/crypto"
  packages = [
    "curve25519",
@@ -495,10 +467,8 @@
    "ed25519/internal/edwards25519",
    "internal/chacha20",
    "internal/subtle",
-    "md4",
    "nacl/box",
    "nacl/secretbox",
-    "pbkdf2",
    "poly1305",
    "salsa20/salsa",
    "ssh",
@@ -509,12 +479,11 @@

 [[projects]]
  branch = "master"
-  digest = "1:6b3dbfffba73ea0d8131ecb5738fe87f6addc4c7b73154b9d58e2693ad6a6256"
+  digest = "1:52d140f7ab52e491cc1cbc93e6637aa5e9a7f3beae7545d675b02e52ca9d7290"
  name = "golang.org/x/net"
  packages = [
    "bpf",
    "context",
-    "context/ctxhttp",
    "http/httpguts",
    "http2",
    "http2/hpack",
@@ -530,17 +499,6 @@
  pruneopts = "UT"
  revision = "1da14a5a36f220ea3f03470682b737b1dfd5de22"

-[[projects]]
-  branch = "master"
-  digest = "1:8d1c112fb1679fa097e9a9255a786ee47383fa2549a3da71bcb1334a693ebcfe"
-  name = "golang.org/x/oauth2"
-  packages = [
-    ".",
-    "internal",
-  ]
-  pruneopts = "UT"
-  revision = "0f29369cfe4552d0e4bcddc57cc75f4d7e672a33"
-
 [[projects]]
  digest = "1:39ebcc2b11457b703ae9ee2e8cca0f68df21969c6102cb3b705f76cca0ea0239"
  name = "golang.org/x/sync"
@@ -587,23 +545,6 @@
  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
  version = "v0.3.0"

-[[projects]]
-  digest = "1:7e8b9c5ae49011b12ae8473834ac1a7bb8ac029ba201270c723e4c280c9e4855"
-  name = "google.golang.org/appengine"
-  packages = [
-    "cloudsql",
-    "internal",
-    "internal/base",
-    "internal/datastore",
-    "internal/log",
-    "internal/remote_api",
-    "internal/urlfetch",
-    "urlfetch",
-  ]
-  pruneopts = "UT"
-  revision = "b2f4a3cf3c67576a2ee09e1fe62656a5086ce880"
-  version = "v1.6.1"
-
 [[projects]]
  branch = "master"
  digest = "1:c3076e7defee87de1236f1814beb588f40a75544c60121e6eb38b3b3721783e2"
@@ -653,26 +594,6 @@
  revision = "236199dd5f8031d698fb64091194aecd1c3895b2"
  version = "v1.20.0"

-[[projects]]
-  branch = "v1"
-  digest = "1:6f70106e7bc1c803e8a0a4519e09c12d154771acfa2559206e97b033bbd1dd38"
-  name = "gopkg.in/coreos/go-oidc.v1"
-  packages = ["jose"]
-  pruneopts = "UT"
-  revision = "e860bd55bfa7d7cb35d30d26a167982584f616b0"
-
-[[projects]]
-  digest = "1:8c05919580be8a5be668709d7e5a69d5cd19b8ee9f23d62ce5b10d3457bf6a13"
-  name = "gopkg.in/square/go-jose.v2"
-  packages = [
-    ".",
-    "cipher",
-    "json",
-  ]
-  pruneopts = "UT"
-  revision = "730df5f748271903322feb182be83b43ebbbe27d"
-  version = "v2.3.1"
-
 [[projects]]
  branch = "altsrc-parse-durations"
  digest = "1:0370b1bceda03dbfade3abbde639a43f1113bab711ec760452e5c0dcc0c14787"
@@ -722,6 +643,10 @@
  analyzer-version = 1
  input-imports = [
    "github.com/DATA-DOG/go-sqlmock",
+    "github.com/aws/aws-sdk-go/aws",
+    "github.com/aws/aws-sdk-go/aws/credentials",
+    "github.com/aws/aws-sdk-go/aws/session",
+    "github.com/aws/aws-sdk-go/service/s3",
    "github.com/cloudflare/brotli-go",
    "github.com/cloudflare/golibs/lrucache",
    "github.com/coredns/coredns/core/dnsserver",
@@ -731,34 +656,31 @@
    "github.com/coredns/coredns/plugin/pkg/dnstest",
    "github.com/coredns/coredns/plugin/pkg/rcode",
    "github.com/coredns/coredns/request",
-    "github.com/coreos/go-oidc",
+    "github.com/coreos/go-oidc/jose",
    "github.com/coreos/go-systemd/daemon",
-    "github.com/denisenkom/go-mssqldb",
+    "github.com/creack/pty",
+    "github.com/elgs/gosqljson",
    "github.com/equinox-io/equinox",
    "github.com/facebookgo/grace/gracenet",
    "github.com/getsentry/raven-go",
-    "github.com/go-sql-driver/mysql",
+    "github.com/gliderlabs/ssh",
    "github.com/golang-collections/collections/queue",
    "github.com/google/uuid",
    "github.com/gorilla/mux",
    "github.com/gorilla/websocket",
-    "github.com/jmoiron/sqlx",
-    "github.com/kshvakov/clickhouse",
    "github.com/lib/pq",
    "github.com/mattn/go-colorable",
-    "github.com/mattn/go-sqlite3",
    "github.com/miekg/dns",
    "github.com/mitchellh/go-homedir",
-    "github.com/mitchellh/go-server-timing",
    "github.com/mitchellh/mapstructure",
    "github.com/pkg/errors",
    "github.com/prometheus/client_golang/prometheus",
    "github.com/prometheus/client_golang/prometheus/promhttp",
    "github.com/rifflock/lfshook",
    "github.com/sirupsen/logrus",
+    "github.com/sirupsen/logrus/hooks/test",
    "github.com/stretchr/testify/assert",
    "github.com/stretchr/testify/require",
-    "github.com/xo/dburl",
    "golang.org/x/crypto/nacl/box",
    "golang.org/x/crypto/ssh",
    "golang.org/x/crypto/ssh/terminal",
@@ -773,7 +695,6 @@
    "golang.org/x/sys/windows/svc",
    "golang.org/x/sys/windows/svc/eventlog",
    "golang.org/x/sys/windows/svc/mgr",
-    "gopkg.in/coreos/go-oidc.v1/jose",
    "gopkg.in/urfave/cli.v2",
    "gopkg.in/urfave/cli.v2/altsrc",
    "zombiezen.com/go/capnproto2",
@@ -6,6 +6,8 @@
    name = "github.com/cloudflare/brotli-go"
    unused-packages = false

+
+
 [[constraint]]
  name = "github.com/facebookgo/grace"
  revision = "75cf19382434e82df4dd84953f566b8ad23d6e9e"
@@ -68,6 +70,10 @@
  name = "github.com/mholt/caddy"
  revision = "d3b731e9255b72d4571a5aac125634cf1b6031dc"

+[[constraint]]
+  name = "github.com/coreos/go-oidc"
+  revision = "a93f71fdfe73d2c0f5413c0565eea0af6523a6df"
+
 [[constraint]]
  name = "golang.org/x/crypto"
  branch = "master"  # master required by github.com/miekg/dns
@@ -85,33 +91,13 @@
  version = "1.1.2"

 [[constraint]]
-  name = "github.com/jmoiron/sqlx"
-  version = "1.2.0"
+  name = "github.com/gliderlabs/ssh"
+  version = "0.2.2"

 [[constraint]]
-  name = "github.com/go-sql-driver/mysql"
-  version = "1.4.1"
+  name = "github.com/creack/pty"
+  version = "1.1.7"

 [[constraint]]
-  name = "github.com/mattn/go-sqlite3"
-  version = "1.11.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/denisenkom/go-mssqldb"
-
-[[constraint]]
-  name = "github.com/kshvakov/clickhouse"
-  version = "1.3.9"
-
-[[constraint]]
-  name = "github.com/DATA-DOG/go-sqlmock"
-  version = "1.3.3"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/xo/dburl"
-
-[[constraint]]
-  branch = "v2"
-  name = "github.com/coreos/go-oidc"
+  name = "github.com/aws/aws-sdk-go"
+  version = "1.23.9"
@@ -1,3 +1,25 @@
+2019.9.0
+- 2019-09-05 TUN-2279: Revert path encoding fix
+- 2019-08-30 AUTH-2021 - check error for failing tests
+- 2019-08-29 AUTH-2030: Support both authorized_key and short lived cert authentication simultaniously without specifiying at start time
+- 2019-08-29 AUTH-2026: Adds support for non-pty sessions and inline command exec
+- 2019-08-26 AUTH-1943: Adds session logging
+- 2019-08-26 TUN-2162: Decomplect OpenStream to allow finer-grained timeouts
+- 2019-08-29 TUN-2260: add name/group to CapnpConnectParameters, remove Scope
+
+2019.8.4
+- 2019-08-30 Fix #111: Add support for specifying a specific HTTP Host: header on the origin. (#114)
+- 2019-08-22 TUN-2165: Add ClientConfig to tunnelrpc.ConnectResult
+- 2019-08-20 AUTH-2014: Checks users login shell
+- 2019-08-26 TUN-2243: Revert "STOR-519: Add db-connect, a SQL over HTTPS server"
+- 2019-08-27 TUN-2244: Add NO_AUTOUPDATE env var
+- 2019-08-22 AUTH-2018: Adds support for authorized keys and short lived certs
+- 2019-08-28 AUTH-2022: Adds ssh timeout configuration
+- 2019-08-28 TUN-1968: Gracefully diff StreamHandler.UpdateConfig
+- 2019-08-26 AUTH-2021 - s3 bucket uploading for SSH logs
+- 2019-08-19 AUTH-2004: Adds static host key support
+- 2019-07-18 AUTH-1941: Adds initial SSH server implementation
+
 2019.8.3
 - 2019-08-20 STOR-519: Add db-connect, a SQL over HTTPS server
 - 2019-08-20 Release 2019.8.2
@@ -0,0 +1,106 @@
+package awsuploader
+
+import (
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/sirupsen/logrus"
+)
+
+// DirectoryUploadManager is used to manage file uploads on an interval from a directory
+type DirectoryUploadManager struct {
+	logger        *logrus.Logger
+	uploader      Uploader
+	rootDirectory string
+	sweepInterval time.Duration
+	ticker        *time.Ticker
+	shutdownC     chan struct{}
+	workQueue     chan string
+}
+
+// NewDirectoryUploadManager create a new DirectoryUploadManager
+// uploader is an Uploader to use as an actual uploading engine
+// directory is the directory to sweep for files to upload
+// sweepInterval is how often to iterate the directory and upload the files within
+func NewDirectoryUploadManager(logger *logrus.Logger, uploader Uploader, directory string, sweepInterval time.Duration, shutdownC chan struct{}) *DirectoryUploadManager {
+	workerCount := 10
+	manager := &DirectoryUploadManager{
+		logger:        logger,
+		uploader:      uploader,
+		rootDirectory: directory,
+		sweepInterval: sweepInterval,
+		shutdownC:     shutdownC,
+		workQueue:     make(chan string, workerCount),
+	}
+
+	//start workers
+	for i := 0; i < workerCount; i++ {
+		go manager.worker()
+	}
+
+	return manager
+}
+
+// Upload a file using the uploader
+// This is useful for "out of band" uploads that need to be triggered immediately instead of waiting for the sweep
+func (m *DirectoryUploadManager) Upload(filepath string) error {
+	return m.uploader.Upload(filepath)
+}
+
+// Start the upload ticker to walk the directories
+func (m *DirectoryUploadManager) Start() {
+	m.ticker = time.NewTicker(m.sweepInterval)
+	go m.run()
+}
+
+func (m *DirectoryUploadManager) run() {
+	for {
+		select {
+		case <-m.shutdownC:
+			m.ticker.Stop()
+			return
+		case <-m.ticker.C:
+			m.sweep()
+		}
+	}
+}
+
+// sweep the directory and kick off uploads
+func (m *DirectoryUploadManager) sweep() {
+	filepath.Walk(m.rootDirectory, func(path string, info os.FileInfo, err error) error {
+		if err != nil || info.IsDir() {
+			return nil
+		}
+		//30 days ago
+		retentionTime := 30 * (time.Hour * 24)
+		checkTime := time.Now().Add(-time.Duration(retentionTime))
+
+		//delete the file it is stale
+		if info.ModTime().After(checkTime) {
+			os.Remove(path)
+			return nil
+		}
+		//add the upload to the work queue
+		go func() {
+			m.workQueue <- path
+		}()
+		return nil
+	})
+}
+
+// worker handles upload requests
+func (m *DirectoryUploadManager) worker() {
+	for {
+		select {
+		case <-m.shutdownC:
+			return
+		case filepath := <-m.workQueue:
+			if err := m.Upload(filepath); err != nil {
+				m.logger.WithError(err).Error("Cannot upload file to s3 bucket")
+			} else {
+				os.Remove(filepath)
+			}
+		}
+	}
+}
@@ -0,0 +1,137 @@
+package awsuploader
+
+import (
+	"errors"
+	"io/ioutil"
+	"math/rand"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/sirupsen/logrus"
+)
+
+type MockUploader struct {
+	shouldFail bool
+}
+
+func (m *MockUploader) Upload(filepath string) error {
+	if m.shouldFail {
+		return errors.New("upload set to fail")
+	}
+	return nil
+}
+
+func NewMockUploader(shouldFail bool) Uploader {
+	return &MockUploader{shouldFail: shouldFail}
+}
+
+func getDirectoryPath(t *testing.T) string {
+	dir, err := os.Getwd()
+	if err != nil {
+		t.Fatal("couldn't create the test directory!", err)
+	}
+	return filepath.Join(dir, "uploads")
+}
+
+func setupTestDirectory(t *testing.T) string {
+	path := getDirectoryPath(t)
+	os.RemoveAll(path)
+	time.Sleep(100 * time.Millisecond) //short way to wait for the OS to delete the folder
+	err := os.MkdirAll(path, os.ModePerm)
+	if err != nil {
+		t.Fatal("couldn't create the test directory!", err)
+	}
+	return path
+}
+
+func createUploadManager(t *testing.T, shouldFailUpload bool) *DirectoryUploadManager {
+	rootDirectory := setupTestDirectory(t)
+	uploader := NewMockUploader(shouldFailUpload)
+	logger := logrus.New()
+	shutdownC := make(chan struct{})
+	return NewDirectoryUploadManager(logger, uploader, rootDirectory, 1*time.Second, shutdownC)
+}
+
+func createFile(t *testing.T, fileName string) (*os.File, string) {
+	path := filepath.Join(getDirectoryPath(t), fileName)
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal("upload to create file for sweep test", err)
+	}
+	return f, path
+}
+
+func TestUploadSuccess(t *testing.T) {
+	manager := createUploadManager(t, false)
+	path := filepath.Join(getDirectoryPath(t), "test_file")
+	if err := manager.Upload(path); err != nil {
+		t.Fatal("the upload request method failed", err)
+	}
+}
+
+func TestUploadFailure(t *testing.T) {
+	manager := createUploadManager(t, true)
+	path := filepath.Join(getDirectoryPath(t), "test_file")
+	if err := manager.Upload(path); err == nil {
+		t.Fatal("the upload request method should have failed and didn't", err)
+	}
+}
+
+func TestSweepSuccess(t *testing.T) {
+	manager := createUploadManager(t, false)
+	f, path := createFile(t, "test_file")
+	defer f.Close()
+
+	manager.Start()
+	time.Sleep(2 * time.Second)
+	if _, err := os.Stat(path); os.IsExist(err) {
+		//the file should have been deleted
+		t.Fatal("the manager failed to delete the file", err)
+	}
+}
+
+func TestSweepFailure(t *testing.T) {
+	manager := createUploadManager(t, true)
+	f, path := createFile(t, "test_file")
+	defer f.Close()
+
+	manager.Start()
+	time.Sleep(2 * time.Second)
+	_, serr := f.Stat()
+	if serr != nil {
+		//the file should still exist
+		os.Remove(path)
+		t.Fatal("the manager failed to delete the file", serr)
+	}
+}
+
+func TestHighLoad(t *testing.T) {
+	manager := createUploadManager(t, false)
+	for i := 0; i < 30; i++ {
+		f, _ := createFile(t, randomString(6))
+		defer f.Close()
+	}
+	manager.Start()
+	time.Sleep(4 * time.Second)
+
+	directory := getDirectoryPath(t)
+	files, err := ioutil.ReadDir(directory)
+	if err != nil || len(files) > 0 {
+		t.Fatalf("the manager failed to upload all the files: %s files left: %d", err, len(files))
+	}
+}
+
+// LowerCase [a-z]
+const randSet = "abcdefghijklmnopqrstuvwxyz"
+
+// String returns a string of length 'n' from a set of letters 'lset'
+func randomString(n int) string {
+	b := make([]byte, n)
+	lsetLen := len(randSet)
+	for i := range b {
+		b[i] = randSet[rand.Intn(lsetLen)]
+	}
+	return string(b)
+}
@@ -0,0 +1,62 @@
+package awsuploader
+
+import (
+	"context"
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/s3"
+)
+
+//FileUploader aws compliant bucket upload
+type FileUploader struct {
+	storage    *s3.S3
+	bucketName string
+	clientID   string
+	secretID   string
+}
+
+// NewFileUploader creates a new S3 compliant bucket uploader
+func NewFileUploader(bucketName, region, accessKeyID, secretID, token, s3Host string) (*FileUploader, error) {
+	sess, err := session.NewSession(&aws.Config{
+		Region:      aws.String(region),
+		Credentials: credentials.NewStaticCredentials(accessKeyID, secretID, token),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var storage *s3.S3
+	if s3Host != "" {
+		storage = s3.New(sess, &aws.Config{Endpoint: aws.String(s3Host)})
+	} else {
+		storage = s3.New(sess)
+	}
+
+	return &FileUploader{
+		storage:    storage,
+		bucketName: bucketName,
+	}, nil
+}
+
+// Upload a file to the bucket
+func (u *FileUploader) Upload(filepath string) error {
+	info, err := os.Stat(filepath)
+	if err != nil {
+		return err
+	}
+	file, err := os.Open(filepath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	_, serr := u.storage.PutObjectWithContext(context.Background(), &s3.PutObjectInput{
+		Bucket: aws.String(u.bucketName),
+		Key:    aws.String(info.Name()),
+		Body:   file,
+	})
+	return serr
+}
@@ -0,0 +1,7 @@
+package awsuploader
+
+// UploadManager is used to manage file uploads on an interval
+type UploadManager interface {
+	Upload(string) error
+	Start()
+}
@@ -0,0 +1,7 @@
+package awsuploader
+
+// Uploader the functions required to upload to a bucket
+type Uploader interface {
+	//Upload a file to the bucket
+	Upload(string) error
+}
@@ -93,14 +93,3 @@ stretch: &stretch
      - make test

 jessie: *stretch
-
-# cfsetup compose
-default-stack: test_dbconnect
-test_dbconnect:
-  compose:
-    up-args:
-      - --renew-anon-volumes
-      - --abort-on-container-exit
-      - --exit-code-from=cloudflared
-    files:
-      - dbconnect/integration_test/dbconnect.yaml
@@ -14,7 +14,7 @@ import (
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
 	"github.com/cloudflare/cloudflared/log"
 	"github.com/cloudflare/cloudflared/origin"
-	"gopkg.in/coreos/go-oidc.v1/jose"
+	"github.com/coreos/go-oidc/jose"
 )

 const (
@@ -26,15 +26,15 @@ var logger = log.CreateLogger()
 type lock struct {
 	lockFilePath string
 	backoff      *origin.BackoffHandler
-	sigHandler   *signalHandler
+	sigHandler 	 *signalHandler
 }

 type signalHandler struct {
-	sigChannel chan os.Signal
-	signals    []os.Signal
+	sigChannel 		 chan os.Signal
+	signals		     []os.Signal
 }

-func (s *signalHandler) register(handler func()) {
+func (s *signalHandler) register(handler func()){
 	s.sigChannel = make(chan os.Signal, 1)
 	signal.Notify(s.sigChannel, s.signals...)
 	go func(s *signalHandler) {
@@ -59,8 +59,8 @@ func newLock(path string) *lock {
 	return &lock{
 		lockFilePath: lockPath,
 		backoff:      &origin.BackoffHandler{MaxRetries: 7},
-		sigHandler: &signalHandler{
-			signals: []os.Signal{syscall.SIGINT, syscall.SIGTERM},
+		sigHandler:   &signalHandler{
+			signals: 	[]os.Signal{syscall.SIGINT, syscall.SIGTERM},
 		},
 	}
 }
@@ -68,8 +68,8 @@ func newLock(path string) *lock {
 func (l *lock) Acquire() error {
 	// Intercept SIGINT and SIGTERM to release lock before exiting
 	l.sigHandler.register(func() {
-		l.deleteLockFile()
-		os.Exit(0)
+        l.deleteLockFile()
+        os.Exit(0)
 	})

 	// Check for a path.lock file
@@ -7,38 +7,73 @@ import (
 	"net"
 	"net/url"
 	"os"
-	"reflect"
+	"runtime"
 	"runtime/trace"
 	"sync"
+	"syscall"
 	"time"

-	"github.com/cloudflare/cloudflared/dbconnect"
-	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
-
-	"github.com/cloudflare/cloudflared/connection"
-	"github.com/cloudflare/cloudflared/supervisor"
-	"github.com/google/uuid"
-
-	"github.com/getsentry/raven-go"
-
+	"github.com/cloudflare/cloudflared/awsuploader"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/buildinfo"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
+	"github.com/cloudflare/cloudflared/cmd/sqlgateway"
+	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/signal"
+	"github.com/cloudflare/cloudflared/sshlog"
+	"github.com/cloudflare/cloudflared/sshserver"
+	"github.com/cloudflare/cloudflared/supervisor"
 	"github.com/cloudflare/cloudflared/tlsconfig"
 	"github.com/cloudflare/cloudflared/tunneldns"
+	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/websocket"
+
 	"github.com/coreos/go-systemd/daemon"
 	"github.com/facebookgo/grace/gracenet"
+	"github.com/getsentry/raven-go"
+	"github.com/gliderlabs/ssh"
+	"github.com/google/uuid"
 	"github.com/pkg/errors"
+	"golang.org/x/crypto/ssh/terminal"
 	"gopkg.in/urfave/cli.v2"
 	"gopkg.in/urfave/cli.v2/altsrc"
 )

-const sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b:3e8827f6f9f740738eb11138f7bebb68@sentry.io/189878"
+const (
+	sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b:3e8827f6f9f740738eb11138f7bebb68@sentry.io/189878"
+
+	sshLogFileDirectory = "/var/log/cloudflared/"
+
+	// sshPortFlag is the port on localhost the cloudflared ssh server will run on
+	sshPortFlag = "local-ssh-port"
+
+	// sshIdleTimeoutFlag defines the duration a SSH session can remain idle before being closed
+	sshIdleTimeoutFlag = "ssh-idle-timeout"
+
+	// sshMaxTimeoutFlag defines the max duration a SSH session can remain open for
+	sshMaxTimeoutFlag = "ssh-max-timeout"
+
+	// bucketNameFlag is the bucket name to use for the SSH log uploader
+	bucketNameFlag = "bucket-name"
+
+	// regionNameFlag is the AWS region name to use for the SSH log uploader
+	regionNameFlag = "region-name"
+
+	// secretIDFlag is the Secret id of SSH log uploader
+	secretIDFlag = "secret-id"
+
+	// accessKeyIDFlag is the Access key id of SSH log uploader
+	accessKeyIDFlag = "access-key-id"
+
+	// sessionTokenIDFlag is the Session token of SSH log uploader
+	sessionTokenIDFlag = "session-token"
+
+	// s3URLFlag is the S3 URL of SSH log uploader (e.g. don't use AWS s3 and use google storage bucket instead)
+	s3URLFlag = "s3-url-host"
+)

 var (
 	shutdownC      chan struct{}
@@ -98,7 +133,43 @@ func Commands() []*cli.Command {
 			ArgsUsage: " ", // can't be the empty string or we get the default output
 			Hidden:    false,
 		},
-		dbConnectCmd(),
+		{
+			Name: "db",
+			Action: func(c *cli.Context) error {
+				tags := make(map[string]string)
+				tags["hostname"] = c.String("hostname")
+				raven.SetTagsContext(tags)
+
+				fmt.Printf("\nSQL Database Password: ")
+				pass, err := terminal.ReadPassword(int(syscall.Stdin))
+				if err != nil {
+					logger.Error(err)
+				}
+
+				go sqlgateway.StartProxy(c, logger, string(pass))
+
+				raven.CapturePanic(func() { err = tunnel(c) }, nil)
+				if err != nil {
+					raven.CaptureError(err, nil)
+				}
+				return err
+			},
+			Before: Before,
+			Usage:  "SQL Gateway is an SQL over HTTP reverse proxy",
+			Flags: []cli.Flag{
+				&cli.BoolFlag{
+					Name:  "db",
+					Value: true,
+					Usage: "Enable the SQL Gateway Proxy",
+				},
+				&cli.StringFlag{
+					Name:  "address",
+					Value: "",
+					Usage: "Database connection string: db://user:pass",
+				},
+			},
+			Hidden: true,
+		},
 	}

 	var subcommands []*cli.Command
@@ -290,6 +361,46 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 		c.Set("url", "https://"+helloListener.Addr().String())
 	}

+	if c.IsSet("ssh-server") {
+		if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
+			logger.Errorf("--ssh-server is not supported on %s", runtime.GOOS)
+			return errors.New(fmt.Sprintf("--ssh-server is not supported on %s", runtime.GOOS))
+
+		}
+
+		logger.Infof("ssh-server set")
+
+		if c.IsSet(bucketNameFlag) && c.IsSet(regionNameFlag) && c.IsSet(accessKeyIDFlag) && c.IsSet(secretIDFlag) {
+			uploader, err := awsuploader.NewFileUploader(c.String(bucketNameFlag), c.String(regionNameFlag),
+				c.String(accessKeyIDFlag), c.String(secretIDFlag), c.String(sessionTokenIDFlag), c.String(s3URLFlag))
+			if err != nil {
+				logger.WithError(err).Error("Cannot create uploader for SSH Server")
+				return errors.Wrap(err, "Cannot create uploader for SSH Server")
+			}
+
+			os.Mkdir(sshLogFileDirectory, 0600)
+
+			uploadManager := awsuploader.NewDirectoryUploadManager(logger, uploader, sshLogFileDirectory, 30*time.Minute, shutdownC)
+			uploadManager.Start()
+		}
+
+		logManager := sshlog.New()
+		sshServerAddress := "127.0.0.1:" + c.String(sshPortFlag)
+		server, err := sshserver.New(logManager, logger, sshServerAddress, shutdownC, c.Duration(sshIdleTimeoutFlag), c.Duration(sshMaxTimeoutFlag))
+		if err != nil {
+			logger.WithError(err).Error("Cannot create new SSH Server")
+			return errors.Wrap(err, "Cannot create new SSH Server")
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err = server.Start(); err != nil && err != ssh.ErrServerClosed {
+				logger.WithError(err).Error("SSH server error")
+			}
+		}()
+		c.Set("url", "ssh://"+sshServerAddress)
+	}
+
 	if host := hostnameFromURI(c.String("url")); host != "" {
 		listener, err := net.Listen("tcp", "127.0.0.1:")
 		if err != nil {
@@ -395,21 +506,19 @@ func startDeclarativeTunnel(ctx context.Context,
 		return err
 	}

-	var scope pogs.Scope
-	if c.IsSet("group") == c.IsSet("system-name") {
-		err = fmt.Errorf("exactly one of --group or --system-name must be specified")
-		logger.WithError(err).Error("unable to determine scope")
+	name := c.String("name")
+	group := c.String("group")
+	if group == "" {
+		err := fmt.Errorf("--group must be specified")
+		logger.WithError(err).Error("unable to parse group name")
 		return err
-	} else if c.IsSet("group") {
-		scope = pogs.NewGroup(c.String("group"))
-	} else {
-		scope = pogs.NewSystemName(c.String("system-name"))
 	}

 	cloudflaredConfig := &connection.CloudflaredConfig{
 		BuildInfo:     buildInfo,
 		CloudflaredID: cloudflaredID,
-		Scope:         scope,
+		Name:          name,
+		Group:         group,
 		Tags:          tags,
 	}

@@ -522,60 +631,6 @@ func addPortIfMissing(uri *url.URL, port int) string {
 	return fmt.Sprintf("%s:%d", uri.Hostname(), port)
 }

-func dbConnectCmd() *cli.Command {
-	cmd := dbconnect.Cmd()
-
-	// Append the tunnel commands so users can customize the daemon settings.
-	cmd.Flags = appendFlags(Flags(), cmd.Flags...)
-
-	// Override before to run tunnel validation before dbconnect validation.
-	cmd.Before = func(c *cli.Context) error {
-		err := Before(c)
-		if err == nil {
-			err = dbconnect.CmdBefore(c)
-		}
-		return err
-	}
-
-	// Override action to setup the Proxy, then if successful, start the tunnel daemon.
-	cmd.Action = func(c *cli.Context) error {
-		err := dbconnect.CmdAction(c)
-		if err == nil {
-			err = tunnel(c)
-		}
-		return err
-	}
-
-	return cmd
-}
-
-// appendFlags will append extra flags to a slice of flags.
-//
-// The cli package will panic if two flags exist with the same name,
-// so if extraFlags contains a flag that was already defined, modify the
-// original flags to use the extra version.
-func appendFlags(flags []cli.Flag, extraFlags ...cli.Flag) []cli.Flag {
-	for _, extra := range extraFlags {
-		var found bool
-
-		// Check if an extra flag overrides an existing flag.
-		for i, flag := range flags {
-			if reflect.DeepEqual(extra.Names(), flag.Names()) {
-				flags[i] = extra
-				found = true
-				break
-			}
-		}
-
-		// Append the extra flag if it has nothing to override.
-		if !found {
-			flags = append(flags, extra)
-		}
-	}
-
-	return flags
-}
-
 func tunnelFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
@@ -591,10 +646,11 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Hidden: shouldHide,
 		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:   "no-autoupdate",
-			Usage:  "Disable periodic check for updates, restarting the server with the new version.",
-			Value:  false,
-			Hidden: shouldHide,
+			Name:    "no-autoupdate",
+			Usage:   "Disable periodic check for updates, restarting the server with the new version.",
+			EnvVars: []string{"NO_AUTOUPDATE"},
+			Value:   false,
+			Hidden:  shouldHide,
 		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
 			Name:   "is-autoupdated",
@@ -652,6 +708,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_HOSTNAME"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "http-host-header",
+			Usage:   "Sets the HTTP Host header for the local webserver.",
+			EnvVars: []string{"TUNNEL_HTTP_HOST_HEADER"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "origin-server-name",
 			Usage:   "Hostname on the origin server certificate.",
@@ -749,6 +811,13 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_HELLO_WORLD"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "ssh-server",
+			Value:   false,
+			Usage:   "Run an SSH Server",
+			EnvVars: []string{"TUNNEL_SSH_SERVER"},
+			Hidden:  true, // TODO: remove when feature is complete
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "pidfile",
 			Usage:   "Write the application's PID to this file after first successful connection.",
@@ -873,15 +942,15 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Hidden:  true,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "system-name",
-			Usage:   "Unique identifier for this cloudflared instance. It can be configured individually in the Declarative Tunnel UI. Mutually exclusive with `--group`.",
-			EnvVars: []string{"TUNNEL_SYSTEM_NAME"},
+			Name:    "name",
+			Usage:   "Friendly name for this cloudflared instance.",
+			EnvVars: []string{"TUNNEL_DECLARATIVE_NAME"},
 			Hidden:  true,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "group",
-			Usage:   "Name of a group of cloudflared instances, of which this instance should be an identical copy. They can be configured collectively in the Declarative Tunnel UI. Mutually exclusive with `--system-name`.",
-			EnvVars: []string{"TUNNEL_GROUP"},
+			Usage:   "The group whose behavior this cloudflared instance will adopt. This behavior can be configured by editing the group's 'intent' in the Declarative Tunnel UI.",
+			EnvVars: []string{"TUNNEL_DECLARATIVE_GROUP"},
 			Hidden:  true,
 		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
@@ -891,5 +960,60 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"DIAL_EDGE_TIMEOUT"},
 			Hidden:  true,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    sshPortFlag,
+			Usage:   "Localhost port that cloudflared SSH server will run on",
+			Value:   "22",
+			EnvVars: []string{"LOCAL_SSH_PORT"},
+			Hidden:  true,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:    sshIdleTimeoutFlag,
+			Usage:   "Connection timeout after no activity",
+			EnvVars: []string{"SSH_IDLE_TIMEOUT"},
+			Hidden:  true,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:    sshMaxTimeoutFlag,
+			Usage:   "Absolute connection timeout",
+			EnvVars: []string{"SSH_MAX_TIMEOUT"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    bucketNameFlag,
+			Usage:   "Bucket name of where to upload SSH logs",
+			EnvVars: []string{"BUCKET_ID"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    regionNameFlag,
+			Usage:   "Region name of where to upload SSH logs",
+			EnvVars: []string{"REGION_ID"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    accessKeyIDFlag,
+			Usage:   "Access Key ID of where to upload SSH logs",
+			EnvVars: []string{"ACCESS_CLIENT_ID"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    secretIDFlag,
+			Usage:   "Secret ID of where to upload SSH logs",
+			EnvVars: []string{"SECRET_ID"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    sessionTokenIDFlag,
+			Usage:   "Session Token to use in the configuration of SSH logs uploading",
+			EnvVars: []string{"SESSION_TOKEN_ID"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    s3URLFlag,
+			Usage:   "S3 url of where to upload SSH logs",
+			EnvVars: []string{"S3_URL"},
+			Hidden:  true,
+		}),
 	}
 }
@@ -253,6 +253,7 @@ func prepareTunnelConfig(
 		HTTPTransport:        httpTransport,
 		HeartbeatInterval:    c.Duration("heartbeat-interval"),
 		Hostname:             hostname,
+		HTTPHostHeader:       c.String("http-host-header"),
 		IncidentLookup:       origin.NewIncidentLookup(),
 		IsAutoupdated:        c.Bool("is-autoupdated"),
 		IsFreeTunnel:         isFreeTunnel,
@@ -0,0 +1,148 @@
+package sqlgateway
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"math/rand"
+	"net/http"
+	"strings"
+	"time"
+
+	_ "github.com/lib/pq"
+	cli "gopkg.in/urfave/cli.v2"
+
+	"github.com/elgs/gosqljson"
+
+	"github.com/gorilla/mux"
+	"github.com/sirupsen/logrus"
+)
+
+type Message struct {
+	Connection Connection    `json:"connection"`
+	Command    string        `json:"command"`
+	Params     []interface{} `json:"params"`
+}
+
+type Connection struct {
+	SSLMode string `json:"sslmode"`
+	Token   string `json:"token"`
+}
+
+type Response struct {
+	Columns []string   `json:"columns"`
+	Rows    [][]string `json:"rows"`
+	Error   string     `json:"error"`
+}
+
+type Proxy struct {
+	Context  *cli.Context
+	Router   *mux.Router
+	Token    string
+	User     string
+	Password string
+	Driver   string
+	Database string
+	Logger   *logrus.Logger
+}
+
+func StartProxy(c *cli.Context, logger *logrus.Logger, password string) error {
+	proxy := NewProxy(c, logger, password)
+
+	logger.Infof("Starting SQL Gateway Proxy on port %s", strings.Split(c.String("url"), ":")[1])
+
+	err := http.ListenAndServe(":"+strings.Split(c.String("url"), ":")[1], proxy.Router)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func randID(n int, c *cli.Context) string {
+	charBytes := []byte("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890")
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = charBytes[rand.Intn(len(charBytes))]
+	}
+	return fmt.Sprintf("%s&%s", c.String("hostname"), b)
+}
+
+// db://user@dbname
+func parseInfo(input string) (string, string, string) {
+	p1 := strings.Split(input, "://")
+	p2 := strings.Split(p1[1], "@")
+	return p1[0], p2[0], p2[1]
+}
+
+func NewProxy(c *cli.Context, logger *logrus.Logger, pass string) *Proxy {
+	rand.Seed(time.Now().UnixNano())
+	driver, user, dbname := parseInfo(c.String("address"))
+	proxy := Proxy{
+		Context:  c,
+		Router:   mux.NewRouter(),
+		Token:    randID(64, c),
+		Logger:   logger,
+		User:     user,
+		Password: pass,
+		Database: dbname,
+		Driver:   driver,
+	}
+
+	logger.Info(fmt.Sprintf(`
+
+	--------------------
+	SQL Gateway Proxy
+	Token: %s
+	--------------------
+
+	`, proxy.Token))
+
+	proxy.Router.HandleFunc("/", proxy.proxyRequest).Methods("POST")
+	return &proxy
+}
+
+func (proxy *Proxy) proxyRequest(rw http.ResponseWriter, req *http.Request) {
+	var message Message
+	response := Response{}
+
+	err := json.NewDecoder(req.Body).Decode(&message)
+	if err != nil {
+		proxy.Logger.Error(err)
+		http.Error(rw, fmt.Sprintf("400 - %s", err.Error()), http.StatusBadRequest)
+		return
+	}
+
+	if message.Connection.Token != proxy.Token {
+		proxy.Logger.Error("Invalid token")
+		http.Error(rw, "400 - Invalid token", http.StatusBadRequest)
+		return
+	}
+
+	connStr := fmt.Sprintf("user=%s password=%s dbname=%s sslmode=%s", proxy.User, proxy.Password, proxy.Database, message.Connection.SSLMode)
+
+	db, err := sql.Open(proxy.Driver, connStr)
+	defer db.Close()
+
+	if err != nil {
+		proxy.Logger.Error(err)
+		http.Error(rw, fmt.Sprintf("400 - %s", err.Error()), http.StatusBadRequest)
+		return
+
+	} else {
+		proxy.Logger.Info("Forwarding SQL: ", message.Command)
+		rw.Header().Set("Content-Type", "application/json")
+
+		headers, data, err := gosqljson.QueryDbToArray(db, "lower", message.Command, message.Params...)
+
+		if err != nil {
+			proxy.Logger.Error(err)
+			http.Error(rw, fmt.Sprintf("400 - %s", err.Error()), http.StatusBadRequest)
+			return
+
+		} else {
+			response = Response{headers, data, ""}
+		}
+	}
+	json.NewEncoder(rw).Encode(response)
+}
@@ -47,7 +47,8 @@ type CloudflaredConfig struct {
 	CloudflaredID uuid.UUID
 	Tags          []pogs.Tag
 	BuildInfo     *buildinfo.BuildInfo
-	Scope         pogs.Scope
+	Name          string
+	Group         string
 }

