sliftutils 1.7.127 → 1.7.129

package/security/authorizedKeys/daemon/git.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import path from "path";
 import { spawnPromise } from "../../helpers/spawn";
-import { sourceKeyPath, sourceRepoPath } from "../sources";
+import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
 import { GIT_TIMEOUT, MAX_ERROR_BODY_LENGTH } from "./paths";
 import { sourceState } from "./state";
 
@@ -68,7 +68,7 @@ export async function currentBranch(config: { repoPath: string; keyPath: string
 
 async function ensureSourceRepo(repoURL: string) {
     let repoPath = sourceRepoPath(repoURL);
-    let keyPath = sourceKeyPath(repoURL);
+    let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
     if (!await repoIsUsable({ repoPath, keyPath })) {
         await cloneRepo({ repoURL, repoPath, keyPath });
     }
@@ -82,7 +82,7 @@ async function ensureSourceRepo(repoURL: string) {
 export async function syncRepo(repoURL: string) {
     await ensureSourceRepo(repoURL);
     let repoPath = sourceRepoPath(repoURL);
-    let keyPath = sourceKeyPath(repoURL);
+    let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
     let branch = sourceState(repoURL).branch;
     let localSha = (await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
 

package/security/authorizedKeys/daemon/notify.ts

@@ -11,8 +11,14 @@ export function setHostLabel(value: string) {
 // notification is only ever added when the user explicitly asks for that specific case. Startup,
 // success, errors, retries and recoveries all belong in console.log instead. The complete list of
 // cases that are allowed to notify is at the top of daemon.ts.
-export async function notify(message: string) {
-    let full = `**portsecure [${hostLabelValue || os.hostname()}]**: ${message}`;
+/** A headline and the rest.
+
+    The headline is all a phone shows. It gets the whole preview to itself: no product name, no
+    host, no timestamp in front of it, because a person glancing at their lock screen needs to read
+    what happened, not which machine said it or when. Those go at the end, where they are there for
+    whoever opens the message and out of the way of whoever does not. */
+export async function notify(headline: string, body: string) {
+    let full = `**${headline}**\n\n${body}\n\n${hostLabelValue || os.hostname()}`;
     // Logged before it is sent, and whether or not it arrives, so the journal is a complete record
     // of what this machine had to say even when Discord is unreachable or the webhook is wrong.
     console.log(`Discord: ${full}`);

package/security/authorizedKeys/daemon/repoFiles.ts

@@ -0,0 +1,118 @@
+import fs from "fs/promises";
+import path from "path";
+import { deriveRevokeKey, findRevokeKey, REVOKE_KEY_LABEL, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
+import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
+import { cloneRepo, repoIsUsable, runGit } from "./git";
+
+/** Reading a repo, made to look like reading a directory. A caller asks for a file and gets its
+    contents; keeping a checkout on disk, cloning it once and pulling it since, is this module's
+    business and nobody else's.
+
+    Nothing here ever answers "there is nothing" when the truth is "I could not look". A repo that
+    cannot be reached throws, and the caller skips that source, because reading an unreachable
+    revoke repo as empty would un-revoke every key in it. */
+export type RepoRef = {
+    repoURL: string;
+    repoPath: string;
+    keyPath: () => Promise<string>;
+};
+
+export function sourceRepo(sourceURL: string): RepoRef {
+    return {
+        repoURL: sourceURL,
+        repoPath: sourceRepoPath(sourceURL),
+        keyPath: async () => await findSourceKey(sourceURL) || sourceKeyPath(sourceURL),
+    };
+}
+
+export function revokeRepo(sourceURL: string): RepoRef {
+    return {
+        repoURL: revokeRepoURL(sourceURL),
+        repoPath: revokeRepoPath(sourceURL),
+        keyPath: () => ensureRevokeKey(sourceURL),
+    };
+}
+
+/** The revoke repo's key is worked out from the source's, so nothing extra had to be uploaded and
+    nothing extra is stored anywhere it could be taken from. */
+export async function ensureRevokeKey(sourceURL: string) {
+    let existing = await findRevokeKey(sourceURL);
+    if (existing) {
+        return existing;
+    }
+    let sourceKey = await findSourceKey(sourceURL);
+    if (!sourceKey) {
+        throw new Error(`Expected a key for ${sourceURL} at ${sourceKeyPath(sourceURL)}, no such file exists`);
+    }
+    let derived = deriveRevokeKey(await fs.readFile(sourceKey, "utf8"));
+    let keyPath = revokeKeyPath(sourceURL);
+    await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 });
+    await fs.writeFile(keyPath, derived.privateKeyFile, { mode: 0o600 });
+    await fs.writeFile(`${keyPath}.pub`, `${derived.publicKey} ${REVOKE_KEY_LABEL}\n`, { mode: 0o644 });
+    console.log(`Derived the revoke key for ${sourceURL} into ${keyPath}`);
+    return keyPath;
+}
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+/** Brings the checkout in line with the remote. Cloned the first time, pulled after that, and the
+    usual case of nothing having changed costs one ref listing and no objects. Throws if the repo
+    cannot be read, so a caller cannot mistake that for an empty repo. */
+export async function syncRepoFiles(repo: RepoRef) {
+    let { repoURL, repoPath } = repo;
+    let keyPath = await repo.keyPath();
+    if (!await repoIsUsable({ repoPath, keyPath })) {
+        await cloneRepo({ repoURL, repoPath, keyPath });
+        return;
+    }
+    let localHead = await runGit({ args: ["rev-parse", "HEAD"], cwd: repoPath, keyPath, allowFailure: true });
+    if (localHead.status !== 0) {
+        // A repo with no commits yet, which is the state every revoke repo starts in. There is
+        // nothing to pull and nothing to say.
+        return;
+    }
+    let branch = (await runGit({ args: ["rev-parse", "--abbrev-ref", "HEAD"], cwd: repoPath, keyPath })).stdout.trim();
+    let listing = (await runGit({ args: ["ls-remote", "origin", branch], cwd: repoPath, keyPath })).stdout;
+    let remoteSha = (listing.split(/\s+/)[0] || "").trim();
+    if (remoteSha && remoteSha === localHead.stdout.trim()) {
+        return;
+    }
+    await runGit({ args: ["fetch", "--prune", "origin"], cwd: repoPath, keyPath });
+    await runGit({ args: ["reset", "--hard", `origin/${branch}`], cwd: repoPath, keyPath });
+    await runGit({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
+}
+
+/** Throws when there is no checkout at all. "I have never managed to read this repo" and "this
+    repo is empty" are different answers and must not collapse into one. */
+async function requireCheckout(repo: RepoRef) {
+    if (!await pathExists(path.join(repo.repoPath, ".git"))) {
+        throw new Error(`Expected a checkout of ${repo.repoURL} at ${repo.repoPath}, there is none`);
+    }
+}
+
+/** One file out of the repo, or undefined if the repo does not have that file. */
+export async function readRepoFile(repo: RepoRef, filePath: string) {
+    await requireCheckout(repo);
+    try {
+        return await fs.readFile(path.join(repo.repoPath, filePath), "utf8");
+    } catch (e) {
+        return undefined;
+    }
+}
+
+/** The names in one of the repo's directories, or nothing if it has no such directory. */
+export async function listRepoDir(repo: RepoRef, directory: string) {
+    await requireCheckout(repo);
+    try {
+        return (await fs.readdir(path.join(repo.repoPath, directory))).sort();
+    } catch (e) {
+        return [];
+    }
+}

package/security/authorizedKeys/daemon/rootKeys.ts

@@ -1,6 +1,6 @@
 import fs from "fs/promises";
 import path from "path";
-import { keyFingerprint, keyRestriction, keyRestrictionList, NO_RESTRICTION, summarizeKey } from "../authorizedKeys";
+import { keyFingerprint, keyNiceName, keyRestriction, keyRestrictionList, NO_RESTRICTION, summarizeKey } from "../authorizedKeys";
 import { KEYS_HISTORY_PATH, ROOT_AUTHORIZED_KEYS } from "./paths";
 import { notify } from "./notify";
 import { getState, saveState } from "./state";
@@ -53,6 +53,64 @@ function describeAddressChange(config: { previousLine: string; currentLine: stri
     return lines.join("\n");
 }
 
+/** The change in one line, for the notification preview. One key added, one removed, or one
+    address gained or lost, said plainly - that covers nearly every real change. Anything with more
+    than one part to it falls back to counting, because a line that tries to say four things says
+    none of them in the space a preview gives it. */
+export function summarizeKeyDifference(config: { before: string[]; after: string[] }) {
+    let { before, after } = config;
+    let beforeByKey = new Map(before.map(key => [keyIdentity(key), key]));
+    let afterByKey = new Map(after.map(key => [keyIdentity(key), key]));
+
+    let added = [...afterByKey].filter(([identity]) => !beforeByKey.has(identity)).map(([, key]) => key);
+    let removed = [...beforeByKey].filter(([identity]) => !afterByKey.has(identity)).map(([, key]) => key);
+    let addressesAdded: { key: string; address: string }[] = [];
+    let addressesRemoved: { key: string; address: string }[] = [];
+    let otherwiseChanged: string[] = [];
+    for (let [identity, previousLine] of beforeByKey) {
+        let currentLine = afterByKey.get(identity);
+        if (!currentLine || currentLine === previousLine) {
+            continue;
+        }
+        let keyLine = currentLine;
+        let previous = keyRestrictionList(previousLine) || [];
+        let current = keyRestrictionList(keyLine) || [];
+        let gained = current.filter(address => !previous.includes(address));
+        let lost = previous.filter(address => !current.includes(address));
+        if (!gained.length && !lost.length) {
+            otherwiseChanged.push(keyLine);
+            continue;
+        }
+        addressesAdded.push(...gained.map(address => ({ key: keyLine, address })));
+        addressesRemoved.push(...lost.map(address => ({ key: keyLine, address })));
+    }
+
+    let changes = added.length + removed.length + addressesAdded.length + addressesRemoved.length
+        + otherwiseChanged.length;
+    if (changes === 1) {
+        if (added.length) {
+            return `SSH KEY ADDED ${keyNiceName(added[0])}`;
+        }
+        if (removed.length) {
+            return `SSH KEY REMOVED ${keyNiceName(removed[0])}`;
+        }
+        if (addressesAdded.length) {
+            return `IP ${addressesAdded[0].address} ALLOWED ON ${keyNiceName(addressesAdded[0].key)}`;
+        }
+        if (addressesRemoved.length) {
+            return `IP ${addressesRemoved[0].address} REMOVED FROM ${keyNiceName(addressesRemoved[0].key)}`;
+        }
+        return `SSH KEY CHANGED ${keyNiceName(otherwiseChanged[0])}`;
+    }
+    let counted = [
+        added.length && `${added.length} key(s) added` || "",
+        removed.length && `${removed.length} key(s) removed` || "",
+        addressesAdded.length && `${addressesAdded.length} IP(s) allowed` || "",
+        addressesRemoved.length && `${addressesRemoved.length} IP(s) removed` || "",
+    ].filter(part => part);
+    return `SSH KEYS CHANGED: ${counted.join(", ") || "no keys differ"}`;
+}
+
 export function describeKeyDifference(config: { before: string[]; after: string[] }) {
     let { before, after } = config;
     let beforeByKey = new Map(before.map(key => [keyIdentity(key), key]));
@@ -181,18 +239,27 @@ export async function enforceRootKeys(keys: string[]) {
     state.appliedKeys = keys;
     await saveState();
 
