sliftutils 1.7.129 → 1.7.131

package/security/machines/machines.d.ts

@@ -0,0 +1,81 @@
+export declare const MACHINES_DIR = "machines";
+/** One machine we are willing to talk to, and the addresses it may talk to us from. */
+export type MachineState = {
+    machineId: string;
+    ips: string[];
+    addedAt: string;
+};
+/** This machine's keys repo, worked out once and then remembered.
+
+    A failure is remembered too, but only briefly: a server may well start before the machine has
+    been set up, and should start working when it is, rather than needing a restart. */
+export declare const keysRepo: {
+    (): Promise<{
+        repoPath: string;
+        sourceURL: string;
+    }>;
+    reset(): void;
+    set(newValue: Promise<{
+        repoPath: string;
+        sourceURL: string;
+    }>): void;
+};
+/** Every machine a checkout lists. Without a repo, this machine's own. */
+export declare function getMachines(repoPath?: string): Promise<MachineState[]>;
+/** The machines this system trusts, as the signed repo lists them.
+
+    Held rather than read per call, and refreshed in the background, so nobody asking whether a
+    machine is trusted waits for a directory of files to be read and a signature to be checked. A
+    refresh that fails leaves the list we already have: the checkout is only stale, not wrong. */
+export declare function getTrustedMachines(): Promise<MachineState[]>;
+/** Makes a checkout list exactly these machines: those named are written with the addresses given,
+    and anything not named is removed. So read them, change what you want, and write the result.
+
+    The addresses are part of setting rather than a separate step, because a machine with no
+    address it may talk from is not a machine that would ever be accepted - there is no state where
+    naming one without them means anything.
+
+    Nothing here signs or commits. The signature is what every other machine checks before
+    believing any of this, and it takes the hardware key, so `yarn signfiles git` is still yours to
+    run afterwards. */
+export declare function setMachines(config: {
+    repoPath?: string;
+    machines: {
+        machineId: string;
+        ips: string[];
+    }[];
+}): Promise<MachineState[]>;
+/** What to run to trust a machine that has just been refused.
+
+    Everything in it is already known to whoever is being refused: their machine id, the address we
+    saw them at, and the domain they just talked to. Handing it back saves them working out the
+    parts of a command they have every right to know. Running it still takes the hardware key on
+    the machine that owns the repo, so telling them costs nothing. */
+export declare function addMachineCommand(config: {
+    machineId: string;
+    ip: string;
+    domain?: string;
+}): string;
+/** Whether we will talk to this machine, coming from this address.
+
+    Both halves are required and neither is a guess: the caller knows the machine id because the
+    connection proved it, and knows the address because the packets came from there. A machine we
+    do not list is simply not accepted. A machine we do list, arriving from an address it does not
+    have, is treated as the same kind of event as a stolen ssh key - it is revoked everywhere, and
+    stays revoked until an unrevoke allows that machine from that address.
+
+    Says why when the answer is no, because the three ways to be refused are entirely different
+    things to a person reading it: never trusted at all, trusted but frozen, or trusted and talking
+    from somewhere it should not be.
+
+    Throws when the repo itself cannot be read or is not signed, rather than answering false: that
+    is a broken installation, not a rejected machine, and the two deserve different handling. */
+export type MachineVerdict = {
+    accepted: boolean;
+    reason: string;
+};
+export declare function isMachineAccepted(config: {
+    machineId: string;
+    ip: string;
+    domain?: string;
+}): Promise<MachineVerdict>;

package/security/machines/machines.ts

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import os from "os";
 import path from "path";
-import { CONFIG_PATH } from "../authorizedKeys/daemon/paths";
+import { resolveKeysRepo } from "../authorizedKeys/keysRepo";
 import { revokeRepo, syncRepoFiles } from "../authorizedKeys/daemon/repoFiles";
 import { listRepoDir, readRepoFile } from "../authorizedKeys/daemon/repoFiles";
 import { newRevocationId, pairKey, readRevocationFiles, readUnrevokes } from "../authorizedKeys/daemon/revocation";
@@ -9,10 +9,10 @@ import { runGit } from "../authorizedKeys/daemon/git";
 import { ensureRevokeKey } from "../authorizedKeys/daemon/repoFiles";
 import { verifyCheckout } from "../authorizedKeys/daemon/trust";
 import { revokeRepoPath, revokeRepoURL } from "../authorizedKeys/revokeSource";
-import { sourceRepoPath } from "../authorizedKeys/sources";
 import { notify } from "../authorizedKeys/daemon/notify";
 import { areDiscordNotificationsConfigured, configureDiscordNotifications, DEFAULT_WEBHOOK_FILE_PATH } from "../notifications/discord";
-import { unrevokeInEffect } from "./trustState";
+import { lazy } from "socket-function/src/caching";
+import { runInfinitePoll } from "socket-function/src/batching";
 import { spawnPromise } from "../helpers/spawn";
 
 // Which machines this system talks to, kept in the same repo as the ssh keys. That repo is already
@@ -24,9 +24,14 @@ const REVOCATION_REASON = "a machine talked to us from an unapproved IP";
 // The revoke repo is pulled at most this often. A check happens per request, and a request must
 // not cost a round trip to github.
 const REVOKE_SYNC_INTERVAL = 60 * 1000;
-// Where a Windows machine is expected to keep the repo, relative to the working directory. There
-// is no daemon there to ask, and no /etc to look in.
-const WINDOWS_REPO_PATH = "../authorized_keys";
+// And the machine list is re-read from the checkout on this interval, in the background. The
+// checkout itself only moves when the daemon pulls it, which is on the same sort of interval, so
+// reading more often than this would only re-read the same bytes.
+const MACHINES_REFRESH_INTERVAL = 60 * 1000;
+// How long a failure to find the keys repo is remembered. A long lived process may start before
+// the machine is set up, and should pick it up once it is, without being restarted - but it must
+// not pay for resolving the repo on every request either.
+const REPO_RETRY_DELAY = 15 * 1000;
 
 /** One machine we are willing to talk to, and the addresses it may talk to us from. */
 export type MachineState = {
@@ -48,27 +53,78 @@ function machineFilePath(repoPath: string, machineId: string) {
     return path.join(repoPath, MACHINES_DIR, `${machineId}.json`);
 }
 
-/** Reads every machine a checkout lists, or sets them.
+/** This machine's keys repo, worked out once and then remembered.
 