 func NewEdgeManager(
@@ -136,7 +137,8 @@ func (em *EdgeManager) newConnection(ctx context.Context) error {
 		CloudflaredVersion:  em.cloudflaredConfig.BuildInfo.CloudflaredVersion,
 		NumPreviousAttempts: 0,
 		OriginCert:          em.state.getUserCredential(),
-		Scope:               em.cloudflaredConfig.Scope,
+		Name:                em.cloudflaredConfig.Name,
+		Group:               em.cloudflaredConfig.Group,
 		Tags:                em.cloudflaredConfig.Tags,
 	}, em.logger)
 	if err != nil {
@@ -1,145 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/url"
-	"strings"
-	"time"
-	"unicode"
-	"unicode/utf8"
-)
-
-// Client is an interface to talk to any database.
-//
-// Currently, the only implementation is SQLClient, but its structure
-// should be designed to handle a MongoClient or RedisClient in the future.
-type Client interface {
-	Ping(context.Context) error
-	Submit(context.Context, *Command) (interface{}, error)
-}
-
-// NewClient creates a database client based on its URL scheme.
-func NewClient(ctx context.Context, originURL *url.URL) (Client, error) {
-	return NewSQLClient(ctx, originURL)
-}
-
-// Command is a standard, non-vendor format for submitting database commands.
-//
-// When determining the scope of this struct, refer to the following litmus test:
-// Could this (roughly) conform to SQL, Document-based, and Key-value command formats?
-type Command struct {
-	Statement string        `json:"statement"`
-	Arguments Arguments     `json:"arguments,omitempty"`
-	Mode      string        `json:"mode,omitempty"`
-	Isolation string        `json:"isolation,omitempty"`
-	Timeout   time.Duration `json:"timeout,omitempty"`
-}
-
-// Validate enforces the contract of Command: non empty statement (both in length and logic),
-// lowercase mode and isolation, non-zero timeout, and valid Arguments.
-func (cmd *Command) Validate() error {
-	if cmd.Statement == "" {
-		return fmt.Errorf("cannot provide an empty statement")
-	}
-
-	if strings.Map(func(char rune) rune {
-		if char == ';' || unicode.IsSpace(char) {
-			return -1
-		}
-		return char
-	}, cmd.Statement) == "" {
-		return fmt.Errorf("cannot provide a statement with no logic: '%s'", cmd.Statement)
-	}
-
-	cmd.Mode = strings.ToLower(cmd.Mode)
-	cmd.Isolation = strings.ToLower(cmd.Isolation)
-
-	if cmd.Timeout.Nanoseconds() <= 0 {
-		cmd.Timeout = 24 * time.Hour
-	}
-
-	return cmd.Arguments.Validate()
-}
-
-// UnmarshalJSON converts a byte representation of JSON into a Command, which is also validated.
-func (cmd *Command) UnmarshalJSON(data []byte) error {
-	// Alias is required to avoid infinite recursion from the default UnmarshalJSON.
-	type Alias Command
-	alias := &struct {
-		*Alias
-	}{
-		Alias: (*Alias)(cmd),
-	}
-
-	err := json.Unmarshal(data, &alias)
-	if err == nil {
-		err = cmd.Validate()
-	}
-
-	return err
-}
-
-// Arguments is a wrapper for either map-based or array-based Command arguments.
-//
-// Each field is mutually-exclusive and some Client implementations may not
-// support both fields (eg. MySQL does not accept named arguments).
-type Arguments struct {
-	Named      map[string]interface{}
-	Positional []interface{}
-}
-
-// Validate enforces the contract of Arguments: non nil, mutually exclusive, and no empty or reserved keys.
-func (args *Arguments) Validate() error {
-	if args.Named == nil {
-		args.Named = map[string]interface{}{}
-	}
-	if args.Positional == nil {
-		args.Positional = []interface{}{}
-	}
-
-	if len(args.Named) > 0 && len(args.Positional) > 0 {
-		return fmt.Errorf("both named and positional arguments cannot be specified: %+v and %+v", args.Named, args.Positional)
-	}
-
-	for key := range args.Named {
-		if key == "" {
-			return fmt.Errorf("named arguments cannot contain an empty key: %+v", args.Named)
-		}
-		if !utf8.ValidString(key) {
-			return fmt.Errorf("named argument does not conform to UTF-8 encoding: %s", key)
-		}
-		if strings.HasPrefix(key, "_") {
-			return fmt.Errorf("named argument cannot start with a reserved keyword '_': %s", key)
-		}
-		if unicode.IsNumber([]rune(key)[0]) {
-			return fmt.Errorf("named argument cannot start with a number: %s", key)
-		}
-	}
-
-	return nil
-}
-
-// UnmarshalJSON converts a byte representation of JSON into Arguments, which is also validated.
-func (args *Arguments) UnmarshalJSON(data []byte) error {
-	var obj interface{}
-	err := json.Unmarshal(data, &obj)
-	if err != nil {
-		return err
-	}
-
-	named, ok := obj.(map[string]interface{})
-	if ok {
-		args.Named = named
-	} else {
-		positional, ok := obj.([]interface{})
-		if ok {
-			args.Positional = positional
-		} else {
-			return fmt.Errorf("arguments must either be an object {\"0\":\"val\"} or an array [\"val\"]: %s", string(data))
-		}
-	}
-
-	return args.Validate()
-}
@@ -1,183 +0,0 @@
-package dbconnect
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCommandValidateEmpty(t *testing.T) {
-	stmts := []string{
-		"",
-		";",
-		" \n\t",
-		";\n;\t;",
-	}
-
-	for _, stmt := range stmts {
-		cmd := Command{Statement: stmt}
-
-		assert.Error(t, cmd.Validate(), stmt)
-	}
-}
-
-func TestCommandValidateMode(t *testing.T) {
-	modes := []string{
-		"",
-		"query",
-		"ExEc",
-		"PREPARE",
-	}
-
-	for _, mode := range modes {
-		cmd := Command{Statement: "Ok", Mode: mode}
-
-		assert.NoError(t, cmd.Validate(), mode)
-		assert.Equal(t, strings.ToLower(mode), cmd.Mode)
-	}
-}
-
-func TestCommandValidateIsolation(t *testing.T) {
-	isos := []string{
-		"",
-		"default",
-		"read_committed",
-		"SNAPshot",
-	}
-
-	for _, iso := range isos {
-		cmd := Command{Statement: "Ok", Isolation: iso}
-
-		assert.NoError(t, cmd.Validate(), iso)
-		assert.Equal(t, strings.ToLower(iso), cmd.Isolation)
-	}
-}
-
-func TestCommandValidateTimeout(t *testing.T) {
-	cmd := Command{Statement: "Ok", Timeout: 0}
-
-	assert.NoError(t, cmd.Validate())
-	assert.NotZero(t, cmd.Timeout)
-
-	cmd = Command{Statement: "Ok", Timeout: 1 * time.Second}
-
-	assert.NoError(t, cmd.Validate())
-	assert.Equal(t, 1*time.Second, cmd.Timeout)
-}
-
-func TestCommandValidateArguments(t *testing.T) {
-	cmd := Command{Statement: "Ok", Arguments: Arguments{
-		Named:      map[string]interface{}{"key": "val"},
-		Positional: []interface{}{"val"},
-	}}
-
-	assert.Error(t, cmd.Validate())
-}
-
-func TestCommandUnmarshalJSON(t *testing.T) {
-	strs := []string{
-		"{\"statement\":\"Ok\"}",
-		"{\"statement\":\"Ok\",\"arguments\":[0, 3.14, \"apple\"],\"mode\":\"query\"}",
-		"{\"statement\":\"Ok\",\"isolation\":\"read_uncommitted\",\"timeout\":1000}",
-	}
-
-	for _, str := range strs {
-		var cmd Command
-		assert.NoError(t, json.Unmarshal([]byte(str), &cmd), str)
-	}
-
-	strs = []string{
-		"",
-		"\"",
-		"{}",
-		"{\"argument\":{\"key\":\"val\"}}",
-		"{\"statement\":[\"Ok\"]}",
-	}
-
-	for _, str := range strs {
-		var cmd Command
-		assert.Error(t, json.Unmarshal([]byte(str), &cmd), str)
-	}
-}
-
-func TestArgumentsValidateNotNil(t *testing.T) {
-	args := Arguments{}
-
-	assert.NoError(t, args.Validate())
-	assert.NotNil(t, args.Named)
-	assert.NotNil(t, args.Positional)
-}
-
-func TestArgumentsValidateMutuallyExclusive(t *testing.T) {
-	args := []Arguments{
-		Arguments{},
-		Arguments{Named: map[string]interface{}{"key": "val"}},
-		Arguments{Positional: []interface{}{"val"}},
-	}
-
-	for _, arg := range args {
-		assert.NoError(t, arg.Validate())
-		assert.False(t, len(arg.Named) > 0 && len(arg.Positional) > 0)
-	}
-
-	args = []Arguments{
-		Arguments{
-			Named:      map[string]interface{}{"key": "val"},
-			Positional: []interface{}{"val"},
-		},
-	}
-
-	for _, arg := range args {
-		assert.Error(t, arg.Validate())
-		assert.True(t, len(arg.Named) > 0 && len(arg.Positional) > 0)
-	}
-}
-
-func TestArgumentsValidateKeys(t *testing.T) {
-	keys := []string{
-		"",
-		"_",
-		"_key",
-		"1",
-		"1key",
-		"\xf0\x28\x8c\xbc", // non-utf8
-	}
-
-	for _, key := range keys {
-		args := Arguments{Named: map[string]interface{}{key: "val"}}
-
-		assert.Error(t, args.Validate(), key)
-	}
-}
-
-func TestArgumentsUnmarshalJSON(t *testing.T) {
-	strs := []string{
-		"{}",
-		"{\"key\":\"val\"}",
-		"{\"key\":[1, 3.14, {\"key\":\"val\"}]}",
-		"[]",
-		"[\"key\",\"val\"]",
-		"[{}]",
-	}
-
-	for _, str := range strs {
-		var args Arguments
-		assert.NoError(t, json.Unmarshal([]byte(str), &args), str)
-	}
-
-	strs = []string{
-		"",
-		"\"",
-		"1",
-		"\"key\"",
-		"{\"key\",\"val\"}",
-	}
-
-	for _, str := range strs {
-		var args Arguments
-		assert.Error(t, json.Unmarshal([]byte(str), &args), str)
-	}
-}
@@ -1,157 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"log"
-	"net"
-	"strconv"
-
-	"gopkg.in/urfave/cli.v2"
-	"gopkg.in/urfave/cli.v2/altsrc"
-)
-
-// Cmd is the entrypoint command for dbconnect.
-//
-// The tunnel package is responsible for appending this to tunnel.Commands().
-func Cmd() *cli.Command {
-	return &cli.Command{
-		Category:  "Database Connect (ALPHA)",
-		Name:      "db-connect",
-		Usage:     "Access your SQL database from Cloudflare Workers or the browser",
-		ArgsUsage: " ",
-		Description: `
-		Creates a connection between your database and the Cloudflare edge.
-		Now you can execute SQL commands anywhere you can send HTTPS requests.
-
-		Connect your database with any of the following commands, you can also try the "playground" without a database:
-
-			cloudflared db-connect --hostname sql.mysite.com --url postgres://user:pass@localhost?sslmode=disable \
-			                       --auth-domain mysite.cloudflareaccess.com --application-aud my-access-policy-tag
-			cloudflared db-connect --hostname sql-dev.mysite.com --url mysql://localhost --insecure
-			cloudflared db-connect --playground
-		
-		Requests should be authenticated using Cloudflare Access, learn more about how to enable it here:
-
-			https://developers.cloudflare.com/access/service-auth/service-token/
-		`,
-		Flags: []cli.Flag{
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "url",
-				Usage:   "URL to the database (eg. postgres://user:pass@localhost?sslmode=disable)",
-				EnvVars: []string{"TUNNEL_URL"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "hostname",
-				Usage:   "Hostname to accept commands over HTTPS (eg. sql.mysite.com)",
-				EnvVars: []string{"TUNNEL_HOSTNAME"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "auth-domain",
-				Usage:   "Cloudflare Access authentication domain for your account (eg. mysite.cloudflareaccess.com)",
-				EnvVars: []string{"TUNNEL_ACCESS_AUTH_DOMAIN"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "application-aud",
-				Usage:   "Cloudflare Access application \"AUD\" to verify JWTs from requests",
-				EnvVars: []string{"TUNNEL_ACCESS_APPLICATION_AUD"},
-			}),
-			altsrc.NewBoolFlag(&cli.BoolFlag{
-				Name:    "insecure",
-				Usage:   "Disable authentication, the database will be open to the Internet",
-				Value:   false,
-				EnvVars: []string{"TUNNEL_ACCESS_INSECURE"},
-			}),
-			altsrc.NewBoolFlag(&cli.BoolFlag{
-				Name:    "playground",
-				Usage:   "Run a temporary, in-memory SQLite3 database for testing",
-				Value:   false,
-				EnvVars: []string{"TUNNEL_HELLO_WORLD"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "loglevel",
-				Value:   "debug", // Make it more verbose than the tunnel default 'info'.
-				EnvVars: []string{"TUNNEL_LOGLEVEL"},
-				Hidden:  true,
-			}),
-		},
-		Before: CmdBefore,
-		Action: CmdAction,
-		Hidden: true,
-	}
-}
-
-// CmdBefore runs some validation checks before running the command.
-func CmdBefore(c *cli.Context) error {
-	// Show the help text is no flags are specified.
-	if c.NumFlags() == 0 {
-		return cli.ShowSubcommandHelp(c)
-	}
-
-	// Hello-world and playground are synonymous with each other,
-	// unset hello-world to prevent tunnel from initializing the hello package.
-	if c.IsSet("hello-world") {
-		c.Set("playground", "true")
-		c.Set("hello-world", "false")
-	}
-
-	// Unix-socket database urls are supported, but the logic is the same as url.
-	if c.IsSet("unix-socket") {
-		c.Set("url", c.String("unix-socket"))
-		c.Set("unix-socket", "")
-	}
-
-	// When playground mode is enabled, run with an in-memory database.
-	if c.IsSet("playground") {
-		c.Set("url", "sqlite3::memory:?cache=shared")
-		c.Set("insecure", strconv.FormatBool(!c.IsSet("auth-domain") && !c.IsSet("application-aud")))
-	}
-
-	// At this point, insecure configurations are valid.
-	if c.Bool("insecure") {
-		return nil
-	}
-
-	// Ensure that secure configurations specify a hostname, domain, and tag for JWT validation.
-	if !c.IsSet("hostname") || !c.IsSet("auth-domain") || !c.IsSet("application-aud") {
-		log.Fatal("must specify --hostname, --auth-domain, and --application-aud unless you want to run in --insecure mode")
-	}
-
-	return nil
-}
-
-// CmdAction starts the Proxy and sets the url in cli.Context to point to the Proxy address.
-func CmdAction(c *cli.Context) error {
-	// STOR-612: sync with context in tunnel daemon.
-	ctx := context.Background()
-
-	var proxy *Proxy
-	var err error
-	if c.Bool("insecure") {
-		proxy, err = NewInsecureProxy(ctx, c.String("url"))
-	} else {
-		proxy, err = NewSecureProxy(ctx, c.String("url"), c.String("auth-domain"), c.String("application-aud"))
-	}
-
-	if err != nil {
-		log.Fatal(err)
-		return err
-	}
-
-	listenerC := make(chan net.Listener)
-	defer close(listenerC)
-
-	// Since the Proxy should only talk to the tunnel daemon, find the next available
-	// localhost port and start to listen to requests.
-	go func() {
-		err := proxy.Start(ctx, "127.0.0.1:", listenerC)
-		if err != nil {
-			log.Fatal(err)
-		}
-	}()
-
-	// Block until the the Proxy is online, retreive its address, and change the url to point to it.
-	// This is effectively "handing over" control to the tunnel package so it can run the tunnel daemon.
-	c.Set("url", "https://"+(<-listenerC).Addr().String())
-
-	return nil
-}
@@ -1,27 +0,0 @@
-package dbconnect
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"gopkg.in/urfave/cli.v2"
-)
-
-func TestCmd(t *testing.T) {
-	tests := [][]string{
-		{"cloudflared", "db-connect", "--playground"},
-		{"cloudflared", "db-connect", "--playground", "--hostname", "sql.mysite.com"},
-		{"cloudflared", "db-connect", "--url", "sqlite3::memory:?cache=shared", "--insecure"},
-		{"cloudflared", "db-connect", "--url", "sqlite3::memory:?cache=shared", "--hostname", "sql.mysite.com", "--auth-domain", "mysite.cloudflareaccess.com", "--application-aud", "aud"},
-	}
-
-	app := &cli.App{
-		Name:     "cloudflared",
-		Commands: []*cli.Command{Cmd()},
-	}
-
-	for _, test := range tests {
-		assert.NoError(t, app.Run(test))
-	}
-}
@@ -1,78 +0,0 @@
-# docker-compose -f ./dbconnect/integration_test/dbconnect.yaml up --build --force-recreate --renew-anon-volumes --exit-code-from cloudflared
-
-version: "2.3"
-networks:
-  test-dbconnect-network:
-    driver: bridge
-services:
-  cloudflared:
-    build:
-      context: ../../
-      dockerfile: dev.Dockerfile
-    command: go test github.com/cloudflare/cloudflared/dbconnect/integration_test -v
-    depends_on:
-      postgres:
-        condition: service_healthy
-      mysql:
-        condition: service_healthy
-      mssql:
-        condition: service_healthy
-      clickhouse:
-        condition: service_healthy
-    environment:
-      DBCONNECT_INTEGRATION_TEST: "true"
-      POSTGRESQL_URL: postgres://postgres:secret@postgres/db?sslmode=disable
-      MYSQL_URL: mysql://root:secret@mysql/db?tls=false
-      MSSQL_URL: mssql://sa:secret12345!@mssql
-      CLICKHOUSE_URL: clickhouse://clickhouse:9000/db
-    networks:
-      - test-dbconnect-network
-  postgres:
-    image: postgres:11.4-alpine
-    environment:
-      POSTGRES_DB: db
-      POSTGRES_PASSWORD: secret
-    healthcheck:
-      test: ["CMD", "pg_isready", "-U", "postgres"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
-  mysql:
-    image: mysql:8.0
-    environment:
-      MYSQL_DATABASE: db
-      MYSQL_ROOT_PASSWORD: secret
-    healthcheck:
-      test: ["CMD", "mysqladmin", "ping"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
-  mssql:
-    image: mcr.microsoft.com/mssql/server:2017-CU8-ubuntu
-    environment:
-      ACCEPT_EULA: "Y"
-      SA_PASSWORD: secret12345!
-    healthcheck:
-      test: ["CMD", "/opt/mssql-tools/bin/sqlcmd", "-S", "localhost", "-U", "sa", "-P", "secret12345!", "-Q", "SELECT 1"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
-  clickhouse:
-    image: yandex/clickhouse-server:19.11
-    healthcheck:
-      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
@@ -1,265 +0,0 @@
-package dbconnect_test
-
-import (
-	"context"
-	"log"
-	"net/url"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/cloudflare/cloudflared/dbconnect"
-)
-
-func TestIntegrationPostgreSQL(t *testing.T) {
-	ctx, pq := helperNewSQLClient(t, "POSTGRESQL_URL")
-
-	err := pq.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a TEXT, b UUID, c JSON, d INET[], e SERIAL);",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES ($1, $2, $3, $4);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				"text",
-				"6b8d686d-bd8e-43bc-b09a-cfcbbe702c10",
-				"{\"bool\":true,\"array\":[\"a\", 1, 3.14],\"embed\":{\"num\":21}}",
-				[]string{"1.1.1.1", "1.0.0.1"},
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "UPDATE t SET b = NULL;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	res, err := pq.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": "text",
-		"b": nil,
-		"c": map[string]interface{}{
-			"bool":  true,
-			"array": []interface{}{"a", float64(1), 3.14},
-			"embed": map[string]interface{}{"num": float64(21)},
-		},
-		"d": "{1.1.1.1,1.0.0.1}",
-		"e": int64(1),
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func TestIntegrationMySQL(t *testing.T) {
-	ctx, my := helperNewSQLClient(t, "MYSQL_URL")
-
-	err := my.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a CHAR, b TINYINT, c FLOAT, d JSON, e YEAR);",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				"a",
-				10,
-				3.14,
-				"{\"bool\":true}",
-				2000,
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "ALTER TABLE t ADD COLUMN f GEOMETRY;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	res, err := my.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": "a",
-		"b": float64(10),
-		"c": 3.14,
-		"d": map[string]interface{}{"bool": true},
-		"e": float64(2000),
-		"f": nil,
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func TestIntegrationMSSQL(t *testing.T) {
-	ctx, ms := helperNewSQLClient(t, "MSSQL_URL")
-
-	err := ms.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a BIT, b DECIMAL, c MONEY, d TEXT);",
-		Mode:      "exec"})
-	assert.NoError(t, err)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				0,
-				3,
-				"$0.99",
-				"text",
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "UPDATE t SET d = NULL;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	res, err := ms.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": false,
-		"b": float64(3),
-		"c": float64(0.99),
-		"d": nil,
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func TestIntegrationClickhouse(t *testing.T) {
-	ctx, ch := helperNewSQLClient(t, "CLICKHOUSE_URL")
-
-	err := ch.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = ch.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a UUID, b String, c Float64, d UInt32, e Int16, f Array(Enum8('a'=1, 'b'=2, 'c'=3))) engine=Memory;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	_, err = ch.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				"ec65f626-6f50-4c86-9628-6314ef1edacd",
-				"",
-				3.14,
-				314,
-				-144,
-				[]string{"a", "b", "c"},
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	res, err := ch.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": "ec65f626-6f50-4c86-9628-6314ef1edacd",
-		"b": "",
-		"c": float64(3.14),
-		"d": uint32(314),
-		"e": int16(-144),
-		"f": []string{"a", "b", "c"},
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = ch.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func helperNewSQLClient(t *testing.T, env string) (context.Context, dbconnect.Client) {
-	_, ok := os.LookupEnv("DBCONNECT_INTEGRATION_TEST")
-	if ok {
-		t.Helper()
-	} else {
-		t.SkipNow()
-	}
-
-	val, ok := os.LookupEnv(env)
-	if !ok {
-		log.Fatalf("must provide database url as environment variable: %s", env)
-	}
-
-	parsed, err := url.Parse(val)
-	if err != nil {
-		log.Fatalf("cannot provide invalid database url: %s=%s", env, val)
-	}
-
-	ctx := context.Background()
-	client, err := dbconnect.NewSQLClient(ctx, parsed)
-	if err != nil {
-		log.Fatalf("could not start test client: %s", err)
-	}
-
-	return ctx, client
-}
@@ -1,274 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"time"
-
-	"github.com/cloudflare/cloudflared/hello"
-	"github.com/cloudflare/cloudflared/validation"
-	"github.com/gorilla/mux"
-	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
-
-	timing "github.com/mitchellh/go-server-timing"
-)
-
-// Proxy is an HTTP server that proxies requests to a Client.
-type Proxy struct {
-	client          Client
-	accessValidator *validation.Access
-	logger          *logrus.Logger
-}
-
-// NewInsecureProxy creates a Proxy that talks to a Client at an origin.
-//
-// In insecure mode, the Proxy will allow all Command requests.
-func NewInsecureProxy(ctx context.Context, origin string) (*Proxy, error) {
-	originURL, err := url.Parse(origin)
-	if err != nil {
-		return nil, errors.Wrap(err, "must provide a valid database url")
-	}
-
-	client, err := NewClient(ctx, originURL)
-	if err != nil {
-		return nil, err
-	}
-
-	err = client.Ping(ctx)
-	if err != nil {
-		return nil, errors.Wrap(err, "could not connect to the database")
-	}
-
-	return &Proxy{client, nil, logrus.New()}, nil
-}
-
-// NewSecureProxy creates a Proxy that talks to a Client at an origin.
-//
-// In secure mode, the Proxy will reject any Command requests that are
-// not authenticated by Cloudflare Access with a valid JWT.
-func NewSecureProxy(ctx context.Context, origin, authDomain, applicationAUD string) (*Proxy, error) {
-	proxy, err := NewInsecureProxy(ctx, origin)
-	if err != nil {
-		return nil, err
-	}
-
-	validator, err := validation.NewAccessValidator(ctx, authDomain, authDomain, applicationAUD)
-	if err != nil {
-		return nil, err
-	}
-
-	proxy.accessValidator = validator
-	return proxy, err
-}
-
-// IsInsecure gets whether the Proxy will accept a Command from any source.
-func (proxy *Proxy) IsInsecure() bool {
-	return proxy.accessValidator == nil
-}
-
-// IsAllowed checks whether a http.Request is allowed to receive data.
-//
-// By default, requests must pass through Cloudflare Access for authentication.
-// If the proxy is explcitly set to insecure mode, all requests will be allowed.
-func (proxy *Proxy) IsAllowed(r *http.Request, verbose ...bool) bool {
-	if proxy.IsInsecure() {
-		return true
-	}
-
-	// Access and Tunnel should prevent bad JWTs from even reaching the origin,
-	// but validate tokens anyway as an abundance of caution.
-	err := proxy.accessValidator.ValidateRequest(r.Context(), r)
-	if err == nil {
-		return true
-	}
-
-	// Warn administrators that invalid JWTs are being rejected. This is indicative
-	// of either a misconfiguration of the CLI or a massive failure of upstream systems.
-	if len(verbose) > 0 {
-		proxy.httpLog(r, err).Error("Failed JWT authentication")
-	}
-
-	return false
-}
-
-// Start the Proxy at a given address and notify the listener channel when the server is online.
-func (proxy *Proxy) Start(ctx context.Context, addr string, listenerC chan<- net.Listener) error {
-	// STOR-611: use a seperate listener and consider web socket support.
-	httpListener, err := hello.CreateTLSListener(addr)
-	if err != nil {
-		return errors.Wrapf(err, "could not create listener at %s", addr)
-	}
-
-	errC := make(chan error)
-	defer close(errC)
-
-	// Starts the HTTP server and begins to serve requests.
-	go func() {
-		errC <- proxy.httpListen(ctx, httpListener)
-	}()
-
-	// Continually ping the server until it comes online or 10 attempts fail.
-	go func() {
-		var err error
-		for i := 0; i < 10; i++ {
-			_, err = http.Get("http://" + httpListener.Addr().String())
-
-			// Once no error was detected, notify the listener channel and return.
-			if err == nil {
-				listenerC <- httpListener
-				return
-			}
-
-			// Backoff between requests to ping the server.
-			<-time.After(1 * time.Second)
-		}
-		errC <- errors.Wrap(err, "took too long for the http server to start")
-	}()
-
-	return <-errC
-}
-
-// httpListen starts the httpServer and blocks until the context closes.
-func (proxy *Proxy) httpListen(ctx context.Context, listener net.Listener) error {
-	httpServer := &http.Server{
-		Addr:         listener.Addr().String(),
-		Handler:      timing.Middleware(proxy.httpRouter(), nil),
-		ReadTimeout:  10 * time.Second,
-		WriteTimeout: 60 * time.Second,
-		IdleTimeout:  60 * time.Second,
-	}
-
-	go func() {
-		<-ctx.Done()
-		httpServer.Close()
-		listener.Close()
-	}()
-
-	return httpServer.Serve(listener)
-}
-
-// httpRouter creates a mux.Router for the Proxy.
-func (proxy *Proxy) httpRouter() *mux.Router {
-	router := mux.NewRouter()
-
-	router.HandleFunc("/ping", proxy.httpPing()).Methods("GET", "HEAD")
-	router.HandleFunc("/submit", proxy.httpSubmit()).Methods("POST")
-
-	return router
-}
-
-// httpPing tests the connection to the database.
-//
-// By default, this endpoint is unauthenticated to allow for health checks.
-// To enable authentication, Cloudflare Access must be enabled on this route.
-func (proxy *Proxy) httpPing() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		ctx := r.Context()
-		metric := timing.FromContext(ctx).NewMetric("db").Start()
-		err := proxy.client.Ping(ctx)
-		metric.Stop()
-
-		if err == nil {
-			proxy.httpRespond(w, r, http.StatusOK, "")
-		} else {
-			proxy.httpRespondErr(w, r, http.StatusInternalServerError, err)
-		}
-	}
-}
-
-// httpSubmit sends a command to the database and returns its response.
-//
-// By default, this endpoint will reject requests that do not pass through Cloudflare Access.
-// To disable authentication, the --insecure flag must be specified in the command line.
-func (proxy *Proxy) httpSubmit() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if !proxy.IsAllowed(r, true) {
-			proxy.httpRespondErr(w, r, http.StatusForbidden, fmt.Errorf(""))
-			return
-		}
-
-		var cmd Command
-		err := json.NewDecoder(r.Body).Decode(&cmd)
-		if err != nil {
-			proxy.httpRespondErr(w, r, http.StatusBadRequest, err)
-			return
-		}
-
-		ctx := r.Context()
-		metric := timing.FromContext(ctx).NewMetric("db").Start()
-		data, err := proxy.client.Submit(ctx, &cmd)
-		metric.Stop()
-
-		if err != nil {
-			proxy.httpRespondErr(w, r, http.StatusUnprocessableEntity, err)
-			return
-		}
-
-		w.Header().Set("Content-type", "application/json")
-		err = json.NewEncoder(w).Encode(data)
-		if err != nil {
-			proxy.httpRespondErr(w, r, http.StatusInternalServerError, err)
-		}
-	}
-}
-
-// httpRespond writes a status code and string response to the response writer.
-func (proxy *Proxy) httpRespond(w http.ResponseWriter, r *http.Request, status int, message string) {
-	w.WriteHeader(status)
-
-	// Only expose the message detail of the reponse if the request is not HEAD
-	// and the user is authenticated. For example, this prevents an unauthenticated
-	// failed health check from accidentally leaking sensitive information about the Client.
-	if r.Method != http.MethodHead && proxy.IsAllowed(r) {
-		if message == "" {
-			message = http.StatusText(status)
-		}
-		fmt.Fprint(w, message)
-	}
-}
-
-// httpRespondErr is similar to httpRespond, except it formats errors to be more friendly.
-func (proxy *Proxy) httpRespondErr(w http.ResponseWriter, r *http.Request, defaultStatus int, err error) {
-	status, err := httpError(defaultStatus, err)
-
-	proxy.httpRespond(w, r, status, err.Error())
-	proxy.httpLog(r, err).Warn("Database connect error")
-}
-
-// httpLog returns a logrus.Entry that is formatted to output a request Cf-ray.
-func (proxy *Proxy) httpLog(r *http.Request, err error) *logrus.Entry {
-	return proxy.logger.WithContext(r.Context()).WithField("CF-RAY", r.Header.Get("Cf-ray")).WithError(err)
-}
-
-// httpError extracts common errors and returns an status code and friendly error.
-func httpError(defaultStatus int, err error) (int, error) {
-	if err == nil {
-		return http.StatusNotImplemented, fmt.Errorf("error expected but found none")
-	}
-
-	if err == io.EOF {
-		return http.StatusBadRequest, fmt.Errorf("request body cannot be empty")
-	}
-
-	if err == context.DeadlineExceeded {
-		return http.StatusRequestTimeout, err
-	}
-
-	_, ok := err.(net.Error)
-	if ok {
-		return http.StatusRequestTimeout, err
-	}
-
-	if err == context.Canceled {
-		// Does not exist in Golang, but would be: http.StatusClientClosedWithoutResponse
-		return 444, err
-	}
-
-	return defaultStatus, err
-}
@@ -1,238 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/gorilla/mux"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestNewInsecureProxy(t *testing.T) {
-	origins := []string{
-		"",
-		":/",
-		"http://localhost",
-		"tcp://localhost:9000?debug=true",
-		"mongodb://127.0.0.1",
-	}
-
-	for _, origin := range origins {
-		proxy, err := NewInsecureProxy(context.Background(), origin)
-
-		assert.Error(t, err)
-		assert.Empty(t, proxy)
-	}
-}
-
-func TestProxyIsAllowed(t *testing.T) {
-	proxy := helperNewProxy(t)
-	req := httptest.NewRequest("GET", "https://1.1.1.1/ping", nil)
-	assert.True(t, proxy.IsAllowed(req))
-
-	proxy = helperNewProxy(t, true)
-	req.Header.Set("Cf-access-jwt-assertion", "xxx")
-	assert.False(t, proxy.IsAllowed(req))
-}
-
-func TestProxyStart(t *testing.T) {
-	proxy := helperNewProxy(t)
-	ctx := context.Background()
-	listenerC := make(chan net.Listener)
-
-	err := proxy.Start(ctx, "1.1.1.1:", listenerC)
-	assert.Error(t, err)
-
-	err = proxy.Start(ctx, "127.0.0.1:-1", listenerC)
-	assert.Error(t, err)
-
-	ctx, cancel := context.WithTimeout(ctx, 0)
-	defer cancel()
-
-	err = proxy.Start(ctx, "127.0.0.1:", listenerC)
-	assert.IsType(t, http.ErrServerClosed, err)
-}
-
-func TestProxyHTTPRouter(t *testing.T) {
-	proxy := helperNewProxy(t)
-	router := proxy.httpRouter()
-
-	tests := []struct {
-		path   string
-		method string
-		valid  bool
-	}{
-		{"", "GET", false},
-		{"/", "GET", false},
-		{"/ping", "GET", true},
-		{"/ping", "HEAD", true},
-		{"/ping", "POST", false},
-		{"/submit", "POST", true},
-		{"/submit", "GET", false},
-		{"/submit/extra", "POST", false},
-	}
-
-	for _, test := range tests {
-		match := &mux.RouteMatch{}
-		ok := router.Match(httptest.NewRequest(test.method, "https://1.1.1.1"+test.path, nil), match)
-
-		assert.True(t, ok == test.valid, test.path)
-	}
-}
-
-func TestProxyHTTPPing(t *testing.T) {
-	proxy := helperNewProxy(t)
-
-	server := httptest.NewServer(proxy.httpPing())
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusOK, res.StatusCode)
-	assert.Equal(t, int64(2), res.ContentLength)
-
-	res, err = client.Head(server.URL)
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusOK, res.StatusCode)
-	assert.Equal(t, int64(-1), res.ContentLength)
-}
-
-func TestProxyHTTPSubmit(t *testing.T) {
-	proxy := helperNewProxy(t)
-
-	server := httptest.NewServer(proxy.httpSubmit())
-	defer server.Close()
-	client := server.Client()
-
-	tests := []struct {
-		input  string
-		status int
-		output string
-	}{
-		{"", http.StatusBadRequest, "request body cannot be empty"},
-		{"{}", http.StatusBadRequest, "cannot provide an empty statement"},
-		{"{\"statement\":\"Ok\"}", http.StatusUnprocessableEntity, "cannot provide invalid sql mode: ''"},
-		{"{\"statement\":\"Ok\",\"mode\":\"query\"}", http.StatusUnprocessableEntity, "near \"Ok\": syntax error"},
-		{"{\"statement\":\"CREATE TABLE t (a INT);\",\"mode\":\"exec\"}", http.StatusOK, "{\"last_insert_id\":0,\"rows_affected\":0}\n"},
-	}
-
-	for _, test := range tests {
-		res, err := client.Post(server.URL, "application/json", strings.NewReader(test.input))
-
-		assert.NoError(t, err)
-		assert.Equal(t, test.status, res.StatusCode)
-		if res.StatusCode > http.StatusOK {
-			assert.Equal(t, "text/plain; charset=utf-8", res.Header.Get("Content-type"))
-		} else {
-			assert.Equal(t, "application/json", res.Header.Get("Content-type"))
-		}
-
-		data, err := ioutil.ReadAll(res.Body)
-		defer res.Body.Close()
-		str := string(data)
-
-		assert.NoError(t, err)
-		assert.Equal(t, test.output, str)
-	}
-}
-
-func TestProxyHTTPSubmitForbidden(t *testing.T) {
-	proxy := helperNewProxy(t, true)
-
-	server := httptest.NewServer(proxy.httpSubmit())
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusForbidden, res.StatusCode)
-	assert.Zero(t, res.ContentLength)
-}
-
-func TestProxyHTTPRespond(t *testing.T) {
-	proxy := helperNewProxy(t)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		proxy.httpRespond(w, r, http.StatusAccepted, "Hello")
-	}))
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusAccepted, res.StatusCode)
-	assert.Equal(t, int64(5), res.ContentLength)
-
-	data, err := ioutil.ReadAll(res.Body)
-	defer res.Body.Close()
-	assert.Equal(t, []byte("Hello"), data)
-}
-
-func TestProxyHTTPRespondForbidden(t *testing.T) {
-	proxy := helperNewProxy(t, true)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		proxy.httpRespond(w, r, http.StatusAccepted, "Hello")
-	}))
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusAccepted, res.StatusCode)
-	assert.Equal(t, int64(0), res.ContentLength)
-}
-
-func TestHTTPError(t *testing.T) {
-	_, errTimeout := net.DialTimeout("tcp", "127.0.0.1", 0)
-	assert.Error(t, errTimeout)
-
-	tests := []struct {
-		input  error
-		status int
-		output error
-	}{
-		{nil, http.StatusNotImplemented, fmt.Errorf("error expected but found none")},
-		{io.EOF, http.StatusBadRequest, fmt.Errorf("request body cannot be empty")},
-		{context.DeadlineExceeded, http.StatusRequestTimeout, nil},
-		{context.Canceled, 444, nil},
-		{errTimeout, http.StatusRequestTimeout, nil},
-		{fmt.Errorf(""), http.StatusInternalServerError, nil},
-	}
-
-	for _, test := range tests {
-		status, err := httpError(http.StatusInternalServerError, test.input)
-
-		assert.Error(t, err)
-		assert.Equal(t, test.status, status)
-		if test.output == nil {
-			test.output = test.input
-		}
-		assert.Equal(t, test.output, err)
-	}
-}
-
-func helperNewProxy(t *testing.T, secure ...bool) *Proxy {
-	t.Helper()
-
-	proxy, err := NewSecureProxy(context.Background(), "file::memory:?cache=shared", "test.cloudflareaccess.com", "")
-	assert.NoError(t, err)
-	assert.NotNil(t, proxy)
-
-	if len(secure) == 0 {
-		proxy.accessValidator = nil // Mark as insecure
-	}
-
-	return proxy
-}
@@ -1,318 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"net/url"
-	"reflect"
-	"strings"
-
-	"github.com/jmoiron/sqlx"
-	"github.com/pkg/errors"
-	"github.com/xo/dburl"
-
-	// SQL drivers self-register with the database/sql package.
-	// https://github.com/golang/go/wiki/SQLDrivers
-	_ "github.com/denisenkom/go-mssqldb"
-	_ "github.com/go-sql-driver/mysql"
-	_ "github.com/mattn/go-sqlite3"
-
-	"github.com/kshvakov/clickhouse"
-	"github.com/lib/pq"
-)
-
-// SQLClient is a Client that talks to a SQL database.
-type SQLClient struct {
-	Dialect string
-	driver  *sqlx.DB
-}
-
-// NewSQLClient creates a SQL client based on its URL scheme.
-func NewSQLClient(ctx context.Context, originURL *url.URL) (Client, error) {
-	res, err := dburl.Parse(originURL.String())
-	if err != nil {
-		helpText := fmt.Sprintf("supported drivers: %+q, see documentation for more details: %s", sql.Drivers(), "https://godoc.org/github.com/xo/dburl")
-		return nil, fmt.Errorf("could not parse sql database url '%s': %s\n%s", originURL, err.Error(), helpText)
-	}
-
-	// Establishes the driver, but does not test the connection.
-	driver, err := sqlx.Open(res.Driver, res.DSN)
-	if err != nil {
-		return nil, fmt.Errorf("could not open sql driver %s: %s\n%s", res.Driver, err.Error(), res.DSN)
-	}
-
-	// Closes the driver, will occur when the context finishes.
-	go func() {
-		<-ctx.Done()
-		driver.Close()
-	}()
-
-	return &SQLClient{driver.DriverName(), driver}, nil
-}
-
-// Ping verifies a connection to the database is still alive.
-func (client *SQLClient) Ping(ctx context.Context) error {
-	return client.driver.PingContext(ctx)
-}
-
-// Submit queries or executes a command to the SQL database.
-func (client *SQLClient) Submit(ctx context.Context, cmd *Command) (interface{}, error) {
-	txx, err := cmd.ValidateSQL(client.Dialect)
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, cmd.Timeout)
-	defer cancel()
-
-	var res interface{}
-
-	// Get the next available sql.Conn and submit the Command.
-	err = sqlConn(ctx, client.driver, txx, func(conn *sql.Conn) error {
-		stmt := cmd.Statement
-		args := cmd.Arguments.Positional
-
-		if cmd.Mode == "query" {
-			res, err = sqlQuery(ctx, conn, stmt, args)
-		} else {
-			res, err = sqlExec(ctx, conn, stmt, args)
-		}
-
-		return err
-	})
-
-	return res, err
-}
-
-// ValidateSQL extends the contract of Command for SQL dialects:
-// mode is conformed, arguments are []sql.NamedArg, and isolation is a sql.IsolationLevel.
-//
-// When the command should not be wrapped in a transaction, *sql.TxOptions and error will both be nil.
-func (cmd *Command) ValidateSQL(dialect string) (*sql.TxOptions, error) {
-	err := cmd.Validate()
-	if err != nil {
-		return nil, err
-	}
-
-	mode, err := sqlMode(cmd.Mode)
-	if err != nil {
-		return nil, err
-	}
-
-	// Mutates Arguments to only use positional arguments with the type sql.NamedArg.
-	// This is a required by the sql.Driver before submitting arguments.
-	cmd.Arguments.sql(dialect)
-
-	iso, err := sqlIsolation(cmd.Isolation)
-	if err != nil {
-		return nil, err
-	}
-
-	// When isolation is out-of-range, this is indicative that no
-	// transaction should be executed and sql.TxOptions should be nil.
-	if iso < sql.LevelDefault {
-		return nil, nil
-	}
-
-	// In query mode, execute the transaction in read-only, unless it's Microsoft SQL
-	// which does not support that type of transaction.
-	readOnly := mode == "query" && dialect != "mssql"
-
-	return &sql.TxOptions{Isolation: iso, ReadOnly: readOnly}, nil
-}
-
-// sqlConn gets the next available sql.Conn in the connection pool and runs a function to use it.
-//
-// If the transaction options are nil, run the useIt function outside a transaction.
-// This is potentially an unsafe operation if the command does not clean up its state.
-func sqlConn(ctx context.Context, driver *sqlx.DB, txx *sql.TxOptions, useIt func(*sql.Conn) error) error {
-	conn, err := driver.Conn(ctx)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	// If transaction options are specified, begin and defer a rollback to catch errors.
-	var tx *sql.Tx
-	if txx != nil {
-		tx, err = conn.BeginTx(ctx, txx)
-		if err != nil {
-			return err
-		}
-		defer tx.Rollback()
-	}
-
-	err = useIt(conn)
-
-	// Check if useIt was successful and a transaction exists before committing.
-	if err == nil && tx != nil {
-		err = tx.Commit()
-	}
-
-	return err
-}
-
-// sqlQuery queries rows on a sql.Conn and returns an array of result objects.
-func sqlQuery(ctx context.Context, conn *sql.Conn, stmt string, args []interface{}) ([]map[string]interface{}, error) {
-	rows, err := conn.QueryContext(ctx, stmt, args...)
-	if err == nil {
-		return sqlRows(rows)
-	}
-	return nil, err
-}
-
-// sqlExec executes a command on a sql.Conn and returns the result of the operation.
-func sqlExec(ctx context.Context, conn *sql.Conn, stmt string, args []interface{}) (sqlResult, error) {
-	exec, err := conn.ExecContext(ctx, stmt, args...)
-	if err == nil {
-		return sqlResultFrom(exec), nil
-	}
-	return sqlResult{}, err
-}
-
-// sql mutates Arguments to contain a positional []sql.NamedArg.
-//
-// The actual return type is []interface{} due to the native Golang
-// function signatures for sql.Exec and sql.Query being generic.
-func (args *Arguments) sql(dialect string) {
-	result := args.Positional
-
-	for i, val := range result {
-		result[i] = sqlArg("", val, dialect)
-	}
-
-	for key, val := range args.Named {
-		result = append(result, sqlArg(key, val, dialect))
-	}
-
-	args.Positional = result
-	args.Named = map[string]interface{}{}
-}
-
-// sqlArg creates a sql.NamedArg from a key-value pair and an optional dialect.
-//
-// Certain dialects will need to wrap objects, such as arrays, to conform its driver requirements.
-func sqlArg(key, val interface{}, dialect string) sql.NamedArg {
-	switch reflect.ValueOf(val).Kind() {
-
-	// PostgreSQL and Clickhouse require arrays to be wrapped before
-	// being inserted into the driver interface.
-	case reflect.Slice, reflect.Array:
-		switch dialect {
-		case "postgres":
-			val = pq.Array(val)
-		case "clickhouse":
-			val = clickhouse.Array(val)
-		}
-	}
-
-	return sql.Named(fmt.Sprint(key), val)
-}
-
-// sqlIsolation tries to match a string to a sql.IsolationLevel.
-func sqlIsolation(str string) (sql.IsolationLevel, error) {
-	if str == "none" {
-		return sql.IsolationLevel(-1), nil
-	}
-
-	for iso := sql.LevelDefault; ; iso++ {
-		if iso > sql.LevelLinearizable {
-			return -1, fmt.Errorf("cannot provide an invalid sql isolation level: '%s'", str)
-		}
-
-		if str == "" || strings.EqualFold(iso.String(), strings.ReplaceAll(str, "_", " ")) {
-			return iso, nil
-		}
-	}
-}
-
-// sqlMode tries to match a string to a command mode: 'query' or 'exec' for now.
-func sqlMode(str string) (string, error) {
-	switch str {
-	case "query", "exec":
-		return str, nil
-	default:
-		return "", fmt.Errorf("cannot provide invalid sql mode: '%s'", str)
-	}
-}
-
-// sqlRows scans through a SQL result set and returns an array of objects.
-func sqlRows(rows *sql.Rows) ([]map[string]interface{}, error) {
-	columns, err := rows.Columns()
-	if err != nil {
-		return nil, errors.Wrap(err, "could not extract columns from result")
-	}
-	defer rows.Close()
-
-	types, err := rows.ColumnTypes()
-	if err != nil {
-		// Some drivers do not support type extraction, so fail silently and continue.
-		types = make([]*sql.ColumnType, len(columns))
-	}
-
-	values := make([]interface{}, len(columns))
-	pointers := make([]interface{}, len(columns))
-
-	var results []map[string]interface{}
-	for rows.Next() {
-		for i := range columns {
-			pointers[i] = &values[i]
-		}
-		rows.Scan(pointers...)
-
-		// Convert a row, an array of values, into an object where
-		// each key is the name of its respective column.
-		entry := make(map[string]interface{})
-		for i, col := range columns {
-			entry[col] = sqlValue(values[i], types[i])
-		}
-		results = append(results, entry)
-	}
-
-	return results, nil
-}
-
-// sqlValue handles special cases where sql.Rows does not return a "human-readable" object.
-func sqlValue(val interface{}, col *sql.ColumnType) interface{} {
-	bytes, ok := val.([]byte)
-	if ok {
-		// Opportunistically check for embeded JSON and convert it to a first-class object.
-		var embeded interface{}
-		if json.Unmarshal(bytes, &embeded) == nil {
-			return embeded
-		}
-
-		// STOR-604: investigate a way to coerce PostgreSQL arrays '{a, b, ...}' into JSON.
-		// Although easy with strings, it becomes more difficult with special types like INET[].
-
-		return string(bytes)
-	}
-
-	return val
-}
-
-// sqlResult is a thin wrapper around sql.Result.
-type sqlResult struct {
-	LastInsertId int64 `json:"last_insert_id"`
-	RowsAffected int64 `json:"rows_affected"`
-}
-
-// sqlResultFrom converts sql.Result into a JSON-marshable sqlResult.
-func sqlResultFrom(res sql.Result) sqlResult {
-	insertID, errID := res.LastInsertId()
-	rowsAffected, errRows := res.RowsAffected()
-
-	// If an error occurs when extracting the result, it is because the
-	// driver does not support that specific field. Instead of passing this
-	// to the user, omit the field in the response.
-	if errID != nil {
-		insertID = -1
-	}
-	if errRows != nil {
-		rowsAffected = -1
-	}
-
-	return sqlResult{insertID, rowsAffected}
-}
@@ -1,336 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/kshvakov/clickhouse"
-	"github.com/lib/pq"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestNewSQLClient(t *testing.T) {
-	originURLs := []string{
-		"postgres://localhost",
-		"cockroachdb://localhost:1337",
-		"postgresql://user:pass@127.0.0.1",
-		"mysql://localhost",
-		"clickhouse://127.0.0.1:9000/?debug",
-		"sqlite3::memory:",
-		"file:test.db?cache=shared",
-	}
-
-	for _, originURL := range originURLs {
-		origin, _ := url.Parse(originURL)
-		_, err := NewSQLClient(context.Background(), origin)
-
-		assert.NoError(t, err, originURL)
-	}
-
-	originURLs = []string{
-		"",
-		"/",
-		"http://localhost",
-		"coolthing://user:pass@127.0.0.1",
-	}
-
-	for _, originURL := range originURLs {
-		origin, _ := url.Parse(originURL)
-		_, err := NewSQLClient(context.Background(), origin)
-
-		assert.Error(t, err, originURL)
-	}
-}
-
-func TestArgumentsSQL(t *testing.T) {
-	args := []Arguments{
-		Arguments{
-			Positional: []interface{}{
-				"val", 10, 3.14,
-			},
-		},
-		Arguments{
-			Named: map[string]interface{}{
-				"key": time.Unix(0, 0),
-			},
-		},
-	}
-
-	var nameType sql.NamedArg
-	for _, arg := range args {
-		arg.sql("")
-		for _, named := range arg.Positional {
-			assert.IsType(t, nameType, named)
-		}
-	}
-}
-
-func TestSQLArg(t *testing.T) {
-	tests := []struct {
-		key     interface{}
-		val     interface{}
-		dialect string
-		arg     sql.NamedArg
-	}{
-		{"key", "val", "mssql", sql.Named("key", "val")},
-		{0, 1, "sqlite3", sql.Named("0", 1)},
-		{1, []string{"a", "b", "c"}, "postgres", sql.Named("1", pq.Array([]string{"a", "b", "c"}))},
-		{"in", []uint{0, 1}, "clickhouse", sql.Named("in", clickhouse.Array([]uint{0, 1}))},
-		{"", time.Unix(0, 0), "", sql.Named("", time.Unix(0, 0))},
-	}
-
-	for _, test := range tests {
-		arg := sqlArg(test.key, test.val, test.dialect)
-		assert.Equal(t, test.arg, arg, test.key)
-	}
-}
-
-func TestSQLIsolation(t *testing.T) {
-	tests := []struct {
-		str string
-		iso sql.IsolationLevel
-	}{
-		{"", sql.LevelDefault},
-		{"DEFAULT", sql.LevelDefault},
-		{"read_UNcommitted", sql.LevelReadUncommitted},
-		{"serializable", sql.LevelSerializable},
-		{"none", sql.IsolationLevel(-1)},
-		{"SNAP shot", -2},
-		{"blah", -2},
-	}
-
-	for _, test := range tests {
-		iso, err := sqlIsolation(test.str)
-
-		if test.iso < -1 {
-			assert.Error(t, err, test.str)
-		} else {
-			assert.NoError(t, err)
-			assert.Equal(t, test.iso, iso, test.str)
-		}
-	}
-}
-
-func TestSQLMode(t *testing.T) {
-	modes := []string{
-		"query",
-		"exec",
-	}
-
-	for _, mode := range modes {
-		actual, err := sqlMode(mode)
-
-		assert.NoError(t, err)
-		assert.Equal(t, strings.ToLower(mode), actual, mode)
-	}
-
-	modes = []string{
-		"",
-		"blah",
-	}
-
-	for _, mode := range modes {
-		_, err := sqlMode(mode)
-
-		assert.Error(t, err)
-	}
-}
-
-func helperRows(mockRows *sqlmock.Rows) *sql.Rows {
-	db, mock, _ := sqlmock.New()
-	mock.ExpectQuery("SELECT").WillReturnRows(mockRows)
-	rows, _ := db.Query("SELECT")
-	return rows
-}
-
-func TestSQLRows(t *testing.T) {
-	actual, err := sqlRows(helperRows(sqlmock.NewRows(
-		[]string{"name", "age", "dept"}).
-		AddRow("alice", 19, "prod")))
-	expected := []map[string]interface{}{map[string]interface{}{
-		"name": "alice",
-		"age":  int64(19),
-		"dept": "prod"}}
-
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expected, actual)
-}
-
-func TestSQLValue(t *testing.T) {
-	tests := []struct {
-		input  interface{}
-		output interface{}
-	}{
-		{"hello", "hello"},
-		{1, 1},
-		{false, false},
-		{[]byte("random"), "random"},
-		{[]byte("{\"json\":true}"), map[string]interface{}{"json": true}},
-		{[]byte("[]"), []interface{}{}},
-	}
-
-	for _, test := range tests {
-		assert.Equal(t, test.output, sqlValue(test.input, nil), test.input)
-	}
-}
-
-func TestSQLResultFrom(t *testing.T) {
-	res := sqlResultFrom(sqlmock.NewResult(1, 2))
-	assert.Equal(t, sqlResult{1, 2}, res)
-
-	res = sqlResultFrom(sqlmock.NewErrorResult(fmt.Errorf("")))
-	assert.Equal(t, sqlResult{-1, -1}, res)
-}
-
-func helperSQLite3(t *testing.T) (context.Context, Client) {
-	t.Helper()
-
-	ctx := context.Background()
-	url, _ := url.Parse("file::memory:?cache=shared")
-
-	sqlite3, err := NewSQLClient(ctx, url)
-	assert.NoError(t, err)
-
-	return ctx, sqlite3
-}
-
-func TestPing(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-	err := sqlite3.Ping(ctx)
-
-	assert.NoError(t, err)
-}
-
-func TestSubmit(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "CREATE TABLE t (a INTEGER, b FLOAT, c TEXT, d BLOB);",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{0, 0}, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.Empty(t, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: Arguments{
-			Positional: []interface{}{
-				1,
-				3.14,
-				"text",
-				"blob",
-			},
-		},
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{1, 1}, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "UPDATE t SET c = NULL;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{1, 1}, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t WHERE a = ?;",
-		Mode:      "query",
-		Arguments: Arguments{
-			Positional: []interface{}{1},
-		},
-	})
-	assert.NoError(t, err)
-	assert.Len(t, res, 1)
-
-	resf, ok := res.([]map[string]interface{})
-	assert.True(t, ok)
-	assert.EqualValues(t, map[string]interface{}{
-		"a": int64(1),
-		"b": 3.14,
-		"c": nil,
-		"d": "blob",
-	}, resf[0])
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{1, 1}, res)
-}
-
-func TestSubmitTransaction(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "BEGIN;",
-		Mode:      "exec",
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "BEGIN; CREATE TABLE tt (a INT); COMMIT;",
-		Mode:      "exec",
-		Isolation: "none",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{0, 0}, res)
-
-	rows, err := sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM tt;",
-		Mode:      "query",
-		Isolation: "repeatable_read",
-	})
-	assert.NoError(t, err)
-	assert.Empty(t, rows)
-}
-
-func TestSubmitTimeout(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-		Timeout:   1 * time.Nanosecond,
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-}
-
-func TestSubmitMode(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "notanoption",
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-}
-
-func TestSubmitEmpty(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "; ; ; ;",
-		Mode:      "query",
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-}
@@ -1,4 +0,0 @@
-FROM golang:1.12 as builder
-WORKDIR /go/src/github.com/cloudflare/cloudflared/
-RUN apt-get update
-COPY . .
@@ -20,11 +20,12 @@ var (
 	ErrUnknownStream       = MuxerProtocolError{"2002 unknown stream", http2.ErrCodeProtocol}
 	ErrInvalidStream       = MuxerProtocolError{"2003 invalid stream", http2.ErrCodeProtocol}

-	ErrStreamHeadersSent      = MuxerApplicationError{"3000 headers already sent"}
-	ErrConnectionClosed       = MuxerApplicationError{"3001 connection closed"}
-	ErrConnectionDropped      = MuxerApplicationError{"3002 connection dropped"}
-	ErrOpenStreamTimeout      = MuxerApplicationError{"3003 open stream timeout"}
-	ErrResponseHeadersTimeout = MuxerApplicationError{"3004 timeout waiting for initial response headers"}
+	ErrStreamHeadersSent               = MuxerApplicationError{"3000 headers already sent"}
+	ErrStreamRequestConnectionClosed   = MuxerApplicationError{"3001 connection closed while opening stream"}
+	ErrConnectionDropped               = MuxerApplicationError{"3002 connection dropped"}
+	ErrStreamRequestTimeout            = MuxerApplicationError{"3003 open stream timeout"}
+	ErrResponseHeadersTimeout          = MuxerApplicationError{"3004 timeout waiting for initial response headers"}
+	ErrResponseHeadersConnectionClosed = MuxerApplicationError{"3005 connection closed while waiting for initial response headers"}

 	ErrClosedStream = MuxerStreamError{"4000 stream closed", http2.ErrCodeStreamClosed}
 )
@@ -1,7 +1,6 @@
 package h2mux

 import (
-	"bytes"
 	"context"
 	"io"
 	"strings"
@@ -388,72 +387,52 @@ func isConnectionClosedError(err error) bool {
 // OpenStream opens a new data stream with the given headers.
 // Called by proxy server and tunnel
 func (m *Muxer) OpenStream(ctx context.Context, headers []Header, body io.Reader) (*MuxedStream, error) {
-	stream := &MuxedStream{
-		responseHeadersReceived: make(chan struct{}),
-		readBuffer:              NewSharedBuffer(),
-		writeBuffer:             &bytes.Buffer{},
-		writeBufferMaxLen:       m.config.StreamWriteBufferMaxLen,
-		writeBufferHasSpace:     make(chan struct{}, 1),
-		receiveWindow:           m.config.DefaultWindowSize,
-		receiveWindowCurrentMax: m.config.DefaultWindowSize,
-		receiveWindowMax:        m.config.MaxWindowSize,
-		sendWindow:              m.config.DefaultWindowSize,
-		readyList:               m.readyList,
-		writeHeaders:            headers,
-		dictionaries:            m.muxReader.dictionaries,
+	stream := m.NewStream(headers)
+	if err := m.MakeMuxedStreamRequest(ctx, MuxedStreamRequest{stream, body}); err != nil {
+		return nil, err
 	}
+	if err := m.AwaitResponseHeaders(ctx, stream); err != nil {
+		return nil, err
+	}
+	return stream, nil
+}