-    let reasons = takeChangeReasons();
-    let why = reasons.length && `\n\n${reasons.join("\n\n")}` || "";
+    let { leading, reasons } = takeChangeReasons();
+    // An attack names the message. Whoever is looking at a preview needs to see that, not that
+    // some keys changed - the change is what the attack caused.
+    let alert = leading.map(entry => entry.body).join("\n\n");
+    let why = [alert, ...reasons].filter(part => part).join("\n\n");
+    let before = weChangedIt && previouslyApplied || keys;
+    let after = weChangedIt && keys || currentKeys;
+    let headline = leading[0]?.headline || summarizeKeyDifference({ before, after });
+
     if (weChangedIt) {
-        await notify(
-            `applied authorized key changes:`
-            + `\n\`\`\`\n${describeKeyDifference({ before: previouslyApplied, after: keys })}\n\`\`\`${why}`
+        await notify(headline,
+            `Who can log in as root:`
+            + `\n\`\`\`\n${describeKeyDifference({ before, after })}\n\`\`\``
+            + `${why && `\n${why}` || ""}`
         );
         return;
     }
-    await notify(
-        `root's authorized_keys was edited by something other than portsecure. The edit below has`
-        + ` been undone, and the keys from the repos are back in place.`
-        + `\n\`\`\`\n${describeKeyDifference({ before: keys, after: currentKeys })}\n\`\`\`${why}`
+    await notify(leading[0]?.headline || `SSH KEYS EDITED BY SOMETHING ELSE`,
+        `Something other than portsecure edited root's authorized_keys. The edit below has been`
+        + ` undone, and the keys from the repos are back in place.`
+        + `\n\`\`\`\n${describeKeyDifference({ before, after })}\n\`\`\``
+        + `${why && `\n${why}` || ""}`
     );
 }

package/security/authorizedKeys/daemon/state.ts

@@ -17,14 +17,26 @@ export type SourceState = {
     reportedProblem: string;
 };
 
-/** A key this machine has stopped accepting. Kept even when the revoke repo no longer lists it:
-    the deploy key that writes revocations lives on every server, so an attacker who took one could
-    otherwise delete the revocation that locked them out. */
+/** One revocation event: this key, used from this address, so it is no longer accepted. Kept even
+    when the revoke repo no longer lists it: the deploy key that writes revocations lives on every
+    server, so an attacker who took one could otherwise delete the revocation that locked them out.
+
+    The id is unique to the event, never derived from the key. A key that has been forgiven for one
+    address is still an ordinary key, and using it from some other address revokes it again, with a
+    new id that no existing unrevoke names. */
 export type RevocationState = {
-    fingerprint: string;
     revocationId: string;
-    // Set once an unrevoke has been seen, so the wait can be served out across restarts.
-    unrevokeSeenAt: number;
+    fingerprint: string;
+    // The address it was used from. Half of what a revocation says, and the half an unrevoke has
+    // to name to undo it.
+    ip: string;
+    // Why this key was revoked, carried from the revocation file so a machine that reads one
+    // written elsewhere can say what happened rather than only that something did.
+    revokedAt: string;
+    revokedBy: string;
+    reason: string;
+    // Which unrevoke allowed this key from this address, once one has been seen. When the wait it
+    // started runs out is in unrevokeFirstSeen, which outlives the daemon.
     unrevokeId: string;
     unrevoked: boolean;
     // Whether we have said that this key actually left root's authorized_keys. The removal is the
@@ -50,7 +62,12 @@ export type DaemonState = {
     // revocations is on every server, so whoever stole one could otherwise erase the record that
     // shut them out. Restarting the daemon does clear it, which is the way back from a revocation
     // that should not have happened.
-    revocations: { [fingerprint: string]: RevocationState };
+    revocations: { [revocationId: string]: RevocationState };
+    // When this machine first saw each unrevoke, by unrevoke id. On disk, unlike the revocations
+    // themselves, because it is what the hour long wait is counted from: measuring from a time the
+    // unrevoke file states would let whoever wrote it backdate the file and skip the wait, and
+    // measuring from process start would restart the wait on every restart.
+    unrevokeFirstSeen: { [unrevokeId: string]: number };
     pendingRevocations: PendingRevocation[];
     // The keys we last wrote out. What tells a change we made apart from one somebody else made:
     // if this still matches what we want, and the file does not, the file was edited behind us.
@@ -64,6 +81,7 @@ let state: DaemonState = {
     sources: {},
     userKeyHashes: {},
     revocations: {},
+    unrevokeFirstSeen: {},
     pendingRevocations: [],
     appliedKeys: [],
     authLogOffset: 0,

package/security/authorizedKeys/daemon/trust.ts

@@ -174,21 +174,31 @@ async function verifyCheckoutSigner(config: {
     return publicKey;
 }
 
+/** Proves a checkout on disk was signed, and that the files in it are the ones that were signed.
+    Returns the signer, and throws if anything about that does not hold.
+
+    Anything reading a repo for something other than ssh keys goes through this first: the whole
+    checkout is covered by one manifest, so a machine list is exactly as trustworthy as the keys
+    beside it, and neither is worth reading unsigned. */
+export async function verifyCheckout(repoPath: string) {
+    return await verifyCheckoutSigner({ repoPath, files: await readSignatureFiles(repoPath) });
+}
+
 export function describeSigner(signer: string) {
     return signer === UNSIGNED && "<no public key>" || signer;
 }
 
 /** Reports a problem with a source's signature, but only when it is not the same problem we
     already reported, so a fault that persists does not repeat every check. */
-async function reportProblem(config: { repoURL: string; problem: string; message: string }) {
-    let { repoURL, problem, message } = config;
+async function reportProblem(config: { repoURL: string; problem: string; headline: string; body: string }) {
+    let { repoURL, problem, headline, body } = config;
     let sourceStateValue = sourceState(repoURL);
     if (sourceStateValue.reportedProblem === problem) {
         return;
     }
     sourceStateValue.reportedProblem = problem;
     await saveState();
-    await notify(message);
+    await notify(headline, body);
 }
 
 /** The keys a source is allowed to contribute right now. A source signed by someone we have not
@@ -210,17 +220,24 @@ export async function resolveSourceKeys(repoURL: string) {
             await reportProblem({
                 repoURL,
                 problem: "stale",
-                message: `\`${repoURL}\` changed but its signature was not updated, so the changes are being`
-                    + ` ignored. Still using the keys signed by \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
-                    + `\nTo deploy the change, run this in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+                headline: `KEY REPO CHANGED WITHOUT BEING SIGNED`,
+                body: `\`${repoURL}\` changed, but nobody signed the change, so it is being ignored`
+                    + ` and this machine is still using the keys signed by`
+                    + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\n\nTo make the change take effect, run this in that repo:`
+                    + `\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
             });
         } else {
             await reportProblem({
                 repoURL,
                 problem: "corrupt",
-                message: `\`${repoURL}\` has a corrupted signature, so its contents are being ignored:`
-                    + ` ${e}.\nStill using the keys signed by \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
-                    + `\nTo replace it, run this in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+                headline: `KEY REPO SIGNATURE IS BROKEN`,
+                body: `The signature on \`${repoURL}\` does not check out, so everything in it is`
+                    + ` being ignored and this machine is still using the keys signed by`
+                    + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\n\n${e}`
+                    + `\n\nTo replace the signature, run this in that repo:`
+                    + `\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
             });
         }
         return sourceStateValue.acceptedKeys;
@@ -259,9 +276,10 @@ export async function resolveSourceKeys(repoURL: string) {
 
     // Going from nothing to something signed is only ever an improvement, so it does not wait.
     if (sourceStateValue.acceptedSigner === UNSIGNED) {
-        await notify(
-            `\`${repoURL}\` is now signed, by \`${signer}\`. It was not signed before, so its keys are`
-            + ` being applied right away.`
+        await notify(`KEY REPO IS NOW SIGNED`,
+            `\`${repoURL}\` was not signed at all before, so this is an improvement and its keys`
+            + ` are being applied right away.`
+            + `\n\nsigned by: \`${signer}\``
         );
         return await accept();
     }
@@ -273,10 +291,13 @@ export async function resolveSourceKeys(repoURL: string) {
         sourceStateValue.pendingSigner = signer;
         sourceStateValue.pendingSince = Date.now();
         await saveState();
-        await notify(
-            `\`${repoURL}\` is now signed by \`${describeSigner(signer)}\`, where it was signed by`
-            + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`. Its keys are NOT being applied.`
-            + ` If nothing changes they will be applied in 24 hours.`
+        await notify(`KEY REPO SIGNED BY A DIFFERENT KEY`,
+            `Somebody else is signing \`${repoURL}\` now. Its keys are NOT being applied, and this`
+            + ` machine is still using the ones it already had. If nothing changes, the new signer`
+            + ` is accepted in 24 hours.`
+            + `\n\nIf that was not you, fix the repo before the 24 hours are up.`
+            + `\n\nsigned by now: \`${describeSigner(signer)}\``
+            + `\nsigned by before: \`${describeSigner(sourceStateValue.acceptedSigner)}\``
         );
         return sourceStateValue.acceptedKeys;
     }