-    Passing `machines` makes the repo match it exactly: machines named are written with the
-    addresses given, and machines not named are removed. That is why the addresses are part of
-    setting rather than a separate step - a machine with no address it may talk from is not a
-    machine we would accept anyway, so there is no state where naming one without them means
-    anything. Read first, change what you want, write the result.
+    A failure is remembered too, but only briefly: a server may well start before the machine has
+    been set up, and should start working when it is, rather than needing a restart. */
+export const keysRepo = lazy(async () => {
+    let lookup = resolveKeysRepo();
+    lookup.catch(() => {
+        setTimeout(() => keysRepo.reset(), REPO_RETRY_DELAY).unref();
+    });
+    return await lookup;
+});
+
+/** Every machine a checkout lists. Without a repo, this machine's own. */
+export async function getMachines(repoPath?: string): Promise<MachineState[]> {
+    return [...(await readMachines(repoPath || (await keysRepo()).repoPath)).values()];
+}
+
+/** Reads the machine list, once its signature has been checked. An unsigned machine list, or one
+    signed over different contents, is not evidence of anything, so this throws rather than
+    quietly trusting nobody. */
+async function readTrustedMachines() {
+    let { repoPath } = await keysRepo();
+    await verifyCheckout(repoPath);
+    return await getMachines(repoPath);
+}
 
-    Nothing here signs or commits anything. The signature is what every other machine checks before
+const trustedMachines = lazy(async () => {
+    let read = readTrustedMachines();
+    read.catch(() => trustedMachines.reset());
+    return await read;
+});
+
+let refreshing = false;
+
+/** The machines this system trusts, as the signed repo lists them.
+
+    Held rather than read per call, and refreshed in the background, so nobody asking whether a
+    machine is trusted waits for a directory of files to be read and a signature to be checked. A
+    refresh that fails leaves the list we already have: the checkout is only stale, not wrong. */
+export async function getTrustedMachines(): Promise<MachineState[]> {
+    if (!refreshing) {
+        refreshing = true;
+        runInfinitePoll(MACHINES_REFRESH_INTERVAL, async () => {
+            try {
+                trustedMachines.set(Promise.resolve(await readTrustedMachines()));
+            } catch (e) {
+                console.log(`Could not re-read the trusted machines, keeping the ones we have. ${e}`);
+            }
+        });
+    }
+    return await trustedMachines();
+}
+
+/** Makes a checkout list exactly these machines: those named are written with the addresses given,
+    and anything not named is removed. So read them, change what you want, and write the result.
+
+    The addresses are part of setting rather than a separate step, because a machine with no
+    address it may talk from is not a machine that would ever be accepted - there is no state where
+    naming one without them means anything.
+
+    Nothing here signs or commits. The signature is what every other machine checks before
     believing any of this, and it takes the hardware key, so `yarn signfiles git` is still yours to
     run afterwards. */
-export async function machineState(config: {
-    repoPath: string;
-    machines?: { machineId: string; ips: string[] }[];
+export async function setMachines(config: {
+    repoPath?: string;
+    machines: { machineId: string; ips: string[] }[];
 }): Promise<MachineState[]> {
-    let { repoPath, machines } = config;
+    let { machines } = config;
+    let repoPath = config.repoPath || (await keysRepo()).repoPath;
+    // Whatever was held is now stale, whoever reads it next.
+    trustedMachines.reset();
     let existing = await readMachines(repoPath);
-    if (!machines) {
-        return [...existing.values()];
-    }
-
     let directory = path.join(repoPath, MACHINES_DIR);
     let written: MachineState[] = [];
     for (let machine of machines) {
@@ -122,61 +178,6 @@ async function readMachines(repoPath: string) {
     return machines;
 }
 
