sliftutils 1.7.127 → 1.7.129

package/security/authorizedKeys/unrevoke.ts

@@ -2,12 +2,14 @@ import fs from "fs/promises";
 import os from "os";
 import path from "path";
 import { runPromise } from "socket-function/src/runPromise";
-import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
-import { revokeRepoURL } from "./revokeSource";
+import { allowAddresses, keyFingerprint, normalizeKeys, summarizeKey } from "./authorizedKeys";
+import { deriveRevokeKey, revokeRepoURL } from "./revokeSource";
+import { findSourceKey } from "./sources";
 import { signRepo } from "../signedFiles/signFiles";
 import { readRepoKeys } from "./authorizedKeys";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
+import { machineState } from "../machines/machines";
 
 const UNREVOKES_DIR = "unrevoked";
 const REVOCATIONS_DIR = "revocations";
@@ -22,26 +24,54 @@ passes. It signs the result, and with ${GIT_KEYWORD} it commits and pushes it to
 Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
 for a key you still want.`;
 
+/** One revocation event. Either an ssh key used from an address it is not allowed from, or a
+    machine that talked to us from one. Both are the same shape - an identity and an address - and
+    an unrevoke undoes either by allowing that same pair.
+
+    Which is why unrevoking never makes anything unrevokable: used from some other address, it is
+    revoked again, under a new id no existing unrevoke names. */
 export type Revocation = {
     revocationId: string;
-    fingerprint: string;
+    // Exactly one of these. A key revocation names a fingerprint, a machine revocation a machineId.
+    fingerprint?: string;
+    machineId?: string;
+    ip?: string;
     key?: string;
     revokedAt?: string;
     revokedBy?: string;
+    reason?: string;
     attempt?: { ip?: string; user?: string; required?: string };
 };
 
-/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
-    credentials this machine already has - the derived deploy key is for servers, and a person
-    running this has their own access to the repo. */
+/** Older revocation files carry the address under attempt only. */
+export function revocationIP(revocation: Revocation) {
+    return revocation.ip || revocation.attempt?.ip || "";
+}
+
+/** What the revocation is about, which is what an unrevoke has to name to undo it. */
+export function revocationIdentity(revocation: Revocation) {
+    return revocation.fingerprint || revocation.machineId || "";
+}
+
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory.
+
+    A person running this has their own access to the repo, so their credentials are what is used.
+    On a machine that is already a portsecure host there may be no such credentials, but the source
+    deploy key is right there, and the key derived from it is one that repo definitely accepts. */
 export async function readRemoteRevocations(config: { sourceURL: string }) {
     let { sourceURL } = config;
     let temporaryDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "unrevoke-"));
     let repoPath = path.join(temporaryDirectory, "repo");
-    let clone = await spawnPromise({
-        command: "git",
-        args: ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath],
-    });
+    let cloneArgs = ["clone", "--depth", "1", revokeRepoURL(sourceURL), repoPath];
+    let sourceKey = await findSourceKey(sourceURL);
+    if (sourceKey) {
+        let derived = deriveRevokeKey(await fs.readFile(sourceKey, "utf8"));
+        let derivedKeyPath = path.join(temporaryDirectory, "key");
+        await fs.writeFile(derivedKeyPath, derived.privateKeyFile, { mode: 0o600 });
+        let sshCommand = `ssh -i ${derivedKeyPath} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+        cloneArgs = ["-c", `core.sshCommand=${sshCommand}`, ...cloneArgs];
+    }
+    let clone = await spawnPromise({ command: "git", args: cloneArgs });
     if (clone.status !== 0) {
         await fs.rm(temporaryDirectory, { recursive: true, force: true });
         throw new Error(
@@ -77,6 +107,10 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
                 continue;
             }
             let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let allowed of parsed.allowed || []) {
+                unrevoked.add(`${allowed.fingerprint || allowed.machineId} ${allowed.ip}`);
+            }
+            // Named ids, for the unrevokes written before this was about pairs.
             for (let revocationId of parsed.revocationIds || []) {
                 unrevoked.add(revocationId);
             }
@@ -84,13 +118,84 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
     } catch (e) {
         // Nothing has been unrevoked.
     }
-    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId)
+        && !unrevoked.has(`${revocation.fingerprint} ${revocationIP(revocation)}`));
     let keys = normalizeKeys(await fs.readFile(path.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
     return stillRevoked
         .filter(revocation => keys.some(key => keyFingerprint(key) === revocation.fingerprint))
         .map(revocation => ({ revocation, key: keys.find(key => keyFingerprint(key) === revocation.fingerprint) || "" }));
 }
 
+/** Writes the addresses into the from= list of each key in the repo's authorized_keys, and says
+    which ones were actually new. Only the lines being changed are touched, so comments, ordering
+    and any key not involved come out of this byte for byte the same. */
+async function allowAddressesInRepo(config: {
+    repoPath: string;
+    addressesByFingerprint: Map<string, string[]>;
+}) {
+    let { repoPath, addressesByFingerprint } = config;
+    let added = new Map<string, string[]>();
+    let filePath = path.join(repoPath, "authorized_keys");
+    let contents;
+    try {
+        contents = await fs.readFile(filePath, "utf8");
+    } catch (e) {
+        // A repo holding its keys as separate .pub files. Nothing to edit in one place, so the
+        // caller's listing is all whoever ran this gets.
+        console.log(`No authorized_keys in ${repoPath}, so the addresses were not added to any key.`);
+        return added;
+    }
+    let lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index++) {
+        let fingerprint = keyFingerprint(lines[index]);
+        let addresses = fingerprint && addressesByFingerprint.get(fingerprint);
+        if (!addresses || !addresses.length) {
+            continue;
+        }
+        let result = allowAddresses(lines[index], addresses);
+        lines[index] = result.keyLine;
+        added.set(fingerprint, [...(added.get(fingerprint) || []), ...result.added]);
+    }
+    if ([...added.values()].some(list => list.length)) {
+        await fs.writeFile(filePath, lines.join("\n"));
+    }
+    return added;
+}
+
+/** Puts each machine's addresses back into its own file, which is the machine equivalent of adding
+    an address to a key's from= list: without it the machine is allowed again in principle and
+    still rejected on sight, which revokes it once more. */
+async function allowAddressesForMachines(config: { repoPath: string; revocations: Revocation[] }) {
+    let { repoPath, revocations } = config;
+    let added = new Map<string, string[]>();
+    // Read the whole list, change what these revocations are about, write it back. Setting is by
+    // the whole set, so writing one machine at a time would delete every other machine.