package/security/authorizedKeys/daemon/userKeys.ts

@@ -65,10 +65,11 @@ export async function checkOtherUserKeys() {
         if (previousHash === undefined || previousHash === hash) {
             continue;
         }
-        await notify(
-            `authorized_keys for user \`${entry.name}\` changed (\`${entry.filePath}\`).`
-            + ` portsecure does not manage this account, so the change was left in place.`
-            + `\n\`\`\`\n${keys.map(summarizeKey).join("\n") || "(now empty)"}\n\`\`\``
+        await notify(`SSH KEYS CHANGED FOR USER ${entry.name}`,
+            `Somebody changed who can log in as \`${entry.name}\`. portsecure does not manage that`
+            + ` account, so the change was left alone. Who can log in as \`${entry.name}\` now:`
+            + `\n\`\`\`\n${keys.map(summarizeKey).join("\n") || "(nobody, the file is now empty)"}\n\`\`\``
+            + `\n${entry.filePath}`
         );
     }
     state.userKeyHashes = hashes;

package/security/authorizedKeys/dist/authorizedKeys.ts.cache

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.readRepoKeys = exports.findKeyProblems = exports.summarizeKey = exports.keyRestriction = exports.keyRestrictionList = exports.NO_RESTRICTION = exports.keyFingerprint = exports.normalizeKeys = void 0;
+//exports.readRepoKeys = exports.findKeyProblems = exports.keyNiceName = exports.summarizeKey = exports.allowAddresses = exports.keyRestriction = exports.keyRestrictionList = exports.NO_RESTRICTION = exports.keyFingerprint = exports.normalizeKeys = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
@@ -44,6 +44,27 @@ function keyRestriction(keyLine) {
     return list.join(",");
 }
 exports.keyRestriction = keyRestriction;
+/** Adds addresses to a key's from= list, leaving the rest of the line exactly as it was. Returns
+    which addresses were actually new, so a caller can report only what it changed.
+
+    A key with no from= at all is left alone: adding one would silently restrict a key that is
+    currently unrestricted, which is a different decision than the one being made here. */
+function allowAddresses(keyLine, addresses) {
+    let list = keyRestrictionList(keyLine);
+    if (!list) {
+        return { keyLine, added: [] };
+    }
+    let allowed = list;
+    let added = addresses.filter(address => address && !allowed.includes(address));
+    if (!added.length) {
+        return { keyLine, added };
+    }
+    return {
+        keyLine: keyLine.replace(/from="[^"]*"/, `from="${[...allowed, ...added].join(",")}"`),
+        added,
+    };
+}
+exports.allowAddresses = allowAddresses;
 /** Enough to recognise whose key this is without printing the whole blob. */
 function summarizeKey(keyLine) {
     let parts = keyLine.trim().split(/\s+/);
@@ -57,6 +78,19 @@ function summarizeKey(keyLine) {
     return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
 }
 exports.summarizeKey = summarizeKey;
+/** The shortest thing that still identifies a key to a person: the comment it carries, which is
+    usually user@machine, and otherwise the tail of the key itself. For the first line of a
+    notification, where there is only room for the one thing that matters. */
+function keyNiceName(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    if (typeIndex < 0) {
+        return keyLine.slice(0, 20);
+    }
+    let comment = parts.slice(typeIndex + 2).join(" ");
+    return comment || `...${(parts[typeIndex + 1] || "").slice(-8)}`;
+}
+exports.keyNiceName = keyNiceName;
 /** What a set of keys has to satisfy before it is worth signing, as a list of complaints.
 
