sliftutils 1.7.128 → 1.7.129

package/security/helpers/dist/remoteSSH.ts.cache

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.SUDO_PREAMBLE = void 0;
+//exports.remoteCommandExists = exports.writeRemoteFile = exports.readRemoteFile = exports.runOverSSH = exports.describeHost = exports.THIS_MACHINE = exports.SUDO_PREAMBLE = void 0;
 const spawn_1 = require("./spawn");
 const SSH_CONNECT_TIMEOUT = 10;
 const EXISTS_MARKER = "__PORTSECURE_EXISTS__";
@@ -8,27 +8,37 @@ const MISSING_MARKER = "__PORTSECURE_MISSING__";
 const MAX_ERROR_BODY_LENGTH = 500;
 // /etc is root owned, so fall back to sudo whenever the SSH user is not root.
 exports.SUDO_PREAMBLE = `SUDO=""; if [ "$(id -u)" -ne 0 ]; then SUDO="sudo -n"; fi`;
+/** No host means this machine, so the very same script runs with nothing in front of it. Local and
+    remote then do exactly the same thing, rather than being two pieces of code that have to be kept
+    saying the same thing. */
+exports.THIS_MACHINE = "";
+function describeHost(host) {
+    return host || "this machine";
+}
+exports.describeHost = describeHost;
 /** The host string is handed to ssh untouched. Users, keys and ports belong in the caller's ssh
     config, so BatchMode makes a missing setup fail immediately instead of prompting. */
 async function runOverSSH(config) {
     let { host, script, input, allowFailure } = config;
     let result = await (0, spawn_1.spawnPromise)({
-        command: "ssh",
-        args: [
+        command: host && "ssh" || "sh",
+        args: host && [
             "-o", "BatchMode=yes",
             "-o", `ConnectTimeout=${SSH_CONNECT_TIMEOUT}`,
             host,
             script,
-        ],
+        ] || ["-c", script],
         input,
         inheritStderr: !allowFailure,
     });
     if (result.error) {
-        throw new Error(`Expected ssh to run against ${host}, failed with ${result.error.message}`);
+        throw new Error(`Expected to run against ${describeHost(host)}, failed with ${result.error.message}`);
     }
     if (result.status !== 0 && !allowFailure) {
-        throw new Error(`Expected ssh to ${host} to exit 0, was ${result.status}.`
-            + ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.\n`
+        let advice = host
+            && ` Non-interactive ssh access to ${host} has to work on its own - fix it in your ssh config.`
+            || "";
+        throw new Error(`Expected the script on ${describeHost(host)} to exit 0, was ${result.status}.${advice}\n`
             + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`);
     }
     return { stdout: result.stdout || "", stderr: result.stderr || "", status: result.status };
@@ -86,5 +96,5 @@ async function remoteCommandExists(config) {
     return result.stdout.trim() === "yes";
 }
 exports.remoteCommandExists = remoteCommandExists;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7d0ZBQ3dGO0FBQ2pGLEtBQUssVUFBVSxVQUFVLENBQUMsTUFBZ0Y7SUFDN0csSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRCxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQztRQUM1QixPQUFPLEVBQUUsS0FBSztRQUNkLElBQUksRUFBRTtZQUNGLElBQUksRUFBRSxlQUFlO1lBQ3JCLElBQUksRUFBRSxrQkFBa0IsbUJBQW1CLEVBQUU7WUFDN0MsSUFBSTtZQUNKLE1BQU07U0FDVDtRQUNELEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsSUFBSSxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxtQkFBbUIsSUFBSSxtQkFBbUIsTUFBTSxDQUFDLE1BQU0sR0FBRztjQUN4RCxrQ0FBa0MsSUFBSSx3REFBd0Q7Y0FDOUYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUNoRixDQUFDO0lBQ04sQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDL0YsQ0FBQztBQXhCRCxnQ0F3QkM7QUFFRDtpQkFDaUI7QUFDVixLQUFLLFVBQVUsY0FBYyxDQUFDLE1BQTBDO0lBQzNFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2hDLElBQUksTUFBTSxHQUFHLENBQUMsTUFBTSxVQUFVLENBQUM7UUFDM0IsSUFBSTtRQUNKLE1BQU0sRUFBRSxHQUFHLHFCQUFhO29CQUNaLFFBQVE7WUFDaEIsYUFBYTtpQkFDUixRQUFROztZQUViLGNBQWM7R0FDdkI7S0FDRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDWCxJQUFJLFlBQVksR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLElBQUksTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xELElBQUksTUFBTSxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxJQUFJLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksYUFBYSxPQUFPLGNBQWMsU0FBUyxJQUFJLFNBQVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEksQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDMUMsQ0FBQztBQXJCRCx3Q0FxQkM7QUFFTSxLQUFLLFVBQVUsZUFBZSxDQUFDLE1BTXJDO0lBQ0csSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkUsSUFBSSxTQUFTLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdELE1BQU0sVUFBVSxDQUFDO1FBQ2IsSUFBSTtRQUNKLHNGQUFzRjtRQUN0RixrREFBa0Q7UUFDbEQsS0FBSyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQztRQUN0QyxNQUFNLEVBQUUsR0FBRyxxQkFBYTs7a0JBRWQsU0FBUztjQUNiLGFBQWEsS0FBSyxTQUFTO2FBQzVCLFFBQVE7Y0FDUCxRQUFRLEtBQUssUUFBUSxHQUFHO0tBQ2pDLENBQUMsQ0FBQztBQUNQLENBQUM7QUFyQkQsMENBcUJDO0FBRU0sS0FBSyxVQUFVLG1CQUFtQixDQUFDLE1BQXlDO0lBQy9FLElBQUksRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQy9CLElBQUksTUFBTSxHQUFHLE1BQU0sVUFBVSxDQUFDO1FBQzFCLElBQUk7UUFDSixNQUFNLEVBQUUsZUFBZSxPQUFPLDJDQUEyQztRQUN6RSxZQUFZLEVBQUUsSUFBSTtLQUNyQixDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssS0FBSyxDQUFDO0FBQzFDLENBQUM7QUFSRCxrREFRQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IHNwYXduUHJvbWlzZSB9IGZyb20gXCIuL3NwYXduXCI7XG5cbmNvbnN0IFNTSF9DT05ORUNUX1RJTUVPVVQgPSAxMDtcbmNvbnN0IEVYSVNUU19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9FWElTVFNfX1wiO1xuY29uc3QgTUlTU0lOR19NQVJLRVIgPSBcIl9fUE9SVFNFQ1VSRV9NSVNTSU5HX19cIjtcbmNvbnN0IE1BWF9FUlJPUl9CT0RZX0xFTkdUSCA9IDUwMDtcblxuLy8gL2V0YyBpcyByb290IG93bmVkLCBzbyBmYWxsIGJhY2sgdG8gc3VkbyB3aGVuZXZlciB0aGUgU1NIIHVzZXIgaXMgbm90IHJvb3QuXG5leHBvcnQgY29uc3QgU1VET19QUkVBTUJMRSA9IGBTVURPPVwiXCI7IGlmIFsgXCIkKGlkIC11KVwiIC1uZSAwIF07IHRoZW4gU1VETz1cInN1ZG8gLW5cIjsgZmlgO1xuXG4vKiogVGhlIGhvc3Qgc3RyaW5nIGlzIGhhbmRlZCB0byBzc2ggdW50b3VjaGVkLiBVc2Vycywga2V5cyBhbmQgcG9ydHMgYmVsb25nIGluIHRoZSBjYWxsZXIncyBzc2hcbiAgICBjb25maWcsIHNvIEJhdGNoTW9kZSBtYWtlcyBhIG1pc3Npbmcgc2V0dXAgZmFpbCBpbW1lZGlhdGVseSBpbnN0ZWFkIG9mIHByb21wdGluZy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBydW5PdmVyU1NIKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IHNjcmlwdDogc3RyaW5nOyBpbnB1dD86IHN0cmluZzsgYWxsb3dGYWlsdXJlPzogYm9vbGVhbiB9KSB7XG4gICAgbGV0IHsgaG9zdCwgc2NyaXB0LCBpbnB1dCwgYWxsb3dGYWlsdXJlIH0gPSBjb25maWc7XG4gICAgbGV0IHJlc3VsdCA9IGF3YWl0IHNwYXduUHJvbWlzZSh7XG4gICAgICAgIGNvbW1hbmQ6IFwic3NoXCIsXG4gICAgICAgIGFyZ3M6IFtcbiAgICAgICAgICAgIFwiLW9cIiwgXCJCYXRjaE1vZGU9eWVzXCIsXG4gICAgICAgICAgICBcIi1vXCIsIGBDb25uZWN0VGltZW91dD0ke1NTSF9DT05ORUNUX1RJTUVPVVR9YCxcbiAgICAgICAgICAgIGhvc3QsXG4gICAgICAgICAgICBzY3JpcHQsXG4gICAgICAgIF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBzc2ggdG8gcnVuIGFnYWluc3QgJHtob3N0fSwgZmFpbGVkIHdpdGggJHtyZXN1bHQuZXJyb3IubWVzc2FnZX1gKTtcbiAgICB9XG4gICAgaWYgKHJlc3VsdC5zdGF0dXMgIT09IDAgJiYgIWFsbG93RmFpbHVyZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgc3NoIHRvICR7aG9zdH0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS5gXG4gICAgICAgICAgICArIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
- /* _JS_SOURCE_HASH = "b9707fe65376e19327371edb2ebdda68daa9b9b21220d7ac91ec21ef22520290"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlU1NILmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmVtb3RlU1NILnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUF1QztBQUV2QyxNQUFNLG1CQUFtQixHQUFHLEVBQUUsQ0FBQztBQUMvQixNQUFNLGFBQWEsR0FBRyx1QkFBdUIsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztBQUNoRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUVsQyw4RUFBOEU7QUFDakUsUUFBQSxhQUFhLEdBQUcsMkRBQTJELENBQUM7QUFFekY7OzZCQUU2QjtBQUNoQixRQUFBLFlBQVksR0FBRyxFQUFFLENBQUM7QUFFL0IsU0FBZ0IsWUFBWSxDQUFDLElBQVk7SUFDckMsT0FBTyxJQUFJLElBQUksY0FBYyxDQUFDO0FBQ2xDLENBQUM7QUFGRCxvQ0FFQztBQUVEO3dGQUN3RjtBQUNqRixLQUFLLFVBQVUsVUFBVSxDQUFDLE1BQWdGO0lBQzdHLElBQUksRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDbkQsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFBLG9CQUFZLEVBQUM7UUFDNUIsT0FBTyxFQUFFLElBQUksSUFBSSxLQUFLLElBQUksSUFBSTtRQUM5QixJQUFJLEVBQUUsSUFBSSxJQUFJO1lBQ1YsSUFBSSxFQUFFLGVBQWU7WUFDckIsSUFBSSxFQUFFLGtCQUFrQixtQkFBbUIsRUFBRTtZQUM3QyxJQUFJO1lBQ0osTUFBTTtTQUNULElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDO1FBQ25CLEtBQUs7UUFDTCxhQUFhLEVBQUUsQ0FBQyxZQUFZO0tBQy9CLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsWUFBWSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkMsSUFBSSxNQUFNLEdBQUcsSUFBSTtlQUNWLGtDQUFrQyxJQUFJLHNEQUFzRDtlQUM1RixFQUFFLENBQUM7UUFDVixNQUFNLElBQUksS0FBSyxDQUNYLDBCQUEwQixZQUFZLENBQUMsSUFBSSxDQUFDLG1CQUFtQixNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sSUFBSTtjQUN4RixHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUUsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUMvRixDQUFDO0FBMUJELGdDQTBCQztBQUVEO2lCQUNpQjtBQUNWLEtBQUssVUFBVSxjQUFjLENBQUMsTUFBMEM7SUFDM0UsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDaEMsSUFBSSxNQUFNLEdBQUcsQ0FBQyxNQUFNLFVBQVUsQ0FBQztRQUMzQixJQUFJO1FBQ0osTUFBTSxFQUFFLEdBQUcscUJBQWE7b0JBQ1osUUFBUTtZQUNoQixhQUFhO2lCQUNSLFFBQVE7O1lBRWIsY0FBYztHQUN2QjtLQUNFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUNYLElBQUksWUFBWSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEMsSUFBSSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDbEQsSUFBSSxNQUFNLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDNUIsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELElBQUksTUFBTSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxhQUFhLE9BQU8sY0FBYyxTQUFTLElBQUksU0FBUyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNsSSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLFlBQVksR0FBRyxDQUFDLENBQUMsQ0FBQztBQUMxQyxDQUFDO0FBckJELHdDQXFCQztBQUVNLEtBQUssVUFBVSxlQUFlLENBQUMsTUFNckM7SUFDRyxJQUFJLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNuRSxJQUFJLFNBQVMsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxRQUFRLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsTUFBTSxVQUFVLENBQUM7UUFDYixJQUFJO1FBQ0osc0ZBQXNGO1FBQ3RGLGtEQUFrRDtRQUNsRCxLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDO1FBQ3RDLE1BQU0sRUFBRSxHQUFHLHFCQUFhOztrQkFFZCxTQUFTO2NBQ2IsYUFBYSxLQUFLLFNBQVM7YUFDNUIsUUFBUTtjQUNQLFFBQVEsS0FBSyxRQUFRLEdBQUc7S0FDakMsQ0FBQyxDQUFDO0FBQ1AsQ0FBQztBQXJCRCwwQ0FxQkM7QUFFTSxLQUFLLFVBQVUsbUJBQW1CLENBQUMsTUFBeUM7SUFDL0UsSUFBSSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDL0IsSUFBSSxNQUFNLEdBQUcsTUFBTSxVQUFVLENBQUM7UUFDMUIsSUFBSTtRQUNKLE1BQU0sRUFBRSxlQUFlLE9BQU8sMkNBQTJDO1FBQ3pFLFlBQVksRUFBRSxJQUFJO0tBQ3JCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLENBQUM7QUFDMUMsQ0FBQztBQVJELGtEQVFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4vc3Bhd25cIjtcblxuY29uc3QgU1NIX0NPTk5FQ1RfVElNRU9VVCA9IDEwO1xuY29uc3QgRVhJU1RTX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX0VYSVNUU19fXCI7XG5jb25zdCBNSVNTSU5HX01BUktFUiA9IFwiX19QT1JUU0VDVVJFX01JU1NJTkdfX1wiO1xuY29uc3QgTUFYX0VSUk9SX0JPRFlfTEVOR1RIID0gNTAwO1xuXG4vLyAvZXRjIGlzIHJvb3Qgb3duZWQsIHNvIGZhbGwgYmFjayB0byBzdWRvIHdoZW5ldmVyIHRoZSBTU0ggdXNlciBpcyBub3Qgcm9vdC5cbmV4cG9ydCBjb25zdCBTVURPX1BSRUFNQkxFID0gYFNVRE89XCJcIjsgaWYgWyBcIiQoaWQgLXUpXCIgLW5lIDAgXTsgdGhlbiBTVURPPVwic3VkbyAtblwiOyBmaWA7XG5cbi8qKiBObyBob3N0IG1lYW5zIHRoaXMgbWFjaGluZSwgc28gdGhlIHZlcnkgc2FtZSBzY3JpcHQgcnVucyB3aXRoIG5vdGhpbmcgaW4gZnJvbnQgb2YgaXQuIExvY2FsIGFuZFxuICAgIHJlbW90ZSB0aGVuIGRvIGV4YWN0bHkgdGhlIHNhbWUgdGhpbmcsIHJhdGhlciB0aGFuIGJlaW5nIHR3byBwaWVjZXMgb2YgY29kZSB0aGF0IGhhdmUgdG8gYmUga2VwdFxuICAgIHNheWluZyB0aGUgc2FtZSB0aGluZy4gKi9cbmV4cG9ydCBjb25zdCBUSElTX01BQ0hJTkUgPSBcIlwiO1xuXG5leHBvcnQgZnVuY3Rpb24gZGVzY3JpYmVIb3N0KGhvc3Q6IHN0cmluZykge1xuICAgIHJldHVybiBob3N0IHx8IFwidGhpcyBtYWNoaW5lXCI7XG59XG5cbi8qKiBUaGUgaG9zdCBzdHJpbmcgaXMgaGFuZGVkIHRvIHNzaCB1bnRvdWNoZWQuIFVzZXJzLCBrZXlzIGFuZCBwb3J0cyBiZWxvbmcgaW4gdGhlIGNhbGxlcidzIHNzaFxuICAgIGNvbmZpZywgc28gQmF0Y2hNb2RlIG1ha2VzIGEgbWlzc2luZyBzZXR1cCBmYWlsIGltbWVkaWF0ZWx5IGluc3RlYWQgb2YgcHJvbXB0aW5nLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJ1bk92ZXJTU0goY29uZmlnOiB7IGhvc3Q6IHN0cmluZzsgc2NyaXB0OiBzdHJpbmc7IGlucHV0Pzogc3RyaW5nOyBhbGxvd0ZhaWx1cmU/OiBib29sZWFuIH0pIHtcbiAgICBsZXQgeyBob3N0LCBzY3JpcHQsIGlucHV0LCBhbGxvd0ZhaWx1cmUgfSA9IGNvbmZpZztcbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogaG9zdCAmJiBcInNzaFwiIHx8IFwic2hcIixcbiAgICAgICAgYXJnczogaG9zdCAmJiBbXG4gICAgICAgICAgICBcIi1vXCIsIFwiQmF0Y2hNb2RlPXllc1wiLFxuICAgICAgICAgICAgXCItb1wiLCBgQ29ubmVjdFRpbWVvdXQ9JHtTU0hfQ09OTkVDVF9USU1FT1VUfWAsXG4gICAgICAgICAgICBob3N0LFxuICAgICAgICAgICAgc2NyaXB0LFxuICAgICAgICBdIHx8IFtcIi1jXCIsIHNjcmlwdF0sXG4gICAgICAgIGlucHV0LFxuICAgICAgICBpbmhlcml0U3RkZXJyOiAhYWxsb3dGYWlsdXJlLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuZXJyb3IpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0byBydW4gYWdhaW5zdCAke2Rlc2NyaWJlSG9zdChob3N0KX0sIGZhaWxlZCB3aXRoICR7cmVzdWx0LmVycm9yLm1lc3NhZ2V9YCk7XG4gICAgfVxuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwICYmICFhbGxvd0ZhaWx1cmUpIHtcbiAgICAgICAgbGV0IGFkdmljZSA9IGhvc3RcbiAgICAgICAgICAgICYmIGAgTm9uLWludGVyYWN0aXZlIHNzaCBhY2Nlc3MgdG8gJHtob3N0fSBoYXMgdG8gd29yayBvbiBpdHMgb3duIC0gZml4IGl0IGluIHlvdXIgc3NoIGNvbmZpZy5gXG4gICAgICAgICAgICB8fCBcIlwiO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgdGhlIHNjcmlwdCBvbiAke2Rlc2NyaWJlSG9zdChob3N0KX0gdG8gZXhpdCAwLCB3YXMgJHtyZXN1bHQuc3RhdHVzfS4ke2FkdmljZX1cXG5gXG4gICAgICAgICAgICArIGAkeyhyZXN1bHQuc3Rkb3V0ICsgcmVzdWx0LnN0ZGVycikudHJpbSgpLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4geyBzdGRvdXQ6IHJlc3VsdC5zdGRvdXQgfHwgXCJcIiwgc3RkZXJyOiByZXN1bHQuc3RkZXJyIHx8IFwiXCIsIHN0YXR1czogcmVzdWx0LnN0YXR1cyB9O1xufVxuXG4vKiogUmV0dXJucyB1bmRlZmluZWQgd2hlbiB0aGUgZmlsZSBkb2VzIG5vdCBleGlzdCwgc28gYSBtaXNzaW5nIGZpbGUgcmVhZHMgZGlmZmVyZW50bHkgZnJvbSBhblxuICAgIGVtcHR5IG9uZS4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVtb3RlRmlsZShjb25maWc6IHsgaG9zdDogc3RyaW5nOyBmaWxlUGF0aDogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBmaWxlUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBvdXRwdXQgPSAoYXdhaXQgcnVuT3ZlclNTSCh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIHNjcmlwdDogYCR7U1VET19QUkVBTUJMRX1cbmlmICRTVURPIHRlc3QgLWYgXCIke2ZpbGVQYXRofVwiOyB0aGVuXG4gICAgZWNobyBcIiR7RVhJU1RTX01BUktFUn1cIlxuICAgICRTVURPIGNhdCBcIiR7ZmlsZVBhdGh9XCJcbmVsc2VcbiAgICBlY2hvIFwiJHtNSVNTSU5HX01BUktFUn1cIlxuZmlgLFxuICAgIH0pKS5zdGRvdXQ7XG4gICAgbGV0IG5ld2xpbmVJbmRleCA9IG91dHB1dC5pbmRleE9mKFwiXFxuXCIpO1xuICAgIGxldCBtYXJrZXIgPSBvdXRwdXQuc2xpY2UoMCwgbmV3bGluZUluZGV4KS50cmltKCk7XG4gICAgaWYgKG1hcmtlciA9PT0gTUlTU0lOR19NQVJLRVIpIHtcbiAgICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9XG4gICAgaWYgKG1hcmtlciAhPT0gRVhJU1RTX01BUktFUikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkICR7RVhJU1RTX01BUktFUn0gb3IgJHtNSVNTSU5HX01BUktFUn0gZnJvbSAke2hvc3R9LCB3YXMgJHtvdXRwdXQuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIG91dHB1dC5zbGljZShuZXdsaW5lSW5kZXggKyAxKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdyaXRlUmVtb3RlRmlsZShjb25maWc6IHtcbiAgICBob3N0OiBzdHJpbmc7XG4gICAgZmlsZVBhdGg6IHN0cmluZztcbiAgICBjb250ZW50czogc3RyaW5nO1xuICAgIGZpbGVNb2RlOiBzdHJpbmc7XG4gICAgZGlyZWN0b3J5TW9kZTogc3RyaW5nO1xufSkge1xuICAgIGxldCB7IGhvc3QsIGZpbGVQYXRoLCBjb250ZW50cywgZmlsZU1vZGUsIGRpcmVjdG9yeU1vZGUgfSA9IGNvbmZpZztcbiAgICBsZXQgZGlyZWN0b3J5ID0gZmlsZVBhdGguc2xpY2UoMCwgZmlsZVBhdGgubGFzdEluZGV4T2YoXCIvXCIpKTtcbiAgICBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgLy8gRGVwbG95aW5nIGZyb20gV2luZG93cyBtdXN0IG5vdCBjYXJyeSBDUkxGIG9udG8gdGhlIHRhcmdldCwgd2hlcmUgaXQgYnJlYWtzIHN5c3RlbWRcbiAgICAgICAgLy8gdW5pdHMgYW5kIG1ha2VzIHByaXZhdGUga2V5cyB1bnJlYWRhYmxlIHRvIHNzaC5cbiAgICAgICAgaW5wdXQ6IGNvbnRlbnRzLnJlcGxhY2UoL1xcclxcbi9nLCBcIlxcblwiKSxcbiAgICAgICAgc2NyaXB0OiBgJHtTVURPX1BSRUFNQkxFfVxuc2V0IC1lXG4kU1VETyBta2RpciAtcCBcIiR7ZGlyZWN0b3J5fVwiXG4kU1VETyBjaG1vZCAke2RpcmVjdG9yeU1vZGV9IFwiJHtkaXJlY3Rvcnl9XCJcbiRTVURPIHRlZSBcIiR7ZmlsZVBhdGh9XCIgPiAvZGV2L251bGxcbiRTVURPIGNobW9kICR7ZmlsZU1vZGV9IFwiJHtmaWxlUGF0aH1cImAsXG4gICAgfSk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVDb21tYW5kRXhpc3RzKGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGNvbW1hbmQ6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgaG9zdCwgY29tbWFuZCB9ID0gY29uZmlnO1xuICAgIGxldCByZXN1bHQgPSBhd2FpdCBydW5PdmVyU1NIKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgc2NyaXB0OiBgY29tbWFuZCAtdiBcIiR7Y29tbWFuZH1cIiA+IC9kZXYvbnVsbCAyPiYxICYmIGVjaG8geWVzIHx8IGVjaG8gbm9gLFxuICAgICAgICBhbGxvd0ZhaWx1cmU6IHRydWUsXG4gICAgfSk7XG4gICAgcmV0dXJuIHJlc3VsdC5zdGRvdXQudHJpbSgpID09PSBcInllc1wiO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "50b1a08f2aa4b96f04f676f20c516bc6c2897a47ad7c12729c0f651735c71057"; */

package/security/machines/addMachine.ts

@@ -0,0 +1,83 @@
+import os from "os";
+import { getOwnIPs } from "../../misc/ownIPs";
+import { describeHost } from "../helpers/remoteSSH";
+import { createRemoteIdentity, Identity, localDomains, localIdentity, remoteIdentity } from "./identity";
+import { machineState, resolveKeysRepo } from "./machines";
+
+const USAGE = `Usage: yarn addmachine <domain> [ip]
+
+The domain is required: a machine has a different identity, and so a different machine id, under
+every domain it runs under, so there is no such thing as "this machine" without one.