+    let machines = await machineState({ repoPath });
+    for (let revocation of revocations) {
+        let machineId = revocation.machineId;
+        let ip = revocationIP(revocation);
+        if (!machineId || !ip) {
+            continue;
+        }
+        let existing = machines.find(machine => machine.machineId === machineId);
+        if (!existing) {
+            // Removed from the repo since it was revoked, so there is nothing to allow. Deleting a
+            // machine is the stronger statement and it stands.
+            console.log(`machines/${machineId}.json is not in this repo, so ${ip} was not added to it`);
+            continue;
+        }
+        if (existing.ips.includes(ip)) {
+            continue;
+        }
+        existing.ips = [...existing.ips, ip];
+        added.set(machineId, [...(added.get(machineId) || []), ip]);
+    }
+    if (added.size) {
+        await machineState({ repoPath, machines });
+    }
+    return added;
+}
+
 /** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
     repo that actually holds keys and has an origin to clone from. */
 async function resolveKeysRepo(named: string | undefined) {
@@ -140,22 +245,77 @@ export async function main() {
     await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
         unrevokeId,
         createdAt: new Date().toISOString(),
-        // Named one by one rather than as a blanket "allow everything again", so this file only
-        // ever undoes the revocations that existed when it was written.
-        revocationIds: revocations.map(revocation => revocation.revocationId),
+        // What this file says: each of these keys is allowed from this address. Pairs, not keys,
+        // and not a blanket "allow everything again" - a key forgiven here for one address is
+        // still revoked the moment it is used from another.
+        allowed: revocations.map(revocation => ({
+            fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
+        })),
         revocations: revocations.map(revocation => ({
             revocationId: revocation.revocationId,
             fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
             revokedAt: revocation.revokedAt,
             revokedBy: revocation.revokedBy,
             attempt: revocation.attempt,
         })),
     }, undefined, 4) + "\n");
 
-    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    // Named the way the notifications name them. A fingerprint is not in authorized_keys and
+    // cannot be worked out by eye, so on its own it tells whoever is reading this nothing about
+    // which of their keys is being talked about.
+    let keysByFingerprint = new Map<string, string>();
+    for (let key of await readRepoKeys(repoPath).catch(() => [] as string[])) {
+        keysByFingerprint.set(keyFingerprint(key), key);
+    }
+    let describeKey = (revocation: Revocation) => {
+        let key = keysByFingerprint.get(revocation.fingerprint || "") || revocation.key || "";
+        return key && summarizeKey(key) || `a key no longer in this repo (${revocation.fingerprint})`;
+    };
+
+    let addressesByIdentity = new Map<string, string[]>();
     for (let revocation of revocations) {
-        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${revocation.attempt?.ip || "?"}`);
+        let ip = revocationIP(revocation);
+        let identity = revocationIdentity(revocation);
+        let existing = addressesByIdentity.get(identity) || [];
+        if (ip && !existing.includes(ip)) {
+            existing.push(ip);
+        }
+        addressesByIdentity.set(identity, existing);
+    }
+
+    // Cancelling the revocation on its own would leave sshd refusing that address, and the machines
+    // revoking all over again, so the addresses go into the key's from= list and into the machine's
+    // own file here. We are in the repo that owns both, so there is nothing to hand back to whoever
+    // ran this.
+    let added = await allowAddressesInRepo({ repoPath, addressesByFingerprint: addressesByIdentity });
+    let addedForMachines = await allowAddressesForMachines({ repoPath, revocations });
+
+    console.log("");
+    for (let [identity, addresses] of addressesByIdentity) {
+        let entries = revocations.filter(entry => revocationIdentity(entry) === identity);
+        let machineId = entries[0].machineId;
+        console.log(`Unfreezing ${machineId && `machine ${machineId}` || describeKey(entries[0])}`);
+        console.log(`Allowing IP ${addresses.join(", ") || "(no address recorded)"}`);
+        let addedHere = machineId && addedForMachines.get(machineId) || added.get(identity) || [];
+        if (addedHere.length) {
+            let where = machineId && `machines/${machineId}.json` || `that key's from= list in authorized_keys`;
+            console.log(`  added to ${where}: ${addedHere.join(", ")}`);
+        } else {
+            console.log(`  already allowed from ${addresses.join(", ") || "everywhere"}`);
+        }
+        for (let entry of entries) {
+            console.log(
+                `  frozen by ${entry.revokedBy || "?"} ${entry.revokedAt || "at an unrecorded time"}`
+            );
+        }
+        console.log("");
     }
+    console.log(`Every other address stays frozen, and any of these used from anywhere else is`);
+    console.log(`frozen again.`);
 
     // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
     // all, and the repo would sit there looking done while every machine ignored it.

package/security/helpers/dist/remoteSSH.ts.cache

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.SUDO_PREAMBLE = void 0;
+//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.describeHost = exports.THIS_MACHINE = exports.SUDO_PREAMBLE = void 0;
 const spawn_1 = require("./spawn");
 const SSH_CONNECT_TIMEOUT = 10;
 const EXISTS_MARKER = "__PORTSECURE_EXISTS__";
@@ -8,27 +8,37 @@ const MISSING_MARKER = "__PORTSECURE_MISSING__";
 const MAX_ERROR_BODY_LENGTH = 500;
 // /etc is root owned, so fall back to sudo whenever the SSH user is not root.