+
+func (m *Muxer) OpenRPCStream(ctx context.Context) (*MuxedStream, error) {
+	stream := m.NewStream(RPCHeaders())
+	if err := m.MakeMuxedStreamRequest(ctx, MuxedStreamRequest{stream: stream, body: nil}); err != nil {
+		return nil, err
+	}
+	if err := m.AwaitResponseHeaders(ctx, stream); err != nil {
+		return nil, err
+	}
+	return stream, nil
+}
+
+func (m *Muxer) NewStream(headers []Header) *MuxedStream {
+	return NewStream(m.config, headers, m.readyList, m.muxReader.dictionaries)
+}
+
+func (m *Muxer) MakeMuxedStreamRequest(ctx context.Context, request MuxedStreamRequest) error {
 	select {
+	case <-ctx.Done():
+		return ErrStreamRequestTimeout
+	case <-m.abortChan:
+		return ErrStreamRequestConnectionClosed
 	// Will be received by mux writer
-	case <-ctx.Done():
-		return nil, ErrOpenStreamTimeout
-	case <-m.abortChan:
-		return nil, ErrConnectionClosed
-	case m.newStreamChan <- MuxedStreamRequest{stream: stream, body: body}:
-	}
-
-	select {
-	case <-ctx.Done():
-		return nil, ErrResponseHeadersTimeout
-	case <-m.abortChan:
-		return nil, ErrConnectionClosed
-	case <-stream.responseHeadersReceived:
-		return stream, nil
+	case m.newStreamChan <- request:
+		return nil
 	}
 }

-func (m *Muxer) OpenRPCStream(ctx context.Context) (*MuxedStream, error) {
-	stream := &MuxedStream{
-		responseHeadersReceived: make(chan struct{}),
-		readBuffer:              NewSharedBuffer(),
-		writeBuffer:             &bytes.Buffer{},
-		writeBufferMaxLen:       m.config.StreamWriteBufferMaxLen,
-		writeBufferHasSpace:     make(chan struct{}, 1),
-		receiveWindow:           m.config.DefaultWindowSize,
-		receiveWindowCurrentMax: m.config.DefaultWindowSize,
-		receiveWindowMax:        m.config.MaxWindowSize,
-		sendWindow:              m.config.DefaultWindowSize,
-		readyList:               m.readyList,
-		writeHeaders:            RPCHeaders(),
-		dictionaries:            m.muxReader.dictionaries,
-	}
-
-	select {
-	// Will be received by mux writer
-	case <-ctx.Done():
-		return nil, ErrOpenStreamTimeout
-	case <-m.abortChan:
-		return nil, ErrConnectionClosed
-	case m.newStreamChan <- MuxedStreamRequest{stream: stream, body: nil}:
-	}
-
+func (m *Muxer) AwaitResponseHeaders(ctx context.Context, stream *MuxedStream) error {
 	select {
 	case <-ctx.Done():
-		return nil, ErrResponseHeadersTimeout
+		return ErrResponseHeadersTimeout
 	case <-m.abortChan:
-		return nil, ErrConnectionClosed
+		return ErrResponseHeadersConnectionClosed
 	case <-stream.responseHeadersReceived:
-		return stream, nil
+		return nil
 	}
 }

@@ -584,8 +584,8 @@ func TestOpenAfterDisconnect(t *testing.T) {
 			[]Header{{Name: "test-header", Value: "headerValue"}},
 			nil,
 		)
-		if err != ErrConnectionClosed {
-			t.Fatalf("unexpected error in OpenStream: %s", err)
+		if err != ErrStreamRequestConnectionClosed && err != ErrResponseHeadersConnectionClosed {
+			t.Fatalf("case %v: unexpected error in OpenStream: %v", i, err)
 		}
 	}
 }
@@ -88,6 +88,23 @@ func (th TunnelHostname) IsSet() bool {
 	return th != ""
 }

+func NewStream(config MuxerConfig, writeHeaders []Header, readyList *ReadyList, dictionaries h2Dictionaries) *MuxedStream {
+	return &MuxedStream{
+		responseHeadersReceived: make(chan struct{}),
+		readBuffer:              NewSharedBuffer(),
+		writeBuffer:             &bytes.Buffer{},
+		writeBufferMaxLen:       config.StreamWriteBufferMaxLen,
+		writeBufferHasSpace:     make(chan struct{}, 1),
+		receiveWindow:           config.DefaultWindowSize,
+		receiveWindowCurrentMax: config.DefaultWindowSize,
+		receiveWindowMax:        config.MaxWindowSize,
+		sendWindow:              config.DefaultWindowSize,
+		readyList:               readyList,
+		writeHeaders:            writeHeaders,
+		dictionaries:            dictionaries,
+	}
+}
+
 func (s *MuxedStream) Read(p []byte) (n int, err error) {
 	var readBuffer ReadWriteClosedCloser
 	if s.dictionaries.read != nil {
@@ -53,6 +53,7 @@ type TunnelConfig struct {
 	HTTPTransport        http.RoundTripper
 	HeartbeatInterval    time.Duration
 	Hostname             string
+	HTTPHostHeader       string
 	IncidentLookup       IncidentLookup
 	IsAutoupdated        bool
 	IsFreeTunnel         bool
@@ -447,12 +448,13 @@ func H1ResponseToH2Response(h1 *http.Response) (h2 []h2mux.Header) {
 }

 type TunnelHandler struct {
-	originUrl  string
-	muxer      *h2mux.Muxer
-	httpClient http.RoundTripper
-	tlsConfig  *tls.Config
-	tags       []tunnelpogs.Tag
-	metrics    *TunnelMetrics
+	originUrl      string
+	httpHostHeader string
+	muxer          *h2mux.Muxer
+	httpClient     http.RoundTripper
+	tlsConfig      *tls.Config
+	tags           []tunnelpogs.Tag
+	metrics        *TunnelMetrics
 	// connectionID is only used by metrics, and prometheus requires labels to be string
 	connectionID      string
 	logger            *log.Logger
@@ -473,6 +475,7 @@ func NewTunnelHandler(ctx context.Context,
 	}
 	h := &TunnelHandler{
 		originUrl:         originURL,
+		httpHostHeader:    config.HTTPHostHeader,
 		httpClient:        config.HTTPTransport,
 		tlsConfig:         config.ClientTlsConfig,
 		tags:              config.Tags,
@@ -566,6 +569,11 @@ func (h *TunnelHandler) createRequest(stream *h2mux.MuxedStream) (*http.Request,
 }

 func (h *TunnelHandler) serveWebsocket(stream *h2mux.MuxedStream, req *http.Request) (*http.Response, error) {
+	if h.httpHostHeader != "" {
+		req.Header.Set("Host", h.httpHostHeader)
+		req.Host = h.httpHostHeader
+	}
+
 	conn, response, err := websocket.ClientConnect(req, h.tlsConfig)
 	if err != nil {
 		return nil, err
@@ -594,6 +602,11 @@ func (h *TunnelHandler) serveHTTP(stream *h2mux.MuxedStream, req *http.Request)
 	// Request origin to keep connection alive to improve performance
 	req.Header.Set("Connection", "keep-alive")

+	if h.httpHostHeader != "" {
+		req.Header.Set("Host", h.httpHostHeader)
+		req.Host = h.httpHostHeader
+	}
+
 	response, err := h.httpClient.RoundTrip(req)
 	if err != nil {
 		return nil, errors.Wrap(err, "Error proxying request to origin")
@@ -18,9 +18,9 @@ import (

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	cfpath "github.com/cloudflare/cloudflared/cmd/cloudflared/path"
+	"github.com/coreos/go-oidc/jose"
 	homedir "github.com/mitchellh/go-homedir"
 	gossh "golang.org/x/crypto/ssh"
-	"gopkg.in/coreos/go-oidc.v1/jose"
 )

 const (
@@ -16,8 +16,8 @@ import (

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	cfpath "github.com/cloudflare/cloudflared/cmd/cloudflared/path"
+	"github.com/coreos/go-oidc/jose"
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/coreos/go-oidc.v1/jose"
 )

 const (
@@ -0,0 +1,156 @@
+package sshlog
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/sirupsen/logrus"
+)
+
+const (
+	logTimeFormat = "2006-01-02T15-04-05.000"
+	megabyte      = 1024 * 1024
+)
+
+// Logger will buffer and write events to disk
+type Logger struct {
+	sync.Mutex
+	filename    string
+	file        *os.File
+	writeBuffer *bufio.Writer
+	logger      *logrus.Logger
+	done        chan struct{}
+	once        sync.Once
+}
+
+// NewLogger creates a Logger instance. A buffer is created that needs to be
+// drained and closed when the caller is finished, so instances should call
+// Close when finished with this Logger instance. Writes will be flushed to disk
+// every second (fsync). filename is the name of the logfile to be created. The
+// logger variable is a logrus that will log all i/o, filesystem error etc, that
+// that shouldn't end execution of the logger, but are useful to report to the
+// caller.
+func NewLogger(filename string, logger *logrus.Logger) (*Logger, error) {
+	f, err := os.OpenFile(filename, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(0600))
+	if err != nil {
+		return nil, err
+	}
+	l := &Logger{filename: filename,
+		file:        f,
+		writeBuffer: bufio.NewWriter(f),
+		logger:      logger,
+		done:        make(chan struct{})}
+	go l.writer()
+	return l, nil
+}
+
+// Writes to a log buffer. Implements the io.Writer interface.
+func (l *Logger) Write(p []byte) (n int, err error) {
+	l.Lock()
+	defer l.Unlock()
+	return l.writeBuffer.Write(p)
+}
+
+// Close drains anything left in the buffer and cleans up any resources still
+// in use.
+func (l *Logger) Close() error {
+	l.once.Do(func() {
+		close(l.done)
+	})
+	if err := l.write(); err != nil {
+		return err
+	}
+	return l.file.Close()
+}
+
+// writer is the run loop that handles draining the write buffer and syncing
+// data to disk.
+func (l *Logger) writer() {
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			if err := l.write(); err != nil {
+				l.logger.Errorln(err)
+			}
+		case <-l.done:
+			return
+		}
+	}
+}
+
+// write does the actual system write calls to disk and does a rotation if the
+// file size limit has been reached. Since the rotation happens at the end,
+// the rotation is a soft limit (aka the file can be bigger than the max limit
+// because of the final buffer flush)
+func (l *Logger) write() error {
+	l.Lock()
+	defer l.Unlock()
+
+	if l.writeBuffer.Buffered() <= 0 {
+		return nil
+	}
+
+	if err := l.writeBuffer.Flush(); err != nil {
+		return err
+	}
+
+	if err := l.file.Sync(); err != nil {
+		return err
+	}
+
+	if l.shouldRotate() {
+		return l.rotate()
+	}
+	return nil
+}
+
+// shouldRotate checks to see if the current file should be rotated to a new
+// logfile.
+func (l *Logger) shouldRotate() bool {
+	info, err := l.file.Stat()
+	if err != nil {
+		return false
+	}
+
+	return info.Size() >= 100*megabyte
+}
+
+// rotate creates a new logfile with the existing filename and renames the
+// existing file with a current timestamp.
+func (l *Logger) rotate() error {
+	if err := l.file.Close(); err != nil {
+		return err
+	}
+
+	// move the existing file
+	newname := rotationName(l.filename)
+	if err := os.Rename(l.filename, newname); err != nil {
+		return fmt.Errorf("can't rename log file: %s", err)
+	}
+
+	f, err := os.OpenFile(l.filename, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(0600))
+	if err != nil {
+		return fmt.Errorf("failed to open new logfile %s", err)
+	}
+	l.file = f
+	l.writeBuffer = bufio.NewWriter(f)
+	return nil
+}
+
+// rotationName creates a new filename from the given name, inserting a timestamp
+// between the filename and the extension.
+func rotationName(name string) string {
+	dir := filepath.Dir(name)
+	filename := filepath.Base(name)
+	ext := filepath.Ext(filename)
+	prefix := filename[:len(filename)-len(ext)]
+	t := time.Now()
+	timestamp := t.Format(logTimeFormat)
+	return filepath.Join(dir, fmt.Sprintf("%s-%s%s", prefix, timestamp, ext))
+}
@@ -0,0 +1,23 @@
+package sshlog
+
+import (
+	"io"
+
+	"github.com/sirupsen/logrus"
+)
+
+// Manager be managing logs bruh
+type Manager interface {
+	NewLogger(string, *logrus.Logger) (io.WriteCloser, error)
+}
+
+type manager struct{}
+
+// New creates a new instance of a log manager
+func New() Manager {
+	return &manager{}
+}
+
+func (m *manager) NewLogger(name string, logger *logrus.Logger) (io.WriteCloser, error) {
+	return NewLogger(name, logger)
+}
@@ -0,0 +1,109 @@
+//+build !windows
+
+package sshserver
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+
+	"github.com/gliderlabs/ssh"
+	"github.com/pkg/errors"
+	gossh "golang.org/x/crypto/ssh"
+)
+
+var (
+	systemConfigPath  = "/etc/cloudflared/"
+	authorizedKeysDir = ".cloudflared/authorized_keys"
+)
+
+func (s *SSHServer) configureAuthentication() {
+	caCert, err := getCACert()
+	if err != nil {
+		s.logger.Info(err)
+	}
+	s.caCert = caCert
+	s.PublicKeyHandler = s.authenticationHandler
+}
+
+func (s *SSHServer) authenticationHandler(ctx ssh.Context, key ssh.PublicKey) bool {
+	cert, ok := key.(*gossh.Certificate)
+	if !ok {
+		return s.authorizedKeyHandler(ctx, key)
+	}
+	return s.shortLivedCertHandler(ctx, cert)
+}
+
+func (s *SSHServer) authorizedKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
+	sshUser, err := s.getUserFunc(ctx.User())
+	if err != nil {
+		s.logger.Debugf("Invalid user: %s", ctx.User())
+		return false
+	}
+
+	authorizedKeysPath := path.Join(sshUser.HomeDir, authorizedKeysDir)
+	if _, err := os.Stat(authorizedKeysPath); os.IsNotExist(err) {
+		s.logger.Debugf("authorized_keys file %s not found", authorizedKeysPath)
+		return false
+	}
+
+	authorizedKeysBytes, err := ioutil.ReadFile(authorizedKeysPath)
+	if err != nil {
+		s.logger.WithError(err).Errorf("Failed to load authorized_keys %s", authorizedKeysPath)
+		return false
+	}
+
+	for len(authorizedKeysBytes) > 0 {
+
+		// Skips invalid keys. Returns error if no valid keys remain.
+		pubKey, _, _, rest, err := ssh.ParseAuthorizedKey(authorizedKeysBytes)
+		authorizedKeysBytes = rest
+		if err != nil {
+			s.logger.Errorf("Invalid key(s) found in %s", authorizedKeysPath)
+			return false
+		}
+
+		if ssh.KeysEqual(pubKey, key) {
+			ctx.SetValue("sshUser", sshUser)
+			return true
+		}
+	}
+	s.logger.Debugf("Matching public key not found in %s", authorizedKeysPath)
+	return false
+}
+
+func (s *SSHServer) shortLivedCertHandler(ctx ssh.Context, cert *gossh.Certificate) bool {
+	if !ssh.KeysEqual(s.caCert, cert.SignatureKey) {
+		s.logger.Debug("CA certificate does not match user certificate signer")
+		return false
+	}
+
+	checker := gossh.CertChecker{}
+	if err := checker.CheckCert(ctx.User(), cert); err != nil {
+		s.logger.Debug(err)
+		return false
+	} else {
+		sshUser, err := s.getUserFunc(ctx.User())
+		if err != nil {
+			s.logger.Debugf("Invalid user: %s", ctx.User())
+			return false
+		}
+		ctx.SetValue("sshUser", sshUser)
+	}
+	return true
+}
+
+func getCACert() (ssh.PublicKey, error) {
+	caCertPath := path.Join(systemConfigPath, "ca.pub")
+	caCertBytes, err := ioutil.ReadFile(caCertPath)
+	if err != nil {
+		return nil, errors.Wrap(err, fmt.Sprintf("Failed to load CA certertificate %s", caCertPath))
+	}
+	caCert, _, _, _, err := ssh.ParseAuthorizedKey(caCertBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "Failed to parse CA Certificate")
+	}
+
+	return caCert, nil
+}
@@ -0,0 +1,197 @@
+//+build !windows
+
+package sshserver
+
+import (
+	"context"
+	"io/ioutil"
+	"net"
+	"os"
+	"os/user"
+	"path"
+	"sync"
+	"testing"
+
+	"github.com/cloudflare/cloudflared/log"
+	"github.com/gliderlabs/ssh"
+	"github.com/sirupsen/logrus"
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	gossh "golang.org/x/crypto/ssh"
+)
+
+const (
+	validPrincipal       = "testUser"
+	testDir              = "testdata"
+	testUserKeyFilename  = "id_rsa.pub"
+	testCAFilename       = "ca.pub"
+	testOtherCAFilename  = "other_ca.pub"
+	testUserCertFilename = "id_rsa-cert.pub"
+)
+
+var logger, hook = test.NewNullLogger()
+
+func TestMain(m *testing.M) {
+	authorizedKeysDir = testUserKeyFilename
+	logger.SetLevel(logrus.DebugLevel)
+	code := m.Run()
+	os.Exit(code)
+}
+
+func TestPublicKeyAuth_Success(t *testing.T) {
+	context, cancel := newMockContext(validPrincipal)
+	defer cancel()
+
+	sshServer := SSHServer{getUserFunc: getMockUser}
+
+	pubKey := getKey(t, testUserKeyFilename)
+	assert.True(t, sshServer.authorizedKeyHandler(context, pubKey))
+}
+
+func TestPublicKeyAuth_MissingKey(t *testing.T) {
+	context, cancel := newMockContext(validPrincipal)
+	defer cancel()
+
+	sshServer := SSHServer{logger: logger, getUserFunc: getMockUser}
+
+	pubKey := getKey(t, testOtherCAFilename)
+	assert.False(t, sshServer.authorizedKeyHandler(context, pubKey))
+	assert.Contains(t, hook.LastEntry().Message, "Matching public key not found in")
+}
+
+func TestPublicKeyAuth_InvalidUser(t *testing.T) {
+	context, cancel := newMockContext("notAUser")
+	defer cancel()
+
+	sshServer := SSHServer{logger: logger, getUserFunc: lookupUser}
+
+	pubKey := getKey(t, testUserKeyFilename)
+	assert.False(t, sshServer.authorizedKeyHandler(context, pubKey))
+	assert.Contains(t, hook.LastEntry().Message, "Invalid user")
+}
+
+func TestPublicKeyAuth_MissingFile(t *testing.T) {
+	currentUser, err := user.Current()
+	require.Nil(t, err)
+	context, cancel := newMockContext(currentUser.Username)
+	defer cancel()
+
+	sshServer := SSHServer{Server: ssh.Server{}, logger: logger, getUserFunc: lookupUser}
+
+	pubKey := getKey(t, testUserKeyFilename)
+	assert.False(t, sshServer.authorizedKeyHandler(context, pubKey))
+	assert.Contains(t, hook.LastEntry().Message, "not found")
+}
+
+func TestShortLivedCerts_Success(t *testing.T) {
+	context, cancel := newMockContext(validPrincipal)
+	defer cancel()
+
+	caCert := getKey(t, testCAFilename)
+	sshServer := SSHServer{logger: log.CreateLogger(), caCert: caCert, getUserFunc: getMockUser}
+
+	userCert, ok := getKey(t, testUserCertFilename).(*gossh.Certificate)
+	require.True(t, ok)
+	assert.True(t, sshServer.shortLivedCertHandler(context, userCert))
+}
+
+func TestShortLivedCerts_CAsDontMatch(t *testing.T) {
+	context, cancel := newMockContext(validPrincipal)
+	defer cancel()
+
+	caCert := getKey(t, testOtherCAFilename)
+	sshServer := SSHServer{logger: logger, caCert: caCert, getUserFunc: getMockUser}
+
+	userCert, ok := getKey(t, testUserCertFilename).(*gossh.Certificate)
+	require.True(t, ok)
+	assert.False(t, sshServer.shortLivedCertHandler(context, userCert))
+	assert.Equal(t, "CA certificate does not match user certificate signer", hook.LastEntry().Message)
+}
+
+func TestShortLivedCerts_UserDoesNotExist(t *testing.T) {
+	context, cancel := newMockContext(validPrincipal)
+	defer cancel()
+
+	caCert := getKey(t, testCAFilename)
+	sshServer := SSHServer{logger: logger, caCert: caCert, getUserFunc: lookupUser}
+
+	userCert, ok := getKey(t, testUserCertFilename).(*gossh.Certificate)
+	require.True(t, ok)
+	assert.False(t, sshServer.shortLivedCertHandler(context, userCert))
+	assert.Contains(t, hook.LastEntry().Message, "Invalid user")
+}
+
+func TestShortLivedCerts_InvalidPrincipal(t *testing.T) {
+	context, cancel := newMockContext("notAUser")
+	defer cancel()
+
+	caCert := getKey(t, testCAFilename)
+	sshServer := SSHServer{logger: logger, caCert: caCert, getUserFunc: lookupUser}
+
+	userCert, ok := getKey(t, testUserCertFilename).(*gossh.Certificate)
+	require.True(t, ok)
+	assert.False(t, sshServer.shortLivedCertHandler(context, userCert))
+	assert.Contains(t, hook.LastEntry().Message, "not in the set of valid principals for given certificate")
+}
+
+func getMockUser(_ string) (*User, error) {
+	return &User{
+		Username: validPrincipal,
+		HomeDir:  testDir,
+	}, nil
+
+}
+
+func getKey(t *testing.T, filename string) ssh.PublicKey {
+	path := path.Join(testDir, filename)
+	bytes, err := ioutil.ReadFile(path)
+	require.Nil(t, err)
+	pubKey, _, _, _, err := ssh.ParseAuthorizedKey(bytes)
+	require.Nil(t, err)
+	return pubKey
+}
+
+type mockSSHContext struct {
+	context.Context
+	*sync.Mutex
+}
+
+func newMockContext(user string) (*mockSSHContext, context.CancelFunc) {
+	innerCtx, cancel := context.WithCancel(context.Background())
+	mockCtx := &mockSSHContext{innerCtx, &sync.Mutex{}}
+	mockCtx.SetValue("user", user)
+	return mockCtx, cancel
+}
+
+func (ctx *mockSSHContext) SetValue(key, value interface{}) {
+	ctx.Context = context.WithValue(ctx.Context, key, value)
+}
+
+func (ctx *mockSSHContext) User() string {
+	return ctx.Value("user").(string)
+}
+
+func (ctx *mockSSHContext) SessionID() string {
+	return ""
+}
+
+func (ctx *mockSSHContext) ClientVersion() string {
+	return ""
+}
+
+func (ctx *mockSSHContext) ServerVersion() string {
+	return ""
+}
+
+func (ctx *mockSSHContext) RemoteAddr() net.Addr {
+	return nil
+}
+
+func (ctx *mockSSHContext) LocalAddr() net.Addr {
+	return nil
+}
+
+func (ctx *mockSSHContext) Permissions() *ssh.Permissions {
+	return nil
+}
@@ -0,0 +1,226 @@
+// Taken from https://github.com/golang/go/blob/ad644d2e86bab85787879d41c2d2aebbd7c57db8/src/os/user/user.go
+// and modified to return login shell in User struct. cloudflared requires cgo for compilation because of this addition.
+
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build aix darwin dragonfly freebsd !android,linux netbsd openbsd solaris
+// +build cgo,!osusergo
+
+package sshserver
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"syscall"
+	"unsafe"
+)
+
+/*
+#cgo solaris CFLAGS: -D_POSIX_PTHREAD_SEMANTICS
+#include <unistd.h>
+#include <sys/types.h>
+#include <pwd.h>
+#include <grp.h>
+#include <stdlib.h>
+
+static int mygetpwuid_r(int uid, struct passwd *pwd,
+	char *buf, size_t buflen, struct passwd **result) {
+	return getpwuid_r(uid, pwd, buf, buflen, result);
+}
+
+static int mygetpwnam_r(const char *name, struct passwd *pwd,
+	char *buf, size_t buflen, struct passwd **result) {
+	return getpwnam_r(name, pwd, buf, buflen, result);
+}
+
+static int mygetgrgid_r(int gid, struct group *grp,
+	char *buf, size_t buflen, struct group **result) {
+ return getgrgid_r(gid, grp, buf, buflen, result);
+}
+
+static int mygetgrnam_r(const char *name, struct group *grp,
+	char *buf, size_t buflen, struct group **result) {
+ return getgrnam_r(name, grp, buf, buflen, result);
+}
+*/
+import "C"
+
+type UnknownUserIdError int
+
+func (e UnknownUserIdError) Error() string {
+	return "user: unknown userid " + strconv.Itoa(int(e))
+}
+
+// UnknownUserError is returned by Lookup when
+// a user cannot be found.
+type UnknownUserError string
+
+func (e UnknownUserError) Error() string {
+	return "user: unknown user " + string(e)
+}
+
+// UnknownGroupIdError is returned by LookupGroupId when
+// a group cannot be found.
+type UnknownGroupIdError string
+
+func (e UnknownGroupIdError) Error() string {
+	return "group: unknown groupid " + string(e)
+}
+
+// UnknownGroupError is returned by LookupGroup when
+// a group cannot be found.
+type UnknownGroupError string
+
+func (e UnknownGroupError) Error() string {
+	return "group: unknown group " + string(e)
+}
+
+type User struct {
+	// Uid is the user ID.
+	// On POSIX systems, this is a decimal number representing the uid.
+	// On Windows, this is a security identifier (SID) in a string format.
+	// On Plan 9, this is the contents of /dev/user.
+	Uid string
+	// Gid is the primary group ID.
+	// On POSIX systems, this is a decimal number representing the gid.
+	// On Windows, this is a SID in a string format.
+	// On Plan 9, this is the contents of /dev/user.
+	Gid string
+	// Username is the login name.
+	Username string
+	// Name is the user's real or display name.
+	// It might be blank.
+	// On POSIX systems, this is the first (or only) entry in the GECOS field
+	// list.
+	// On Windows, this is the user's display name.
+	// On Plan 9, this is the contents of /dev/user.
+	Name string
+	// HomeDir is the path to the user's home directory (if they have one).
+	HomeDir string
+
+	/****************** Begin added code ******************/
+	// Login shell
+	Shell string
+	/****************** End added code ******************/
+}
+
+func lookupUser(username string) (*User, error) {
+	var pwd C.struct_passwd
+	var result *C.struct_passwd
+	nameC := make([]byte, len(username)+1)
+	copy(nameC, username)
+
+	buf := alloc(userBuffer)
+	defer buf.free()
+
+	err := retryWithBuffer(buf, func() syscall.Errno {
+		// mygetpwnam_r is a wrapper around getpwnam_r to avoid
+		// passing a size_t to getpwnam_r, because for unknown
+		// reasons passing a size_t to getpwnam_r doesn't work on
+		// Solaris.
+		return syscall.Errno(C.mygetpwnam_r((*C.char)(unsafe.Pointer(&nameC[0])),
+			&pwd,
+			(*C.char)(buf.ptr),
+			C.size_t(buf.size),
+			&result))
+	})
+	if err != nil {
+		return nil, fmt.Errorf("user: lookup username %s: %v", username, err)
+	}
+	if result == nil {
+		return nil, UnknownUserError(username)
+	}
+	return buildUser(&pwd), err
+}
+
+func buildUser(pwd *C.struct_passwd) *User {
+	u := &User{
+		Uid:      strconv.FormatUint(uint64(pwd.pw_uid), 10),
+		Gid:      strconv.FormatUint(uint64(pwd.pw_gid), 10),
+		Username: C.GoString(pwd.pw_name),
+		Name:     C.GoString(pwd.pw_gecos),
+		HomeDir:  C.GoString(pwd.pw_dir),
+		/****************** Begin added code ******************/
+		Shell: C.GoString(pwd.pw_shell),
+		/****************** End added code ******************/
+	}
+	// The pw_gecos field isn't quite standardized. Some docs
+	// say: "It is expected to be a comma separated list of
+	// personal data where the first item is the full name of the
+	// user."
+	if i := strings.Index(u.Name, ","); i >= 0 {
+		u.Name = u.Name[:i]
+	}
+	return u
+}
+
+type bufferKind C.int
+
+const (
+	userBuffer = bufferKind(C._SC_GETPW_R_SIZE_MAX)
+)
+
+func (k bufferKind) initialSize() C.size_t {
+	sz := C.sysconf(C.int(k))
+	if sz == -1 {
+		// DragonFly and FreeBSD do not have _SC_GETPW_R_SIZE_MAX.
+		// Additionally, not all Linux systems have it, either. For
+		// example, the musl libc returns -1.
+		return 1024
+	}
+	if !isSizeReasonable(int64(sz)) {
+		// Truncate.  If this truly isn't enough, retryWithBuffer will error on the first run.
+		return maxBufferSize
+	}
+	return C.size_t(sz)
+}
+
+type memBuffer struct {
+	ptr  unsafe.Pointer
+	size C.size_t
+}
+
+func alloc(kind bufferKind) *memBuffer {
+	sz := kind.initialSize()
+	return &memBuffer{
+		ptr:  C.malloc(sz),
+		size: sz,
+	}
+}
+
+func (mb *memBuffer) resize(newSize C.size_t) {
+	mb.ptr = C.realloc(mb.ptr, newSize)
+	mb.size = newSize
+}
+
+func (mb *memBuffer) free() {
+	C.free(mb.ptr)
+}
+
+// retryWithBuffer repeatedly calls f(), increasing the size of the
+// buffer each time, until f succeeds, fails with a non-ERANGE error,
+// or the buffer exceeds a reasonable limit.
+func retryWithBuffer(buf *memBuffer, f func() syscall.Errno) error {
+	for {
+		errno := f()
+		if errno == 0 {
+			return nil
+		} else if errno != syscall.ERANGE {
+			return errno
+		}
+		newSize := buf.size * 2
+		if !isSizeReasonable(int64(newSize)) {
+			return fmt.Errorf("internal buffer exceeds %d bytes", maxBufferSize)
+		}
+		buf.resize(newSize)
+	}
+}
+
+const maxBufferSize = 1 << 20
+
+func isSizeReasonable(sz int64) bool {
+	return sz > 0 && sz <= maxBufferSize
+}
@@ -0,0 +1,110 @@
+//+build !windows
+
+package sshserver
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"github.com/gliderlabs/ssh"
+	"github.com/pkg/errors"
+)
+
+const (
+	rsaFilename   = "ssh_host_rsa_key"
+	ecdsaFilename = "ssh_host_ecdsa_key"
+)
+
+func (s *SSHServer) configureHostKeys() error {
+	if _, err := os.Stat(systemConfigPath); os.IsNotExist(err) {
+		if err := os.MkdirAll(systemConfigPath, 0755); err != nil {
+			return errors.Wrap(err, fmt.Sprintf("Error creating %s directory", systemConfigPath))
+		}
+	}
+
+	if err := s.configureHostKey(s.ensureECDSAKeyExists); err != nil {
+		return err
+	}
+
+	if err := s.configureHostKey(s.ensureRSAKeyExists); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *SSHServer) configureHostKey(keyFunc func() (string, error)) error {
+	path, err := keyFunc()
+	if err != nil {
+		return err
+	}
+
+	if err := s.SetOption(ssh.HostKeyFile(path)); err != nil {
+		return errors.Wrap(err, "Could not set SSH host key")
+	}
+	return nil
+}
+
+func (s *SSHServer) ensureRSAKeyExists() (string, error) {
+	keyPath := filepath.Join(systemConfigPath, rsaFilename)
+	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+		key, err := rsa.GenerateKey(rand.Reader, 2048)
+		if err != nil {
+			return "", errors.Wrap(err, "Error generating RSA host key")
+		}
+
+		privateKey := &pem.Block{
+			Type:  "RSA PRIVATE KEY",
+			Bytes: x509.MarshalPKCS1PrivateKey(key),
+		}
+
+		if err = writePrivateKey(keyPath, privateKey); err != nil {
+			return "", err
+		}
+
+		s.logger.Debug("Created new RSA SSH host key: ", keyPath)
+	}
+	return keyPath, nil
+}
+
+func (s *SSHServer) ensureECDSAKeyExists() (string, error) {
+	keyPath := filepath.Join(systemConfigPath, ecdsaFilename)
+	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		if err != nil {
+			return "", errors.Wrap(err, "Error generating ECDSA host key")
+		}
+
+		keyBytes, err := x509.MarshalECPrivateKey(key)
+		if err != nil {
+			return "", errors.Wrap(err, "Error marshalling ECDSA key")
+		}
+
+		privateKey := &pem.Block{
+			Type:  "EC PRIVATE KEY",
+			Bytes: keyBytes,
+		}
+
+		if err = writePrivateKey(keyPath, privateKey); err != nil {
+			return "", err
+		}
+
+		s.logger.Debug("Created new ECDSA SSH host key: ", keyPath)
+	}
+	return keyPath, nil
+}
+
+func writePrivateKey(keyPath string, privateKey *pem.Block) error {
+	if err := ioutil.WriteFile(keyPath, pem.EncodeToMemory(privateKey), 0600); err != nil {
+		return errors.Wrap(err, fmt.Sprintf("Error writing host key to %s", keyPath))
+	}
+	return nil
+}
@@ -0,0 +1,227 @@
+//+build !windows
+
+package sshserver
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"os/user"
+	"strconv"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"github.com/cloudflare/cloudflared/sshlog"
+
+	"github.com/creack/pty"
+	"github.com/gliderlabs/ssh"
+	"github.com/google/uuid"
+	"github.com/sirupsen/logrus"
+)
+
+type SSHServer struct {
+	ssh.Server
+	logger      *logrus.Logger
+	shutdownC   chan struct{}
+	caCert      ssh.PublicKey
+	getUserFunc func(string) (*User, error)
+	logManager  sshlog.Manager
+}
+
+func New(logManager sshlog.Manager, logger *logrus.Logger, address string, shutdownC chan struct{}, idleTimeout, maxTimeout time.Duration) (*SSHServer, error) {
+	currentUser, err := user.Current()
+	if err != nil {
+		return nil, err
+	}
+	if currentUser.Uid != "0" {
+		return nil, errors.New("cloudflared SSH server needs to run as root")
+	}
+
+	sshServer := SSHServer{
+		Server:      ssh.Server{Addr: address, MaxTimeout: maxTimeout, IdleTimeout: idleTimeout},
+		logger:      logger,
+		shutdownC:   shutdownC,
+		getUserFunc: lookupUser,
+		logManager:  logManager,
+	}
+
+	if err := sshServer.configureHostKeys(); err != nil {
+		return nil, err
+	}
+
+	sshServer.configureAuthentication()
+	return &sshServer, nil
+}
+
+func (s *SSHServer) Start() error {
+	s.logger.Infof("Starting SSH server at %s", s.Addr)
+
+	go func() {
+		<-s.shutdownC
+		if err := s.Close(); err != nil {
+			s.logger.WithError(err).Error("Cannot close SSH server")
+		}
+	}()
+
+	s.Handle(s.connectionHandler)
+	return s.ListenAndServe()
+}
+
+func (s *SSHServer) connectionHandler(session ssh.Session) {
+	sessionID, err := uuid.NewRandom()
+	if err != nil {
+		if _, err := io.WriteString(session, "Failed to generate session ID\n"); err != nil {
+			s.logger.WithError(err).Error("Failed to generate session ID: Failed to write to SSH session")
+		}
+		s.CloseSession(session)
+	}
+
+	// Get uid and gid of user attempting to login
+	sshUser, ok := session.Context().Value("sshUser").(*User)
+	if !ok || sshUser == nil {
+		s.logger.Error("Error retrieving credentials from session")
+		s.CloseSession(session)
+		return
+	}
+
+	uidInt, err := stringToUint32(sshUser.Uid)
+	if err != nil {
+		s.logger.WithError(err).Error("Invalid user")
+		s.CloseSession(session)
+		return
+	}
+	gidInt, err := stringToUint32(sshUser.Gid)
+	if err != nil {
+		s.logger.WithError(err).Error("Invalid user group")
+		s.CloseSession(session)
+		return
+	}
+
+	// Spawn shell under user
+	var cmd *exec.Cmd
+	if session.RawCommand() != "" {
+		cmd = exec.Command(sshUser.Shell, "-c", session.RawCommand())
+	} else {
+		cmd = exec.Command(sshUser.Shell)
+	}
+	// Supplementary groups are not explicitly specified. They seem to be inherited by default.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uidInt, Gid: gidInt}, Setsid: true}
+	cmd.Env = append(cmd.Env, session.Environ()...)
+	cmd.Env = append(cmd.Env, fmt.Sprintf("USER=%s", sshUser.Username))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("HOME=%s", sshUser.HomeDir))
+	cmd.Dir = sshUser.HomeDir
+
+	ptyReq, winCh, isPty := session.Pty()
+	var shellInput io.WriteCloser
+	var shellOutput io.ReadCloser
+
+	if isPty {
+		cmd.Env = append(cmd.Env, fmt.Sprintf("TERM=%s", ptyReq.Term))
+		shellInput, shellOutput, err = s.startPtySession(cmd, winCh)
+		if err != nil {
+			s.logger.WithError(err).Error("Failed to start pty session")
+			close(s.shutdownC)
+			return
+		}
+	} else {
+		shellInput, shellOutput, err = s.startNonPtySession(cmd)
+		if err != nil {
+			s.logger.WithError(err).Error("Failed to start non-pty session")
+			close(s.shutdownC)
+			return
+		}
+	}
+
+	// Write incoming commands to shell
+	go func() {
+		if _, err := io.Copy(shellInput, session); err != nil {
+			s.logger.WithError(err).Error("Failed to write incoming command to pty")
+		}
+	}()
+
+	pr, pw := io.Pipe()
+	defer pr.Close()
+	defer pw.Close()
+
+	logger, err := s.logManager.NewLogger(fmt.Sprintf("%s-session.log", sessionID), s.logger)
+	if err != nil {
+		if _, err := io.WriteString(session, "Failed to create log\n"); err != nil {
+			s.logger.WithError(err).Error("Failed to create log: Failed to write to SSH session")
+		}
+		s.CloseSession(session)
+	}
+	defer logger.Close()
+	go func() {
+		io.Copy(logger, pr)
+	}()
+
+	// Write outgoing command output to both the command recorder, and remote user
+	mw := io.MultiWriter(pw, session)
+	if _, err := io.Copy(mw, shellOutput); err != nil {
+		s.logger.WithError(err).Error("Failed to write command output to user")
+	}
+
+	// Wait for all resources associated with cmd to be released
+	// Returns error if shell exited with a non-zero status or received a signal
+	if err := cmd.Wait(); err != nil {
+		s.logger.WithError(err).Debug("Shell did not close correctly")
+	}
+}
+
+func (s *SSHServer) CloseSession(session ssh.Session) {
+	if err := session.Exit(1); err != nil {
+		s.logger.WithError(err).Error("Failed to close SSH session")
+	}
+}
+
+func (s *SSHServer) startNonPtySession(cmd *exec.Cmd) (io.WriteCloser, io.ReadCloser, error) {
+	in, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, nil, err
+	}
+	out, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, nil, err
+	}
+	cmd.Stderr = cmd.Stdout
+	if err = cmd.Start(); err != nil {
+		return nil, nil, err
+	}
+	return in, out, nil
+}
+
+func (s *SSHServer) startPtySession(cmd *exec.Cmd, winCh <-chan ssh.Window) (io.WriteCloser, io.ReadCloser, error) {
+	tty, err := pty.Start(cmd)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Handle terminal window size changes
+	go func() {
+		for win := range winCh {
+			if errNo := setWinsize(tty, win.Width, win.Height); errNo != 0 {
+				s.logger.WithError(err).Error("Failed to set pty window size")
+				close(s.shutdownC)
+				return
+			}
+		}
+	}()
+
+	return tty, tty, nil
+}
+
+// Sets PTY window size for terminal
+func setWinsize(f *os.File, w, h int) syscall.Errno {
+	_, _, errNo := syscall.Syscall(syscall.SYS_IOCTL, f.Fd(), uintptr(syscall.TIOCSWINSZ),
+		uintptr(unsafe.Pointer(&struct{ h, w, x, y uint16 }{uint16(h), uint16(w), 0, 0})))
+	return errNo
+}
+
+func stringToUint32(str string) (uint32, error) {
+	uid, err := strconv.ParseUint(str, 10, 32)
+	return uint32(uid), err
+
+}
@@ -0,0 +1,22 @@
+//+build windows
+
+package sshserver
+
+import (
+	"errors"
+
+	"time"
+
+	"github.com/cloudflare/cloudflared/sshlog"
+	"github.com/sirupsen/logrus"
+)
+
+type SSHServer struct{}
+
+func New(_ sshlog.Manager, _ *logrus.Logger, _ string, _ chan struct{}, _, _ time.Duration) (*SSHServer, error) {
+	return nil, errors.New("cloudflared ssh server is not supported on windows")
+}
+
+func (s *SSHServer) Start() error {
+	return errors.New("cloudflared ssh server is not supported on windows")
+}
@@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEA0c6EklYvC9B041qEGWDNuot6G4tTVm9LCQC0vA+v2n25ru9CINV6
+8IljmXBORXBwfG6PdLhg0SEabZUbsNX5WrIVbGovcghKS6GRsqI5+Quhm+o8eG042JE/hB
+oYdZ19TcMEyPOGzHsx0U/BSN9ZJWVCxqN51iI6qyhz9f6jlX2LQBFEvXlhxgF3owBEf8UC
+Zt/UvbZdmeeyKNQElPmiVLIJEAPCueECp7a2mjCiP3zqjDvSeeGk4CelB/1qZZ4V2n7fvb
+HZjAB5JJs4KXs5o8KgvQnqgQMxiLFZ4PATt4+mxEzh4JymppbqJOo2rYwOA3TAIEWWtYRV
+/ZKJ0AyhhQAAA8gciO8XHIjvFwAAAAdzc2gtcnNhAAABAQDRzoSSVi8L0HTjWoQZYM26i3
+obi1NWb0sJALS8D6/afbmu70Ig1XrwiWOZcE5FcHB8bo90uGDRIRptlRuw1flashVsai9y
+CEpLoZGyojn5C6Gb6jx4bTjYkT+EGhh1nX1NwwTI84bMezHRT8FI31klZULGo3nWIjqrKH
+P1/qOVfYtAEUS9eWHGAXejAER/xQJm39S9tl2Z57Io1ASU+aJUsgkQA8K54QKntraaMKI/
+fOqMO9J54aTgJ6UH/WplnhXaft+9sdmMAHkkmzgpezmjwqC9CeqBAzGIsVng8BO3j6bETO
+HgnKamluok6jatjA4DdMAgRZa1hFX9konQDKGFAAAAAwEAAQAAAQEApVzGdKhk8ETevAst
+rurze6JPHcKUbr3NQE1EJi2fBvCtF0oQrtxTx54h2GAB8Q0MO6bQfsiL1ojm0ZQCfUBJBs
+jxxb9zoccS98Vilo7ybm5SdBcMjkZX1am1jCMdQCZfCpk4/kGi7yvyOe1IhG01UBodpX5X
+mwTjhN+fdjW7LSiW6cKPClN49CZKgmtvI27FCt+/TtMzdCXOiJxJ4yZCzCRhSgssV0gWI1
+0VJr/MHirKUvv/qCLAuOBxIr9UgdduRZUpNX+KS2rfhFEbjnUqc/57aAakpQmuPB5I+s9G
+DnrF0HSHpq7u1XC1SvYlnFBN/0A7Hw/MX2SaBFH7mc9AAQAAAIAFuTHr6O8tCvWEawfxC0
+qiAPQ+Yy1vthq5uewmuQujMutUnc9JAUl32PdU1DbS7APC1Dg9XL7SyAB6A+ZpRJRAKgCY
+SneAKE6hOytH+yM206aekrz6VuZiSpBqpfEqDibVAaZIO8sv/9dtZd6kWemxNErPQoKJey
+Z7/cuWUWQovAAAAIEA6ugIlVj1irPmElyCCt5YfPv2x8Dl54ELoP/WsffsrPHNQog64hFd
+ahD7Wq63TA566bN85fkx8OVU5TbbEQmkHgOEV6nDRY2YsBSqIOblA/KehtfdUIqZB0iNBh
+Gn6TV/z6HwnSR3gKv4b66Gveek6LfRAG3mbsLCgyRAbYgn6YUAAACBAOSlf+n1eh6yjtvF
+Zecq3Zslj7O8cUs17PQx4vQ7sXNCFrIZdevWPIn9sVrt7/hsTrXunDz6eXCeclB35KZe3H
+WPVjRoD+xnr5+sXx2qXOnKCR0LdFybso6IR5bXAI6DNSNfP7D9LPEQ+R73Jk0jPuLYzocS
+iM89KZiuGpzr01gBAAAAEW1pa2VAQzAyWTUwVEdKR0g4AQ==
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRzoSSVi8L0HTjWoQZYM26i3obi1NWb0sJALS8D6/afbmu70Ig1XrwiWOZcE5FcHB8bo90uGDRIRptlRuw1flashVsai9yCEpLoZGyojn5C6Gb6jx4bTjYkT+EGhh1nX1NwwTI84bMezHRT8FI31klZULGo3nWIjqrKHP1/qOVfYtAEUS9eWHGAXejAER/xQJm39S9tl2Z57Io1ASU+aJUsgkQA8K54QKntraaMKI/fOqMO9J54aTgJ6UH/WplnhXaft+9sdmMAHkkmzgpezmjwqC9CeqBAzGIsVng8BO3j6bETOHgnKamluok6jatjA4DdMAgRZa1hFX9konQDKGF mike@C02Y50TGJGH8
@@ -0,0 +1,49 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAgEA60Kneo87qPsh+zErWFl7vx93c7fyTxbZ9lUNqafgXy/BLOCc/nQS
+McosVSLsQrbHlhYzfmZEhTiubmuYUrHchmsn1ml1HIqP8T5aDgtNbLqYnS4H5oO4Sj1+XH
+lQtU7n7zHXgca9SnMWt1Fhkx1mvkeiOKs0eq7hV2TuIZxfmbYfIVvJGwrL0uWzbSEE1gvx
+gTXZHxEChIQyrNviljgi4u2MD/cIi6KMeYUnaTL1FxO9G4GIFiy7ueHRwOZPIFHgYm+Vrt
+X7XafSF0///zCrC63zzWt/6A06hFepOz2VXvm7SdckaR7qMXAb7kipsc0+dKk9ggU7Fqpx
+ZY5cVeZo9RlRVhRXGDy7mABA/FMwvv+qYCgJ3nlZbdKbaiPLQu8ScTlJ9sMI06/ZiEY04b
+meZ0ASM52gaDGjrFbbnuHNf5XV/oreEUhtCrryFnoIxmKgHznGjZ55q77FtTHnrAKFmKFP
+11s3MLIX9o4RgtriOtl4KenkIfUumgtrwY/UGjOaOQUOrVH1am54wkUiVEF0Qd3AD8KCl/
+l/xT5+t6cOspZ9GIhwa2NBmRjN/wVGp+Yrb08Re3kxPCX9bs5iLe+kHN0vuFr7RDo+eUoi
+SPhWl6FUqx2W9NZqekmEgKn3oKrfbGaMH1VLkaKWlzQ4xJzP0iadQbIXGryLEYASydemZt
+sAAAdQ/ovjxf6L48UAAAAHc3NoLXJzYQAAAgEA60Kneo87qPsh+zErWFl7vx93c7fyTxbZ
+9lUNqafgXy/BLOCc/nQSMcosVSLsQrbHlhYzfmZEhTiubmuYUrHchmsn1ml1HIqP8T5aDg
+tNbLqYnS4H5oO4Sj1+XHlQtU7n7zHXgca9SnMWt1Fhkx1mvkeiOKs0eq7hV2TuIZxfmbYf
+IVvJGwrL0uWzbSEE1gvxgTXZHxEChIQyrNviljgi4u2MD/cIi6KMeYUnaTL1FxO9G4GIFi
+y7ueHRwOZPIFHgYm+VrtX7XafSF0///zCrC63zzWt/6A06hFepOz2VXvm7SdckaR7qMXAb
+7kipsc0+dKk9ggU7FqpxZY5cVeZo9RlRVhRXGDy7mABA/FMwvv+qYCgJ3nlZbdKbaiPLQu
+8ScTlJ9sMI06/ZiEY04bmeZ0ASM52gaDGjrFbbnuHNf5XV/oreEUhtCrryFnoIxmKgHznG
+jZ55q77FtTHnrAKFmKFP11s3MLIX9o4RgtriOtl4KenkIfUumgtrwY/UGjOaOQUOrVH1am
+54wkUiVEF0Qd3AD8KCl/l/xT5+t6cOspZ9GIhwa2NBmRjN/wVGp+Yrb08Re3kxPCX9bs5i
+Le+kHN0vuFr7RDo+eUoiSPhWl6FUqx2W9NZqekmEgKn3oKrfbGaMH1VLkaKWlzQ4xJzP0i
+adQbIXGryLEYASydemZtsAAAADAQABAAACABUYzBYEhDAaHSj+dsmcdKll8/tPko4fGXqq
+k+gT4t4GVUdl+Q4kcIFAhQs5b4BoDava39FE8H4V4CaMxYMc6g6vy0nB+TuO/Wt/0OmTf+
+TxMsBdoV29kCgwLYWzZ1Zq9geQK6g6nzzu5ymXRa3ApDcKC3UTfUhHKHQC3AvtjvEk0NPX
+/EfNhwuph5aQsHNVbNnOb2MGznf9tuGjckVQUWiSLs47s+t5rykylJ8tb6cbIQk3a3G5nz
+gDFSE8Rfo6/Wk2YnDkRX9XjlKC3Q0QWzZX6hYQvs6baRT3G3jxg9SZhn8PqPc4S34VdJvA
+rl8AbcpeZuKi/3J/5F1cD9GwMNcl4gM87piF20/r9mMvC4zBAEgyF8WBi4OjSu0+ccsEsb
+GSpxKK04OPTB7p8mLJ8hQUiREg5OuPEEcAoDSuHgdliE7nDHzuImbpTcAZcWhkJaUdBWI6
+qcnGPARzxAOmuzkY8Gq0MtcWge5QxnLWJyrfy43M984Cvxql/maLUij4eTbMDDwV7Qx30V
+P2tJp5+hOnitRwB6cQIg5N7/cTQdJ6eiFYuw0v3IfHjYmaolY8F3u38Zv2PPk50CorPRDG
+esx0a9Elm2UKPb145MtHGZtLH2mayRnDjnxr25iLwgokI06tCLCNvbkYLA7wVpJn81eKmZ
+tQBtbfqBSiDiLjCrehAAABAQDh8vmgPR95Kx1DeBxzMSja7TStP5V58JcUvLP4dAN6zqtt
+rMuKDfJRSIVYGkU8vXlME5E6phWP7R5lYY7+kLDbeZrYQg1AxkK8y4fUYkCLBuEcCjzWDK
+oqZQNskk4urbCdBIP6AR7d/LMCHBb9rk2iOuUeos6JHRKbPGP1lvH3hLkbH9CA0F41sz86
+JFg6u/XaRQ2CyhS7y7SQ8dmaANGz9LGdIRqIoZ8Hfht8t1VRbM9fzSb3xoxUItbHpk9R9g
+GZsHSryi7AtRmHt0uBrWIv6RbIY0epCbjdCLvHflbkPgwBM7UndgkOSIwQ4SQF8Fs+e9/r
+hV05h0Y81vd1RZvOAAABAQD5EgW3SpmYzeMmiP7MKkfIlbZtwVmRu4anTzWxlk5pJ9GXnC
+QoInULCipWAOeJbuLIgRWLU4VzhOUbYLNKQPXECARfgoto2VXoXZZ2q2O4aXaCpeyU6nE8
+VKbp4nU1jEg5hWB3PRwZ8Pzs4A93/9mrpVzLmCT+LW9Rlnp6tTpqcUKGugg8vr64SSgqnV
+ZFyQgHgw+ZGOG9w714urS3U97WNTeHXAs0p2YBOu5XW3JQ3jkRo7YyZF3+TtBxbgfHRZfH
+O2mFcMBD3Sn4t+LAbgnLye3S2/WZf/gQwdVB7BgrVqguzQ2hGoOxNiwadkIDsxb6r/u3n6
+2lScpHFDS0WnpRAAABAQDxzkV52VX6wAWkQe/2KFH9wTG0XFANmZUnnTPR8wd+b9E7HIr0
+Mdd8iAHOhLRvTy8mih53GGBptXK7GdABMZtkqDErbXhuC8xbi9uRLEHiRe/oBfWr8vYIZY
+awiw3/EqxaTv0HBMicdr2S31Bs2/mjrVuJH0wAaI9ueQnZizzjgWuzeNZMWq1qk0akUUdm
+PDVd58yBkt8lKlkOG0LJAn6JEG9oH9XiTFShHzu1dQmoC2bKVHdxL8WCcYFVtmyoMRcLZq
+u6d4nyKha02cYZB5hM3VcizJI5HY/A+H3fBkRR0hXgkU5R89w+8x9VSJkNVx+JGC7ziK4a
+kUjfOmR5WBdrAAAAE3Rlc3RAY2xvdWRmbGFyZS5jb20BAgMEBQYH
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgOsuFqKdzp/nC3wQfKVJBdHa8axtGryKplPkDjdSXT4kAAAADAQABAAACAQDrQqd6jzuo+yH7MStYWXu/H3dzt/JPFtn2VQ2pp+BfL8Es4Jz+dBIxyixVIuxCtseWFjN+ZkSFOK5ua5hSsdyGayfWaXUcio/xPloOC01supidLgfmg7hKPX5ceVC1TufvMdeBxr1Kcxa3UWGTHWa+R6I4qzR6ruFXZO4hnF+Zth8hW8kbCsvS5bNtIQTWC/GBNdkfEQKEhDKs2+KWOCLi7YwP9wiLoox5hSdpMvUXE70bgYgWLLu54dHA5k8gUeBib5Wu1ftdp9IXT///MKsLrfPNa3/oDTqEV6k7PZVe+btJ1yRpHuoxcBvuSKmxzT50qT2CBTsWqnFljlxV5mj1GVFWFFcYPLuYAED8UzC+/6pgKAneeVlt0ptqI8tC7xJxOUn2wwjTr9mIRjThuZ5nQBIznaBoMaOsVtue4c1/ldX+it4RSG0KuvIWegjGYqAfOcaNnnmrvsW1MeesAoWYoU/XWzcwshf2jhGC2uI62Xgp6eQh9S6aC2vBj9QaM5o5BQ6tUfVqbnjCRSJUQXRB3cAPwoKX+X/FPn63pw6yln0YiHBrY0GZGM3/BUan5itvTxF7eTE8Jf1uzmIt76Qc3S+4WvtEOj55SiJI+FaXoVSrHZb01mp6SYSAqfegqt9sZowfVUuRopaXNDjEnM/SJp1BshcavIsRgBLJ16Zm2wAAAAAAAAAAAAAAAQAAAA10ZXN0VXNlckB0ZXN0AAAADAAAAAh0ZXN0VXNlcgAAAAAAAAAA//////////8AAAAAAAAAggAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAF3Blcm1pdC1hZ2VudC1mb3J3YXJkaW5nAAAAAAAAABZwZXJtaXQtcG9ydC1mb3J3YXJkaW5nAAAAAAAAAApwZXJtaXQtcHR5AAAAAAAAAA5wZXJtaXQtdXNlci1yYwAAAAAAAAAAAAABFwAAAAdzc2gtcnNhAAAAAwEAAQAAAQEA0c6EklYvC9B041qEGWDNuot6G4tTVm9LCQC0vA+v2n25ru9CINV68IljmXBORXBwfG6PdLhg0SEabZUbsNX5WrIVbGovcghKS6GRsqI5+Quhm+o8eG042JE/hBoYdZ19TcMEyPOGzHsx0U/BSN9ZJWVCxqN51iI6qyhz9f6jlX2LQBFEvXlhxgF3owBEf8UCZt/UvbZdmeeyKNQElPmiVLIJEAPCueECp7a2mjCiP3zqjDvSeeGk4CelB/1qZZ4V2n7fvbHZjAB5JJs4KXs5o8KgvQnqgQMxiLFZ4PATt4+mxEzh4JymppbqJOo2rYwOA3TAIEWWtYRV/ZKJ0AyhhQAAAQ8AAAAHc3NoLXJzYQAAAQC2lL+6JYTGOdz1zNnck6onrFcVpO2onCVAKP8HdLoCeH0/upIugaCocPKuzoURYEfiHQotviNeprE/2CyAroJ5VBdqWftEeHn3FFvBCQ1gwRQ7oci4C5n72t0vjWWE6WBylS0RqpJjr6EQ8a1vuwIqAQrEJPp2yNLjRH2WD7eicBh5f43VKOMr73DtyTh4xoF0C2sNBROudt58npTaYqRHQgoI25V/aCmuYBgM3wdAGcoEZGoSerMfhID7GcWkvemq2hF8mQsspG3zgnyQXk+ahagmefzxutDnr3KdrZ637La0/XwABvBZ9L4l5RiEilVI1Shl96F2qbBW2YZ64pUQ test@cloudflare.com
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDrQqd6jzuo+yH7MStYWXu/H3dzt/JPFtn2VQ2pp+BfL8Es4Jz+dBIxyixVIuxCtseWFjN+ZkSFOK5ua5hSsdyGayfWaXUcio/xPloOC01supidLgfmg7hKPX5ceVC1TufvMdeBxr1Kcxa3UWGTHWa+R6I4qzR6ruFXZO4hnF+Zth8hW8kbCsvS5bNtIQTWC/GBNdkfEQKEhDKs2+KWOCLi7YwP9wiLoox5hSdpMvUXE70bgYgWLLu54dHA5k8gUeBib5Wu1ftdp9IXT///MKsLrfPNa3/oDTqEV6k7PZVe+btJ1yRpHuoxcBvuSKmxzT50qT2CBTsWqnFljlxV5mj1GVFWFFcYPLuYAED8UzC+/6pgKAneeVlt0ptqI8tC7xJxOUn2wwjTr9mIRjThuZ5nQBIznaBoMaOsVtue4c1/ldX+it4RSG0KuvIWegjGYqAfOcaNnnmrvsW1MeesAoWYoU/XWzcwshf2jhGC2uI62Xgp6eQh9S6aC2vBj9QaM5o5BQ6tUfVqbnjCRSJUQXRB3cAPwoKX+X/FPn63pw6yln0YiHBrY0GZGM3/BUan5itvTxF7eTE8Jf1uzmIt76Qc3S+4WvtEOj55SiJI+FaXoVSrHZb01mp6SYSAqfegqt9sZowfVUuRopaXNDjEnM/SJp1BshcavIsRgBLJ16Zm2w== test@cloudflare.com
@@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEAzBO7TXxbpk7sGQm/Wa29N/NFe5uuoEQGC5hxfihmcvVgeKeNKiSS
+snxzCE1Y6SmNMoE4aQs92wtcn48GmxRwZSXbCqLq2CJrHfe9B2k3aPkJZpQkFMshcJGo7p
+G0Vlo7dWAbYf99/YKddf290uLK7vxw9ty0pM1hXSXHNShv1b+bTQm/COMZ5jNsncjc1yBH
+KGkFVHee9Dh4Z0xLlHipIyyNXXzI0RFYuHSNJz9GD310XQLIIroptr7+/7g6+sPPGsNlI+
+95OScba1/PQ2b/qy+KyIwNIMSd9ziJy5xnO7Vo3LrqQrza1Pkn2i29PljUcbc/F0hhXNIq
+ITdNWwVqsQAAA8iKllTIipZUyAAAAAdzc2gtcnNhAAABAQDME7tNfFumTuwZCb9Zrb0380
+V7m66gRAYLmHF+KGZy9WB4p40qJJKyfHMITVjpKY0ygThpCz3bC1yfjwabFHBlJdsKourY
+Imsd970HaTdo+QlmlCQUyyFwkajukbRWWjt1YBth/339gp11/b3S4sru/HD23LSkzWFdJc
+c1KG/Vv5tNCb8I4xnmM2ydyNzXIEcoaQVUd570OHhnTEuUeKkjLI1dfMjREVi4dI0nP0YP
+fXRdAsgiuim2vv7/uDr6w88aw2Uj73k5JxtrX89DZv+rL4rIjA0gxJ33OInLnGc7tWjcuu
+pCvNrU+SfaLb0+WNRxtz8XSGFc0iohN01bBWqxAAAAAwEAAQAAAQAKEtNFEOVpQS4QUlXa
+tGPJtj1wy4+EI7d0rRK1GoNsG0amzgZ+1Q1UuCXpe//uinmIy64gKUjlXhs1WRcHYqvlok
+e8r6wN/Szybr8q9Xuht+FJ6fgZ+qjs6JPBKvoO5SdYNOVFIhpzABaLs3nCRiWkRFvDI8Pa
+rRap7m8mwFiOJtmdiIZYFxzw6xXwTsGCrWPKgTv3FKGZzXnCB9i7jC2vwT1MDYbcnzEH4
+Ba4dxI8bp6WWEX0biRIXj3jCtLb5gisNTSxdZs254Syh75HEXunSh2YO+yVSWQtZj19ewW
+6Rb1Z3x5rVfXcgSkg7gZd9EpbckIIg6+MFSH3wdGW6atAAAAgQDFXiMuNd4ZYwdyhjlM5n
+nFqQDXGgnwyNdiIqAapoqTdF5aZwNnbTU0fCFaDMLCQAHgntcgCEsW9A4HzDzYhOABKElv
+j973vXWF165wFiZwuKSfroq/6JH6CiIcjiqpszbnqSOzy1hq913RWILS6e9yMjxRv8PUjm
+E+IkcnfcFUwAAAAIEA+jwI3ICe8PGEIezV2tvQFeQy2Z2wGslu1yvqfTYEztSmtygns3wn
+ZBb+cBXCnpqUCtznG7hZhq7I4m1I47BYznULwwFiBTVtBASG5wNP7zeVKTVZ4SKprze+Fe
+I/nUZDJ5Q26um7eDbhvZ/n95GY+fucMVHoSBfX1wE16XBfp88AAACBANDHcgC4qP2oyOw/
+p9HineMQd/ppG3fePe07jyZXLHLf0rByFveFgRAQ1m77O7FtP3fFKy3Y9nNy18LGq35ZK
+Blsz2B23bO8NuffgAhchDG7KzKFXCo+AraIj5znp/znK5zIkaiiSOQaYywJ36EooYVpRtj
+ep5ap6bBFDZ2e+V/AAAAEW1pa2VAQzAyWTUwVEdKR0g4AQ==
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDME7tNfFumTuwZCb9Zrb0380V7m66gRAYLmHF+KGZy9WB4p40qJJKyfHMITVjpKY0ygThpCz3bC1yfjwabFHBlJdsKourYImsd970HaTdo+QlmlCQUyyFwkajukbRWWjt1YBth/339gp11/b3S4sru/HD23LSkzWFdJcc1KG/Vv5tNCb8I4xnmM2ydyNzXIEcoaQVUd570OHhnTEuUeKkjLI1dfMjREVi4dI0nP0YPfXRdAsgiuim2vv7/uDr6w88aw2Uj73k5JxtrX89DZv+rL4rIjA0gxJ33OInLnGc7tWjcuupCvNrU+SfaLb0+WNRxtz8XSGFc0iohN01bBWqx mike@C02Y50TGJGH8
@@ -45,13 +45,16 @@ func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
 			// Otherwise the host header will be based on the origin URL
 			h1.Host = header.Value
 		case ":path":
-			// Separate the path and the (optional) query from each other
-			chunks := strings.SplitN(header.Value, "?", 2)
-
-			h1.URL.Path = chunks[0]
-			if len(chunks) > 1 {
-				h1.URL.RawQuery = chunks[1]
+			u, err := url.Parse(header.Value)
+			if err != nil {
+				return fmt.Errorf("unparseable path")
 			}
+			resolved := h1.URL.ResolveReference(u)
+			// prevent escaping base URL
+			if !strings.HasPrefix(resolved.String(), h1.URL.String()) {
+				return fmt.Errorf("invalid path")
+			}
+			h1.URL = resolved
 		case "content-length":
 			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
 			if err != nil {
@@ -1,104 +0,0 @@
-package streamhandler
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/cloudflare/cloudflared/h2mux"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]h2mux.Header{
-			h2mux.Header{
-				Name:  "Mock header 1",
-				Value: "Mock value 1",
-			},
-			h2mux.Header{
-				Name:  "Mock header 2",
-				Value: "Mock value 2",
-			},
-		},
-		request,
-	)
-
-	assert.Equal(t, http.Header{
-		"Mock header 1": []string{"Mock value 1"},
-		"Mock header 2": []string{"Mock value 2"},
-	}, request.Header)
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]h2mux.Header{},
-		request,
-	)
-
-	assert.Equal(t, http.Header{}, request.Header)
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]h2mux.Header{
-			h2mux.Header{
-				Name:  ":path",
-				Value: "//bad_path/",
-			},
-			h2mux.Header{
-				Name:  "Mock header",
-				Value: "Mock value",
-			},
-		},
-		request,
-	)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]h2mux.Header{
-			h2mux.Header{
-				Name:  ":path",
-				Value: "/?query",
-			},
-			h2mux.Header{
-				Name:  "Mock header",
-				Value: "Mock value",
-			},
-		},
-		request,
-	)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/?query", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
@@ -82,9 +82,16 @@ func (s *StreamHandler) UseConfiguration(ctx context.Context, config *pogs.Clien

