sliftutils 1.7.128 → 1.7.129

package/security/authorizedKeys/dist/unrevoke.ts.cache

@@ -3,13 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.main = exports.revokedKeysInRepo = exports.readRemoteRevocations = void 0;
+//exports.main = exports.revokedKeysInRepo = exports.readRemoteRevocations = exports.revocationIP = void 0;
 const promises_1 = __importDefault(require("fs/promises"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const runPromise_1 = require("socket-function/src/runPromise");
 const authorizedKeys_1 = require("./authorizedKeys");
 const revokeSource_1 = require("./revokeSource");
+const sources_1 = require("./sources");
 const signFiles_1 = require("../signedFiles/signFiles");
 const authorizedKeys_2 = require("./authorizedKeys");
 const paths_1 = require("../helpers/paths");
@@ -26,17 +27,31 @@ passes. It signs the result, and with ${GIT_KEYWORD} it commits and pushes it to
 
 Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
 for a key you still want.`;
-/** Every revocation the revoke repo lists. Cloned read only into a temp directory, with whatever
-    credentials this machine already has - the derived deploy key is for servers, and a person
-    running this has their own access to the repo. */
+/** Older revocation files carry the address under attempt only. */
+function revocationIP(revocation) {
+    var _a;
+    return revocation.ip || ((_a = revocation.attempt) === null || _a === void 0 ? void 0 : _a.ip) || "";
+}
+exports.revocationIP = revocationIP;
+/** Every revocation the revoke repo lists. Cloned read only into a temp directory.
+
+    A person running this has their own access to the repo, so their credentials are what is used.
+    On a machine that is already a portsecure host there may be no such credentials, but the source
+    deploy key is right there, and the key derived from it is one that repo definitely accepts. */
 async function readRemoteRevocations(config) {
     let { sourceURL } = config;
     let temporaryDirectory = await promises_1.default.mkdtemp(path_1.default.join(os_1.default.tmpdir(), "unrevoke-"));
     let repoPath = path_1.default.join(temporaryDirectory, "repo");
-    let clone = await (0, spawn_1.spawnPromise)({
-        command: "git",
-        args: ["clone", "--depth", "1", (0, revokeSource_1.revokeRepoURL)(sourceURL), repoPath],
-    });
+    let cloneArgs = ["clone", "--depth", "1", (0, revokeSource_1.revokeRepoURL)(sourceURL), repoPath];
+    let sourceKey = await (0, sources_1.findSourceKey)(sourceURL);
+    if (sourceKey) {
+        let derived = (0, revokeSource_1.deriveRevokeKey)(await promises_1.default.readFile(sourceKey, "utf8"));
+        let derivedKeyPath = path_1.default.join(temporaryDirectory, "key");
+        await promises_1.default.writeFile(derivedKeyPath, derived.privateKeyFile, { mode: 0o600 });
+        let sshCommand = `ssh -i ${derivedKeyPath} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new`;
+        cloneArgs = ["-c", `core.sshCommand=${sshCommand}`, ...cloneArgs];
+    }
+    let clone = await (0, spawn_1.spawnPromise)({ command: "git", args: cloneArgs });
     if (clone.status !== 0) {
         await promises_1.default.rm(temporaryDirectory, { recursive: true, force: true });
         throw new Error(`Expected to be able to read ${(0, revokeSource_1.revokeRepoURL)(sourceURL)}.\n`
@@ -71,6 +86,10 @@ async function revokedKeysInRepo(config) {
                 continue;
             }
             let parsed = JSON.parse(await promises_1.default.readFile(path_1.default.join(directory, name), "utf8"));
+            for (let allowed of parsed.allowed || []) {
+                unrevoked.add(`${allowed.fingerprint} ${allowed.ip}`);
+            }
+            // Named ids, for the unrevokes written before this was about pairs.
             for (let revocationId of parsed.revocationIds || []) {
                 unrevoked.add(revocationId);
             }
@@ -79,13 +98,47 @@ async function revokedKeysInRepo(config) {
     catch (e) {
         // Nothing has been unrevoked.
     }
-    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId)
+        && !unrevoked.has(`${revocation.fingerprint} ${revocationIP(revocation)}`));
     let keys = (0, authorizedKeys_1.normalizeKeys)(await promises_1.default.readFile(path_1.default.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
     return stillRevoked
         .filter(revocation => keys.some(key => (0, authorizedKeys_1.keyFingerprint)(key) === revocation.fingerprint))
         .map(revocation => ({ revocation, key: keys.find(key => (0, authorizedKeys_1.keyFingerprint)(key) === revocation.fingerprint) || "" }));
 }
 exports.revokedKeysInRepo = revokedKeysInRepo;
+/** Writes the addresses into the from= list of each key in the repo's authorized_keys, and says
+    which ones were actually new. Only the lines being changed are touched, so comments, ordering
+    and any key not involved come out of this byte for byte the same. */
+async function allowAddressesInRepo(config) {
+    let { repoPath, addressesByFingerprint } = config;
+    let added = new Map();
+    let filePath = path_1.default.join(repoPath, "authorized_keys");
+    let contents;
+    try {
+        contents = await promises_1.default.readFile(filePath, "utf8");
+    }
+    catch (e) {
+        // A repo holding its keys as separate .pub files. Nothing to edit in one place, so the
+        // caller's listing is all whoever ran this gets.
+        console.log(`No authorized_keys in ${repoPath}, so the addresses were not added to any key.`);
+        return added;
+    }
+    let lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index++) {
+        let fingerprint = (0, authorizedKeys_1.keyFingerprint)(lines[index]);
+        let addresses = fingerprint && addressesByFingerprint.get(fingerprint);
+        if (!addresses || !addresses.length) {
+            continue;
+        }
+        let result = (0, authorizedKeys_1.allowAddresses)(lines[index], addresses);
+        lines[index] = result.keyLine;
+        added.set(fingerprint, [...(added.get(fingerprint) || []), ...result.added]);
+    }
+    if ([...added.values()].some(list => list.length)) {
+        await promises_1.default.writeFile(filePath, lines.join("\n"));
+    }
+    return added;
+}
 /** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
     repo that actually holds keys and has an origin to clone from. */
 async function resolveKeysRepo(named) {
@@ -112,7 +165,6 @@ async function resolveKeysRepo(named) {
     return { repoPath, originURL };
 }
 async function main() {
-    var _a;
     let argv = process.argv.slice(2);
     let pushToGit = argv.includes(GIT_KEYWORD);
     let positional = argv.filter(arg => arg !== GIT_KEYWORD);
@@ -132,21 +184,65 @@ async function main() {
     await promises_1.default.writeFile(path_1.default.join(directory, `${unrevokeId}.json`), JSON.stringify({
         unrevokeId,
         createdAt: new Date().toISOString(),
-        // Named one by one rather than as a blanket "allow everything again", so this file only
-        // ever undoes the revocations that existed when it was written.
-        revocationIds: revocations.map(revocation => revocation.revocationId),
+        // What this file says: each of these keys is allowed from this address. Pairs, not keys,
+        // and not a blanket "allow everything again" - a key forgiven here for one address is
+        // still revoked the moment it is used from another.
+        allowed: revocations.map(revocation => ({
+            fingerprint: revocation.fingerprint,
+            ip: revocationIP(revocation),
+        })),
         revocations: revocations.map(revocation => ({
             revocationId: revocation.revocationId,
             fingerprint: revocation.fingerprint,
+            ip: revocationIP(revocation),
             revokedAt: revocation.revokedAt,
             revokedBy: revocation.revokedBy,
             attempt: revocation.attempt,
         })),
     }, undefined, 4) + "\n");
-    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    // Named the way the notifications name them. A fingerprint is not in authorized_keys and
+    // cannot be worked out by eye, so on its own it tells whoever is reading this nothing about
+    // which of their keys is being talked about.
+    let keysByFingerprint = new Map();
+    for (let key of await (0, authorizedKeys_2.readRepoKeys)(repoPath).catch(() => [])) {
+        keysByFingerprint.set((0, authorizedKeys_1.keyFingerprint)(key), key);
+    }
+    let describeKey = (revocation) => {
+        let key = keysByFingerprint.get(revocation.fingerprint) || revocation.key || "";
+        return key && (0, authorizedKeys_1.summarizeKey)(key) || `a key no longer in this repo (${revocation.fingerprint})`;
+    };
+    let addressesByFingerprint = new Map();
     for (let revocation of revocations) {
-        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${((_a = revocation.attempt) === null || _a === void 0 ? void 0 : _a.ip) || "?"}`);