 exports.SUDO_PREAMBLE = `SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo -n"; fi`;
+/** No host means this machine, so the very same script runs with nothing in front of it. Local and
+    remote then do exactly the same thing, rather than being two pieces of code that have to be kept
+    saying the same thing. */
+exports.THIS_MACHINE = "";
+function describeHost(host) {
+    return host || "this machine";
+}
+exports.describeHost = describeHost;
 /** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
     config, so BatchMode makes a missing setup fail immediately instead of prompting. */
 async function runOverSSH(config) {
     let { host, script, input, allowFailure } = config;
     let result = await (0, spawn_1.spawnPromise)({
-        command: "ssh",
-        args: [
+        command: host && "ssh" || "sh",
+        args: host && [
             "-o", "BatchMode=yes",
             "-o", `ConnectTimeout=${SSH_CONNECT_TIMEOUT}`,
             host,
             script,
-        ],
+        ] || ["-c", script],
         input,
         inheritStderr: !allowFailure,
     });
     if (result.error) {
-        throw new Error(`Expected ssh to run against ${host}, failed with ${result.error.message}`);
+        throw new Error(`Expected to run against ${describeHost(host)}, failed with ${result.error.message}`);
     }
     if (result.status !== 0 && !allowFailure) {
-        throw new Error(`Expected ssh to ${host} to exit 0, was ${result.status}.`
-            + ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.\n`
+        let advice = host
+            && ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.`
+            || "";
+        throw new Error(`Expected the script on ${describeHost(host)} to exit 0, was ${result.status}.${advice}\n`
             + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
     }
     return { stdout: result.stdout || "", stderr: result.stderr || "", status: result.status };
@@ -86,5 +96,5 @@ async function remoteCommandExists(config) {
     return result.stdout.trim() === "yes";
 }
 exports.remoteCommandExists = remoteCommandExists;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7d0ZBQ3dGO0FBQ2pGLEtBQUssVUFBVSxVQUFVLENBQUMsTUFBZ0Y7SUFDN0csSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRCxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQztRQUM1QixPQUFPLEVBQUUsS0FBSztRQUNkLElBQUksRUFBRTtZQUNGLElBQUksRUFBRSxlQUFlO1lBQ3JCLElBQUksRUFBRSxrQkFBa0IsbUJBQW1CLEVBQUU7WUFDN0MsSUFBSTtZQUNKLE1BQU07U0FDVDtRQUNELEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsSUFBSSxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxtQkFBbUIsSUFBSSxtQkFBbUIsTUFBTSxDQUFDLE1BQU0sR0FBRztjQUN4RCxrQ0FBa0MsSUFBSSx3REFBd0Q7Y0FDOUYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUNoRixDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDL0YsQ0FBQztBQXhCRCxnQ0F3QkM7QUFFRDtpQkFDaUI7QUFDVixLQUFLLFVBQVUsY0FBYyxDQUFDLE1BQTBDO0lBQzNFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2hDLElBQUksTUFBTSxHQUFHLENBQUMsTUFBTSxVQUFVLENBQUM7UUFDM0IsSUFBSTtRQUNKLE1BQU0sRUFBRSxHQUFHLHFCQUFhO29CQUNaLFFBQVE7WUFDaEIsYUFBYTtpQkFDUixRQUFROztZQUViLGNBQWM7R0FDdkI7S0FDRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDWCxJQUFJLFlBQVksR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLElBQUksTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xELElBQUksTUFBTSxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxJQUFJLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksYUFBYSxPQUFPLGNBQWMsU0FBUyxJQUFJLFNBQVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEksQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDMUMsQ0FBQztBQXJCRCx3Q0FxQkM7QUFFTSxLQUFLLFVBQVUsZUFBZSxDQUFDLE1BTXJDO0lBQ0csSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkUsSUFBSSxTQUFTLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdELE1BQU0sVUFBVSxDQUFDO1FBQ2IsSUFBSTtRQUNKLHNGQUFzRjtRQUN0RixrREFBa0Q7UUFDbEQsS0FBSyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQztRQUN0QyxNQUFNLEVBQUUsR0FBRyxxQkFBYTs7a0JBRWQsU0FBUztjQUNiLGFBQWEsS0FBSyxTQUFTO2FBQzVCLFFBQVE7Y0FDUCxRQUFRLEtBQUssUUFBUSxHQUFHO0tBQ2pDLENBQUMsQ0FBQztBQUNQLENBQUM7QUFyQkQsMENBcUJDO0FBRU0sS0FBSyxVQUFVLG1CQUFtQixDQUFDLE1BQXlDO0lBQy9FLElBQUksRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQy9CLElBQUksTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDO1FBQzFCLElBQUk7UUFDSixNQUFNLEVBQUUsZUFBZSxPQUFPLDJDQUEyQztRQUN6RSxZQUFZLEVBQUUsSUFBSTtLQUNyQixDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssS0FBSyxDQUFDO0FBQzFDLENBQUM7QUFSRCxrREFRQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHNwYXduUHJvbWlzZSB9IGZyb20gXCIuL3NwYXduXCI7XG5cbmNvbnN0IFNTSF9DT05ORUNUX1RJTUVPVVQgPSAxMDtcbmNvbnN0IEVYSVNUU19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9FWElTVFNfX1wiO1xuY29uc3QgTUlTU0lOR19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9NSVNTSU5HX19cIjtcbmNvbnN0IE1BWF9FUlJPUl9CT0RZX0xFTkdUSCA9IDUwMDtcblxuLy8gL2V0YyBpcyByb290IG93bmVkLCBzbyBmYWxsIGJhY2sgdG8gc3VkbyB3aGVuZXZlciB0aGUgU1NIIHVzZXIgaXMgbm90IHJvb3QuXG5leHBvcnQgY29uc3QgU1VET19QUkVBTUJMRSA9IGBTVURPPVwiXCI7IGlmIFsgXCIkKGlkIC11KVwiIC1uZSAwIF07IHRoZW4gU1VETz1cInN1ZG8gLW5cIjsgZmlgO1xuXG4vKiogVGhlIGhvc3Qgc3RyaW5nIGlzIGhhbmRlZCB0byBzc2ggdW50b3VjaGVkLiBVc2Vycywga2V5cyBhbmQgcG9ydHMgYmVsb25nIGluIHRoZSBjYWxsZXIncyBzc2hcbiAgICBjb25maWcsIHNvIEJhdGNoTW9kZSBtYWtlcyBhIG1pc3Npbmcgc2V0dXAgZmFpbCBpbW1lZGlhdGVseSBpbnN0ZWFkIG9mIHByb21wdGluZy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBydW5PdmVyU1NIKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IHNjcmlwdDogc3RyaW5nOyBpbnB1dD86IHN0cmluZzsgYWxsb