     Every key needs a from=, because an unrestricted key can never be caught being used from the
@@ -107,5 +141,5 @@ async function readRepoKeys(repoPath) {
     return keys;
 }
 exports.readRepoKeys = readRepoKeys;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplZEtleXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhdXRob3JpemVkS2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUV4QixTQUFnQixhQUFhLENBQUMsUUFBZ0I7SUFDMUMsT0FBTyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUN2RyxDQUFDO0FBRkQsc0NBRUM7QUFFRDs4RUFDOEU7QUFDOUUsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDMUMsSUFBSSxLQUFLLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsSUFBSSxJQUFJLEdBQUcsU0FBUyxJQUFJLENBQUMsSUFBSSxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN4RCxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDUixPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLFNBQVMsR0FBRyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztBQUMzSCxDQUFDO0FBUkQsd0NBUUM7QUFFWSxRQUFBLGNBQWMsR0FBRyxvQ0FBb0MsQ0FBQztBQUVuRTttR0FDbUc7QUFDbkcsU0FBZ0Isa0JBQWtCLENBQUMsT0FBZTtJQUM5QyxJQUFJLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDNUMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1QsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNqRixDQUFDO0FBTkQsZ0RBTUM7QUFFRDt3RkFDd0Y7QUFDeEYsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDMUMsSUFBSSxJQUFJLEdBQUcsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1IsT0FBTyxzQkFBYyxDQUFDO0lBQzFCLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDMUIsQ0FBQztBQU5ELHdDQU1DO0FBRUQsNkVBQTZFO0FBQzdFLFNBQWdCLFlBQVksQ0FBQyxPQUFlO0lBQ3hDLElBQUksS0FBSyxHQUFHLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEMsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLElBQUksU0FBUyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hCLE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDaEMsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM1QixJQUFJLElBQUksR0FBRyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0QyxJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkQsT0FBTyxHQUFHLElBQUksT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLEdBQUcsT0FBTyxJQUFJLElBQUksT0FBTyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUM7QUFDNUUsQ0FBQztBQVZELG9DQVVDO0FBRUQ7Ozs7OztnRkFNZ0Y7QUFDaEYsU0FBZ0IsZUFBZSxDQUFDLElBQWM7SUFDMUMsSUFBSSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksYUFBYSxHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO0lBQ2hELEtBQUssSUFBSSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDbkIsSUFBSSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDMUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2YsUUFBUSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwRyxTQUFTO1FBQ2IsQ0FBQztRQUNELHNGQUFzRjtRQUN0RixJQUFJLFFBQVEsR0FBRyxDQUFDLEdBQUcsV0FBVyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pELGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsS0FBSyxJQUFJLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQy9DLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyQixTQUFTO1FBQ2IsQ0FBQztRQUNELFFBQVEsQ0FBQyxJQUFJLENBQ1QsR0FBRyxPQUFPLENBQUMsTUFBTSwyQ0FBMkMsV0FBVyxpQkFBaUI7Y0FDdEYsc0NBQXNDO2NBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxTQUFTLFlBQVksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUNoRSxDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ3BCLENBQUM7QUF4QkQsMENBd0JDO0FBRUQ7bUVBQ21FO0FBQzVELEtBQUssVUFBVSxZQUFZLENBQUMsUUFBZ0I7SUFDL0MsSUFBSSxZQUFZLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUMxRCxJQUFJLE9BQU8sR0FBRyxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDdEMsT0FBTyxhQUFhLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNwRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELFFBQVEsaUJBQWlCLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQWEsRUFBRSxDQUFDO0lBQ3hCLEtBQUssSUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLGFBQWEsQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQztBQWZELG9DQWVDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tIFwiY3J5cHRvXCI7XG5pbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuXG5leHBvcnQgZnVuY3Rpb24gbm9ybWFsaXplS2V5cyhjb250ZW50czogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpLm1hcChsaW5lID0+IGxpbmUudHJpbSgpKS5maWx0ZXIobGluZSA9PiBsaW5lICYmICFsaW5lLnN0YXJ0c1dpdGgoXCIjXCIpKTtcbn1cblxuLyoqIFRoZSBmaW5nZXJwcmludCBzc2ggaXRzZWxmIHJlcG9ydHMgZm9yIGEga2V5LCB3aGljaCBpcyB3aGF0IHRoZSBzc2hkIGxvZyBuYW1lcyBhbmQgdGhlcmVmb3JlXG4gICAgd2hhdCBhIHJldm9jYXRpb24gaXMga2V5ZWQgYnkuIFJldHVybnMgXCJcIiBmb3IgYSBsaW5lIHRoYXQgaG9sZHMgbm8ga2V5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleUZpbmdlcnByaW50KGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBwYXJ0cyA9IGtleUxpbmUudHJpbSgpLnNwbGl0KC9cXHMrLyk7XG4gICAgbGV0IHR5cGVJbmRleCA9IHBhcnRzLmZpbmRJbmRleChwYXJ0ID0+IC9eKHNzaC18ZWNkc2EtfHNrLSkvLnRlc3QocGFydCkpO1xuICAgIGxldCBibG9iID0gdHlwZUluZGV4ID49IDAgJiYgcGFydHNbdHlwZUluZGV4ICsgMV0gfHwgXCJcIjtcbiAgICBpZiAoIWJsb2IpIHtcbiAgICAgICAgcmV0dXJuIFwiXCI7XG4gICAgfVxuICAgIHJldHVybiBcIlNIQTI1NjpcIiArIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShCdWZmZXIuZnJvbShibG9iLCBcImJhc2U2NFwiKSkuZGlnZXN0KFwiYmFzZTY0XCIpLnJlcGxhY2UoLz0rJC8sIFwiXCIpO1xufVxuXG5leHBvcnQgY29uc3QgTk9fUkVTVFJJQ1RJT04gPSBcIkFOWSBBRERSRVNTIChubyBmcm9tPSByZXN0cmljdGlvbilcIjtcblxuLyoqIFRoZSBhZGRyZXNzZXMgYSBrZXkgbWF5IGJlIHVzZWQgZnJvbSwgb25lIGJ5IG9uZSwgb3IgdW5kZWZpbmVkIHdoZW4gdGhlIGtleSBjYXJyaWVzIG5vIGZyb209XG4gICAgYXQgYWxsLiBVbmRlZmluZWQgYW5kIGFuIGVtcHR5IGxpc3QgYXJlIHZlcnkgZGlmZmVyZW50IHRoaW5ncywgc28gdGhleSBzdGF5IGRpc3Rpbmd1aXNoYWJsZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBrZXlSZXN0cmljdGlvbkxpc3Qoa2V5TGluZTogc3RyaW5nKSB7XG4gICAgbGV0IG1hdGNoID0ga2V5TGluZS5tYXRjaCgvZnJvbT1cIihbXlwiXSopXCIvKTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICAgIHJldHVybiB1bmRlZmluZWQ7XG4gICAgfVxuICAgIHJldHVybiBtYXRjaFsxXS5zcGxpdChcIixcIikubWFwKGVudHJ5ID0+IGVudHJ5LnRyaW0oKSkuZmlsdGVyKGVudHJ5ID0+IGVudHJ5KTtcbn1cblxuLyoqIFRoZSBhZGRyZXNzZXMgYSBrZXkgbWF5IGJlIHVzZWQgZnJvbSwgd2hpY2ggaXMgdGhlIHBhcnQgb2YgYW4gYXV0aG9yaXplZF9rZXlzIGxpbmUgdGhhdFxuICAgIGRlY2lkZXMgaG93IG11Y2ggYSBzdG9sZW4ga2V5IGlzIHdvcnRoLiBBIGtleSB3aXRoIG5vIHJlc3RyaWN0aW9uIHNheXMgc28gbG91ZGx5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleVJlc3RyaWN0aW9uKGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBsaXN0ID0ga2V5UmVzdHJpY3Rpb25MaXN0KGtleUxpbmUpO1xuICAgIGlmICghbGlzdCkge1xuICAgICAgICByZXR1cm4gTk9fUkVTVFJJQ1RJT047XG4gICAgfVxuICAgIHJldHVybiBsaXN0LmpvaW4oXCIsXCIpO1xufVxuXG4vKiogRW5vdWdoIHRvIHJlY29nbmlzZSB3aG9zZSBrZXkgdGhpcyBpcyB3aXRob3V0IHByaW50aW5nIHRoZSB3aG9sZSBibG9iLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHN1bW1hcml6ZUtleShrZXlMaW5lOiBzdHJpbmcpIHtcbiAgICBsZXQgcGFydHMgPSBrZXlMaW5lLnRyaW0oKS5zcGxpdCgvXFxzKy8pO1xuICAgIGxldCB0eXBlSW5kZXggPSBwYXJ0cy5maW5kSW5kZXgocGFydCA9PiAvXihzc2gtfGVjZHNhLXxzay0pLy50ZXN0KHBhcnQpKTtcbiAgICBpZiAodHlwZUluZGV4IDwgMCkge1xuICAgICAgICByZXR1cm4ga2V5TGluZS5zbGljZSgwLCA2MCk7XG4gICAgfVxuICAgIGxldCB0eXBlID0gcGFydHNbdHlwZUluZGV4XTtcbiAgICBsZXQgYmxvYiA9IHBhcnRzW3R5cGVJbmRleCArIDFdIHx8IFwiXCI7XG4gICAgbGV0IGNvbW1lbnQgPSBwYXJ0cy5zbGljZSh0eXBlSW5kZXggKyAyKS5qb2luKFwiIFwiKTtcbiAgICByZXR1cm4gYCR7dHlwZX0gLi4uJHtibG9iLnNsaWNlKC0xMil9JHtjb21tZW50ICYmIGAgJHtjb21tZW50fWAgfHwgXCJcIn1gO1xufVxuXG4vKiogV2hhdCBhIHNldCBvZiBrZXlzIGhhcyB0byBzYXRpc2Z5IGJlZm9yZSBpdCBpcyB3b3J0aCBzaWduaW5nLCBhcyBhIGxpc3Qgb2YgY29tcGxhaW50cy5cblxuICAgIEV2ZXJ5IGtleSBuZWVkcyBhIGZyb209LCBiZWNhdXNlIGFuIHVucmVzdHJpY3RlZCBrZXkgY2FuIG5ldmVyIGJlIGNhdWdodCBiZWluZyB1c2VkIGZyb20gdGhlXG4gICAgd3JvbmcgcGxhY2UsIGFuZCBiZWluZyBjYXVnaHQgaXMgdGhlIG9ubHkgdGhpbmcgdGhhdCB0cmlnZ2VycyBhIHJldm9jYXRpb24uXG5cbiAgICBObyB0d28ga2V5cyBtYXkgYWxsb3cgdGhlIHNhbWUgYWRkcmVzc2VzLCBiZWNhdXNlIHRoYXQgaXMgb25lIHBlcnNvbiBob2xkaW5nIHR3byBrZXlzOiByZXZva2luZ1xuICAgIG9uZSBvZiB0aGVtIGxlYXZlcyB0aGUgb3RoZXIgd29ya2luZywgc28gdGhlIHJldm9jYXRpb24gYWNoaWV2ZXMgbm90aGluZy4gKi9cbmV4cG9ydCBmdW5jdGlvbiBmaW5kS2V5UHJvYmxlbXMoa2V5czogc3RyaW5nW10pIHtcbiAgICBsZXQgcHJvYmxlbXM6IHN0cmluZ1tdID0gW107XG4gICAgbGV0IGJ5UmVzdHJpY3Rpb24gPSBuZXcgTWFwPHN0cmluZywgc3RyaW5nW10+KCk7XG4gICAgZm9yIChsZXQga2V5IG9mIGtleXMpIHtcbiAgICAgICAgbGV0IHJlc3RyaWN0aW9uID0ga2V5UmVzdHJpY3Rpb25MaXN0KGtleSk7XG4gICAgICAgIGlmICghcmVzdHJpY3Rpb24pIHtcbiAgICAgICAgICAgIHByb2JsZW1zLnB1c2goYG5vIGZyb209IHJlc3RyaWN0aW9uLCBzbyBpdCBjYW4gYmUgdXNlZCBmcm9tIGFueXdoZXJlOlxcbiAgICAgICR7c3VtbWFyaXplS2V5KGtleSl9YCk7XG4gICAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICAvLyBTb3J0ZWQsIHNvIHRoZSBzYW1lIGFkZHJlc3NlcyB3cml0dGVuIGluIGEgZGlmZmVyZW50IG9yZGVyIHN0aWxsIGNvdW50IGFzIHRoZSBzYW1lLlxuICAgICAgICBsZXQgaWRlbnRpdHkgPSBbLi4ucmVzdHJpY3Rpb25dLnNvcnQoKS5qb2luKFwiLFwiKTtcbiAgICAgICAgYnlSZXN0cmljdGlvbi5zZXQoaWRlbnRpdHksIFsuLi4oYnlSZXN0cmljdGlvbi5nZXQoaWRlbnRpdHkpIHx8IFtdKSwga2V5XSk7XG4gICAgfVxuICAgIGZvciAobGV0IFtyZXN0cmljdGlvbiwgc2hhcmluZ10gb2YgYnlSZXN0cmljdGlvbikge1xuICAgICAgICBpZiAoc2hhcmluZy5sZW5ndGggPCAyKSB7XG4gICAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICBwcm9ibGVtcy5wdXNoKFxuICAgICAgICAgICAgYCR7c2hhcmluZy5sZW5ndGh9IGtleXMgYWxsb3cgZXhhY3RseSB0aGUgc2FtZSBhZGRyZXNzZXMgKCR7cmVzdHJpY3Rpb259KSwgd2hpY2ggaXMgb25lYFxuICAgICAgICAgICAgKyBgIHBlcnNvbiBob2xkaW5nIG1vcmUgdGhhbiBvbmUga2V5OlxcbmBcbiAgICAgICAgICAgICsgc2hhcmluZy5tYXAoa2V5ID0+IGAgICAgICAke3N1bW1hcml6ZUtleShrZXkpfWApLmpvaW4oXCJcXG5cIilcbiAgICAgICAgKTtcbiAgICB9XG4gICAgcmV0dXJuIHByb2JsZW1zO1xufVxuXG4vKiogUmVhZHMgdGhlIGF1dGhvcml6ZWQga2V5cyBhIHJlcG8gY2hlY2tvdXQgd2FudHMgYXBwbGllZC4gUHJlZmVycyBhIHRvcCBsZXZlbCBhdXRob3JpemVkX2tleXNcbiAgICBmaWxlIGFuZCBvdGhlcndpc2UgY29uY2F0ZW5hdGVzIGV2ZXJ5IC5wdWIgYXQgdGhlIHRvcCBsZXZlbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVwb0tleXMocmVwb1BhdGg6IHN0cmluZykge1xuICAgIGxldCBjb21iaW5lZFBhdGggPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFwiYXV0aG9yaXplZF9rZXlzXCIpO1xuICAgIGxldCBlbnRyaWVzID0gYXdhaXQgZnMucmVhZGRpcihyZXBvUGF0aCk7XG4gICAgaWYgKGVudHJpZXMuaW5jbHVkZXMoXCJhdXRob3JpemVkX2tleXNcIikpIHtcbiAgICAgICAgcmV0dXJuIG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUoY29tYmluZWRQYXRoLCBcInV0ZjhcIikpO1xuICAgIH1cbiAgICBsZXQgcHViRmlsZXMgPSBlbnRyaWVzLmZpbHRlcihuYW1lID0+IG5hbWUuZW5kc1dpdGgoXCIucHViXCIpKS5zb3J0KCk7XG4gICAgaWYgKCFwdWJGaWxlcy5sZW5ndGgpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhdXRob3JpemVkX2tleXMgb3IgYXQgbGVhc3Qgb25lIC5wdWIgZmlsZSBpbiAke3JlcG9QYXRofSwgZm91bmQgbmVpdGhlcmApO1xuICAgIH1cbiAgICBsZXQga2V5czogc3RyaW5nW10gPSBbXTtcbiAgICBmb3IgKGxldCBuYW1lIG9mIHB1YkZpbGVzKSB7XG4gICAgICAgIGtleXMucHVzaCguLi5ub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgbmFtZSksIFwidXRmOFwiKSkpO1xuICAgIH1cbiAgICByZXR1cm4ga2V5cztcbn1cbiJdfQ==
- /* _JS_SOURCE_HASH = "a5147a2eb954468a9ddfcac36189a744f5b17f944d7e837ce0a525c780093a26"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplZEtleXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhdXRob3JpemVkS2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUV4QixTQUFnQixhQUFhLENBQUMsUUFBZ0I7SUFDMUMsT0FBTyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztBQUN2RyxDQUFDO0FBRkQsc0NBRUM7QUFFRDs4RUFDOEU7QUFDOUUsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDMUMsSUFBSSxLQUFLLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsSUFBSSxJQUFJLEdBQUcsU0FBUyxJQUFJLENBQUMsSUFBSSxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN4RCxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDUixPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLFNBQVMsR0FBRyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztBQUMzSCxDQUFDO0FBUkQsd0NBUUM7QUFFWSxRQUFBLGNBQWMsR0FBRyxvQ0FBb0MsQ0FBQztBQUVuRTttR0FDbUc7QUFDbkcsU0FBZ0Isa0JBQWtCLENBQUMsT0FBZTtJQUM5QyxJQUFJLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDNUMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1QsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNqRixDQUFDO0FBTkQsZ0RBTUM7QUFFRDt3RkFDd0Y7QUFDeEYsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDMUMsSUFBSSxJQUFJLEdBQUcsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1IsT0FBTyxzQkFBYyxDQUFDO0lBQzFCLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDMUIsQ0FBQztBQU5ELHdDQU1DO0FBRUQ7Ozs7MEZBSTBGO0FBQzFGLFNBQWdCLGNBQWMsQ0FBQyxPQUFlLEVBQUUsU0FBbUI7SUFDL0QsSUFBSSxJQUFJLEdBQUcsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1IsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBYyxFQUFFLENBQUM7SUFDOUMsQ0FBQztJQUNELElBQUksT0FBTyxHQUFHLElBQUksQ0FBQztJQUNuQixJQUFJLEtBQUssR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQy9FLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDaEIsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM5QixDQUFDO0lBQ0QsT0FBTztRQUNILE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxTQUFTLENBQUMsR0FBRyxPQUFPLEVBQUUsR0FBRyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztRQUN0RixLQUFLO0tBQ1IsQ0FBQztBQUNOLENBQUM7QUFkRCx3Q0FjQztBQUVELDZFQUE2RTtBQUM3RSxTQUFnQixZQUFZLENBQUMsT0FBZTtJQUN4QyxJQUFJLEtBQUssR0FBRyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3hDLElBQUksU0FBUyxHQUFHLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUN6RSxJQUFJLFNBQVMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNoQixPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ2hDLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUIsSUFBSSxJQUFJLEdBQUcsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdEMsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25ELE9BQU8sR0FBRyxJQUFJLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxHQUFHLE9BQU8sSUFBSSxJQUFJLE9BQU8sRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDO0FBQzVFLENBQUM7QUFWRCxvQ0FVQztBQUVEOzs2RUFFNkU7QUFDN0UsU0FBZ0IsV0FBVyxDQUFDLE9BQWU7SUFDdkMsSUFBSSxLQUFLLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsSUFBSSxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEIsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25ELE9BQU8sT0FBTyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDckUsQ0FBQztBQVJELGtDQVFDO0FBRUQ7Ozs7OztnRkFNZ0Y7QUFDaEYsU0FBZ0IsZUFBZSxDQUFDLElBQWM7SUFDMUMsSUFBSSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksYUFBYSxHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO0lBQ2hELEtBQUssSUFBSSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDbkIsSUFBSSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDMUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2YsUUFBUSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwRyxTQUFTO1FBQ2IsQ0FBQztRQUNELHNGQUFzRjtRQUN0RixJQUFJLFFBQVEsR0FBRyxDQUFDLEdBQUcsV0FBVyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pELGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsS0FBSyxJQUFJLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQy9DLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyQixTQUFTO1FBQ2IsQ0FBQztRQUNELFFBQVEsQ0FBQyxJQUFJLENBQ1QsR0FBRyxPQUFPLENBQUMsTUFBTSwyQ0FBMkMsV0FBVyxpQkFBaUI7Y0FDdEYsc0NBQXNDO2NBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxTQUFTLFlBQVksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUNoRSxDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ3BCLENBQUM7QUF4QkQsMENBd0JDO0FBRUQ7bUVBQ21FO0FBQzVELEtBQUssVUFBVSxZQUFZLENBQUMsUUFBZ0I7SUFDL0MsSUFBSSxZQUFZLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUMxRCxJQUFJLE9BQU8sR0FBRyxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDdEMsT0FBTyxhQUFhLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNwRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELFFBQVEsaUJBQWlCLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQWEsRUFBRSxDQUFDO0lBQ3hCLEtBQUssSUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLGFBQWEsQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQztBQWZELG9DQWVDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tIFwiY3J5cHRvXCI7XG5pbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuXG5leHBvcnQgZnVuY3Rpb24gbm9ybWFsaXplS2V5cyhjb250ZW50czogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpLm1hcChsaW5lID0+IGxpbmUudHJpbSgpKS5maWx0ZXIobGluZSA9PiBsaW5lICYmICFsaW5lLnN0YXJ0c1dpdGgoXCIjXCIpKTtcbn1cblxuLyoqIFRoZSBmaW5nZXJwcmludCBzc2ggaXRzZWxmIHJlcG9ydHMgZm9yIGEga2V5LCB3aGljaCBpcyB3aGF0IHRoZSBzc2hkIGxvZyBuYW1lcyBhbmQgdGhlcmVmb3JlXG4gICAgd2hhdCBhIHJldm9jYXRpb24gaXMga2V5ZWQgYnkuIFJldHVybnMgXCJcIiBmb3IgYSBsaW5lIHRoYXQgaG9sZHMgbm8ga2V5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleUZpbmdlcnByaW50KGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBwYXJ0cyA9IGtleUxpbmUudHJpbSgpLnNwbGl0KC9cXHMrLyk7XG4gICAgbGV0IHR5cGVJbmRleCA9IHBhcnRzLmZpbmRJbmRleChwYXJ0ID0+IC9eKHNzaC18ZWNkc2EtfHNrLSkvLnRlc3QocGFydCkpO1xuICAgIGxldCBibG9iID0gdHlwZUluZGV4ID49IDAgJiYgcGFydHNbdHlwZUluZGV4ICsgMV0gfHwgXCJcIjtcbiAgICBpZiAoIWJsb2IpIHtcbiAgICAgICAgcmV0dXJuIFwiXCI7XG4gICAgfVxuICAgIHJldHVybiBcIlNIQTI1NjpcIiArIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShCdWZmZXIuZnJvbShibG9iLCBcImJhc2U2NFwiKSkuZGlnZXN0KFwiYmFzZTY0XCIpLnJlcGxhY2UoLz0rJC8sIFwiXCIpO1xufVxuXG5leHBvcnQgY29uc3QgTk9fUkVTVFJJQ1RJT04gPSBcIkFOWSBBRERSRVNTIChubyBmcm9tPSByZXN0cmljdGlvbilcIjtcblxuLyoqIFRoZSBhZGRyZXNzZXMgYSBrZXkgbWF5IGJlIHVzZWQgZnJvbSwgb25lIGJ5IG9uZSwgb3IgdW5kZWZpbmVkIHdoZW4gdGhlIGtleSBjYXJyaWVzIG5vIGZyb209XG4gICAgYXQgYWxsLiBVbmRlZmluZWQgYW5kIGFuIGVtcHR5IGxpc3QgYXJlIHZlcnkgZGlmZmVyZW50IHRoaW5ncywgc28gdGhleSBzdGF5IGRpc3Rpbmd1aXNoYWJsZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBrZXlSZXN0cmljdGlvbkxpc3Qoa2V5TGluZTogc3RyaW5nKSB7XG4gICAgbGV0IG1hdGNoID0ga2V5TGluZS5tYXRjaCgvZnJvbT1cIihbXlwiXSopXCIvKTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICAgIHJldHVybiB1bmRlZmluZWQ7XG4gICAgfVxuICAgIHJldHVybiBtYXRjaFsxXS5zcGxpdChcIixcIikubWFwKGVudHJ5ID0+IGVudHJ5LnRyaW0oKSkuZmlsdGVyKGVudHJ5ID0+IGVudHJ5KTtcbn1cblxuLyoqIFRoZSBhZGRyZXNzZXMgYSBrZXkgbWF5IGJlIHVzZWQgZnJvbSwgd2hpY2ggaXMgdGhlIHBhcnQgb2YgYW4gYXV0aG9yaXplZF9rZXlzIGxpbmUgdGhhdFxuICAgIGRlY2lkZXMgaG93IG11Y2ggYSBzdG9sZW4ga2V5IGlzIHdvcnRoLiBBIGtleSB3aXRoIG5vIHJlc3RyaWN0aW9uIHNheXMgc28gbG91ZGx5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleVJlc3RyaWN0aW9uKGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBsaXN0ID0ga2V5UmVzdHJpY3Rpb25MaXN0KGtleUxpbmUpO1xuICAgIGlmICghbGlzdCkge1xuICAgICAgICByZXR1cm4gTk9fUkVTVFJJQ1RJT047XG4gICAgfVxuICAgIHJldHVybiBsaXN0LmpvaW4oXCIsXCIpO1xufVxuXG4vKiogQWRkcyBhZGRyZXNzZXMgdG8gYSBrZXkncyBmcm9tPSBsaXN0LCBsZWF2aW5nIHRoZSByZXN0IG9mIHRoZSBsaW5lIGV4YWN0bHkgYXMgaXQgd2FzLiBSZXR1cm5zXG4gICAgd2hpY2ggYWRkcmVzc2VzIHdlcmUgYWN0dWFsbHkgbmV3LCBzbyBhIGNhbGxlciBjYW4gcmVwb3J0IG9ubHkgd2hhdCBpdCBjaGFuZ2VkLlxuXG4gICAgQSBrZXkgd2l0aCBubyBmcm9tPSBhdCBhbGwgaXMgbGVmdCBhbG9uZTogYWRkaW5nIG9uZSB3b3VsZCBzaWxlbnRseSByZXN0cmljdCBhIGtleSB0aGF0IGlzXG4gICAgY3VycmVudGx5IHVucmVzdHJpY3RlZCwgd2hpY2ggaXMgYSBkaWZmZXJlbnQgZGVjaXNpb24gdGhhbiB0aGUgb25lIGJlaW5nIG1hZGUgaGVyZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhbGxvd0FkZHJlc3NlcyhrZXlMaW5lOiBzdHJpbmcsIGFkZHJlc3Nlczogc3RyaW5nW10pIHtcbiAgICBsZXQgbGlzdCA9IGtleVJlc3RyaWN0aW9uTGlzdChrZXlMaW5lKTtcbiAgICBpZiAoIWxpc3QpIHtcbiAgICAgICAgcmV0dXJuIHsga2V5TGluZSwgYWRkZWQ6IFtdIGFzIHN0cmluZ1tdIH07XG4gICAgfVxuICAgIGxldCBhbGxvd2VkID0gbGlzdDtcbiAgICBsZXQgYWRkZWQgPSBhZGRyZXNzZXMuZmlsdGVyKGFkZHJlc3MgPT4gYWRkcmVzcyAmJiAhYWxsb3dlZC5pbmNsdWRlcyhhZGRyZXNzKSk7XG4gICAgaWYgKCFhZGRlZC5sZW5ndGgpIHtcbiAgICAgICAgcmV0dXJuIHsga2V5TGluZSwgYWRkZWQgfTtcbiAgICB9XG4gICAgcmV0dXJuIHtcbiAgICAgICAga2V5TGluZToga2V5TGluZS5yZXBsYWNlKC9mcm9tPVwiW15cIl0qXCIvLCBgZnJvbT1cIiR7Wy4uLmFsbG93ZWQsIC4uLmFkZGVkXS5qb2luKFwiLFwiKX1cImApLFxuICAgICAgICBhZGRlZCxcbiAgICB9O1xufVxuXG4vKiogRW5vdWdoIHRvIHJlY29nbmlzZSB3aG9zZSBrZXkgdGhpcyBpcyB3aXRob3V0IHByaW50aW5nIHRoZSB3aG9sZSBibG9iLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHN1bW1hcml6ZUtleShrZXlMaW5lOiBzdHJpbmcpIHtcbiAgICBsZXQgcGFydHMgPSBrZXlMaW5lLnRyaW0oKS5zcGxpdCgvXFxzKy8pO1xuICAgIGxldCB0eXBlSW5kZXggPSBwYXJ0cy5maW5kSW5kZXgocGFydCA9PiAvXihzc2gtfGVjZHNhLXxzay0pLy50ZXN0KHBhcnQpKTtcbiAgICBpZiAodHlwZUluZGV4IDwgMCkge1xuICAgICAgICByZXR1cm4ga2V5TGluZS5zbGljZSgwLCA2MCk7XG4gICAgfVxuICAgIGxldCB0eXBlID0gcGFydHNbdHlwZUluZGV4XTtcbiAgICBsZXQgYmxvYiA9IHBhcnRzW3R5cGVJbmRleCArIDFdIHx8IFwiXCI7XG4gICAgbGV0IGNvbW1lbnQgPSBwYXJ0cy5zbGljZSh0eXBlSW5kZXggKyAyKS5qb2luKFwiIFwiKTtcbiAgICByZXR1cm4gYCR7dHlwZX0gLi4uJHtibG9iLnNsaWNlKC0xMil9JHtjb21tZW50ICYmIGAgJHtjb21tZW50fWAgfHwgXCJcIn1gO1xufVxuXG4vKiogVGhlIHNob3J0ZXN0IHRoaW5nIHRoYXQgc3RpbGwgaWRlbnRpZmllcyBhIGtleSB0byBhIHBlcnNvbjogdGhlIGNvbW1lbnQgaXQgY2Fycmllcywgd2hpY2ggaXNcbiAgICB1c3VhbGx5IHVzZXJAbWFjaGluZSwgYW5kIG90aGVyd2lzZSB0aGUgdGFpbCBvZiB0aGUga2V5IGl0c2VsZi4gRm9yIHRoZSBmaXJzdCBsaW5lIG9mIGFcbiAgICBub3RpZmljYXRpb24sIHdoZXJlIHRoZXJlIGlzIG9ubHkgcm9vbSBmb3IgdGhlIG9uZSB0aGluZyB0aGF0IG1hdHRlcnMuICovXG5leHBvcnQgZnVuY3Rpb24ga2V5TmljZU5hbWUoa2V5TGluZTogc3RyaW5nKSB7XG4gICAgbGV0IHBhcnRzID0ga2V5TGluZS50cmltKCkuc3BsaXQoL1xccysvKTtcbiAgICBsZXQgdHlwZUluZGV4ID0gcGFydHMuZmluZEluZGV4KHBhcnQgPT4gL14oc3NoLXxlY2RzYS18c2stKS8udGVzdChwYXJ0KSk7XG4gICAgaWYgKHR5cGVJbmRleCA8IDApIHtcbiAgICAgICAgcmV0dXJuIGtleUxpbmUuc2xpY2UoMCwgMjApO1xuICAgIH1cbiAgICBsZXQgY29tbWVudCA9IHBhcnRzLnNsaWNlKHR5cGVJbmRleCArIDIpLmpvaW4oXCIgXCIpO1xuICAgIHJldHVybiBjb21tZW50IHx8IGAuLi4keyhwYXJ0c1t0eXBlSW5kZXggKyAxXSB8fCBcIlwiKS5zbGljZSgtOCl9YDtcbn1cblxuLyoqIFdoYXQgYSBzZXQgb2Yga2V5cyBoYXMgdG8gc2F0aXNmeSBiZWZvcmUgaXQgaXMgd29ydGggc2lnbmluZywgYXMgYSBsaXN0IG9mIGNvbXBsYWludHMuXG5cbiAgICBFdmVyeSBrZXkgbmVlZHMgYSBmcm9tPSwgYmVjYXVzZSBhbiB1bnJlc3RyaWN0ZWQga2V5IGNhbiBuZXZlciBiZSBjYXVnaHQgYmVpbmcgdXNlZCBmcm9tIHRoZVxuICAgIHdyb25nIHBsYWNlLCBhbmQgYmVpbmcgY2F1Z2h0IGlzIHRoZSBvbmx5IHRoaW5nIHRoYXQgdHJpZ2dlcnMgYSByZXZvY2F0aW9uLlxuXG4gICAgTm8gdHdvIGtleXMgbWF5IGFsbG93IHRoZSBzYW1lIGFkZHJlc3NlcywgYmVjYXVzZSB0aGF0IGlzIG9uZSBwZXJzb24gaG9sZGluZyB0d28ga2V5czogcmV2b2tpbmdcbiAgICBvbmUgb2YgdGhlbSBsZWF2ZXMgdGhlIG90aGVyIHdvcmtpbmcsIHNvIHRoZSByZXZvY2F0aW9uIGFjaGlldmVzIG5vdGhpbmcuICovXG5leHBvcnQgZnVuY3Rpb24gZmluZEtleVByb2JsZW1zKGtleXM6IHN0cmluZ1tdKSB7XG4gICAgbGV0IHByb2JsZW1zOiBzdHJpbmdbXSA9IFtdO1xuICAgIGxldCBieVJlc3RyaWN0aW9uID0gbmV3IE1hcDxzdHJpbmcsIHN0cmluZ1tdPigpO1xuICAgIGZvciAobGV0IGtleSBvZiBrZXlzKSB7XG4gICAgICAgIGxldCByZXN0cmljdGlvbiA9IGtleVJlc3RyaWN0aW9uTGlzdChrZXkpO1xuICAgICAgICBpZiAoIXJlc3RyaWN0aW9uKSB7XG4gICAgICAgICAgICBwcm9ibGVtcy5wdXNoKGBubyBmcm9tPSByZXN0cmljdGlvbiwgc28gaXQgY2FuIGJlIHVzZWQgZnJvbSBhbnl3aGVyZTpcXG4gICAgICAke3N1bW1hcml6ZUtleShrZXkpfWApO1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgLy8gU29ydGVkLCBzbyB0aGUgc2FtZSBhZGRyZXNzZXMgd3JpdHRlbiBpbiBhIGRpZmZlcmVudCBvcmRlciBzdGlsbCBjb3VudCBhcyB0aGUgc2FtZS5cbiAgICAgICAgbGV0IGlkZW50aXR5ID0gWy4uLnJlc3RyaWN0aW9uXS5zb3J0KCkuam9pbihcIixcIik7XG4gICAgICAgIGJ5UmVzdHJpY3Rpb24uc2V0KGlkZW50aXR5LCBbLi4uKGJ5UmVzdHJpY3Rpb24uZ2V0KGlkZW50aXR5KSB8fCBbXSksIGtleV0pO1xuICAgIH1cbiAgICBmb3IgKGxldCBbcmVzdHJpY3Rpb24sIHNoYXJpbmddIG9mIGJ5UmVzdHJpY3Rpb24pIHtcbiAgICAgICAgaWYgKHNoYXJpbmcubGVuZ3RoIDwgMikge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgcHJvYmxlbXMucHVzaChcbiAgICAgICAgICAgIGAke3NoYXJpbmcubGVuZ3RofSBrZXlzIGFsbG93IGV4YWN0bHkgdGhlIHNhbWUgYWRkcmVzc2VzICgke3Jlc3RyaWN0aW9ufSksIHdoaWNoIGlzIG9uZWBcbiAgICAgICAgICAgICsgYCBwZXJzb24gaG9sZGluZyBtb3JlIHRoYW4gb25lIGtleTpcXG5gXG4gICAgICAgICAgICArIHNoYXJpbmcubWFwKGtleSA9PiBgICAgICAgJHtzdW1tYXJpemVLZXkoa2V5KX1gKS5qb2luKFwiXFxuXCIpXG4gICAgICAgICk7XG4gICAgfVxuICAgIHJldHVybiBwcm9ibGVtcztcbn1cblxuLyoqIFJlYWRzIHRoZSBhdXRob3JpemVkIGtleXMgYSByZXBvIGNoZWNrb3V0IHdhbnRzIGFwcGxpZWQuIFByZWZlcnMgYSB0b3AgbGV2ZWwgYXV0aG9yaXplZF9rZXlzXG4gICAgZmlsZSBhbmQgb3RoZXJ3aXNlIGNvbmNhdGVuYXRlcyBldmVyeSAucHViIGF0IHRoZSB0b3AgbGV2ZWwuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVhZFJlcG9LZXlzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgY29tYmluZWRQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKTtcbiAgICBsZXQgZW50cmllcyA9IGF3YWl0IGZzLnJlYWRkaXIocmVwb1BhdGgpO1xuICAgIGlmIChlbnRyaWVzLmluY2x1ZGVzKFwiYXV0aG9yaXplZF9rZXlzXCIpKSB7XG4gICAgICAgIHJldHVybiBub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKGNvbWJpbmVkUGF0aCwgXCJ1dGY4XCIpKTtcbiAgICB9XG4gICAgbGV0IHB1YkZpbGVzID0gZW50cmllcy5maWx0ZXIobmFtZSA9PiBuYW1lLmVuZHNXaXRoKFwiLnB1YlwiKSkuc29ydCgpO1xuICAgIGlmICghcHViRmlsZXMubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYXV0aG9yaXplZF9rZXlzIG9yIGF0IGxlYXN0IG9uZSAucHViIGZpbGUgaW4gJHtyZXBvUGF0aH0sIGZvdW5kIG5laXRoZXJgKTtcbiAgICB9XG4gICAgbGV0IGtleXM6IHN0cmluZ1tdID0gW107XG4gICAgZm9yIChsZXQgbmFtZSBvZiBwdWJGaWxlcykge1xuICAgICAgICBrZXlzLnB1c2goLi4ubm9ybWFsaXplS2V5cyhhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4ocmVwb1BhdGgsIG5hbWUpLCBcInV0ZjhcIikpKTtcbiAgICB9XG4gICAgcmV0dXJuIGtleXM7XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "5dc60c0f88ff3878003bf57017d1342326afa7c6a9f511d5896e4113565a7823"; */