 // UpdateConfig replaces current originmapper mapping with mappings from newConfig
 func (s *StreamHandler) UpdateConfig(newConfig []*pogs.ReverseProxyConfig) (failedConfigs []*pogs.FailedConfig) {
-	// TODO: TUN-1968: Gracefully apply new config
-	s.tunnelHostnameMapper.DeleteAll()
-	for _, tunnelConfig := range newConfig {
+
+	// Delete old configs that aren't in the `newConfig`
+	toRemove := s.tunnelHostnameMapper.ToRemove(newConfig)
+	for _, hostnameToRemove := range toRemove {
+		s.tunnelHostnameMapper.Delete(hostnameToRemove)
+	}
+
+	// Add new configs that weren't in the old mapper
+	toAdd := s.tunnelHostnameMapper.ToAdd(newConfig)
+	for _, tunnelConfig := range toAdd {
 		tunnelHostname := tunnelConfig.TunnelHostname
 		originSerice, err := tunnelConfig.OriginConfigJSONHandler.OriginConfig.Service()
 		if err != nil {
@@ -5,6 +5,7 @@ import (

 	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/originservice"
+	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )

 // TunnelHostnameMapper maps TunnelHostname to an OriginService
@@ -38,12 +39,55 @@ func (om *TunnelHostnameMapper) Add(key h2mux.TunnelHostname, os originservice.O
 	om.tunnelHostnameToOrigin[key] = os
 }

-// DeleteAll mappings, and shutdown all OriginService
-func (om *TunnelHostnameMapper) DeleteAll() {
+// Delete a mapping, and shutdown its OriginService
+func (om *TunnelHostnameMapper) Delete(key h2mux.TunnelHostname) (keyFound bool) {
 	om.Lock()
 	defer om.Unlock()
-	for key, os := range om.tunnelHostnameToOrigin {
+	if os, ok := om.tunnelHostnameToOrigin[key]; ok {
 		os.Shutdown()
 		delete(om.tunnelHostnameToOrigin, key)
+		return true
 	}
+	return false
+}
+
+// ToRemove finds all keys that should be removed from the TunnelHostnameMapper.
+func (om *TunnelHostnameMapper) ToRemove(newConfigs []*pogs.ReverseProxyConfig) (toRemove []h2mux.TunnelHostname) {
+	om.Lock()
+	defer om.Unlock()
+
+	// Convert into a set, for O(1) lookups instead of O(n)
+	newConfigSet := toSet(newConfigs)
+
+	// If a config in `om` isn't in `newConfigs`, it must be removed.
+	for hostname := range om.tunnelHostnameToOrigin {
+		if _, ok := newConfigSet[hostname]; !ok {
+			toRemove = append(toRemove, hostname)
+		}
+	}
+
+	return
+}
+
+// ToAdd filters the given configs, keeping those that should be added to the TunnelHostnameMapper.
+func (om *TunnelHostnameMapper) ToAdd(newConfigs []*pogs.ReverseProxyConfig) (toAdd []*pogs.ReverseProxyConfig) {
+	om.Lock()
+	defer om.Unlock()
+
+	// If a config in `newConfigs` isn't in `om`, it must be added.
+	for _, config := range newConfigs {
+		if _, ok := om.tunnelHostnameToOrigin[config.TunnelHostname]; !ok {
+			toAdd = append(toAdd, config)
+		}
+	}
+
+	return
+}
+
+func toSet(configs []*pogs.ReverseProxyConfig) map[h2mux.TunnelHostname]*pogs.ReverseProxyConfig {
+	m := make(map[h2mux.TunnelHostname]*pogs.ReverseProxyConfig)
+	for _, config := range configs {
+		m[config.TunnelHostname] = config
+	}
+	return m
 }
@@ -4,11 +4,14 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"reflect"
 	"sync"
 	"testing"
+	"time"

 	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/originservice"
+	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/stretchr/testify/assert"
 )

@@ -52,9 +55,6 @@ func TestTunnelHostnameMapperConcurrentAccess(t *testing.T) {
 		assert.True(t, ok)
 		assert.Equal(t, secondHTTPOS, os)
 	})
-
-	thm.DeleteAll()
-	assert.Empty(t, thm.tunnelHostnameToOrigin)
 }

 func concurrentOps(t *testing.T, f func(i int)) {
@@ -72,3 +72,141 @@ func concurrentOps(t *testing.T, f func(i int)) {
 func tunnelHostname(i int) h2mux.TunnelHostname {
 	return h2mux.TunnelHostname(fmt.Sprintf("%d.cftunnel.com", i))
 }
+
+func Test_toSet(t *testing.T) {
+
+	type args struct {
+		configs []*pogs.ReverseProxyConfig
+	}
+	tests := []struct {
+		name string
+		args args
+		want map[h2mux.TunnelHostname]*pogs.ReverseProxyConfig
+	}{
+		{
+			name: "empty slice should yield empty map",
+			args: args{},
+			want: map[h2mux.TunnelHostname]*pogs.ReverseProxyConfig{},
+		},
+		{
+			name: "multiple elements",
+			args: args{[]*pogs.ReverseProxyConfig{sampleConfig1(), sampleConfig2()}},
+			want: map[h2mux.TunnelHostname]*pogs.ReverseProxyConfig{
+				"mock.example.com":  sampleConfig1(),
+				"mock2.example.com": sampleConfig2(),
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := toSet(tt.args.configs); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("toSet() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestTunnelHostnameMapper_ToAdd(t *testing.T) {
+	type fields struct {
+		tunnelHostnameToOrigin map[h2mux.TunnelHostname]originservice.OriginService
+	}
+	type args struct {
+		newConfigs []*pogs.ReverseProxyConfig
+	}
+	tests := []struct {
+		name      string
+		fields    fields
+		args      args
+		wantToAdd []*pogs.ReverseProxyConfig
+	}{
+		{
+			name: "Mapper={}, NewConfig={}, toAdd={}",
+		},
+		{
+			name:      "Mapper={}, NewConfig={x}, toAdd={x}",
+			args:      args{newConfigs: []*pogs.ReverseProxyConfig{sampleConfig1()}},
+			wantToAdd: []*pogs.ReverseProxyConfig{sampleConfig1()},
+		},
+		{
+			name:      "Mapper={x}, NewConfig={x,y}, toAdd={y}",
+			args:      args{newConfigs: []*pogs.ReverseProxyConfig{sampleConfig2()}},
+			wantToAdd: []*pogs.ReverseProxyConfig{sampleConfig2()},
+			fields: fields{tunnelHostnameToOrigin: map[h2mux.TunnelHostname]originservice.OriginService{
+				h2mux.TunnelHostname(sampleConfig1().TunnelHostname): &originservice.HelloWorldService{},
+			}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			om := &TunnelHostnameMapper{
+				tunnelHostnameToOrigin: tt.fields.tunnelHostnameToOrigin,
+			}
+			if gotToAdd := om.ToAdd(tt.args.newConfigs); !reflect.DeepEqual(gotToAdd, tt.wantToAdd) {
+				t.Errorf("TunnelHostnameMapper.ToAdd() = %v, want %v", gotToAdd, tt.wantToAdd)
+			}
+		})
+	}
+}
+
+func TestTunnelHostnameMapper_ToRemove(t *testing.T) {
+	type fields struct {
+		tunnelHostnameToOrigin map[h2mux.TunnelHostname]originservice.OriginService
+	}
+	type args struct {
+		newConfigs []*pogs.ReverseProxyConfig
+	}
+	tests := []struct {
+		name         string
+		fields       fields
+		args         args
+		wantToRemove []h2mux.TunnelHostname
+	}{
+		{
+			name: "Mapper={}, NewConfig={}, toRemove={}",
+		},
+		{
+			name:         "Mapper={x}, NewConfig={}, toRemove={x}",
+			wantToRemove: []h2mux.TunnelHostname{sampleConfig1().TunnelHostname},
+			fields: fields{tunnelHostnameToOrigin: map[h2mux.TunnelHostname]originservice.OriginService{
+				h2mux.TunnelHostname(sampleConfig1().TunnelHostname): &originservice.HelloWorldService{},
+			}},
+		},
+		{
+			name: "Mapper={x}, NewConfig={x}, toRemove={}",
+			args: args{newConfigs: []*pogs.ReverseProxyConfig{sampleConfig1()}},
+			fields: fields{tunnelHostnameToOrigin: map[h2mux.TunnelHostname]originservice.OriginService{
+				h2mux.TunnelHostname(sampleConfig1().TunnelHostname): &originservice.HelloWorldService{},
+			}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			om := &TunnelHostnameMapper{
+				tunnelHostnameToOrigin: tt.fields.tunnelHostnameToOrigin,
+			}
+			if gotToRemove := om.ToRemove(tt.args.newConfigs); !reflect.DeepEqual(gotToRemove, tt.wantToRemove) {
+				t.Errorf("TunnelHostnameMapper.ToRemove() = %v, want %v", gotToRemove, tt.wantToRemove)
+			}
+		})
+	}
+}
+
+func sampleConfig1() *pogs.ReverseProxyConfig {
+	return &pogs.ReverseProxyConfig{
+		TunnelHostname:          "mock.example.com",
+		OriginConfigJSONHandler: &pogs.OriginConfigJSONHandler{OriginConfig: &pogs.HelloWorldOriginConfig{}},
+		Retries:                 18,
+		ConnectionTimeout:       5 * time.Second,
+		CompressionQuality:      3,
+	}
+}
+
+func sampleConfig2() *pogs.ReverseProxyConfig {
+	return &pogs.ReverseProxyConfig{
+		TunnelHostname:          "mock2.example.com",
+		OriginConfigJSONHandler: &pogs.OriginConfigJSONHandler{OriginConfig: &pogs.HelloWorldOriginConfig{}},
+		Retries:                 18,
+		ConnectionTimeout:       5 * time.Second,
+		CompressionQuality:      3,
+	}
+}
@@ -32,7 +32,7 @@ type ClientConfig struct {
 	Version              Version               `json:"version"`
 	SupervisorConfig     *SupervisorConfig     `json:"supervisor_config"`
 	EdgeConnectionConfig *EdgeConnectionConfig `json:"edge_connection_config"`
-	DoHProxyConfigs      []*DoHProxyConfig     `json:"doh_proxy_configs"`
+	DoHProxyConfigs      []*DoHProxyConfig     `json:"doh_proxy_configs" capnp:"dohProxyConfigs"`
 	ReverseProxyConfigs  []*ReverseProxyConfig `json:"reverse_proxy_configs"`
 }

@@ -29,7 +29,27 @@ func TestVersion(t *testing.T) {
 	assert.True(t, secondVersion.IsNewerOrEqual(secondVersion))
 }

-func TestClientConfig(t *testing.T) {
+func TestClientConfigCapnp(t *testing.T) {
+	for i, testCase := range ClientConfigTestCases() {
+		_, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
+		capnpEntity, err := tunnelrpc.NewClientConfig(seg)
+		if !assert.NoError(t, err) {
+			t.Fatal("Couldn't initialize a new message")
+		}
+		err = MarshalClientConfig(capnpEntity, testCase)
+		if !assert.NoError(t, err, "testCase index %v failed to marshal", i) {
+			continue
+		}
+		result, err := UnmarshalClientConfig(capnpEntity)
+		if !assert.NoError(t, err, "testCase index %v failed to unmarshal", i) {
+			continue
+		}
+		assert.Equal(t, testCase, result, "testCase index %v didn't preserve struct through marshalling and unmarshalling", i)
+	}
+}
+
+func ClientConfigTestCases() []*ClientConfig {
+
 	addDoHProxyConfigs := func(c *ClientConfig) {
 		c.DoHProxyConfigs = []*DoHProxyConfig{
 			sampleDoHProxyConfig(),
@@ -58,7 +78,12 @@ func TestClientConfig(t *testing.T) {
 		sampleClientConfig(addReverseProxyConfigs),
 		sampleClientConfig(addDoHProxyConfigs, addReverseProxyConfigs),
 	}
-	for i, testCase := range testCases {
+
+	return testCases
+}
+
+func TestClientConfig(t *testing.T) {
+	for i, testCase := range ClientConfigTestCases() {
 		_, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
 		capnpEntity, err := tunnelrpc.NewClientConfig(seg)
 		if !assert.NoError(t, err) {
@@ -8,39 +8,6 @@ import (
 	"github.com/pkg/errors"
 )

-// ScopeUnmarshaler can marshal a Scope pog from JSON.
-type ScopeUnmarshaler struct {
-	Scope Scope
-}
-
-// UnmarshalJSON takes in a JSON string, and attempts to marshal it into a Scope.
-// If successful, the Scope member of this ScopeUnmarshaler is set and nil is returned.
-// If unsuccessful, returns an error.
-func (su *ScopeUnmarshaler) UnmarshalJSON(b []byte) error {
-	var scopeJSON map[string]interface{}
-	if err := json.Unmarshal(b, &scopeJSON); err != nil {
-		return errors.Wrapf(err, "cannot unmarshal %s into scopeJSON", string(b))
-	}
-
-	if group, ok := scopeJSON["group"]; ok {
-		if val, ok := group.(string); ok {
-			su.Scope = NewGroup(val)
-			return nil
-		}
-		return fmt.Errorf("JSON should have been a Scope, but the 'group' key contained %v", group)
-	}
-
-	if systemName, ok := scopeJSON["system_name"]; ok {
-		if val, ok := systemName.(string); ok {
-			su.Scope = NewSystemName(val)
-			return nil
-		}
-		return fmt.Errorf("JSON should have been a Scope, but the 'system_name' key contained %v", systemName)
-	}
-
-	return fmt.Errorf("JSON should have been an object with one root key, either 'system_name' or 'group'")
-}
-
 // OriginConfigJSONHandler is a wrapper to serialize OriginConfig with type information, and deserialize JSON
 // into an OriginConfig.
 type OriginConfigJSONHandler struct {
@@ -9,59 +9,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )

-func TestScopeUnmarshaler_UnmarshalJSON(t *testing.T) {
-	type fields struct {
-		Scope Scope
-	}
-	type args struct {
-		b []byte
-	}
-	tests := []struct {
-		name      string
-		fields    fields
-		args      args
-		wantErr   bool
-		wantScope Scope
-	}{
-		{
-			name:      "group_successful",
-			args:      args{b: []byte(`{"group": "my-group"}`)},
-			wantScope: NewGroup("my-group"),
-		},
-		{
-			name:      "system_name_successful",
-			args:      args{b: []byte(`{"system_name": "my-computer"}`)},
-			wantScope: NewSystemName("my-computer"),
-		},
-		{
-			name:    "not_a_scope",
-			args:    args{b: []byte(`{"x": "y"}`)},
-			wantErr: true,
-		},
-		{
-			name:    "malformed_group",
-			args:    args{b: []byte(`{"group": ["a", "b"]}`)},
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			su := &ScopeUnmarshaler{
-				Scope: tt.fields.Scope,
-			}
-			err := su.UnmarshalJSON(tt.args.b)
-			if !tt.wantErr {
-				if err != nil {
-					t.Errorf("ScopeUnmarshaler.UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
-				}
-				if !eqScope(tt.wantScope, su.Scope) {
-					t.Errorf("Wanted scope %v but got scope %v", tt.wantScope, su.Scope)
-				}
-			}
-		})
-	}
-}
-
 func TestUnmarshalOrigin(t *testing.T) {
 	tests := []struct {
 		jsonLiteral          string
@@ -336,7 +283,3 @@ type prettyJSON string
 func prettyToValidJSON(prettyJSON string) string {
 	return strings.ReplaceAll(strings.ReplaceAll(prettyJSON, "\n", ""), "\t", "")
 }
-
-func eqScope(s1, s2 Scope) bool {
-	return s1.Value() == s2.Value() && s1.PostgresType() == s2.PostgresType()
-}
@@ -2,7 +2,6 @@ package pogs

 import (
 	"context"
-	"fmt"
 	"time"

 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -75,8 +74,9 @@ func UnmarshalRegistrationOptions(s tunnelrpc.RegistrationOptions) (*Registratio
 }

 type ConnectResult struct {
-	Err        *ConnectError
-	ServerInfo ServerInfo
+	Err          *ConnectError
+	ServerInfo   ServerInfo
+	ClientConfig ClientConfig
 }

 func MarshalConnectResult(s tunnelrpc.ConnectResult, p *ConnectResult) error {
@@ -128,82 +128,14 @@ func UnmarshalServerInfo(s tunnelrpc.ServerInfo) (*ServerInfo, error) {
 	return p, err
 }

-//go-sumtype:decl Scope
-type Scope interface {
-	Value() string
-	PostgresType() string
-	GraphQLType() string
-	isScope()
-}
-
-type SystemName struct {
-	systemName string
-}
-
-func NewSystemName(systemName string) *SystemName {
-	return &SystemName{systemName: systemName}
-}
-
-func (s *SystemName) Value() string        { return s.systemName }
-func (_ *SystemName) PostgresType() string { return "system_name" }
-func (_ *SystemName) GraphQLType() string { return "SYSTEM_NAME" }
-
-func (_ *SystemName) isScope() {}
-
-type Group struct {
-	group string
-}
-
-func NewGroup(group string) *Group {
-	return &Group{group: group}
-}
-
-func (g *Group) Value() string        { return g.group }
-func (_ *Group) PostgresType() string { return "group" }
-func (_ *Group) GraphQLType() string { return "GROUP" }
-
-func (_ *Group) isScope() {}
-
-func MarshalScope(s tunnelrpc.Scope, p Scope) error {
-	ss := s.Value()
-	switch scope := p.(type) {
-	case *SystemName:
-		ss.SetSystemName(scope.systemName)
-	case *Group:
-		ss.SetGroup(scope.group)
-	default:
-		return fmt.Errorf("unexpected Scope value: %v", p)
-	}
-	return nil
-}
-
-func UnmarshalScope(s tunnelrpc.Scope) (Scope, error) {
-	ss := s.Value()
-	switch ss.Which() {
-	case tunnelrpc.Scope_value_Which_systemName:
-		systemName, err := ss.SystemName()
-		if err != nil {
-			return nil, err
-		}
-		return NewSystemName(systemName), nil
-	case tunnelrpc.Scope_value_Which_group:
-		group, err := ss.Group()
-		if err != nil {
-			return nil, err
-		}
-		return NewGroup(group), nil
-	default:
-		return nil, fmt.Errorf("unexpected Scope tag: %v", ss.Which())
-	}
-}
-
 type ConnectParameters struct {
 	OriginCert          []byte
 	CloudflaredID       uuid.UUID
 	NumPreviousAttempts uint8
 	Tags                []Tag
 	CloudflaredVersion  string
-	Scope               Scope
+	Name                string
+	Group               string
 }

 func MarshalConnectParameters(s tunnelrpc.CapnpConnectParameters, p *ConnectParameters) error {
@@ -236,11 +168,13 @@ func MarshalConnectParameters(s tunnelrpc.CapnpConnectParameters, p *ConnectPara
 	if err := s.SetCloudflaredVersion(p.CloudflaredVersion); err != nil {
 		return err
 	}
-	scope, err := s.NewScope()
-	if err != nil {
+	if err := s.SetName(p.Name); err != nil {
 		return err
 	}
-	return MarshalScope(scope, p.Scope)
+	if err := s.SetGroup(p.Group); err != nil {
+		return err
+	}
+	return nil
 }

 func UnmarshalConnectParameters(s tunnelrpc.CapnpConnectParameters) (*ConnectParameters, error) {
@@ -281,11 +215,12 @@ func UnmarshalConnectParameters(s tunnelrpc.CapnpConnectParameters) (*ConnectPar
 		return nil, err
 	}

-	scopeCapnp, err := s.Scope()
+	name, err := s.Name()
 	if err != nil {
 		return nil, err
 	}
-	scope, err := UnmarshalScope(scopeCapnp)
+
+	group, err := s.Group()
 	if err != nil {
 		return nil, err
 	}
@@ -296,7 +231,8 @@ func UnmarshalConnectParameters(s tunnelrpc.CapnpConnectParameters) (*ConnectPar
 		NumPreviousAttempts: s.NumPreviousAttempts(),
 		Tags:                tags,
 		CloudflaredVersion:  cloudflaredVersion,
-		Scope:               scope,
+		Name:                name,
+		Group:               group,
 	}, nil
 }

@@ -3,6 +3,7 @@ package pogs
 import (
 	"reflect"
 	"testing"
+	"time"

 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	"github.com/google/uuid"
@@ -10,29 +11,34 @@ import (
 	capnp "zombiezen.com/go/capnproto2"
 )

-// Assert *SystemName implements Scope
-var _ Scope = (*SystemName)(nil)
+func sampleTestConnectResult() *ConnectResult {
+	return &ConnectResult{
+		Err: &ConnectError{
+			Cause:       "it broke",
+			ShouldRetry: false,
+			RetryAfter:  2 * time.Second,
+		},
+		ServerInfo:   ServerInfo{LocationName: "computer"},
+		ClientConfig: *sampleClientConfig(),
+	}
+}

-// Assert *Group implements Scope
-var _ Scope = (*Group)(nil)
-
-func TestScope(t *testing.T) {
-	testCases := []Scope{
-		&SystemName{systemName: "my_system"},
-		&Group{group: "my_group"},
+func TestConnectResult(t *testing.T) {
+	testCases := []*ConnectResult{
+		sampleTestConnectResult(),
 	}
 	for i, testCase := range testCases {
 		_, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
-		capnpEntity, err := tunnelrpc.NewScope(seg)
+		capnpEntity, err := tunnelrpc.NewConnectResult(seg)
 		if !assert.NoError(t, err) {
 			t.Fatal("Couldn't initialize a new message")
 		}
-		err = MarshalScope(capnpEntity, testCase)
-		if !assert.NoError(t, err, "testCase index %v failed to marshal", i) {
+		err = MarshalConnectResult(capnpEntity, testCase)
+		if !assert.NoError(t, err, "testCase #%v failed to marshal", i) {
 			continue
 		}
-		result, err := UnmarshalScope(capnpEntity)
-		if !assert.NoError(t, err, "testCase index %v failed to unmarshal", i) {
+		result, err := UnmarshalConnectResult(capnpEntity)
+		if !assert.NoError(t, err, "testCase #%v failed to unmarshal", i) {
 			continue
 		}
 		assert.Equal(t, testCase, result, "testCase index %v didn't preserve struct through marshalling and unmarshalling", i)
@@ -43,7 +49,7 @@ func TestConnectParameters(t *testing.T) {
 	testCases := []*ConnectParameters{
 		sampleConnectParameters(),
 		sampleConnectParameters(func(c *ConnectParameters) {
-			c.Scope = &SystemName{systemName: "my_system"}
+			c.Name = ""
 		}),
 		sampleConnectParameters(func(c *ConnectParameters) {
 			c.Tags = nil
@@ -83,7 +89,8 @@ func sampleConnectParameters(overrides ...func(*ConnectParameters)) *ConnectPara
 			},
 		},
 		CloudflaredVersion: "7.0",
-		Scope:              &Group{group: "my_group"},
+		Name:               "My Computer",
+		Group:              "www",
 	}
 	sample.ensureNoZeroFields()
 	for _, f := range overrides {
@@ -57,23 +57,18 @@ struct CapnpConnectParameters {
    tags @3 :List(Tag);
    # release version of cloudflared
    cloudflaredVersion @4 :Text;
-    # identifier for this cloudflared instance
-    scope @5 :Scope;
-}
-
-struct Scope {
-    value :union {
-        # Standalone instance
-        systemName @0 :Text;
-        # Associated with a group of identical cloudflared instances
-        group @1 :Text;
-    }
+    # friendly name for this cloudflared instance
+    name @5 :Text;
+    # group whose behavior this cloudflared instance will adopt
+    group @6 :Text;
 }

 struct ConnectResult {
    err @0 :ConnectError;
    # Information about the server this connection is established with
    serverInfo @1 :ServerInfo;
+    # How this cloudflared instance should be configured
+    clientConfig @2 :ClientConfig;
 }

 struct ConnectError {
@@ -504,12 +504,12 @@ type CapnpConnectParameters struct{ capnp.Struct }
 const CapnpConnectParameters_TypeID = 0xa78f37418c1077c8

 func NewCapnpConnectParameters(s *capnp.Segment) (CapnpConnectParameters, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 5})
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 6})
 	return CapnpConnectParameters{st}, err
 }

 func NewRootCapnpConnectParameters(s *capnp.Segment) (CapnpConnectParameters, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 5})
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 6})
 	return CapnpConnectParameters{st}, err
 }

@@ -603,29 +603,42 @@ func (s CapnpConnectParameters) SetCloudflaredVersion(v string) error {
 	return s.Struct.SetText(3, v)
 }

-func (s CapnpConnectParameters) Scope() (Scope, error) {
+func (s CapnpConnectParameters) Name() (string, error) {
 	p, err := s.Struct.Ptr(4)
-	return Scope{Struct: p.Struct()}, err
+	return p.Text(), err
 }

-func (s CapnpConnectParameters) HasScope() bool {
+func (s CapnpConnectParameters) HasName() bool {
 	p, err := s.Struct.Ptr(4)
 	return p.IsValid() || err != nil
 }

-func (s CapnpConnectParameters) SetScope(v Scope) error {
-	return s.Struct.SetPtr(4, v.Struct.ToPtr())
+func (s CapnpConnectParameters) NameBytes() ([]byte, error) {
+	p, err := s.Struct.Ptr(4)
+	return p.TextBytes(), err
 }

-// NewScope sets the scope field to a newly
-// allocated Scope struct, preferring placement in s's segment.
-func (s CapnpConnectParameters) NewScope() (Scope, error) {
-	ss, err := NewScope(s.Struct.Segment())
-	if err != nil {
-		return Scope{}, err
-	}
-	err = s.Struct.SetPtr(4, ss.Struct.ToPtr())
-	return ss, err
+func (s CapnpConnectParameters) SetName(v string) error {
+	return s.Struct.SetText(4, v)
+}
+
+func (s CapnpConnectParameters) Group() (string, error) {
+	p, err := s.Struct.Ptr(5)
+	return p.Text(), err
+}
+
+func (s CapnpConnectParameters) HasGroup() bool {
+	p, err := s.Struct.Ptr(5)
+	return p.IsValid() || err != nil
+}
+
+func (s CapnpConnectParameters) GroupBytes() ([]byte, error) {
+	p, err := s.Struct.Ptr(5)
+	return p.TextBytes(), err
+}
+
+func (s CapnpConnectParameters) SetGroup(v string) error {
+	return s.Struct.SetText(5, v)
 }

 // CapnpConnectParameters_List is a list of CapnpConnectParameters.
@@ -633,7 +646,7 @@ type CapnpConnectParameters_List struct{ capnp.List }

 // NewCapnpConnectParameters creates a new list of CapnpConnectParameters.
 func NewCapnpConnectParameters_List(s *capnp.Segment, sz int32) (CapnpConnectParameters_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 5}, sz)
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 6}, sz)
 	return CapnpConnectParameters_List{l}, err
 }

@@ -658,159 +671,18 @@ func (p CapnpConnectParameters_Promise) Struct() (CapnpConnectParameters, error)
 	return CapnpConnectParameters{s}, err
 }

-func (p CapnpConnectParameters_Promise) Scope() Scope_Promise {
-	return Scope_Promise{Pipeline: p.Pipeline.GetPipeline(4)}
-}
-
-type Scope struct{ capnp.Struct }
-type Scope_value Scope
-type Scope_value_Which uint16
-
-const (
-	Scope_value_Which_systemName Scope_value_Which = 0
-	Scope_value_Which_group      Scope_value_Which = 1
-)
-
-func (w Scope_value_Which) String() string {
-	const s = "systemNamegroup"
-	switch w {
-	case Scope_value_Which_systemName:
-		return s[0:10]
-	case Scope_value_Which_group:
-		return s[10:15]
-
-	}
-	return "Scope_value_Which(" + strconv.FormatUint(uint64(w), 10) + ")"
-}
-
-// Scope_TypeID is the unique identifier for the type Scope.
-const Scope_TypeID = 0xc54a4a6fd4d87596
-
-func NewScope(s *capnp.Segment) (Scope, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 1})
-	return Scope{st}, err
-}
-
-func NewRootScope(s *capnp.Segment) (Scope, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 1})
-	return Scope{st}, err
-}
-
-func ReadRootScope(msg *capnp.Message) (Scope, error) {
-	root, err := msg.RootPtr()
-	return Scope{root.Struct()}, err
-}
-
-func (s Scope) String() string {
-	str, _ := text.Marshal(0xc54a4a6fd4d87596, s.Struct)
-	return str
-}
-
-func (s Scope) Value() Scope_value { return Scope_value(s) }
-
-func (s Scope_value) Which() Scope_value_Which {
-	return Scope_value_Which(s.Struct.Uint16(0))
-}
-func (s Scope_value) SystemName() (string, error) {
-	if s.Struct.Uint16(0) != 0 {
-		panic("Which() != systemName")
-	}
-	p, err := s.Struct.Ptr(0)
-	return p.Text(), err
-}
-
-func (s Scope_value) HasSystemName() bool {
-	if s.Struct.Uint16(0) != 0 {
-		return false
-	}
-	p, err := s.Struct.Ptr(0)
-	return p.IsValid() || err != nil
-}
-
-func (s Scope_value) SystemNameBytes() ([]byte, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.TextBytes(), err
-}
-
-func (s Scope_value) SetSystemName(v string) error {
-	s.Struct.SetUint16(0, 0)
-	return s.Struct.SetText(0, v)
-}
-
-func (s Scope_value) Group() (string, error) {
-	if s.Struct.Uint16(0) != 1 {
-		panic("Which() != group")
-	}
-	p, err := s.Struct.Ptr(0)
-	return p.Text(), err
-}
-
-func (s Scope_value) HasGroup() bool {
-	if s.Struct.Uint16(0) != 1 {
-		return false
-	}
-	p, err := s.Struct.Ptr(0)
-	return p.IsValid() || err != nil
-}
-
-func (s Scope_value) GroupBytes() ([]byte, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.TextBytes(), err
-}
-
-func (s Scope_value) SetGroup(v string) error {
-	s.Struct.SetUint16(0, 1)
-	return s.Struct.SetText(0, v)
-}
-
-// Scope_List is a list of Scope.
-type Scope_List struct{ capnp.List }
-
-// NewScope creates a new list of Scope.
-func NewScope_List(s *capnp.Segment, sz int32) (Scope_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 1}, sz)
-	return Scope_List{l}, err
-}
-
-func (s Scope_List) At(i int) Scope { return Scope{s.List.Struct(i)} }
-
-func (s Scope_List) Set(i int, v Scope) error { return s.List.SetStruct(i, v.Struct) }
-
-func (s Scope_List) String() string {
-	str, _ := text.MarshalList(0xc54a4a6fd4d87596, s.List)
-	return str
-}
-
-// Scope_Promise is a wrapper for a Scope promised by a client call.
-type Scope_Promise struct{ *capnp.Pipeline }
-
-func (p Scope_Promise) Struct() (Scope, error) {
-	s, err := p.Pipeline.Struct()
-	return Scope{s}, err
-}
-
-func (p Scope_Promise) Value() Scope_value_Promise { return Scope_value_Promise{p.Pipeline} }
-
-// Scope_value_Promise is a wrapper for a Scope_value promised by a client call.
-type Scope_value_Promise struct{ *capnp.Pipeline }
-
-func (p Scope_value_Promise) Struct() (Scope_value, error) {
-	s, err := p.Pipeline.Struct()
-	return Scope_value{s}, err
-}
-
 type ConnectResult struct{ capnp.Struct }