3dGYWlsdXJlPzogYm9vbGVhbiB9KSB7XG4gICAgbGV0IHsgaG9zdCwgc2NyaXB0LCBpbnB1dCwgYWxsb3dGYWlsdXJlIH0gPSBjb25maWc7XG4gICAgbGV0IHJlc3VsdCA9IGF3YWl0IHNwYXduUHJvbWlzZSh7XG4gICAgICAgIGNvbW1hbmQ6IFwic3NoXCIsXG4gICAgICAgIGFyZ3M6IFtcbiAgICAgICAgICAgIFwiLW9cIiwgXCJCYXRjaE1vZGU9eWVzXCIsXG4gICAgICAgICAgICBcIi1vXCIsIGBDb25uZWN0VGltZW91dD0ke1NTSF9DT05ORUNUX1RJTUVPVVR9YCxcbiAgICAgICAgICAgIGhvc3QsXG4gICAgICAgICAgICBzY3JpcHQsXG4gICAgICAgIF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBzc2ggdG8gcnVuIGFnYWluc3QgJHtob3N0fSwgZmFpbGVkIHdpdGggJHtyZXN1bHQuZXJyb3IubWVzc2FnZX1gKTtcbiAgICB9XG4gICAgaWYgKHJlc3VsdC5zdGF0dXMgIT09IDAgJiYgIWFsbG93RmFpbHVyZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgc3NoIHRvICR7aG9zdH0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS5gXG4gICAgICAgICAgICArIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
- /* _JS_SOURCE_HASH = "b9707fe65376e19327371edb2ebdda68daa9b9b21220d7ac91ec21ef22520290"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7OzZCQUU2QjtBQUNoQixRQUFBLFlBQVksR0FBRyxFQUFFLENBQUM7QUFFL0IsU0FBZ0IsWUFBWSxDQUFDLElBQVk7SUFDckMsT0FBTyxJQUFJLElBQUksY0FBYyxDQUFDO0FBQ2xDLENBQUM7QUFGRCxvQ0FFQztBQUVEO3dGQUN3RjtBQUNqRixLQUFLLFVBQVUsVUFBVSxDQUFDLE1BQWdGO0lBQzdHLElBQUksRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkQsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUM7UUFDNUIsT0FBTyxFQUFFLElBQUksSUFBSSxLQUFLLElBQUksSUFBSTtRQUM5QixJQUFJLEVBQUUsSUFBSSxJQUFJO1lBQ1YsSUFBSSxFQUFFLGVBQWU7WUFDckIsSUFBSSxFQUFFLGtCQUFrQixtQkFBbUIsRUFBRTtZQUM3QyxJQUFJO1lBQ0osTUFBTTtTQUNULElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDO1FBQ25CLEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsSUFBSSxNQUFNLEdBQUcsSUFBSTtlQUNWLGtDQUFrQyxJQUFJLHNEQUFzRDtlQUM1RixFQUFFLENBQUM7UUFDVixNQUFNLElBQUksS0FBSyxDQUNYLDBCQUEwQixZQUFZLENBQUMsSUFBSSxDQUFDLG1CQUFtQixNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sSUFBSTtjQUN4RixHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUUsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUMvRixDQUFDO0FBMUJELGdDQTBCQztBQUVEO2lCQUNpQjtBQUNWLEtBQUssVUFBVSxjQUFjLENBQUMsTUFBMEM7SUFDM0UsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDaEMsSUFBSSxNQUFNLEdBQUcsQ0FBQyxNQUFNLFVBQVUsQ0FBQztRQUMzQixJQUFJO1FBQ0osTUFBTSxFQUFFLEdBQUcscUJBQWE7b0JBQ1osUUFBUTtZQUNoQixhQUFhO2lCQUNSLFFBQVE7O1lBRWIsY0FBYztHQUN2QjtLQUNFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNYLElBQUksWUFBWSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEMsSUFBSSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDbEQsSUFBSSxNQUFNLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDNUIsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELElBQUksTUFBTSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxhQUFhLE9BQU8sY0FBYyxTQUFTLElBQUksU0FBUyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNsSSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLFlBQVksR0FBRyxDQUFDLENBQUMsQ0FBQztBQUMxQyxDQUFDO0FBckJELHdDQXFCQztBQUVNLEtBQUssVUFBVSxlQUFlLENBQUMsTUFNckM7SUFDRyxJQUFJLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRSxJQUFJLFNBQVMsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxRQUFRLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsTUFBTSxVQUFVLENBQUM7UUFDYixJQUFJO1FBQ0osc0ZBQXNGO1FBQ3RGLGtEQUFrRDtRQUNsRCxLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDO1FBQ3RDLE1BQU0sRUFBRSxHQUFHLHFCQUFhOztrQkFFZCxTQUFTO2NBQ2IsYUFBYSxLQUFLLFNBQVM7YUFDNUIsUUFBUTtjQUNQLFFBQVEsS0FBSyxRQUFRLEdBQUc7S0FDakMsQ0FBQyxDQUFDO0FBQ1AsQ0FBQztBQXJCRCwwQ0FxQkM7QUFFTSxLQUFLLFVBQVUsbUJBQW1CLENBQUMsTUFBeUM7SUFDL0UsSUFBSSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDL0IsSUFBSSxNQUFNLEdBQUcsTUFBTSxVQUFVLENBQUM7UUFDMUIsSUFBSTtRQUNKLE1BQU0sRUFBRSxlQUFlLE9BQU8sMkNBQTJDO1FBQ3pFLFlBQVksRUFBRSxJQUFJO0tBQ3JCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLENBQUM7QUFDMUMsQ0FBQztBQVJELGtEQVFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4vc3Bhd25cIjtcblxuY29uc3QgU1NIX0NPTk5FQ1RfVElNRU9VVCA9IDEwO1xuY29uc3QgRVhJU1RTX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX0VYSVNUU19fXCI7XG5jb25zdCBNSVNTSU5HX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX01JU1NJTkdfX1wiO1xuY29uc3QgTUFYX0VSUk9SX0JPRFlfTEVOR1RIID0gNTAwO1xuXG4vLyAvZXRjIGlzIHJvb3Qgb3duZWQsIHNvIGZhbGwgYmFjayB0byBzdWRvIHdoZW5ldmVyIHRoZSBTU0ggdXNlciBpcyBub3Qgcm9vdC5cbmV4cG9ydCBjb25zdCBTVURPX1BSRUFNQkxFID0gYFNVRE89XCJcIjsgaWYgWyBcIiQoaWQgLXUpXCIgLW5lIDAgXTsgdGhlbiBTVURPPVwic3VkbyAtblwiOyBmaWA7XG5cbi8qKiBObyBob3N0IG1lYW5zIHRoaXMgbWFjaGluZSwgc28gdGhlIHZlcnkgc2FtZSBzY3JpcHQgcnVucyB3aXRoIG5vdGhpbmcgaW4gZnJvbnQgb2YgaXQuIExvY2FsIGFuZFxuICAgIHJlbW90ZSB0aGVuIGRvIGV4YWN0bHkgdGhlIHNhbWUgdGhpbmcsIHJhdGhlciB0aGFuIGJlaW5nIHR3byBwaWVjZXMgb2YgY29kZSB0aGF0IGhhdmUgdG8gYmUga2VwdFxuICAgIHNheWluZyB0aGUgc2FtZSB0aGluZy4gKi9cbmV4cG9ydCBjb25zdCBUSElTX01BQ0hJTkUgPSBcIlwiO1xuXG5leHBvcnQgZnVuY3Rpb24gZGVzY3JpYmVIb3N0KGhvc3Q6IHN0cmluZykge1xuICAgIHJldHVybiBob3N0IHx8IFwidGhpcyBtYWNoaW5lXCI7XG59XG5cbi8qKiBUaGUgaG9zdCBzdHJpbmcgaXMgaGFuZGVkIHRvIHNzaCB1bnRvdWNoZWQuIFVzZXJzLCBrZXlzIGFuZCBwb3J0cyBiZWxvbmcgaW4gdGhlIGNhbGxlcidzIHNzaFxuICAgIGNvbmZpZywgc28gQmF0Y2hNb2RlIG1ha2VzIGEgbWlzc2luZyBzZXR1cCBmYWlsIGltbWVkaWF0ZWx5IGluc3RlYWQgb2YgcHJvbXB0aW5nLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJ1bk92ZXJTU0goY29uZmlnOiB7IGhvc3Q6IHN0cmluZzsgc2NyaXB0OiBzdHJpbmc7IGlucHV0Pzogc3RyaW5nOyBhbGxvd0ZhaWx1cmU/OiBib29sZWFuIH0pIHtcbiAgICBsZXQgeyBob3N0LCBzY3JpcHQsIGlucHV0LCBhbGxvd0ZhaWx1cmUgfSA9IGNvbmZpZztcbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogaG9zdCAmJiBcInNzaFwiIHx8IFwic2hcIixcbiAgICAgICAgYXJnczogaG9zdCAmJiBbXG4gICAgICAgICAgICBcIi1vXCIsIFwiQmF0Y2hNb2RlPXllc1wiLFxuICAgICAgICAgICAgXCItb1wiLCBgQ29ubmVjdFRpbWVvdXQ9JHtTU0hfQ09OTkVDVF9USU1FT1VUfWAsXG4gICAgICAgICAgICBob3N0LFxuICAgICAgICAgICAgc2NyaXB0LFxuICAgICAgICBdIHx8IFtcIi1jXCIsIHNjcmlwdF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0byBydW4gYWdhaW5zdCAke2Rlc2NyaWJlSG9zdChob3N0KX0sIGZhaWxlZCB3aXRoICR7cmVzdWx0LmVycm9yLm1lc3NhZ2V9YCk7XG4gICAgfVxuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwICYmICFhbGxvd0ZhaWx1cmUpIHtcbiAgICAgICAgbGV0IGFkdmljZSA9IGhvc3RcbiAgICAgICAgICAgICYmIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5gXG4gICAgICAgICAgICB8fCBcIlwiO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgdGhlIHNjcmlwdCBvbiAke2Rlc2NyaWJlSG9zdChob3N0KX0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS4ke2FkdmljZX1cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "50b1a08f2aa4b96f04f676f20c516bc6c2897a47ad7c12729c0f651735c71057"; */

package/security/machines/addMachine.ts

@@ -0,0 +1,83 @@
+import os from "os";
+import { getOwnIPs } from "../../misc/ownIPs";
+import { describeHost } from "../helpers/remoteSSH";
+import { createRemoteIdentity, Identity, localDomains, localIdentity, remoteIdentity } from "./identity";
+import { machineState, resolveKeysRepo } from "./machines";
+
+const USAGE = `Usage: yarn addmachine <domain> [ip]
+
+The domain is required: a machine has a different identity, and so a different machine id, under
+every domain it runs under, so there is no such thing as "this machine" without one.
+
+With no ip it adds this machine, with its own addresses. With an ip it asks that machine over ssh
+for its identity under that domain, gives it one if it has none, and adds it under that address.
+
+It edits the keys repo this machine reads, wherever that is, not whatever directory this was run
+from. Nothing is signed or pushed here. Run "yarn signfiles git" in that repo afterwards, or no
+machine will believe any of it.`;
+
+export async function main() {
+    let argv = process.argv.slice(2);
+    if (!argv.length || argv.length > 2) {
+        throw new Error(`Expected a domain and optionally an ip, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [domain, host = ""] = argv;
+    // The same repo the acceptance check reads. Editing anything else would write a machine list
+    // nothing on this machine ever looks at.
+    let { repoPath } = await resolveKeysRepo();
+
+    let identity: Identity;
+    let addresses: string[];
+    if (!host) {
+        let found = await localIdentity(domain);
+        if (!found) {
+            throw new Error(
+                `Expected an identity for ${domain} in ${os.homedir()}, this machine has none.\n`
+                + `It has: ${(await localDomains()).join(", ") || "no identities at all"}\n`
+                + `One is generated the first time something runs here under a domain, so run that`
+                + ` first, or name another machine to add instead.`
+            );
+        }
+        identity = found;
+        addresses = await getOwnIPs();
+        if (!addresses.length) {
+            throw new Error(`Expected this machine to have an address anything else can see, it has none`);
+        }
+    } else {
+        // Nothing there under this domain means it gets one. Its own from this point on: the key
+        // is written there and nothing keeps a copy.
+        let found = await remoteIdentity(host, domain);
+        if (!found) {
+            console.log(`${describeHost(host)} has no identity for ${domain}, generating one`);
+        }
+        identity = found || await createRemoteIdentity({ host, domain });
+        // The address it was named by is the address it talks to us from, which is the one thing
+        // it cannot lie about.
+        addresses = [host];
+    }
+
+    // The whole list is read and written back, because setting is by the set: writing this one
+    // machine alone would remove every other machine from the repo.
+    let machines = await machineState({ repoPath });
+    let existing = machines.find(machine => machine.machineId === identity.machineId);
+    let ips = [...(existing?.ips || [])];
+    let added = addresses.filter(address => !ips.includes(address));
+    if (existing) {
+        existing.ips = [...ips, ...added];
+    } else {
+        machines.push({ machineId: identity.machineId, ips: [...added], addedAt: "" });
+    }
+    await machineState({ repoPath, machines });
+
+    console.log(`\nTrusting machine ${identity.machineId}`);
+    console.log(`Allowing IP ${[...ips, ...added].join(", ")}`);
+    if (added.length) {
+        console.log(`  added to machines/${identity.machineId}.json: ${added.join(", ")}`);
+    } else {
+        console.log(`  already allowed from ${addresses.join(", ")}`);
+    }
+    console.log(`  identity ${identity.fullDomain}`);
+    console.log(`  in ${repoPath}`);
+    console.log(`\nNothing believes this until it is signed. In that repo, run:`);
+    console.log(`\`\`\`\nyarn signfiles git\n\`\`\``);
+}

package/security/machines/dist/addMachine.ts.cache

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.main = void 0;
+const os_1 = __importDefault(require("os"));
+const ownIPs_1 = require("../../misc/ownIPs");
+const remoteSSH_1 = require("../helpers/remoteSSH");
+const identity_1 = require("./identity");
+const machines_1 = require("./machines");
+const USAGE = `Usage: yarn addmachine <domain> [ip]
+
+The domain is required: a machine has a different identity, and so a different machine id, under
+every domain it runs under, so there is no such thing as "this machine" without one.