+
+With no ip it adds this machine, with its own addresses. With an ip it asks that machine over ssh
+for its identity under that domain, gives it one if it has none, and adds it under that address.
+
+It edits the keys repo this machine reads, wherever that is, not whatever directory this was run
+from. Nothing is signed or pushed here. Run "yarn signfiles git" in that repo afterwards, or no
+machine will believe any of it.`;
+
+export async function main() {
+    let argv = process.argv.slice(2);
+    if (!argv.length || argv.length > 2) {
+        throw new Error(`Expected a domain and optionally an ip, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [domain, host = ""] = argv;
+    // The same repo the acceptance check reads. Editing anything else would write a machine list
+    // nothing on this machine ever looks at.
+    let { repoPath } = await resolveKeysRepo();
+
+    let identity: Identity;
+    let addresses: string[];
+    if (!host) {
+        let found = await localIdentity(domain);
+        if (!found) {
+            throw new Error(
+                `Expected an identity for ${domain} in ${os.homedir()}, this machine has none.\n`
+                + `It has: ${(await localDomains()).join(", ") || "no identities at all"}\n`
+                + `One is generated the first time something runs here under a domain, so run that`
+                + ` first, or name another machine to add instead.`
+            );
+        }
+        identity = found;
+        addresses = await getOwnIPs();
+        if (!addresses.length) {
+            throw new Error(`Expected this machine to have an address anything else can see, it has none`);
+        }
+    } else {
+        // Nothing there under this domain means it gets one. Its own from this point on: the key
+        // is written there and nothing keeps a copy.
+        let found = await remoteIdentity(host, domain);
+        if (!found) {
+            console.log(`${describeHost(host)} has no identity for ${domain}, generating one`);
+        }
+        identity = found || await createRemoteIdentity({ host, domain });
+        // The address it was named by is the address it talks to us from, which is the one thing
+        // it cannot lie about.
+        addresses = [host];
+    }
+
+    // The whole list is read and written back, because setting is by the set: writing this one
+    // machine alone would remove every other machine from the repo.
+    let machines = await machineState({ repoPath });
+    let existing = machines.find(machine => machine.machineId === identity.machineId);
+    let ips = [...(existing?.ips || [])];
+    let added = addresses.filter(address => !ips.includes(address));
+    if (existing) {
+        existing.ips = [...ips, ...added];
+    } else {
+        machines.push({ machineId: identity.machineId, ips: [...added], addedAt: "" });
+    }
+    await machineState({ repoPath, machines });
+
+    console.log(`\nTrusting machine ${identity.machineId}`);
+    console.log(`Allowing IP ${[...ips, ...added].join(", ")}`);
+    if (added.length) {
+        console.log(`  added to machines/${identity.machineId}.json: ${added.join(", ")}`);
+    } else {
+        console.log(`  already allowed from ${addresses.join(", ")}`);
+    }
+    console.log(`  identity ${identity.fullDomain}`);
+    console.log(`  in ${repoPath}`);
+    console.log(`\nNothing believes this until it is signed. In that repo, run:`);
+    console.log(`\`\`\`\nyarn signfiles git\n\`\`\``);
+}

package/security/machines/dist/addMachine.ts.cache

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.main = void 0;
+const os_1 = __importDefault(require("os"));
+const ownIPs_1 = require("../../misc/ownIPs");
+const remoteSSH_1 = require("../helpers/remoteSSH");
+const identity_1 = require("./identity");
+const machines_1 = require("./machines");
+const USAGE = `Usage: yarn addmachine <domain> [ip]
+
+The domain is required: a machine has a different identity, and so a different machine id, under
+every domain it runs under, so there is no such thing as "this machine" without one.
+
+With no ip it adds this machine, with its own addresses. With an ip it asks that machine over ssh
+for its identity under that domain, gives it one if it has none, and adds it under that address.
+
+It edits the keys repo this machine reads, wherever that is, not whatever directory this was run
+from. Nothing is signed or pushed here. Run "yarn signfiles git" in that repo afterwards, or no
+machine will believe any of it.`;
+async function main() {
+    let argv = process.argv.slice(2);
+    if (!argv.length || argv.length > 2) {
+        throw new Error(`Expected a domain and optionally an ip, was ${argv.length} argument(s)\n${USAGE}`);
+    }
+    let [domain, host = ""] = argv;
+    // The same repo the acceptance check reads. Editing anything else would write a machine list
+    // nothing on this machine ever looks at.
+    let { repoPath } = await (0, machines_1.resolveKeysRepo)();
+    let identity;
+    let addresses;
+    if (!host) {
+        let found = await (0, identity_1.localIdentity)(domain);
+        if (!found) {
+            throw new Error(`Expected an identity for ${domain} in ${os_1.default.homedir()}, this machine has none.\n`
+                + `It has: ${(await (0, identity_1.localDomains)()).join(", ") || "no identities at all"}\n`
+                + `One is generated the first time something runs here under a domain, so run that`
+                + ` first, or name another machine to add instead.`);
+        }
+        identity = found;
+        addresses = await (0, ownIPs_1.getOwnIPs)();
+        if (!addresses.length) {
+            throw new Error(`Expected this machine to have an address anything else can see, it has none`);
+        }
+    }
+    else {
+        // Nothing there under this domain means it gets one. Its own from this point on: the key
+        // is written there and nothing keeps a copy.
+        let found = await (0, identity_1.remoteIdentity)(host, domain);
+        if (!found) {
+            console.log(`${(0, remoteSSH_1.describeHost)(host)} has no identity for ${domain}, generating one`);
+        }
+        identity = found || await (0, identity_1.createRemoteIdentity)({ host, domain });
+        // The address it was named by is the address it talks to us from, which is the one thing
+        // it cannot lie about.
+        addresses = [host];
+    }
+    // The whole list is read and written back, because setting is by the set: writing this one
+    // machine alone would remove every other machine from the repo.
+    let machines = await (0, machines_1.machineState)({ repoPath });
+    let existing = machines.find(machine => machine.machineId === identity.machineId);
+    let ips = [...((existing === null || existing === void 0 ? void 0 : existing.ips) || [])];
+    let added = addresses.filter(address => !ips.includes(address));
+    if (existing) {
+        existing.ips = [...ips, ...added];
+    }
+    else {
+        machines.push({ machineId: identity.machineId, ips: [...added], addedAt: "" });
+    }
+    await (0, machines_1.machineState)({ repoPath, machines });
+    console.log(`\nTrusting machine ${identity.machineId}`);
+    console.log(`Allowing IP ${[...ips, ...added].join(", ")}`);
+    if (added.length) {
+        console.log(`  added to machines/${identity.machineId}.json: ${added.join(", ")}`);
+    }
+    else {
+        console.log(`  already allowed from ${addresses.join(", ")}`);
+    }
+    console.log(`  identity ${identity.fullDomain}`);
+    console.log(`  in ${repoPath}`);
+    console.log(`\nNothing believes this until it is signed. In that repo, run:`);
+    console.log(`\`\`\`\nyarn signfiles git\n\`\`\``);
+}
+exports.main = main;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWRkTWFjaGluZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImFkZE1hY2hpbmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsNENBQW9CO0FBQ3BCLDhDQUE4QztBQUM5QyxvREFBb0Q7QUFDcEQseUNBQXlHO0FBQ3pHLHlDQUEyRDtBQUUzRCxNQUFNLEtBQUssR0FBRzs7Ozs7Ozs7OztnQ0FVa0IsQ0FBQztBQUUxQixLQUFLLFVBQVUsSUFBSTtJQUN0QixJQUFJLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLElBQUksQ0FBQyxNQUFNLGlCQUFpQixLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksR0FBRyxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUM7SUFDL0IsNkZBQTZGO0lBQzdGLHlDQUF5QztJQUN6QyxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxJQUFBLDBCQUFlLEdBQUUsQ0FBQztJQUUzQyxJQUFJLFFBQWtCLENBQUM7SUFDdkIsSUFBSSxTQUFtQixDQUFDO0lBQ3hCLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNSLElBQUksS0FBSyxHQUFHLE1BQU0sSUFBQSx3QkFBYSxFQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3hDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQ1gsNEJBQTRCLE1BQU0sT0FBTyxZQUFFLENBQUMsT0FBTyxFQUFFLDRCQUE0QjtrQkFDL0UsV0FBVyxDQUFDLE1BQU0sSUFBQSx1QkFBWSxHQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksc0JBQXNCLElBQUk7a0JBQzFFLGlGQUFpRjtrQkFDakYsaURBQWlELENBQ3RELENBQUM7UUFDTixDQUFDO1FBQ0QsUUFBUSxHQUFHLEtBQUssQ0FBQztRQUNqQixTQUFTLEdBQUcsTUFBTSxJQUFBLGtCQUFTLEdBQUUsQ0FBQztRQUM5QixJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3BCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkVBQTZFLENBQUMsQ0FBQztRQUNuRyxDQUFDO0lBQ0wsQ0FBQztTQUFNLENBQUM7UUFDSix5RkFBeUY7UUFDekYsNkNBQTZDO1FBQzdDLElBQUksS0FBSyxHQUFHLE1BQU0sSUFBQSx5QkFBYyxFQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUMvQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDVCxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBQSx3QkFBWSxFQUFDLElBQUksQ0FBQyx3QkFBd0IsTUFBTSxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7UUFDRCxRQUFRLEdBQUcsS0FBSyxJQUFJLE1BQU0sSUFBQSwrQkFBb0IsRUFBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2pFLHlGQUF5RjtRQUN6Rix1QkFBdUI7UUFDdkIsU0FBUyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdkIsQ0FBQztJQUVELDJGQUEyRjtJQUMzRixnRUFBZ0U7SUFDaEUsSUFBSSxRQUFRLEdBQUcsTUFBTSxJQUFBLHVCQUFZLEVBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ2hELElBQUksUUFBUSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRixJQUFJLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBLFFBQVEsYUFBUixRQUFRLHVCQUFSLFFBQVEsQ0FBRSxHQUFHLEtBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNyQyxJQUFJLEtBQUssR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDaEUsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNYLFFBQVEsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxDQUFDO0lBQ3RDLENBQUM7U0FBTSxDQUFDO1FBQ0osUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLEdBQUcsS0FBSyxDQUFDLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELE1BQU0sSUFBQSx1QkFBWSxFQUFDLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFFM0MsT0FBTyxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUMsR0FBRyxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVELElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2YsT0FBTyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsUUFBUSxDQUFDLFNBQVMsVUFBVSxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN2RixDQUFDO1NBQU0sQ0FBQztRQUNKLE9BQU8sQ0FBQyxHQUFHLENBQUMsMEJBQTBCLFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDakQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDaEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQzlFLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0NBQW9DLENBQUMsQ0FBQztBQUN0RCxDQUFDO0FBaEVELG9CQWdFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBvcyBmcm9tIFwib3NcIjtcbmltcG9ydCB7IGdldE93bklQcyB9IGZyb20gXCIuLi8uLi9taXNjL293bklQc1wiO1xuaW1wb3J0IHsgZGVzY3JpYmVIb3N0IH0gZnJvbSBcIi4uL2hlbHBlcnMvcmVtb3RlU1NIXCI7XG5pbXBvcnQgeyBjcmVhdGVSZW1vdGVJZGVudGl0eSwgSWRlbnRpdHksIGxvY2FsRG9tYWlucywgbG9jYWxJZGVudGl0eSwgcmVtb3RlSWRlbnRpdHkgfSBmcm9tIFwiLi9pZGVudGl0eVwiO1xuaW1wb3J0IHsgbWFjaGluZVN0YXRlLCByZXNvbHZlS2V5c1JlcG8gfSBmcm9tIFwiLi9tYWNoaW5lc1wiO1xuXG5jb25zdCBVU0FHRSA9IGBVc2FnZTogeWFybiBhZGRtYWNoaW5lIDxkb21haW4+IFtpcF1cblxuVGhlIGRvbWFpbiBpcyByZXF1aXJlZDogYSBtYWNoaW5lIGhhcyBhIGRpZmZlcmVudCBpZGVudGl0eSwgYW5kIHNvIGEgZGlmZmVyZW50IG1hY2hpbmUgaWQsIHVuZGVyXG5ldmVyeSBkb21haW4gaXQgcnVucyB1bmRlciwgc28gdGhlcmUgaXMgbm8gc3VjaCB0aGluZyBhcyBcInRoaXMgbWFjaGluZVwiIHdpdGhvdXQgb25lLlxuXG5XaXRoIG5vIGlwIGl0IGFkZHMgdGhpcyBtYWNoaW5lLCB3aXRoIGl0cyBvd24gYWRkcmVzc2VzLiBXaXRoIGFuIGlwIGl0IGFza3MgdGhhdCBtYWNoaW5lIG92ZXIgc3NoXG5mb3IgaXRzIGlkZW50aXR5IHVuZGVyIHRoYXQgZG9tYWluLCBnaXZlcyBpdCBvbmUgaWYgaXQgaGFzIG5vbmUsIGFuZCBhZGRzIGl0IHVuZGVyIHRoYXQgYWRkcmVzcy5cblxuSXQgZWRpdHMgdGhlIGtleXMgcmVwbyB0aGlzIG1hY2hpbmUgcmVhZHMsIHdoZXJldmVyIHRoYXQgaXMsIG5vdCB3aGF0ZXZlciBkaXJlY3RvcnkgdGhpcyB3YXMgcnVuXG5mcm9tLiBOb3RoaW5nIGlzIHNpZ25lZCBvciBwdXNoZWQgaGVyZS4gUnVuIFwieWFybiBzaWduZmlsZXMgZ2l0XCIgaW4gdGhhdCByZXBvIGFmdGVyd2FyZHMsIG9yIG5vXG5tYWNoaW5lIHdpbGwgYmVsaWV2ZSBhbnkgb2YgaXQuYDtcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIG1haW4oKSB7XG4gICAgbGV0IGFyZ3YgPSBwcm9jZXNzLmFyZ3Yuc2xpY2UoMik7XG4gICAgaWYgKCFhcmd2Lmxlbmd0aCB8fCBhcmd2Lmxlbmd0aCA+IDIpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhIGRvbWFpbiBhbmQgb3B0aW9uYWxseSBhbiBpcCwgd2FzICR7YXJndi5sZW5ndGh9IGFyZ3VtZW50KHMpXFxuJHtVU0FHRX1gKTtcbiAgICB9XG4gICAgbGV0IFtkb21haW4sIGhvc3QgPSBcIlwiXSA9IGFyZ3Y7XG4gICAgLy8gVGhlIHNhbWUgcmVwbyB0aGUgYWNjZXB0YW5jZSBjaGVjayByZWFkcy4gRWRpdGluZyBhbnl0aGluZyBlbHNlIHdvdWxkIHdyaXRlIGEgbWFjaGluZSBsaXN0XG4gICAgLy8gbm90aGluZyBvbiB0aGlzIG1hY2hpbmUgZXZlciBsb29rcyBhdC5cbiAgICBsZXQgeyByZXBvUGF0aCB9ID0gYXdhaXQgcmVzb2x2ZUtleXNSZXBvKCk7XG5cbiAgICBsZXQgaWRlbnRpdHk6IElkZW50aXR5O1xuICAgIGxldCBhZGRyZXNzZXM6IHN0cmluZ1tdO1xuICAgIGlmICghaG9zdCkge1xuICAgICAgICBsZXQgZm91bmQgPSBhd2FpdCBsb2NhbElkZW50aXR5KGRvbWFpbik7XG4gICAgICAgIGlmICghZm91bmQpIHtcbiAgICAgICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgICAgICBgRXhwZWN0ZWQgYW4gaWRlbnRpdHkgZm9yICR7ZG9tYWlufSBpbiAke29zLmhvbWVkaXIoKX0sIHRoaXMgbWFjaGluZSBoYXMgbm9uZS5cXG5gXG4gICAgICAgICAgICAgICAgKyBgSXQgaGFzOiAkeyhhd2FpdCBsb2NhbERvbWFpbnMoKSkuam9pbihcIiwgXCIpIHx8IFwibm8gaWRlbnRpdGllcyBhdCBhbGxcIn1cXG5gXG4gICAgICAgICAgICAgICAgKyBgT25lIGlzIGdlbmVyYXRlZCB0aGUgZmlyc3QgdGltZSBzb21ldGhpbmcgcnVucyBoZXJlIHVuZGVyIGEgZG9tYWluLCBzbyBydW4gdGhhdGBcbiAgICAgICAgICAgICAgICArIGAgZmlyc3QsIG9yIG5hbWUgYW5vdGhlciBtYWNoaW5lIHRvIGFkZCBpbnN0ZWFkLmBcbiAgICAgICAgICAgICk7XG4gICAgICAgIH1cbiAgICAgICAgaWRlbnRpdHkgPSBmb3VuZDtcbiAgICAgICAgYWRkcmVzc2VzID0gYXdhaXQgZ2V0T3duSVBzKCk7XG4gICAgICAgIGlmICghYWRkcmVzc2VzLmxlbmd0aCkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCB0aGlzIG1hY2hpbmUgdG8gaGF2ZSBhbiBhZGRyZXNzIGFueXRoaW5nIGVsc2UgY2FuIHNlZSwgaXQgaGFzIG5vbmVgKTtcbiAgICAgICAgfVxuICAgIH0gZWxzZSB7XG4gICAgICAgIC8vIE5vdGhpbmcgdGhlcmUgdW5kZXIgdGhpcyBkb21haW4gbWVhbnMgaXQgZ2V0cyBvbmUuIEl0cyBvd24gZnJvbSB0aGlzIHBvaW50IG9uOiB0aGUga2V5XG4gICAgICAgIC8vIGlzIHdyaXR0ZW4gdGhlcmUgYW5kIG5vdGhpbmcga2VlcHMgYSBjb3B5LlxuICAgICAgICBsZXQgZm91bmQgPSBhd2FpdCByZW1vdGVJZGVudGl0eShob3N0LCBkb21haW4pO1xuICAgICAgICBpZiAoIWZvdW5kKSB7XG4gICAgICAgICAgICBjb25zb2xlLmxvZyhgJHtkZXNjcmliZUhvc3QoaG9zdCl9IGhhcyBubyBpZGVudGl0eSBmb3IgJHtkb21haW59LCBnZW5lcmF0aW5nIG9uZWApO1xuICAgICAgICB9XG4gICAgICAgIGlkZW50aXR5ID0gZm91bmQgfHwgYXdhaXQgY3JlYXRlUmVtb3RlSWRlbnRpdHkoeyBob3N0LCBkb21haW4gfSk7XG4gICAgICAgIC8vIFRoZSBhZGRyZXNzIGl0IHdhcyBuYW1lZCBieSBpcyB0aGUgYWRkcmVzcyBpdCB0YWxrcyB0byB1cyBmcm9tLCB3aGljaCBpcyB0aGUgb25lIHRoaW5nXG4gICAgICAgIC8vIGl0IGNhbm5vdCBsaWUgYWJvdXQuXG4gICAgICAgIGFkZHJlc3NlcyA9IFtob3N0XTtcbiAgICB9XG5cbiAgICAvLyBUaGUgd2hvbGUgbGlzdCBpcyByZWFkIGFuZCB3cml0dGVuIGJhY2ssIGJlY2F1c2Ugc2V0dGluZyBpcyBieSB0aGUgc2V0OiB3cml0aW5nIHRoaXMgb25lXG4gICAgLy8gbWFjaGluZSBhbG9uZSB3b3VsZCByZW1vdmUgZXZlcnkgb3RoZXIgbWFjaGluZSBmcm9tIHRoZSByZXBvLlxuICAgIGxldCBtYWNoaW5lcyA9IGF3YWl0IG1hY2hpbmVTdGF0ZSh7IHJlcG9QYXRoIH0pO1xuICAgIGxldCBleGlzdGluZyA9IG1hY2hpbmVzLmZpbmQobWFjaGluZSA9PiBtYWNoaW5lLm1hY2hpbmVJZCA9PT0gaWRlbnRpdHkubWFjaGluZUlkKTtcbiAgICBsZXQgaXBzID0gWy4uLihleGlzdGluZz8uaXBzIHx8IFtdKV07XG4gICAgbGV0IGFkZGVkID0gYWRkcmVzc2VzLmZpbHRlcihhZGRyZXNzID0+ICFpcHMuaW5jbHVkZXMoYWRkcmVzcykpO1xuICAgIGlmIChleGlzdGluZykge1xuICAgICAgICBleGlzdGluZy5pcHMgPSBbLi4uaXBzLCAuLi5hZGRlZF07XG4gICAgfSBlbHNlIHtcbiAgICAgICAgbWFjaGluZXMucHVzaCh7IG1hY2hpbmVJZDogaWRlbnRpdHkubWFjaGluZUlkLCBpcHM6IFsuLi5hZGRlZF0sIGFkZGVkQXQ6IFwiXCIgfSk7XG4gICAgfVxuICAgIGF3YWl0IG1hY2hpbmVTdGF0ZSh7IHJlcG9QYXRoLCBtYWNoaW5lcyB9KTtcblxuICAgIGNvbnNvbGUubG9nKGBcXG5UcnVzdGluZyBtYWNoaW5lICR7aWRlbnRpdHkubWFjaGluZUlkfWApO1xuICAgIGNvbnNvbGUubG9nKGBBbGxvd2luZyBJUCAke1suLi5pcHMsIC4uLmFkZGVkXS5qb2luKFwiLCBcIil9YCk7XG4gICAgaWYgKGFkZGVkLmxlbmd0aCkge1xuICAgICAgICBjb25zb2xlLmxvZyhgICBhZGRlZCB0byBtYWNoaW5lcy8ke2lkZW50aXR5Lm1hY2hpbmVJZH0uanNvbjogJHthZGRlZC5qb2luKFwiLCBcIil9YCk7XG4gICAgfSBlbHNlIHtcbiAgICAgICAgY29uc29sZS5sb2coYCAgYWxyZWFkeSBhbGxvd2VkIGZyb20gJHthZGRyZXNzZXMuam9pbihcIiwgXCIpfWApO1xuICAgIH1cbiAgICBjb25zb2xlLmxvZyhgICBpZGVudGl0eSAke2lkZW50aXR5LmZ1bGxEb21haW59YCk7XG4gICAgY29uc29sZS5sb2coYCAgaW4gJHtyZXBvUGF0aH1gKTtcbiAgICBjb25zb2xlLmxvZyhgXFxuTm90aGluZyBiZWxpZXZlcyB0aGlzIHVudGlsIGl0IGlzIHNpZ25lZC4gSW4gdGhhdCByZXBvLCBydW46YCk7XG4gICAgY29uc29sZS5sb2coYFxcYFxcYFxcYFxcbnlhcm4gc2lnbmZpbGVzIGdpdFxcblxcYFxcYFxcYGApO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "8b6a7e13912660fd6733b2585e4fec0865a5548fe5846ee6e23f46c506f83e34"; */