-async function isKeysRepo(repoPath: string) {
-    return await pathExists(path.join(repoPath, ".git"))
-        && await pathExists(path.join(repoPath, "authorized_keys"));
-}
-
-async function originOf(repoPath: string) {
-    let origin = await spawnPromise({ command: "git", args: ["remote", "get-url", "origin"], cwd: repoPath });
-    let url = origin.stdout.trim();
-    if (origin.status !== 0 || !url) {
-        throw new Error(`Expected ${repoPath} to have an origin remote, it has none`);
-    }
-    return url;
-}
-
-/** The keys repo this machine answers from, and the one anything editing the machine list edits.
-
-    On a host, that is the checkout the daemon already keeps up to date. On Windows there is no
-    daemon and no /etc, so the repo is expected beside the working directory, which is where a
-    developer working on both would have it.
-
-    Never the directory the command happens to be run from. Which repo this machine trusts is a
-    property of the machine, not of where somebody was standing when they typed something. */
-export async function resolveKeysRepo() {
-    if (os.platform() === "win32") {
-        let repoPath = path.resolve(WINDOWS_REPO_PATH);
-        if (!await isKeysRepo(repoPath)) {
-            throw new Error(
-                `Expected ${repoPath} to be an authorized_keys repo, it is not.\n`
-                + `On Windows the repo is read from there, so clone it beside this one:\n`
-                + `  git clone <your authorized_keys repo> ${repoPath}`
-            );
-        }
-        return { repoPath, sourceURL: await originOf(repoPath) };
-    }
-
-    let config = await fs.readFile(CONFIG_PATH, "utf8").catch(() => "");
-    let sourceURL = config && (JSON.parse(config).repoSources || [])[0] || "";
-    if (!sourceURL) {
-        throw new Error(
-            `Expected this machine to be set up with an authorized_keys repo, ${CONFIG_PATH} names none.\n`
-            + `Set it up first:\n`
-            + `  yarn setupnotify <discord-webhook-url>\n`
-            + `  yarn securessh add <repo-private-key> <repo-url>`
-        );
-    }
-    let repoPath = sourceRepoPath(sourceURL);
-    if (!await isKeysRepo(repoPath)) {
-        throw new Error(
-            `Expected a checkout of ${sourceURL} at ${repoPath}, there is none.\n`
-            + `Run \`yarn securessh update\` to put it back.`
-        );
-    }
-    return { repoPath, sourceURL };
-}
-
 let lastRevokeSync = 0;
 
 /** Pulled at most once a REVOKE_SYNC_INTERVAL, because this is asked per request. A sync that
@@ -218,6 +219,17 @@ async function readMachineRevocations(sourceURL: string) {
     return revocations;
 }
 
+/** What to run to trust a machine that has just been refused.
+
+    Everything in it is already known to whoever is being refused: their machine id, the address we
+    saw them at, and the domain they just talked to. Handing it back saves them working out the
+    parts of a command they have every right to know. Running it still takes the hardware key on
+    the machine that owns the repo, so telling them costs nothing. */
+export function addMachineCommand(config: { machineId: string; ip: string; domain?: string }) {
+    let { machineId, ip, domain } = config;
+    return `To trust it, run: yarn addmachine ${domain || "<domain>"} ${machineId} ${ip} git`;
+}
+
 /** Sends the one notification this file is allowed to send, when it can.
 
     The daemon configures notifications on startup and would simply send. This can also run in some
@@ -285,7 +297,7 @@ async function recordMachineRevocation(config: {
         + `\n\nIt is frozen everywhere now, and nothing accepts it.`
         + `\n\nIf this was an attack, remove \`machines/${machineId}.json\` from \`${sourceURL}\` now.`
         + `\nIf it was legitimate, run \`yarn unrevoke git\` in that repo. It allows ${ip} for that`
-        + ` machine, and takes an hour to reach every machine.`
+        + ` machine, and takes effect as each machine picks it up.`
         + `\n\nmachine: \`${machineId}\``
         + `\nfrozen by: \`${hostLabel}\``
     );
@@ -299,48 +311,59 @@ async function recordMachineRevocation(config: {
     have, is treated as the same kind of event as a stolen ssh key - it is revoked everywhere, and
     stays revoked until an unrevoke allows that machine from that address.
 
+    Says why when the answer is no, because the three ways to be refused are entirely different
+    things to a person reading it: never trusted at all, trusted but frozen, or trusted and talking
+    from somewhere it should not be.
+
     Throws when the repo itself cannot be read or is not signed, rather than answering false: that
     is a broken installation, not a rejected machine, and the two deserve different handling. */
-export async function isMachineAccepted(config: { machineId: string; ip: string }): Promise<boolean> {
-    let { machineId, ip } = config;
+export type MachineVerdict = { accepted: boolean; reason: string };
+
+export async function isMachineAccepted(config: {
+    machineId: string;
+    ip: string;
+    // Only used to write a complete command into the refusal. A caller that knows which domain it
+    // is answering as saves whoever is refused from having to guess it.
+    domain?: string;
+}): Promise<MachineVerdict> {
+    let { machineId, ip, domain } = config;
     if (!machineId || !ip) {
         throw new Error(`Expected a machineId and an ip, was ${JSON.stringify(machineId)} and ${JSON.stringify(ip)}`);
     }
-    let { repoPath, sourceURL } = await resolveKeysRepo();
-    // Unsigned, or signed over different contents, means the machine list is not evidence of
-    // anything. Same gate the ssh keys go through.
-    await verifyCheckout(repoPath);
-
-    let machine = (await readMachines(repoPath)).get(machineId);
+    let { sourceURL } = await keysRepo();
+    // Verified before it is believed, and cached, since this is asked once per request.
+    let machine = (await getTrustedMachines()).find(entry => entry.machineId === machineId);
     if (!machine) {
-        return false;
+        return { accepted: false, reason: `that machine is not trusted. ${addMachineCommand({ machineId, ip, domain })}` };
     }
 