+        let ip = revocationIP(revocation);
+        let existing = addressesByFingerprint.get(revocation.fingerprint) || [];
+        if (ip && !existing.includes(ip)) {
+            existing.push(ip);
+        }
+        addressesByFingerprint.set(revocation.fingerprint, existing);
+    }
+    // Cancelling the revocation on its own would leave sshd refusing that address and the machines
+    // revoking the key all over again, so the addresses go into the key's from= here. We are in
+    // the repo that owns authorized_keys, so there is nothing to hand back to whoever ran this.
+    let added = await allowAddressesInRepo({ repoPath, addressesByFingerprint });
+    console.log("");
+    for (let [fingerprint, addresses] of addressesByFingerprint) {
+        let revocation = revocations.find(entry => entry.fingerprint === fingerprint);
+        console.log(`Unfreezing ${describeKey(revocation)}`);
+        console.log(`Allowing IP ${addresses.join(", ") || "(no address recorded)"}`);
+        let addedHere = added.get(fingerprint) || [];
+        if (addedHere.length) {
+            console.log(`  added to that key's from= list in authorized_keys: ${addedHere.join(", ")}`);
+        }
+        else {
+            console.log(`  that key's from= list already allowed ${addresses.join(", ") ? "them" : "everything"}`);
+        }
+        for (let entry of revocations.filter(entry => entry.fingerprint === fingerprint)) {
+            console.log(`  frozen by ${entry.revokedBy || "?"} ${entry.revokedAt || "at an unrecorded time"}`);
+        }
+        console.log("");
     }
+    console.log(`Every other address stays frozen, and one of these keys used from anywhere else`);
+    console.log(`is frozen again.`);
     // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
     // all, and the repo would sit there looking done while every machine ignored it.
     await (0, signFiles_1.signRepo)({ repoPath });
@@ -163,5 +259,5 @@ async function main() {
     console.log(`keys work again.`);
 }
 exports.main = main;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5yZXZva2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ1bnJldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBNkI7QUFDN0IsNENBQW9CO0FBQ3BCLGdEQUF3QjtBQUN4QiwrREFBNEQ7QUFDNUQscURBQWlFO0FBQ2pFLGlEQUErQztBQUMvQyx3REFBb0Q7QUFDcEQscURBQWdEO0FBQ2hELDRDQUE4QztBQUM5Qyw0Q0FBZ0Q7QUFFaEQsTUFBTSxhQUFhLEdBQUcsV0FBVyxDQUFDO0FBQ2xDLE1BQU0sZUFBZSxHQUFHLGFBQWEsQ0FBQztBQUN0QyxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUM7QUFDMUIsTUFBTSxjQUFjLEdBQUcsZUFBZSxDQUFDO0FBQ3ZDLE1BQU0sS0FBSyxHQUFHLHFDQUFxQyxXQUFXOzs7O3dDQUl0QixXQUFXOzs7MEJBR3pCLENBQUM7QUFXM0I7O3FEQUVxRDtBQUM5QyxLQUFLLFVBQVUscUJBQXFCLENBQUMsTUFBNkI7SUFDckUsSUFBSSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUMzQixJQUFJLGtCQUFrQixHQUFHLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsTUFBTSxFQUFFLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMvRSxJQUFJLFFBQVEsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3JELElBQUksS0FBSyxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDO1FBQzNCLE9BQU8sRUFBRSxLQUFLO1FBQ2QsSUFBSSxFQUFFLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsSUFBQSw0QkFBYSxFQUFDLFNBQVMsQ0FBQyxFQUFFLFFBQVEsQ0FBQztLQUN0RSxDQUFDLENBQUM7SUFDSCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDckIsTUFBTSxrQkFBRSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDbEUsTUFBTSxJQUFJLEtBQUssQ0FDWCwrQkFBK0IsSUFBQSw0QkFBYSxFQUFDLFNBQVMsQ0FBQyxLQUFLO2NBQzFELEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUM5QyxDQUFDO0lBQ04sQ0FBQztJQUNELElBQUksV0FBVyxHQUFpQixFQUFFLENBQUM7SUFDbkMsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDckQsSUFBSSxDQUFDO1FBQ0QsS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ3BELElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUN6QixXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDeEYsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULDRFQUE0RTtJQUNoRixDQUFDO0lBQ0QsTUFBTSxrQkFBRSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDbEUsT0FBTyxXQUFXLENBQUM7QUFDdkIsQ0FBQztBQTVCRCxzREE0QkM7QUFFRCxrRkFBa0Y7QUFDM0UsS0FBSyxVQUFVLGlCQUFpQixDQUFDLE1BQStDO0lBQ25GLElBQUksRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ3JDLElBQUksV0FBVyxHQUFHLE1BQU0scUJBQXFCLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzdELElBQUksbUJBQW1CLEdBQUcsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLElBQUksU0FBUyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDbEMsSUFBSSxDQUFDO1FBQ0QsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFDbkQsS0FBSyxJQUFJLElBQUksSUFBSSxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDM0MsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUIsU0FBUztZQUNiLENBQUM7WUFDRCxJQUFJLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztZQUMvRSxLQUFLLElBQUksWUFBWSxJQUFJLE1BQU0sQ0FBQyxhQUFhLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQ2xELFNBQVMsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDaEMsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULDhCQUE4QjtJQUNsQyxDQUFDO0lBQ0QsSUFBSSxZQUFZLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RixJQUFJLElBQUksR0FBRyxJQUFBLDhCQUFhLEVBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzVHLE9BQU8sWUFBWTtTQUNkLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFBLCtCQUFjLEVBQUMsR0FBRyxDQUFDLEtBQUssVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1NBQ3RGLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFBLCtCQUFjLEVBQUMsR0FBRyxDQUFDLEtBQUssVUFBVSxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztBQUMxSCxDQUFDO0FBeEJELDhDQXdCQztBQUVEO3FFQUNxRTtBQUNyRSxLQUFLLFVBQVUsZUFBZSxDQUFDLEtBQXlCO0lBQ3BELElBQUksR0FBRyxHQUFHLEtBQUssSUFBSSxJQUFBLGtCQUFVLEVBQUMsS0FBSyxDQUFDLElBQUksU0FBUyxDQUFDO0lBQ2xELDhGQUE4RjtJQUM5RiwrRkFBK0Y7SUFDL0YsSUFBSSxRQUFRLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxpQkFBaUIsQ0FBQyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDbkcsSUFBSSxRQUFRLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0QyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FDWCxZQUFZLEtBQUssSUFBSSx1QkFBdUIsd0NBQXdDO2NBQ2xGLEdBQUcsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLEVBQUUsQ0FDOUQsQ0FBQztJQUNOLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDRCxNQUFNLElBQUEsNkJBQVksRUFBQyxRQUFRLENBQUMsQ0FBQztJQUNqQyxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxRQUFRLDBDQUEwQyxDQUFDLEtBQUssS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDMUcsSUFBSSxTQUFTLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNyQyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxZQUFZLFFBQVEsNENBQTRDLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELE9BQU8sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLENBQUM7QUFDbkMsQ0FBQztBQUVNLEtBQUssVUFBVSxJQUFJOztJQUN0QixJQUFJLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqQyxJQUFJLFNBQVMsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzNDLElBQUksVUFBVSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDekQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLFVBQVUsQ0FBQyxNQUFNLGlCQUFpQixLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3BHLENBQUM7SUFDRCxJQUFJLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBRW5FLElBQUksV0FBVyxHQUFHLE1BQU0scUJBQXFCLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN4RSxJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3RCLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFBLDRCQUFhLEVBQUMsU0FBUyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7UUFDOUYsT0FBTztJQUNYLENBQUM7SUFFRCxJQUFJLFNBQVMsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxhQUFhLENBQUMsQ0FBQztJQUNuRCxNQUFNLGtCQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQy9DLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQztJQUMzRCxJQUFJLFVBQVUsR0FBRyxHQUFHLEtBQUssV0FBVyxDQUFDO0lBQ3JDLE1BQU0sa0JBQUUsQ0FBQyxTQUFTLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsR0FBRyxVQUFVLE9BQU8sQ0FBQyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDMUUsVUFBVTtRQUNWLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtRQUNuQyx3RkFBd0Y7UUFDeEYsZ0VBQWdFO1FBQ2hFLGFBQWEsRUFBRSxXQUFXLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztRQUNyRSxXQUFXLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDeEMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZO1lBQ3JDLFdBQVcsRUFBRSxVQUFVLENBQUMsV0FBVztZQUNuQyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7WUFDL0IsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTO1lBQy9CLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztTQUM5QixDQUFDLENBQUM7S0FDTixFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUV6QixPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsYUFBYSxJQUFJLFVBQVUsa0JBQWtCLFdBQVcsQ0FBQyxNQUFNLGlCQUFpQixDQUFDLENBQUM7SUFDdkcsS0FBSyxJQUFJLFVBQVUsSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUNqQyxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssVUFBVSxDQUFDLFdBQVcsZUFBZSxVQUFVLENBQUMsU0FBUyxJQUFJLEdBQUcsU0FBUyxDQUFBLE1BQUEsVUFBVSxDQUFDLE9BQU8sMENBQUUsRUFBRSxLQUFJLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDL0gsQ0FBQztJQUVELGdHQUFnRztJQUNoRyxpRkFBaUY7SUFDakYsTUFBTSxJQUFBLG9CQUFRLEVBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBRTdCLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNiLE9BQU8sQ0FBQyxHQUFHLENBQUMsaUZBQWlGLENBQUMsQ0FBQztRQUMvRixPQUFPLENBQUMsR0FBRyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDdEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQ0FBc0MsY0FBYyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ3ZGLE9BQU87SUFDWCxDQUFDO0lBQ0QsTUFBTSxJQUFBLHVCQUFVLEVBQUMsWUFBWSxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDbEQsTUFBTSxJQUFBLHVCQUFVLEVBQUMsa0JBQWtCLGNBQWMsR0FBRyxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDekUsTUFBTSxJQUFBLHVCQUFVLEVBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDaEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpRkFBaUYsQ0FBQyxDQUFDO0lBQy9GLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUNwQyxDQUFDO0FBdERELG9CQXNEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5pbXBvcnQgeyBydW5Qcm9taXNlIH0gZnJvbSBcInNvY2tldC1mdW5jdGlvbi9zcmMvcnVuUHJvbWlzZVwiO1xuaW1wb3J0IHsga2V5RmluZ2VycHJpbnQsIG5vcm1hbGl6ZUtleXMgfSBmcm9tIFwiLi9hdXRob3JpemVkS2V5c1wiO1xuaW1wb3J0IHsgcmV2b2tlUmVwb1VSTCB9IGZyb20gXCIuL3Jldm9rZVNvdXJjZVwiO1xuaW1wb3J0IHsgc2lnblJlcG8gfSBmcm9tIFwiLi4vc2lnbmVkRmlsZXMvc2lnbkZpbGVzXCI7XG5pbXBvcnQgeyByZWFkUmVwb0tleXMgfSBmcm9tIFwiLi9hdXRob3JpemVkS2V5c1wiO1xuaW1wb3J0IHsgZXhwYW5kSG9tZSB9IGZyb20gXCIuLi9oZWxwZXJzL3BhdGhzXCI7XG5pbXBvcnQgeyBzcGF3blByb21pc2UgfSBmcm9tIFwiLi4vaGVscGVycy9zcGF3blwiO1xuXG5jb25zdCBVTlJFVk9LRVNfRElSID0gXCJ1bnJldm9rZWRcIjtcbmNvbnN0IFJFVk9DQVRJT05TX0RJUiA9IFwicmV2b2NhdGlvbnNcIjtcbmNvbnN0IEdJVF9LRVlXT1JEID0gXCJnaXRcIjtcbmNvbnN0IENPTU1JVF9NRVNTQUdFID0gXCJ1bnJldm9rZSBrZXlzXCI7XG5jb25zdCBVU0FHRSA9IGBVc2FnZTogeWFybiB1bnJldm9rZSBba2V5cy1yZXBvXSBbJHtHSVRfS0VZV09SRH1dXG5cblJ1biB0aGlzIGluIGEga2V5cyByZXBvLCBvciBuYW1lIG9uZS4gSXQgcmVhZHMgdGhhdCByZXBvJ3MgcmV2b2tlIHJlcG8gYW5kIHdyaXRlcyBvbmUgdW5yZXZva2UgZmlsZVxubmFtaW5nIGV2ZXJ5IHJldm9jYXRpb24gaW4gaXQsIHNvIHRoZSBrZXlzIGFyZSBhY2NlcHRlZCBhZ2FpbiBvbmNlIGVhY2ggbWFjaGluZSdzIGhvdXIgbG9uZyB3YWl0XG5wYXNzZXMuIEl0IHNpZ25zIHRoZSByZXN1bHQsIGFuZCB3aXRoICR7R0lUX0tFWVdPUkR9IGl0IGNvbW1pdHMgYW5kIHB1c2hlcyBpdCB0b28uXG5cbktleXMgdGhhdCB3ZXJlIHJldm9rZWQgc2hvdWxkIG5vcm1hbGx5IGJlIGRlbGV0ZWQgZnJvbSB0aGUgcmVwbyBpbnN0ZWFkLiBVbnJldm9raW5nIG9ubHkgbWF0dGVyc1xuZm9yIGEga2V5IHlvdSBzdGlsbCB3YW50LmA7XG5cbmV4cG9ydCB0eXBlIFJldm9jYXRpb24gPSB7XG4gICAgcmV2b2NhdGlvbklkOiBzdHJpbmc7XG4gICAgZmluZ2VycHJpbnQ6IHN0cmluZztcbiAgICBrZXk/OiBzdHJpbmc7XG4gICAgcmV2b2tlZEF0Pzogc3RyaW5nO1xuICAgIHJldm9rZWRCeT86IHN0cmluZztcbiAgICBhdHRlbXB0PzogeyBpcD86IHN0cmluZzsgdXNlcj86IHN0cmluZzsgcmVxdWlyZWQ/OiBzdHJpbmcgfTtcbn07XG5cbi8qKiBFdmVyeSByZXZvY2F0aW9uIHRoZSByZXZva2UgcmVwbyBsaXN0cy4gQ2xvbmVkIHJlYWQgb25seSBpbnRvIGEgdGVtcCBkaXJlY3RvcnksIHdpdGggd2hhdGV2ZXJcbiAgICBjcmVkZW50aWFscyB0aGlzIG1hY2hpbmUgYWxyZWFkeSBoYXMgLSB0aGUgZGVyaXZlZCBkZXBsb3kga2V5IGlzIGZvciBzZXJ2ZXJzLCBhbmQgYSBwZXJzb25cbiAgICBydW5uaW5nIHRoaXMgaGFzIHRoZWlyIG93biBhY2Nlc3MgdG8gdGhlIHJlcG8uICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVhZFJlbW90ZVJldm9jYXRpb25zKGNvbmZpZzogeyBzb3VyY2VVUkw6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgc291cmNlVVJMIH0gPSBjb25maWc7XG4gICAgbGV0IHRlbXBvcmFyeURpcmVjdG9yeSA9IGF3YWl0IGZzLm1rZHRlbXAocGF0aC5qb2luKG9zLnRtcGRpcigpLCBcInVucmV2b2tlLVwiKSk7XG4gICAgbGV0IHJlcG9QYXRoID0gcGF0aC5qb2luKHRlbXBvcmFyeURpcmVjdG9yeSwgXCJyZXBvXCIpO1xuICAgIGxldCBjbG9uZSA9IGF3YWl0IHNwYXduUHJvbWlzZSh7XG4gICAgICAgIGNvbW1hbmQ6IFwiZ2l0XCIsXG4gICAgICAgIGFyZ3M6IFtcImNsb25lXCIsIFwiLS1kZXB0aFwiLCBcIjFcIiwgcmV2b2tlUmVwb1VSTChzb3VyY2VVUkwpLCByZXBvUGF0aF0sXG4gICAgfSk7XG4gICAgaWYgKGNsb25lLnN0YXR1cyAhPT0gMCkge1xuICAgICAgICBhd2FpdCBmcy5ybSh0ZW1wb3JhcnlEaXJlY3RvcnksIHsgcmVjdXJzaXZlOiB0cnVlLCBmb3JjZTogdHJ1ZSB9KTtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgYEV4cGVjdGVkIHRvIGJlIGFibGUgdG8gcmVhZCAke3Jldm9rZVJlcG9VUkwoc291cmNlVVJMKX0uXFxuYFxuICAgICAgICAgICAgKyBgJHsoY2xvbmUuc3Rkb3V0ICsgY2xvbmUuc3RkZXJyKS50cmltKCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICBsZXQgcmV2b2NhdGlvbnM6IFJldm9jYXRpb25bXSA9IFtdO1xuICAgIGxldCBkaXJlY3RvcnkgPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFJFVk9DQVRJT05TX0RJUik7XG4gICAgdHJ5IHtcbiAgICAgICAgZm9yIChsZXQgbmFtZSBvZiAoYXdhaXQgZnMucmVhZGRpcihkaXJlY3RvcnkpKS5zb3J0KCkpIHtcbiAgICAgICAgICAgIGlmIChuYW1lLmVuZHNXaXRoKFwiLmpzb25cIikpIHtcbiAgICAgICAgICAgICAgICByZXZvY2F0aW9ucy5wdXNoKEpTT04ucGFyc2UoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKGRpcmVjdG9yeSwgbmFtZSksIFwidXRmOFwiKSkpO1xuICAgICAgICAgICAgfVxuICAgICAgICB9XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICAvLyBObyByZXZvY2F0aW9ucyBkaXJlY3RvcnkgYXQgYWxsIGp1c3QgbWVhbnMgbm90aGluZyBoYXMgZXZlciBiZWVuIHJldm9rZWQuXG4gICAgfVxuICAgIGF3YWl0IGZzLnJtKHRlbXBvcmFyeURpcmVjdG9yeSwgeyByZWN1cnNpdmU6IHRydWUsIGZvcmNlOiB0cnVlIH0pO1xuICAgIHJldHVybiByZXZvY2F0aW9ucztcbn1cblxuLyoqIFdoaWNoIGtleXMgaW4gYSByZXBvIGFyZSByZXZva2VkLiBXaGF0IHNpZ25maWxlcyBhbmQgc2VjdXJlc3NoIHJlZnVzZSBvdmVyLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJldm9rZWRLZXlzSW5SZXBvKGNvbmZpZzogeyByZXBvUGF0aDogc3RyaW5nOyBzb3VyY2VVUkw6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgcmVwb1BhdGgsIHNvdXJjZVVSTCB9ID0gY29uZmlnO1xuICAgIGxldCByZXZvY2F0aW9ucyA9IGF3YWl0IHJlYWRSZW1vdGVSZXZvY2F0aW9ucyh7IHNvdXJjZVVSTCB9KTtcbiAgICBsZXQgcmV2b2tlZEZpbmdlcnByaW50cyA9IG5ldyBTZXQocmV2b2NhdGlvbnMubWFwKHJldm9jYXRpb24gPT4gcmV2b2NhdGlvbi5maW5nZXJwcmludCkpO1xuICAgIGxldCB1bnJldm9rZWQgPSBuZXcgU2V0PHN0cmluZz4oKTtcbiAgICB0cnkge1xuICAgICAgICBsZXQgZGlyZWN0b3J5ID0gcGF0aC5qb2luKHJlcG9QYXRoLCBVTlJFVk9LRVNfRElSKTtcbiAgICAgICAgZm9yIChsZXQgbmFtZSBvZiBhd2FpdCBmcy5yZWFkZGlyKGRpcmVjdG9yeSkpIHtcbiAgICAgICAgICAgIGlmICghbmFtZS5lbmRzV2l0aChcIi5qc29uXCIpKSB7XG4gICAgICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgICAgICB9XG4gICAgICAgICAgICBsZXQgcGFyc2VkID0gSlNPTi5wYXJzZShhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4oZGlyZWN0b3J5LCBuYW1lKSwgXCJ1dGY4XCIpKTtcbiAgICAgICAgICAgIGZvciAobGV0IHJldm9jYXRpb25JZCBvZiBwYXJzZWQucmV2b2NhdGlvbklkcyB8fCBbXSkge1xuICAgICAgICAgICAgICAgIHVucmV2b2tlZC5hZGQocmV2b2NhdGlvbklkKTtcbiAgICAgICAgICAgIH1cbiAgICAgICAgfVxuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgLy8gTm90aGluZyBoYXMgYmVlbiB1bnJldm9rZWQuXG4gICAgfVxuICAgIGxldCBzdGlsbFJldm9rZWQgPSByZXZvY2F0aW9ucy5maWx0ZXIocmV2b2NhdGlvbiA9PiAhdW5yZXZva2VkLmhhcyhyZXZvY2F0aW9uLnJldm9jYXRpb25JZCkpO1xuICAgIGxldCBrZXlzID0gbm9ybWFsaXplS2V5cyhhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4ocmVwb1BhdGgsIFwiYXV0aG9yaXplZF9rZXlzXCIpLCBcInV0ZjhcIikuY2F0Y2goKCkgPT4gXCJcIikpO1xuICAgIHJldHVybiBzdGlsbFJldm9rZWRcbiAgICAgICAgLmZpbHRlcihyZXZvY2F0aW9uID0+IGtleXMuc29tZShrZXkgPT4ga2V5RmluZ2VycHJpbnQoa2V5KSA9PT0gcmV2b2NhdGlvbi5maW5nZXJwcmludCkpXG4gICAgICAgIC5tYXAocmV2b2NhdGlvbiA9PiAoeyByZXZvY2F0aW9uLCBrZXk6IGtleXMuZmluZChrZXkgPT4ga2V5RmluZ2VycHJpbnQoa2V5KSA9PT0gcmV2b2NhdGlvbi5maW5nZXJwcmludCkgfHwgXCJcIiB9KSk7XG59XG5cbi8qKiBUaGUgcmVwbyBuYW1lZCwgb3IgdGhlIG9uZSB3ZSBhcmUgc3RhbmRpbmcgaW4uIENoZWNrZWQgdGhlIHNhbWUgd2F5IHNlY3VyZXNzaCBjaGVja3MgaXQ6IGEgZ2l0XG4gICAgcmVwbyB0aGF0IGFjdHVhbGx5IGhvbGRzIGtleXMgYW5kIGhhcyBhbiBvcmlnaW4gdG8gY2xvbmUgZnJvbS4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlc29sdmVLZXlzUmVwbyhuYW1lZDogc3RyaW5nIHwgdW5kZWZpbmVkKSB7XG4gICAgbGV0IGN3ZCA9IG5hbWVkICYmIGV4cGFuZEhvbWUobmFtZWQpIHx8IHVuZGVmaW5lZDtcbiAgICAvLyBzcGF3blByb21pc2UgcmF0aGVyIHRoYW4gcnVuUHJvbWlzZSwgYmVjYXVzZSB0aGVzZSB0d28gYXJlIHJlYWQgZm9yIHRoZWlyIHZhbHVlLiBydW5Qcm9taXNlXG4gICAgLy8gcmV0dXJucyBzdGRvdXQgYW5kIHN0ZGVyciBqb2luZWQsIHNvIG9uZSBnaXQgd2FybmluZyBlbmRzIHVwIGdsdWVkIHRvIHRoZSBmcm9udCBvZiB0aGUgcGF0aC5cbiAgICBsZXQgdG9wTGV2ZWwgPSBhd2FpdCBzcGF3blByb21pc2UoeyBjb21tYW5kOiBcImdpdFwiLCBhcmdzOiBbXCJyZXYtcGFyc2VcIiwgXCItLXNob3ctdG9wbGV2ZWxcIl0sIGN3ZCB9KTtcbiAgICBsZXQgcmVwb1BhdGggPSB0b3BMZXZlbC5zdGRvdXQudHJpbSgpO1xuICAgIGlmICh0b3BMZXZlbC5zdGF0dXMgIT09IDAgfHwgIXJlcG9QYXRoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGBFeHBlY3RlZCAke25hbWVkIHx8IFwidGhlIGN1cnJlbnQgZGlyZWN0b3J5XCJ9IHRvIGJlIGluc2lkZSBhIGdpdCByZXBvLCBpdCBpcyBub3QuXFxuYFxuICAgICAgICAgICAgKyBgJHsodG9wTGV2ZWwuc3Rkb3V0ICsgdG9wTGV2ZWwuc3RkZXJyKS50cmltKCl9XFxuJHtVU0FHRX1gXG4gICAgICAgICk7XG4gICAgfVxuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IHJlYWRSZXBvS2V5cyhyZXBvUGF0aCk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7cmVwb1BhdGh9IHRvIGJlIGEga2V5cyByZXBvLCBpdCBob2xkcyBubyBrZXlzLlxcbiR7ZX1cXG4ke1VTQUdFfWApO1xuICAgIH1cbiAgICBsZXQgb3JpZ2luID0gYXdhaXQgc3Bhd25Qcm9taXNlKHsgY29tbWFuZDogXCJnaXRcIiwgYXJnczogW1wicmVtb3RlXCIsIFwiZ2V0LXVybFwiLCBcIm9yaWdpblwiXSwgY3dkOiByZXBvUGF0aCB9KTtcbiAgICBsZXQgb3JpZ2luVVJMID0gb3JpZ2luLnN0ZG91dC50cmltKCk7XG4gICAgaWYgKG9yaWdpbi5zdGF0dXMgIT09IDAgfHwgIW9yaWdpblVSTCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7cmVwb1BhdGh9IHRvIGhhdmUgYW4gb3JpZ2luIHJlbW90ZSwgaXQgaGFzIG5vbmUuXFxuJHtVU0FHRX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIHsgcmVwb1BhdGgsIG9yaWdpblVSTCB9O1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbWFpbigpIHtcbiAgICBsZXQgYXJndiA9IHByb2Nlc3MuYXJndi5zbGljZSgyKTtcbiAgICBsZXQgcHVzaFRvR2l0ID0gYXJndi5pbmNsdWRlcyhHSVRfS0VZV09SRCk7XG4gICAgbGV0IHBvc2l0aW9uYWwgPSBhcmd2LmZpbHRlcihhcmcgPT4gYXJnICE9PSBHSVRfS0VZV09SRCk7XG4gICAgaWYgKHBvc2l0aW9uYWwubGVuZ3RoID4gMSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGF0IG1vc3QgYSBrZXlzIHJlcG8sIHdhcyAke3Bvc2l0aW9uYWwubGVuZ3RofSBhcmd1bWVudChzKVxcbiR7VVNBR0V9YCk7XG4gICAgfVxuICAgIGxldCB7IHJlcG9QYXRoLCBvcmlnaW5VUkwgfSA9IGF3YWl0IHJlc29sdmVLZXlzUmVwbyhwb3NpdGlvbmFsWzBdKTtcblxuICAgIGxldCByZXZvY2F0aW9ucyA9IGF3YWl0IHJlYWRSZW1vdGVSZXZvY2F0aW9ucyh7IHNvdXJjZVVSTDogb3JpZ2luVVJMIH0pO1xuICAgIGlmICghcmV2b2NhdGlvbnMubGVuZ3RoKSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGAke3Jldm9rZVJlcG9VUkwob3JpZ2luVVJMKX0gbGlzdHMgbm8gcmV2b2NhdGlvbnMsIHNvIHRoZXJlIGlzIG5vdGhpbmcgdG8gdW5kby5gKTtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cblxuICAgIGxldCBkaXJlY3RvcnkgPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFVOUkVWT0tFU19ESVIpO1xuICAgIGF3YWl0IGZzLm1rZGlyKGRpcmVjdG9yeSwgeyByZWN1cnNpdmU6IHRydWUgfSk7XG4gICAgbGV0IHN0YW1wID0gbmV3IERhdGUoKS50b0lTT1N0cmluZygpLnJlcGxhY2UoL1s6Ll0vZywgXCItXCIpO1xuICAgIGxldCB1bnJldm9rZUlkID0gYCR7c3RhbXB9LXVucmV2b2tlYDtcbiAgICBhd2FpdCBmcy53cml0ZUZpbGUocGF0aC5qb2luKGRpcmVjdG9yeSwgYCR7dW5yZXZva2VJZH0uanNvbmApLCBKU09OLnN0cmluZ2lmeSh7XG4gICAgICAgIHVucmV2b2tlSWQsXG4gICAgICAgIGNyZWF0ZWRBdDogbmV3IERhdGUoKS50b0lTT1N0cmluZygpLFxuICAgICAgICAvLyBOYW1lZCBvbmUgYnkgb25lIHJhdGhlciB0aGFuIGFzIGEgYmxhbmtldCBcImFsbG93IGV2ZXJ5dGhpbmcgYWdhaW5cIiwgc28gdGhpcyBmaWxlIG9ubHlcbiAgICAgICAgLy8gZXZlciB1bmRvZXMgdGhlIHJldm9jYXRpb25zIHRoYXQgZXhpc3RlZCB3aGVuIGl0IHdhcyB3cml0dGVuLlxuICAgICAgICByZXZvY2F0aW9uSWRzOiByZXZvY2F0aW9ucy5tYXAocmV2b2NhdGlvbiA9PiByZXZvY2F0aW9uLnJldm9jYXRpb25JZCksXG4gICAgICAgIHJldm9jYXRpb25zOiByZXZvY2F0aW9ucy5tYXAocmV2b2NhdGlvbiA9PiAoe1xuICAgICAgICAgICAgcmV2b2NhdGlvbklkOiByZXZvY2F0aW9uLnJldm9jYXRpb25JZCxcbiAgICAgICAgICAgIGZpbmdlcnByaW50OiByZXZvY2F0aW9uLmZpbmdlcnByaW50LFxuICAgICAgICAgICAgcmV2b2tlZEF0OiByZXZvY2F0aW9uLnJldm9rZWRBdCxcbiAgICAgICAgICAgIHJldm9rZWRCeTogcmV2b2NhdGlvbi5yZXZva2VkQnksXG4gICAgICAgICAgICBhdHRlbXB0OiByZXZvY2F0aW9uLmF0dGVtcHQsXG4gICAgICAgIH0pKSxcbiAgICB9LCB1bmRlZmluZWQsIDQpICsgXCJcXG5cIik7XG5cbiAgICBjb25zb2xlLmxvZyhgV3JvdGUgJHtVTlJFVk9LRVNfRElSfS8ke3VucmV2b2tlSWR9Lmpzb24gY292ZXJpbmcgJHtyZXZvY2F0aW9ucy5sZW5ndGh9IHJldm9jYXRpb24ocyk6YCk7XG4gICAgZm9yIChsZXQgcmV2b2NhdGlvbiBvZiByZXZvY2F0aW9ucykge1xuICAgICAgICBjb25zb2xlLmxvZyhgICAke3Jldm9jYXRpb24uZmluZ2VycHJpbnR9IHJldm9rZWQgYnkgJHtyZXZvY2F0aW9uLnJldm9rZWRCeSB8fCBcIj9cIn0gZnJvbSAke3Jldm9jYXRpb24uYXR0ZW1wdD8uaXAgfHwgXCI/XCJ9YCk7XG4gICAgfVxuXG4gICAgLy8gU2lnbmVkIGhlcmUgcmF0aGVyIHRoYW4gbGVmdCBhcyBhIHN0ZXAgdG8gcmVtZW1iZXIuIEFuIHVucmV2b2tlIG5vYm9keSBzaWduZWQgZG9lcyBub3RoaW5nIGF0XG4gICAgLy8gYWxsLCBhbmQgdGhlIHJlcG8gd291bGQgc2l0IHRoZXJlIGxvb2tpbmcgZG9uZSB3aGlsZSBldmVyeSBtYWNoaW5lIGlnbm9yZWQgaXQuXG4gICAgYXdhaXQgc2lnblJlcG8oeyByZXBvUGF0aCB9KTtcblxuICAgIGlmICghcHVzaFRvR2l0KSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGBcXG5Db21taXQgYW5kIHB1c2ggaXQsIGFuZCBlYWNoIG1hY2hpbmUgd2lsbCB3YWl0IGFuIGhvdXIgYWZ0ZXIgc2VlaW5nIGl0IGJlZm9yZWApO1xuICAgICAgICBjb25zb2xlLmxvZyhgdGhvc2Uga2V5cyB3b3JrIGFnYWluOmApO1xuICAgICAgICBjb25zb2xlLmxvZyhgXFxgXFxgXFxgXFxuZ2l0IGFkZCAtQVxcbmdpdCBjb21taXQgLW0gXCIke0NPTU1JVF9NRVNTQUdFfVwiXFxuZ2l0IHB1c2hcXG5cXGBcXGBcXGBgKTtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBhd2FpdCBydW5Qcm9taXNlKGBnaXQgYWRkIC1BYCwgeyBjd2Q6IHJlcG9QYXRoIH0pO1xuICAgIGF3YWl0IHJ1blByb21pc2UoYGdpdCBjb21taXQgLW0gXCIke0NPTU1JVF9NRVNTQUdFfVwiYCwgeyBjd2Q6IHJlcG9QYXRoIH0pO1xuICAgIGF3YWl0IHJ1blByb21pc2UoYGdpdCBwdXNoYCwgeyBjd2Q6IHJlcG9QYXRoIH0pO1xuICAgIGNvbnNvbGUubG9nKGBcXG5Db21taXR0ZWQgYW5kIHB1c2hlZC4gRWFjaCBtYWNoaW5lIHdhaXRzIGFuIGhvdXIgYWZ0ZXIgc2VlaW5nIGl0IGJlZm9yZSB0aG9zZWApO1xuICAgIGNvbnNvbGUubG9nKGBrZXlzIHdvcmsgYWdhaW4uYCk7XG59XG4iXX0=
- /* _JS_SOURCE_HASH = "0fcca51775122c0bd892f4c8b9872f06ef62cdb278ee8668702a7ce402c07867"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5yZXZva2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ1bnJldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBNkI7QUFDN0IsNENBQW9CO0FBQ3BCLGdEQUF3QjtBQUN4QiwrREFBNEQ7QUFDNUQscURBQStGO0FBQy9GLGlEQUFnRTtBQUNoRSx1Q0FBMEM7QUFDMUMsd0RBQW9EO0FBQ3BELHFEQUFnRDtBQUNoRCw0Q0FBOEM7QUFDOUMsNENBQWdEO0FBRWhELE1BQU0sYUFBYSxHQUFHLFdBQVcsQ0FBQztBQUNsQyxNQUFNLGVBQWUsR0FBRyxhQUFhLENBQUM7QUFDdEMsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDO0FBQzFCLE1BQU0sY0FBYyxHQUFHLGVBQWUsQ0FBQztBQUN2QyxNQUFNLEtBQUssR0FBRyxxQ0FBcUMsV0FBVzs7Ozt3Q0FJdEIsV0FBVzs7OzBCQUd6QixDQUFDO0FBZTNCLG1FQUFtRTtBQUNuRSxTQUFnQixZQUFZLENBQUMsVUFBc0I7O0lBQy9DLE9BQU8sVUFBVSxDQUFDLEVBQUUsS0FBSSxNQUFBLFVBQVUsQ0FBQyxPQUFPLDBDQUFFLEVBQUUsQ0FBQSxJQUFJLEVBQUUsQ0FBQztBQUN6RCxDQUFDO0FBRkQsb0NBRUM7QUFFRDs7OztrR0FJa0c7QUFDM0YsS0FBSyxVQUFVLHFCQUFxQixDQUFDLE1BQTZCO0lBQ3JFLElBQUksRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDM0IsSUFBSSxrQkFBa0IsR0FBRyxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsWUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDL0UsSUFBSSxRQUFRLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNyRCxJQUFJLFNBQVMsR0FBRyxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLElBQUEsNEJBQWEsRUFBQyxTQUFTLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUM5RSxJQUFJLFNBQVMsR0FBRyxNQUFNLElBQUEsdUJBQWEsRUFBQyxTQUFTLENBQUMsQ0FBQztJQUMvQyxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ1osSUFBSSxPQUFPLEdBQUcsSUFBQSw4QkFBZSxFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDcEUsSUFBSSxjQUFjLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMxRCxNQUFNLGtCQUFFLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYyxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDNUUsSUFBSSxVQUFVLEdBQUcsVUFBVSxjQUFjLDZFQUE2RSxDQUFDO1FBQ3ZILFNBQVMsR0FBRyxDQUFDLElBQUksRUFBRSxtQkFBbUIsVUFBVSxFQUFFLEVBQUUsR0FBRyxTQUFTLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsSUFBSSxLQUFLLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3BFLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQixNQUFNLGtCQUFFLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNsRSxNQUFNLElBQUksS0FBSyxDQUNYLCtCQUErQixJQUFBLDRCQUFhLEVBQUMsU0FBUyxDQUFDLEtBQUs7Y0FDMUQsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQzlDLENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSxXQUFXLEdBQWlCLEVBQUUsQ0FBQztJQUNuQyxJQUFJLFNBQVMsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxlQUFlLENBQUMsQ0FBQztJQUNyRCxJQUFJLENBQUM7UUFDRCxLQUFLLElBQUksSUFBSSxJQUFJLENBQUMsTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDcEQsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7Z0JBQ3pCLFdBQVcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0wsQ0FBQztJQUNMLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsNEVBQTRFO0lBQ2hGLENBQUM7SUFDRCxNQUFNLGtCQUFFLENBQUMsRUFBRSxDQUFDLGtCQUFrQixFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNsRSxPQUFPLFdBQVcsQ0FBQztBQUN2QixDQUFDO0FBbENELHNEQWtDQztBQUVELGtGQUFrRjtBQUMzRSxLQUFLLFVBQVUsaUJBQWlCLENBQUMsTUFBK0M7SUFDbkYsSUFBSSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDckMsSUFBSSxXQUFXLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDN0QsSUFBSSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDekYsSUFBSSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNsQyxJQUFJLENBQUM7UUFDRCxJQUFJLFNBQVMsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUNuRCxLQUFLLElBQUksSUFBSSxJQUFJLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUMxQixTQUFTO1lBQ2IsQ0FBQztZQUNELElBQUksTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBQy9FLEtBQUssSUFBSSxPQUFPLElBQUksTUFBTSxDQUFDLE9BQU8sSUFBSSxFQUFFLEVBQUUsQ0FBQztnQkFDdkMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxXQUFXLElBQUksT0FBTyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDMUQsQ0FBQztZQUNELG9FQUFvRTtZQUNwRSxLQUFLLElBQUksWUFBWSxJQUFJLE1BQU0sQ0FBQyxhQUFhLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQ2xELFNBQVMsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDaEMsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULDhCQUE4QjtJQUNsQyxDQUFDO0lBQ0QsSUFBSSxZQUFZLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1dBQ3BGLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxXQUFXLElBQUksWUFBWSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ2hGLElBQUksSUFBSSxHQUFHLElBQUEsOEJBQWEsRUFBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDNUcsT0FBTyxZQUFZO1NBQ2QsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUEsK0JBQWMsRUFBQyxHQUFHLENBQUMsS0FBSyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7U0FDdEYsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUEsK0JBQWMsRUFBQyxHQUFHLENBQUMsS0FBSyxVQUFVLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQzFILENBQUM7QUE3QkQsOENBNkJDO0FBRUQ7O3dFQUV3RTtBQUN4RSxLQUFLLFVBQVUsb0JBQW9CLENBQUMsTUFHbkM7SUFDRyxJQUFJLEVBQUUsUUFBUSxFQUFFLHNCQUFzQixFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2xELElBQUksS0FBSyxHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO0lBQ3hDLElBQUksUUFBUSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDdEQsSUFBSSxRQUFRLENBQUM7SUFDYixJQUFJLENBQUM7UUFDRCxRQUFRLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCx1RkFBdUY7UUFDdkYsaURBQWlEO1FBQ2pELE9BQU8sQ0FBQyxHQUFHLENBQUMseUJBQXlCLFFBQVEsK0NBQStDLENBQUMsQ0FBQztRQUM5RixPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBQ0QsSUFBSSxLQUFLLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqQyxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ2hELElBQUksV0FBVyxHQUFHLElBQUEsK0JBQWMsRUFBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUMvQyxJQUFJLFNBQVMsR0FBRyxXQUFXLElBQUksc0JBQXNCLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3ZFLElBQUksQ0FBQyxTQUFTLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbEMsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLE1BQU0sR0FBRyxJQUFBLCtCQUFjLEVBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ3JELEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQzlCLEtBQUssQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBQ0QsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxrQkFBRSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQztBQUNqQixDQUFDO0FBRUQ7cUVBQ3FFO0FBQ3JFLEtBQUssVUFBVSxlQUFlLENBQUMsS0FBeUI7SUFDcEQsSUFBSSxHQUFHLEdBQUcsS0FBSyxJQUFJLElBQUEsa0JBQVUsRUFBQyxLQUFLLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDbEQsOEZBQThGO0lBQzlGLCtGQUErRjtJQUMvRixJQUFJLFFBQVEsR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLGlCQUFpQixDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNuRyxJQUFJLFFBQVEsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3RDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNyQyxNQUFNLElBQUksS0FBSyxDQUNYLFlBQVksS0FBSyxJQUFJLHVCQUF1Qix3Q0FBd0M7Y0FDbEYsR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEtBQUssRUFBRSxDQUM5RCxDQUFDO0lBQ04sQ0FBQztJQUNELElBQUksQ0FBQztRQUNELE1BQU0sSUFBQSw2QkFBWSxFQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyxZQUFZLFFBQVEsMENBQTBDLENBQUMsS0FBSyxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7SUFDRCxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUMxRyxJQUFJLFNBQVMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3JDLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksUUFBUSw0Q0FBNEMsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUM3RixDQUFDO0lBQ0QsT0FBTyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsQ0FBQztBQUNuQyxDQUFDO0FBRU0sS0FBSyxVQUFVLElBQUk7SUFDdEIsSUFBSSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDakMsSUFBSSxTQUFTLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUMzQyxJQUFJLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxLQUFLLFdBQVcsQ0FBQyxDQUFDO0lBQ3pELElBQUksVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN4QixNQUFNLElBQUksS0FBSyxDQUFDLHFDQUFxQyxVQUFVLENBQUMsTUFBTSxpQkFBaUIsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBQ0QsSUFBSSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUVuRSxJQUFJLFdBQVcsR0FBRyxNQUFNLHFCQUFxQixDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0QixPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBQSw0QkFBYSxFQUFDLFNBQVMsQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO1FBQzlGLE9BQU87SUFDWCxDQUFDO0lBRUQsSUFBSSxTQUFTLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDbkQsTUFBTSxrQkFBRSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUMvQyxJQUFJLEtBQUssR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDM0QsSUFBSSxVQUFVLEdBQUcsR0FBRyxLQUFLLFdBQVcsQ0FBQztJQUNyQyxNQUFNLGtCQUFFLENBQUMsU0FBUyxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsVUFBVSxPQUFPLENBQUMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQzFFLFVBQVU7UUFDVixTQUFTLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7UUFDbkMseUZBQXlGO1FBQ3pGLHNGQUFzRjtRQUN0RixvREFBb0Q7UUFDcEQsT0FBTyxFQUFFLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3BDLFdBQVcsRUFBRSxVQUFVLENBQUMsV0FBVztZQUNuQyxFQUFFLEVBQUUsWUFBWSxDQUFDLFVBQVUsQ0FBQztTQUMvQixDQUFDLENBQUM7UUFDSCxXQUFXLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDeEMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZO1lBQ3JDLFdBQVcsRUFBRSxVQUFVLENBQUMsV0FBVztZQUNuQyxFQUFFLEVBQUUsWUFBWSxDQUFDLFVBQVUsQ0FBQztZQUM1QixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7WUFDL0IsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTO1lBQy9CLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztTQUM5QixDQUFDLENBQUM7S0FDTixFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUV6Qix5RkFBeUY7SUFDekYsNEZBQTRGO0lBQzVGLDZDQUE2QztJQUM3QyxJQUFJLGlCQUFpQixHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO0lBQ2xELEtBQUssSUFBSSxHQUFHLElBQUksTUFBTSxJQUFBLDZCQUFZLEVBQUMsUUFBUSxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQWMsQ0FBQyxFQUFFLENBQUM7UUFDdkUsaUJBQWlCLENBQUMsR0FBRyxDQUFDLElBQUEsK0JBQWMsRUFBQyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLEdBQUcsQ0FBQyxVQUFzQixFQUFFLEVBQUU7UUFDekMsSUFBSSxHQUFHLEdBQUcsaUJBQWlCLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsSUFBSSxVQUFVLENBQUMsR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUNoRixPQUFPLEdBQUcsSUFBSSxJQUFBLDZCQUFZLEVBQUMsR0FBRyxDQUFDLElBQUksaUNBQWlDLFVBQVUsQ0FBQyxXQUFXLEdBQUcsQ0FBQztJQUNsRyxDQUFDLENBQUM7SUFFRixJQUFJLHNCQUFzQixHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO0lBQ3pELEtBQUssSUFBSSxVQUFVLElBQUksV0FBVyxFQUFFLENBQUM7UUFDakMsSUFBSSxFQUFFLEdBQUcsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2xDLElBQUksUUFBUSxHQUFHLHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3hFLElBQUksRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQy9CLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdEIsQ0FBQztRQUNELHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFRCwrRkFBK0Y7SUFDL0YsNEZBQTRGO0lBQzVGLDRGQUE0RjtJQUM1RixJQUFJLEtBQUssR0FBRyxNQUFNLG9CQUFvQixDQUFDLEVBQUUsUUFBUSxFQUFFLHNCQUFzQixFQUFFLENBQUMsQ0FBQztJQUU3RSxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2hCLEtBQUssSUFBSSxDQUFDLFdBQVcsRUFBRSxTQUFTLENBQUMsSUFBSSxzQkFBc0IsRUFBRSxDQUFDO1FBQzFELElBQUksVUFBVSxHQUFHLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsV0FBVyxLQUFLLFdBQVcsQ0FBRSxDQUFDO1FBQy9FLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxXQUFXLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLHVCQUF1QixFQUFFLENBQUMsQ0FBQztRQUM5RSxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUM3QyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuQixPQUFPLENBQUMsR0FBRyxDQUFDLHdEQUF3RCxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNoRyxDQUFDO2FBQU0sQ0FBQztZQUNKLE9BQU8sQ0FBQyxHQUFHLENBQUMsMkNBQTJDLFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsWUFBWSxFQUFFLENBQUMsQ0FBQztRQUMzRyxDQUFDO1FBQ0QsS0FBSyxJQUFJLEtBQUssSUFBSSxXQUFXLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFdBQVcsS0FBSyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQy9FLE9BQU8sQ0FBQyxHQUFHLENBQ1AsZUFBZSxLQUFLLENBQUMsU0FBUyxJQUFJLEdBQUcsSUFBSSxLQUFLLENBQUMsU0FBUyxJQUFJLHVCQUF1QixFQUFFLENBQ3hGLENBQUM7UUFDTixDQUFDO1FBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNwQixDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpRkFBaUYsQ0FBQyxDQUFDO0lBQy9GLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUVoQyxnR0FBZ0c7SUFDaEcsaUZBQWlGO0lBQ2pGLE1BQU0sSUFBQSxvQkFBUSxFQUFDLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUU3QixJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDYixPQUFPLENBQUMsR0FBRyxDQUFDLGlGQUFpRixDQUFDLENBQUM7UUFDL0YsT0FBTyxDQUFDLEdBQUcsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsc0NBQXNDLGNBQWMscUJBQXFCLENBQUMsQ0FBQztRQUN2RixPQUFPO0lBQ1gsQ0FBQztJQUNELE1BQU0sSUFBQSx1QkFBVSxFQUFDLFlBQVksRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2xELE1BQU0sSUFBQSx1QkFBVSxFQUFDLGtCQUFrQixjQUFjLEdBQUcsRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3pFLE1BQU0sSUFBQSx1QkFBVSxFQUFDLFVBQVUsRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2hELE9BQU8sQ0FBQyxHQUFHLENBQUMsaUZBQWlGLENBQUMsQ0FBQztJQUMvRixPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUM7QUFDcEMsQ0FBQztBQXRHRCxvQkFzR0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgb3MgZnJvbSBcIm9zXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuaW1wb3J0IHsgcnVuUHJvbWlzZSB9IGZyb20gXCJzb2NrZXQtZnVuY3Rpb24vc3JjL3J1blByb21pc2VcIjtcbmltcG9ydCB7IGFsbG93QWRkcmVzc2VzLCBrZXlGaW5nZXJwcmludCwgbm9ybWFsaXplS2V5cywgc3VtbWFyaXplS2V5IH0gZnJvbSBcIi4vYXV0aG9yaXplZEtleXNcIjtcbmltcG9ydCB7IGRlcml2ZVJldm9rZUtleSwgcmV2b2tlUmVwb1VSTCB9IGZyb20gXCIuL3Jldm9rZVNvdXJjZVwiO1xuaW1wb3J0IHsgZmluZFNvdXJjZUtleSB9IGZyb20gXCIuL3NvdXJjZXNcIjtcbmltcG9ydCB7IHNpZ25SZXBvIH0gZnJvbSBcIi4uL3NpZ25lZEZpbGVzL3NpZ25GaWxlc1wiO1xuaW1wb3J0IHsgcmVhZFJlcG9LZXlzIH0gZnJvbSBcIi4vYXV0aG9yaXplZEtleXNcIjtcbmltcG9ydCB7IGV4cGFuZEhvbWUgfSBmcm9tIFwiLi4vaGVscGVycy9wYXRoc1wiO1xuaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4uL2hlbHBlcnMvc3Bhd25cIjtcblxuY29uc3QgVU5SRVZPS0VTX0RJUiA9IFwidW5yZXZva2VkXCI7XG5jb25zdCBSRVZPQ0FUSU9OU19ESVIgPSBcInJldm9jYXRpb25zXCI7XG5jb25zdCBHSVRfS0VZV09SRCA9IFwiZ2l0XCI7XG5jb25zdCBDT01NSVRfTUVTU0FHRSA9IFwidW5yZXZva2Uga2V5c1wiO1xuY29uc3QgVVNBR0UgPSBgVXNhZ2U6IHlhcm4gdW5yZXZva2UgW2tleXMtcmVwb10gWyR7R0lUX0tFWVdPUkR9XVxuXG5SdW4gdGhpcyBpbiBhIGtleXMgcmVwbywgb3IgbmFtZSBvbmUuIEl0IHJlYWRzIHRoYXQgcmVwbydzIHJldm9rZSByZXBvIGFuZCB3cml0ZXMgb25lIHVucmV2b2tlIGZpbGVcbm5hbWluZyBldmVyeSByZXZvY2F0aW9uIGluIGl0LCBzbyB0aGUga2V5cyBhcmUgYWNjZXB0ZWQgYWdhaW4gb25jZSBlYWNoIG1hY2hpbmUncyBob3VyIGxvbmcgd2FpdFxucGFzc2VzLiBJdCBzaWducyB0aGUgcmVzdWx0LCBhbmQgd2l0aCAke0dJVF9LRVlXT1JEfSBpdCBjb21taXRzIGFuZCBwdXNoZXMgaXQgdG9vLlxuXG5LZXlzIHRoYXQgd2VyZSByZXZva2VkIHNob3VsZCBub3JtYWxseSBiZSBkZWxldGVkIGZyb20gdGhlIHJlcG8gaW5zdGVhZC4gVW5yZXZva2luZyBvbmx5IG1hdHRlcnNcbmZvciBhIGtleSB5b3Ugc3RpbGwgd2FudC5gO1xuXG5leHBvcnQgdHlwZSBSZXZvY2F0aW9uID0ge1xuICAgIHJldm9jYXRpb25JZDogc3RyaW5nO1xuICAgIGZpbmdlcnByaW50OiBzdHJpbmc7XG4gICAgLy8gVGhlIGFkZHJlc3MgdGhlIGtleSB3YXMgdXNlZCBmcm9tLiBBIHJldm9jYXRpb24gaXMgYWJvdXQgdGhpcyBwYWlyLCBhbmQgYW4gdW5yZXZva2UgdW5kb2VzXG4gICAgLy8gaXQgYnkgYWxsb3dpbmcgdGhhdCBzYW1lIHBhaXIgLSB3aGljaCBpcyB3aHkgdW5yZXZva2luZyBuZXZlciBtYWtlcyBhIGtleSB1bnJldm9rYWJsZTogdXNlZFxuICAgIC8vIGZyb20gc29tZSBvdGhlciBhZGRyZXNzLCBpdCBpcyByZXZva2VkIGFnYWluLlxuICAgIGlwPzogc3RyaW5nO1xuICAgIGtleT86IHN0cmluZztcbiAgICByZXZva2VkQXQ/OiBzdHJpbmc7XG4gICAgcmV2b2tlZEJ5Pzogc3RyaW5nO1xuICAgIGF0dGVtcHQ/OiB7IGlwPzogc3RyaW5nOyB1c2VyPzogc3RyaW5nOyByZXF1aXJlZD86IHN0cmluZyB9O1xufTtcblxuLyoqIE9sZGVyIHJldm9jYXRpb24gZmlsZXMgY2FycnkgdGhlIGFkZHJlc3MgdW5kZXIgYXR0ZW1wdCBvbmx5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJldm9jYXRpb25JUChyZXZvY2F0aW9uOiBSZXZvY2F0aW9uKSB7XG4gICAgcmV0dXJuIHJldm9jYXRpb24uaXAgfHwgcmV2b2NhdGlvbi5hdHRlbXB0Py5pcCB8fCBcIlwiO1xufVxuXG4vKiogRXZlcnkgcmV2b2NhdGlvbiB0aGUgcmV2b2tlIHJlcG8gbGlzdHMuIENsb25lZCByZWFkIG9ubHkgaW50byBhIHRlbXAgZGlyZWN0b3J5LlxuXG4gICAgQSBwZXJzb24gcnVubmluZyB0aGlzIGhhcyB0aGVpciBvd24gYWNjZXNzIHRvIHRoZSByZXBvLCBzbyB0aGVpciBjcmVkZW50aWFscyBhcmUgd2hhdCBpcyB1c2VkLlxuICAgIE9uIGEgbWFjaGluZSB0aGF0IGlzIGFscmVhZHkgYSBwb3J0c2VjdXJlIGhvc3QgdGhlcmUgbWF5IGJlIG5vIHN1Y2ggY3JlZGVudGlhbHMsIGJ1dCB0aGUgc291cmNlXG4gICAgZGVwbG95IGtleSBpcyByaWdodCB0aGVyZSwgYW5kIHRoZSBrZXkgZGVyaXZlZCBmcm9tIGl0IGlzIG9uZSB0aGF0IHJlcG8gZGVmaW5pdGVseSBhY2NlcHRzLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlYWRSZW1vdGVSZXZvY2F0aW9ucyhjb25maWc6IHsgc291cmNlVVJMOiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHNvdXJjZVVSTCB9ID0gY29uZmlnO1xuICAgIGxldCB0ZW1wb3JhcnlEaXJlY3RvcnkgPSBhd2FpdCBmcy5ta2R0ZW1wKHBhdGguam9pbihvcy50bXBkaXIoKSwgXCJ1bnJldm9rZS1cIikpO1xuICAgIGxldCByZXBvUGF0aCA9IHBhdGguam9pbih0ZW1wb3JhcnlEaXJlY3RvcnksIFwicmVwb1wiKTtcbiAgICBsZXQgY2xvbmVBcmdzID0gW1wiY2xvbmVcIiwgXCItLWRlcHRoXCIsIFwiMVwiLCByZXZva2VSZXBvVVJMKHNvdXJjZVVSTCksIHJlcG9QYXRoXTtcbiAgICBsZXQgc291cmNlS2V5ID0gYXdhaXQgZmluZFNvdXJjZUtleShzb3VyY2VVUkwpO1xuICAgIGlmIChzb3VyY2VLZXkpIHtcbiAgICAgICAgbGV0IGRlcml2ZWQgPSBkZXJpdmVSZXZva2VLZXkoYXdhaXQgZnMucmVhZEZpbGUoc291cmNlS2V5LCBcInV0ZjhcIikpO1xuICAgICAgICBsZXQgZGVyaXZlZEtleVBhdGggPSBwYXRoLmpvaW4odGVtcG9yYXJ5RGlyZWN0b3J5LCBcImtleVwiKTtcbiAgICAgICAgYXdhaXQgZnMud3JpdGVGaWxlKGRlcml2ZWRLZXlQYXRoLCBkZXJpdmVkLnByaXZhdGVLZXlGaWxlLCB7IG1vZGU6IDBvNjAwIH0pO1xuICAgICAgICBsZXQgc3NoQ29tbWFuZCA9IGBzc2ggLWkgJHtkZXJpdmVkS2V5UGF0aH0gLW8gSWRlbnRpdGllc09ubHk9eWVzIC1vIEJhdGNoTW9kZT15ZXMgLW8gU3RyaWN0SG9zdEtleUNoZWNraW5nPWFjY2VwdC1uZXdgO1xuICAgICAgICBjbG9uZUFyZ3MgPSBbXCItY1wiLCBgY29yZS5zc2hDb21tYW5kPSR7c3NoQ29tbWFuZH1gLCAuLi5jbG9uZUFyZ3NdO1xuICAgIH1cbiAgICBsZXQgY2xvbmUgPSBhd2FpdCBzcGF3blByb21pc2UoeyBjb21tYW5kOiBcImdpdFwiLCBhcmdzOiBjbG9uZUFyZ3MgfSk7XG4gICAgaWYgKGNsb25lLnN0YXR1cyAhPT0gMCkge1xuICAgICAgICBhd2FpdCBmcy5ybSh0ZW1wb3JhcnlEaXJlY3RvcnksIHsgcmVjdXJzaXZlOiB0cnVlLCBmb3JjZTogdHJ1ZSB9KTtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgYEV4cGVjdGVkIHRvIGJlIGFibGUgdG8gcmVhZCAke3Jldm9rZVJlcG9VUkwoc291cmNlVVJMKX0uXFxuYFxuICAgICAgICAgICAgKyBgJHsoY2xvbmUuc3Rkb3V0ICsgY2xvbmUuc3RkZXJyKS50cmltKCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICBsZXQgcmV2b2NhdGlvbnM6IFJldm9jYXRpb25bXSA9IFtdO1xuICAgIGxldCBkaXJlY3RvcnkgPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFJFVk9DQVRJT05TX0RJUik7XG4gICAgdHJ5IHtcbiAgICAgICAgZm9yIChsZXQgbmFtZSBvZiAoYXdhaXQgZnMucmVhZGRpcihkaXJlY3RvcnkpKS5zb3J0KCkpIHtcbiAgICAgICAgICAgIGlmIChuYW1lLmVuZHNXaXRoKFwiLmpzb25cIikpIHtcbiAgICAgICAgICAgICAgICByZXZvY2F0aW9ucy5wdXNoKEpTT04ucGFyc2UoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKGRpcmVjdG9yeSwgbmFtZSksIFwidXRmOFwiKSkpO1xuICAgICAgICAgICAgfVxuICAgICAgICB9XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICAvLyBObyByZXZvY2F0aW9ucyBkaXJlY3RvcnkgYXQgYWxsIGp1c3QgbWVhbnMgbm90aGluZyBoYXMgZXZlciBiZWVuIHJldm9rZWQuXG4gICAgfVxuICAgIGF3YWl0IGZzLnJtKHRlbXBvcmFyeURpcmVjdG9yeSwgeyByZWN1cnNpdmU6IHRydWUsIGZvcmNlOiB0cnVlIH0pO1xuICAgIHJldHVybiByZXZvY2F0aW9ucztcbn1cblxuLyoqIFdoaWNoIGtleXMgaW4gYSByZXBvIGFyZSByZXZva2VkLiBXaGF0IHNpZ25maWxlcyBhbmQgc2VjdXJlc3NoIHJlZnVzZSBvdmVyLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJldm9rZWRLZXlzSW5SZXBvKGNvbmZpZzogeyByZXBvUGF0aDogc3RyaW5nOyBzb3VyY2VVUkw6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgcmVwb1BhdGgsIHNvdXJjZVVSTCB9ID0gY29uZmlnO1xuICAgIGxldCByZXZvY2F0aW9ucyA9IGF3YWl0IHJlYWRSZW1vdGVSZXZvY2F0aW9ucyh7IHNvdXJjZVVSTCB9KTtcbiAgICBsZXQgcmV2b2tlZEZpbmdlcnByaW50cyA9IG5ldyBTZXQocmV2b2NhdGlvbnMubWFwKHJldm9jYXRpb24gPT4gcmV2b2NhdGlvbi5maW5nZXJwcmludCkpO1xuICAgIGxldCB1bnJldm9rZWQgPSBuZXcgU2V0PHN0cmluZz4oKTtcbiAgICB0cnkge1xuICAgICAgICBsZXQgZGlyZWN0b3J5ID0gcGF0aC5qb2luKHJlcG9QYXRoLCBVTlJFVk9LRVNfRElSKTtcbiAgICAgICAgZm9yIChsZXQgbmFtZSBvZiBhd2FpdCBmcy5yZWFkZGlyKGRpcmVjdG9yeSkpIHtcbiAgICAgICAgICAgIGlmICghbmFtZS5lbmRzV2l0aChcIi5qc29uXCIpKSB7XG4gICAgICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgICAgICB9XG4gICAgICAgICAgICBsZXQgcGFyc2VkID0gSlNPTi5wYXJzZShhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4oZGlyZWN0b3J5LCBuYW1lKSwgXCJ1dGY4XCIpKTtcbiAgICAgICAgICAgIGZvciAobGV0IGFsbG93ZWQgb2YgcGFyc2VkLmFsbG93ZWQgfHwgW10pIHtcbiAgICAgICAgICAgICAgICB1bnJldm9rZWQuYWRkKGAke2FsbG93ZWQuZmluZ2VycHJpbnR9ICR7YWxsb3dlZC5pcH1gKTtcbiAgICAgICAgICAgIH1cbiAgICAgICAgICAgIC8vIE5hbWVkIGlkcywgZm9yIHRoZSB1bnJldm9rZXMgd3JpdHRlbiBiZWZvcmUgdGhpcyB3YXMgYWJvdXQgcGFpcnMuXG4gICAgICAgICAgICBmb3IgKGxldCByZXZvY2F0aW9uSWQgb2YgcGFyc2VkLnJldm9jYXRpb25JZHMgfHwgW10pIHtcbiAgICAgICAgICAgICAgICB1bnJldm9rZWQuYWRkKHJldm9jYXRpb25JZCk7XG4gICAgICAgICAgICB9XG4gICAgICAgIH1cbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIE5vdGhpbmcgaGFzIGJlZW4gdW5yZXZva2VkLlxuICAgIH1cbiAgICBsZXQgc3RpbGxSZXZva2VkID0gcmV2b2NhdGlvbnMuZmlsdGVyKHJldm9jYXRpb24gPT4gIXVucmV2b2tlZC5oYXMocmV2b2NhdGlvbi5yZXZvY2F0aW9uSWQpXG4gICAgICAgICYmICF1bnJldm9rZWQuaGFzKGAke3Jldm9jYXRpb24uZmluZ2VycHJpbnR9ICR7cmV2b2NhdGlvbklQKHJldm9jYXRpb24pfWApKTtcbiAgICBsZXQga2V5cyA9IG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKSwgXCJ1dGY4XCIpLmNhdGNoKCgpID0+IFwiXCIpKTtcbiAgICByZXR1cm4gc3RpbGxSZXZva2VkXG4gICAgICAgIC5maWx0ZXIocmV2b2NhdGlvbiA9PiBrZXlzLnNvbWUoa2V5ID0+IGtleUZpbmdlcnByaW50KGtleSkgPT09IHJldm9jYXRpb24uZmluZ2VycHJpbnQpKVxuICAgICAgICAubWFwKHJldm9jYXRpb24gPT4gKHsgcmV2b2NhdGlvbiwga2V5OiBrZXlzLmZpbmQoa2V5ID0+IGtleUZpbmdlcnByaW50KGtleSkgPT09IHJldm9jYXRpb24uZmluZ2VycHJpbnQpIHx8IFwiXCIgfSkpO1xufVxuXG4vKiogV3JpdGVzIHRoZSBhZGRyZXNzZXMgaW50byB0aGUgZnJvbT0gbGlzdCBvZiBlYWNoIGtleSBpbiB0aGUgcmVwbydzIGF1dGhvcml6ZWRfa2V5cywgYW5kIHNheXNcbiAgICB3aGljaCBvbmVzIHdlcmUgYWN0dWFsbHkgbmV3LiBPbmx5IHRoZSBsaW5lcyBiZWluZyBjaGFuZ2VkIGFyZSB0b3VjaGVkLCBzbyBjb21tZW50cywgb3JkZXJpbmdcbiAgICBhbmQgYW55IGtleSBub3QgaW52b2x2ZWQgY29tZSBvdXQgb2YgdGhpcyBieXRlIGZvciBieXRlIHRoZSBzYW1lLiAqL1xuYXN5bmMgZnVuY3Rpb24gYWxsb3dBZGRyZXNzZXNJblJlcG8oY29uZmlnOiB7XG4gICAgcmVwb1BhdGg6IHN0cmluZztcbiAgICBhZGRyZXNzZXNCeUZpbmdlcnByaW50OiBNYXA8c3RyaW5nLCBzdHJpbmdbXT47XG59KSB7XG4gICAgbGV0IHsgcmVwb1BhdGgsIGFkZHJlc3Nlc0J5RmluZ2VycHJpbnQgfSA9IGNvbmZpZztcbiAgICBsZXQgYWRkZWQgPSBuZXcgTWFwPHN0cmluZywgc3RyaW5nW10+KCk7XG4gICAgbGV0IGZpbGVQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKTtcbiAgICBsZXQgY29udGVudHM7XG4gICAgdHJ5IHtcbiAgICAgICAgY29udGVudHMgPSBhd2FpdCBmcy5yZWFkRmlsZShmaWxlUGF0aCwgXCJ1dGY4XCIpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgLy8gQSByZXBvIGhvbGRpbmcgaXRzIGtleXMgYXMgc2VwYXJhdGUgLnB1YiBmaWxlcy4gTm90aGluZyB0byBlZGl0IGluIG9uZSBwbGFjZSwgc28gdGhlXG4gICAgICAgIC8vIGNhbGxlcidzIGxpc3RpbmcgaXMgYWxsIHdob2V2ZXIgcmFuIHRoaXMgZ2V0cy5cbiAgICAgICAgY29uc29sZS5sb2coYE5vIGF1dGhvcml6ZWRfa2V5cyBpbiAke3JlcG9QYXRofSwgc28gdGhlIGFkZHJlc3NlcyB3ZXJlIG5vdCBhZGRlZCB0byBhbnkga2V5LmApO1xuICAgICAgICByZXR1cm4gYWRkZWQ7XG4gICAgfVxuICAgIGxldCBsaW5lcyA9IGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpO1xuICAgIGZvciAobGV0IGluZGV4ID0gMDsgaW5kZXggPCBsaW5lcy5sZW5ndGg7IGluZGV4KyspIHtcbiAgICAgICAgbGV0IGZpbmdlcnByaW50ID0ga2V5RmluZ2VycHJpbnQobGluZXNbaW5kZXhdKTtcbiAgICAgICAgbGV0IGFkZHJlc3NlcyA9IGZpbmdlcnByaW50ICYmIGFkZHJlc3Nlc0J5RmluZ2VycHJpbnQuZ2V0KGZpbmdlcnByaW50KTtcbiAgICAgICAgaWYgKCFhZGRyZXNzZXMgfHwgIWFkZHJlc3Nlcy5sZW5ndGgpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGxldCByZXN1bHQgPSBhbGxvd0FkZHJlc3NlcyhsaW5lc1tpbmRleF0sIGFkZHJlc3Nlcyk7XG4gICAgICAgIGxpbmVzW2luZGV4XSA9IHJlc3VsdC5rZXlMaW5lO1xuICAgICAgICBhZGRlZC5zZXQoZmluZ2VycHJpbnQsIFsuLi4oYWRkZWQuZ2V0KGZpbmdlcnByaW50KSB8fCBbXSksIC4uLnJlc3VsdC5hZGRlZF0pO1xuICAgIH1cbiAgICBpZiAoWy4uLmFkZGVkLnZhbHVlcygpXS5zb21lKGxpc3QgPT4gbGlzdC5sZW5ndGgpKSB7XG4gICAgICAgIGF3YWl0IGZzLndyaXRlRmlsZShmaWxlUGF0aCwgbGluZXMuam9pbihcIlxcblwiKSk7XG4gICAgfVxuICAgIHJldHVybiBhZGRlZDtcbn1cblxuLyoqIFRoZSByZXBvIG5hbWVkLCBvciB0aGUgb25lIHdlIGFyZSBzdGFuZGluZyBpbi4gQ2hlY2tlZCB0aGUgc2FtZSB3YXkgc2VjdXJlc3NoIGNoZWNrcyBpdDogYSBnaXRcbiAgICByZXBvIHRoYXQgYWN0dWFsbHkgaG9sZHMga2V5cyBhbmQgaGFzIGFuIG9yaWdpbiB0byBjbG9uZSBmcm9tLiAqL1xuYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZUtleXNSZXBvKG5hbWVkOiBzdHJpbmcgfCB1bmRlZmluZWQpIHtcbiAgICBsZXQgY3dkID0gbmFtZWQgJiYgZXhwYW5kSG9tZShuYW1lZCkgfHwgdW5kZWZpbmVkO1xuICAgIC8vIHNwYXduUHJvbWlzZSByYXRoZXIgdGhhbiBydW5Qcm9taXNlLCBiZWNhdXNlIHRoZXNlIHR3byBhcmUgcmVhZCBmb3IgdGhlaXIgdmFsdWUuIHJ1blByb21pc2VcbiAgICAvLyByZXR1cm5zIHN0ZG91dCBhbmQgc3RkZXJyIGpvaW5lZCwgc28gb25lIGdpdCB3YXJuaW5nIGVuZHMgdXAgZ2x1ZWQgdG8gdGhlIGZyb250IG9mIHRoZSBwYXRoLlxuICAgIGxldCB0b3BMZXZlbCA9IGF3YWl0IHNwYXduUHJvbWlzZSh7IGNvbW1hbmQ6IFwiZ2l0XCIsIGFyZ3M6IFtcInJldi1wYXJzZVwiLCBcIi0tc2hvdy10b3BsZXZlbFwiXSwgY3dkIH0pO1xuICAgIGxldCByZXBvUGF0aCA9IHRvcExldmVsLnN0ZG91dC50cmltKCk7XG4gICAgaWYgKHRvcExldmVsLnN0YXR1cyAhPT0gMCB8fCAhcmVwb1BhdGgpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgYEV4cGVjdGVkICR7bmFtZWQgfHwgXCJ0aGUgY3VycmVudCBkaXJlY3RvcnlcIn0gdG8gYmUgaW5zaWRlIGEgZ2l0IHJlcG8sIGl0IGlzIG5vdC5cXG5gXG4gICAgICAgICAgICArIGAkeyh0b3BMZXZlbC5zdGRvdXQgKyB0b3BMZXZlbC5zdGRlcnIpLnRyaW0oKX1cXG4ke1VTQUdFfWBcbiAgICAgICAgKTtcbiAgICB9XG4gICAgdHJ5IHtcbiAgICAgICAgYXdhaXQgcmVhZFJlcG9LZXlzKHJlcG9QYXRoKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgJHtyZXBvUGF0aH0gdG8gYmUgYSBrZXlzIHJlcG8sIGl0IGhvbGRzIG5vIGtleXMuXFxuJHtlfVxcbiR7VVNBR0V9YCk7XG4gICAgfVxuICAgIGxldCBvcmlnaW4gPSBhd2FpdCBzcGF3blByb21pc2UoeyBjb21tYW5kOiBcImdpdFwiLCBhcmdzOiBbXCJyZW1vdGVcIiwgXCJnZXQtdXJsXCIsIFwib3JpZ2luXCJdLCBjd2Q6IHJlcG9QYXRoIH0pO1xuICAgIGxldCBvcmlnaW5VUkwgPSBvcmlnaW4uc3Rkb3V0LnRyaW0oKTtcbiAgICBpZiAob3JpZ2luLnN0YXR1cyAhPT0gMCB8fCAhb3JpZ2luVVJMKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgJHtyZXBvUGF0aH0gdG8gaGF2ZSBhbiBvcmlnaW4gcmVtb3RlLCBpdCBoYXMgbm9uZS5cXG4ke1VTQUdFfWApO1xuICAgIH1cbiAgICByZXR1cm4geyByZXBvUGF0aCwgb3JpZ2luVVJMIH07XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBtYWluKCkge1xuICAgIGxldCBhcmd2ID0gcHJvY2Vzcy5hcmd2LnNsaWNlKDIpO1xuICAgIGxldCBwdXNoVG9HaXQgPSBhcmd2LmluY2x1ZGVzKEdJVF9LRVlXT1JEKTtcbiAgICBsZXQgcG9zaXRpb25hbCA9IGFyZ3YuZmlsdGVyKGFyZyA9PiBhcmcgIT09IEdJVF9LRVlXT1JEKTtcbiAgICBpZiAocG9zaXRpb25hbC5sZW5ndGggPiAxKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYXQgbW9zdCBhIGtleXMgcmVwbywgd2FzICR7cG9zaXRpb25hbC5sZW5ndGh9IGFyZ3VtZW50KHMpXFxuJHtVU0FHRX1gKTtcbiAgICB9XG4gICAgbGV0IHsgcmVwb1BhdGgsIG9yaWdpblVSTCB9ID0gYXdhaXQgcmVzb2x2ZUtleXNSZXBvKHBvc2l0aW9uYWxbMF0pO1xuXG4gICAgbGV0IHJldm9jYXRpb25zID0gYXdhaXQgcmVhZFJlbW90ZVJldm9jYXRpb25zKHsgc291cmNlVVJMOiBvcmlnaW5VUkwgfSk7XG4gICAgaWYgKCFyZXZvY2F0aW9ucy5sZW5ndGgpIHtcbiAgICAgICAgY29uc29sZS5sb2coYCR7cmV2b2tlUmVwb1VSTChvcmlnaW5VUkwpfSBsaXN0cyBubyByZXZvY2F0aW9ucywgc28gdGhlcmUgaXMgbm90aGluZyB0byB1bmRvLmApO1xuICAgICAgICByZXR1cm47XG4gICAgfVxuXG4gICAgbGV0IGRpcmVjdG9yeSA9IHBhdGguam9pbihyZXBvUGF0aCwgVU5SRVZPS0VTX0RJUik7XG4gICAgYXdhaXQgZnMubWtkaXIoZGlyZWN0b3J5LCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcbiAgICBsZXQgc3RhbXAgPSBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCkucmVwbGFjZSgvWzouXS9nLCBcIi1cIik7XG4gICAgbGV0IHVucmV2b2tlSWQgPSBgJHtzdGFtcH0tdW5yZXZva2VgO1xuICAgIGF3YWl0IGZzLndyaXRlRmlsZShwYXRoLmpvaW4oZGlyZWN0b3J5LCBgJHt1bnJldm9rZUlkfS5qc29uYCksIEpTT04uc3RyaW5naWZ5KHtcbiAgICAgICAgdW5yZXZva2VJZCxcbiAgICAgICAgY3JlYXRlZEF0OiBuZXcgRGF0ZSgpLnRvSVNPU3RyaW5nKCksXG4gICAgICAgIC8vIFdoYXQgdGhpcyBmaWxlIHNheXM6IGVhY2ggb2YgdGhlc2Uga2V5cyBpcyBhbGxvd2VkIGZyb20gdGhpcyBhZGRyZXNzLiBQYWlycywgbm90IGtleXMsXG4gICAgICAgIC8vIGFuZCBub3QgYSBibGFua2V0IFwiYWxsb3cgZXZlcnl0aGluZyBhZ2FpblwiIC0gYSBrZXkgZm9yZ2l2ZW4gaGVyZSBmb3Igb25lIGFkZHJlc3MgaXNcbiAgICAgICAgLy8gc3RpbGwgcmV2b2tlZCB0aGUgbW9tZW50IGl0IGlzIHVzZWQgZnJvbSBhbm90aGVyLlxuICAgICAgICBhbGxvd2VkOiByZXZvY2F0aW9ucy5tYXAocmV2b2NhdGlvbiA9PiAoe1xuICAgICAgICAgICAgZmluZ2VycHJpbnQ6IHJldm9jYXRpb24uZmluZ2VycHJpbnQsXG4gICAgICAgICAgICBpcDogcmV2b2NhdGlvbklQKHJldm9jYXRpb24pLFxuICAgICAgICB9KSksXG4gICAgICAgIHJldm9jYXRpb25zOiByZXZvY2F0aW9ucy5tYXAocmV2b2NhdGlvbiA9PiAoe1xuICAgICAgICAgICAgcmV2b2NhdGlvbklkOiByZXZvY2F0aW9uLnJldm9jYXRpb25JZCxcbiAgICAgICAgICAgIGZpbmdlcnByaW50OiByZXZvY2F0aW9uLmZpbmdlcnByaW50LFxuICAgICAgICAgICAgaXA6IHJldm9jYXRpb25JUChyZXZvY2F0aW9uKSxcbiAgICAgICAgICAgIHJldm9rZWRBdDogcmV2b2NhdGlvbi5yZXZva2VkQXQsXG4gICAgICAgICAgICByZXZva2VkQnk6IHJldm9jYXRpb24ucmV2b2tlZEJ5LFxuICAgICAgICAgICAgYXR0ZW1wdDogcmV2b2NhdGlvbi5hdHRlbXB0LFxuICAgICAgICB9KSksXG4gICAgfSwgdW5kZWZpbmVkLCA0KSArIFwiXFxuXCIpO1xuXG4gICAgLy8gTmFtZWQgdGhlIHdheSB0aGUgbm90aWZpY2F0aW9ucyBuYW1lIHRoZW0uIEEgZmluZ2VycHJpbnQgaXMgbm90IGluIGF1dGhvcml6ZWRfa2V5cyBhbmRcbiAgICAvLyBjYW5ub3QgYmUgd29ya2VkIG91dCBieSBleWUsIHNvIG9uIGl0cyBvd24gaXQgdGVsbHMgd2hvZXZlciBpcyByZWFkaW5nIHRoaXMgbm90aGluZyBhYm91dFxuICAgIC8vIHdoaWNoIG9mIHRoZWlyIGtleXMgaXMgYmVpbmcgdGFsa2VkIGFib3V0LlxuICAgIGxldCBrZXlzQnlGaW5nZXJwcmludCA9IG5ldyBNYXA8c3RyaW5nLCBzdHJpbmc+KCk7XG4gICAgZm9yIChsZXQga2V5IG9mIGF3YWl0IHJlYWRSZXBvS2V5cyhyZXBvUGF0aCkuY2F0Y2goKCkgPT4gW10gYXMgc3RyaW5nW10pKSB7XG4gICAgICAgIGtleXNCeUZpbmdlcnByaW50LnNldChrZXlGaW5nZXJwcmludChrZXkpLCBrZXkpO1xuICAgIH1cbiAgICBsZXQgZGVzY3JpYmVLZXkgPSAocmV2b2NhdGlvbjogUmV2b2NhdGlvbikgPT4ge1xuICAgICAgICBsZXQga2V5ID0ga2V5c0J5RmluZ2VycHJpbnQuZ2V0KHJldm9jYXRpb24uZmluZ2VycHJpbnQpIHx8IHJldm9jYXRpb24ua2V5IHx8IFwiXCI7XG4gICAgICAgIHJldHVybiBrZXkgJiYgc3VtbWFyaXplS2V5KGtleSkgfHwgYGEga2V5IG5vIGxvbmdlciBpbiB0aGlzIHJlcG8gKCR7cmV2b2NhdGlvbi5maW5nZXJwcmludH0pYDtcbiAgICB9O1xuXG4gICAgbGV0IGFkZHJlc3Nlc0J5RmluZ2VycHJpbnQgPSBuZXcgTWFwPHN0cmluZywgc3RyaW5nW10+KCk7XG4gICAgZm9yIChsZXQgcmV2b2NhdGlvbiBvZiByZXZvY2F0aW9ucykge1xuICAgICAgICBsZXQgaXAgPSByZXZvY2F0aW9uSVAocmV2b2NhdGlvbik7XG4gICAgICAgIGxldCBleGlzdGluZyA9IGFkZHJlc3Nlc0J5RmluZ2VycHJpbnQuZ2V0KHJldm9jYXRpb24uZmluZ2VycHJpbnQpIHx8IFtdO1xuICAgICAgICBpZiAoaXAgJiYgIWV4aXN0aW5nLmluY2x1ZGVzKGlwKSkge1xuICAgICAgICAgICAgZXhpc3RpbmcucHVzaChpcCk7XG4gICAgICAgIH1cbiAgICAgICAgYWRkcmVzc2VzQnlGaW5nZXJwcmludC5zZXQocmV2b2NhdGlvbi5maW5nZXJwcmludCwgZXhpc3RpbmcpO1xuICAgIH1cblxuICAgIC8vIENhbmNlbGxpbmcgdGhlIHJldm9jYXRpb24gb24gaXRzIG93biB3b3VsZCBsZWF2ZSBzc2hkIHJlZnVzaW5nIHRoYXQgYWRkcmVzcyBhbmQgdGhlIG1hY2hpbmVzXG4gICAgLy8gcmV2b2tpbmcgdGhlIGtleSBhbGwgb3ZlciBhZ2Fpbiwgc28gdGhlIGFkZHJlc3NlcyBnbyBpbnRvIHRoZSBrZXkncyBmcm9tPSBoZXJlLiBXZSBhcmUgaW5cbiAgICAvLyB0aGUgcmVwbyB0aGF0IG93bnMgYXV0aG9yaXplZF9rZXlzLCBzbyB0aGVyZSBpcyBub3RoaW5nIHRvIGhhbmQgYmFjayB0byB3aG9ldmVyIHJhbiB0aGlzLlxuICAgIGxldCBhZGRlZCA9IGF3YWl0IGFsbG93QWRkcmVzc2VzSW5SZXBvKHsgcmVwb1BhdGgsIGFkZHJlc3Nlc0J5RmluZ2VycHJpbnQgfSk7XG5cbiAgICBjb25zb2xlLmxvZyhcIlwiKTtcbiAgICBmb3IgKGxldCBbZmluZ2VycHJpbnQsIGFkZHJlc3Nlc10gb2YgYWRkcmVzc2VzQnlGaW5nZXJwcmludCkge1xuICAgICAgICBsZXQgcmV2b2NhdGlvbiA9IHJldm9jYXRpb25zLmZpbmQoZW50cnkgPT4gZW50cnkuZmluZ2VycHJpbnQgPT09IGZpbmdlcnByaW50KSE7XG4gICAgICAgIGNvbnNvbGUubG9nKGBVbmZyZWV6aW5nICR7ZGVzY3JpYmVLZXkocmV2b2NhdGlvbil9YCk7XG4gICAgICAgIGNvbnNvbGUubG9nKGBBbGxvd2luZyBJUCAke2FkZHJlc3Nlcy5qb2luKFwiLCBcIikgfHwgXCIobm8gYWRkcmVzcyByZWNvcmRlZClcIn1gKTtcbiAgICAgICAgbGV0IGFkZGVkSGVyZSA9IGFkZGVkLmdldChmaW5nZXJwcmludCkgfHwgW107XG4gICAgICAgIGlmIChhZGRlZEhlcmUubGVuZ3RoKSB7XG4gICAgICAgICAgICBjb25zb2xlLmxvZyhgICBhZGRlZCB0byB0aGF0IGtleSdzIGZyb209IGxpc3QgaW4gYXV0aG9yaXplZF9rZXlzOiAke2FkZGVkSGVyZS5qb2luKFwiLCBcIil9YCk7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgICBjb25zb2xlLmxvZyhgICB0aGF0IGtleSdzIGZyb209IGxpc3QgYWxyZWFkeSBhbGxvd2VkICR7YWRkcmVzc2VzLmpvaW4oXCIsIFwiKSA/IFwidGhlbVwiIDogXCJldmVyeXRoaW5nXCJ9YCk7XG4gICAgICAgIH1cbiAgICAgICAgZm9yIChsZXQgZW50cnkgb2YgcmV2b2NhdGlvbnMuZmlsdGVyKGVudHJ5ID0+IGVudHJ5LmZpbmdlcnByaW50ID09PSBmaW5nZXJwcmludCkpIHtcbiAgICAgICAgICAgIGNvbnNvbGUubG9nKFxuICAgICAgICAgICAgICAgIGAgIGZyb3plbiBieSAke2VudHJ5LnJldm9rZWRCeSB8fCBcIj9cIn0gJHtlbnRyeS5yZXZva2VkQXQgfHwgXCJhdCBhbiB1bnJlY29yZGVkIHRpbWVcIn1gXG4gICAgICAgICAgICApO1xuICAgICAgICB9XG4gICAgICAgIGNvbnNvbGUubG9nKFwiXCIpO1xuICAgIH1cbiAgICBjb25zb2xlLmxvZyhgRXZlcnkgb3RoZXIgYWRkcmVzcyBzdGF5cyBmcm96ZW4sIGFuZCBvbmUgb2YgdGhlc2Uga2V5cyB1c2VkIGZyb20gYW55d2hlcmUgZWxzZWApO1xuICAgIGNvbnNvbGUubG9nKGBpcyBmcm96ZW4gYWdhaW4uYCk7XG5cbiAgICAvLyBTaWduZWQgaGVyZSByYXRoZXIgdGhhbiBsZWZ0IGFzIGEgc3RlcCB0byByZW1lbWJlci4gQW4gdW5yZXZva2Ugbm9ib2R5IHNpZ25lZCBkb2VzIG5vdGhpbmcgYXRcbiAgICAvLyBhbGwsIGFuZCB0aGUgcmVwbyB3b3VsZCBzaXQgdGhlcmUgbG9va2luZyBkb25lIHdoaWxlIGV2ZXJ5IG1hY2hpbmUgaWdub3JlZCBpdC5cbiAgICBhd2FpdCBzaWduUmVwbyh7IHJlcG9QYXRoIH0pO1xuXG4gICAgaWYgKCFwdXNoVG9HaXQpIHtcbiAgICAgICAgY29uc29sZS5sb2coYFxcbkNvbW1pdCBhbmQgcHVzaCBpdCwgYW5kIGVhY2ggbWFjaGluZSB3aWxsIHdhaXQgYW4gaG91ciBhZnRlciBzZWVpbmcgaXQgYmVmb3JlYCk7XG4gICAgICAgIGNvbnNvbGUubG9nKGB0aG9zZSBrZXlzIHdvcmsgYWdhaW46YCk7XG4gICAgICAgIGNvbnNvbGUubG9nKGBcXGBcXGBcXGBcXG5naXQgYWRkIC1BXFxuZ2l0IGNvbW1pdCAtbSBcIiR7Q09NTUlUX01FU1NBR0V9XCJcXG5naXQgcHVzaFxcblxcYFxcYFxcYGApO1xuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIGF3YWl0IHJ1blByb21pc2UoYGdpdCBhZGQgLUFgLCB7IGN3ZDogcmVwb1BhdGggfSk7XG4gICAgYXdhaXQgcnVuUHJvbWlzZShgZ2l0IGNvbW1pdCAtbSBcIiR7Q09NTUlUX01FU1NBR0V9XCJgLCB7IGN3ZDogcmVwb1BhdGggfSk7XG4gICAgYXdhaXQgcnVuUHJvbWlzZShgZ2l0IHB1c2hgLCB7IGN3ZDogcmVwb1BhdGggfSk7XG4gICAgY29uc29sZS5sb2coYFxcbkNvbW1pdHRlZCBhbmQgcHVzaGVkLiBFYWNoIG1hY2hpbmUgd2FpdHMgYW4gaG91ciBhZnRlciBzZWVpbmcgaXQgYmVmb3JlIHRob3NlYCk7XG4gICAgY29uc29sZS5sb2coYGtleXMgd29yayBhZ2Fpbi5gKTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "9b90ba359ba9cd1b6be2a54ba85a896c0ebcf4bac2b38be51f7d4886cdc1820e"; */