package/security/machines/dist/identity.ts.cache

@@ -0,0 +1,176 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.verifyTrustPacket = exports.signTrustPacket = exports.createRemoteIdentity = exports.remoteIdentity = exports.localIdentityKeys = exports.localIdentity = exports.localDomains = exports.PACKET_LIFETIME = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const certs_1 = require("../../misc/https/certs");
+const remoteSSH_1 = require("../helpers/remoteSSH");
+// A machine's identity is the CA it generated for itself, kept in one file in the home directory
+// of whoever runs it. The name carries the domain it belongs to, so a machine can hold one per
+// domain, and the id itself is a hash of that CA's public key - which is why a machine cannot
+// claim to be another one without holding its key.
+const IDENTITY_PREFIX = "keystore_";
+const IDENTITY_SUFFIX = `_${certs_1.identityStorageKey}.json`;
+// How stale a signed packet may be. Long enough for clock skew between two machines, short enough
+// that a captured packet is not worth replaying.
+exports.PACKET_LIFETIME = 2 * 60 * 1000;
+function identityFileName(domain) {
+    return `${IDENTITY_PREFIX}${domain}${IDENTITY_SUFFIX}`;
+}
+/** The domain out of an identity file's name, or "" if it is not one. */
+function domainOfFileName(fileName) {
+    if (!fileName.startsWith(IDENTITY_PREFIX) || !fileName.endsWith(IDENTITY_SUFFIX)) {
+        return "";
+    }
+    return fileName.slice(IDENTITY_PREFIX.length, -IDENTITY_SUFFIX.length);
+}
+function describeIdentity(config) {
+    let { domain, stored } = config;
+    return {
+        machineId: (0, certs_1.getMachineId)(stored.domain, domain),
+        domain,
+        fullDomain: stored.domain,
+        fileName: identityFileName(domain),
+    };
+}
+/** Every domain this machine holds an identity under. A machine has one identity per domain, and
+    they are different machine ids, so which one is meant is a real question rather than a detail. */
+async function localDomains() {
+    let domains = [];
+    for (let name of (await promises_1.default.readdir(os_1.default.homedir()).catch(() => [])).sort()) {
+        let domain = domainOfFileName(name);
+        if (domain) {
+            domains.push(domain);
+        }
+    }
+    return domains;
+}
+exports.localDomains = localDomains;
+/** This machine's identity under one domain. Undefined when it has none under that one.
+
+    The domain is required everywhere it appears. A machine has a different identity, and so a
+    different machine id, under every domain it runs under, so "this machine" on its own does not
+    name anything: answering under the wrong one means answering as a machine we are not. */
+async function localIdentity(domain) {
+    if (!domain) {
+        throw new Error(`Expected a domain, was ${JSON.stringify(domain)}`);
+    }
+    let contents = await promises_1.default.readFile(path_1.default.join(os_1.default.homedir(), identityFileName(domain)), "utf8").catch(() => "");
+    if (!contents) {
+        return undefined;
+    }
+    return describeIdentity({ domain, stored: JSON.parse(contents) });
+}
+exports.localIdentity = localIdentity;
+/** This machine's identity and its keys, for signing. */
+async function localIdentityKeys(domain) {
+    let identity = await localIdentity(domain);
+    if (!identity) {
+        throw new Error(`Expected an identity for ${domain} at ${path_1.default.join(os_1.default.homedir(), identityFileName(domain))},`
+            + ` there is none.\n`
+            + `This machine has: ${(await localDomains()).join(", ") || "no identities at all"}`);
+    }
+    let stored = JSON.parse(await promises_1.default.readFile(path_1.default.join(os_1.default.homedir(), identity.fileName), "utf8"));
+    return { identity, stored };
+}
+exports.localIdentityKeys = localIdentityKeys;
+/** The identity of another machine under one domain, over ssh. Undefined when it has none under
+    that domain, whatever else it may have under others. */
+async function remoteIdentity(host, domain) {
+    if (!domain) {
+        throw new Error(`Expected a domain, was ${JSON.stringify(domain)}`);
+    }
+    let home = (await (0, remoteSSH_1.runOverSSH)({ host, script: `echo $HOME` })).stdout.trim();
+    if (!home) {
+        throw new Error(`Expected ${host} to report a home directory, it reported nothing`);
+    }
+    let contents = await (0, remoteSSH_1.runOverSSH)({
+        host,
+        script: `cat ${home}/${identityFileName(domain)} 2>/dev/null || true`,
+    });
+    if (!contents.stdout.trim()) {
+        return undefined;
+    }
+    return describeIdentity({ domain, stored: JSON.parse(contents.stdout) });
+}
+exports.remoteIdentity = remoteIdentity;
+/** Gives a machine an identity it does not have yet, by generating one here and writing it there.
+
+    The CA is self signed and never leaves that machine afterwards, so generating it here is only a
+    convenience: what matters is that the private key ends up in one place and the id is the hash
+    of its public half. */
+async function createRemoteIdentity(config) {
+    let { host, domain } = config;
+    let generated = (0, certs_1.generateTestCA)(domain);
+    let stored = {
+        domain: generated.domain,
+        certB64: generated.cert.toString("base64"),
+        keyB64: generated.key.toString("base64"),
+    };
+    let home = (await (0, remoteSSH_1.runOverSSH)({ host, script: `echo $HOME` })).stdout.trim();
+    await (0, remoteSSH_1.writeRemoteFile)({
+        host,
+        filePath: `${home}/${identityFileName(domain)}`,
+        contents: JSON.stringify(stored),
+        fileMode: "600",
+        // The home directory is already there, this is only what it is created with if it is not.
+        directoryMode: "700",
+    });
+    return describeIdentity({ domain, stored });
+}
+exports.createRemoteIdentity = createRemoteIdentity;
+/** The raw ed25519 public key out of a certificate, which is what the machine id is a hash of. */
+function publicKeyBytes(certPEM) {
+    let spki = new crypto_1.default.X509Certificate(certPEM).publicKey.export({ type: "spki", format: "der" });
+    // An ed25519 SPKI is a fixed 12 byte header followed by the 32 byte key.
+    return spki.subarray(spki.length - 32);
+}
+/** Proves we hold the private key behind our machine id, right now. The signature covers the id
+    and the time, so the packet cannot be replayed later or reused for another id. */
+async function signTrustPacket(domain) {
+    let { identity, stored } = await localIdentityKeys(domain);
+    let signedAt = Date.now();
+    let signature = crypto_1.default.sign(null, Buffer.from(`${identity.machineId} ${signedAt}`), crypto_1.default.createPrivateKey(Buffer.from(stored.keyB64, "base64").toString()));
+    return {
+        machineId: identity.machineId,
+        certB64: stored.certB64,
+        signedAt,
+        signatureB64: signature.toString("base64"),
+    };
+}
+exports.signTrustPacket = signTrustPacket;
+/** Whether a packet really came from the machine it names. Says why when it did not, because
+    "this is not that machine" and "this arrived too late" are different problems. */
+function verifyTrustPacket(packet) {
+    if (!packet || !packet.machineId || !packet.certB64 || !packet.signatureB64) {
+        return { valid: false, problem: "the packet is missing fields" };
+    }
+    if (Math.abs(Date.now() - packet.signedAt) > exports.PACKET_LIFETIME) {
+        return { valid: false, problem: `it was signed ${Math.round((Date.now() - packet.signedAt) / 1000)}s ago` };
+    }
+    let certPEM = Buffer.from(packet.certB64, "base64").toString();
+    let publicKey;
+    try {
+        publicKey = new crypto_1.default.X509Certificate(certPEM).publicKey;
+    }
+    catch (e) {
+        return { valid: false, problem: `its certificate could not be read, ${e}` };
+    }
+    // The id is a hash of the public key, so this is what stops a machine claiming another's id.