package/security/authorizedKeys/dist/revokeSource.ts.cache

@@ -1,8 +1,12 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.deriveRevokeKey = exports.revokeRepoPath = exports.revokeKeyPath = exports.revokeRepoURL = exports.REVOKE_KEY_LABEL = void 0;
+//exports.deriveRevokeKey = exports.revokeRepoPath = exports.findRevokeKey = exports.legacyRevokeKeyPath = exports.revokeKeyPath = exports.revokeRepoURL = exports.REVOKE_KEY_LABEL = void 0;
 const deriveKey_1 = require("../keys/deriveKey");
 const sshKeyFile_1 = require("../keys/sshKeyFile");
+const path_1 = __importDefault(require("path"));
 const sources_1 = require("./sources");
 // A source's revocations live in a repo beside it. Derived rather than configured, so adding a
 // source brings its revoke repo with it and there is nothing extra to pass on the command line.
@@ -16,9 +20,18 @@ function revokeRepoURL(sourceURL) {
 }
 exports.revokeRepoURL = revokeRepoURL;
 function revokeKeyPath(sourceURL) {
-    return `${sources_1.REPO_KEYS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+    return path_1.default.join((0, sources_1.keysDir)(), `${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`);
 }
 exports.revokeKeyPath = revokeKeyPath;
+function legacyRevokeKeyPath(sourceURL) {
+    return `${sources_1.LEGACY_REPO_KEYS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.legacyRevokeKeyPath = legacyRevokeKeyPath;
+/** Wherever this source's revoke key already is, or nothing if it has not been derived yet. */
+async function findRevokeKey(sourceURL) {
+    return await (0, sources_1.findKey)({ current: revokeKeyPath(sourceURL), legacy: legacyRevokeKeyPath(sourceURL) });
+}
+exports.findRevokeKey = findRevokeKey;
 function revokeRepoPath(sourceURL) {
     return `${sources_1.REPOS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
 }
@@ -40,5 +53,5 @@ function deriveRevokeKey(sourcePrivateKey) {
     };
 }
 exports.deriveRevokeKey = deriveRevokeKey;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlU291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmV2b2tlU291cmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLGlEQUFxRDtBQUNyRCxtREFBcUY7QUFDckYsdUNBQWlFO0FBRWpFLCtGQUErRjtBQUMvRixnR0FBZ0c7QUFDaEcsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDO0FBQ2xDLCtGQUErRjtBQUMvRixrRUFBa0U7QUFDckQsUUFBQSxnQkFBZ0IsR0FBRyxpQkFBaUIsQ0FBQztBQUVsRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsSUFBSSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDakQsT0FBTyxHQUFHLFVBQVUsR0FBRyxjQUFjLE1BQU0sQ0FBQztBQUNoRCxDQUFDO0FBSEQsc0NBR0M7QUFFRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsT0FBTyxHQUFHLHVCQUFhLElBQUksSUFBQSxvQkFBVSxFQUFDLFNBQVMsQ0FBQyxHQUFHLGNBQWMsRUFBRSxDQUFDO0FBQ3hFLENBQUM7QUFGRCxzQ0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxTQUFpQjtJQUM1QyxPQUFPLEdBQUcsbUJBQVMsSUFBSSxJQUFBLG9CQUFVLEVBQUMsU0FBUyxDQUFDLEdBQUcsY0FBYyxFQUFFLENBQUM7QUFDcEUsQ0FBQztBQUZELHdDQUVDO0FBRUQ7eUZBQ3lGO0FBQ3pGLFNBQWdCLGVBQWUsQ0FBQyxnQkFBd0I7SUFDcEQsSUFBSSxNQUFNLEdBQUcsSUFBQSxtQ0FBc0IsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3RELElBQUksT0FBTyxHQUFHLElBQUEsNEJBQWdCLEVBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsd0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLE9BQU87UUFDSCxTQUFTLEVBQUUsZUFBZSxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1lBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1NBQ2hELENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDdkIsY0FBYyxFQUFFLElBQUEsb0NBQXVCLEVBQUM7WUFDcEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksWUFBWSxJQUFJLHdCQUFnQixFQUFFO1NBQ25FLENBQUM7S0FDTCxDQUFDO0FBQ04sQ0FBQztBQWJELDBDQWFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZGVyaXZlRWQyNTUxOUtleSB9IGZyb20gXCIuLi9rZXlzL2Rlcml2ZUtleVwiO1xuaW1wb3J0IHsgZm9ybWF0T3BlblNTSFByaXZhdGVLZXksIHBhcnNlT3BlblNTSFByaXZhdGVLZXkgfSBmcm9tIFwiLi4va2V5cy9zc2hLZXlGaWxlXCI7XG5pbXBvcnQgeyBSRVBPX0tFWVNfRElSLCBSRVBPU19ESVIsIHNvdXJjZU5hbWUgfSBmcm9tIFwiLi9zb3VyY2VzXCI7XG5cbi8vIEEgc291cmNlJ3MgcmV2b2NhdGlvbnMgbGl2ZSBpbiBhIHJlcG8gYmVzaWRlIGl0LiBEZXJpdmVkIHJhdGhlciB0aGFuIGNvbmZpZ3VyZWQsIHNvIGFkZGluZyBhXG4vLyBzb3VyY2UgYnJpbmdzIGl0cyByZXZva2UgcmVwbyB3aXRoIGl0IGFuZCB0aGVyZSBpcyBub3RoaW5nIGV4dHJhIHRvIHBhc3Mgb24gdGhlIGNvbW1hbmQgbGluZS5cbmNvbnN0IFJFVk9LRURfU1VGRklYID0gXCJfcmV2b2tlZFwiO1xuLy8gR2l0SHViIHdpbGwgbm90IHRha2UgdGhlIHNhbWUgcHVibGljIGtleSBhcyBhIGRlcGxveSBrZXkgb24gdHdvIHJlcG9zLCBzbyB0aGUgcmV2b2tlIHJlcG8gaXNcbi8vIHJlYWNoZWQgd2l0aCBhIGtleSBkZXJpdmVkIGZyb20gdGhlIHNvdXJjZSdzLCB1bmRlciB0aGlzIGxhYmVsLlxuZXhwb3J0IGNvbnN0IFJFVk9LRV9LRVlfTEFCRUwgPSBcInJldm9rZWdpdGh1YmtleVwiO1xuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwb1VSTChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIGxldCB3aXRob3V0R2l0ID0gc291cmNlVVJMLnJlcGxhY2UoL1xcLmdpdCQvLCBcIlwiKTtcbiAgICByZXR1cm4gYCR7d2l0aG91dEdpdH0ke1JFVk9LRURfU1VGRklYfS5naXRgO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlS2V5UGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPX0tFWVNfRElSfS8ke3NvdXJjZU5hbWUoc291cmNlVVJMKX0ke1JFVk9LRURfU1VGRklYfWA7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZXZva2VSZXBvUGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPU19ESVJ9LyR7c291cmNlTmFtZShzb3VyY2VVUkwpfSR7UkVWT0tFRF9TVUZGSVh9YDtcbn1cblxuLyoqIFRoZSByZXZva2UgcmVwbydzIGtleSwgd29ya2VkIG91dCBmcm9tIHRoZSBzb3VyY2UgcmVwbydzIGtleS4gQW55dGhpbmcgaG9sZGluZyB0aGUgc291cmNlIGtleVxuICAgIGNhbiBwcm9kdWNlIGl0LCBzbyBpdCBuZXZlciBoYXMgdG8gYmUgc3RvcmVkIGFueXdoZXJlIHNlcGFyYXRlbHkgb3IgaGFuZGVkIGFyb3VuZC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXJpdmVSZXZva2VLZXkoc291cmNlUHJpdmF0ZUtleTogc3RyaW5nKSB7XG4gICAgbGV0IHNvdXJjZSA9IHBhcnNlT3BlblNTSFByaXZhdGVLZXkoc291cmNlUHJpdmF0ZUtleSk7XG4gICAgbGV0IGRlcml2ZWQgPSBkZXJpdmVFZDI1NTE5S2V5KHsgc2VlZDogc291cmNlLnNlZWQsIGxhYmVsOiBSRVZPS0VfS0VZX0xBQkVMIH0pO1xuICAgIHJldHVybiB7XG4gICAgICAgIHB1YmxpY0tleTogYHNzaC1lZDI1NTE5ICR7QnVmZmVyLmNvbmNhdChbXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShbMCwgMCwgMCwgMTFdKSwgQnVmZmVyLmZyb20oXCJzc2gtZWQyNTUxOVwiKSxcbiAgICAgICAgICAgIEJ1ZmZlci5mcm9tKFswLCAwLCAwLCAzMl0pLCBkZXJpdmVkLnB1YmxpY0tleSxcbiAgICAgICAgXSkudG9TdHJpbmcoXCJiYXNlNjRcIil9YCxcbiAgICAgICAgcHJpdmF0ZUtleUZpbGU6IGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5KHtcbiAgICAgICAgICAgIHNlZWQ6IGRlcml2ZWQuc2VlZCxcbiAgICAgICAgICAgIGNvbW1lbnQ6IGAke3NvdXJjZS5jb21tZW50IHx8IFwicG9ydHNlY3VyZVwifSAke1JFVk9LRV9LRVlfTEFCRUx9YCxcbiAgICAgICAgfSksXG4gICAgfTtcbn1cbiJdfQ==