 // ConnectResult_TypeID is the unique identifier for the type ConnectResult.
 const ConnectResult_TypeID = 0xff8d9848747c956a

 func NewConnectResult(s *capnp.Segment) (ConnectResult, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2})
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 3})
 	return ConnectResult{st}, err
 }

 func NewRootConnectResult(s *capnp.Segment) (ConnectResult, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2})
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 3})
 	return ConnectResult{st}, err
 }

@@ -874,12 +746,37 @@ func (s ConnectResult) NewServerInfo() (ServerInfo, error) {
 	return ss, err
 }

+func (s ConnectResult) ClientConfig() (ClientConfig, error) {
+	p, err := s.Struct.Ptr(2)
+	return ClientConfig{Struct: p.Struct()}, err
+}
+
+func (s ConnectResult) HasClientConfig() bool {
+	p, err := s.Struct.Ptr(2)
+	return p.IsValid() || err != nil
+}
+
+func (s ConnectResult) SetClientConfig(v ClientConfig) error {
+	return s.Struct.SetPtr(2, v.Struct.ToPtr())
+}
+
+// NewClientConfig sets the clientConfig field to a newly
+// allocated ClientConfig struct, preferring placement in s's segment.
+func (s ConnectResult) NewClientConfig() (ClientConfig, error) {
+	ss, err := NewClientConfig(s.Struct.Segment())
+	if err != nil {
+		return ClientConfig{}, err
+	}
+	err = s.Struct.SetPtr(2, ss.Struct.ToPtr())
+	return ss, err
+}
+
 // ConnectResult_List is a list of ConnectResult.
 type ConnectResult_List struct{ capnp.List }

 // NewConnectResult creates a new list of ConnectResult.
 func NewConnectResult_List(s *capnp.Segment, sz int32) (ConnectResult_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2}, sz)
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 3}, sz)
 	return ConnectResult_List{l}, err
 }

@@ -908,6 +805,10 @@ func (p ConnectResult_Promise) ServerInfo() ServerInfo_Promise {
 	return ServerInfo_Promise{Pipeline: p.Pipeline.GetPipeline(1)}
 }

+func (p ConnectResult_Promise) ClientConfig() ClientConfig_Promise {
+	return ClientConfig_Promise{Pipeline: p.Pipeline.GetPipeline(2)}
+}
+
 type ConnectError struct{ capnp.Struct }

 // ConnectError_TypeID is the unique identifier for the type ConnectError.
@@ -3675,228 +3576,223 @@ func (p ClientService_useConfiguration_Results_Promise) Result() UseConfiguratio
 	return UseConfigurationResult_Promise{Pipeline: p.Pipeline.GetPipeline(0)}
 }

-const schema_db8274f9144abc7e = "x\xda\xacY}l\x1cez\x7f\x9ey\xd7\x1e;\xf1" +
-	"f=\xcc\"b\x13\xcb\xa7\x08t\x17\x8e\xa4\x107-" +
-	"q\xdb\xdb\xd8Nr\xb6/\x1f;\xfe\x08\x10\x12)\x93" +
-	"\xdd\xd7\xebIfg6\xf3\x91\xd8Q\xee\x02i(\xe0" +
-	"\x92#\xe1.\x15\xc9\x85\x13\xa4\x97\xf2\xa1\\K\xb8\xa0" +
-	"\xf6(\x9c\x8e\xaa\x14\xd2;\x09P\xa1\x82\x96\xfe\xd1\x83" +
-	"\xa8\x025\xa2p'!N\x17\xa6z\xe6\xdb\xeb\xc5!" +
-	"U\xffIV\xcf<\xef\xfb>\x9f\xbf\xe7\xc3\xb7\\n" +
-	"Y#\xdc\xdadf\x01\x94SM\xcd\xde\x1fW_;" +
-	"\xfd\x07\xc7\x7fq\x18\xa4N\xc1\xfb\xce\x0b\xc3\xf9\xcf\x9c" +
-	"C\xff\x0e\x80=\x8f6\xefG\xf9\\\xb3\x08 \xff\xb8" +
-	"y3\xa0\xf7/\xb7\x1cx\x7f\xc7\xaf\x8f\xdd\x0fR'" +
-	"&\x9c\x19\x11\xa0\xe7\xe5\xe6\x19\x94\xff\xa3Y\x04\xe6=" +
-	"zW\xfe\x9f\xf1\xb1O\x8f\x81\xf45\x04hB\xfa\xfc" +
-	"\xd3\xe6\x05\x02\xa0\xfcFs\x01\xd0{\xed\xe6\x17\x9e?" +
-	"\xfa\x93\xfb~\x00\xcaW\x11!8\xffq\xf3o\x11P" +
-	"n\x12\x89\xe1\xe3\x1f}=\xf3\xe3\xd7\xae\xf9\xa1\xcf\xe0" +
-	"\x9dy\xe3\xf6g\x8f\xfe\xe4+\x1f\xc2\xb8 b\x06\xa0" +
-	"g\xb9h\x11\xefj\xf1\xbf\x00\xbd\xef\xbf\xfd\xe2\xa6\xea" +
-	"\xb1\x93\xa7A\xfajtWG\x8b @\xc6[\xf5o" +
-	"\x177o|v\xe2\x89\xe0K G\xb6\xe5Y:\xda" +
-	"\xd5B\xcf\xbc\xba\xaf\xfd\xc1\xbe?|\xe8\x09P:1" +
-	"\xa5OS\x13q\xf6\xb5\xcc\xa0|g\x0b\xfd\x1co\xb9" +
-	"\x1d\x01\xbd\x99\xd5/n\xf9\xf5\x9f\xd9O\x83\xb2\x1c3" +
-	"\xde?>\xf0\xde\xdeeOM\xbc\xe2K\xc5\x00z." +
-	"\xb4\x9e\xa6\xab\xdfi\xfd\x1b@/\xfb\xf77mz\xe8" +
-	"\xfd\x0d\xe7\xe8\xea\x94Q\x03!\xa6\x17\xf4\xa2\xfc\xc0\x02" +
-	"\xb2\xeb\xbd\x0b\x88\xfb\xf5\x9b\xb7\xfc\xecg\xcfT\xce\xd5" +
-	"\x0b\"\x10\xf7\x8d\x0b\x87Q^\xbd\x90\xb8W-$\xee" +
-	"k\x87\xf0\xdd\x9f\xdf\x9a\xf9\xdbP/FL\x1f,\xfc" +
-	"\x90\x1e\xbf\xec3\xdc\xf5\xbb\xe7\xfea\xddGo\xfe4" +
-	"\xed\x80G\xdb\x04r\xc0\xb96R\xbc\xebR\x7f\xd6\xf8" +
-	"\xe8\xd0\xcfg\xfb1\xb8\xe9\x9d\xb6a\x94/\xb5\xd1s" +
-	"\x1f\xb4\xd1m\x7f\xe1\xbe\xfd\xa69<\xfcr\xbdp\xfe" +
-	"\xb5\xf7f\x05\x94\x8fe\x89\xfbH\xb6\x00\xf8\xe9\xd3\xf7" +
-	"\x1d\x1dzo\xed+J'f\xeay\x8fe\xf7\xa3|" +
-	"\x86x{\x1e\xcfv\x93Ec\x1b\xd6\xb1\xfbz\xbf\xb1" +
-	"h\x17\xca\x17\x17\xd1\xcf\xff\\\xe4\xb3\x0f\xdf\xf5\xbd\x87" +
-	"\x9b.~\xef\x95z\xa3\x8a\xbe\x05r\x16\xca\x97s\xf4" +
-	"\xf3\xb3\xdc\x13\x02\xa0\xf7\xdb\xb3\x7f\xca/\xaex\xf5\x02" +
-	"(_\xc1\x94\x1a\xe3(\xa2\x00\xd0s\xf1\x9a\x95d\xb2" +
-	"K\xd7\xec\x03\xf4:\x9f\xf9\xa3\xbf\xee/\xbf\xf3\x8b:" +
-	"\x8b\x90 \xf2F\xf9\x13\xf9N\x99~\x8d\xcb\xc4{\xdf" +
-	"\xd7\xa7\xf7o\xbaq\xe6\xad\x86\x069'\xcf\xa0|\xc1" +
-	"\xe7~\xd9\xe7\x16.\xaa\x1dw\xff\xeb7\xdeM\xc5\xe7" +
-	"\xaa\xfc\xaf\x102\xde\xa6-w\xedj\xfd\xf6{\xef\xa5" +
-	"\xe3sY\xde\xf7\xe3\x9f\xe4\xc9M\xe7\xa5\x87\xe5\x17\x1e" +
-	"\xff\xab\xf7\xe9!\xb1\xdeO\xdb\xf3[Q\xde\x93\xa7\x9f" +
-	"\xd5\xbc\xafo\x9c'\x8d\xa2H\xbb\xae\x17\xe5\xe9\xebH" +
-	".\xf7:\x92k\xd5\x8e>\xbe\xed\xb6;>\x04\xa9\x93" +
-	"\xcd\xca\xfa\xe7\x88\xf3e\xe2\xecy\xe9:\x11\xe5=\x8b" +
-	"E\x00\xef\xbb\x95\xad\x17>\x1ex\xfc\x7f\xea/\xf7\x15" +
-	"\xbasq/\xca\x1a\xf1\xf5\xf0\xc5\xbe\xabzn\xfd\xf3" +
-	"K\xc7\xffr\xe0\xe39\xb7\x9f\xeb\xe8G\xf9\xa5\x0e\x92" +
-	"\xe3\xc5\x8eo\xca\x97:\xfc\xcb\xbf\xb3v\xf3\xea\xa5/" +
-	"}\x92\xb6\xc4[\x1d\x9f\x90%>\xe8 KL\xdc\xf6" +
-	"\xdf\xdf\xbc\xf1\xbb\xff\xf4I\x9d{|\xc6\xd6\xce\x9bP" +
-	"\xee\xe8\xa4\x1b\xaf\xed,\x00~\xb4\xfe\x87ov\xe6:" +
-	"\x7f\xd3H\xd0\xd5\x9d\xbbP\xdeH\xbc=C\x9d\xbe\xa0" +
-	"w\xfc\xea\xe4\xbe\xc2\x0f~\xf3)\xe9\xc5\xea0m\xfa" +
-	"\xfa\xad(\x1f\xb9\x9en~\xe0zJ\x85\x0dg\xdf\xf9" +
-	"\xc6\xe4\xf1W?\xab7\x82\xef\x90UK\x0e\xa1<\xb4" +
-	"\x84\xb8\xd7-!d:\xf0\xd1\x89\xc1\x87\xb6\x9d\xfd<" +
-	"\xad\xd5\xf2\xae\xe7}\xffv\x91V\xbb\x8e\x1fp\x06\x1f" +
-	"9\xe25\x08\xba\x9e\xed]\xfd(W\xbb\xe86\xadk" +
-	"\x1f,\xf7\x1c\xd70\xb8n\xd52\xa5\xdf\x8b~\x96V" +
-	"\x94\xd4\x9aQ\xeb]7\xa5\xd9\x8efT\xc6|z\xa1" +
-	"h\xeaZi\xba\x88\xa8\xb4Q\xa0K]\xbd\x00\x88\xd2" +
-	"\xb5[\x01P\x90\xa4~\x80\x82V1L\x8b{e\xcd" +
-	".\x99\x86\xc1\x81\x95\x9c\x83;U]5J<~\xa8" +
-	"i\xeeC\x83\\\xd7\xcd\xdbMK/o\xb6\xb4\x8af" +
-	"\x0c\x98\xc6\x84V\x01(\"\xc6\xc7\xc4\xb9\xc7\x06t\x8d" +
-	"\x1b\xce(\xb7\xf6j%\xbe\xc2\xb5yp\xce\xb5TG" +
-	"3\x8d\x1bF\xb8\xed\xea\x8e\x0d\xa0dX\x06 \x83\x00" +
-	"R\xb6\x17@ia\xa8\xe4\x05,X>\x03\xb6'\x99" +
-	"\x07\x88\xed\x90\xbc\xd9<\xf7\xcd\xc0\x16\xf4&\xb7V\xb8" +
-	"\x86\xc5+\x9a\xedp+ \xdfP(\xaa\x96Z\xb5\xd3" +
-	"\x0f\x9e\x04P\xda\x19*K\x04\xf4*\x96Z\xe2En" +
-	"\xa1f\x967\xa9\x869\xcax\x09\x9b@\xc0\xa6\xd4\xa3" +
-	"\x0d\x1c\xb1^\xd5t^\x0e\xb4[Q\xea\xf6\xffW\xda" +
-	"Y\xa6\xcd\xf3\xfcG\xd4\xad\x00\xca\x0e\x86\x8a.`\x16" +
-	"?\xf7\xf2T\xfe$m?\x802\xc9Pq\x04\xcc\x0a" +
-	"\x97\xbd\xbc\xef\xb5=K\x01\x14\x9d\xa12%`\x96\xfd" +
-	"\xce\xcbS\x91\x91\xdc]\x00\x8a\xc3P\xb9[@\xcfv" +
-	"kdS\x1b\x98ia{\x12\xca\xa1ux\xb9B\x96" +
-	"6\xa0\xc0Kdhl\x8f\xd09`\x10\xcb\xe6$\xb6" +
-	"'\xc5'<f\xf1\xbd\xdc\xb2y\x11r\x9695\x8d" +
-	"\xed\x09J\xd7Y={\xb5V\x8f\x1c\x1d\x9f\x9a\xff\xbc" +
-	"\x1f\x9a%\xe7\x86b\xf7\x1cg\x91\x1d\xdb\x18*\x8b\x05" +
-	"\xf4j\xf4\x95;\x1c\x98ec{R\xd4\xeb\xa4m\x10" +
-	"\xce\x03\xf4\xef@\xf0J1\xbc\xc5\xb2\xfdpV\x16\xc7" +
-	"\x8f\x9d\xa0\xc7\x1ea\xa8\xfcH@\x091\xf0\xd9\xe3\x16" +
-	"\x80\xf2\x18C\xe5\xac\x80(\x04\x1e{\xea4\x80r\x96" +
-	"\xa1\xf2w\x02JL\x08\x1c\xf6\xdcM\x00\xca3\x0c\x95" +
-	"_\x0a(eX\x9e\x1a\x18\xe9\x02\x05\xdb/\x19*o" +
-	"\x0b(5e\xf2\xd8\x04 \xbd\xb5\x12@y\x9d\xa1\xf2" +
-	"\xae\x80\x9e\x19\xe4\x17)\xe5`\x16\x04\xcc\x02z%\xdd" +
-	"t\xcb\x13\xba\x0a\xdd\x16/\x0f\xad\x8d\xe9\x86[-Z" +
-	"|\xaf\x86\xa6k\xf79\x0e\xaf\x8a5\xc7\xc6f\x10\xb0" +
-	"\x190\xe7\xa8\x15\x1b\x17\x01\x16\x19b{R\xe8\x00\x89" +
-	"\x18\xdf\x89\x16/o\xe1\x96\xad1\xd3\xc06\x10\xb0\x0d" +
-	"\xb0\xdb.\x995\x8e\xedI\xed\xbc\xb2MG\xc2\xe8\xa1" +
-	"\xd8\x09\x13\xc1\xb44\xb1\xa2\x19J\x1b\xcb,\xf1\xbc\xd0" +
-	"\x80\xeb\xc8.k\x18*\x1b\x04\xec\xc2\xcf\x89L6\x1c" +
-	"\x1a\x01P\x06\x19*c\x02v\x09\x97\x89LVT\xc8" +
-	"\x07E\x86\xca6\x01s\x93\x8eS\xc3\xf6\xa4:\x86B" +
-	"\xed\xe3;m\xb3\xb4\x9b\x03\x12T\xc4P\x1d~\x9d\x0c" +
-	"\xa1\x0b\x98^\xc6\xf6\xa4\x93\xad\xd3\x885\x88\x12?@" +
-	"\x0a\xce:\xcb2-\x1fU\xe3\xd0X\xb72Q\"\x8a" +
-	"\x8c\xa1\xad\x89\x06\x92\xb0&PK\xd9\x99\xc8\xdf]R" +
-	"]\x9bG6\xf6,\xeeX\xd3}\x13\x0e0n\xc5\x18" +
-	"cO\x9a\xae^\x1e\xe1 :\xd64\"\x08\x88\xf3#" +
-	"\xcfZs0e\xf2 \x84Sr\x92Lk\x19*\xc5" +
-	"D\xce\x8dD\xdb\xc0P\xb9\x83\xe4\x0c\xcd?N\xe6\x1f" +
-	"c\xa8\xd4\x04\xf4t\xca]c\xd0\x04f;\xb1\xb8\x01" +
-	"\xb1h\xfa\x81)\x82\x80\"\xa0\xe7\xd6l\xc7\xe2j\x15" +
-	"0\x8e4\xe2_t\x15\x10]\x07\x15E5\xe7\xe7|" +
-	"c\x1d\xe24\xdc8\x9cV\"\xcc\xc3\xf1\xfe\xc4\xd8\x8d" +
-	"\x13i\xd2\xb4\x1dC\xadr\x00\x88\x14;h\xd6\x08#" +
-	"\x09A\xe26\xb3.6\xae\xbe\xb2\x05UfV];" +
-	"\x9d*3\xa5\xf04\xfa\xc7\x07LC\x9c\xd0*\xd8\x9e" +
-	"\xf4Zu\x024\xf0{\x9f\xebLr\xc3\xd1J\xfe\x83" +
-	"s\xfc\xbe4\x89\xcf\xd8fC+S\x86\x8cl\xb6q" +
-	"gbHq7\x9f\x8e!\x80WUM\x8f\xbd\x1fZ" +
-	"\xb3\x0f\xc4o%<\xf3%\xcf(!\x88/\x95o\x03" +
-	"Lu\xe5Rv%\x08\xdd{U\xdd\xe5\xf367a" +
-	"\x15\x0bjX!00]\x98\x8f\xd5\xfc\xf6\x0c\x80r" +
-	"7C\xe5\xc1\x94\x9a\x0f<\x0c\xa0<\xc8Py$\xa5" +
-	"\xe6q\x0a\x8d\xa3\x0c\x95S\x04\xd1,\x00\x97\x13\xe4\x93" +
-	"S\x0c\x95'\x05\xc4L\x80\xd0g\x08\xa1\x9fd\xa8\x9c" +
-	"\x17||\x1d\xec\x1b0\x0d\x0c\x85\xb0\x01\"t\xf5&" +
-	"\xb9j9;\xb9\x8a\xce\x90\xe1pk\xaf\x8az\x94\xc5" +
-	"\x07\x1d\xad\xcaM\xd7\x89\xb3\xba\xaaN\xf9\x1d\x02\x96\x07" +
-	"\x83S\xa2\xea\xd8\xd8\x0a\x02\xb6R\x12\xd9\xdc\x1a\xb0x" +
-	"\x19\xc9\x9f\xaa^T\x9939\xc7\xc4\x99+!n\xae" +
-	"\x81y\xa8\xbf8\xc0P\xb9\x9f\xb2\x1fS\x83\xacto" +
-	"/\x08~\xf2\x93\xce\xd5\xfe\xa4\x0f\xf1\xeb\x17U\xa5=" +
-	"\x0f'\x0d\x87_\xbf\x9a\xe9\xc6\x93\x89\xc1C\xd1\x06M" +
-	"(\x04I\x15\xc9\\\x08\x82\xe5 \x01\x9c\xc6\x13=\xc3" +
-	"\xb2\xae\xa1i\x8c\xf9\x06\xc2\xc4B%\xb3Z\xb3\xb8m" +
-	"\xa3f\x1a\x8a\xab\xea\x1as\xa6\xe3\x83\xf3\xda\x80\xd0#" +
-	"\xc8\xba\xcd\xb5n\xdfId\x84[\"#\xc8}8\x0c" +
-	"0\xba\x06\x19\x8en\xc0$L\xe4!\xec\x07\x18]K" +
-	"\xf4\"&\x91\"o\xc4N\x80\xd1A\xa2\x8f\xa1\x80\x18" +
-	"\xc4\x8a\xac\xe0\xd3\x00\xa3cD\xde\x81IE\x97\xb7\xfb" +
-	"\xd7o#\xfa$&E]\xe6x\x13\xc0\xe8\x0e\xa2\x1f" +
-	" z\xb3\xe0[P\x9e\xc6]\x00\xa3SD?Lt" +
-	"\xb1)O\xf3\x81|\x0fZ\x00\xa3w\x13\xfdA\xa2\xb7" +
-	",\xcec\x0b\xcd\x1f>\xfd~\xa2\x7f\x9f\xe8\xad\x1dy" +
-	"l\x05\x90\x8f\xe1!\x80\xd1\xa3D?E\xf4\x05\x98\xc7" +
-	"\x05\x00\xf2\x09<\x090z\x8a\xe8O\x12}as\x1e" +
-	"\x17\x02\xc8g|y\x1e#\xfaY\x8c!h\xa8\x9cF" +
-	"B\x0a'-\xe9\x02\x98i\xc7a\xc8\xc3I\x03\x03\x98" +
-	".\x9a9\x1a50\x97\xec\x90\x001\x07\xe8\xd5LS" +
-	"\xdf4\x1ba\xaf\xd4\x88\x84a\x019\xd3\x18*\xc7\xf9" +
-	"\x15\x04\xd1\x06\x13\xbaK\xaa>T\x8b%\xd1\xec>\xd7" +
-	"1\xdd\x1at\x97U\x87\x97\xe3\x1ai\xb9\xc6z\xcb\xac" +
-	"\x8e!\xb7\xaa\x9a\xa1\xea\x10\x7f\x99/\xb6r\xae\xab\x95" +
-	"\xbf4\x9e\xad\x08PKiI:\xfbeT\x9d\xbe\xc6" +
-	"P\xf9\xfdtg\x7f+A\xed\xcd\x0c\x95\xdb\xa8[\x9f" +
-	"\xb6\x1d^\xdd\xa4\x02Kr\xa4\xbbb\x99nm\xce\xc3" +
-	"B\xfd\xc3\xdd\xb5\xde1\xd5O\xeb\x968\xad\x97Q\x07" +
-	"u\x03C\xe5\x96\x14\xea-_\x99\xc8\x91Kgc " +
-	"\xf2\x9c\x97\x1atp\xe3uU,\xe8\xda\x83\xd2\x92z" +
-	"\xbd?y=~\xdc\x0a\xd5\x1d\x14\xf0\xa0\xed\x96Jd" +
-	"\xed\xc8\xfc\x13\xe1l\x04\xddtw*\x10\xe2\xb5E\x18" +
-	"\x08_\xb6c\xa8p'\xf85dL\x98TjE\xb5" +
-	"j\xff\x1fO\x8fp;G\xa3\xc9\x15'\xd0x\x11q" +
-	"\xe5\xd2<86VL\xc6d\x16\xa0r\x1a\x90F\xd2" +
-	"\x80\x94\xe0\xd1\xae4\xeeD\x1d\xa4\xac\xf8\x00P$\xfa" +
-	"6L\xe6\x0b\xf9N<=\x0bx2}\x01 q\xff" +
-	"\xfa2\xd1k> a\x00HU\xff~\x9d\xe8Si" +
-	"@rqf6 \xb1\x08\x90\x08H\x0e\x13\xfd\xa8\x0f" +
-	"H\x99\x00\x90\x8e\xe0\xb3\xb3\x80\xa7\xb5)\x00\xa4\x13\xf8" +
-	"\xfc,\xe0Y\xd0\x1c\x00\xd2\x19\x9f\xffI\xa2\x9f\xf7\x01" +
-	"\xa9?\x00\xa4s>\x80=C\xf4\x17\x08\x90\\K\x1f" +
-	"u,\xcd\x00\xac$\xc1Z\xaa}\x8b\xf3Z\x1f\xe4t" +
-	"m/\x8f\x8bEYS\xf5\xb5\xae\xaaC\xf7\xa8\xa3\x96" +
-	"v'm\xb2n\x0f\xaaF\xd9\xc6Iu7\xa7\x12#" +
-	"\xa6\x8b\xb0\xa3\xdb[\xb8\xa5M\x00&\x8du\xdc\xd6\xe4" +
-	"\x8a\xa6Y\xdf\xed\xf8\xfd\x19\xb7\x024\x8b\xbfU\xd5\xa9" +
-	"\xa1\xb2\xce\x070jM\x98\x91\x948\x8d\xbe\x98\x86\x81" +
-	"A\xbf0\xa6u\xcfn\x04ja\xab\x1e5\x14c\x85" +
-	"\xbaN\x81O\xd5x\xc9\x190\xd1p4\xc3\xe5s." +
-	"(M\xba\xc6n^^\x87F\xc9,kF\x05\xe6\xcc" +
-	"\x08\xec\x8b\xb6\x13\xa9\x0e\xaa%l\xc9\xe2u\xbb\xb4\x8c" +
-	"\xfa\x01\x0c\xfb\x01\xa97\x99\xb2\x0b%\xffT\xc1\xe2\xaa" +
-	"\x9d\x94\x86\xf9^\x0b\x97QA\x92\xd1k\xed\xac\x09 " +
-	"^^c\xb4\xf3\x93\xf6\xec\x07A\xd2DLV\xa5\x18" +
-	"mF\xa5\xed\x16\x08\xd2\xb8\x88B\xfc7\x03\x8c\xf6\xfd" +
-	"\xd2\xd0\x0c\x08\xd2:\x11Y\xbc\xe8\xc7h\xe3&\xad\xee" +
-	"\x07AZ.z\xd1T\x01\x85@\x9c5\xe8E\x89\x0f" +
-	"\xdd~\xea\xafA/\xdaS`4}\x00\xac\xc1\x83a" +
-	"=Z\x83\xe9\xe5\x16\xfb\xa2\x11\xa0q_J\x189\xc5" +
-	"P9\x9c`\xe4=\xd4\xab\x1ef\xa8\x1cM\x8d]G" +
-	"\x9eN\xb7\xa5\xe1\xe6\xe0\xc4\xa1p\xefp>\xb598" +
-	"G\xbd\xeay\x86\xca\xebBR\xa8\xa3\xb0\x8b\xf6Ah" +
-	"Z\xd1\x1c8\xcfZ(\x0c\xce\xb0e\xac_\x0eye" +
-	"s\xd2o)1\xb8\xca\x86\x04\xb1\xd3\x1b\xa3E\xa9\x8d" +
-	"\x11F\x13\xa88\x0b\xe0\xd3\xfb\xa3E\xf3c\xe6\xacy" +
-	"*\x1c\x1b(j\xa2\xbfh`\xf4\xb7%I\"\xefg" +
-	"E/\x9a\xb90*W\xe4\xbc\xb4\xcb\xaer\xf0\x1c\xe1" +
-	"\xdd\xf6\x97\xa9\x04\xd1\x96\xf9\xca\xfb\x83\xe0\x9d\x1c\x05[" +
-	"<\x07\x05\xf7\xeeJm\xb1t3\x1c\xe1r\x9bRU" +
-	"{>[\x05\x02G\x9do\x8e\x0e\xd7\x85\xdf\xd2$\xfc" +
-	"\xe2\x06\xe1\x9e\xa5\xc90\x10\x8fE\xf7\x0e\x87A\xf9X" +
-	"\xdc\xe9J\x8f\xce$\x1b\xae8\xfc\x9e\x1aN\xc6\"\x91" +
-	"[V$\xa7\xe8Z\x09l\xeafe\x83fp\x9bz" +
-	"\xbf\xbam@\x8d[U\xd5\xe0\x06:\x04F\xaeE\x88" +
-	":\x1b\xb9\x86\xd6\xa6Z\xc6\xf9\xd4\x1f\x0d\x83=\x88\xf5" +
-	"\xb0\xbc\xa6F\xdf\xd3\xa95L\xa4\xbc\xf2|\xb8\xde\xd8" +
-	"\x91R~;\x8d\xbe\xdb\x18*\x93\x02z\xaa\xeb\x98\xe3" +
-	"\xb5\xb2\x8a\x0e_o\xf1=.\x17\x8d\xd2t2\xc0\xd1" +
-	"(S\xb2\xc7\xb1FM\xe7z\x8b\x17\xf6\xb8<\xcd\x10" +
-	"-\x8eA\xd4\xcc\xf2\x9c\x8dq\x83f\xebv\xbes\xd4" +
-	",\xed\xe6\xce\xac\x85z\x00\x97\x91*\xeaH\xb25\x8e" +
-	"4\xd1FR\xb3Z\x04#{(\xa0j\x0c\x95\x03)" +
-	"\x18\x99\x9eI\x1c\xde\xb8\xba\xfe\xff\x14\xc4y\x94l\xb8" +
-	"\xd5\x1d)\xf0/\x95h\xc9_I\xae\xdcr\x85{\x82" +
-	"\xb0c\xadkX\x976j\x97\xb7&\x0d\xba\x1f\xcf\xed" +
-	"\xc9_n\xc3\xe7\xec\xb0K\x046a\xcem\x00\xff7" +
-	"\x00\x00\xff\xff\xfd\xa0l\x0d"
+const schema_db8274f9144abc7e = "x\xda\xacY{p\\\xe5u?\xe7~\xab\xbd\x96-" +
+	"y\xf7r\x15\x88\x84=j<0\x09\x04S\x8cK\x1b" +
+	"\xd4N\xd6\x92,Gr\xfc\xd8O+\x1b0\xf6\x8c\xaf" +
+	"w?\xad\xae}\xf7\xde\xf5}\x18\xc9cb\xf0\x98\x02" +
+	"*\x04C\xf0\x0cv C\xdc\xba<\x06\xca#0\x1d" +
+	"\xa8\x9d\x92N)\xd0\x94!L\xa0S\xb7\xc9\x1f\x04<" +
+	"\x0dL2\x04B\x87\xd2\x01n\xe7\xdc\xb7VB\xb6;" +
+	"\xfd\x07\xae\xcf\x9e\xef\xfb\xce\xf3w\x1e\xba\xe2\xe7\x0bV" +
+	"I+\xda\xfe\xbe\x03\x80\xdf\xdb\x96\xf7\xff\xac\xf1\xda\xb1" +
+	"?>\xfc\xd3\x83\xa0\xf4H\xfewN\xac\xed\xfa\xc4=" +
+	"\xf0\x1f\x00\xb8r(\xbf\x17\xd5\xeb\xf22\x80\xba)\xbf" +
+	"\x11\xd0\xff\xf9\x15\xfb\xde\xd9\xfe\xfb\xbbo\x03\xa5\x07S" +
+	"\xce\x9c\x0c\xb0\xb2\x91\x9fF\xf5\x96\xbc\x0c\xcc\x7f\xe0\xfa" +
+	"\xae\x7f\xc6\x07?\xbe\x1b\x94\xaf!@\x1b\xd2\xcfZ~" +
+	"\xa1\x04\xa8N\xe5K\x80\xfek\x97\x9dx\xfe\xd0\x8fn" +
+	"\xfd>\xf0\xaf\"Bx\xfeH\xfe\x7f\x10P}<`" +
+	"\xf8\xe0\xaf\xbe\x9e{\xfc\xb5\xf3~\x100\xf8\xc7_\xbf" +
+	"\xe6\xe9C?\xfa\x83\xf7`\x93$c\x0e`\xe5\x9by" +
+	"\x9bx\xdf\xca\xff'\xa0\x7f\xef\xbf\x9d\xdc\xd0\xb8\xfb\xe8" +
+	"1P\xbe\x1a\xdf\xf5\x13Y\x92 \xe7_\xf5\xef\xa77" +
+	"\xae\x7fz\xfc\xa1\xf0\x97P\x8eg\xe5\xa7\xe9\xe8\x8b2" +
+	"=\xf3\xf2\x0d\xc5;\xfa\xff\xe4\xae\x87\x80\xf7`F\x9f" +
+	"6\xd2x\xe5\xbb\xf24\xaa\xb8\x80>?\x93\xefB@" +
+	"\x7f\xfa\xea\x93\x9b\x7f\xff\xe7\xce\xa3\xc0\x97c\xce\xff\xc7" +
+	"\xdb\xdf\xdes\xc9#\xe3/\x05R1\x80\x95\x8f\xb7\x1f" +
+	"\xa3\xabO\xb6?\x01\xe8w\xfe\xdd\xa5\x1b\xeezg\xdd" +
+	"Stu\xc6\xa8\xa1\x10\xdb\x16\xf6\xa1\xdaXHv\xd5" +
+	"\x17\x12\xf7\xcf.\xdb\xfc\xe3\x1f?Y\x7f\xaaU\x10\x89" +
+	"\xb8\xdb\x17\xadEu\xe9\"\xe2\xee^D\xdc_\x1a\xc1" +
+	"_\xbc\xb0\"\xf7\xb7\x91^\x8c\x98^]\xf4^`\x92" +
+	"\x80\xe1\xfaO\x9f\xfd\x87\xa1\xf7\xdfx.\xeb\x80\x9b;" +
+	"$r\xc0\xe1\x0eR|\xe9o\x07:\xcd\xf7\x0f\xbc0" +
+	"\xd3\x8f\xe1M';\xd6\xa2\xfaz\x07=\xf7j\xc7\x13" +
+	"\x80\x1f?z\xeb\xa1\x91\xb7W\xbf\xc4{0\xd7\xaa\x88" +
+	"\xde\xb9\x17\xd5\x1b;\xe9s\xaa\xb3\x97l\x94X\xa5\x85" +
+	"=\xd0\xe4\x91\xc5;Q=\xb9\x98>\x9f[\x1c\xb0\xaf" +
+	"\xbd\xfe{\xf7\xb4\x9d\xfe\xdeK\xadf\x92\x037\x16l" +
+	"T\xdf,\xd0\xe7\xeb\x85\x87$@\xbf\xe7\xc9?\xfd\x9b" +
+	"\x81\xda\xa9\x9f\xb6\xc8M\x97\xab'\xcf\xfbP}\xe5<" +
+	"\xfaz\xf1\xbc\x1b\x00\xfd[\xbf>\xb5w\xc3\xc5\xd3o" +
+	"\xb6\xda4\x10\xfc+\xea4\xaaW\xab\xc4}\x95J\xdc" +
+	"\xd2i\xad\xfb\xa6\x7f\xfd\xe6/2Qt\\\xfd\x15B" +
+	"\xce\xdf\xb0\xf9\xfa\x9d\xed7\xbe\xfdv6\x8a\x8e\xa8\x81" +
+	"\xb5\x1fW\xc9\x98\xcf(\xf7\xa8'~\xf8\xd7\xef\xd0C" +
+	"r\xab5_U\xb7\xa0\xfa\x16=\xb4\xf2\x97j\xa0C" +
+	"\x12\xcds\xf9\xfa\xd4\xf9}\xa8\xbe{>\xc9u\xfa|" +
+	"\x92\xeb\xaa\xed\xfdb\xeb7\xae}\x0f\x94\x1e6#7" +
+	"/\xbe\xa0\x0f\xd5\xab.\xa0C+.\x90Q}\x8b>" +
+	"\xfd\xef\xd6\xb7\xbc\xf2\xc1\xe0\x0f\x7f\xd7zy\xa0\xd0+" +
+	"t\xe4Tp\xe4\xcd\x0b\x02\xf3\xaf\\\xf1\x17\xbf=\xfc" +
+	"\x97\x83\x1f\xcc\xba\xfd+\xdd\x03\xa8\xae\xe8&9\x96w" +
+	"\x7fK\xdd\xd6\x1d\\\xfe\x9d\xd5\x1b\xaf^\xf6\x93\x0f\xb3" +
+	"\x96\x18\xea\xfe\x90,q]7Yb\xfc\x1b\xbf\xf9\xd6" +
+	"\xc5\xdf\xfd\xa7\x0f[\xdc\x130Nu_\x8a\xea\xed\xc1" +
+	"\x8d\xb7\x10\xf3\xfbk~\xf0FO\xa1\xe7\xa3\xb9\x04}" +
+	"\xa4\x9b\xe2\xa4;\x88\x93\xee@\xd0k\x7fu\xf4\x86\xd2" +
+	"\xf7?\xfa\x98\xf4b-\xc8\xf3n\xcf\x16T?\xeb\xa1" +
+	"\x9b?\xe9\xa1\xf0_\xf7\xd8\xa9oN\x1c~\xf9\x93V" +
+	"#\x04\x0e9~\xe1\x01T\x9f\xbb\x90\xb8\x9f\xbd\x90\xf0" +
+	"c\xdf\xfbG\x86\xef\xda\xfa\xd8\xe7Y\xad\x1eX\xf2|" +
+	"\xe0\xdf%\xa4\xd5\xce\xc3\xfb\xdc\xe1\xfb\xee\xf4\xe7J\x96" +
+	"W\x97\x0c\xa0\xfa\xcb%t\xdb\xa9%O\xc0r\xdf\xf5" +
+	"LS\x18v3W\xfd\xc3\xf8\xb3zyUk\x9a\xcd" +
+	"\xbe\xa1I\xddqu\xb3>\x16\xd0Ke\xcb\xd0\xabS" +
+	"eD\xde\x81\x12\x80\xb2\xb4\x0f\x00Q\xf9\xd2\x16\x00\x94" +
+	"\x14e\x00\xa0\xa4\xd7M\xcb\x16~Mw\xaa\x96i\x0a" +
+	"`Uw\xff\x0e\xcd\xd0\xcc\xaaH\x1ej\x9b\xfd\xd0\xb0" +
+	"0\x0c\xeb\x1a\xcb6j\x1bm\xbd\xae\x9b\x83\x969\xae" +
+	"\xd7\x01\xca\x88\xc91y\xf6\xb1AC\x17\xa6[\x11\xf6" +
+	"\x1e\xbd*.\xf7\x1c\x11\x9e\xf3l\xcd\xd5-\xf3\xa2Q" +
+	"\xe1x\x86\xeb\x00\xf0\x1c\xcb\x01\xe4\x10@\xe9\xec\x03\xe0" +
+	"\x0b\x18\xf2.\x09Kv\xc0\x80\xc54\xf3\x00\xb1\x08\xe9" +
+	"\x9b\xf9\xd9o\x86\xb6\xa07\x85}\xb9g\xda\xa2\xae;" +
+	"\xae\xb0C\xf2E\xa5\xb2fk\x0d'\xfb\xe0Q\x00^" +
+	"d\xc8\x97H\xe8\xd7m\xad*\xca\xc2F\xdd\xaam\xd0" +
+	"L\xab\xc2D\x15\xdb@\xc2\xb6\xcc\xa3s8b\x8d\xa6" +
+	"\x1b\xa2\x16jwy\xb57\xf8?/\xb2\\\x87\xef\x07" +
+	"\x8fh[\x00\xf8v\x86\xdc\x90\xb0\x13?\xf7\xbb\xa8H" +
+	")\xfa^\x00>\xc1\x90\xbb\x12vJ\x9f\xf9]\x81\xd7" +
+	"v/\x03\xe0\x06C>)a'\xfb\xd4\xef\xa2R\xa0" +
+	"x;\x01\xb8\xcb\x90\xdf$\xa1\xefxM\xb2\xa9\x03\xcc" +
+	"\xb2\xb1\x98\x86rd\x1dQ\xab\x93\xa5M(\x89*\x19" +
+	"\x1a\x8b1\xe2\x86\x0cr\xcd\x9a\xc0bZ\"\xa2c\xb6" +
+	"\xd8#lG\x94\xa1`[\x93SXL\x91\xb7\xc5\xea" +
+	"\x9d\xe7j\xf5\xd8\xd1\xc9\xa9\xf9\xcf\x07\xa1Yu/*" +
+	"\xf7\xcer\x16\xd9\xb1\x83!\xff\xb2\x84~\x93~\x15\xae" +
+	"\x00f;XLKo\x8b\xb4s\x84\xf3 \xfdw0" +
+	"|\xa5\x1c\xddb;A8\xf3%\xc9c\xcf\xd2c\xcf" +
+	"0\xe4/H\xa8 \x86>;i\x03\xf0\x13\x0c\xf9\xcb" +
+	"\x12\xa2\x14z\xec\xc5c\x00\xfce\x86\xfc\x0d\x09\x15&" +
+	"\x85\x0e{\xfdR\x00\xfe/\x0c\xf9\xaf%Tr\xac\x8b" +
+	"\xda\x0c\xe54\x05\xdb\xaf\x19\xf2\x8f$T\xdar]\xd8" +
+	"\x06\xa0|@\x9c\xbfa\xc8\xff[B%\xdf\xd6\x85y" +
+	"\x00\xe5\xbf\xae\x04\xe0\xbfc\xc8?\x95\xd0\xb7\xc2\xa4#" +
+	"M]\xec\x04\x09;\x01\xfd\xaaay\xb5qC\x83^" +
+	"[\xd4FV't\xd3k\x94m\xb1GG\xcbs\xfa" +
+	"]W4\xe4\xa6\xeb`\x1e$\xcc\x03\x16\\\xad\xee\xe0" +
+	"b\xc02C,\xa6\xd5\x0f\x90\x88\xc9\x9dh\x8b\xdaf" +
+	"a;:\xb3L\xec\x00\x09;\x00\x0b\xa6\xd6\x10\xf1?" +
+	"z\xeb\xb6\xe55\xe3\x7f\xcdg\xeb\xd1(\xaa(\xa6\xa2" +
+	"\x04\xb1l]\xae\xeb&\xef`\xb9%\xbe\x1f\x19v\x88" +
+	"\xac\xb0\x8a!_'\xe1R\xfc\x9c\xc8d\xdb\x91Q\x00" +
+	">\xcc\x90\x8fI\xb8T\xfa\x8c\xc8d]N\xbe)3" +
+	"\xe4[%,L\xb8n\x13\x8bi\xd5\x8c\x02\xe0\x06\xb1" +
+	"\xc3\xb1\xaa\xbb\x04 AH\x02\xe1\xd1\xaf\x13\x11\xa4\x01" +
+	"3jXL\xfb\xd0\x96\xe8asDO\x108%w" +
+	"\xc8\xb6-;@\xdb$d\x86\xaeL\x95\x88#fd" +
+	"K\xaa\x81\"\xad\x0a\xd5\xe2;R\xf9{\xab\x9a\xe7$" +
+	"\x96\xf5m\xe1\xdaS\xfd\xe3.0a'\xd8\xe3LX" +
+	"\x9eQ\x1b\x15 \xbb\xf6\x14\"H\x88\xf3#\xd2jk" +
+	"8c\xf20\xb43r\x92L\xab\x19\xf2r*\xe7z" +
+	"\xa2\xadc\xc8\xaf%9#\xf3o\"\xf3\x8f1\xe4M" +
+	"\x09}\x83r\xda\x1c\xb6\x809n\"nH,[A" +
+	"l\xca \xa1\x0c\xe8{M\xc7\xb5\x85\xd6\x00L\x82\x8d" +
+	"\xf8\x17\x9f\x03t\xb7@HY+\x04X0\xb7\x0eI" +
+	"z\xae_\x9bU\"\xca\xcfM\x03\xa9\xb1\xe7\xce\xa5\x09" +
+	"\xcbq)\xbc\x01 Vl\xbf\xd5$\xec$dIZ" +
+	"\xca\x96\xd88\xf7\x8a\x17V\x9f\x19\xf5\xeeX\xa6\xfcT" +
+	"\xa3\xd3\x18\x1c\x1f\xb4Ly\\\xafc1\xed\xc1Z\x04" +
+	"\x98\xc3\xef\xfd\x9e;!LW\xaf\x06\x0f\xce\xf2\xfb\xb2" +
+	"4>\x13\x9b\x8d\\\x991dl\xb3\xf5;RC\xca" +
+	"\xbb\xc4T\x92\xf8\xa2\xa1\xe9F\xe2\xfd\xc8\x9a\xfd \x7f" +
+	";\xe5\x99\xb7e\x89jSX\x99J\xa1yH\xc8\xae" +
+	"D\xc8\x1b\xa7\x01\xf8M\x0c\xf9\x1d\x19!o\xbf\x07\x80" +
+	"\xdf\xc1\x90\xdf\x97\x11\xf209\xf6\x10C~?\x01/" +
+	"\x0b\xa1\xe1\x08Y\xf4~\x86\xfca\x091\x17\xe2\xeeq" +
+	"\xc2\xdd\x87\x19\xf2g\xa4\x00 \x87\xfb\x07-\x13#!" +
+	"\x1c\x80\x18\x1e\xfd\x09\xa1\xd9\xee\x0e\xa1\xa1;b\xba\xc2" +
+	"\xde\xa3\xa1\x11\xe7\xe0~Wo\x08\xcbs\x93\x9clh" +
+	"\x93A\xdd\xc7\xdapxJ\xd6\\\x07\xdbA\xc2vJ" +
+	"\x01G\xd8\x83\xb6\xa8!yC3\xca\x1as'\xce\xc6" +
+	"@3\xf1\xb20\x87y\xa8k\xd8\xc7\x90\xdfF\xb9\x8b" +
+	"\x99!R\xb9\xa5\x0f\xa4 uI\xe7\xc6@\xda]\x04" +
+	"U\x89j\xcd\xee{\xd26\"\xa8JTkn<\x9a" +
+	"\x1a<\x12m\xd8\x82R\x98\x12\xb1\xcc\xa5\xd0\xd5\xfb\x09" +
+	"\x9et\x91\xea\x19\x15k\x1d-s,0\x10\xa6\x16\xaa" +
+	"Z\x8d\xa6-\x1c\x07u\xcb\xe4\x9ef\xe8\xcc\x9dJ\x0e" +
+	"\xcek\x03\xca\xfd0g66{\x03'\x91\x11\xae\x88" +
+	"\x8d\xa0\xf6\xe3Z\x80\xca*dXY\x87i\x98\xa8#" +
+	"8\x00PYM\xf42\xa6\x91\xa2\xae\xc7\x1e\x80\xca0" +
+	"\xd1\xc7PB\x0ccE\xe5\xf8(@e\x8c\xc8\xdb1" +
+	"\xad\xd3\xea\xb6\xe0\xfa\xadD\x9f\xc0\xb4T\xab\x02/\x05" +
+	"\xa8l'\xfa>\xa2\xe7\xa5\xc0\x82\xea\x14\xee\x04\xa8L" +
+	"\x12\xfd \xd1\xe5\xb6.\xea\xfa\xd5\x9b\xd1\x06\xa8\xdcD" +
+	"\xf4;\x88\xbe\xe0\xcb]\xb8\x00@\xbd=\xa0\xdfF\xf4" +
+	"{\x89\xde\xde\xdd\x85\xed\x00\xea\xddx\x00\xa0r\x88\xe8" +
+	"\xf7\x13}!v\xe1B\x00\xf5\x08\x1e\x05\xa8\xdcO\xf4" +
+	"\x87\x89\xbe(\xdf\x85\x8b\x00\xd4\xe3\x81<\x0f\x12\xfd1" +
+	"L\x00d\xa4\x96\xc51\x0a'=-\xe3\xccr\x920" +
+	"\x14\xd1\xfc\x80!\xc8\x96\xad\x02\x0d\x10XH\xf77\x80" +
+	"X\x00\xf4\x9b\x96el\x98\x89\x8fg\xea$\xa2\xb0\x80" +
+	"\x82e\x8e\xd4\x92\xfc\x0a\x83h\x9d\x05\xbdU\xcd\x18I" +
+	"\x1b\x08\xdd\xe9\xf7\\\xcbkBoMsE-\xa9p" +
+	"\xb6g\xae\xb1\xad\xc6\x18\x0a\xbb\xa1\x9b\x9a\x01\xc9/\xf3" +
+	"\xc5V\xc1\xf3\xf4\xda\xacd\x93Z\x03\xad\xb7\xd97\xa6" +
+	"\x05\xd9\xb5 \xc9\xaeK\xa8\x0d\xb9\x88!\xbf\"\x03>" +
+	"\xcb\x09!\xbf\xc6\x90\xff\x91\xd4\xd2\x06\xed\xd1\x0cO\x9c" +
+	"M\x1b\xb4\xa9\xa5\x14\x84-q\x88\xcf\x99\xd7\x07\xd2\xd7" +
+	"\x93\xc7\xa9\xe3\xbc\x8c!\x1f\x96p\xbf\xe3U\xab\xa4t" +
+	"l\x85\xf1h\xf0\x80^\xba;\xe3\x8fd'\x10\xf9\xe3" +
+	"l\xcbn]\xb8\xe1\xd7\x889nQ\xbd\x92\xb5\x86\xf3" +
+	"\x7f<=*\x9c\x02\xf5\xfdg\x1c\xef\x92)\xff\xcc\xf5" +
+	"mxl\xac\x9c\xce\xa0,\x04\xc7,.\x8cfq!" +
+	"\x85\x85\x9d\xd9\xf4\x8f\xdb0\x95\x07yX&\xfaVL" +
+	"\x9bw\xf5:<6#\xffs\xfd!.\x88\xe0\xfa\x1a" +
+	"\xd1\x9b\x01.`\x88\x0b\x8d\xe0~\x83\xe8\x93Y\\\xf0" +
+	"pz&.\xb0\x18\x17(\x9f\x0f\x12\xfdP\x80\x0b\xb9" +
+	"\x10\x17\xee\xc4\xa7g\xe4\x7f{[\x88\x0bG\xf0\xf9\x19" +
+	"\xf9\xbf0\x1f\xe2\xc2\xf1\x80\xffa\xa2?\x13\xe0\xc2@" +
+	"\x88\x0bO\x058\xf2$\xd1O\x10.x\xb6Qqm" +
+	"\xdd\x04\xac\xa7\xc1Zm~[\x88f?\x14\x0c}\x8f" +
+	"H0\xbb\xa6k\xc6jO3\xa0\xb7\xe2j\xd5]i" +
+	"\xafi8\xc3\x9aYspB\xdb%\x08\xe9\xe5l-" +
+	"t\x0dg\xb3\xb0\xf5q\xc0\xb4;Mz\x83B\xd9\xb2" +
+	"Z[\x86\xa0\xc9\x11v\x08*\xc9o\x0dmr\xa4f" +
+	"\x88A\x8c;\x04f\xa6\x95F\xa7_,\xd3\xc4\xb0l" +
+	"\x8f\xe9\xbd3\xebq3\xeaw\xe3\xba>Vj)\xd8" +
+	"b\xb2)\xaa\xee\xa0\x85\xa6\xab\x9b\x9e\x98uAu\xc2" +
+	"3w\x89\xda\x10\x9aU\xab\xa6\x9bu\x98\xd5h\xb3/" +
+	"\x1a\xfd3\x8dL\x90\xcd\x98\xd98+\x97PY\xc6\xa8" +
+	",+}\xe9\x08[\xaa\x06\xa7J\xb6\xd0\x9c\x14\xa1\xe7" +
+	"{-\xda\xf4\x84IF\xaf\x15Y\x1b@\xb2\xbf\xc5x" +
+	"\xa1\xa6\xec\xde\x0b\x92\xa2\xcb\x98\xee!1^;*\xdb" +
+	"l\x90\x94M2J\xc9\xda\x1c\xe3\x95\xb722\x0d\x92" +
+	"2$#Kv\xdd\x18\xaf\xb3\x94\xab\x07@R\x96\xcb" +
+	"~\xdc\x9aC)\x14g\x15\xfaq\xe2Co\x90\xfa\xab" +
+	"\xd0\x8f\x97\x00\x18\xb7\xf0\x00\xabp\x7fT\x16Vav" +
+	"s\xc4\xbe\xa8\x8f\x9e\xbb=$\x8c\x9cd\xc8\x0f\xa6\x18" +
+	"y3\xb5\x8c\x07\x19\xf2C\x99\xd9\xe5\xceG\xb3\xdda" +
+	"4\x96\x1f9\x00\xc0\xef\x0b;\xc1d,\x7f\xeaX4" +
+	"\xe9\xffLJ\xebe\x1cv\xf1\xb2\x05-;\x1e\xa6\xe6" +
+	"\xd9\xb9D\xc1\x19un\xad\x9b\x17\xbffM\x04\x9d\x1d" +
+	"\x86W9\x90\"vv\x1d\xb38\xb3\x8e\xc1x\x8c\x93" +
+	"g\x00|v9\xb3x~\xcc\x9c1\x94\x04\x15'\x17" +
+	"DM\xbc\xd4\xc7\xf8\xcf+\x8aB\xde\xef\x94\xfdxp" +
+	"\xc1\xb8\\\x91\xf3\xb2.;\xc7\xe9mT\xf4:gS" +
+	"\x09\xe2\x15\xee\x99\x87\xf0\xf0\x9d\x02\x05[\xa8Pr\xef" +
+	"\xce\xcc\x8a\xc8\xb0\xa29\xa8\xb0!S\xb5\xe7\xb3U(" +
+	"p\xdc\x80\x16\xe8pK\xf8-K\xc3/i\x10n^" +
+	"\x96\xf6\xe4\xc9tr\xcb\xda((\x1fL\x1aN\xe5\x01" +
+	"\x0a\xd4\x07\x19\xf2\xc72\xe1\xf7\xc8\xdat:\x91\x85m" +
+	"\xc7r\xca\x9e\x9d\xc2\xa6a\xd5\xd7\xe9\xa6p\xa8\x05k" +
+	"\x19\xa9\x9b\xc2nh\xa60\xd1%0\xf2lB\xd4\x99" +
+	"\xc85\xb2:\xd3\xb9\xcd\xa7~%\x0a\xf60\xd6\xa3\xf2" +
+	"\x9a\x99\x1f\x8fev\x19\xb1\xf2\xfc\xf9hG\xb0=\xa3" +
+	"\xfc6\x9a\x1f\xb72\xe4\x13\x12\xfa\x9a\xe7Z\x9b\x9a5" +
+	"\x0d]\xb1\xc6\x16\xbb=!\x9b\xd5\xa9t\x8e\xa2\x89\xa2" +
+	"\xeal\xc2&\xf5~klQ\xda\xed\x89,C\xbc\x95" +
+	"\x05Y\xb7j\xb3\xd6\xb1s4[\xd7\x88\x1d\x15\xab\xba" +
+	"K\xb83\xb6\xd5!\\\xc6\xaah\xa3\xe9J6\xd6D" +
+	"\x1f\xcd\x8cL1\x8c\xec\xa6\x80j2\xe4\xfb202" +
+	"5\x9d:|\xee\xea\xfa\xffS\x10\xe7Qr\xce\x95\xe9" +
+	"hI\x9cU\xa2\xa5\x7f\x828s\xcb\x15\x8d\xebQ\xc7" +
+	"z6\x0b\x85\x19\x1b\xaf( \xf8\xcet\x09\x13\x04y" +
+	"1\xfd\x8bf$\x83\x13\xb5\x8e\xc0\xc6\xad9\xba\xc2p" +
+	"\xb8\x19\xb4 \x82\xd6\xd6\xb5\xc8\xff\x06\x00\x00\xff\xffX" +
+	"t1W"