+    if (!(0, certs_1.verifyMachineIdForPublicKey)({ machineId: packet.machineId, publicKey: publicKeyBytes(certPEM) })) {
+        return { valid: false, problem: "the machine id does not belong to that certificate" };
+    }
+    let signed = crypto_1.default.verify(null, Buffer.from(`${packet.machineId} ${packet.signedAt}`), publicKey, Buffer.from(packet.signatureB64, "base64"));
+    if (!signed) {
+        return { valid: false, problem: "the signature does not check out" };
+    }
+    return { valid: true, problem: "" };
+}
+exports.verifyTrustPacket = verifyTrustPacket;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRlbnRpdHkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpZGVudGl0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLDRDQUFvQjtBQUNwQixnREFBd0I7QUFDeEIsa0RBQTRJO0FBQzVJLG9EQUFtRTtBQUVuRSxpR0FBaUc7QUFDakcsK0ZBQStGO0FBQy9GLDhGQUE4RjtBQUM5RixtREFBbUQ7QUFDbkQsTUFBTSxlQUFlLEdBQUcsV0FBVyxDQUFDO0FBQ3BDLE1BQU0sZUFBZSxHQUFHLElBQUksMEJBQWtCLE9BQU8sQ0FBQztBQUN0RCxrR0FBa0c7QUFDbEcsaURBQWlEO0FBQ3BDLFFBQUEsZUFBZSxHQUFHLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDO0FBUzdDLFNBQVMsZ0JBQWdCLENBQUMsTUFBYztJQUNwQyxPQUFPLEdBQUcsZUFBZSxHQUFHLE1BQU0sR0FBRyxlQUFlLEVBQUUsQ0FBQztBQUMzRCxDQUFDO0FBRUQseUVBQXlFO0FBQ3pFLFNBQVMsZ0JBQWdCLENBQUMsUUFBZ0I7SUFDdEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDM0UsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsTUFBdUQ7SUFDN0UsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFDaEMsT0FBTztRQUNILFNBQVMsRUFBRSxJQUFBLG9CQUFZLEVBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUM7UUFDOUMsTUFBTTtRQUNOLFVBQVUsRUFBRSxNQUFNLENBQUMsTUFBTTtRQUN6QixRQUFRLEVBQUUsZ0JBQWdCLENBQUMsTUFBTSxDQUFDO0tBQ3JDLENBQUM7QUFDTixDQUFDO0FBRUQ7cUdBQ3FHO0FBQzlGLEtBQUssVUFBVSxZQUFZO0lBQzlCLElBQUksT0FBTyxHQUFhLEVBQUUsQ0FBQztJQUMzQixLQUFLLElBQUksSUFBSSxJQUFJLENBQUMsTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxZQUFFLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBYyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1FBQ25GLElBQUksTUFBTSxHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3BDLElBQUksTUFBTSxFQUFFLENBQUM7WUFDVCxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pCLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDbkIsQ0FBQztBQVRELG9DQVNDO0FBRUQ7Ozs7NEZBSTRGO0FBQ3JGLEtBQUssVUFBVSxhQUFhLENBQUMsTUFBYztJQUM5QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDVixNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFlBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM1RyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDWixPQUFPLFNBQVMsQ0FBQztJQUNyQixDQUFDO0lBQ0QsT0FBTyxnQkFBZ0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDdEUsQ0FBQztBQVRELHNDQVNDO0FBRUQseURBQXlEO0FBQ2xELEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxNQUFjO0lBQ2xELElBQUksUUFBUSxHQUFHLE1BQU0sYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzNDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNaLE1BQU0sSUFBSSxLQUFLLENBQ1gsNEJBQTRCLE1BQU0sT0FBTyxjQUFJLENBQUMsSUFBSSxDQUFDLFlBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHO2NBQzNGLG1CQUFtQjtjQUNuQixxQkFBcUIsQ0FBQyxNQUFNLFlBQVksRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLHNCQUFzQixFQUFFLENBQ3ZGLENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSxNQUFNLEdBQXdCLElBQUksQ0FBQyxLQUFLLENBQ3hDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUN4RSxDQUFDO0lBQ0YsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUNoQyxDQUFDO0FBYkQsOENBYUM7QUFFRDsyREFDMkQ7QUFDcEQsS0FBSyxVQUFVLGNBQWMsQ0FBQyxJQUFZLEVBQUUsTUFBYztJQUM3RCxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDVixNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxNQUFNLElBQUEsc0JBQVUsRUFBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1RSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDUixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksSUFBSSxrREFBa0QsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxNQUFNLElBQUEsc0JBQVUsRUFBQztRQUM1QixJQUFJO1FBQ0osTUFBTSxFQUFFLE9BQU8sSUFBSSxJQUFJLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxzQkFBc0I7S0FDeEUsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUMxQixPQUFPLFNBQVMsQ0FBQztJQUNyQixDQUFDO0lBQ0QsT0FBTyxnQkFBZ0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzdFLENBQUM7QUFoQkQsd0NBZ0JDO0FBRUQ7Ozs7MEJBSTBCO0FBQ25CLEtBQUssVUFBVSxvQkFBb0IsQ0FBQyxNQUF3QztJQUMvRSxJQUFJLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUM5QixJQUFJLFNBQVMsR0FBRyxJQUFBLHNCQUFjLEVBQUMsTUFBTSxDQUFDLENBQUM7SUFDdkMsSUFBSSxNQUFNLEdBQXdCO1FBQzlCLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTTtRQUN4QixPQUFPLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQzFDLE1BQU0sRUFBRSxTQUFTLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7S0FDM0MsQ0FBQztJQUNGLElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxJQUFBLHNCQUFVLEVBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDNUUsTUFBTSxJQUFBLDJCQUFlLEVBQUM7UUFDbEIsSUFBSTtRQUNKLFFBQVEsRUFBRSxHQUFHLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsRUFBRTtRQUMvQyxRQUFRLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUM7UUFDaEMsUUFBUSxFQUFFLEtBQUs7UUFDZiwwRkFBMEY7UUFDMUYsYUFBYSxFQUFFLEtBQUs7S0FDdkIsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxnQkFBZ0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO0FBQ2hELENBQUM7QUFsQkQsb0RBa0JDO0FBRUQsa0dBQWtHO0FBQ2xHLFNBQVMsY0FBYyxDQUFDLE9BQWU7SUFDbkMsSUFBSSxJQUFJLEdBQUcsSUFBSSxnQkFBTSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUNqRyx5RUFBeUU7SUFDekUsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsRUFBRSxDQUFDLENBQUM7QUFDM0MsQ0FBQztBQVNEO3FGQUNxRjtBQUM5RSxLQUFLLFVBQVUsZUFBZSxDQUFDLE1BQWM7SUFDaEQsSUFBSSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzNELElBQUksUUFBUSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUMxQixJQUFJLFNBQVMsR0FBRyxnQkFBTSxDQUFDLElBQUksQ0FDdkIsSUFBSSxFQUNKLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLENBQUMsU0FBUyxJQUFJLFFBQVEsRUFBRSxDQUFDLEVBQ2hELGdCQUFNLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQzNFLENBQUM7SUFDRixPQUFPO1FBQ0gsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTO1FBQzdCLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTztRQUN2QixRQUFRO1FBQ1IsWUFBWSxFQUFFLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO0tBQzdDLENBQUM7QUFDTixDQUFDO0FBZEQsMENBY0M7QUFFRDtxRkFDcUY7QUFDckYsU0FBZ0IsaUJBQWlCLENBQUMsTUFBbUI7SUFDakQsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQzFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxDQUFDO0lBQ3JFLENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsR0FBRyx1QkFBZSxFQUFFLENBQUM7UUFDM0QsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLGlCQUFpQixJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7SUFDaEgsQ0FBQztJQUNELElBQUksT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUMvRCxJQUFJLFNBQTJCLENBQUM7SUFDaEMsSUFBSSxDQUFDO1FBQ0QsU0FBUyxHQUFHLElBQUksZ0JBQU0sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzlELENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLHNDQUFzQyxDQUFDLEVBQUUsRUFBRSxDQUFDO0lBQ2hGLENBQUM7SUFDRCw2RkFBNkY7SUFDN0YsSUFBSSxDQUFDLElBQUEsbUNBQTJCLEVBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsY0FBYyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3BHLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxvREFBb0QsRUFBRSxDQUFDO0lBQzNGLENBQUM7SUFDRCxJQUFJLE1BQU0sR0FBRyxnQkFBTSxDQUFDLE1BQU0sQ0FDdEIsSUFBSSxFQUNKLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxFQUNyRCxTQUFTLEVBQ1QsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUM3QyxDQUFDO0lBQ0YsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1YsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUM7SUFDekUsQ0FBQztJQUNELE9BQU8sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsQ0FBQztBQUN4QyxDQUFDO0FBNUJELDhDQTRCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBjcnlwdG8gZnJvbSBcImNyeXB0b1wiO1xuaW1wb3J0IGZzIGZyb20gXCJmcy9wcm9taXNlc1wiO1xuaW1wb3J0IG9zIGZyb20gXCJvc1wiO1xuaW1wb3J0IHBhdGggZnJvbSBcInBhdGhcIjtcbmltcG9ydCB7IGdlbmVyYXRlVGVzdENBLCBnZXRNYWNoaW5lSWQsIGlkZW50aXR5U3RvcmFnZUtleSwgSWRlbnRpdHlTdG9yYWdlVHlwZSwgdmVyaWZ5TWFjaGluZUlkRm9yUHVibGljS2V5IH0gZnJvbSBcIi4uLy4uL21pc2MvaHR0cHMvY2VydHNcIjtcbmltcG9ydCB7IHJ1bk92ZXJTU0gsIHdyaXRlUmVtb3RlRmlsZSB9IGZyb20gXCIuLi9oZWxwZXJzL3JlbW90ZVNTSFwiO1xuXG4vLyBBIG1hY2hpbmUncyBpZGVudGl0eSBpcyB0aGUgQ0EgaXQgZ2VuZXJhdGVkIGZvciBpdHNlbGYsIGtlcHQgaW4gb25lIGZpbGUgaW4gdGhlIGhvbWUgZGlyZWN0b3J5XG4vLyBvZiB3aG9ldmVyIHJ1bnMgaXQuIFRoZSBuYW1lIGNhcnJpZXMgdGhlIGRvbWFpbiBpdCBiZWxvbmdzIHRvLCBzbyBhIG1hY2hpbmUgY2FuIGhvbGQgb25lIHBlclxuLy8gZG9tYWluLCBhbmQgdGhlIGlkIGl0c2VsZiBpcyBhIGhhc2ggb2YgdGhhdCBDQSdzIHB1YmxpYyBrZXkgLSB3aGljaCBpcyB3aHkgYSBtYWNoaW5lIGNhbm5vdFxuLy8gY2xhaW0gdG8gYmUgYW5vdGhlciBvbmUgd2l0aG91dCBob2xkaW5nIGl0cyBrZXkuXG5jb25zdCBJREVOVElUWV9QUkVGSVggPSBcImtleXN0b3JlX1wiO1xuY29uc3QgSURFTlRJVFlfU1VGRklYID0gYF8ke2lkZW50aXR5U3RvcmFnZUtleX0uanNvbmA7XG4vLyBIb3cgc3RhbGUgYSBzaWduZWQgcGFja2V0IG1heSBiZS4gTG9uZyBlbm91Z2ggZm9yIGNsb2NrIHNrZXcgYmV0d2VlbiB0d28gbWFjaGluZXMsIHNob3J0IGVub3VnaFxuLy8gdGhhdCBhIGNhcHR1cmVkIHBhY2tldCBpcyBub3Qgd29ydGggcmVwbGF5aW5nLlxuZXhwb3J0IGNvbnN0IFBBQ0tFVF9MSUZFVElNRSA9IDIgKiA2MCAqIDEwMDA7XG5cbmV4cG9ydCB0eXBlIElkZW50aXR5ID0ge1xuICAgIG1hY2hpbmVJZDogc3RyaW5nO1xuICAgIGRvbWFpbjogc3RyaW5nO1xuICAgIGZ1bGxEb21haW46IHN0cmluZztcbiAgICBmaWxlTmFtZTogc3RyaW5nO1xufTtcblxuZnVuY3Rpb24gaWRlbnRpdHlGaWxlTmFtZShkb21haW46IHN0cmluZykge1xuICAgIHJldHVybiBgJHtJREVOVElUWV9QUkVGSVh9JHtkb21haW59JHtJREVOVElUWV9TVUZGSVh9YDtcbn1cblxuLyoqIFRoZSBkb21haW4gb3V0IG9mIGFuIGlkZW50aXR5IGZpbGUncyBuYW1lLCBvciBcIlwiIGlmIGl0IGlzIG5vdCBvbmUuICovXG5mdW5jdGlvbiBkb21haW5PZkZpbGVOYW1lKGZpbGVOYW1lOiBzdHJpbmcpIHtcbiAgICBpZiAoIWZpbGVOYW1lLnN0YXJ0c1dpdGgoSURFTlRJVFlfUFJFRklYKSB8fCAhZmlsZU5hbWUuZW5kc1dpdGgoSURFTlRJVFlfU1VGRklYKSkge1xuICAgICAgICByZXR1cm4gXCJcIjtcbiAgICB9XG4gICAgcmV0dXJuIGZpbGVOYW1lLnNsaWNlKElERU5USVRZX1BSRUZJWC5sZW5ndGgsIC1JREVOVElUWV9TVUZGSVgubGVuZ3RoKTtcbn1cblxuZnVuY3Rpb24gZGVzY3JpYmVJZGVudGl0eShjb25maWc6IHsgZG9tYWluOiBzdHJpbmc7IHN0b3JlZDogSWRlbnRpdHlTdG9yYWdlVHlwZSB9KSB7XG4gICAgbGV0IHsgZG9tYWluLCBzdG9yZWQgfSA9IGNvbmZpZztcbiAgICByZXR1cm4ge1xuICAgICAgICBtYWNoaW5lSWQ6IGdldE1hY2hpbmVJZChzdG9yZWQuZG9tYWluLCBkb21haW4pLFxuICAgICAgICBkb21haW4sXG4gICAgICAgIGZ1bGxEb21haW46IHN0b3JlZC5kb21haW4sXG4gICAgICAgIGZpbGVOYW1lOiBpZGVudGl0eUZpbGVOYW1lKGRvbWFpbiksXG4gICAgfTtcbn1cblxuLyoqIEV2ZXJ5IGRvbWFpbiB0aGlzIG1hY2hpbmUgaG9sZHMgYW4gaWRlbnRpdHkgdW5kZXIuIEEgbWFjaGluZSBoYXMgb25lIGlkZW50aXR5IHBlciBkb21haW4sIGFuZFxuICAgIHRoZXkgYXJlIGRpZmZlcmVudCBtYWNoaW5lIGlkcywgc28gd2hpY2ggb25lIGlzIG1lYW50IGlzIGEgcmVhbCBxdWVzdGlvbiByYXRoZXIgdGhhbiBhIGRldGFpbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBsb2NhbERvbWFpbnMoKSB7XG4gICAgbGV0IGRvbWFpbnM6IHN0cmluZ1tdID0gW107XG4gICAgZm9yIChsZXQgbmFtZSBvZiAoYXdhaXQgZnMucmVhZGRpcihvcy5ob21lZGlyKCkpLmNhdGNoKCgpID0+IFtdIGFzIHN0cmluZ1tdKSkuc29ydCgpKSB7XG4gICAgICAgIGxldCBkb21haW4gPSBkb21haW5PZkZpbGVOYW1lKG5hbWUpO1xuICAgICAgICBpZiAoZG9tYWluKSB7XG4gICAgICAgICAgICBkb21haW5zLnB1c2goZG9tYWluKTtcbiAgICAgICAgfVxuICAgIH1cbiAgICByZXR1cm4gZG9tYWlucztcbn1cblxuLyoqIFRoaXMgbWFjaGluZSdzIGlkZW50aXR5IHVuZGVyIG9uZSBkb21haW4uIFVuZGVmaW5lZCB3aGVuIGl0IGhhcyBub25lIHVuZGVyIHRoYXQgb25lLlxuXG4gICAgVGhlIGRvbWFpbiBpcyByZXF1aXJlZCBldmVyeXdoZXJlIGl0IGFwcGVhcnMuIEEgbWFjaGluZSBoYXMgYSBkaWZmZXJlbnQgaWRlbnRpdHksIGFuZCBzbyBhXG4gICAgZGlmZmVyZW50IG1hY2hpbmUgaWQsIHVuZGVyIGV2ZXJ5IGRvbWFpbiBpdCBydW5zIHVuZGVyLCBzbyBcInRoaXMgbWFjaGluZVwiIG9uIGl0cyBvd24gZG9lcyBub3RcbiAgICBuYW1lIGFueXRoaW5nOiBhbnN3ZXJpbmcgdW5kZXIgdGhlIHdyb25nIG9uZSBtZWFucyBhbnN3ZXJpbmcgYXMgYSBtYWNoaW5lIHdlIGFyZSBub3QuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbG9jYWxJZGVudGl0eShkb21haW46IHN0cmluZyk6IFByb21pc2U8SWRlbnRpdHkgfCB1bmRlZmluZWQ+IHtcbiAgICBpZiAoIWRvbWFpbikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgZG9tYWluLCB3YXMgJHtKU09OLnN0cmluZ2lmeShkb21haW4pfWApO1xuICAgIH1cbiAgICBsZXQgY29udGVudHMgPSBhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4ob3MuaG9tZWRpcigpLCBpZGVudGl0eUZpbGVOYW1lKGRvbWFpbikpLCBcInV0ZjhcIikuY2F0Y2goKCkgPT4gXCJcIik7XG4gICAgaWYgKCFjb250ZW50cykge1xuICAgICAgICByZXR1cm4gdW5kZWZpbmVkO1xuICAgIH1cbiAgICByZXR1cm4gZGVzY3JpYmVJZGVudGl0eSh7IGRvbWFpbiwgc3RvcmVkOiBKU09OLnBhcnNlKGNvbnRlbnRzKSB9KTtcbn1cblxuLyoqIFRoaXMgbWFjaGluZSdzIGlkZW50aXR5IGFuZCBpdHMga2V5cywgZm9yIHNpZ25pbmcuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbG9jYWxJZGVudGl0eUtleXMoZG9tYWluOiBzdHJpbmcpIHtcbiAgICBsZXQgaWRlbnRpdHkgPSBhd2FpdCBsb2NhbElkZW50aXR5KGRvbWFpbik7XG4gICAgaWYgKCFpZGVudGl0eSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgICBgRXhwZWN0ZWQgYW4gaWRlbnRpdHkgZm9yICR7ZG9tYWlufSBhdCAke3BhdGguam9pbihvcy5ob21lZGlyKCksIGlkZW50aXR5RmlsZU5hbWUoZG9tYWluKSl9LGBcbiAgICAgICAgICAgICsgYCB0aGVyZSBpcyBub25lLlxcbmBcbiAgICAgICAgICAgICsgYFRoaXMgbWFjaGluZSBoYXM6ICR7KGF3YWl0IGxvY2FsRG9tYWlucygpKS5qb2luKFwiLCBcIikgfHwgXCJubyBpZGVudGl0aWVzIGF0IGFsbFwifWBcbiAgICAgICAgKTtcbiAgICB9XG4gICAgbGV0IHN0b3JlZDogSWRlbnRpdHlTdG9yYWdlVHlwZSA9IEpTT04ucGFyc2UoXG4gICAgICAgIGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihvcy5ob21lZGlyKCksIGlkZW50aXR5LmZpbGVOYW1lKSwgXCJ1dGY4XCIpXG4gICAgKTtcbiAgICByZXR1cm4geyBpZGVudGl0eSwgc3RvcmVkIH07XG59XG5cbi8qKiBUaGUgaWRlbnRpdHkgb2YgYW5vdGhlciBtYWNoaW5lIHVuZGVyIG9uZSBkb21haW4sIG92ZXIgc3NoLiBVbmRlZmluZWQgd2hlbiBpdCBoYXMgbm9uZSB1bmRlclxuICAgIHRoYXQgZG9tYWluLCB3aGF0ZXZlciBlbHNlIGl0IG1heSBoYXZlIHVuZGVyIG90aGVycy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZW1vdGVJZGVudGl0eShob3N0OiBzdHJpbmcsIGRvbWFpbjogc3RyaW5nKTogUHJvbWlzZTxJZGVudGl0eSB8IHVuZGVmaW5lZD4ge1xuICAgIGlmICghZG9tYWluKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYSBkb21haW4sIHdhcyAke0pTT04uc3RyaW5naWZ5KGRvbWFpbil9YCk7XG4gICAgfVxuICAgIGxldCBob21lID0gKGF3YWl0IHJ1bk92ZXJTU0goeyBob3N0LCBzY3JpcHQ6IGBlY2hvICRIT01FYCB9KSkuc3Rkb3V0LnRyaW0oKTtcbiAgICBpZiAoIWhvbWUpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2hvc3R9IHRvIHJlcG9ydCBhIGhvbWUgZGlyZWN0b3J5LCBpdCByZXBvcnRlZCBub3RoaW5nYCk7XG4gICAgfVxuICAgIGxldCBjb250ZW50cyA9IGF3YWl0IHJ1bk92ZXJTU0goe1xuICAgICAgICBob3N0LFxuICAgICAgICBzY3JpcHQ6IGBjYXQgJHtob21lfS8ke2lkZW50aXR5RmlsZU5hbWUoZG9tYWluKX0gMj4vZGV2L251bGwgfHwgdHJ1ZWAsXG4gICAgfSk7XG4gICAgaWYgKCFjb250ZW50cy5zdGRvdXQudHJpbSgpKSB7XG4gICAgICAgIHJldHVybiB1bmRlZmluZWQ7XG4gICAgfVxuICAgIHJldHVybiBkZXNjcmliZUlkZW50aXR5KHsgZG9tYWluLCBzdG9yZWQ6IEpTT04ucGFyc2UoY29udGVudHMuc3Rkb3V0KSB9KTtcbn1cblxuLyoqIEdpdmVzIGEgbWFjaGluZSBhbiBpZGVudGl0eSBpdCBkb2VzIG5vdCBoYXZlIHlldCwgYnkgZ2VuZXJhdGluZyBvbmUgaGVyZSBhbmQgd3JpdGluZyBpdCB0aGVyZS5cblxuICAgIFRoZSBDQSBpcyBzZWxmIHNpZ25lZCBhbmQgbmV2ZXIgbGVhdmVzIHRoYXQgbWFjaGluZSBhZnRlcndhcmRzLCBzbyBnZW5lcmF0aW5nIGl0IGhlcmUgaXMgb25seSBhXG4gICAgY29udmVuaWVuY2U6IHdoYXQgbWF0dGVycyBpcyB0aGF0IHRoZSBwcml2YXRlIGtleSBlbmRzIHVwIGluIG9uZSBwbGFjZSBhbmQgdGhlIGlkIGlzIHRoZSBoYXNoXG4gICAgb2YgaXRzIHB1YmxpYyBoYWxmLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGNyZWF0ZVJlbW90ZUlkZW50aXR5KGNvbmZpZzogeyBob3N0OiBzdHJpbmc7IGRvbWFpbjogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyBob3N0LCBkb21haW4gfSA9IGNvbmZpZztcbiAgICBsZXQgZ2VuZXJhdGVkID0gZ2VuZXJhdGVUZXN0Q0EoZG9tYWluKTtcbiAgICBsZXQgc3RvcmVkOiBJZGVudGl0eVN0b3JhZ2VUeXBlID0ge1xuICAgICAgICBkb21haW46IGdlbmVyYXRlZC5kb21haW4sXG4gICAgICAgIGNlcnRCNjQ6IGdlbmVyYXRlZC5jZXJ0LnRvU3RyaW5nKFwiYmFzZTY0XCIpLFxuICAgICAgICBrZXlCNjQ6IGdlbmVyYXRlZC5rZXkudG9TdHJpbmcoXCJiYXNlNjRcIiksXG4gICAgfTtcbiAgICBsZXQgaG9tZSA9IChhd2FpdCBydW5PdmVyU1NIKHsgaG9zdCwgc2NyaXB0OiBgZWNobyAkSE9NRWAgfSkpLnN0ZG91dC50cmltKCk7XG4gICAgYXdhaXQgd3JpdGVSZW1vdGVGaWxlKHtcbiAgICAgICAgaG9zdCxcbiAgICAgICAgZmlsZVBhdGg6IGAke2hvbWV9LyR7aWRlbnRpdHlGaWxlTmFtZShkb21haW4pfWAsXG4gICAgICAgIGNvbnRlbnRzOiBKU09OLnN0cmluZ2lmeShzdG9yZWQpLFxuICAgICAgICBmaWxlTW9kZTogXCI2MDBcIixcbiAgICAgICAgLy8gVGhlIGhvbWUgZGlyZWN0b3J5IGlzIGFscmVhZHkgdGhlcmUsIHRoaXMgaXMgb25seSB3aGF0IGl0IGlzIGNyZWF0ZWQgd2l0aCBpZiBpdCBpcyBub3QuXG4gICAgICAgIGRpcmVjdG9yeU1vZGU6IFwiNzAwXCIsXG4gICAgfSk7XG4gICAgcmV0dXJuIGRlc2NyaWJlSWRlbnRpdHkoeyBkb21haW4sIHN0b3JlZCB9KTtcbn1cblxuLyoqIFRoZSByYXcgZWQyNTUxOSBwdWJsaWMga2V5IG91dCBvZiBhIGNlcnRpZmljYXRlLCB3aGljaCBpcyB3aGF0IHRoZSBtYWNoaW5lIGlkIGlzIGEgaGFzaCBvZi4gKi9cbmZ1bmN0aW9uIHB1YmxpY0tleUJ5dGVzKGNlcnRQRU06IHN0cmluZykge1xuICAgIGxldCBzcGtpID0gbmV3IGNyeXB0by5YNTA5Q2VydGlmaWNhdGUoY2VydFBFTSkucHVibGljS2V5LmV4cG9ydCh7IHR5cGU6IFwic3BraVwiLCBmb3JtYXQ6IFwiZGVyXCIgfSk7XG4gICAgLy8gQW4gZWQyNTUxOSBTUEtJIGlzIGEgZml4ZWQgMTIgYnl0ZSBoZWFkZXIgZm9sbG93ZWQgYnkgdGhlIDMyIGJ5dGUga2V5LlxuICAgIHJldHVybiBzcGtpLnN1YmFycmF5KHNwa2kubGVuZ3RoIC0gMzIpO1xufVxuXG5leHBvcnQgdHlwZSBUcnVzdFBhY2tldCA9IHtcbiAgICBtYWNoaW5lSWQ6IHN0cmluZztcbiAgICBjZXJ0QjY0OiBzdHJpbmc7XG4gICAgc2lnbmVkQXQ6IG51bWJlcjtcbiAgICBzaWduYXR1cmVCNjQ6IHN0cmluZztcbn07XG5cbi8qKiBQcm92ZXMgd2UgaG9sZCB0aGUgcHJpdmF0ZSBrZXkgYmVoaW5kIG91ciBtYWNoaW5lIGlkLCByaWdodCBub3cuIFRoZSBzaWduYXR1cmUgY292ZXJzIHRoZSBpZFxuICAgIGFuZCB0aGUgdGltZSwgc28gdGhlIHBhY2tldCBjYW5ub3QgYmUgcmVwbGF5ZWQgbGF0ZXIgb3IgcmV1c2VkIGZvciBhbm90aGVyIGlkLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHNpZ25UcnVzdFBhY2tldChkb21haW46IHN0cmluZyk6IFByb21pc2U8VHJ1c3RQYWNrZXQ+IHtcbiAgICBsZXQgeyBpZGVudGl0eSwgc3RvcmVkIH0gPSBhd2FpdCBsb2NhbElkZW50aXR5S2V5cyhkb21haW4pO1xuICAgIGxldCBzaWduZWRBdCA9IERhdGUubm93KCk7XG4gICAgbGV0IHNpZ25hdHVyZSA9IGNyeXB0by5zaWduKFxuICAgICAgICBudWxsLFxuICAgICAgICBCdWZmZXIuZnJvbShgJHtpZGVudGl0eS5tYWNoaW5lSWR9ICR7c2lnbmVkQXR9YCksXG4gICAgICAgIGNyeXB0by5jcmVhdGVQcml2YXRlS2V5KEJ1ZmZlci5mcm9tKHN0b3JlZC5rZXlCNjQsIFwiYmFzZTY0XCIpLnRvU3RyaW5nKCkpXG4gICAgKTtcbiAgICByZXR1cm4ge1xuICAgICAgICBtYWNoaW5lSWQ6IGlkZW50aXR5Lm1hY2hpbmVJZCxcbiAgICAgICAgY2VydEI2NDogc3RvcmVkLmNlcnRCNjQsXG4gICAgICAgIHNpZ25lZEF0LFxuICAgICAgICBzaWduYXR1cmVCNjQ6IHNpZ25hdHVyZS50b1N0cmluZyhcImJhc2U2NFwiKSxcbiAgICB9O1xufVxuXG4vKiogV2hldGhlciBhIHBhY2tldCByZWFsbHkgY2FtZSBmcm9tIHRoZSBtYWNoaW5lIGl0IG5hbWVzLiBTYXlzIHdoeSB3aGVuIGl0IGRpZCBub3QsIGJlY2F1c2VcbiAgICBcInRoaXMgaXMgbm90IHRoYXQgbWFjaGluZVwiIGFuZCBcInRoaXMgYXJyaXZlZCB0b28gbGF0ZVwiIGFyZSBkaWZmZXJlbnQgcHJvYmxlbXMuICovXG5leHBvcnQgZnVuY3Rpb24gdmVyaWZ5VHJ1c3RQYWNrZXQocGFja2V0OiBUcnVzdFBhY2tldCkge1xuICAgIGlmICghcGFja2V0IHx8ICFwYWNrZXQubWFjaGluZUlkIHx8ICFwYWNrZXQuY2VydEI2NCB8fCAhcGFja2V0LnNpZ25hdHVyZUI2NCkge1xuICAgICAgICByZXR1cm4geyB2YWxpZDogZmFsc2UsIHByb2JsZW06IFwidGhlIHBhY2tldCBpcyBtaXNzaW5nIGZpZWxkc1wiIH07XG4gICAgfVxuICAgIGlmIChNYXRoLmFicyhEYXRlLm5vdygpIC0gcGFja2V0LnNpZ25lZEF0KSA+IFBBQ0tFVF9MSUZFVElNRSkge1xuICAgICAgICByZXR1cm4geyB2YWxpZDogZmFsc2UsIHByb2JsZW06IGBpdCB3YXMgc2lnbmVkICR7TWF0aC5yb3VuZCgoRGF0ZS5ub3coKSAtIHBhY2tldC5zaWduZWRBdCkgLyAxMDAwKX1zIGFnb2AgfTtcbiAgICB9XG4gICAgbGV0IGNlcnRQRU0gPSBCdWZmZXIuZnJvbShwYWNrZXQuY2VydEI2NCwgXCJiYXNlNjRcIikudG9TdHJpbmcoKTtcbiAgICBsZXQgcHVibGljS2V5OiBjcnlwdG8uS2V5T2JqZWN0O1xuICAgIHRyeSB7XG4gICAgICAgIHB1YmxpY0tleSA9IG5ldyBjcnlwdG8uWDUwOUNlcnRpZmljYXRlKGNlcnRQRU0pLnB1YmxpY0tleTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIHJldHVybiB7IHZhbGlkOiBmYWxzZSwgcHJvYmxlbTogYGl0cyBjZXJ0aWZpY2F0ZSBjb3VsZCBub3QgYmUgcmVhZCwgJHtlfWAgfTtcbiAgICB9XG4gICAgLy8gVGhlIGlkIGlzIGEgaGFzaCBvZiB0aGUgcHVibGljIGtleSwgc28gdGhpcyBpcyB3aGF0IHN0b3BzIGEgbWFjaGluZSBjbGFpbWluZyBhbm90aGVyJ3MgaWQuXG4gICAgaWYgKCF2ZXJpZnlNYWNoaW5lSWRGb3JQdWJsaWNLZXkoeyBtYWNoaW5lSWQ6IHBhY2tldC5tYWNoaW5lSWQsIHB1YmxpY0tleTogcHVibGljS2V5Qnl0ZXMoY2VydFBFTSkgfSkpIHtcbiAgICAgICAgcmV0dXJuIHsgdmFsaWQ6IGZhbHNlLCBwcm9ibGVtOiBcInRoZSBtYWNoaW5lIGlkIGRvZXMgbm90IGJlbG9uZyB0byB0aGF0IGNlcnRpZmljYXRlXCIgfTtcbiAgICB9XG4gICAgbGV0IHNpZ25lZCA9IGNyeXB0by52ZXJpZnkoXG4gICAgICAgIG51bGwsXG4gICAgICAgIEJ1ZmZlci5mcm9tKGAke3BhY2tldC5tYWNoaW5lSWR9ICR7cGFja2V0LnNpZ25lZEF0fWApLFxuICAgICAgICBwdWJsaWNLZXksXG4gICAgICAgIEJ1ZmZlci5mcm9tKHBhY2tldC5zaWduYXR1cmVCNjQsIFwiYmFzZTY0XCIpXG4gICAgKTtcbiAgICBpZiAoIXNpZ25lZCkge1xuICAgICAgICByZXR1cm4geyB2YWxpZDogZmFsc2UsIHByb2JsZW06IFwidGhlIHNpZ25hdHVyZSBkb2VzIG5vdCBjaGVjayBvdXRcIiB9O1xuICAgIH1cbiAgICByZXR1cm4geyB2YWxpZDogdHJ1ZSwgcHJvYmxlbTogXCJcIiB9O1xufVxuIl19
+ /* _JS_SOURCE_HASH = "2b16a13142ed08ef2e755cf33ce9a940aaef44261d0b1bdd42b8efe807f54df2"; */