+
+With no ip it adds this machine, with its own addresses. With an ip it asks that machine over ssh
+for its identity under that domain, gives it one if it has none, and adds it under that address.
+
+It edits the keys repo this machine reads, wherever that is, not whatever directory this was run
+from. Nothing is signed or pushed here. Run "yarn signfiles git" in that repo afterwards, or no
+machine will believe any of it.`;
+async function main() {
+    let argv = process.argv.slice(2);
+    if (!argv.length || argv.length > 2) {
+        throw new Error(`Expected a domain and optionally an ip, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [domain, host = ""] = argv;
+    // The same repo the acceptance check reads. Editing anything else would write a machine list
+    // nothing on this machine ever looks at.
+    let { repoPath } = await (0, machines_1.resolveKeysRepo)();
+    let identity;
+    let addresses;
+    if (!host) {
+        let found = await (0, identity_1.localIdentity)(domain);
+        if (!found) {
+            throw new Error(`Expected an identity for ${domain} in ${os_1.default.homedir()}, this machine has none.\n`
+                + `It has: ${(await (0, identity_1.localDomains)()).join(", ") || "no identities at all"}\n`
+                + `One is generated the first time something runs here under a domain, so run that`
+                + ` first, or name another machine to add instead.`);
+        }
+        identity = found;
+        addresses = await (0, ownIPs_1.getOwnIPs)();
+        if (!addresses.length) {
+            throw new Error(`Expected this machine to have an address anything else can see, it has none`);
+        }
+    }
+    else {
+        // Nothing there under this domain means it gets one. Its own from this point on: the key
+        // is written there and nothing keeps a copy.
+        let found = await (0, identity_1.remoteIdentity)(host, domain);
+        if (!found) {
+            console.log(`${(0, remoteSSH_1.describeHost)(host)} has no identity for ${domain}, generating one`);
+        }
+        identity = found || await (0, identity_1.createRemoteIdentity)({ host, domain });
+        // The address it was named by is the address it talks to us from, which is the one thing
+        // it cannot lie about.
+        addresses = [host];
+    }
+    // The whole list is read and written back, because setting is by the set: writing this one
+    // machine alone would remove every other machine from the repo.
+    let machines = await (0, machines_1.machineState)({ repoPath });
+    let existing = machines.find(machine => machine.machineId === identity.machineId);
+    let ips = [...((existing === null || existing === void 0 ? void 0 : existing.ips) || [])];
+    let added = addresses.filter(address => !ips.includes(address));
+    if (existing) {
+        existing.ips = [...ips, ...added];
+    }
+    else {
+        machines.push({ machineId: identity.machineId, ips: [...added], addedAt: "" });
+    }
+    await (0, machines_1.machineState)({ repoPath, machines });
+    console.log(`\nTrusting machine ${identity.machineId}`);
+    console.log(`Allowing IP ${[...ips, ...added].join(", ")}`);
+    if (added.length) {
+        console.log(`  added to machines/${identity.machineId}.json: ${added.join(", ")}`);
+    }
+    else {
+        console.log(`  already allowed from ${addresses.join(", ")}`);
+    }
+    console.log(`  identity ${identity.fullDomain}`);
+    console.log(`  in ${repoPath}`);
+    console.log(`\nNothing believes this until it is signed. In that repo, run:`);
+    console.log(`\`\`\`\nyarn signfiles git\n\`\`\``);
+}