     await syncRevocations(sourceURL);
     let unrevokes = await readUnrevokes(sourceURL).catch(() => ({ pairs: new Map(), legacyIds: new Map() }));
-    // An unrevoke is only honoured once it has waited out its hour, exactly as an ssh key's is.
-    let allowedAgain = async (pair: string) => {
-        let unrevokeId = unrevokes.pairs.get(pair);
-        return !!unrevokeId && await unrevokeInEffect(unrevokeId);
-    };
+    // An unrevoke counts as soon as it is seen. It is signed, so writing one already takes the
+    // hardware key, and anyone holding that can sign anything at all - a wait before honouring it
+    // guards against an attacker who has no need of it.
+    let allowedAgain = (pair: string) => !!unrevokes.pairs.get(pair)?.length;
     let revocations = await readMachineRevocations(sourceURL);
     // Any revocation nothing has undone keeps the machine out, from everywhere, the way a revoked
     // ssh key is out everywhere rather than only from the address it was misused from.
-    let revoked = false;
+    let frozenFrom = "";
     for (let revocation of revocations) {
         if (revocation.machineId !== machineId) {
             continue;
         }
-        if (!await allowedAgain(pairKey({ fingerprint: revocation.machineId, ip: revocation.ip }))) {
-            revoked = true;
+        if (!allowedAgain(pairKey({ fingerprint: revocation.machineId, ip: revocation.ip }))) {
+            frozenFrom = revocation.ip;
         }
     }
-    if (revoked) {
-        return false;
+    if (frozenFrom) {
+        return {
+            accepted: false,
+            reason: `that machine is frozen, it was used from ${frozenFrom} which it is not allowed from`,
+        };
     }
 
     if (machine.ips.includes(ip)) {
-        return true;
+        return { accepted: true, reason: "" };
     }
 
     // Listed, but talking to us from somewhere it should not be. Recorded once for this machine
@@ -348,8 +371,9 @@ export async function isMachineAccepted(config: { machineId: string; ip: string
     let pair = pairKey({ fingerprint: machineId, ip });
     let alreadyRecorded = revocations.some(revocation =>
         pairKey({ fingerprint: revocation.machineId, ip: revocation.ip }) === pair);
-    if (!alreadyRecorded && !await allowedAgain(pair)) {
+    if (!alreadyRecorded && !allowedAgain(pair)) {
         await recordMachineRevocation({ sourceURL, machineId, ip, hostLabel: os.hostname() });
+        return { accepted: false, reason: `that machine is not allowed from ${ip}, so it is now frozen everywhere` };
     }
-    return false;
+    return { accepted: false, reason: `that machine is not allowed from ${ip}` };
 }

package/security/machines/trustServer.ts

@@ -47,14 +47,16 @@ export function startTrustServer(config: { port: number }) {
                 // Not a rejection of the machine, a packet that does not prove anything about one.
                 return { status: 400, body: { trusted: false, ip, reason: verified.problem } };
             }
-            let trusted = await isMachineAccepted({ machineId: packet.machineId, ip });
+            let verdict = await isMachineAccepted({ machineId: packet.machineId, ip });
             return {
                 status: 200,
                 body: {
-                    trusted,
+                    trusted: verdict.accepted,
                     machineId: packet.machineId,
                     ip,
-                    reason: trusted && "" || "that machine is not trusted from that address",
+                    // Whatever the check itself said. It is the only thing that knows which of the
+                    // ways to be refused this was.
+                    reason: verdict.reason,
                 },
             };
         };

package/security/notifications/discord.d.ts

@@ -0,0 +1,36 @@
+export declare const DEFAULT_WEBHOOK_FILE_PATH = "/etc/portsecure/discord-webhook";
+/** Pulls the webhook URL out of webhook file contents. `sourceName` only appears in errors, so
+    callers can name a remote path. */
+export declare function parseWebhookFile(config: {
+    contents: string;
+    sourceName: string;
+}): string;
+/** Keeps the id and both ends of the token, so a reader can confirm which webhook replaced theirs
+    without receiving one they could post to. */
+export declare function redactWebhookURL(webhookURL: string): string;
+export declare function formatWebhookFile(webhookURL: string): string;
+/** When the message was sent, in the sending machine's own time zone. Discord shows when it
+    received something, which is not the same thing when a machine has been offline or a send has
+    been retried, and the zone matters when the machines are not all in one place. */
+export declare function messageTimestamp(now: Date): string;
+/** Sends to an explicit webhook URL, for tooling that acts on a webhook before (or instead of)
+    configureDiscordNotifications - setup, migrations, connectivity checks. */
+export declare function sendToWebhookURL(config: {
+    webhookURL: string;
+    message: string;
+}): Promise<void>;
+/** Must be called once on startup, before any notification is sent. Aborts the process if the
+    webhook file is missing or invalid, then re-checks the file on an interval and warns the old
+    webhook whenever it changes. */
+export declare function configureDiscordNotifications(config?: {
+    filePath?: string;
+    checkInterval?: number;
+}): Promise<{
+    filePath: string;
+    checkInterval: number;
+}>;
+export declare function sendDiscordNotification(message: string): Promise<void>;
+/** Whether notifications are set up in this process. For code that may run outside the daemon,
+    where sending is worth doing if it can be and not worth failing over if it cannot. */
+export declare function areDiscordNotificationsConfigured(): boolean;
+export declare function stopDiscordNotifications(): void;