package/security/authorizedKeys/secureSSH.ts

@@ -449,6 +449,31 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
         console.log(`${describeHost(host)} already has ${repoURL}, refreshing its key and the daemon.`);
     }
 
+    // Copied into place before anything else needs it. The checks below look this source's key up
+    // where the machine keeps it, not at the path it was handed on the command line, so a key that
+    // is still only sitting in the caller's directory reads as no key at all.
+    //
+    // Into the home of whoever the daemon runs as, which is where it looks. Asked of the host
+    // rather than worked out here: this may be running on a machine with no such user, and with a
+    // home directory in an entirely different shape.
+    let hostKeysDirectory = await daemonKeysDir(host);
+    await writeRemoteFile({
+        host,
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}`,
+        contents: await fs.readFile(keyPath, "utf8"),
+        fileMode: "600",
+        directoryMode: "700",
+    });
+    // The public half too, so the deploy key that a repo was given can be looked up on the machine
+    // using it, rather than only in whatever github shows.
+    await writeRemoteFile({
+        host,
+        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}.pub`,
+        contents: await publicKeyOf(keyPath),
+        fileMode: "644",
+        directoryMode: "700",
+    });
+
     // The merged result is what root ends up with, so our own key has to be somewhere in it. On
     // this machine there is no ssh session to preserve, so there is nothing to check.
     let ourFingerprint = "";
@@ -490,27 +515,6 @@ async function addSource(config: { host: string; keyPath: string; repoURL: strin
     let webhookURL = await requireRemoteWebhook(host);
     console.log(`${describeHost(host)} notifies ${webhookURL}`);
 
-    // Into the home of whoever the daemon runs as, which is where it looks. Asked of the host
-    // rather than worked out here: this may be running on a machine with no such user, and with a
-    // home directory in an entirely different shape.
-    let hostKeysDirectory = await daemonKeysDir(host);
-    await writeRemoteFile({
-        host,
-        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}`,
-        contents: await fs.readFile(keyPath, "utf8"),
-        fileMode: "600",
-        directoryMode: "700",
-    });
-    // The public half too, so the deploy key that a repo was given can be looked up on the machine
-    // using it, rather than only in whatever github shows.
-    await writeRemoteFile({
-        host,
-        filePath: `${hostKeysDirectory}/${sourceName(repoURL)}.pub`,
-        contents: await publicKeyOf(keyPath),
-        fileMode: "644",
-        directoryMode: "700",
-    });
-
     let repoSources = remoteConfig.repoSources.filter(source => source !== repoURL);
     repoSources.push(repoURL);
     await installDaemon({ host, hostLabel: remoteConfig.hostLabel, repoSources });
@@ -637,7 +641,21 @@ function parseArgs(argv: string[]) {
     return { verb, host, rest: positional };
 }
 
+/** Everything here is root's: root's authorized_keys, root's keys directory, the sshd config, the
+    systemd unit. Run as anyone else it reads a different home and writes files the daemon will
+    never see, and it gets there several steps in rather than failing at the start. */
+function requireRoot() {
+    let uid = process.getuid?.();
+    if (uid !== 0) {
+        throw new Error(
+            `Expected to be running as root, is uid ${uid ?? "unknown"}.\n`
+            + `Rerun this with sudo.`
+        );
+    }
+}
+
 export async function main() {
+    requireRoot();
     let { verb, host, rest } = parseArgs(process.argv.slice(2));
 
     if (verb === "list") {

package/security/authorizedKeys/unrevoke.ts

@@ -2,13 +2,14 @@ import fs from "fs/promises";
 import os from "os";
 import path from "path";
 import { runPromise } from "socket-function/src/runPromise";
-import { keyFingerprint, normalizeKeys } from "./authorizedKeys";
+import { allowAddresses, keyFingerprint, normalizeKeys, summarizeKey } from "./authorizedKeys";
 import { deriveRevokeKey, revokeRepoURL } from "./revokeSource";
 import { findSourceKey } from "./sources";
 import { signRepo } from "../signedFiles/signFiles";
 import { readRepoKeys } from "./authorizedKeys";
 import { expandHome } from "../helpers/paths";
 import { spawnPromise } from "../helpers/spawn";
+import { machineState } from "../machines/machines";
 
 const UNREVOKES_DIR = "unrevoked";
 const REVOCATIONS_DIR = "revocations";
@@ -23,15 +24,35 @@ passes. It signs the result, and with ${GIT_KEYWORD} it commits and pushes it to
 Keys that were revoked should normally be deleted from the repo instead. Unrevoking only matters
 for a key you still want.`;
 
+/** One revocation event. Either an ssh key used from an address it is not allowed from, or a
+    machine that talked to us from one. Both are the same shape - an identity and an address - and
+    an unrevoke undoes either by allowing that same pair.
+
+    Which is why unrevoking never makes anything unrevokable: used from some other address, it is
+    revoked again, under a new id no existing unrevoke names. */
 export type Revocation = {
     revocationId: string;
-    fingerprint: string;
+    // Exactly one of these. A key revocation names a fingerprint, a machine revocation a machineId.
+    fingerprint?: string;
+    machineId?: string;
+    ip?: string;
     key?: string;
     revokedAt?: string;
     revokedBy?: string;
+    reason?: string;
     attempt?: { ip?: string; user?: string; required?: string };
 };
 
+/** Older revocation files carry the address under attempt only. */
+export function revocationIP(revocation: Revocation) {
+    return revocation.ip || revocation.attempt?.ip || "";
+}
+
+/** What the revocation is about, which is what an unrevoke has to name to undo it. */
+export function revocationIdentity(revocation: Revocation) {
+    return revocation.fingerprint || revocation.machineId || "";
+}
+
 /** Every revocation the revoke repo lists. Cloned read only into a temp directory.
 
     A person running this has their own access to the repo, so their credentials are what is used.
@@ -86,6 +107,10 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
                 continue;
             }
             let parsed = JSON.parse(await fs.readFile(path.join(directory, name), "utf8"));
+            for (let allowed of parsed.allowed || []) {
+                unrevoked.add(`${allowed.fingerprint || allowed.machineId} ${allowed.ip}`);
+            }
+            // Named ids, for the unrevokes written before this was about pairs.
             for (let revocationId of parsed.revocationIds || []) {
                 unrevoked.add(revocationId);
             }
@@ -93,13 +118,84 @@ export async function revokedKeysInRepo(config: { repoPath: string; sourceURL: s
     } catch (e) {
         // Nothing has been unrevoked.
     }
-    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId));
+    let stillRevoked = revocations.filter(revocation => !unrevoked.has(revocation.revocationId)
+        && !unrevoked.has(`${revocation.fingerprint} ${revocationIP(revocation)}`));
     let keys = normalizeKeys(await fs.readFile(path.join(repoPath, "authorized_keys"), "utf8").catch(() => ""));
     return stillRevoked
         .filter(revocation => keys.some(key => keyFingerprint(key) === revocation.fingerprint))
         .map(revocation => ({ revocation, key: keys.find(key => keyFingerprint(key) === revocation.fingerprint) || "" }));
 }
 
+/** Writes the addresses into the from= list of each key in the repo's authorized_keys, and says
+    which ones were actually new. Only the lines being changed are touched, so comments, ordering
+    and any key not involved come out of this byte for byte the same. */
+async function allowAddressesInRepo(config: {
+    repoPath: string;
+    addressesByFingerprint: Map<string, string[]>;
+}) {
+    let { repoPath, addressesByFingerprint } = config;
+    let added = new Map<string, string[]>();
+    let filePath = path.join(repoPath, "authorized_keys");
+    let contents;
+    try {
+        contents = await fs.readFile(filePath, "utf8");
+    } catch (e) {
+        // A repo holding its keys as separate .pub files. Nothing to edit in one place, so the
+        // caller's listing is all whoever ran this gets.
+        console.log(`No authorized_keys in ${repoPath}, so the addresses were not added to any key.`);
+        return added;
+    }
+    let lines = contents.split("\n");
+    for (let index = 0; index < lines.length; index++) {
+        let fingerprint = keyFingerprint(lines[index]);
+        let addresses = fingerprint && addressesByFingerprint.get(fingerprint);
+        if (!addresses || !addresses.length) {
+            continue;
+        }
+        let result = allowAddresses(lines[index], addresses);
+        lines[index] = result.keyLine;
+        added.set(fingerprint, [...(added.get(fingerprint) || []), ...result.added]);
+    }
+    if ([...added.values()].some(list => list.length)) {
+        await fs.writeFile(filePath, lines.join("\n"));
+    }
+    return added;
+}
+
+/** Puts each machine's addresses back into its own file, which is the machine equivalent of adding
+    an address to a key's from= list: without it the machine is allowed again in principle and
+    still rejected on sight, which revokes it once more. */
+async function allowAddressesForMachines(config: { repoPath: string; revocations: Revocation[] }) {
+    let { repoPath, revocations } = config;
+    let added = new Map<string, string[]>();
+    // Read the whole list, change what these revocations are about, write it back. Setting is by
+    // the whole set, so writing one machine at a time would delete every other machine.
+    let machines = await machineState({ repoPath });
+    for (let revocation of revocations) {
+        let machineId = revocation.machineId;
+        let ip = revocationIP(revocation);
+        if (!machineId || !ip) {
+            continue;
+        }
+        let existing = machines.find(machine => machine.machineId === machineId);
+        if (!existing) {
+            // Removed from the repo since it was revoked, so there is nothing to allow. Deleting a
+            // machine is the stronger statement and it stands.
+            console.log(`machines/${machineId}.json is not in this repo, so ${ip} was not added to it`);
+            continue;
+        }
+        if (existing.ips.includes(ip)) {
+            continue;
+        }
+        existing.ips = [...existing.ips, ip];
+        added.set(machineId, [...(added.get(machineId) || []), ip]);
+    }
+    if (added.size) {
+        await machineState({ repoPath, machines });
+    }
+    return added;
+}
+
 /** The repo named, or the one we are standing in. Checked the same way securessh checks it: a git
     repo that actually holds keys and has an origin to clone from. */
 async function resolveKeysRepo(named: string | undefined) {
@@ -149,22 +245,77 @@ export async function main() {
     await fs.writeFile(path.join(directory, `${unrevokeId}.json`), JSON.stringify({
         unrevokeId,
         createdAt: new Date().toISOString(),
-        // Named one by one rather than as a blanket "allow everything again", so this file only
-        // ever undoes the revocations that existed when it was written.
-        revocationIds: revocations.map(revocation => revocation.revocationId),
+        // What this file says: each of these keys is allowed from this address. Pairs, not keys,
+        // and not a blanket "allow everything again" - a key forgiven here for one address is
+        // still revoked the moment it is used from another.
+        allowed: revocations.map(revocation => ({
+            fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
+        })),
         revocations: revocations.map(revocation => ({
             revocationId: revocation.revocationId,
             fingerprint: revocation.fingerprint,
+            machineId: revocation.machineId,
+            ip: revocationIP(revocation),
             revokedAt: revocation.revokedAt,
             revokedBy: revocation.revokedBy,
             attempt: revocation.attempt,
         })),
     }, undefined, 4) + "\n");
 
-    console.log(`Wrote ${UNREVOKES_DIR}/${unrevokeId}.json covering ${revocations.length} revocation(s):`);
+    // Named the way the notifications name them. A fingerprint is not in authorized_keys and
+    // cannot be worked out by eye, so on its own it tells whoever is reading this nothing about
+    // which of their keys is being talked about.
+    let keysByFingerprint = new Map<string, string>();
+    for (let key of await readRepoKeys(repoPath).catch(() => [] as string[])) {
+        keysByFingerprint.set(keyFingerprint(key), key);
+    }
+    let describeKey = (revocation: Revocation) => {
+        let key = keysByFingerprint.get(revocation.fingerprint || "") || revocation.key || "";
+        return key && summarizeKey(key) || `a key no longer in this repo (${revocation.fingerprint})`;
+    };
+
+    let addressesByIdentity = new Map<string, string[]>();
     for (let revocation of revocations) {
-        console.log(`  ${revocation.fingerprint} revoked by ${revocation.revokedBy || "?"} from ${revocation.attempt?.ip || "?"}`);
+        let ip = revocationIP(revocation);
+        let identity = revocationIdentity(revocation);
+        let existing = addressesByIdentity.get(identity) || [];
+        if (ip && !existing.includes(ip)) {
+            existing.push(ip);
+        }
+        addressesByIdentity.set(identity, existing);
+    }
+
+    // Cancelling the revocation on its own would leave sshd refusing that address, and the machines
+    // revoking all over again, so the addresses go into the key's from= list and into the machine's
+    // own file here. We are in the repo that owns both, so there is nothing to hand back to whoever
+    // ran this.
+    let added = await allowAddressesInRepo({ repoPath, addressesByFingerprint: addressesByIdentity });
+    let addedForMachines = await allowAddressesForMachines({ repoPath, revocations });
+
+    console.log("");
+    for (let [identity, addresses] of addressesByIdentity) {
+        let entries = revocations.filter(entry => revocationIdentity(entry) === identity);
+        let machineId = entries[0].machineId;
+        console.log(`Unfreezing ${machineId && `machine ${machineId}` || describeKey(entries[0])}`);
+        console.log(`Allowing IP ${addresses.join(", ") || "(no address recorded)"}`);
+        let addedHere = machineId && addedForMachines.get(machineId) || added.get(identity) || [];
+        if (addedHere.length) {
+            let where = machineId && `machines/${machineId}.json` || `that key's from= list in authorized_keys`;
+            console.log(`  added to ${where}: ${addedHere.join(", ")}`);
+        } else {
+            console.log(`  already allowed from ${addresses.join(", ") || "everywhere"}`);
+        }
+        for (let entry of entries) {
+            console.log(
+                `  frozen by ${entry.revokedBy || "?"} ${entry.revokedAt || "at an unrecorded time"}`
+            );
+        }
+        console.log("");
     }
+    console.log(`Every other address stays frozen, and any of these used from anywhere else is`);
+    console.log(`frozen again.`);
 
     // Signed here rather than left as a step to remember. An unrevoke nobody signed does nothing at
     // all, and the repo would sit there looking done while every machine ignored it.