+exports.main = main;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWRkTWFjaGluZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImFkZE1hY2hpbmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsNENBQW9CO0FBQ3BCLDhDQUE4QztBQUM5QyxvREFBb0Q7QUFDcEQseUNBQXlHO0FBQ3pHLHlDQUEyRDtBQUUzRCxNQUFNLEtBQUssR0FBRzs7Ozs7Ozs7OztnQ0FVa0IsQ0FBQztBQUUxQixLQUFLLFVBQVUsSUFBSTtJQUN0QixJQUFJLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLElBQUksQ0FBQyxNQUFNLGlCQUFpQixLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksR0FBRyxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUM7SUFDL0IsNkZBQTZGO0lBQzdGLHlDQUF5QztJQUN6QyxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxJQUFBLDBCQUFlLEdBQUUsQ0FBQztJQUUzQyxJQUFJLFFBQWtCLENBQUM7SUFDdkIsSUFBSSxTQUFtQixDQUFDO0lBQ3hCLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNSLElBQUksS0FBSyxHQUFHLE1BQU0sSUFBQSx3QkFBYSxFQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3hDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQ1gsNEJBQTRCLE1BQU0sT0FBTyxZQUFFLENBQUMsT0FBTyxFQUFFLDRCQUE0QjtrQkFDL0UsV0FBVyxDQUFDLE1BQU0sSUFBQSx1QkFBWSxHQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksc0JBQXNCLElBQUk7a0JBQzFFLGlGQUFpRjtrQkFDakYsaURBQWlELENBQ3RELENBQUM7UUFDTixDQUFDO1FBQ0QsUUFBUSxHQUFHLEtBQUssQ0FBQztRQUNqQixTQUFTLEdBQUcsTUFBTSxJQUFBLGtCQUFTLEdBQUUsQ0FBQztRQUM5QixJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3BCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkVBQTZFLENBQUMsQ0FBQztRQUNuRyxDQUFDO0lBQ0wsQ0FBQztTQUFNLENBQUM7UUFDSix5RkFBeUY7UUFDekYsNkNBQTZDO1FBQzdDLElBQUksS0FBSyxHQUFHLE1BQU0sSUFBQSx5QkFBYyxFQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUMvQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDVCxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBQSx3QkFBWSxFQUFDLElBQUksQ0FBQyx3QkFBd0IsTUFBTSxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7UUFDRCxRQUFRLEdBQUcsS0FBSyxJQUFJLE1BQU0sSUFBQSwrQkFBb0IsRUFBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2pFLHlGQUF5RjtRQUN6Rix1QkFBdUI7UUFDdkIsU0FBUyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdkIsQ0FBQztJQUVELDJGQUEyRjtJQUMzRixnRUFBZ0U7SUFDaEUsSUFBSSxRQUFRLEdBQUcsTUFBTSxJQUFBLHVCQUFZLEVBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2hELElBQUksUUFBUSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRixJQUFJLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBLFFBQVEsYUFBUixRQUFRLHVCQUFSLFFBQVEsQ0FBRSxHQUFHLEtBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNyQyxJQUFJLEtBQUssR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDaEUsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNYLFFBQVEsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxDQUFDO0lBQ3RDLENBQUM7U0FBTSxDQUFDO1FBQ0osUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLEdBQUcsS0FBSyxDQUFDLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELE1BQU0sSUFBQSx1QkFBWSxFQUFDLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFFM0MsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUMsR0FBRyxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVELElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2YsT0FBTyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsUUFBUSxDQUFDLFNBQVMsVUFBVSxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN2RixDQUFDO1NBQU0sQ0FBQztRQUNKLE9BQU8sQ0FBQyxHQUFHLENBQUMsMEJBQTBCLFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDakQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDaEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQzlFLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0NBQW9DLENBQUMsQ0FBQztBQUN0RCxDQUFDO0FBaEVELG9CQWdFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCB7IGdldE93bklQcyB9IGZyb20gXCIuLi8uLi9taXNjL293bklQc1wiO1xuaW1wb3J0IHsgZGVzY3JpYmVIb3N0IH0gZnJvbSBcIi4uL2hlbHBlcnMvcmVtb3RlU1NIXCI7XG5pbXBvcnQgeyBjcmVhdGVSZW1vdGVJZGVudGl0eSwgSWRlbnRpdHksIGxvY2FsRG9tYWlucywgbG9jYWxJZGVudGl0eSwgcmVtb3RlSWRlbnRpdHkgfSBmcm9tIFwiLi9pZGVudGl0eVwiO1xuaW1wb3J0IHsgbWFjaGluZVN0YXRlLCByZXNvbHZlS2V5c1JlcG8gfSBmcm9tIFwiLi9tYWNoaW5lc1wiO1xuXG5jb25zdCBVU0FHRSA9IGBVc2FnZTogeWFybiBhZGRtYWNoaW5lIDxkb21haW4+IFtpcF1cblxuVGhlIGRvbWFpbiBpcyByZXF1aXJlZDogYSBtYWNoaW5lIGhhcyBhIGRpZmZlcmVudCBpZGVudGl0eSwgYW5kIHNvIGEgZGlmZmVyZW50IG1hY2hpbmUgaWQsIHVuZGVyXG5ldmVyeSBkb21haW4gaXQgcnVucyB1bmRlciwgc28gdGhlcmUgaXMgbm8gc3VjaCB0aGluZyBhcyBcInRoaXMgbWFjaGluZVwiIHdpdGhvdXQgb25lLlxuXG5XaXRoIG5vIGlwIGl0IGFkZHMgdGhpcyBtYWNoaW5lLCB3aXRoIGl0cyBvd24gYWRkcmVzc2VzLiBXaXRoIGFuIGlwIGl0IGFza3MgdGhhdCBtYWNoaW5lIG92ZXIgc3NoXG5mb3IgaXRzIGlkZW50aXR5IHVuZGVyIHRoYXQgZG9tYWluLCBnaXZlcyBpdCBvbmUgaWYgaXQgaGFzIG5vbmUsIGFuZCBhZGRzIGl0IHVuZGVyIHRoYXQgYWRkcmVzcy5cblxuSXQgZWRpdHMgdGhlIGtleXMgcmVwbyB0aGlzIG1hY2hpbmUgcmVhZHMsIHdoZXJldmVyIHRoYXQgaXMsIG5vdCB3aGF0ZXZlciBkaXJlY3RvcnkgdGhpcyB3YXMgcnVuXG5mcm9tLiBOb3RoaW5nIGlzIHNpZ25lZCBvciBwdXNoZWQgaGVyZS4gUnVuIFwieWFybiBzaWduZmlsZXMgZ2l0XCIgaW4gdGhhdCByZXBvIGFmdGVyd2FyZHMsIG9yIG5vXG5tYWNoaW5lIHdpbGwgYmVsaWV2ZSBhbnkgb2YgaXQuYDtcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIG1haW4oKSB7XG4gICAgbGV0IGFyZ3YgPSBwcm9jZXNzLmFyZ3Yuc2xpY2UoMik7XG4gICAgaWYgKCFhcmd2Lmxlbmd0aCB8fCBhcmd2Lmxlbmd0aCA+IDIpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhIGRvbWFpbiBhbmQgb3B0aW9uYWxseSBhbiBpcCwgd2FzICR7YXJndi5sZW5ndGh9IGFyZ3VtZW50KHMpXFxuJHtVU0FHRX1gKTtcbiAgICB9XG4gICAgbGV0IFtkb21haW4sIGhvc3QgPSBcIlwiXSA9IGFyZ3Y7XG4gICAgLy8gVGhlIHNhbWUgcmVwbyB0aGUgYWNjZXB0YW5jZSBjaGVjayByZWFkcy4gRWRpdGluZyBhbnl0aGluZyBlbHNlIHdvdWxkIHdyaXRlIGEgbWFjaGluZSBsaXN0XG4gICAgLy8gbm90aGluZyBvbiB0aGlzIG1hY2hpbmUgZXZlciBsb29rcyBhdC5cbiAgICBsZXQgeyByZXBvUGF0aCB9ID0gYXdhaXQgcmVzb2x2ZUtleXNSZXBvKCk7XG5cbiAgICBsZXQgaWRlbnRpdHk6IElkZW50aXR5O1xuICAgIGxldCBhZGRyZXNzZXM6IHN0cmluZ1tdO1xuICAgIGlmICghaG9zdCkge1xuICAgICAgICBsZXQgZm91bmQgPSBhd2FpdCBsb2NhbElkZW50aXR5KGRvbWFpbik7XG4gICAgICAgIGlmICghZm91bmQpIHtcbiAgICAgICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgICAgICBgRXhwZWN0ZWQgYW4gaWRlbnRpdHkgZm9yICR7ZG9tYWlufSBpbiAke29zLmhvbWVkaXIoKX0sIHRoaXMgbWFjaGluZSBoYXMgbm9uZS5cXG5gXG4gICAgICAgICAgICAgICAgKyBgSXQgaGFzOiAkeyhhd2FpdCBsb2NhbERvbWFpbnMoKSkuam9pbihcIiwgXCIpIHx8IFwibm8gaWRlbnRpdGllcyBhdCBhbGxcIn1cXG5gXG4gICAgICAgICAgICAgICAgKyBgT25lIGlzIGdlbmVyYXRlZCB0aGUgZmlyc3QgdGltZSBzb21ldGhpbmcgcnVucyBoZXJlIHVuZGVyIGEgZG9tYWluLCBzbyBydW4gdGhhdGBcbiAgICAgICAgICAgICAgICArIGAgZmlyc3QsIG9yIG5hbWUgYW5vdGhlciBtYWNoaW5lIHRvIGFkZCBpbnN0ZWFkLmBcbiAgICAgICAgICAgICk7XG4gICAgICAgIH1cbiAgICAgICAgaWRlbnRpdHkgPSBmb3VuZDtcbiAgICAgICAgYWRkcmVzc2VzID0gYXdhaXQgZ2V0T3duSVBzKCk7XG4gICAgICAgIGlmICghYWRkcmVzc2VzLmxlbmd0aCkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0aGlzIG1hY2hpbmUgdG8gaGF2ZSBhbiBhZGRyZXNzIGFueXRoaW5nIGVsc2UgY2FuIHNlZSwgaXQgaGFzIG5vbmVgKTtcbiAgICAgICAgfVxuICAgIH0gZWxzZSB7XG4gICAgICAgIC8vIE5vdGhpbmcgdGhlcmUgdW5kZXIgdGhpcyBkb21haW4gbWVhbnMgaXQgZ2V0cyBvbmUuIEl0cyBvd24gZnJvbSB0aGlzIHBvaW50IG9uOiB0aGUga2V5XG4gICAgICAgIC8vIGlzIHdyaXR0ZW4gdGhlcmUgYW5kIG5vdGhpbmcga2VlcHMgYSBjb3B5LlxuICAgICAgICBsZXQgZm91bmQgPSBhd2FpdCByZW1vdGVJZGVudGl0eShob3N0LCBkb21haW4pO1xuICAgICAgICBpZiAoIWZvdW5kKSB7XG4gICAgICAgICAgICBjb25zb2xlLmxvZyhgJHtkZXNjcmliZUhvc3QoaG9zdCl9IGhhcyBubyBpZGVudGl0eSBmb3IgJHtkb21haW59LCBnZW5lcmF0aW5nIG9uZWApO1xuICAgICAgICB9XG4gICAgICAgIGlkZW50aXR5ID0gZm91bmQgfHwgYXdhaXQgY3JlYXRlUmVtb3RlSWRlbnRpdHkoeyBob3N0LCBkb21haW4gfSk7XG4gICAgICAgIC8vIFRoZSBhZGRyZXNzIGl0IHdhcyBuYW1lZCBieSBpcyB0aGUgYWRkcmVzcyBpdCB0YWxrcyB0byB1cyBmcm9tLCB3aGljaCBpcyB0aGUgb25lIHRoaW5nXG4gICAgICAgIC8vIGl0IGNhbm5vdCBsaWUgYWJvdXQuXG4gICAgICAgIGFkZHJlc3NlcyA9IFtob3N0XTtcbiAgICB9XG5cbiAgICAvLyBUaGUgd2hvbGUgbGlzdCBpcyByZWFkIGFuZCB3cml0dGVuIGJhY2ssIGJlY2F1c2Ugc2V0dGluZyBpcyBieSB0aGUgc2V0OiB3cml0aW5nIHRoaXMgb25lXG4gICAgLy8gbWFjaGluZSBhbG9uZSB3b3VsZCByZW1vdmUgZXZlcnkgb3RoZXIgbWFjaGluZSBmcm9tIHRoZSByZXBvLlxuICAgIGxldCBtYWNoaW5lcyA9IGF3YWl0IG1hY2hpbmVTdGF0ZSh7IHJlcG9QYXRoIH0pO1xuICAgIGxldCBleGlzdGluZyA9IG1hY2hpbmVzLmZpbmQobWFjaGluZSA9PiBtYWNoaW5lLm1hY2hpbmVJZCA9PT0gaWRlbnRpdHkubWFjaGluZUlkKTtcbiAgICBsZXQgaXBzID0gWy4uLihleGlzdGluZz8uaXBzIHx8IFtdKV07XG4gICAgbGV0IGFkZGVkID0gYWRkcmVzc2VzLmZpbHRlcihhZGRyZXNzID0+ICFpcHMuaW5jbHVkZXMoYWRkcmVzcykpO1xuICAgIGlmIChleGlzdGluZykge1xuICAgICAgICBleGlzdGluZy5pcHMgPSBbLi4uaXBzLCAuLi5hZGRlZF07XG4gICAgfSBlbHNlIHtcbiAgICAgICAgbWFjaGluZXMucHVzaCh7IG1hY2hpbmVJZDogaWRlbnRpdHkubWFjaGluZUlkLCBpcHM6IFsuLi5hZGRlZF0sIGFkZGVkQXQ6IFwiXCIgfSk7XG4gICAgfVxuICAgIGF3YWl0IG1hY2hpbmVTdGF0ZSh7IHJlcG9QYXRoLCBtYWNoaW5lcyB9KTtcblxuICAgIGNvbnNvbGUubG9nKGBcXG5UcnVzdGluZyBtYWNoaW5lICR7aWRlbnRpdHkubWFjaGluZUlkfWApO1xuICAgIGNvbnNvbGUubG9nKGBBbGxvd2luZyBJUCAke1suLi5pcHMsIC4uLmFkZGVkXS5qb2luKFwiLCBcIil9YCk7XG4gICAgaWYgKGFkZGVkLmxlbmd0aCkge1xuICAgICAgICBjb25zb2xlLmxvZyhgICBhZGRlZCB0byBtYWNoaW5lcy8ke2lkZW50aXR5Lm1hY2hpbmVJZH0uanNvbjogJHthZGRlZC5qb2luKFwiLCBcIil9YCk7XG4gICAgfSBlbHNlIHtcbiAgICAgICAgY29uc29sZS5sb2coYCAgYWxyZWFkeSBhbGxvd2VkIGZyb20gJHthZGRyZXNzZXMuam9pbihcIiwgXCIpfWApO1xuICAgIH1cbiAgICBjb25zb2xlLmxvZyhgICBpZGVudGl0eSAke2lkZW50aXR5LmZ1bGxEb21haW59YCk7XG4gICAgY29uc29sZS5sb2coYCAgaW4gJHtyZXBvUGF0aH1gKTtcbiAgICBjb25zb2xlLmxvZyhgXFxuTm90aGluZyBiZWxpZXZlcyB0aGlzIHVudGlsIGl0IGlzIHNpZ25lZC4gSW4gdGhhdCByZXBvLCBydW46YCk7XG4gICAgY29uc29sZS5sb2coYFxcYFxcYFxcYFxcbnlhcm4gc2lnbmZpbGVzIGdpdFxcblxcYFxcYFxcYGApO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "8b6a7e13912660fd6733b2585e4fec0865a5548fe5846ee6e23f46c506f83e34"; */