- /* _JS_SOURCE_HASH = "9f16cd6aea6e1f1a646eda715ac4cac70dc67579ce23c1e473bd371b7985b229"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlU291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmV2b2tlU291cmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLGlEQUFxRDtBQUNyRCxtREFBcUY7QUFDckYsZ0RBQXdCO0FBQ3hCLHVDQUEwRjtBQUUxRiwrRkFBK0Y7QUFDL0YsZ0dBQWdHO0FBQ2hHLE1BQU0sY0FBYyxHQUFHLFVBQVUsQ0FBQztBQUNsQywrRkFBK0Y7QUFDL0Ysa0VBQWtFO0FBQ3JELFFBQUEsZ0JBQWdCLEdBQUcsaUJBQWlCLENBQUM7QUFFbEQsU0FBZ0IsYUFBYSxDQUFDLFNBQWlCO0lBQzNDLElBQUksVUFBVSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ2pELE9BQU8sR0FBRyxVQUFVLEdBQUcsY0FBYyxNQUFNLENBQUM7QUFDaEQsQ0FBQztBQUhELHNDQUdDO0FBRUQsU0FBZ0IsYUFBYSxDQUFDLFNBQWlCO0lBQzNDLE9BQU8sY0FBSSxDQUFDLElBQUksQ0FBQyxJQUFBLGlCQUFPLEdBQUUsRUFBRSxHQUFHLElBQUEsb0JBQVUsRUFBQyxTQUFTLENBQUMsR0FBRyxjQUFjLEVBQUUsQ0FBQyxDQUFDO0FBQzdFLENBQUM7QUFGRCxzQ0FFQztBQUVELFNBQWdCLG1CQUFtQixDQUFDLFNBQWlCO0lBQ2pELE9BQU8sR0FBRyw4QkFBb0IsSUFBSSxJQUFBLG9CQUFVLEVBQUMsU0FBUyxDQUFDLEdBQUcsY0FBYyxFQUFFLENBQUM7QUFDL0UsQ0FBQztBQUZELGtEQUVDO0FBRUQsK0ZBQStGO0FBQ3hGLEtBQUssVUFBVSxhQUFhLENBQUMsU0FBaUI7SUFDakQsT0FBTyxNQUFNLElBQUEsaUJBQU8sRUFBQyxFQUFFLE9BQU8sRUFBRSxhQUFhLENBQUMsU0FBUyxDQUFDLEVBQUUsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUN4RyxDQUFDO0FBRkQsc0NBRUM7QUFFRCxTQUFnQixjQUFjLENBQUMsU0FBaUI7SUFDNUMsT0FBTyxHQUFHLG1CQUFTLElBQUksSUFBQSxvQkFBVSxFQUFDLFNBQVMsQ0FBQyxHQUFHLGNBQWMsRUFBRSxDQUFDO0FBQ3BFLENBQUM7QUFGRCx3Q0FFQztBQUVEO3lGQUN5RjtBQUN6RixTQUFnQixlQUFlLENBQUMsZ0JBQXdCO0lBQ3BELElBQUksTUFBTSxHQUFHLElBQUEsbUNBQXNCLEVBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUN0RCxJQUFJLE9BQU8sR0FBRyxJQUFBLDRCQUFnQixFQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLHdCQUFnQixFQUFFLENBQUMsQ0FBQztJQUMvRSxPQUFPO1FBQ0gsU0FBUyxFQUFFLGVBQWUsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNwQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQztZQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxPQUFPLENBQUMsU0FBUztTQUNoRCxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFO1FBQ3ZCLGNBQWMsRUFBRSxJQUFBLG9DQUF1QixFQUFDO1lBQ3BDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixPQUFPLEVBQUUsR0FBRyxNQUFNLENBQUMsT0FBTyxJQUFJLFlBQVksSUFBSSx3QkFBZ0IsRUFBRTtTQUNuRSxDQUFDO0tBQ0wsQ0FBQztBQUNOLENBQUM7QUFiRCwwQ0FhQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGRlcml2ZUVkMjU1MTlLZXkgfSBmcm9tIFwiLi4va2V5cy9kZXJpdmVLZXlcIjtcbmltcG9ydCB7IGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5LCBwYXJzZU9wZW5TU0hQcml2YXRlS2V5IH0gZnJvbSBcIi4uL2tleXMvc3NoS2V5RmlsZVwiO1xuaW1wb3J0IHBhdGggZnJvbSBcInBhdGhcIjtcbmltcG9ydCB7IGZpbmRLZXksIGtleXNEaXIsIExFR0FDWV9SRVBPX0tFWVNfRElSLCBSRVBPU19ESVIsIHNvdXJjZU5hbWUgfSBmcm9tIFwiLi9zb3VyY2VzXCI7XG5cbi8vIEEgc291cmNlJ3MgcmV2b2NhdGlvbnMgbGl2ZSBpbiBhIHJlcG8gYmVzaWRlIGl0LiBEZXJpdmVkIHJhdGhlciB0aGFuIGNvbmZpZ3VyZWQsIHNvIGFkZGluZyBhXG4vLyBzb3VyY2UgYnJpbmdzIGl0cyByZXZva2UgcmVwbyB3aXRoIGl0IGFuZCB0aGVyZSBpcyBub3RoaW5nIGV4dHJhIHRvIHBhc3Mgb24gdGhlIGNvbW1hbmQgbGluZS5cbmNvbnN0IFJFVk9LRURfU1VGRklYID0gXCJfcmV2b2tlZFwiO1xuLy8gR2l0SHViIHdpbGwgbm90IHRha2UgdGhlIHNhbWUgcHVibGljIGtleSBhcyBhIGRlcGxveSBrZXkgb24gdHdvIHJlcG9zLCBzbyB0aGUgcmV2b2tlIHJlcG8gaXNcbi8vIHJlYWNoZWQgd2l0aCBhIGtleSBkZXJpdmVkIGZyb20gdGhlIHNvdXJjZSdzLCB1bmRlciB0aGlzIGxhYmVsLlxuZXhwb3J0IGNvbnN0IFJFVk9LRV9LRVlfTEFCRUwgPSBcInJldm9rZWdpdGh1YmtleVwiO1xuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwb1VSTChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIGxldCB3aXRob3V0R2l0ID0gc291cmNlVVJMLnJlcGxhY2UoL1xcLmdpdCQvLCBcIlwiKTtcbiAgICByZXR1cm4gYCR7d2l0aG91dEdpdH0ke1JFVk9LRURfU1VGRklYfS5naXRgO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlS2V5UGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBwYXRoLmpvaW4oa2V5c0RpcigpLCBgJHtzb3VyY2VOYW1lKHNvdXJjZVVSTCl9JHtSRVZPS0VEX1NVRkZJWH1gKTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGxlZ2FjeVJldm9rZUtleVBhdGgoc291cmNlVVJMOiBzdHJpbmcpIHtcbiAgICByZXR1cm4gYCR7TEVHQUNZX1JFUE9fS0VZU19ESVJ9LyR7c291cmNlTmFtZShzb3VyY2VVUkwpfSR7UkVWT0tFRF9TVUZGSVh9YDtcbn1cblxuLyoqIFdoZXJldmVyIHRoaXMgc291cmNlJ3MgcmV2b2tlIGtleSBhbHJlYWR5IGlzLCBvciBub3RoaW5nIGlmIGl0IGhhcyBub3QgYmVlbiBkZXJpdmVkIHlldC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBmaW5kUmV2b2tlS2V5KHNvdXJjZVVSTDogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGF3YWl0IGZpbmRLZXkoeyBjdXJyZW50OiByZXZva2VLZXlQYXRoKHNvdXJjZVVSTCksIGxlZ2FjeTogbGVnYWN5UmV2b2tlS2V5UGF0aChzb3VyY2VVUkwpIH0pO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwb1BhdGgoc291cmNlVVJMOiBzdHJpbmcpIHtcbiAgICByZXR1cm4gYCR7UkVQT1NfRElSfS8ke3NvdXJjZU5hbWUoc291cmNlVVJMKX0ke1JFVk9LRURfU1VGRklYfWA7XG59XG5cbi8qKiBUaGUgcmV2b2tlIHJlcG8ncyBrZXksIHdvcmtlZCBvdXQgZnJvbSB0aGUgc291cmNlIHJlcG8ncyBrZXkuIEFueXRoaW5nIGhvbGRpbmcgdGhlIHNvdXJjZSBrZXlcbiAgICBjYW4gcHJvZHVjZSBpdCwgc28gaXQgbmV2ZXIgaGFzIHRvIGJlIHN0b3JlZCBhbnl3aGVyZSBzZXBhcmF0ZWx5IG9yIGhhbmRlZCBhcm91bmQuICovXG5leHBvcnQgZnVuY3Rpb24gZGVyaXZlUmV2b2tlS2V5KHNvdXJjZVByaXZhdGVLZXk6IHN0cmluZykge1xuICAgIGxldCBzb3VyY2UgPSBwYXJzZU9wZW5TU0hQcml2YXRlS2V5KHNvdXJjZVByaXZhdGVLZXkpO1xuICAgIGxldCBkZXJpdmVkID0gZGVyaXZlRWQyNTUxOUtleSh7IHNlZWQ6IHNvdXJjZS5zZWVkLCBsYWJlbDogUkVWT0tFX0tFWV9MQUJFTCB9KTtcbiAgICByZXR1cm4ge1xuICAgICAgICBwdWJsaWNLZXk6IGBzc2gtZWQyNTUxOSAke0J1ZmZlci5jb25jYXQoW1xuICAgICAgICAgICAgQnVmZmVyLmZyb20oWzAsIDAsIDAsIDExXSksIEJ1ZmZlci5mcm9tKFwic3NoLWVkMjU1MTlcIiksXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShbMCwgMCwgMCwgMzJdKSwgZGVyaXZlZC5wdWJsaWNLZXksXG4gICAgICAgIF0pLnRvU3RyaW5nKFwiYmFzZTY0XCIpfWAsXG4gICAgICAgIHByaXZhdGVLZXlGaWxlOiBmb3JtYXRPcGVuU1NIUHJpdmF0ZUtleSh7XG4gICAgICAgICAgICBzZWVkOiBkZXJpdmVkLnNlZWQsXG4gICAgICAgICAgICBjb21tZW50OiBgJHtzb3VyY2UuY29tbWVudCB8fCBcInBvcnRzZWN1cmVcIn0gJHtSRVZPS0VfS0VZX0xBQkVMfWAsXG4gICAgICAgIH0pLFxuICAgIH07XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "fa19b1fd43388ad835ac95f96f64acb37f8ebbc316741e6c48fc273ac174e1e7"; */