 func init() {
 	schemas.Register(schema_db8274f9144abc7e,
@@ -3914,11 +3810,9 @@ func init() {
 		0xb70431c0dc014915,
 		0xb9d4ef45c2b5fc5b,
 		0xc082ef6e0d42ed1d,
-		0xc54a4a6fd4d87596,
 		0xc744e349009087aa,
 		0xc766a92976e389c4,
 		0xc793e50592935b4a,
-		0xc9c82ee56583acfa,
 		0xcbd96442ae3bb01a,
 		0xd58a254e7a792b87,
 		0xdc3ed6801961e502,
@@ -1,7 +1,6 @@
 package validation

 import (
-	"context"
 	"fmt"
 	"net"
 	"net/url"
@@ -10,21 +9,15 @@ import (

 	"net/http"

-	"github.com/coreos/go-oidc"
 	"github.com/pkg/errors"
 	"golang.org/x/net/idna"
 )

-const (
-	defaultScheme   = "http"
-	accessDomain    = "cloudflareaccess.com"
-	accessCertPath  = "/cdn-cgi/access/certs"
-	accessJwtHeader = "Cf-access-jwt-assertion"
-)
+const defaultScheme = "http"

 var (
 	supportedProtocols = []string{"http", "https", "rdp"}
-	validationTimeout  = time.Duration(30 * time.Second)
+	validationTimeout = time.Duration(30 * time.Second)
 )

 func ValidateHostname(hostname string) (string, error) {
@@ -204,50 +197,3 @@ func toggleProtocol(httpProtocol string) string {
 		return httpProtocol
 	}
 }
-
-// Access checks if a JWT from Cloudflare Access is valid.
-type Access struct {
-	verifier *oidc.IDTokenVerifier
-}
-
-func NewAccessValidator(ctx context.Context, domain, issuer, applicationAUD string) (*Access, error) {
-	domainURL, err := ValidateUrl(domain)
-	if err != nil {
-		return nil, err
-	}
-
-	issuerURL, err := ValidateUrl(issuer)
-	if err != nil {
-		return nil, err
-	}
-
-	// An issuerURL from Cloudflare Access will always use HTTPS.
-	issuerURL = strings.Replace(issuerURL, "http:", "https:", 1)
-
-	keySet := oidc.NewRemoteKeySet(ctx, domainURL+accessCertPath)
-	return &Access{oidc.NewVerifier(issuerURL, keySet, &oidc.Config{ClientID: applicationAUD})}, nil
-}
-
-func (a *Access) Validate(ctx context.Context, jwt string) error {
-	token, err := a.verifier.Verify(ctx, jwt)
-
-	if err != nil {
-		return errors.Wrapf(err, "token is invalid: %s", jwt)
-	}
-
-	// Perform extra sanity checks, just to be safe.
-
-	if token == nil {
-		return fmt.Errorf("token is nil: %s", jwt)
-	}
-
-	if !strings.HasSuffix(token.Issuer, accessDomain) {
-		return fmt.Errorf("token has non-cloudflare issuer of %s: %s", token.Issuer, jwt)
-	}
-
-	return nil
-}
-
-func (a *Access) ValidateRequest(ctx context.Context, r *http.Request) error {
-	return a.Validate(ctx, r.Header.Get(accessJwtHeader))
-}
@@ -320,39 +320,6 @@ func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
 	}
 }

-func TestNewAccessValidatorOk(t *testing.T) {
-	ctx := context.Background()
-	url := "test.cloudflareaccess.com"
-	access, err := NewAccessValidator(ctx, url, url, "")
-
-	assert.NoError(t, err)
-	assert.NotNil(t, access)
-
-	assert.Error(t, access.Validate(ctx, ""))
-	assert.Error(t, access.Validate(ctx, "invalid"))
-
-	req := httptest.NewRequest("GET", "https://test.cloudflareaccess.com", nil)
-	req.Header.Set(accessJwtHeader, "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c")
-	assert.Error(t, access.ValidateRequest(ctx, req))
-}
-
-func TestNewAccessValidatorErr(t *testing.T) {
-	ctx := context.Background()
-
-	urls := []string{
-		"",
-		"tcp://test.cloudflareaccess.com",
-		"wss://cloudflarenone.com",
-	}
-
-	for _, url := range urls {
-		access, err := NewAccessValidator(ctx, url, url, "")
-
-		assert.Error(t, err, url)
-		assert.Nil(t, access)
-	}
-}
-
 type testRoundTripper func(req *http.Request) (*http.Response, error)

 func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
@@ -1,277 +0,0 @@
-// Copyright 2016 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package civil implements types for civil time, a time-zone-independent
-// representation of time that follows the rules of the proleptic
-// Gregorian calendar with exactly 24-hour days, 60-minute hours, and 60-second
-// minutes.
-//
-// Because they lack location information, these types do not represent unique
-// moments or intervals of time. Use time.Time for that purpose.
-package civil
-
-import (
-	"fmt"
-	"time"
-)
-
-// A Date represents a date (year, month, day).
-//
-// This type does not include location information, and therefore does not
-// describe a unique 24-hour timespan.
-type Date struct {
-	Year  int        // Year (e.g., 2014).
-	Month time.Month // Month of the year (January = 1, ...).
-	Day   int        // Day of the month, starting at 1.
-}
-
-// DateOf returns the Date in which a time occurs in that time's location.
-func DateOf(t time.Time) Date {
-	var d Date
-	d.Year, d.Month, d.Day = t.Date()
-	return d
-}
-
-// ParseDate parses a string in RFC3339 full-date format and returns the date value it represents.
-func ParseDate(s string) (Date, error) {
-	t, err := time.Parse("2006-01-02", s)
-	if err != nil {
-		return Date{}, err
-	}
-	return DateOf(t), nil
-}
-
-// String returns the date in RFC3339 full-date format.
-func (d Date) String() string {
-	return fmt.Sprintf("%04d-%02d-%02d", d.Year, d.Month, d.Day)
-}
-
-// IsValid reports whether the date is valid.
-func (d Date) IsValid() bool {
-	return DateOf(d.In(time.UTC)) == d
-}
-
-// In returns the time corresponding to time 00:00:00 of the date in the location.
-//
-// In is always consistent with time.Date, even when time.Date returns a time
-// on a different day. For example, if loc is America/Indiana/Vincennes, then both
-//     time.Date(1955, time.May, 1, 0, 0, 0, 0, loc)
-// and
-//     civil.Date{Year: 1955, Month: time.May, Day: 1}.In(loc)
-// return 23:00:00 on April 30, 1955.
-//
-// In panics if loc is nil.
-func (d Date) In(loc *time.Location) time.Time {
-	return time.Date(d.Year, d.Month, d.Day, 0, 0, 0, 0, loc)
-}
-
-// AddDays returns the date that is n days in the future.
-// n can also be negative to go into the past.
-func (d Date) AddDays(n int) Date {
-	return DateOf(d.In(time.UTC).AddDate(0, 0, n))
-}
-
-// DaysSince returns the signed number of days between the date and s, not including the end day.
-// This is the inverse operation to AddDays.
-func (d Date) DaysSince(s Date) (days int) {
-	// We convert to Unix time so we do not have to worry about leap seconds:
-	// Unix time increases by exactly 86400 seconds per day.
-	deltaUnix := d.In(time.UTC).Unix() - s.In(time.UTC).Unix()
-	return int(deltaUnix / 86400)
-}
-
-// Before reports whether d1 occurs before d2.
-func (d1 Date) Before(d2 Date) bool {
-	if d1.Year != d2.Year {
-		return d1.Year < d2.Year
-	}
-	if d1.Month != d2.Month {
-		return d1.Month < d2.Month
-	}
-	return d1.Day < d2.Day
-}
-
-// After reports whether d1 occurs after d2.
-func (d1 Date) After(d2 Date) bool {
-	return d2.Before(d1)
-}
-
-// MarshalText implements the encoding.TextMarshaler interface.
-// The output is the result of d.String().
-func (d Date) MarshalText() ([]byte, error) {
-	return []byte(d.String()), nil
-}
-
-// UnmarshalText implements the encoding.TextUnmarshaler interface.
-// The date is expected to be a string in a format accepted by ParseDate.
-func (d *Date) UnmarshalText(data []byte) error {
-	var err error
-	*d, err = ParseDate(string(data))
-	return err
-}
-
-// A Time represents a time with nanosecond precision.
-//
-// This type does not include location information, and therefore does not
-// describe a unique moment in time.
-//
-// This type exists to represent the TIME type in storage-based APIs like BigQuery.
-// Most operations on Times are unlikely to be meaningful. Prefer the DateTime type.
-type Time struct {
-	Hour       int // The hour of the day in 24-hour format; range [0-23]
-	Minute     int // The minute of the hour; range [0-59]
-	Second     int // The second of the minute; range [0-59]
-	Nanosecond int // The nanosecond of the second; range [0-999999999]
-}
-
-// TimeOf returns the Time representing the time of day in which a time occurs
-// in that time's location. It ignores the date.
-func TimeOf(t time.Time) Time {
-	var tm Time
-	tm.Hour, tm.Minute, tm.Second = t.Clock()
-	tm.Nanosecond = t.Nanosecond()
-	return tm
-}
-
-// ParseTime parses a string and returns the time value it represents.
-// ParseTime accepts an extended form of the RFC3339 partial-time format. After
-// the HH:MM:SS part of the string, an optional fractional part may appear,
-// consisting of a decimal point followed by one to nine decimal digits.
-// (RFC3339 admits only one digit after the decimal point).
-func ParseTime(s string) (Time, error) {
-	t, err := time.Parse("15:04:05.999999999", s)
-	if err != nil {
-		return Time{}, err
-	}
-	return TimeOf(t), nil
-}
-
-// String returns the date in the format described in ParseTime. If Nanoseconds
-// is zero, no fractional part will be generated. Otherwise, the result will
-// end with a fractional part consisting of a decimal point and nine digits.
-func (t Time) String() string {
-	s := fmt.Sprintf("%02d:%02d:%02d", t.Hour, t.Minute, t.Second)
-	if t.Nanosecond == 0 {
-		return s
-	}
-	return s + fmt.Sprintf(".%09d", t.Nanosecond)
-}
-
-// IsValid reports whether the time is valid.
-func (t Time) IsValid() bool {
-	// Construct a non-zero time.
-	tm := time.Date(2, 2, 2, t.Hour, t.Minute, t.Second, t.Nanosecond, time.UTC)
-	return TimeOf(tm) == t
-}
-
-// MarshalText implements the encoding.TextMarshaler interface.
-// The output is the result of t.String().
-func (t Time) MarshalText() ([]byte, error) {
-	return []byte(t.String()), nil
-}
-
-// UnmarshalText implements the encoding.TextUnmarshaler interface.
-// The time is expected to be a string in a format accepted by ParseTime.
-func (t *Time) UnmarshalText(data []byte) error {
-	var err error
-	*t, err = ParseTime(string(data))
-	return err
-}
-
-// A DateTime represents a date and time.
-//
-// This type does not include location information, and therefore does not
-// describe a unique moment in time.
-type DateTime struct {
-	Date Date
-	Time Time
-}
-
-// Note: We deliberately do not embed Date into DateTime, to avoid promoting AddDays and Sub.
-
-// DateTimeOf returns the DateTime in which a time occurs in that time's location.
-func DateTimeOf(t time.Time) DateTime {
-	return DateTime{
-		Date: DateOf(t),
-		Time: TimeOf(t),
-	}
-}
-
-// ParseDateTime parses a string and returns the DateTime it represents.
-// ParseDateTime accepts a variant of the RFC3339 date-time format that omits
-// the time offset but includes an optional fractional time, as described in
-// ParseTime. Informally, the accepted format is
-//     YYYY-MM-DDTHH:MM:SS[.FFFFFFFFF]
-// where the 'T' may be a lower-case 't'.
-func ParseDateTime(s string) (DateTime, error) {
-	t, err := time.Parse("2006-01-02T15:04:05.999999999", s)
-	if err != nil {
-		t, err = time.Parse("2006-01-02t15:04:05.999999999", s)
-		if err != nil {
-			return DateTime{}, err
-		}
-	}
-	return DateTimeOf(t), nil
-}
-
-// String returns the date in the format described in ParseDate.
-func (dt DateTime) String() string {
-	return dt.Date.String() + "T" + dt.Time.String()
-}
-
-// IsValid reports whether the datetime is valid.
-func (dt DateTime) IsValid() bool {
-	return dt.Date.IsValid() && dt.Time.IsValid()
-}
-
-// In returns the time corresponding to the DateTime in the given location.
-//
-// If the time is missing or ambigous at the location, In returns the same
-// result as time.Date. For example, if loc is America/Indiana/Vincennes, then
-// both
-//     time.Date(1955, time.May, 1, 0, 30, 0, 0, loc)
-// and
-//     civil.DateTime{
-//         civil.Date{Year: 1955, Month: time.May, Day: 1}},
-//         civil.Time{Minute: 30}}.In(loc)
-// return 23:30:00 on April 30, 1955.
-//
-// In panics if loc is nil.
-func (dt DateTime) In(loc *time.Location) time.Time {
-	return time.Date(dt.Date.Year, dt.Date.Month, dt.Date.Day, dt.Time.Hour, dt.Time.Minute, dt.Time.Second, dt.Time.Nanosecond, loc)
-}
-
-// Before reports whether dt1 occurs before dt2.
-func (dt1 DateTime) Before(dt2 DateTime) bool {
-	return dt1.In(time.UTC).Before(dt2.In(time.UTC))
-}
-
-// After reports whether dt1 occurs after dt2.
-func (dt1 DateTime) After(dt2 DateTime) bool {
-	return dt2.Before(dt1)
-}
-
-// MarshalText implements the encoding.TextMarshaler interface.
-// The output is the result of dt.String().
-func (dt DateTime) MarshalText() ([]byte, error) {
-	return []byte(dt.String()), nil
-}
-
-// UnmarshalText implements the encoding.TextUnmarshaler interface.
-// The datetime is expected to be a string in a format accepted by ParseDateTime
-func (dt *DateTime) UnmarshalText(data []byte) error {
-	var err error
-	*dt, err = ParseDateTime(string(data))
-	return err
-}
@@ -1,3 +0,0 @@
-/examples/blog/blog
-/examples/orders/orders
-/examples/basic/basic
@@ -1,25 +0,0 @@
-language: go
-
-go_import_path: github.com/DATA-DOG/go-sqlmock
-
-go:
-  - 1.2.x
-  - 1.3.x
-  - 1.4 # has no cover tool for latest releases
-  - 1.5.x
-  - 1.6.x
-  - 1.7.x
-  - 1.8.x
-  - 1.9.x
-  - 1.10.x
-  - 1.11.x
-
-sudo: false
-
-script:
-  - go vet
-  - test -z "$(go fmt ./...)" # fail if not formatted properly
-  - go test -race -coverprofile=coverage.txt -covermode=atomic
-
-after_success:
-  - bash <(curl -s https://codecov.io/bash)
@@ -1,28 +0,0 @@
-The three clause BSD license (http://en.wikipedia.org/wiki/BSD_licenses)
-
-Copyright (c) 2013-2019, DATA-DOG team
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-
-* The name DataDog.lt may not be used to endorse or promote products
-  derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL MICHAEL BOSTOCK BE LIABLE FOR ANY DIRECT,
-INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
-EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -1,259 +0,0 @@
-[![Build Status](https://travis-ci.org/DATA-DOG/go-sqlmock.svg)](https://travis-ci.org/DATA-DOG/go-sqlmock)
-[![GoDoc](https://godoc.org/github.com/DATA-DOG/go-sqlmock?status.svg)](https://godoc.org/github.com/DATA-DOG/go-sqlmock)
-[![Go Report Card](https://goreportcard.com/badge/github.com/DATA-DOG/go-sqlmock)](https://goreportcard.com/report/github.com/DATA-DOG/go-sqlmock)
-[![codecov.io](https://codecov.io/github/DATA-DOG/go-sqlmock/branch/master/graph/badge.svg)](https://codecov.io/github/DATA-DOG/go-sqlmock)
-
-# Sql driver mock for Golang
-
-**sqlmock** is a mock library implementing [sql/driver](https://godoc.org/database/sql/driver). Which has one and only
-purpose - to simulate any **sql** driver behavior in tests, without needing a real database connection. It helps to
-maintain correct **TDD** workflow.
-
- this library is now complete and stable. (you may not find new changes for this reason)
- supports concurrency and multiple connections.
- supports **go1.8** Context related feature mocking and Named sql parameters.
- does not require any modifications to your source code.
- the driver allows to mock any sql driver method behavior.
- has strict by default expectation order matching.
- has no third party dependencies.
-
-**NOTE:** in **v1.2.0** **sqlmock.Rows** has changed to struct from interface, if you were using any type references to that
-interface, you will need to switch it to a pointer struct type. Also, **sqlmock.Rows** were used to implement **driver.Rows**
-interface, which was not required or useful for mocking and was removed. Hope it will not cause issues.
-
-## Install
-
-    go get github.com/DATA-DOG/go-sqlmock
-
-## Documentation and Examples
-
-Visit [godoc](http://godoc.org/github.com/DATA-DOG/go-sqlmock) for general examples and public api reference.
-See **.travis.yml** for supported **go** versions.
-Different use case, is to functionally test with a real database - [go-txdb](https://github.com/DATA-DOG/go-txdb)
-all database related actions are isolated within a single transaction so the database can remain in the same state.
-
-See implementation examples:
-
- [blog API server](https://github.com/DATA-DOG/go-sqlmock/tree/master/examples/blog)
- [the same orders example](https://github.com/DATA-DOG/go-sqlmock/tree/master/examples/orders)
-
-### Something you may want to test, assuming you use the [go-mysql-driver](https://github.com/go-sql-driver/mysql)
-
-``` go
-package main
-
-import (
-	"database/sql"
-
-	_ "github.com/go-sql-driver/mysql"
-)
-
-func recordStats(db *sql.DB, userID, productID int64) (err error) {
-	tx, err := db.Begin()
-	if err != nil {
-		return
-	}
-
-	defer func() {
-		switch err {
-		case nil:
-			err = tx.Commit()
-		default:
-			tx.Rollback()
-		}
-	}()
-
-	if _, err = tx.Exec("UPDATE products SET views = views + 1"); err != nil {
-		return
-	}
-	if _, err = tx.Exec("INSERT INTO product_viewers (user_id, product_id) VALUES (?, ?)", userID, productID); err != nil {
-		return
-	}
-	return
-}
-
-func main() {
-	// @NOTE: the real connection is not required for tests
-	db, err := sql.Open("mysql", "root@/blog")
-	if err != nil {
-		panic(err)
-	}
-	defer db.Close()
-
-	if err = recordStats(db, 1 /*some user id*/, 5 /*some product id*/); err != nil {
-		panic(err)
-	}
-}
-```
-
-### Tests with sqlmock
-
-``` go
-package main
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-)
-
-// a successful case
-func TestShouldUpdateStats(t *testing.T) {
-	db, mock, err := sqlmock.New()
-	if err != nil {
-		t.Fatalf("an error '%s' was not expected when opening a stub database connection", err)
-	}
-	defer db.Close()
-
-	mock.ExpectBegin()
-	mock.ExpectExec("UPDATE products").WillReturnResult(sqlmock.NewResult(1, 1))
-	mock.ExpectExec("INSERT INTO product_viewers").WithArgs(2, 3).WillReturnResult(sqlmock.NewResult(1, 1))
-	mock.ExpectCommit()
-
-	// now we execute our method
-	if err = recordStats(db, 2, 3); err != nil {
-		t.Errorf("error was not expected while updating stats: %s", err)
-	}
-
-	// we make sure that all expectations were met
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("there were unfulfilled expectations: %s", err)
-	}
-}
-
-// a failing test case
-func TestShouldRollbackStatUpdatesOnFailure(t *testing.T) {
-	db, mock, err := sqlmock.New()
-	if err != nil {
-		t.Fatalf("an error '%s' was not expected when opening a stub database connection", err)
-	}
-	defer db.Close()
-
-	mock.ExpectBegin()
-	mock.ExpectExec("UPDATE products").WillReturnResult(sqlmock.NewResult(1, 1))
-	mock.ExpectExec("INSERT INTO product_viewers").
-		WithArgs(2, 3).
-		WillReturnError(fmt.Errorf("some error"))
-	mock.ExpectRollback()
-
-	// now we execute our method
-	if err = recordStats(db, 2, 3); err == nil {
-		t.Errorf("was expecting an error, but there was none")
-	}
-
-	// we make sure that all expectations were met
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("there were unfulfilled expectations: %s", err)
-	}
-}
-```
-
-## Customize SQL query matching
-
-There were plenty of requests from users regarding SQL query string validation or different matching option.
-We have now implemented the `QueryMatcher` interface, which can be passed through an option when calling
-`sqlmock.New` or `sqlmock.NewWithDSN`.
-
-This now allows to include some library, which would allow for example to parse and validate `mysql` SQL AST.
-And create a custom QueryMatcher in order to validate SQL in sophisticated ways.
-
-By default, **sqlmock** is preserving backward compatibility and default query matcher is `sqlmock.QueryMatcherRegexp`
-which uses expected SQL string as a regular expression to match incoming query string. There is an equality matcher:
-`QueryMatcherEqual` which will do a full case sensitive match.
-
-In order to customize the QueryMatcher, use the following:
-
-``` go
-	db, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-```
-
-The query matcher can be fully customized based on user needs. **sqlmock** will not
-provide a standard sql parsing matchers, since various drivers may not follow the same SQL standard.
-
-## Matching arguments like time.Time
-
-There may be arguments which are of `struct` type and cannot be compared easily by value like `time.Time`. In this case
-**sqlmock** provides an [Argument](https://godoc.org/github.com/DATA-DOG/go-sqlmock#Argument) interface which
-can be used in more sophisticated matching. Here is a simple example of time argument matching:
-
-``` go
-type AnyTime struct{}
-
-// Match satisfies sqlmock.Argument interface
-func (a AnyTime) Match(v driver.Value) bool {
-	_, ok := v.(time.Time)
-	return ok
-}
-
-func TestAnyTimeArgument(t *testing.T) {
-	t.Parallel()
-	db, mock, err := New()
-	if err != nil {
-		t.Errorf("an error '%s' was not expected when opening a stub database connection", err)
-	}
-	defer db.Close()
-
-	mock.ExpectExec("INSERT INTO users").
-		WithArgs("john", AnyTime{}).
-		WillReturnResult(NewResult(1, 1))
-
-	_, err = db.Exec("INSERT INTO users(name, created_at) VALUES (?, ?)", "john", time.Now())
-	if err != nil {
-		t.Errorf("error '%s' was not expected, while inserting a row", err)
-	}
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("there were unfulfilled expectations: %s", err)
-	}
-}
-```
-
-It only asserts that argument is of `time.Time` type.
-
-## Run tests
-
-    go test -race
-
-## Change Log
-
- **2019-02-13** - added `go.mod` removed the references and suggestions using `gopkg.in`.
- **2018-12-11** - added expectation of Rows to be closed, while mocking expected query.
- **2018-12-11** - introduced an option to provide **QueryMatcher** in order to customize SQL query matching.
- **2017-09-01** - it is now possible to expect that prepared statement will be closed,
-  using **ExpectedPrepare.WillBeClosed**.
- **2017-02-09** - implemented support for **go1.8** features. **Rows** interface was changed to struct
-  but contains all methods as before and should maintain backwards compatibility. **ExpectedQuery.WillReturnRows** may now
-  accept multiple row sets.
- **2016-11-02** - `db.Prepare()` was not validating expected prepare SQL
-  query. It should still be validated even if Exec or Query is not
-  executed on that prepared statement.
- **2016-02-23** - added **sqlmock.AnyArg()** function to provide any kind
-  of argument matcher.
- **2016-02-23** - convert expected arguments to driver.Value as natural
-  driver does, the change may affect time.Time comparison and will be
-  stricter. See [issue](https://github.com/DATA-DOG/go-sqlmock/issues/31).
- **2015-08-27** - **v1** api change, concurrency support, all known issues fixed.
- **2014-08-16** instead of **panic** during reflect type mismatch when comparing query arguments - now return error
- **2014-08-14** added **sqlmock.NewErrorResult** which gives an option to return driver.Result with errors for
-interface methods, see [issue](https://github.com/DATA-DOG/go-sqlmock/issues/5)
- **2014-05-29** allow to match arguments in more sophisticated ways, by providing an **sqlmock.Argument** interface
- **2014-04-21** introduce **sqlmock.New()** to open a mock database connection for tests. This method
-calls sql.DB.Ping to ensure that connection is open, see [issue](https://github.com/DATA-DOG/go-sqlmock/issues/4).
-This way on Close it will surely assert if all expectations are met, even if database was not triggered at all.
-The old way is still available, but it is advisable to call db.Ping manually before asserting with db.Close.
- **2014-02-14** RowsFromCSVString is now a part of Rows interface named as FromCSVString.
-It has changed to allow more ways to construct rows and to easily extend this API in future.
-See [issue 1](https://github.com/DATA-DOG/go-sqlmock/issues/1)
-**RowsFromCSVString** is deprecated and will be removed in future
-
-## Contributions
-
-Feel free to open a pull request. Note, if you wish to contribute an extension to public (exported methods or types) -
-please open an issue before, to discuss whether these changes can be accepted. All backward incompatible changes are
-and will be treated cautiously
-
-## License
-
-The [three clause BSD license](http://en.wikipedia.org/wiki/BSD_licenses)
-
@@ -1,24 +0,0 @@
-package sqlmock
-
-import "database/sql/driver"
-
-// Argument interface allows to match
-// any argument in specific way when used with
-// ExpectedQuery and ExpectedExec expectations.
-type Argument interface {
-	Match(driver.Value) bool
-}
-
-// AnyArg will return an Argument which can
-// match any kind of arguments.
-//
-// Useful for time.Time or similar kinds of arguments.
-func AnyArg() Argument {
-	return anyArgument{}
-}
-
-type anyArgument struct{}
-
-func (a anyArgument) Match(_ driver.Value) bool {
-	return true
-}
@@ -1,81 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"sync"
-)
-
-var pool *mockDriver
-
-func init() {
-	pool = &mockDriver{
-		conns: make(map[string]*sqlmock),
-	}
-	sql.Register("sqlmock", pool)
-}
-
-type mockDriver struct {
-	sync.Mutex
-	counter int
-	conns   map[string]*sqlmock
-}
-
-func (d *mockDriver) Open(dsn string) (driver.Conn, error) {
-	d.Lock()
-	defer d.Unlock()
-
-	c, ok := d.conns[dsn]
-	if !ok {
-		return c, fmt.Errorf("expected a connection to be available, but it is not")
-	}
-
-	c.opened++
-	return c, nil
-}
-
-// New creates sqlmock database connection and a mock to manage expectations.
-// Accepts options, like ValueConverterOption, to use a ValueConverter from
-// a specific driver.
-// Pings db so that all expectations could be
-// asserted.
-func New(options ...func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
-	pool.Lock()
-	dsn := fmt.Sprintf("sqlmock_db_%d", pool.counter)
-	pool.counter++
-
-	smock := &sqlmock{dsn: dsn, drv: pool, ordered: true}
-	pool.conns[dsn] = smock
-	pool.Unlock()
-
-	return smock.open(options)
-}
-
-// NewWithDSN creates sqlmock database connection with a specific DSN
-// and a mock to manage expectations.
-// Accepts options, like ValueConverterOption, to use a ValueConverter from
-// a specific driver.
-// Pings db so that all expectations could be asserted.
-//
-// This method is introduced because of sql abstraction
-// libraries, which do not provide a way to initialize
-// with sql.DB instance. For example GORM library.
-//
-// Note, it will error if attempted to create with an
-// already used dsn
-//
-// It is not recommended to use this method, unless you
-// really need it and there is no other way around.
-func NewWithDSN(dsn string, options ...func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
-	pool.Lock()
-	if _, ok := pool.conns[dsn]; ok {
-		pool.Unlock()
-		return nil, nil, fmt.Errorf("cannot create a new mock database with the same dsn: %s", dsn)
-	}
-	smock := &sqlmock{dsn: dsn, drv: pool, ordered: true}
-	pool.conns[dsn] = smock
-	pool.Unlock()
-
-	return smock.open(options)
-}
@@ -1,355 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-	"fmt"
-	"strings"
-	"sync"
-	"time"
-)
-
-// an expectation interface
-type expectation interface {
-	fulfilled() bool
-	Lock()
-	Unlock()
-	String() string
-}
-
-// common expectation struct
-// satisfies the expectation interface
-type commonExpectation struct {
-	sync.Mutex
-	triggered bool
-	err       error
-}
-
-func (e *commonExpectation) fulfilled() bool {
-	return e.triggered
-}
-
-// ExpectedClose is used to manage *sql.DB.Close expectation
-// returned by *Sqlmock.ExpectClose.
-type ExpectedClose struct {
-	commonExpectation
-}
-
-// WillReturnError allows to set an error for *sql.DB.Close action
-func (e *ExpectedClose) WillReturnError(err error) *ExpectedClose {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedClose) String() string {
-	msg := "ExpectedClose => expecting database Close"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// ExpectedBegin is used to manage *sql.DB.Begin expectation
-// returned by *Sqlmock.ExpectBegin.
-type ExpectedBegin struct {
-	commonExpectation
-	delay time.Duration
-}
-
-// WillReturnError allows to set an error for *sql.DB.Begin action
-func (e *ExpectedBegin) WillReturnError(err error) *ExpectedBegin {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedBegin) String() string {
-	msg := "ExpectedBegin => expecting database transaction Begin"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedBegin) WillDelayFor(duration time.Duration) *ExpectedBegin {
-	e.delay = duration
-	return e
-}
-
-// ExpectedCommit is used to manage *sql.Tx.Commit expectation
-// returned by *Sqlmock.ExpectCommit.
-type ExpectedCommit struct {
-	commonExpectation
-}
-
-// WillReturnError allows to set an error for *sql.Tx.Close action
-func (e *ExpectedCommit) WillReturnError(err error) *ExpectedCommit {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedCommit) String() string {
-	msg := "ExpectedCommit => expecting transaction Commit"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// ExpectedRollback is used to manage *sql.Tx.Rollback expectation
-// returned by *Sqlmock.ExpectRollback.
-type ExpectedRollback struct {
-	commonExpectation
-}
-
-// WillReturnError allows to set an error for *sql.Tx.Rollback action
-func (e *ExpectedRollback) WillReturnError(err error) *ExpectedRollback {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedRollback) String() string {
-	msg := "ExpectedRollback => expecting transaction Rollback"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// ExpectedQuery is used to manage *sql.DB.Query, *dql.DB.QueryRow, *sql.Tx.Query,
-// *sql.Tx.QueryRow, *sql.Stmt.Query or *sql.Stmt.QueryRow expectations.
-// Returned by *Sqlmock.ExpectQuery.
-type ExpectedQuery struct {
-	queryBasedExpectation
-	rows             driver.Rows
-	delay            time.Duration
-	rowsMustBeClosed bool
-	rowsWereClosed   bool
-}
-
-// WithArgs will match given expected args to actual database query arguments.
-// if at least one argument does not match, it will return an error. For specific
-// arguments an sqlmock.Argument interface can be used to match an argument.
-func (e *ExpectedQuery) WithArgs(args ...driver.Value) *ExpectedQuery {
-	e.args = args
-	return e
-}
-
-// RowsWillBeClosed expects this query rows to be closed.
-func (e *ExpectedQuery) RowsWillBeClosed() *ExpectedQuery {
-	e.rowsMustBeClosed = true
-	return e
-}
-
-// WillReturnError allows to set an error for expected database query
-func (e *ExpectedQuery) WillReturnError(err error) *ExpectedQuery {
-	e.err = err
-	return e
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedQuery) WillDelayFor(duration time.Duration) *ExpectedQuery {
-	e.delay = duration
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedQuery) String() string {
-	msg := "ExpectedQuery => expecting Query, QueryContext or QueryRow which:"
-	msg += "\n  - matches sql: '" + e.expectSQL + "'"
-
-	if len(e.args) == 0 {
-		msg += "\n  - is without arguments"
-	} else {
-		msg += "\n  - is with arguments:\n"
-		for i, arg := range e.args {
-			msg += fmt.Sprintf("    %d - %+v\n", i, arg)
-		}
-		msg = strings.TrimSpace(msg)
-	}
-
-	if e.rows != nil {
-		msg += fmt.Sprintf("\n  - %s", e.rows)
-	}
-
-	if e.err != nil {
-		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
-	}
-
-	return msg
-}
-
-// ExpectedExec is used to manage *sql.DB.Exec, *sql.Tx.Exec or *sql.Stmt.Exec expectations.
-// Returned by *Sqlmock.ExpectExec.
-type ExpectedExec struct {
-	queryBasedExpectation
-	result driver.Result
-	delay  time.Duration
-}
-
-// WithArgs will match given expected args to actual database exec operation arguments.
-// if at least one argument does not match, it will return an error. For specific
-// arguments an sqlmock.Argument interface can be used to match an argument.
-func (e *ExpectedExec) WithArgs(args ...driver.Value) *ExpectedExec {
-	e.args = args
-	return e
-}
-
-// WillReturnError allows to set an error for expected database exec action
-func (e *ExpectedExec) WillReturnError(err error) *ExpectedExec {
-	e.err = err
-	return e
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedExec) WillDelayFor(duration time.Duration) *ExpectedExec {
-	e.delay = duration
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedExec) String() string {
-	msg := "ExpectedExec => expecting Exec or ExecContext which:"
-	msg += "\n  - matches sql: '" + e.expectSQL + "'"
-
-	if len(e.args) == 0 {
-		msg += "\n  - is without arguments"
-	} else {
-		msg += "\n  - is with arguments:\n"
-		var margs []string
-		for i, arg := range e.args {
-			margs = append(margs, fmt.Sprintf("    %d - %+v", i, arg))
-		}
-		msg += strings.Join(margs, "\n")
-	}
-
-	if e.result != nil {
-		res, _ := e.result.(*result)
-		msg += "\n  - should return Result having:"
-		msg += fmt.Sprintf("\n      LastInsertId: %d", res.insertID)
-		msg += fmt.Sprintf("\n      RowsAffected: %d", res.rowsAffected)
-		if res.err != nil {
-			msg += fmt.Sprintf("\n      Error: %s", res.err)
-		}
-	}
-
-	if e.err != nil {
-		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
-	}
-
-	return msg
-}
-
-// WillReturnResult arranges for an expected Exec() to return a particular
-// result, there is sqlmock.NewResult(lastInsertID int64, affectedRows int64) method
-// to build a corresponding result. Or if actions needs to be tested against errors
-// sqlmock.NewErrorResult(err error) to return a given error.
-func (e *ExpectedExec) WillReturnResult(result driver.Result) *ExpectedExec {
-	e.result = result
-	return e
-}
-
-// ExpectedPrepare is used to manage *sql.DB.Prepare or *sql.Tx.Prepare expectations.
-// Returned by *Sqlmock.ExpectPrepare.
-type ExpectedPrepare struct {
-	commonExpectation
-	mock         *sqlmock
-	expectSQL    string
-	statement    driver.Stmt
-	closeErr     error
-	mustBeClosed bool
-	wasClosed    bool
-	delay        time.Duration
-}
-
-// WillReturnError allows to set an error for the expected *sql.DB.Prepare or *sql.Tx.Prepare action.
-func (e *ExpectedPrepare) WillReturnError(err error) *ExpectedPrepare {
-	e.err = err
-	return e
-}
-
-// WillReturnCloseError allows to set an error for this prepared statement Close action
-func (e *ExpectedPrepare) WillReturnCloseError(err error) *ExpectedPrepare {
-	e.closeErr = err
-	return e
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedPrepare) WillDelayFor(duration time.Duration) *ExpectedPrepare {
-	e.delay = duration
-	return e
-}
-
-// WillBeClosed expects this prepared statement to
-// be closed.
-func (e *ExpectedPrepare) WillBeClosed() *ExpectedPrepare {
-	e.mustBeClosed = true
-	return e
-}
-
-// ExpectQuery allows to expect Query() or QueryRow() on this prepared statement.
-// This method is convenient in order to prevent duplicating sql query string matching.
-func (e *ExpectedPrepare) ExpectQuery() *ExpectedQuery {
-	eq := &ExpectedQuery{}
-	eq.expectSQL = e.expectSQL
-	eq.converter = e.mock.converter
-	e.mock.expected = append(e.mock.expected, eq)
-	return eq
-}
-
-// ExpectExec allows to expect Exec() on this prepared statement.
-// This method is convenient in order to prevent duplicating sql query string matching.
-func (e *ExpectedPrepare) ExpectExec() *ExpectedExec {
-	eq := &ExpectedExec{}
-	eq.expectSQL = e.expectSQL
-	eq.converter = e.mock.converter
-	e.mock.expected = append(e.mock.expected, eq)
-	return eq
-}
-
-// String returns string representation
-func (e *ExpectedPrepare) String() string {
-	msg := "ExpectedPrepare => expecting Prepare statement which:"
-	msg += "\n  - matches sql: '" + e.expectSQL + "'"
-
-	if e.err != nil {
-		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
-	}
-
-	if e.closeErr != nil {
-		msg += fmt.Sprintf("\n  - should return error on Close: %s", e.closeErr)
-	}
-
-	return msg
-}
-
-// query based expectation
-// adds a query matching logic
-type queryBasedExpectation struct {
-	commonExpectation
-	expectSQL string
-	converter driver.ValueConverter
-	args      []driver.Value
-}
-
-func (e *queryBasedExpectation) attemptArgMatch(args []namedValue) (err error) {
-	// catch panic
-	defer func() {
-		if e := recover(); e != nil {
-			_, ok := e.(error)
-			if !ok {
-				err = fmt.Errorf(e.(string))
-			}
-		}
-	}()
-
-	err = e.argsMatches(args)
-	return
-}
@@ -1,52 +0,0 @@
-// +build !go1.8
-
-package sqlmock
-
-import (
-	"database/sql/driver"
-	"fmt"
-	"reflect"
-)
-
-// WillReturnRows specifies the set of resulting rows that will be returned
-// by the triggered query
-func (e *ExpectedQuery) WillReturnRows(rows *Rows) *ExpectedQuery {
-	e.rows = &rowSets{sets: []*Rows{rows}, ex: e}
-	return e
-}
-
-func (e *queryBasedExpectation) argsMatches(args []namedValue) error {
-	if nil == e.args {
-		return nil
-	}
-	if len(args) != len(e.args) {
-		return fmt.Errorf("expected %d, but got %d arguments", len(e.args), len(args))
-	}
-	for k, v := range args {
-		// custom argument matcher
-		matcher, ok := e.args[k].(Argument)
-		if ok {
-			// @TODO: does it make sense to pass value instead of named value?
-			if !matcher.Match(v.Value) {
-				return fmt.Errorf("matcher %T could not match %d argument %T - %+v", matcher, k, args[k], args[k])
-			}
-			continue
-		}
-
-		dval := e.args[k]
-		// convert to driver converter
-		darg, err := e.converter.ConvertValue(dval)
-		if err != nil {
-			return fmt.Errorf("could not convert %d argument %T - %+v to driver value: %s", k, e.args[k], e.args[k], err)
-		}
-
-		if !driver.IsValue(darg) {
-			return fmt.Errorf("argument %d: non-subset type %T returned from Value", k, darg)
-		}
-
-		if !reflect.DeepEqual(darg, v.Value) {
-			return fmt.Errorf("argument %d expected [%T - %+v] does not match actual [%T - %+v]", k, darg, darg, v.Value, v.Value)
-		}
-	}
-	return nil
-}
@@ -1,66 +0,0 @@
-// +build go1.8
-
-package sqlmock
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"reflect"
-)
-
-// WillReturnRows specifies the set of resulting rows that will be returned
-// by the triggered query
-func (e *ExpectedQuery) WillReturnRows(rows ...*Rows) *ExpectedQuery {
-	sets := make([]*Rows, len(rows))
-	for i, r := range rows {
-		sets[i] = r
-	}
-	e.rows = &rowSets{sets: sets, ex: e}
-	return e
-}
-
-func (e *queryBasedExpectation) argsMatches(args []namedValue) error {
-	if nil == e.args {
-		return nil
-	}
-	if len(args) != len(e.args) {
-		return fmt.Errorf("expected %d, but got %d arguments", len(e.args), len(args))
-	}
-	// @TODO should we assert either all args are named or ordinal?
-	for k, v := range args {
-		// custom argument matcher
-		matcher, ok := e.args[k].(Argument)
-		if ok {
-			if !matcher.Match(v.Value) {
-				return fmt.Errorf("matcher %T could not match %d argument %T - %+v", matcher, k, args[k], args[k])
-			}
-			continue
-		}
-
-		dval := e.args[k]
-		if named, isNamed := dval.(sql.NamedArg); isNamed {
-			dval = named.Value
-			if v.Name != named.Name {
-				return fmt.Errorf("named argument %d: name: \"%s\" does not match expected: \"%s\"", k, v.Name, named.Name)
-			}
-		} else if k+1 != v.Ordinal {
-			return fmt.Errorf("argument %d: ordinal position: %d does not match expected: %d", k, k+1, v.Ordinal)
-		}
-
-		// convert to driver converter
-		darg, err := e.converter.ConvertValue(dval)
-		if err != nil {
-			return fmt.Errorf("could not convert %d argument %T - %+v to driver value: %s", k, e.args[k], e.args[k], err)
-		}
-
-		if !driver.IsValue(darg) {
-			return fmt.Errorf("argument %d: non-subset type %T returned from Value", k, darg)
-		}
-
-		if !reflect.DeepEqual(darg, v.Value) {
-			return fmt.Errorf("argument %d expected [%T - %+v] does not match actual [%T - %+v]", k, darg, darg, v.Value, v.Value)
-		}
-	}
-	return nil
-}
@@ -1 +0,0 @@
-module github.com/DATA-DOG/go-sqlmock
@@ -1,22 +0,0 @@
-package sqlmock
-
-import "database/sql/driver"
-
-// ValueConverterOption allows to create a sqlmock connection
-// with a custom ValueConverter to support drivers with special data types.
-func ValueConverterOption(converter driver.ValueConverter) func(*sqlmock) error {
-	return func(s *sqlmock) error {
-		s.converter = converter
-		return nil
-	}
-}
-
-// QueryMatcherOption allows to customize SQL query matcher
-// and match SQL query strings in more sophisticated ways.
-// The default QueryMatcher is QueryMatcherRegexp.
-func QueryMatcherOption(queryMatcher QueryMatcher) func(*sqlmock) error {
-	return func(s *sqlmock) error {
-		s.queryMatcher = queryMatcher
-		return nil
-	}
-}
@@ -1,68 +0,0 @@
-package sqlmock
-
-import (
-	"fmt"
-	"regexp"
-	"strings"
-)
-
-var re = regexp.MustCompile("\\s+")
-
-// strip out new lines and trim spaces
-func stripQuery(q string) (s string) {
-	return strings.TrimSpace(re.ReplaceAllString(q, " "))
-}
-
-// QueryMatcher is an SQL query string matcher interface,
-// which can be used to customize validation of SQL query strings.
-// As an example, external library could be used to build
-// and validate SQL ast, columns selected.
-//
-// sqlmock can be customized to implement a different QueryMatcher
-// configured through an option when sqlmock.New or sqlmock.NewWithDSN
-// is called, default QueryMatcher is QueryMatcherRegexp.
-type QueryMatcher interface {
-
-	// Match expected SQL query string without whitespace to
-	// actual SQL.
-	Match(expectedSQL, actualSQL string) error
-}
-
-// QueryMatcherFunc type is an adapter to allow the use of
-// ordinary functions as QueryMatcher. If f is a function
-// with the appropriate signature, QueryMatcherFunc(f) is a
-// QueryMatcher that calls f.
-type QueryMatcherFunc func(expectedSQL, actualSQL string) error
-
-// Match implements the QueryMatcher
-func (f QueryMatcherFunc) Match(expectedSQL, actualSQL string) error {
-	return f(expectedSQL, actualSQL)
-}
-
-// QueryMatcherRegexp is the default SQL query matcher
-// used by sqlmock. It parses expectedSQL to a regular
-// expression and attempts to match actualSQL.
-var QueryMatcherRegexp QueryMatcher = QueryMatcherFunc(func(expectedSQL, actualSQL string) error {
-	expect := stripQuery(expectedSQL)
-	actual := stripQuery(actualSQL)
-	re, err := regexp.Compile(expect)
-	if err != nil {
-		return err
-	}
-	if !re.MatchString(actual) {
-		return fmt.Errorf(`could not match actual sql: "%s" with expected regexp "%s"`, actual, re.String())
-	}
-	return nil
-})
-
-// QueryMatcherEqual is the SQL query matcher
-// which simply tries a case sensitive match of
-// expected and actual SQL strings without whitespace.
-var QueryMatcherEqual QueryMatcher = QueryMatcherFunc(func(expectedSQL, actualSQL string) error {
-	expect := stripQuery(expectedSQL)
-	actual := stripQuery(actualSQL)
-	if actual != expect {
-		return fmt.Errorf(`actual sql: "%s" does not equal to expected "%s"`, actual, expect)
-	}
-	return nil
-})
@@ -1,39 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-)
-
-// Result satisfies sql driver Result, which
-// holds last insert id and rows affected
-// by Exec queries
-type result struct {
-	insertID     int64
-	rowsAffected int64
-	err          error
-}
-
-// NewResult creates a new sql driver Result
-// for Exec based query mocks.
-func NewResult(lastInsertID int64, rowsAffected int64) driver.Result {
-	return &result{
-		insertID:     lastInsertID,
-		rowsAffected: rowsAffected,
-	}
-}
-
-// NewErrorResult creates a new sql driver Result
-// which returns an error given for both interface methods
-func NewErrorResult(err error) driver.Result {
-	return &result{
-		err: err,
-	}
-}
-
-func (r *result) LastInsertId() (int64, error) {
-	return r.insertID, r.err
-}
-
-func (r *result) RowsAffected() (int64, error) {
-	return r.rowsAffected, r.err
-}
@@ -1,176 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-	"encoding/csv"
-	"fmt"
-	"io"
-	"strings"
-)
-
-// CSVColumnParser is a function which converts trimmed csv
-// column string to a []byte representation. Currently
-// transforms NULL to nil
-var CSVColumnParser = func(s string) []byte {
-	switch {
-	case strings.ToLower(s) == "null":
-		return nil
-	}
-	return []byte(s)
-}
-
-type rowSets struct {
-	sets []*Rows
-	pos  int
-	ex   *ExpectedQuery
-}
-
-func (rs *rowSets) Columns() []string {
-	return rs.sets[rs.pos].cols
-}
-
-func (rs *rowSets) Close() error {
-	rs.ex.rowsWereClosed = true
-	return rs.sets[rs.pos].closeErr
-}
-
-// advances to next row
-func (rs *rowSets) Next(dest []driver.Value) error {
-	r := rs.sets[rs.pos]
-	r.pos++
-	if r.pos > len(r.rows) {
-		return io.EOF // per interface spec
-	}
-
-	for i, col := range r.rows[r.pos-1] {
-		dest[i] = col
-	}
-
-	return r.nextErr[r.pos-1]
-}
-
-// transforms to debuggable printable string
-func (rs *rowSets) String() string {
-	if rs.empty() {
-		return "with empty rows"
-	}
-
-	msg := "should return rows:\n"
-	if len(rs.sets) == 1 {
-		for n, row := range rs.sets[0].rows {
-			msg += fmt.Sprintf("    row %d - %+v\n", n, row)
-		}
-		return strings.TrimSpace(msg)
-	}
-	for i, set := range rs.sets {
-		msg += fmt.Sprintf("    result set: %d\n", i)
-		for n, row := range set.rows {
-			msg += fmt.Sprintf("      row %d - %+v\n", n, row)
-		}
-	}
-	return strings.TrimSpace(msg)
-}
-
-func (rs *rowSets) empty() bool {
-	for _, set := range rs.sets {
-		if len(set.rows) > 0 {
-			return false
-		}
-	}
-	return true
-}
-
-// Rows is a mocked collection of rows to
-// return for Query result
-type Rows struct {
-	converter driver.ValueConverter
-	cols      []string
-	rows      [][]driver.Value
-	pos       int
-	nextErr   map[int]error
-	closeErr  error
-}
-
-// NewRows allows Rows to be created from a
-// sql driver.Value slice or from the CSV string and
-// to be used as sql driver.Rows.
-// Use Sqlmock.NewRows instead if using a custom converter
-func NewRows(columns []string) *Rows {
-	return &Rows{
-		cols:      columns,
-		nextErr:   make(map[int]error),
-		converter: driver.DefaultParameterConverter,
-	}
-}
-
-// CloseError allows to set an error
-// which will be returned by rows.Close
-// function.
-//
-// The close error will be triggered only in cases
-// when rows.Next() EOF was not yet reached, that is
-// a default sql library behavior
-func (r *Rows) CloseError(err error) *Rows {
-	r.closeErr = err
-	return r
-}
-
-// RowError allows to set an error
-// which will be returned when a given
-// row number is read
-func (r *Rows) RowError(row int, err error) *Rows {
-	r.nextErr[row] = err
-	return r
-}
-
-// AddRow composed from database driver.Value slice
-// return the same instance to perform subsequent actions.
-// Note that the number of values must match the number
-// of columns
-func (r *Rows) AddRow(values ...driver.Value) *Rows {
-	if len(values) != len(r.cols) {
-		panic("Expected number of values to match number of columns")
-	}
-
-	row := make([]driver.Value, len(r.cols))
-	for i, v := range values {
-		// Convert user-friendly values (such as int or driver.Valuer)
-		// to database/sql native value (driver.Value such as int64)
-		var err error
-		v, err = r.converter.ConvertValue(v)
-		if err != nil {
-			panic(fmt.Errorf(
-				"row #%d, column #%d (%q) type %T: %s",
-				len(r.rows)+1, i, r.cols[i], values[i], err,
-			))
-		}
-
-		row[i] = v
-	}
-
-	r.rows = append(r.rows, row)
-	return r
-}
-
-// FromCSVString build rows from csv string.
-// return the same instance to perform subsequent actions.
-// Note that the number of values must match the number
-// of columns
-func (r *Rows) FromCSVString(s string) *Rows {
-	res := strings.NewReader(strings.TrimSpace(s))
-	csvReader := csv.NewReader(res)
-
-	for {
-		res, err := csvReader.Read()
-		if err != nil || res == nil {
-			break
-		}
-
-		row := make([]driver.Value, len(r.cols))
-		for i, v := range res {
-			row[i] = CSVColumnParser(strings.TrimSpace(v))
-		}
-		r.rows = append(r.rows, row)
-	}
-	return r
-}
@@ -1,20 +0,0 @@
-// +build go1.8
-
-package sqlmock
-
-import "io"
-
-// Implement the "RowsNextResultSet" interface
-func (rs *rowSets) HasNextResultSet() bool {
-	return rs.pos+1 < len(rs.sets)
-}
-
-// Implement the "RowsNextResultSet" interface
-func (rs *rowSets) NextResultSet() error {
-	if !rs.HasNextResultSet() {
-		return io.EOF
-	}
-
-	rs.pos++
-	return nil
-}
@@ -1,589 +0,0 @@
-/*
-Package sqlmock is a mock library implementing sql driver. Which has one and only
-purpose - to simulate any sql driver behavior in tests, without needing a real
-database connection. It helps to maintain correct **TDD** workflow.
-
-It does not require any modifications to your source code in order to test
-and mock database operations. Supports concurrency and multiple database mocking.
-
-The driver allows to mock any sql driver method behavior.
-*/
-package sqlmock
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"time"
-)
-
-// Sqlmock interface serves to create expectations
-// for any kind of database action in order to mock
-// and test real database behavior.
-type Sqlmock interface {
-
-	// ExpectClose queues an expectation for this database
-	// action to be triggered. the *ExpectedClose allows
-	// to mock database response
-	ExpectClose() *ExpectedClose
-
-	// ExpectationsWereMet checks whether all queued expectations
-	// were met in order. If any of them was not met - an error is returned.
-	ExpectationsWereMet() error
-
-	// ExpectPrepare expects Prepare() to be called with expectedSQL query.
-	// the *ExpectedPrepare allows to mock database response.
-	// Note that you may expect Query() or Exec() on the *ExpectedPrepare
-	// statement to prevent repeating expectedSQL
-	ExpectPrepare(expectedSQL string) *ExpectedPrepare
-
-	// ExpectQuery expects Query() or QueryRow() to be called with expectedSQL query.
-	// the *ExpectedQuery allows to mock database response.
-	ExpectQuery(expectedSQL string) *ExpectedQuery
-
-	// ExpectExec expects Exec() to be called with expectedSQL query.
-	// the *ExpectedExec allows to mock database response
-	ExpectExec(expectedSQL string) *ExpectedExec
-
-	// ExpectBegin expects *sql.DB.Begin to be called.
-	// the *ExpectedBegin allows to mock database response
-	ExpectBegin() *ExpectedBegin
-
-	// ExpectCommit expects *sql.Tx.Commit to be called.
-	// the *ExpectedCommit allows to mock database response
-	ExpectCommit() *ExpectedCommit
-
-	// ExpectRollback expects *sql.Tx.Rollback to be called.
-	// the *ExpectedRollback allows to mock database response
-	ExpectRollback() *ExpectedRollback
-
-	// MatchExpectationsInOrder gives an option whether to match all
-	// expectations in the order they were set or not.
-	//
-	// By default it is set to - true. But if you use goroutines
-	// to parallelize your query executation, that option may
-	// be handy.
-	//
-	// This option may be turned on anytime during tests. As soon
-	// as it is switched to false, expectations will be matched
-	// in any order. Or otherwise if switched to true, any unmatched
-	// expectations will be expected in order
-	MatchExpectationsInOrder(bool)
-
-	// NewRows allows Rows to be created from a
-	// sql driver.Value slice or from the CSV string and
-	// to be used as sql driver.Rows.
-	NewRows(columns []string) *Rows
-}
-
-type sqlmock struct {
-	ordered      bool
-	dsn          string
-	opened       int
-	drv          *mockDriver
-	converter    driver.ValueConverter
-	queryMatcher QueryMatcher
-
-	expected []expectation
-}
-
-func (c *sqlmock) open(options []func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
-	db, err := sql.Open("sqlmock", c.dsn)
-	if err != nil {
-		return db, c, err
-	}
-	for _, option := range options {
-		err := option(c)
-		if err != nil {
-			return db, c, err
-		}
-	}
-	if c.converter == nil {
-		c.converter = driver.DefaultParameterConverter
-	}
-	if c.queryMatcher == nil {
-		c.queryMatcher = QueryMatcherRegexp
-	}
-	return db, c, db.Ping()
-}
-
-func (c *sqlmock) ExpectClose() *ExpectedClose {
-	e := &ExpectedClose{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-func (c *sqlmock) MatchExpectationsInOrder(b bool) {
-	c.ordered = b
-}
-
-// Close a mock database driver connection. It may or may not
-// be called depending on the circumstances, but if it is called
-// there must be an *ExpectedClose expectation satisfied.
-// meets http://golang.org/pkg/database/sql/driver/#Conn interface
-func (c *sqlmock) Close() error {
-	c.drv.Lock()
-	defer c.drv.Unlock()
-
-	c.opened--
-	if c.opened == 0 {
-		delete(c.drv.conns, c.dsn)
-	}
-
-	var expected *ExpectedClose
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedClose); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return fmt.Errorf("call to database Close, was not expected, next expectation is: %s", next)
-		}
-	}
-
-	if expected == nil {
-		msg := "call to database Close was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-	return expected.err
-}
-
-func (c *sqlmock) ExpectationsWereMet() error {
-	for _, e := range c.expected {
-		e.Lock()
-		fulfilled := e.fulfilled()
-		e.Unlock()
-
-		if !fulfilled {
-			return fmt.Errorf("there is a remaining expectation which was not matched: %s", e)
-		}
-
-		// for expected prepared statement check whether it was closed if expected
-		if prep, ok := e.(*ExpectedPrepare); ok {
-			if prep.mustBeClosed && !prep.wasClosed {
-				return fmt.Errorf("expected prepared statement to be closed, but it was not: %s", prep)
-			}
-		}
-
-		// must check whether all expected queried rows are closed
-		if query, ok := e.(*ExpectedQuery); ok {
-			if query.rowsMustBeClosed && !query.rowsWereClosed {
-				return fmt.Errorf("expected query rows to be closed, but it was not: %s", query)
-			}
-		}
-	}
-	return nil
-}
-
-// Begin meets http://golang.org/pkg/database/sql/driver/#Conn interface
-func (c *sqlmock) Begin() (driver.Tx, error) {
-	ex, err := c.begin()
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return c, nil
-}
-
-func (c *sqlmock) begin() (*ExpectedBegin, error) {
-	var expected *ExpectedBegin
-	var ok bool
-	var fulfilled int
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedBegin); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return nil, fmt.Errorf("call to database transaction Begin, was not expected, next expectation is: %s", next)
-		}
-	}
-	if expected == nil {
-		msg := "call to database transaction Begin was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-
-	return expected, expected.err
-}
-
-func (c *sqlmock) ExpectBegin() *ExpectedBegin {
-	e := &ExpectedBegin{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-// Exec meets http://golang.org/pkg/database/sql/driver/#Execer
-func (c *sqlmock) Exec(query string, args []driver.Value) (driver.Result, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, v := range args {
-		namedArgs[i] = namedValue{
-			Ordinal: i + 1,
-			Value:   v,
-		}
-	}
-
-	ex, err := c.exec(query, namedArgs)
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return ex.result, nil
-}
-
-func (c *sqlmock) exec(query string, args []namedValue) (*ExpectedExec, error) {
-	var expected *ExpectedExec
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if c.ordered {
-			if expected, ok = next.(*ExpectedExec); ok {
-				break
-			}
-			next.Unlock()
-			return nil, fmt.Errorf("call to ExecQuery '%s' with args %+v, was not expected, next expectation is: %s", query, args, next)
-		}
-		if exec, ok := next.(*ExpectedExec); ok {
-			if err := c.queryMatcher.Match(exec.expectSQL, query); err != nil {
-				next.Unlock()
-				continue
-			}
-
-			if err := exec.attemptArgMatch(args); err == nil {
-				expected = exec
-				break
-			}
-		}
-		next.Unlock()
-	}
-	if expected == nil {
-		msg := "call to ExecQuery '%s' with args %+v was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg, query, args)
-	}
-	defer expected.Unlock()
-
-	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
-		return nil, fmt.Errorf("ExecQuery: %v", err)
-	}
-
-	if err := expected.argsMatches(args); err != nil {
-		return nil, fmt.Errorf("ExecQuery '%s', arguments do not match: %s", query, err)
-	}
-
-	expected.triggered = true
-	if expected.err != nil {
-		return expected, expected.err // mocked to return error
-	}
-
-	if expected.result == nil {
-		return nil, fmt.Errorf("ExecQuery '%s' with args %+v, must return a database/sql/driver.Result, but it was not set for expectation %T as %+v", query, args, expected, expected)
-	}
-
-	return expected, nil
-}
-
-func (c *sqlmock) ExpectExec(expectedSQL string) *ExpectedExec {
-	e := &ExpectedExec{}
-	e.expectSQL = expectedSQL
-	e.converter = c.converter
-	c.expected = append(c.expected, e)
-	return e
-}
-
-// Prepare meets http://golang.org/pkg/database/sql/driver/#Conn interface
-func (c *sqlmock) Prepare(query string) (driver.Stmt, error) {
-	ex, err := c.prepare(query)
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return &statement{c, ex, query}, nil
-}
-
-func (c *sqlmock) prepare(query string) (*ExpectedPrepare, error) {
-	var expected *ExpectedPrepare
-	var fulfilled int
-	var ok bool
-
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if c.ordered {
-			if expected, ok = next.(*ExpectedPrepare); ok {
-				break
-			}
-
-			next.Unlock()
-			return nil, fmt.Errorf("call to Prepare statement with query '%s', was not expected, next expectation is: %s", query, next)
-		}
-
-		if pr, ok := next.(*ExpectedPrepare); ok {
-			if err := c.queryMatcher.Match(pr.expectSQL, query); err == nil {
-				expected = pr
-				break
-			}
-		}
-		next.Unlock()
-	}
-
-	if expected == nil {
-		msg := "call to Prepare '%s' query was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg, query)
-	}
-	defer expected.Unlock()
-	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
-		return nil, fmt.Errorf("Prepare: %v", err)
-	}
-
-	expected.triggered = true
-	return expected, expected.err
-}
-
-func (c *sqlmock) ExpectPrepare(expectedSQL string) *ExpectedPrepare {
-	e := &ExpectedPrepare{expectSQL: expectedSQL, mock: c}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-type namedValue struct {
-	Name    string
-	Ordinal int
-	Value   driver.Value
-}
-
-// Query meets http://golang.org/pkg/database/sql/driver/#Queryer
-func (c *sqlmock) Query(query string, args []driver.Value) (driver.Rows, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, v := range args {
-		namedArgs[i] = namedValue{
-			Ordinal: i + 1,
-			Value:   v,
-		}
-	}
-
-	ex, err := c.query(query, namedArgs)
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return ex.rows, nil
-}
-
-func (c *sqlmock) query(query string, args []namedValue) (*ExpectedQuery, error) {
-	var expected *ExpectedQuery
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if c.ordered {
-			if expected, ok = next.(*ExpectedQuery); ok {
-				break
-			}
-			next.Unlock()
-			return nil, fmt.Errorf("call to Query '%s' with args %+v, was not expected, next expectation is: %s", query, args, next)
-		}
-		if qr, ok := next.(*ExpectedQuery); ok {
-			if err := c.queryMatcher.Match(qr.expectSQL, query); err != nil {
-				next.Unlock()
-				continue
-			}
-			if err := qr.attemptArgMatch(args); err == nil {
-				expected = qr
-				break
-			}
-		}
-		next.Unlock()
-	}
-
-	if expected == nil {
-		msg := "call to Query '%s' with args %+v was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg, query, args)
-	}
-
-	defer expected.Unlock()
-
-	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
-		return nil, fmt.Errorf("Query: %v", err)
-	}
-
-	if err := expected.argsMatches(args); err != nil {
-		return nil, fmt.Errorf("Query '%s', arguments do not match: %s", query, err)
-	}
-
-	expected.triggered = true
-	if expected.err != nil {
-		return expected, expected.err // mocked to return error
-	}
-
-	if expected.rows == nil {
-		return nil, fmt.Errorf("Query '%s' with args %+v, must return a database/sql/driver.Rows, but it was not set for expectation %T as %+v", query, args, expected, expected)
-	}
-	return expected, nil
-}
-
-func (c *sqlmock) ExpectQuery(expectedSQL string) *ExpectedQuery {
-	e := &ExpectedQuery{}
-	e.expectSQL = expectedSQL
-	e.converter = c.converter
-	c.expected = append(c.expected, e)
-	return e
-}
-
-func (c *sqlmock) ExpectCommit() *ExpectedCommit {
-	e := &ExpectedCommit{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-func (c *sqlmock) ExpectRollback() *ExpectedRollback {
-	e := &ExpectedRollback{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-// Commit meets http://golang.org/pkg/database/sql/driver/#Tx
-func (c *sqlmock) Commit() error {
-	var expected *ExpectedCommit
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedCommit); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return fmt.Errorf("call to Commit transaction, was not expected, next expectation is: %s", next)
-		}
-	}
-	if expected == nil {
-		msg := "call to Commit transaction was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-	return expected.err
-}
-
-// Rollback meets http://golang.org/pkg/database/sql/driver/#Tx
-func (c *sqlmock) Rollback() error {
-	var expected *ExpectedRollback
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedRollback); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return fmt.Errorf("call to Rollback transaction, was not expected, next expectation is: %s", next)
-		}
-	}
-	if expected == nil {
-		msg := "call to Rollback transaction was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-	return expected.err
-}
-
-// NewRows allows Rows to be created from a
-// sql driver.Value slice or from the CSV string and
-// to be used as sql driver.Rows.
-func (c *sqlmock) NewRows(columns []string) *Rows {
-	r := NewRows(columns)
-	r.converter = c.converter
-	return r
-}
@@ -1,121 +0,0 @@
-// +build go1.8
-
-package sqlmock
-
-import (
-	"context"
-	"database/sql/driver"
-	"errors"
-	"time"
-)
-
-// ErrCancelled defines an error value, which can be expected in case of
-// such cancellation error.
-var ErrCancelled = errors.New("canceling query due to user request")
-
-// Implement the "QueryerContext" interface
-func (c *sqlmock) QueryContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Rows, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, nv := range args {
-		namedArgs[i] = namedValue(nv)
-	}
-
-	ex, err := c.query(query, namedArgs)
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return ex.rows, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "ExecerContext" interface
-func (c *sqlmock) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Result, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, nv := range args {
-		namedArgs[i] = namedValue(nv)
-	}
-
-	ex, err := c.exec(query, namedArgs)
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return ex.result, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "ConnBeginTx" interface
-func (c *sqlmock) BeginTx(ctx context.Context, opts driver.TxOptions) (driver.Tx, error) {
-	ex, err := c.begin()
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return c, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "ConnPrepareContext" interface
-func (c *sqlmock) PrepareContext(ctx context.Context, query string) (driver.Stmt, error) {
-	ex, err := c.prepare(query)
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return &statement{c, ex, query}, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "Pinger" interface
-// for now we do not have a Ping expectation
-// may be something for the future
-func (c *sqlmock) Ping(ctx context.Context) error {
-	return nil
-}
-
-// Implement the "StmtExecContext" interface
-func (stmt *statement) ExecContext(ctx context.Context, args []driver.NamedValue) (driver.Result, error) {
-	return stmt.conn.ExecContext(ctx, stmt.query, args)
-}
-
-// Implement the "StmtQueryContext" interface
-func (stmt *statement) QueryContext(ctx context.Context, args []driver.NamedValue) (driver.Rows, error) {
-	return stmt.conn.QueryContext(ctx, stmt.query, args)
-}
-
-// @TODO maybe add ExpectedBegin.WithOptions(driver.TxOptions)
-
-// CheckNamedValue meets https://golang.org/pkg/database/sql/driver/#NamedValueChecker
-func (c *sqlmock) CheckNamedValue(nv *driver.NamedValue) (err error) {
-	nv.Value, err = c.converter.ConvertValue(nv.Value)
-	return err
-}
@@ -1,28 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-)
-
-type statement struct {
-	conn  *sqlmock
-	ex    *ExpectedPrepare
-	query string
-}
-
-func (stmt *statement) Close() error {
-	stmt.ex.wasClosed = true
-	return stmt.ex.closeErr
-}
-
-func (stmt *statement) NumInput() int {
-	return -1
-}
-
-func (stmt *statement) Exec(args []driver.Value) (driver.Result, error) {
-	return stmt.conn.Exec(stmt.query, args)
-}
-
-func (stmt *statement) Query(args []driver.Value) (driver.Rows, error) {
-	return stmt.conn.Query(stmt.query, args)
-}
@@ -0,0 +1 @@
+shlex.test
@@ -0,0 +1,20 @@
+Copyright (c) anmitsu <anmitsu.s@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,38 @@
+# go-shlex
+
+go-shlex is a library to make a lexical analyzer like Unix shell for
+Go.
+
+## Install
+
+    go get -u "github.com/anmitsu/go-shlex"
+
+## Usage
+
+```go
+package main
+
+import (
+    "fmt"
+    "log"
+
+    "github.com/anmitsu/go-shlex"
+)
+
+func main() {
+    cmd := `cp -Rdp "file name" 'file name2' dir\ name`
+    words, err := shlex.Split(cmd, true)
+    if err != nil {
+        log.Fatal(err)
+    }
+
+    for _, w := range words {
+        fmt.Println(w)
+    }
+}
+```
+
+## Documentation
+
+http://godoc.org/github.com/anmitsu/go-shlex
+
@@ -0,0 +1,193 @@
+// Package shlex provides a simple lexical analysis like Unix shell.
+package shlex
+
+import (
+	"bufio"
+	"errors"
+	"io"
+	"strings"
+	"unicode"
+)
+
+var (
+	ErrNoClosing = errors.New("No closing quotation")
+	ErrNoEscaped = errors.New("No escaped character")
+)
+
+// Tokenizer is the interface that classifies a token according to
+// words, whitespaces, quotations, escapes and escaped quotations.
+type Tokenizer interface {
+	IsWord(rune) bool
+	IsWhitespace(rune) bool
+	IsQuote(rune) bool
+	IsEscape(rune) bool
+	IsEscapedQuote(rune) bool
+}
+
+// DefaultTokenizer implements a simple tokenizer like Unix shell.
+type DefaultTokenizer struct{}
+
+func (t *DefaultTokenizer) IsWord(r rune) bool {
+	return r == '_' || unicode.IsLetter(r) || unicode.IsNumber(r)
+}
+func (t *DefaultTokenizer) IsQuote(r rune) bool {
+	switch r {
+	case '\'', '"':
+		return true
+	default:
+		return false
+	}
+}
+func (t *DefaultTokenizer) IsWhitespace(r rune) bool {
+	return unicode.IsSpace(r)
+}
+func (t *DefaultTokenizer) IsEscape(r rune) bool {
+	return r == '\\'
+}
+func (t *DefaultTokenizer) IsEscapedQuote(r rune) bool {
+	return r == '"'
+}
+
+// Lexer represents a lexical analyzer.
+type Lexer struct {
+	reader          *bufio.Reader
+	tokenizer       Tokenizer
+	posix           bool
+	whitespacesplit bool
+}
+
+// NewLexer creates a new Lexer reading from io.Reader.  This Lexer
+// has a DefaultTokenizer according to posix and whitespacesplit
+// rules.
+func NewLexer(r io.Reader, posix, whitespacesplit bool) *Lexer {
+	return &Lexer{
+		reader:          bufio.NewReader(r),
+		tokenizer:       &DefaultTokenizer{},
+		posix:           posix,
+		whitespacesplit: whitespacesplit,
+	}
+}
+
+// NewLexerString creates a new Lexer reading from a string.  This
+// Lexer has a DefaultTokenizer according to posix and whitespacesplit
+// rules.
+func NewLexerString(s string, posix, whitespacesplit bool) *Lexer {
+	return NewLexer(strings.NewReader(s), posix, whitespacesplit)
+}
+
+// Split splits a string according to posix or non-posix rules.
+func Split(s string, posix bool) ([]string, error) {
+	return NewLexerString(s, posix, true).Split()
+}
+
+// SetTokenizer sets a Tokenizer.
+func (l *Lexer) SetTokenizer(t Tokenizer) {
+	l.tokenizer = t
+}
+
+func (l *Lexer) Split() ([]string, error) {
+	result := make([]string, 0)
+	for {
+		token, err := l.readToken()
+		if token != "" {
+			result = append(result, token)
+		}
+
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return result, err
+		}
+	}
+	return result, nil
+}
+
+func (l *Lexer) readToken() (string, error) {
+	t := l.tokenizer
+	token := ""
+	quoted := false
+	state := ' '
+	escapedstate := ' '
+scanning:
+	for {
+		next, _, err := l.reader.ReadRune()
+		if err != nil {
+			if t.IsQuote(state) {
+				return token, ErrNoClosing
+			} else if t.IsEscape(state) {
+				return token, ErrNoEscaped
+			}
+			return token, err
+		}
+
+		switch {
+		case t.IsWhitespace(state):
+			switch {
+			case t.IsWhitespace(next):
+				break scanning
+			case l.posix && t.IsEscape(next):
+				escapedstate = 'a'
+				state = next
+			case t.IsWord(next):
+				token += string(next)
+				state = 'a'
+			case t.IsQuote(next):
+				if !l.posix {
+					token += string(next)
+				}
+				state = next
+			default:
+				token = string(next)
+				if l.whitespacesplit {
+					state = 'a'
+				} else if token != "" || (l.posix && quoted) {
+					break scanning
+				}
+			}
+		case t.IsQuote(state):
+			quoted = true
+			switch {
+			case next == state:
+				if !l.posix {
+					token += string(next)
+					break scanning
+				} else {
+					state = 'a'
+				}
+			case l.posix && t.IsEscape(next) && t.IsEscapedQuote(state):
+				escapedstate = state
+				state = next
+			default:
+				token += string(next)
+			}
+		case t.IsEscape(state):
+			if t.IsQuote(escapedstate) && next != state && next != escapedstate {
+				token += string(state)
+			}
+			token += string(next)
+			state = escapedstate
+		case t.IsWord(state):
+			switch {
+			case t.IsWhitespace(next):
+				if token != "" || (l.posix && quoted) {
+					break scanning
+				}
+			case l.posix && t.IsQuote(next):
+				state = next
+			case l.posix && t.IsEscape(next):
+				escapedstate = 'a'
+				state = next
+			case t.IsWord(next) || t.IsQuote(next):
+				token += string(next)
+			default:
+				if l.whitespacesplit {
+					token += string(next)
+				} else if token != "" {
+					l.reader.UnreadRune()
+					break scanning
+				}
+			}
+		}
+	}
+	return token, nil
+}
@@ -0,0 +1,3 @@
+AWS SDK for Go
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Copyright 2014-2015 Stripe, Inc.
@@ -0,0 +1,164 @@
+// Package awserr represents API error interface accessors for the SDK.
+package awserr
+
+// An Error wraps lower level errors with code, message and an original error.
+// The underlying concrete error type may also satisfy other interfaces which
+// can be to used to obtain more specific information about the error.
+//
+// Calling Error() or String() will always include the full information about
+// an error based on its underlying type.
+//
+// Example:
+//
+//     output, err := s3manage.Upload(svc, input, opts)
+//     if err != nil {
+//         if awsErr, ok := err.(awserr.Error); ok {
+//             // Get error details
+//             log.Println("Error:", awsErr.Code(), awsErr.Message())
+//
+//             // Prints out full error message, including original error if there was one.
+//             log.Println("Error:", awsErr.Error())
+//
+//             // Get original error
+//             if origErr := awsErr.OrigErr(); origErr != nil {
+//                 // operate on original error.
+//             }
+//         } else {
+//             fmt.Println(err.Error())
+//         }
+//     }
+//
+type Error interface {
+	// Satisfy the generic error interface.
+	error
+
+	// Returns the short phrase depicting the classification of the error.
+	Code() string
+
+	// Returns the error details message.
+	Message() string
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErr() error
+}
+
+// BatchError is a batch of errors which also wraps lower level errors with
+// code, message, and original errors. Calling Error() will include all errors
+// that occurred in the batch.
+//
+// Deprecated: Replaced with BatchedErrors. Only defined for backwards
+// compatibility.
+type BatchError interface {
+	// Satisfy the generic error interface.
+	error
+
+	// Returns the short phrase depicting the classification of the error.
+	Code() string
+
+	// Returns the error details message.
+	Message() string
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErrs() []error
+}
+
+// BatchedErrors is a batch of errors which also wraps lower level errors with
+// code, message, and original errors. Calling Error() will include all errors
+// that occurred in the batch.
+//
+// Replaces BatchError
+type BatchedErrors interface {
+	// Satisfy the base Error interface.
+	Error
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErrs() []error
+}
+
+// New returns an Error object described by the code, message, and origErr.
+//
+// If origErr satisfies the Error interface it will not be wrapped within a new
+// Error object and will instead be returned.
+func New(code, message string, origErr error) Error {
+	var errs []error
+	if origErr != nil {
+		errs = append(errs, origErr)
+	}
+	return newBaseError(code, message, errs)
+}
+
+// NewBatchError returns an BatchedErrors with a collection of errors as an
+// array of errors.
+func NewBatchError(code, message string, errs []error) BatchedErrors {
+	return newBaseError(code, message, errs)
+}
+
+// A RequestFailure is an interface to extract request failure information from
+// an Error such as the request ID of the failed request returned by a service.
+// RequestFailures may not always have a requestID value if the request failed
+// prior to reaching the service such as a connection error.
+//
+// Example:
+//
+//     output, err := s3manage.Upload(svc, input, opts)
+//     if err != nil {
+//         if reqerr, ok := err.(RequestFailure); ok {
+//             log.Println("Request failed", reqerr.Code(), reqerr.Message(), reqerr.RequestID())
+//         } else {
+//             log.Println("Error:", err.Error())
+//         }
+//     }
+//
+// Combined with awserr.Error:
+//
+//    output, err := s3manage.Upload(svc, input, opts)
+//    if err != nil {
+//        if awsErr, ok := err.(awserr.Error); ok {
+//            // Generic AWS Error with Code, Message, and original error (if any)
+//            fmt.Println(awsErr.Code(), awsErr.Message(), awsErr.OrigErr())
+//
+//            if reqErr, ok := err.(awserr.RequestFailure); ok {
+//                // A service error occurred
+//                fmt.Println(reqErr.StatusCode(), reqErr.RequestID())
+//            }
+//        } else {
+//            fmt.Println(err.Error())
+//        }
+//    }
+//
+type RequestFailure interface {
+	Error
+
+	// The status code of the HTTP response.
+	StatusCode() int
+
+	// The request ID returned by the service for a request failure. This will
+	// be empty if no request ID is available such as the request failed due
+	// to a connection error.
+	RequestID() string
+}
+
+// NewRequestFailure returns a wrapped error with additional information for
+// request status code, and service requestID.
+//
+// Should be used to wrap all request which involve service requests. Even if
+// the request failed without a service response, but had an HTTP status code
+// that may be meaningful.
+func NewRequestFailure(err Error, statusCode int, reqID string) RequestFailure {
+	return newRequestError(err, statusCode, reqID)
+}
+
+// UnmarshalError provides the interface for the SDK failing to unmarshal data.
+type UnmarshalError interface {
+	awsError
+	Bytes() []byte
+}
+
+// NewUnmarshalError returns an initialized UnmarshalError error wrapper adding
+// the bytes that fail to unmarshal to the error.
+func NewUnmarshalError(err error, msg string, bytes []byte) UnmarshalError {
+	return &unmarshalError{
+		awsError: New("UnmarshalError", msg, err),
+		bytes:    bytes,
+	}
+}
@@ -0,0 +1,221 @@
+package awserr
+
+import (
+	"encoding/hex"
+	"fmt"
+)
+
+// SprintError returns a string of the formatted error code.
+//
+// Both extra and origErr are optional.  If they are included their lines
+// will be added, but if they are not included their lines will be ignored.
+func SprintError(code, message, extra string, origErr error) string {
+	msg := fmt.Sprintf("%s: %s", code, message)
+	if extra != "" {
+		msg = fmt.Sprintf("%s\n\t%s", msg, extra)
+	}
+	if origErr != nil {
+		msg = fmt.Sprintf("%s\ncaused by: %s", msg, origErr.Error())
+	}
+	return msg
+}
+
+// A baseError wraps the code and message which defines an error. It also
+// can be used to wrap an original error object.
+//
+// Should be used as the root for errors satisfying the awserr.Error. Also
+// for any error which does not fit into a specific error wrapper type.
+type baseError struct {
+	// Classification of error
+	code string
+
+	// Detailed information about error
+	message string
+
+	// Optional original error this error is based off of. Allows building
+	// chained errors.
+	errs []error
+}
+
+// newBaseError returns an error object for the code, message, and errors.
+//
+// code is a short no whitespace phrase depicting the classification of
+// the error that is being created.
+//
+// message is the free flow string containing detailed information about the
+// error.
+//
+// origErrs is the error objects which will be nested under the new errors to
+// be returned.
+func newBaseError(code, message string, origErrs []error) *baseError {
+	b := &baseError{
+		code:    code,
+		message: message,
+		errs:    origErrs,
+	}
+
+	return b
+}
+
+// Error returns the string representation of the error.
+//
+// See ErrorWithExtra for formatting.
+//
+// Satisfies the error interface.
+func (b baseError) Error() string {
+	size := len(b.errs)
+	if size > 0 {
+		return SprintError(b.code, b.message, "", errorList(b.errs))
+	}
+
+	return SprintError(b.code, b.message, "", nil)
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (b baseError) String() string {
+	return b.Error()
+}
+
+// Code returns the short phrase depicting the classification of the error.
+func (b baseError) Code() string {
+	return b.code
+}
+
+// Message returns the error details message.
+func (b baseError) Message() string {
+	return b.message
+}
+
+// OrigErr returns the original error if one was set. Nil is returned if no
+// error was set. This only returns the first element in the list. If the full
+// list is needed, use BatchedErrors.
+func (b baseError) OrigErr() error {
+	switch len(b.errs) {
+	case 0:
+		return nil
+	case 1:
+		return b.errs[0]
+	default:
+		if err, ok := b.errs[0].(Error); ok {
+			return NewBatchError(err.Code(), err.Message(), b.errs[1:])
+		}
+		return NewBatchError("BatchedErrors",
+			"multiple errors occurred", b.errs)
+	}
+}
+
+// OrigErrs returns the original errors if one was set. An empty slice is
+// returned if no error was set.
+func (b baseError) OrigErrs() []error {
+	return b.errs
+}
+
+// So that the Error interface type can be included as an anonymous field
+// in the requestError struct and not conflict with the error.Error() method.
+type awsError Error
+
+// A requestError wraps a request or service error.
+//
+// Composed of baseError for code, message, and original error.
+type requestError struct {
+	awsError
+	statusCode int
+	requestID  string
+	bytes      []byte
+}
+
+// newRequestError returns a wrapped error with additional information for
+// request status code, and service requestID.
+//
+// Should be used to wrap all request which involve service requests. Even if
+// the request failed without a service response, but had an HTTP status code
+// that may be meaningful.
+//
+// Also wraps original errors via the baseError.
+func newRequestError(err Error, statusCode int, requestID string) *requestError {
+	return &requestError{
+		awsError:   err,
+		statusCode: statusCode,
+		requestID:  requestID,
+	}
+}
+
+// Error returns the string representation of the error.
+// Satisfies the error interface.
+func (r requestError) Error() string {
+	extra := fmt.Sprintf("status code: %d, request id: %s",
+		r.statusCode, r.requestID)
+	return SprintError(r.Code(), r.Message(), extra, r.OrigErr())
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (r requestError) String() string {
+	return r.Error()
+}
+
+// StatusCode returns the wrapped status code for the error
+func (r requestError) StatusCode() int {
+	return r.statusCode
+}
+
+// RequestID returns the wrapped requestID
+func (r requestError) RequestID() string {
+	return r.requestID
+}
+
+// OrigErrs returns the original errors if one was set. An empty slice is
+// returned if no error was set.
+func (r requestError) OrigErrs() []error {
+	if b, ok := r.awsError.(BatchedErrors); ok {
+		return b.OrigErrs()
+	}
+	return []error{r.OrigErr()}
+}
+
+type unmarshalError struct {
+	awsError
+	bytes []byte
+}
+
+// Error returns the string representation of the error.
+// Satisfies the error interface.
+func (e unmarshalError) Error() string {
+	extra := hex.Dump(e.bytes)
+	return SprintError(e.Code(), e.Message(), extra, e.OrigErr())
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (e unmarshalError) String() string {
+	return e.Error()
+}
+
+// Bytes returns the bytes that failed to unmarshal.
+func (e unmarshalError) Bytes() []byte {
+	return e.bytes
+}
+
+// An error list that satisfies the golang interface
+type errorList []error
+
+// Error returns the string representation of the error.
+//
+// Satisfies the error interface.
+func (e errorList) Error() string {
+	msg := ""
+	// How do we want to handle the array size being zero
+	if size := len(e); size > 0 {
+		for i := 0; i < size; i++ {
+			msg += e[i].Error()
+			// We check the next index to see if it is within the slice.
+			// If it is, then we append a newline. We do this, because unit tests
+			// could be broken with the additional '\n'
+			if i+1 < size {
+				msg += "\n"
+			}
+		}
+	}
+	return msg
+}
@@ -0,0 +1,108 @@
+package awsutil
+
+import (
+	"io"
+	"reflect"
+	"time"
+)
+
+// Copy deeply copies a src structure to dst. Useful for copying request and
+// response structures.
+//
+// Can copy between structs of different type, but will only copy fields which
+// are assignable, and exist in both structs. Fields which are not assignable,
+// or do not exist in both structs are ignored.
+func Copy(dst, src interface{}) {
+	dstval := reflect.ValueOf(dst)
+	if !dstval.IsValid() {
+		panic("Copy dst cannot be nil")
+	}
+
+	rcopy(dstval, reflect.ValueOf(src), true)
+}
+
+// CopyOf returns a copy of src while also allocating the memory for dst.
+// src must be a pointer type or this operation will fail.
+func CopyOf(src interface{}) (dst interface{}) {
+	dsti := reflect.New(reflect.TypeOf(src).Elem())
+	dst = dsti.Interface()
+	rcopy(dsti, reflect.ValueOf(src), true)
+	return
+}
+
+// rcopy performs a recursive copy of values from the source to destination.
+//
+// root is used to skip certain aspects of the copy which are not valid
+// for the root node of a object.
+func rcopy(dst, src reflect.Value, root bool) {
+	if !src.IsValid() {
+		return
+	}
+
+	switch src.Kind() {
+	case reflect.Ptr:
+		if _, ok := src.Interface().(io.Reader); ok {
+			if dst.Kind() == reflect.Ptr && dst.Elem().CanSet() {
+				dst.Elem().Set(src)
+			} else if dst.CanSet() {
+				dst.Set(src)
+			}
+		} else {
+			e := src.Type().Elem()
+			if dst.CanSet() && !src.IsNil() {
+				if _, ok := src.Interface().(*time.Time); !ok {
+					dst.Set(reflect.New(e))
+				} else {
+					tempValue := reflect.New(e)
+					tempValue.Elem().Set(src.Elem())
+					// Sets time.Time's unexported values
+					dst.Set(tempValue)
+				}
+			}
+			if src.Elem().IsValid() {
+				// Keep the current root state since the depth hasn't changed
+				rcopy(dst.Elem(), src.Elem(), root)
+			}
+		}
+	case reflect.Struct:
+		t := dst.Type()
+		for i := 0; i < t.NumField(); i++ {
+			name := t.Field(i).Name
+			srcVal := src.FieldByName(name)
+			dstVal := dst.FieldByName(name)
+			if srcVal.IsValid() && dstVal.CanSet() {
+				rcopy(dstVal, srcVal, false)
+			}
+		}
+	case reflect.Slice:
+		if src.IsNil() {
+			break
+		}
+
+		s := reflect.MakeSlice(src.Type(), src.Len(), src.Cap())
+		dst.Set(s)
+		for i := 0; i < src.Len(); i++ {
+			rcopy(dst.Index(i), src.Index(i), false)
+		}
+	case reflect.Map:
+		if src.IsNil() {
+			break
+		}
+
+		s := reflect.MakeMap(src.Type())
+		dst.Set(s)
+		for _, k := range src.MapKeys() {
+			v := src.MapIndex(k)
+			v2 := reflect.New(v.Type()).Elem()
+			rcopy(v2, v, false)
+			dst.SetMapIndex(k, v2)
+		}
+	default:
+		// Assign the value if possible. If its not assignable, the value would
+		// need to be converted and the impact of that may be unexpected, or is
+		// not compatible with the dst type.
+		if src.Type().AssignableTo(dst.Type()) {
+			dst.Set(src)
+		}
+	}
+}
@@ -0,0 +1,27 @@
+package awsutil
+
+import (
+	"reflect"
+)
+
+// DeepEqual returns if the two values are deeply equal like reflect.DeepEqual.
+// In addition to this, this method will also dereference the input values if
+// possible so the DeepEqual performed will not fail if one parameter is a
+// pointer and the other is not.
+//
+// DeepEqual will not perform indirection of nested values of the input parameters.
+func DeepEqual(a, b interface{}) bool {
+	ra := reflect.Indirect(reflect.ValueOf(a))
+	rb := reflect.Indirect(reflect.ValueOf(b))
+
+	if raValid, rbValid := ra.IsValid(), rb.IsValid(); !raValid && !rbValid {
+		// If the elements are both nil, and of the same type they are equal
+		// If they are of different types they are not equal
+		return reflect.TypeOf(a) == reflect.TypeOf(b)
+	} else if raValid != rbValid {
+		// Both values must be valid to be equal
+		return false
+	}
+
+	return reflect.DeepEqual(ra.Interface(), rb.Interface())
+}
@@ -0,0 +1,221 @@
+package awsutil
+
+import (
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/jmespath/go-jmespath"
+)
+
+var indexRe = regexp.MustCompile(`(.+)\[(-?\d+)?\]$`)
+
+// rValuesAtPath returns a slice of values found in value v. The values
+// in v are explored recursively so all nested values are collected.
+func rValuesAtPath(v interface{}, path string, createPath, caseSensitive, nilTerm bool) []reflect.Value {
+	pathparts := strings.Split(path, "||")
+	if len(pathparts) > 1 {
+		for _, pathpart := range pathparts {
+			vals := rValuesAtPath(v, pathpart, createPath, caseSensitive, nilTerm)
+			if len(vals) > 0 {
+				return vals
+			}
+		}
+		return nil
+	}
+
+	values := []reflect.Value{reflect.Indirect(reflect.ValueOf(v))}
+	components := strings.Split(path, ".")
+	for len(values) > 0 && len(components) > 0 {
+		var index *int64
+		var indexStar bool
+		c := strings.TrimSpace(components[0])
+		if c == "" { // no actual component, illegal syntax
+			return nil
+		} else if caseSensitive && c != "*" && strings.ToLower(c[0:1]) == c[0:1] {
+			// TODO normalize case for user
+			return nil // don't support unexported fields
+		}
+
+		// parse this component
+		if m := indexRe.FindStringSubmatch(c); m != nil {
+			c = m[1]
+			if m[2] == "" {
+				index = nil
+				indexStar = true
+			} else {
+				i, _ := strconv.ParseInt(m[2], 10, 32)
+				index = &i
+				indexStar = false
+			}
+		}
+
+		nextvals := []reflect.Value{}
+		for _, value := range values {
+			// pull component name out of struct member
+			if value.Kind() != reflect.Struct {
+				continue
+			}
+
+			if c == "*" { // pull all members
+				for i := 0; i < value.NumField(); i++ {
+					if f := reflect.Indirect(value.Field(i)); f.IsValid() {
+						nextvals = append(nextvals, f)
+					}
+				}
+				continue
+			}
+
+			value = value.FieldByNameFunc(func(name string) bool {
+				if c == name {
+					return true
+				} else if !caseSensitive && strings.ToLower(name) == strings.ToLower(c) {
+					return true
+				}
+				return false
+			})
+
+			if nilTerm && value.Kind() == reflect.Ptr && len(components[1:]) == 0 {
+				if !value.IsNil() {
+					value.Set(reflect.Zero(value.Type()))
+				}
+				return []reflect.Value{value}
+			}
+
+			if createPath && value.Kind() == reflect.Ptr && value.IsNil() {
+				// TODO if the value is the terminus it should not be created
+				// if the value to be set to its position is nil.
+				value.Set(reflect.New(value.Type().Elem()))
+				value = value.Elem()
+			} else {
+				value = reflect.Indirect(value)
+			}
+
+			if value.Kind() == reflect.Slice || value.Kind() == reflect.Map {
+				if !createPath && value.IsNil() {
+					value = reflect.ValueOf(nil)
+				}
+			}
+
+			if value.IsValid() {
+				nextvals = append(nextvals, value)
+			}
+		}
+		values = nextvals
+
+		if indexStar || index != nil {
+			nextvals = []reflect.Value{}
+			for _, valItem := range values {
+				value := reflect.Indirect(valItem)
+				if value.Kind() != reflect.Slice {
+					continue
+				}
+
+				if indexStar { // grab all indices
+					for i := 0; i < value.Len(); i++ {
+						idx := reflect.Indirect(value.Index(i))
+						if idx.IsValid() {
+							nextvals = append(nextvals, idx)
+						}
+					}
+					continue
+				}
+
+				// pull out index
+				i := int(*index)
+				if i >= value.Len() { // check out of bounds
+					if createPath {
+						// TODO resize slice
+					} else {
+						continue
+					}
+				} else if i < 0 { // support negative indexing
+					i = value.Len() + i
+				}
+				value = reflect.Indirect(value.Index(i))
+
+				if value.Kind() == reflect.Slice || value.Kind() == reflect.Map {
+					if !createPath && value.IsNil() {
+						value = reflect.ValueOf(nil)
+					}
+				}
+
+				if value.IsValid() {
+					nextvals = append(nextvals, value)
+				}
+			}
+			values = nextvals
+		}
+
+		components = components[1:]
+	}
+	return values
+}
+
+// ValuesAtPath returns a list of values at the case insensitive lexical
+// path inside of a structure.
+func ValuesAtPath(i interface{}, path string) ([]interface{}, error) {
+	result, err := jmespath.Search(path, i)
+	if err != nil {
+		return nil, err
+	}
+
+	v := reflect.ValueOf(result)
+	if !v.IsValid() || (v.Kind() == reflect.Ptr && v.IsNil()) {
+		return nil, nil
+	}
+	if s, ok := result.([]interface{}); ok {
+		return s, err
+	}
+	if v.Kind() == reflect.Map && v.Len() == 0 {
+		return nil, nil
+	}
+	if v.Kind() == reflect.Slice {
+		out := make([]interface{}, v.Len())
+		for i := 0; i < v.Len(); i++ {
+			out[i] = v.Index(i).Interface()
+		}
+		return out, nil
+	}
+
+	return []interface{}{result}, nil
+}
+
+// SetValueAtPath sets a value at the case insensitive lexical path inside
+// of a structure.
+func SetValueAtPath(i interface{}, path string, v interface{}) {
+	rvals := rValuesAtPath(i, path, true, false, v == nil)
+	for _, rval := range rvals {
+		if rval.Kind() == reflect.Ptr && rval.IsNil() {
+			continue
+		}
+		setValue(rval, v)
+	}
+}
+
+func setValue(dstVal reflect.Value, src interface{}) {
+	if dstVal.Kind() == reflect.Ptr {
+		dstVal = reflect.Indirect(dstVal)
+	}
+	srcVal := reflect.ValueOf(src)
+
+	if !srcVal.IsValid() { // src is literal nil
+		if dstVal.CanAddr() {
+			// Convert to pointer so that pointer's value can be nil'ed
+			//                     dstVal = dstVal.Addr()
+		}
+		dstVal.Set(reflect.Zero(dstVal.Type()))
+
+	} else if srcVal.Kind() == reflect.Ptr {
+		if srcVal.IsNil() {
+			srcVal = reflect.Zero(dstVal.Type())
+		} else {
+			srcVal = reflect.ValueOf(src).Elem()
+		}
+		dstVal.Set(srcVal)
+	} else {
+		dstVal.Set(srcVal)
+	}
+
+}
@@ -0,0 +1,113 @@
+package awsutil
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+)
+
+// Prettify returns the string representation of a value.
+func Prettify(i interface{}) string {
+	var buf bytes.Buffer
+	prettify(reflect.ValueOf(i), 0, &buf)
+	return buf.String()
+}
+
+// prettify will recursively walk value v to build a textual
+// representation of the value.
+func prettify(v reflect.Value, indent int, buf *bytes.Buffer) {
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		strtype := v.Type().String()
+		if strtype == "time.Time" {
+			fmt.Fprintf(buf, "%s", v.Interface())
+			break
+		} else if strings.HasPrefix(strtype, "io.") {
+			buf.WriteString("<buffer>")
+			break
+		}
+
+		buf.WriteString("{\n")
+
+		names := []string{}
+		for i := 0; i < v.Type().NumField(); i++ {
+			name := v.Type().Field(i).Name
+			f := v.Field(i)
+			if name[0:1] == strings.ToLower(name[0:1]) {
+				continue // ignore unexported fields
+			}
+			if (f.Kind() == reflect.Ptr || f.Kind() == reflect.Slice || f.Kind() == reflect.Map) && f.IsNil() {
+				continue // ignore unset fields
+			}
+			names = append(names, name)
+		}
+
+		for i, n := range names {
+			val := v.FieldByName(n)
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(n + ": ")
+			prettify(val, indent+2, buf)
+
+			if i < len(names)-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	case reflect.Slice:
+		strtype := v.Type().String()
+		if strtype == "[]uint8" {
+			fmt.Fprintf(buf, "<binary> len %d", v.Len())
+			break
+		}
+
+		nl, id, id2 := "", "", ""
+		if v.Len() > 3 {
+			nl, id, id2 = "\n", strings.Repeat(" ", indent), strings.Repeat(" ", indent+2)
+		}
+		buf.WriteString("[" + nl)
+		for i := 0; i < v.Len(); i++ {
+			buf.WriteString(id2)
+			prettify(v.Index(i), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString("," + nl)
+			}
+		}
+
+		buf.WriteString(nl + id + "]")
+	case reflect.Map:
+		buf.WriteString("{\n")
+
+		for i, k := range v.MapKeys() {
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(k.String() + ": ")
+			prettify(v.MapIndex(k), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	default:
+		if !v.IsValid() {
+			fmt.Fprint(buf, "<invalid value>")
+			return
+		}
+		format := "%v"
+		switch v.Interface().(type) {
+		case string:
+			format = "%q"
+		case io.ReadSeeker, io.Reader:
+			format = "buffer(%p)"
+		}
+		fmt.Fprintf(buf, format, v.Interface())
+	}
+}
@@ -0,0 +1,88 @@
+package awsutil
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// StringValue returns the string representation of a value.
+func StringValue(i interface{}) string {
+	var buf bytes.Buffer
+	stringValue(reflect.ValueOf(i), 0, &buf)
+	return buf.String()
+}
+
+func stringValue(v reflect.Value, indent int, buf *bytes.Buffer) {
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		buf.WriteString("{\n")
+
+		for i := 0; i < v.Type().NumField(); i++ {
+			ft := v.Type().Field(i)
+			fv := v.Field(i)
+
+			if ft.Name[0:1] == strings.ToLower(ft.Name[0:1]) {
+				continue // ignore unexported fields
+			}
+			if (fv.Kind() == reflect.Ptr || fv.Kind() == reflect.Slice) && fv.IsNil() {
+				continue // ignore unset fields
+			}
+
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(ft.Name + ": ")
+
+			if tag := ft.Tag.Get("sensitive"); tag == "true" {
+				buf.WriteString("<sensitive>")
+			} else {
+				stringValue(fv, indent+2, buf)
+			}
+
+			buf.WriteString(",\n")
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	case reflect.Slice:
+		nl, id, id2 := "", "", ""
+		if v.Len() > 3 {
+			nl, id, id2 = "\n", strings.Repeat(" ", indent), strings.Repeat(" ", indent+2)
+		}
+		buf.WriteString("[" + nl)
+		for i := 0; i < v.Len(); i++ {
+			buf.WriteString(id2)
+			stringValue(v.Index(i), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString("," + nl)
+			}
+		}
+
+		buf.WriteString(nl + id + "]")
+	case reflect.Map:
+		buf.WriteString("{\n")
+
+		for i, k := range v.MapKeys() {
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(k.String() + ": ")
+			stringValue(v.MapIndex(k), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	default:
+		format := "%v"
+		switch v.Interface().(type) {
+		case string:
+			format = "%q"
+		}
+		fmt.Fprintf(buf, format, v.Interface())
+	}
+}
@@ -0,0 +1,96 @@
+package client
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// A Config provides configuration to a service client instance.
+type Config struct {
+	Config        *aws.Config
+	Handlers      request.Handlers
+	Endpoint      string
+	SigningRegion string
+	SigningName   string
+
+	// States that the signing name did not come from a modeled source but
+	// was derived based on other data. Used by service client constructors
+	// to determine if the signin name can be overridden based on metadata the
+	// service has.
+	SigningNameDerived bool
+}
+
+// ConfigProvider provides a generic way for a service client to receive
+// the ClientConfig without circular dependencies.
+type ConfigProvider interface {
+	ClientConfig(serviceName string, cfgs ...*aws.Config) Config
+}
+
+// ConfigNoResolveEndpointProvider same as ConfigProvider except it will not
+// resolve the endpoint automatically. The service client's endpoint must be
+// provided via the aws.Config.Endpoint field.
+type ConfigNoResolveEndpointProvider interface {
+	ClientConfigNoResolveEndpoint(cfgs ...*aws.Config) Config
+}
+
+// A Client implements the base client request and response handling
+// used by all service clients.
+type Client struct {
+	request.Retryer
+	metadata.ClientInfo
+
+	Config   aws.Config
+	Handlers request.Handlers
+}
+
+// New will return a pointer to a new initialized service client.
+func New(cfg aws.Config, info metadata.ClientInfo, handlers request.Handlers, options ...func(*Client)) *Client {
+	svc := &Client{
+		Config:     cfg,
+		ClientInfo: info,
+		Handlers:   handlers.Copy(),
+	}
+
+	switch retryer, ok := cfg.Retryer.(request.Retryer); {
+	case ok:
+		svc.Retryer = retryer
+	case cfg.Retryer != nil && cfg.Logger != nil:
+		s := fmt.Sprintf("WARNING: %T does not implement request.Retryer; using DefaultRetryer instead", cfg.Retryer)
+		cfg.Logger.Log(s)
+		fallthrough
+	default:
+		maxRetries := aws.IntValue(cfg.MaxRetries)
+		if cfg.MaxRetries == nil || maxRetries == aws.UseServiceDefaultRetries {
+			maxRetries = 3
+		}
+		svc.Retryer = DefaultRetryer{NumMaxRetries: maxRetries}
+	}
+
+	svc.AddDebugHandlers()
+
+	for _, option := range options {
+		option(svc)
+	}
+
+	return svc
+}
+
+// NewRequest returns a new Request pointer for the service API
+// operation and parameters.
+func (c *Client) NewRequest(operation *request.Operation, params interface{}, data interface{}) *request.Request {
+	return request.New(c.Config, c.ClientInfo, c.Handlers, c.Retryer, operation, params, data)
+}
+
+// AddDebugHandlers injects debug logging handlers into the service to log request
+// debug information.
+func (c *Client) AddDebugHandlers() {
+	if !c.Config.LogLevel.AtLeast(aws.LogDebug) {
+		return
+	}
+
+	c.Handlers.Send.PushFrontNamed(LogHTTPRequestHandler)
+	c.Handlers.Send.PushBackNamed(LogHTTPResponseHandler)
+}
@@ -0,0 +1,103 @@
+package client
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/sdkrand"
+)
+
+// DefaultRetryer implements basic retry logic using exponential backoff for
+// most services. If you want to implement custom retry logic, implement the
+// request.Retryer interface or create a structure type that composes this
+// struct and override the specific methods. For example, to override only
+// the MaxRetries method:
+//
+//   type retryer struct {
+//       client.DefaultRetryer
+//   }
+//
+//   // This implementation always has 100 max retries
+//   func (d retryer) MaxRetries() int { return 100 }
+type DefaultRetryer struct {
+	NumMaxRetries int
+}
+
+// MaxRetries returns the number of maximum returns the service will use to make
+// an individual API request.
+func (d DefaultRetryer) MaxRetries() int {
+	return d.NumMaxRetries
+}
+
+// RetryRules returns the delay duration before retrying this request again
+func (d DefaultRetryer) RetryRules(r *request.Request) time.Duration {
+	// Set the upper limit of delay in retrying at ~five minutes
+	minTime := 30
+	isThrottle := r.IsErrorThrottle()
+	if isThrottle {
+		if delay, ok := getRetryDelay(r); ok {
+			return delay
+		}
+
+		minTime = 500
+	}
+
+	retryCount := r.RetryCount
+	if isThrottle && retryCount > 8 {
+		retryCount = 8
+	} else if retryCount > 13 {
+		retryCount = 13
+	}
+
+	delay := (1 << uint(retryCount)) * (sdkrand.SeededRand.Intn(minTime) + minTime)
+	return time.Duration(delay) * time.Millisecond
+}
+
+// ShouldRetry returns true if the request should be retried.
+func (d DefaultRetryer) ShouldRetry(r *request.Request) bool {
+	// If one of the other handlers already set the retry state
+	// we don't want to override it based on the service's state
+	if r.Retryable != nil {
+		return *r.Retryable
+	}
+
+	if r.HTTPResponse.StatusCode >= 500 && r.HTTPResponse.StatusCode != 501 {
+		return true
+	}
+
+	return r.IsErrorRetryable() || r.IsErrorThrottle()
+}
+
+// This will look in the Retry-After header, RFC 7231, for how long
+// it will wait before attempting another request
+func getRetryDelay(r *request.Request) (time.Duration, bool) {
+	if !canUseRetryAfterHeader(r) {
+		return 0, false
+	}
+
+	delayStr := r.HTTPResponse.Header.Get("Retry-After")
+	if len(delayStr) == 0 {
+		return 0, false
+	}
+
+	delay, err := strconv.Atoi(delayStr)
+	if err != nil {
+		return 0, false
+	}
+
+	return time.Duration(delay) * time.Second, true
+}
+
+// Will look at the status code to see if the retry header pertains to
+// the status code.
+func canUseRetryAfterHeader(r *request.Request) bool {
+	switch r.HTTPResponse.StatusCode {
+	case 429:
+	case 503:
+	default:
+		return false
+	}
+
+	return true
+}
@@ -0,0 +1,194 @@
+package client
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http/httputil"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+const logReqMsg = `DEBUG: Request %s/%s Details:
+---[ REQUEST POST-SIGN ]-----------------------------
+%s
+-----------------------------------------------------`
+
+const logReqErrMsg = `DEBUG ERROR: Request %s/%s:
+---[ REQUEST DUMP ERROR ]-----------------------------
+%s
+------------------------------------------------------`
+
+type logWriter struct {
+	// Logger is what we will use to log the payload of a response.
+	Logger aws.Logger
+	// buf stores the contents of what has been read
+	buf *bytes.Buffer
+}
+
+func (logger *logWriter) Write(b []byte) (int, error) {
+	return logger.buf.Write(b)
+}
+
+type teeReaderCloser struct {
+	// io.Reader will be a tee reader that is used during logging.
+	// This structure will read from a body and write the contents to a logger.
+	io.Reader
+	// Source is used just to close when we are done reading.
+	Source io.ReadCloser
+}
+
+func (reader *teeReaderCloser) Close() error {
+	return reader.Source.Close()
+}
+
+// LogHTTPRequestHandler is a SDK request handler to log the HTTP request sent
+// to a service. Will include the HTTP request body if the LogLevel of the
+// request matches LogDebugWithHTTPBody.
+var LogHTTPRequestHandler = request.NamedHandler{
+	Name: "awssdk.client.LogRequest",
+	Fn:   logRequest,
+}
+
+func logRequest(r *request.Request) {
+	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
+	bodySeekable := aws.IsReaderSeekable(r.Body)
+
+	b, err := httputil.DumpRequestOut(r.HTTPRequest, logBody)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	if logBody {
+		if !bodySeekable {
+			r.SetReaderBody(aws.ReadSeekCloser(r.HTTPRequest.Body))
+		}
+		// Reset the request body because dumpRequest will re-wrap the
+		// r.HTTPRequest's Body as a NoOpCloser and will not be reset after
+		// read by the HTTP client reader.
+		if err := r.Error; err != nil {
+			r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+				r.ClientInfo.ServiceName, r.Operation.Name, err))
+			return
+		}
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logReqMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
+
+// LogHTTPRequestHeaderHandler is a SDK request handler to log the HTTP request sent
+// to a service. Will only log the HTTP request's headers. The request payload
+// will not be read.
+var LogHTTPRequestHeaderHandler = request.NamedHandler{
+	Name: "awssdk.client.LogRequestHeader",
+	Fn:   logRequestHeader,
+}
+
+func logRequestHeader(r *request.Request) {
+	b, err := httputil.DumpRequestOut(r.HTTPRequest, false)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logReqMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
+
+const logRespMsg = `DEBUG: Response %s/%s Details:
+---[ RESPONSE ]--------------------------------------
+%s
+-----------------------------------------------------`
+
+const logRespErrMsg = `DEBUG ERROR: Response %s/%s:
+---[ RESPONSE DUMP ERROR ]-----------------------------
+%s
+-----------------------------------------------------`
+
+// LogHTTPResponseHandler is a SDK request handler to log the HTTP response
+// received from a service. Will include the HTTP response body if the LogLevel
+// of the request matches LogDebugWithHTTPBody.
+var LogHTTPResponseHandler = request.NamedHandler{
+	Name: "awssdk.client.LogResponse",
+	Fn:   logResponse,
+}
+
+func logResponse(r *request.Request) {
+	lw := &logWriter{r.Config.Logger, bytes.NewBuffer(nil)}
+
+	if r.HTTPResponse == nil {
+		lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, "request's HTTPResponse is nil"))
+		return
+	}
+
+	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
+	if logBody {
+		r.HTTPResponse.Body = &teeReaderCloser{
+			Reader: io.TeeReader(r.HTTPResponse.Body, lw),
+			Source: r.HTTPResponse.Body,
+		}
+	}
+
+	handlerFn := func(req *request.Request) {
+		b, err := httputil.DumpResponse(req.HTTPResponse, false)
+		if err != nil {
+			lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+				req.ClientInfo.ServiceName, req.Operation.Name, err))
+			return
+		}
+
+		lw.Logger.Log(fmt.Sprintf(logRespMsg,
+			req.ClientInfo.ServiceName, req.Operation.Name, string(b)))
+
+		if logBody {
+			b, err := ioutil.ReadAll(lw.buf)
+			if err != nil {
+				lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+					req.ClientInfo.ServiceName, req.Operation.Name, err))
+				return
+			}
+
+			lw.Logger.Log(string(b))
+		}
+	}
+
+	const handlerName = "awsdk.client.LogResponse.ResponseBody"
+
+	r.Handlers.Unmarshal.SetBackNamed(request.NamedHandler{
+		Name: handlerName, Fn: handlerFn,
+	})
+	r.Handlers.UnmarshalError.SetBackNamed(request.NamedHandler{
+		Name: handlerName, Fn: handlerFn,
+	})
+}
+
+// LogHTTPResponseHeaderHandler is a SDK request handler to log the HTTP
+// response received from a service. Will only log the HTTP response's headers.
+// The response payload will not be read.
+var LogHTTPResponseHeaderHandler = request.NamedHandler{
+	Name: "awssdk.client.LogResponseHeader",
+	Fn:   logResponseHeader,
+}
+
+func logResponseHeader(r *request.Request) {
+	if r.Config.Logger == nil {
+		return
+	}
+
+	b, err := httputil.DumpResponse(r.HTTPResponse, false)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logRespErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logRespMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
@@ -0,0 +1,13 @@
+package metadata
+
+// ClientInfo wraps immutable data from the client.Client structure.
+type ClientInfo struct {
+	ServiceName   string
+	ServiceID     string
+	APIVersion    string
+	Endpoint      string
+	SigningName   string
+	SigningRegion string
+	JSONVersion   string
+	TargetPrefix  string
+}
@@ -0,0 +1,536 @@
+package aws
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+)
+
+// UseServiceDefaultRetries instructs the config to use the service's own
+// default number of retries. This will be the default action if
+// Config.MaxRetries is nil also.
+const UseServiceDefaultRetries = -1
+
+// RequestRetryer is an alias for a type that implements the request.Retryer
+// interface.
+type RequestRetryer interface{}
+
+// A Config provides service configuration for service clients. By default,
+// all clients will use the defaults.DefaultConfig structure.
+//
+//     // Create Session with MaxRetries configuration to be shared by multiple
+//     // service clients.
+//     sess := session.Must(session.NewSession(&aws.Config{
+//         MaxRetries: aws.Int(3),
+//     }))
+//
+//     // Create S3 service client with a specific Region.
+//     svc := s3.New(sess, &aws.Config{
+//         Region: aws.String("us-west-2"),
+//     })
+type Config struct {
+	// Enables verbose error printing of all credential chain errors.
+	// Should be used when wanting to see all errors while attempting to
+	// retrieve credentials.
+	CredentialsChainVerboseErrors *bool
+
+	// The credentials object to use when signing requests. Defaults to a
+	// chain of credential providers to search for credentials in environment
+	// variables, shared credential file, and EC2 Instance Roles.
+	Credentials *credentials.Credentials
+
+	// An optional endpoint URL (hostname only or fully qualified URI)
+	// that overrides the default generated endpoint for a client. Set this
+	// to `""` to use the default generated endpoint.
+	//
+	// Note: You must still provide a `Region` value when specifying an
+	// endpoint for a client.
+	Endpoint *string
+
+	// The resolver to use for looking up endpoints for AWS service clients
+	// to use based on region.
+	EndpointResolver endpoints.Resolver
+
+	// EnforceShouldRetryCheck is used in the AfterRetryHandler to always call
+	// ShouldRetry regardless of whether or not if request.Retryable is set.
+	// This will utilize ShouldRetry method of custom retryers. If EnforceShouldRetryCheck
+	// is not set, then ShouldRetry will only be called if request.Retryable is nil.
+	// Proper handling of the request.Retryable field is important when setting this field.
+	EnforceShouldRetryCheck *bool
+
+	// The region to send requests to. This parameter is required and must
+	// be configured globally or on a per-client basis unless otherwise
+	// noted. A full list of regions is found in the "Regions and Endpoints"
+	// document.
+	//
+	// See http://docs.aws.amazon.com/general/latest/gr/rande.html for AWS
+	// Regions and Endpoints.
+	Region *string
+
+	// Set this to `true` to disable SSL when sending requests. Defaults
+	// to `false`.
+	DisableSSL *bool
+
+	// The HTTP client to use when sending requests. Defaults to
+	// `http.DefaultClient`.
+	HTTPClient *http.Client
+
+	// An integer value representing the logging level. The default log level
+	// is zero (LogOff), which represents no logging. To enable logging set
+	// to a LogLevel Value.
+	LogLevel *LogLevelType
+
+	// The logger writer interface to write logging messages to. Defaults to
+	// standard out.
+	Logger Logger
+
+	// The maximum number of times that a request will be retried for failures.
+	// Defaults to -1, which defers the max retry setting to the service
+	// specific configuration.
+	MaxRetries *int
+
+	// Retryer guides how HTTP requests should be retried in case of
+	// recoverable failures.
+	//
+	// When nil or the value does not implement the request.Retryer interface,
+	// the client.DefaultRetryer will be used.
+	//
+	// When both Retryer and MaxRetries are non-nil, the former is used and
+	// the latter ignored.
+	//
+	// To set the Retryer field in a type-safe manner and with chaining, use
+	// the request.WithRetryer helper function:
+	//
+	//   cfg := request.WithRetryer(aws.NewConfig(), myRetryer)
+	//
+	Retryer RequestRetryer
+
+	// Disables semantic parameter validation, which validates input for
+	// missing required fields and/or other semantic request input errors.
+	DisableParamValidation *bool
+
+	// Disables the computation of request and response checksums, e.g.,
+	// CRC32 checksums in Amazon DynamoDB.
+	DisableComputeChecksums *bool
+
+	// Set this to `true` to force the request to use path-style addressing,
+	// i.e., `http://s3.amazonaws.com/BUCKET/KEY`. By default, the S3 client
+	// will use virtual hosted bucket addressing when possible
+	// (`http://BUCKET.s3.amazonaws.com/KEY`).
+	//
+	// Note: This configuration option is specific to the Amazon S3 service.
+	//
+	// See http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
+	// for Amazon S3: Virtual Hosting of Buckets
+	S3ForcePathStyle *bool
+
+	// Set this to `true` to disable the SDK adding the `Expect: 100-Continue`
+	// header to PUT requests over 2MB of content. 100-Continue instructs the
+	// HTTP client not to send the body until the service responds with a
+	// `continue` status. This is useful to prevent sending the request body
+	// until after the request is authenticated, and validated.
+	//
+	// http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html
+	//
+	// 100-Continue is only enabled for Go 1.6 and above. See `http.Transport`'s
+	// `ExpectContinueTimeout` for information on adjusting the continue wait
+	// timeout. https://golang.org/pkg/net/http/#Transport
+	//
+	// You should use this flag to disble 100-Continue if you experience issues
+	// with proxies or third party S3 compatible services.
+	S3Disable100Continue *bool
+
+	// Set this to `true` to enable S3 Accelerate feature. For all operations
+	// compatible with S3 Accelerate will use the accelerate endpoint for
+	// requests. Requests not compatible will fall back to normal S3 requests.
+	//
+	// The bucket must be enable for accelerate to be used with S3 client with
+	// accelerate enabled. If the bucket is not enabled for accelerate an error
+	// will be returned. The bucket name must be DNS compatible to also work
+	// with accelerate.
+	S3UseAccelerate *bool
+
+	// S3DisableContentMD5Validation config option is temporarily disabled,
+	// For S3 GetObject API calls, #1837.
+	//
+	// Set this to `true` to disable the S3 service client from automatically
+	// adding the ContentMD5 to S3 Object Put and Upload API calls. This option
+	// will also disable the SDK from performing object ContentMD5 validation
+	// on GetObject API calls.
+	S3DisableContentMD5Validation *bool
+
+	// Set this to `true` to disable the EC2Metadata client from overriding the
+	// default http.Client's Timeout. This is helpful if you do not want the
+	// EC2Metadata client to create a new http.Client. This options is only
+	// meaningful if you're not already using a custom HTTP client with the
+	// SDK. Enabled by default.
+	//
+	// Must be set and provided to the session.NewSession() in order to disable
+	// the EC2Metadata overriding the timeout for default credentials chain.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(aws.NewConfig()
+	//       .WithEC2MetadataDiableTimeoutOverride(true)))
+	//
+	//    svc := s3.New(sess)
+	//
+	EC2MetadataDisableTimeoutOverride *bool
+
+	// Instructs the endpoint to be generated for a service client to
+	// be the dual stack endpoint. The dual stack endpoint will support
+	// both IPv4 and IPv6 addressing.
+	//
+	// Setting this for a service which does not support dual stack will fail
+	// to make requets. It is not recommended to set this value on the session
+	// as it will apply to all service clients created with the session. Even
+	// services which don't support dual stack endpoints.
+	//
+	// If the Endpoint config value is also provided the UseDualStack flag
+	// will be ignored.
+	//
+	// Only supported with.
+	//
+	//     sess := session.Must(session.NewSession())
+	//
+	//     svc := s3.New(sess, &aws.Config{
+	//         UseDualStack: aws.Bool(true),
+	//     })
+	UseDualStack *bool
+
+	// SleepDelay is an override for the func the SDK will call when sleeping
+	// during the lifecycle of a request. Specifically this will be used for
+	// request delays. This value should only be used for testing. To adjust
+	// the delay of a request see the aws/client.DefaultRetryer and
+	// aws/request.Retryer.
+	//
+	// SleepDelay will prevent any Context from being used for canceling retry
+	// delay of an API operation. It is recommended to not use SleepDelay at all
+	// and specify a Retryer instead.
+	SleepDelay func(time.Duration)
+
+	// DisableRestProtocolURICleaning will not clean the URL path when making rest protocol requests.
+	// Will default to false. This would only be used for empty directory names in s3 requests.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(&aws.Config{
+	//         DisableRestProtocolURICleaning: aws.Bool(true),
+	//    }))
+	//
+	//    svc := s3.New(sess)
+	//    out, err := svc.GetObject(&s3.GetObjectInput {
+	//    	Bucket: aws.String("bucketname"),
+	//    	Key: aws.String("//foo//bar//moo"),
+	//    })
+	DisableRestProtocolURICleaning *bool
+
+	// EnableEndpointDiscovery will allow for endpoint discovery on operations that
+	// have the definition in its model. By default, endpoint discovery is off.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(&aws.Config{
+	//         EnableEndpointDiscovery: aws.Bool(true),
+	//    }))
+	//
+	//    svc := s3.New(sess)
+	//    out, err := svc.GetObject(&s3.GetObjectInput {
+	//    	Bucket: aws.String("bucketname"),
+	//    	Key: aws.String("/foo/bar/moo"),
+	//    })
+	EnableEndpointDiscovery *bool
+
+	// DisableEndpointHostPrefix will disable the SDK's behavior of prefixing
+	// request endpoint hosts with modeled information.
+	//
+	// Disabling this feature is useful when you want to use local endpoints
+	// for testing that do not support the modeled host prefix pattern.
+	DisableEndpointHostPrefix *bool
+}
+
+// NewConfig returns a new Config pointer that can be chained with builder
+// methods to set multiple configuration values inline without using pointers.
+//
+//     // Create Session with MaxRetries configuration to be shared by multiple
+//     // service clients.
+//     sess := session.Must(session.NewSession(aws.NewConfig().
+//         WithMaxRetries(3),
+//     ))
+//
+//     // Create S3 service client with a specific Region.
+//     svc := s3.New(sess, aws.NewConfig().
+//         WithRegion("us-west-2"),
+//     )
+func NewConfig() *Config {
+	return &Config{}
+}
+
+// WithCredentialsChainVerboseErrors sets a config verbose errors boolean and returning
+// a Config pointer.
+func (c *Config) WithCredentialsChainVerboseErrors(verboseErrs bool) *Config {
+	c.CredentialsChainVerboseErrors = &verboseErrs
+	return c
+}
+
+// WithCredentials sets a config Credentials value returning a Config pointer
+// for chaining.
+func (c *Config) WithCredentials(creds *credentials.Credentials) *Config {
+	c.Credentials = creds
+	return c
+}
+
+// WithEndpoint sets a config Endpoint value returning a Config pointer for
+// chaining.
+func (c *Config) WithEndpoint(endpoint string) *Config {
+	c.Endpoint = &endpoint
+	return c
+}
+
+// WithEndpointResolver sets a config EndpointResolver value returning a
+// Config pointer for chaining.
+func (c *Config) WithEndpointResolver(resolver endpoints.Resolver) *Config {
+	c.EndpointResolver = resolver
+	return c
+}
+
+// WithRegion sets a config Region value returning a Config pointer for
+// chaining.
+func (c *Config) WithRegion(region string) *Config {
+	c.Region = &region
+	return c
+}
+
+// WithDisableSSL sets a config DisableSSL value returning a Config pointer
+// for chaining.
+func (c *Config) WithDisableSSL(disable bool) *Config {
+	c.DisableSSL = &disable
+	return c
+}
+
+// WithHTTPClient sets a config HTTPClient value returning a Config pointer
+// for chaining.
+func (c *Config) WithHTTPClient(client *http.Client) *Config {
+	c.HTTPClient = client
+	return c
+}
+
+// WithMaxRetries sets a config MaxRetries value returning a Config pointer
+// for chaining.
+func (c *Config) WithMaxRetries(max int) *Config {
+	c.MaxRetries = &max
+	return c
+}
+
+// WithDisableParamValidation sets a config DisableParamValidation value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableParamValidation(disable bool) *Config {
+	c.DisableParamValidation = &disable
+	return c
+}
+
+// WithDisableComputeChecksums sets a config DisableComputeChecksums value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableComputeChecksums(disable bool) *Config {
+	c.DisableComputeChecksums = &disable
+	return c
+}
+
+// WithLogLevel sets a config LogLevel value returning a Config pointer for
+// chaining.
+func (c *Config) WithLogLevel(level LogLevelType) *Config {
+	c.LogLevel = &level
+	return c
+}
+
+// WithLogger sets a config Logger value returning a Config pointer for
+// chaining.
+func (c *Config) WithLogger(logger Logger) *Config {
+	c.Logger = logger
+	return c
+}
+
+// WithS3ForcePathStyle sets a config S3ForcePathStyle value returning a Config
+// pointer for chaining.
+func (c *Config) WithS3ForcePathStyle(force bool) *Config {
+	c.S3ForcePathStyle = &force
+	return c
+}
+
+// WithS3Disable100Continue sets a config S3Disable100Continue value returning
+// a Config pointer for chaining.
+func (c *Config) WithS3Disable100Continue(disable bool) *Config {
+	c.S3Disable100Continue = &disable
+	return c
+}
+
+// WithS3UseAccelerate sets a config S3UseAccelerate value returning a Config
+// pointer for chaining.
+func (c *Config) WithS3UseAccelerate(enable bool) *Config {
+	c.S3UseAccelerate = &enable
+	return c
+
+}
+
+// WithS3DisableContentMD5Validation sets a config
+// S3DisableContentMD5Validation value returning a Config pointer for chaining.
+func (c *Config) WithS3DisableContentMD5Validation(enable bool) *Config {
+	c.S3DisableContentMD5Validation = &enable
+	return c
+
+}
+
+// WithUseDualStack sets a config UseDualStack value returning a Config
+// pointer for chaining.
+func (c *Config) WithUseDualStack(enable bool) *Config {
+	c.UseDualStack = &enable
+	return c
+}
+
+// WithEC2MetadataDisableTimeoutOverride sets a config EC2MetadataDisableTimeoutOverride value
+// returning a Config pointer for chaining.
+func (c *Config) WithEC2MetadataDisableTimeoutOverride(enable bool) *Config {
+	c.EC2MetadataDisableTimeoutOverride = &enable
+	return c
+}
+
+// WithSleepDelay overrides the function used to sleep while waiting for the
+// next retry. Defaults to time.Sleep.
+func (c *Config) WithSleepDelay(fn func(time.Duration)) *Config {
+	c.SleepDelay = fn
+	return c
+}
+
+// WithEndpointDiscovery will set whether or not to use endpoint discovery.
+func (c *Config) WithEndpointDiscovery(t bool) *Config {
+	c.EnableEndpointDiscovery = &t
+	return c
+}
+
+// WithDisableEndpointHostPrefix will set whether or not to use modeled host prefix
+// when making requests.
+func (c *Config) WithDisableEndpointHostPrefix(t bool) *Config {
+	c.DisableEndpointHostPrefix = &t
+	return c
+}
+
+// MergeIn merges the passed in configs into the existing config object.
+func (c *Config) MergeIn(cfgs ...*Config) {
+	for _, other := range cfgs {
+		mergeInConfig(c, other)
+	}
+}
+
+func mergeInConfig(dst *Config, other *Config) {
+	if other == nil {
+		return
+	}
+
+	if other.CredentialsChainVerboseErrors != nil {
+		dst.CredentialsChainVerboseErrors = other.CredentialsChainVerboseErrors
+	}
+
+	if other.Credentials != nil {
+		dst.Credentials = other.Credentials
+	}
+
+	if other.Endpoint != nil {
+		dst.Endpoint = other.Endpoint
+	}
+
+	if other.EndpointResolver != nil {
+		dst.EndpointResolver = other.EndpointResolver
+	}
+
+	if other.Region != nil {
+		dst.Region = other.Region
+	}
+
+	if other.DisableSSL != nil {
+		dst.DisableSSL = other.DisableSSL
+	}
+
+	if other.HTTPClient != nil {
+		dst.HTTPClient = other.HTTPClient
+	}
+
+	if other.LogLevel != nil {
+		dst.LogLevel = other.LogLevel
+	}
+
+	if other.Logger != nil {
+		dst.Logger = other.Logger
+	}
+
+	if other.MaxRetries != nil {
+		dst.MaxRetries = other.MaxRetries
+	}
+
+	if other.Retryer != nil {
+		dst.Retryer = other.Retryer
+	}
+
+	if other.DisableParamValidation != nil {
+		dst.DisableParamValidation = other.DisableParamValidation
+	}
+
+	if other.DisableComputeChecksums != nil {
+		dst.DisableComputeChecksums = other.DisableComputeChecksums
+	}
+
+	if other.S3ForcePathStyle != nil {
+		dst.S3ForcePathStyle = other.S3ForcePathStyle
+	}
+
+	if other.S3Disable100Continue != nil {
+		dst.S3Disable100Continue = other.S3Disable100Continue
+	}
+
+	if other.S3UseAccelerate != nil {
+		dst.S3UseAccelerate = other.S3UseAccelerate
+	}
+
+	if other.S3DisableContentMD5Validation != nil {
+		dst.S3DisableContentMD5Validation = other.S3DisableContentMD5Validation
+	}
+
+	if other.UseDualStack != nil {
+		dst.UseDualStack = other.UseDualStack
+	}
+
+	if other.EC2MetadataDisableTimeoutOverride != nil {
+		dst.EC2MetadataDisableTimeoutOverride = other.EC2MetadataDisableTimeoutOverride
+	}
+
+	if other.SleepDelay != nil {
+		dst.SleepDelay = other.SleepDelay
+	}
+
+	if other.DisableRestProtocolURICleaning != nil {
+		dst.DisableRestProtocolURICleaning = other.DisableRestProtocolURICleaning
+	}
+
+	if other.EnforceShouldRetryCheck != nil {
+		dst.EnforceShouldRetryCheck = other.EnforceShouldRetryCheck
+	}
+
+	if other.EnableEndpointDiscovery != nil {
+		dst.EnableEndpointDiscovery = other.EnableEndpointDiscovery
+	}
+
+	if other.DisableEndpointHostPrefix != nil {
+		dst.DisableEndpointHostPrefix = other.DisableEndpointHostPrefix
+	}
+}
+
+// Copy will return a shallow copy of the Config object. If any additional
+// configurations are provided they will be merged into the new config returned.
+func (c *Config) Copy(cfgs ...*Config) *Config {
+	dst := &Config{}
+	dst.MergeIn(c)
+
+	for _, cfg := range cfgs {
+		dst.MergeIn(cfg)
+	}
+
+	return dst
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Areg Harutyunyan	2cac1f0f78	Release 2019.9.0	2019-09-05 22:15:19 -05:00
Areg Harutyunyan	a10785a701	TUN-2279: Revert path encoding fix This reverts commit `f6c7f8a96c`.	2019-09-05 22:03:31 -05:00
Nick Vollmar	dc730615f2	TUN-2260: add name/group to CapnpConnectParameters, remove Scope	2019-09-05 15:36:16 +00:00
Nick Vollmar	b836cb350a	TUN-2162: Decomplect OpenStream to allow finer-grained timeouts	2019-09-05 15:23:41 +00:00
Austin Cherry	5e85a8bd16	AUTH-1943: Adds session logging	2019-09-03 13:54:29 -05:00
Dalton	f41121f4e5	AUTH-2021 - check error for failing tests	2019-08-30 15:20:49 -05:00
Michael Borkenstein	93a9504824	AUTH-2026: Adds support for non-pty sessions and inline command exec	2019-08-30 14:26:53 -05:00
Michael Borkenstein	7abbe91d41	AUTH-2030: Support both authorized_key and short lived cert authentication simultaniously without specifiying at start time	2019-08-30 19:23:10 +00:00
Areg Harutyunyan	cf314ddb58	Release 2019.8.4	2019-08-30 13:50:41 -05:00
Areg Harutyunyan	ff97fb6dc8	Merge branch 'master' of github.com:cloudflare/cloudflared	2019-08-30 13:45:40 -05:00
David Barr	dc48cdce1a	Fix #111 : Add support for specifying a specific HTTP Host: header on the origin. (#114 )	2019-08-29 22:55:54 -05:00
Dalton	f130e6d4d7	AUTH-2021 - s3 bucket uploading for SSH logs	2019-08-29 16:54:54 -05:00
Adam Chalmers	ef5b44b2d0	TUN-1968: Gracefully diff StreamHandler.UpdateConfig	2019-08-29 16:51:23 +00:00
Michael Borkenstein	858ef29868	AUTH-2022: Adds ssh timeout configuration	2019-08-28 15:22:35 -05:00
Michael Borkenstein	baec3e289e	AUTH-2018: Adds support for authorized keys and short lived certs	2019-08-28 09:58:42 -05:00
Adam Chalmers	df25ed9bde	TUN-2244: Add NO_AUTOUPDATE env var	2019-08-27 15:53:28 -05:00
Adam Chalmers	4e1df1a211	TUN-2243: Revert "STOR-519: Add db-connect, a SQL over HTTPS server" This reverts commit `5da2109811`.	2019-08-26 16:50:12 -05:00
Michael Borkenstein	c3c88cc31e	AUTH-2014: Checks users login shell	2019-08-26 18:14:39 +00:00
Adam Chalmers	fb8ff33203	TUN-2165: Add ClientConfig to tunnelrpc.ConnectResult	2019-08-26 16:27:28 +00:00
Michael Borkenstein	188f4667cb	AUTH-2004: Adds static host key support	2019-08-26 10:29:13 -05:00
Austin Cherry	30c9e2af9b	AUTH-1941: Adds initial SSH server implementation	2019-08-21 15:49:03 -05:00
				`@@ -0,0 +1 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRzoSSVi8L0HTjWoQZYM26i3obi1NWb0sJALS8D6/afbmu70Ig1XrwiWOZcE5FcHB8bo90uGDRIRptlRuw1flashVsai9yCEpLoZGyojn5C6Gb6jx4bTjYkT+EGhh1nX1NwwTI84bMezHRT8FI31klZULGo3nWIjqrKHP1/qOVfYtAEUS9eWHGAXejAER/xQJm39S9tl2Z57Io1ASU+aJUsgkQA8K54QKntraaMKI/fOqMO9J54aTgJ6UH/WplnhXaft+9sdmMAHkkmzgpezmjwqC9CeqBAzGIsVng8BO3j6bETOHgnKamluok6jatjA4DdMAgRZa1hFX9konQDKGF mike@C02Y50TGJGH8`
				`@@ -0,0 +1 @@`
				ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgOsuFqKdzp/nC3wQfKVJBdHa8axtGryKplPkDjdSXT4kAAAADAQABAAACAQDrQqd6jzuo+yH7MStYWXu/H3dzt/JPFtn2VQ2pp+BfL8Es4Jz+dBIxyixVIuxCtseWFjN+ZkSFOK5ua5hSsdyGayfWaXUcio/xPloOC01supidLgfmg7hKPX5ceVC1TufvMdeBxr1Kcxa3UWGTHWa+R6I4qzR6ruFXZO4hnF+Zth8hW8kbCsvS5bNtIQTWC/GBNdkfEQKEhDKs2+KWOCLi7YwP9wiLoox5hSdpMvUXE70bgYgWLLu54dHA5k8gUeBib5Wu1ftdp9IXT///MKsLrfPNa3/oDTqEV6k7PZVe+btJ1yRpHuoxcBvuSKmxzT50qT2CBTsWqnFljlxV5mj1GVFWFFcYPLuYAED8UzC+/6pgKAneeVlt0ptqI8tC7xJxOUn2wwjTr9mIRjThuZ5nQBIznaBoMaOsVtue4c1/ldX+it4RSG0KuvIWegjGYqAfOcaNnnmrvsW1MeesAoWYoU/XWzcwshf2jhGC2uI62Xgp6eQh9S6aC2vBj9QaM5o5BQ6tUfVqbnjCRSJUQXRB3cAPwoKX+X/FPn63pw6yln0YiHBrY0GZGM3/BUan5itvTxF7eTE8Jf1uzmIt76Qc3S+4WvtEOj55SiJI+FaXoVSrHZb01mp6SYSAqfegqt9sZowfVUuRopaXNDjEnM/SJp1BshcavIsRgBLJ16Zm2wAAAAAAAAAAAAAAAQAAAA10ZXN0VXNlckB0ZXN0AAAADAAAAAh0ZXN0VXNlcgAAAAAAAAAA//////////8AAAAAAAAAggAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAF3Blcm1pdC1hZ2VudC1mb3J3YXJkaW5nAAAAAAAAABZwZXJtaXQtcG9ydC1mb3J3YXJkaW5nAAAAAAAAAApwZXJtaXQtcHR5AAAAAAAAAA5wZXJtaXQtdXNlci1yYwAAAAAAAAAAAAABFwAAAAdzc2gtcnNhAAAAAwEAAQAAAQEA0c6EklYvC9B041qEGWDNuot6G4tTVm9LCQC0vA+v2n25ru9CINV68IljmXBORXBwfG6PdLhg0SEabZUbsNX5WrIVbGovcghKS6GRsqI5+Quhm+o8eG042JE/hBoYdZ19TcMEyPOGzHsx0U/BSN9ZJWVCxqN51iI6qyhz9f6jlX2LQBFEvXlhxgF3owBEf8UCZt/UvbZdmeeyKNQElPmiVLIJEAPCueECp7a2mjCiP3zqjDvSeeGk4CelB/1qZZ4V2n7fvbHZjAB5JJs4KXs5o8KgvQnqgQMxiLFZ4PATt4+mxEzh4JymppbqJOo2rYwOA3TAIEWWtYRV/ZKJ0AyhhQAAAQ8AAAAHc3NoLXJzYQAAAQC2lL+6JYTGOdz1zNnck6onrFcVpO2onCVAKP8HdLoCeH0/upIugaCocPKuzoURYEfiHQotviNeprE/2CyAroJ5VBdqWftEeHn3FFvBCQ1gwRQ7oci4C5n72t0vjWWE6WBylS0RqpJjr6EQ8a1vuwIqAQrEJPp2yNLjRH2WD7eicBh5f43VKOMr73DtyTh4xoF0C2sNBROudt58npTaYqRHQgoI25V/aCmuYBgM3wdAGcoEZGoSerMfhID7GcWkvemq2hF8mQsspG3zgnyQXk+ahagmefzxutDnr3KdrZ637La0/XwABvBZ9L4l5RiEilVI1Shl96F2qbBW2YZ64pUQ test@cloudflare.com
				`@@ -0,0 +1 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDrQqd6jzuo+yH7MStYWXu/H3dzt/JPFtn2VQ2pp+BfL8Es4Jz+dBIxyixVIuxCtseWFjN+ZkSFOK5ua5hSsdyGayfWaXUcio/xPloOC01supidLgfmg7hKPX5ceVC1TufvMdeBxr1Kcxa3UWGTHWa+R6I4qzR6ruFXZO4hnF+Zth8hW8kbCsvS5bNtIQTWC/GBNdkfEQKEhDKs2+KWOCLi7YwP9wiLoox5hSdpMvUXE70bgYgWLLu54dHA5k8gUeBib5Wu1ftdp9IXT///MKsLrfPNa3/oDTqEV6k7PZVe+btJ1yRpHuoxcBvuSKmxzT50qT2CBTsWqnFljlxV5mj1GVFWFFcYPLuYAED8UzC+/6pgKAneeVlt0ptqI8tC7xJxOUn2wwjTr9mIRjThuZ5nQBIznaBoMaOsVtue4c1/ldX+it4RSG0KuvIWegjGYqAfOcaNnnmrvsW1MeesAoWYoU/XWzcwshf2jhGC2uI62Xgp6eQh9S6aC2vBj9QaM5o5BQ6tUfVqbnjCRSJUQXRB3cAPwoKX+X/FPn63pw6yln0YiHBrY0GZGM3/BUan5itvTxF7eTE8Jf1uzmIt76Qc3S+4WvtEOj55SiJI+FaXoVSrHZb01mp6SYSAqfegqt9sZowfVUuRopaXNDjEnM/SJp1BshcavIsRgBLJ16Zm2w== test@cloudflare.com