package/security/notifications/dist/discord.ts.cache

@@ -1,4 +1,4 @@
-"use strict";
+"use strict"; var console = (function shimConsole() {             let baseConsole = globalThis.console;             if (typeof window !== "undefined")                 return baseConsole;             let name = __filename.replaceAll("\\", "/").split("/").pop();             let dirName = __dirname.replaceAll("\\", "/").split("/").pop();             let context = {                 __FILE__: __filename,                 __DIR__: __dirname,                 __NAME__: name,                 __DIRNAME__: dirName             };             let newConsole = {                 ...baseConsole             };             for (let shim of ["log", "info", "warn", "error"]) {                 newConsole[shim] = (...args) => {                     args.push(context);                     baseConsole[shim](...args);                 };             }             newConsole.__context = context;             return newConsole;         })(); "use strict";
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
 };
@@ -203,4 +203,4 @@ function stopDiscordNotifications() {
 }
 exports.stopDiscordNotifications = stopDiscordNotifications;
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzY29yZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImRpc2NvcmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsMkRBQTZCO0FBRTdCLHNIQUFzSDtBQUN0SCxrR0FBa0c7QUFDbEcsOENBQThDO0FBRWpDLFFBQUEseUJBQXlCLEdBQUcsaUNBQWlDLENBQUM7QUFDM0UsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUM3QyxNQUFNLHNCQUFzQixHQUFHO0lBQzNCLG1DQUFtQztJQUNuQyxzQ0FBc0M7SUFDdEMsMENBQTBDO0NBQzdDLENBQUM7QUFDRixNQUFNLHFCQUFxQixHQUFHLElBQUksQ0FBQztBQUNuQyxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQztBQUNsQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsQ0FBQztBQUM1QixNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQztBQUNqQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsR0FBRyxJQUFJLENBQUM7QUFFekMsSUFBSSxpQkFJUyxDQUFDO0FBRWQsc0ZBQXNGO0FBQ3RGLDRDQUE0QztBQUM1QyxJQUFJLFNBQVMsR0FBcUIsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0FBRXBEO3NDQUNzQztBQUN0QyxTQUFnQixnQkFBZ0IsQ0FBQyxNQUFnRDtJQUM3RSxJQUFJLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUN0QyxJQUFJLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN4RyxJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUIsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2QsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsVUFBVSxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQ3JHLENBQUM7SUFDRCxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDeEUsTUFBTSxJQUFJLEtBQUssQ0FDWCx1REFBdUQsc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJO2NBQzFGLE9BQU8sVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsUUFBUSxVQUFVLEdBQUcsQ0FDM0UsQ0FBQztJQUNOLENBQUM7SUFDRCxPQUFPLFVBQVUsQ0FBQztBQUN0QixDQUFDO0FBZEQsNENBY0M7QUFFRDtnREFDZ0Q7QUFDaEQsU0FBZ0IsZ0JBQWdCLENBQUMsVUFBa0I7SUFDL0MsSUFBSSxjQUFjLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqRCxJQUFJLElBQUksR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxjQUFjLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbkQsSUFBSSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxjQUFjLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDakQsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLHNCQUFzQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzdDLG1FQUFtRTtRQUNuRSxPQUFPLEdBQUcsSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHNCQUFzQixDQUFDLEtBQUssQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxHQUFHLElBQUksR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxzQkFBc0IsQ0FBQyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLENBQUM7QUFDeEcsQ0FBQztBQVRELDRDQVNDO0FBRUQsU0FBZ0IsaUJBQWlCLENBQUMsVUFBa0I7SUFDaEQsT0FBTyxrRUFBa0UsVUFBVSxJQUFJLENBQUM7QUFDNUYsQ0FBQztBQUZELDhDQUVDO0FBRUQsS0FBSyxVQUFVLGVBQWUsQ0FBQyxRQUFnQjtJQUMzQyxJQUFJLFFBQVEsQ0FBQztJQUNiLElBQUksQ0FBQztRQUNELFFBQVEsR0FBRyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLFFBQVEsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxPQUFPLGdCQUFnQixDQUFDLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUFFRDs7cUZBRXFGO0FBQ3JGLFNBQWdCLGdCQUFnQixDQUFDLEdBQVM7SUFDdEMsSUFBSSxJQUFJLEdBQUcsR0FBRyxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzNDLElBQUksSUFBSSxHQUFHLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLEVBQUU7UUFDdkMsSUFBSSxFQUFFLFNBQVM7UUFDZixNQUFNLEVBQUUsU0FBUztRQUNqQixNQUFNLEVBQUUsU0FBUztRQUNqQixNQUFNLEVBQUUsSUFBSTtRQUNaLFlBQVksRUFBRSxPQUFPO0tBQ3hCLENBQUMsQ0FBQztJQUNILE9BQU8sR0FBRyxJQUFJLElBQUksSUFBSSxFQUFFLENBQUM7QUFDN0IsQ0FBQztBQVZELDRDQVVDO0FBRUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxVQUFrQixFQUFFLE9BQWU7SUFDNUQsNEZBQTRGO0lBQzVGLDZGQUE2RjtJQUM3Riw0RUFBNEU7SUFDNUUsSUFBSSxPQUFPLEdBQUcsR0FBRyxPQUFPLFFBQVEsZ0JBQWdCLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxJQUFJLENBQUM7SUFDakUsSUFBSSxPQUFPLENBQUMsTUFBTSxHQUFHLHFCQUFxQixFQUFFLENBQUM7UUFDekMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixHQUFHLENBQUMsQ0FBQyxHQUFHLEtBQUssQ0FBQztJQUNsRSxDQUFDO0lBQ0QsS0FBSyxJQUFJLE9BQU8sR0FBRyxDQUFDLEVBQUUsT0FBTyxJQUFJLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDNUQsSUFBSSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsVUFBVSxFQUFFO1lBQ25DLE1BQU0sRUFBRSxNQUFNO1lBQ2QsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO1lBQy9DLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUM7U0FDcEMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDZCxPQUFPO1FBQ1gsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDLENBQUM7UUFDbkUsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLEdBQUcsSUFBSSxPQUFPLEdBQUcsaUJBQWlCLEVBQUUsQ0FBQztZQUN6RCxJQUFJLFVBQVUsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztZQUM3RCxJQUFJLFFBQVEsR0FBRyxVQUFVLElBQUksVUFBVSxHQUFHLElBQUksSUFBSSx1QkFBdUIsQ0FBQztZQUMxRSxNQUFNLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQzVELFNBQVM7UUFDYixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDWCx5REFBeUQsUUFBUSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsVUFBVSxVQUFVLElBQUksRUFBRSxDQUNsSCxDQUFDO0lBQ04sQ0FBQztBQUNMLENBQUM7QUFFRCxTQUFTLFNBQVMsQ0FBQyxVQUFrQixFQUFFLE9BQWU7SUFDbEQsSUFBSSxJQUFJLEdBQUcsR0FBRyxFQUFFLENBQUMsYUFBYSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNwRCxJQUFJLE1BQU0sR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN4QyxTQUFTLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMxQyxPQUFPLE1BQU0sQ0FBQztBQUNsQixDQUFDO0FBRUQ7OEVBQzhFO0FBQzlFLFNBQWdCLGdCQUFnQixDQUFDLE1BQStDO0lBQzVFLE9BQU8sU0FBUyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFGRCw0Q0FFQztBQUVELEtBQUssVUFBVSx1QkFBdUI7SUFDbEMsSUFBSSxLQUFLLEdBQUcsaUJBQWlCLENBQUM7SUFDOUIsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1QsT0FBTztJQUNYLENBQUM7SUFDRCxJQUFJLGFBQWEsQ0FBQztJQUNsQixJQUFJLENBQUM7UUFDRCxhQUFhLEdBQUcsTUFBTSxlQUFlLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsT0FBTyxDQUFDLEtBQUssQ0FBQywyRkFBMkYsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM5RyxPQUFPO0lBQ1gsQ0FBQztJQUNELElBQUksYUFBYSxLQUFLLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNyQyxPQUFPO0lBQ1gsQ0FBQztJQUNELDhGQUE4RjtJQUM5RixzQ0FBc0M7SUFDdEMsSUFBSSxDQUFDO1FBQ0QsTUFBTSxTQUFTLENBQ1gsS0FBSyxDQUFDLFVBQVUsRUFDaEIsaUVBQWlFO2NBQy9ELHNGQUFzRjtjQUN0Riw4Q0FBOEM7Y0FDOUMsc0JBQXNCLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxJQUFJO2NBQ3pELGVBQWUsS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUN0QyxDQUFDO0lBQ04sQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLENBQUMsS0FBSyxDQUFDLHdFQUF3RSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxLQUFLLENBQUMsVUFBVSxHQUFHLGFBQWEsQ0FBQztBQUNyQyxDQUFDO0FBRUQ7O21DQUVtQztBQUM1QixLQUFLLFVBQVUsNkJBQTZCLENBQUMsTUFHbkQ7SUFDRyxJQUFJLGlCQUFpQixFQUFFLENBQUM7UUFDcEIsTUFBTSxJQUFJLEtBQUssQ0FBQyw2RkFBNkYsaUJBQWlCLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztJQUNoSixDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsQ0FBQSxNQUFNLGFBQU4sTUFBTSx1QkFBTixNQUFNLENBQUUsUUFBUSxLQUFJLGlDQUF5QixDQUFDO0lBQzdELElBQUksYUFBYSxHQUFHLENBQUEsTUFBTSxhQUFOLE1BQU0sdUJBQU4sTUFBTSxDQUFFLGFBQWEsS0FBSSxzQkFBc0IsQ0FBQztJQUNwRSxJQUFJLFVBQVUsQ0FBQztJQUNmLElBQUksQ0FBQztRQUNELFVBQVUsR0FBRyxNQUFNLGVBQWUsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU8sQ0FBQyxLQUFLLENBQUMsd0VBQXdFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDM0YsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwQixDQUFDO0lBQ0QsSUFBSSxVQUFVLEdBQUcsV0FBVyxDQUFDLEdBQUcsRUFBRTtRQUM5Qix1QkFBdUIsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsa0RBQWtELENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMvRyxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDbEIsZ0VBQWdFO0lBQ2hFLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUNuQixpQkFBaUIsR0FBRyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDekQsT0FBTyxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsQ0FBQztBQUN2QyxDQUFDO0FBdkJELHNFQXVCQztBQUVELGdHQUFnRztBQUNoRyxpR0FBaUc7QUFDakcsdUVBQXVFO0FBQ2hFLEtBQUssVUFBVSx1QkFBdUIsQ0FBQyxPQUFlO0lBQ3pELElBQUksS0FBSyxHQUFHLGlCQUFpQixDQUFDO0lBQzlCLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsK0ZBQStGLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzlKLENBQUM7SUFDRCxNQUFNLFNBQVMsQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQy9DLENBQUM7QUFORCwwREFNQztBQUVEO3lGQUN5RjtBQUN6RixTQUFnQixpQ0FBaUM7SUFDN0MsT0FBTyxDQUFDLENBQUMsaUJBQWlCLENBQUM7QUFDL0IsQ0FBQztBQUZELDhFQUVDO0FBRUQsU0FBZ0Isd0JBQXdCO0lBQ3BDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3JCLE9BQU87SUFDWCxDQUFDO0lBQ0QsYUFBYSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzVDLGlCQUFpQixHQUFHLFNBQVMsQ0FBQztBQUNsQyxDQUFDO0FBTkQsNERBTUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5cbi8vIFBPUlRFRCBDT0RFOiBzZWN1cml0eS9hdXRob3JpemVkS2V5cy9kYWVtb24vcG9ydHNlY3VyZURhZW1vbi5qcyBlbWJlZHMgYSBoYW5kIHBvcnQgb2YgdGhpcyBmaWxlIGluIHBsYWluIEpTLCBzbyB0aGVcbi8vIGRhZW1vbiBjYW4gcnVuIHdpdGggbm8gZGVwZW5kZW5jaWVzLiBUaGUgdHdvIGFyZSBleHBlY3RlZCB0byBiZWhhdmUgaWRlbnRpY2FsbHkgLSBpZiB5b3UgY2hhbmdlXG4vLyBvbmUsIG1ha2UgdGhlIG1hdGNoaW5nIGNoYW5nZSBpbiB0aGUgb3RoZXIuXG5cbmV4cG9ydCBjb25zdCBERUZBVUxUX1dFQkhPT0tfRklMRV9QQVRIID0gXCIvZXRjL3BvcnRzZWN1cmUvZGlzY29yZC13ZWJob29rXCI7XG5jb25zdCBERUZBVUxUX0NIRUNLX0lOVEVSVkFMID0gNSAqIDYwICogMTAwMDtcbmNvbnN0IFZBTElEX1dFQkhPT0tfUFJFRklYRVMgPSBbXG4gICAgXCJodHRwczovL2Rpc2NvcmQuY29tL2FwaS93ZWJob29rcy9cIixcbiAgICBcImh0dHBzOi8vZGlzY29yZGFwcC5jb20vYXBpL3dlYmhvb2tzL1wiLFxuICAgIFwiaHR0cHM6Ly9jYW5hcnkuZGlzY29yZC5jb20vYXBpL3dlYmhvb2tzL1wiLFxuXTtcbmNvbnN0IERJU0NPUkRfTUVTU0FHRV9MSU1JVCA9IDIwMDA7XG5jb25zdCBNQVhfRVJST1JfQk9EWV9MRU5HVEggPSA1MDA7XG5jb25zdCBNQVhfU0VORF9BVFRFTVBUUyA9IDM7XG5jb25zdCBSRURBQ1RFRF9UT0tFTl9WSVNJQkxFID0gODtcbmNvbnN0IERFRkFVTFRfUkFURV9MSU1JVF9XQUlUID0gMiAqIDEwMDA7XG5cbmxldCBub3RpZmljYXRpb25TdGF0ZToge1xuICAgIGZpbGVQYXRoOiBzdHJpbmc7XG4gICAgd2ViaG9va1VSTDogc3RyaW5nO1xuICAgIGNoZWNrVGltZXI6IE5vZGVKUy5UaW1lb3V0O1xufSB8IHVuZGVmaW5lZDtcblxuLy8gRGlzY29yZCB3ZWJob29rcyBhcmUgcmF0ZSBsaW1pdGVkIChyb3VnaGx5IDUgcmVxdWVzdHMgcGVyIDIgc2Vjb25kcyksIHNvIGV2ZXJ5IHNlbmRcbi8vIGdvZXMgdGhyb3VnaCBvbmUgY2hhaW4gaW5zdGVhZCBvZiByYWNpbmcuXG5sZXQgc2VuZENoYWluOiBQcm9taXNlPHVua25vd24+ID0gUHJvbWlzZS5yZXNvbHZlKCk7XG5cbi8qKiBQdWxscyB0aGUgd2ViaG9vayBVUkwgb3V0IG9mIHdlYmhvb2sgZmlsZSBjb250ZW50cy4gYHNvdXJjZU5hbWVgIG9ubHkgYXBwZWFycyBpbiBlcnJvcnMsIHNvXG4gICAgY2FsbGVycyBjYW4gbmFtZSBhIHJlbW90ZSBwYXRoLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHBhcnNlV2ViaG9va0ZpbGUoY29uZmlnOiB7IGNvbnRlbnRzOiBzdHJpbmc7IHNvdXJjZU5hbWU6IHN0cmluZyB9KSB7XG4gICAgbGV0IHsgY29udGVudHMsIHNvdXJjZU5hbWUgfSA9IGNvbmZpZztcbiAgICBsZXQgbGluZXMgPSBjb250ZW50cy5zcGxpdChcIlxcblwiKS5tYXAobGluZSA9PiBsaW5lLnRyaW0oKSkuZmlsdGVyKGxpbmUgPT4gbGluZSAmJiAhbGluZS5zdGFydHNXaXRoKFwiI1wiKSk7XG4gICAgbGV0IHdlYmhvb2tVUkwgPSBsaW5lc1swXTtcbiAgICBpZiAoIXdlYmhvb2tVUkwpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhIERpc2NvcmQgd2ViaG9vayBVUkwgaW4gJHtzb3VyY2VOYW1lfSwgdGhlIGZpbGUgaGFzIG5vIHVzYWJsZSBsaW5lc2ApO1xuICAgIH1cbiAgICBpZiAoIVZBTElEX1dFQkhPT0tfUFJFRklYRVMuc29tZShwcmVmaXggPT4gd2ViaG9va1VSTC5zdGFydHNXaXRoKHByZWZpeCkpKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGBFeHBlY3RlZCBhIERpc2NvcmQgd2ViaG9vayBVUkwgc3RhcnRpbmcgd2l0aCBvbmUgb2YgJHtWQUxJRF9XRUJIT09LX1BSRUZJWEVTLmpvaW4oXCIsIFwiKX0sIGBcbiAgICAgICAgICAgICsgYHdhcyAke3dlYmhvb2tVUkwuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX0gKGluICR7c291cmNlTmFtZX0pYFxuICAgICAgICApO1xuICAgIH1cbiAgICByZXR1cm4gd2ViaG9va1VSTDtcbn1cblxuLyoqIEtlZXBzIHRoZSBpZCBhbmQgYm90aCBlbmRzIG9mIHRoZSB0b2tlbiwgc28gYSByZWFkZXIgY2FuIGNvbmZpcm0gd2hpY2ggd2ViaG9vayByZXBsYWNlZCB0aGVpcnNcbiAgICB3aXRob3V0IHJlY2VpdmluZyBvbmUgdGhleSBjb3VsZCBwb3N0IHRvLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlZGFjdFdlYmhvb2tVUkwod2ViaG9va1VSTDogc3RyaW5nKSB7XG4gICAgbGV0IHNlcGFyYXRvckluZGV4ID0gd2ViaG9va1VSTC5sYXN0SW5kZXhPZihcIi9cIik7XG4gICAgbGV0IGJhc2UgPSB3ZWJob29rVVJMLnNsaWNlKDAsIHNlcGFyYXRvckluZGV4ICsgMSk7XG4gICAgbGV0IHRva2VuID0gd2ViaG9va1VSTC5zbGljZShzZXBhcmF0b3JJbmRleCArIDEpO1xuICAgIGlmICh0b2tlbi5sZW5ndGggPD0gUkVEQUNURURfVE9LRU5fVklTSUJMRSAqIDIpIHtcbiAgICAgICAgLy8gVG9vIHNob3J0IHRvIHNob3cgYm90aCBlbmRzIHdpdGhvdXQgZ2l2aW5nIGF3YXkgdGhlIHdob2xlIHRva2VuLlxuICAgICAgICByZXR1cm4gYCR7YmFzZX0ke3Rva2VuLnNsaWNlKDAsIFJFREFDVEVEX1RPS0VOX1ZJU0lCTEUpfS4uLmA7XG4gICAgfVxuICAgIHJldHVybiBgJHtiYXNlfSR7dG9rZW4uc2xpY2UoMCwgUkVEQUNURURfVE9LRU5fVklTSUJMRSl9Li4uJHt0b2tlbi5zbGljZSgtUkVEQUNURURfVE9LRU5fVklTSUJMRSl9YDtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGZvcm1hdFdlYmhvb2tGaWxlKHdlYmhvb2tVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgIyBwb3J0c2VjdXJlIERpc2NvcmQgd2ViaG9vay4gRmlyc3Qgbm9uLWNvbW1lbnQgbGluZSBpcyB1c2VkLlxcbiR7d2ViaG9va1VSTH1cXG5gO1xufVxuXG5hc3luYyBmdW5jdGlvbiByZWFkV2ViaG9va0ZpbGUoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIGxldCBjb250ZW50cztcbiAgICB0cnkge1xuICAgICAgICBjb250ZW50cyA9IGF3YWl0IGZzLnJlYWRGaWxlKGZpbGVQYXRoLCBcInV0ZjhcIik7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgcmVhZGFibGUgRGlzY29yZCB3ZWJob29rIGZpbGUgYXQgJHtmaWxlUGF0aH0sICR7ZX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIHBhcnNlV2ViaG9va0ZpbGUoeyBjb250ZW50cywgc291cmNlTmFtZTogZmlsZVBhdGggfSk7XG59XG5cbi8qKiBXaGVuIHRoZSBtZXNzYWdlIHdhcyBzZW50LCBpbiB0aGUgc2VuZGluZyBtYWNoaW5lJ3Mgb3duIHRpbWUgem9uZS4gRGlzY29yZCBzaG93cyB3aGVuIGl0XG4gICAgcmVjZWl2ZWQgc29tZXRoaW5nLCB3aGljaCBpcyBub3QgdGhlIHNhbWUgdGhpbmcgd2hlbiBhIG1hY2hpbmUgaGFzIGJlZW4gb2ZmbGluZSBvciBhIHNlbmQgaGFzXG4gICAgYmVlbiByZXRyaWVkLCBhbmQgdGhlIHpvbmUgbWF0dGVycyB3aGVuIHRoZSBtYWNoaW5lcyBhcmUgbm90IGFsbCBpbiBvbmUgcGxhY2UuICovXG5leHBvcnQgZnVuY3Rpb24gbWVzc2FnZVRpbWVzdGFtcChub3c6IERhdGUpIHtcbiAgICBsZXQgZGF0ZSA9IG5vdy50b0xvY2FsZURhdGVTdHJpbmcoXCJlbi1DQVwiKTtcbiAgICBsZXQgdGltZSA9IG5vdy50b0xvY2FsZVRpbWVTdHJpbmcoXCJlbi1VU1wiLCB7XG4gICAgICAgIGhvdXI6IFwiMi1kaWdpdFwiLFxuICAgICAgICBtaW51dGU6IFwiMi1kaWdpdFwiLFxuICAgICAgICBzZWNvbmQ6IFwiMi1kaWdpdFwiLFxuICAgICAgICBob3VyMTI6IHRydWUsXG4gICAgICAgIHRpbWVab25lTmFtZTogXCJzaG9ydFwiLFxuICAgIH0pO1xuICAgIHJldHVybiBgJHtkYXRlfSAke3RpbWV9YDtcbn1cblxuYXN5bmMgZnVuY3Rpb24gcG9zdFRvV2ViaG9vayh3ZWJob29rVVJMOiBzdHJpbmcsIG1lc3NhZ2U6IHN0cmluZykge1xuICAgIC8vIFN0YW1wZWQgb25jZSByYXRoZXIgdGhhbiBwZXIgYXR0ZW1wdCwgc28gYSByZXRyeSBzYXlzIHdoZW4gdGhlIHRoaW5nIGhhcHBlbmVkIHJhdGhlciB0aGFuXG4gICAgLy8gd2hlbiB3ZSBsYXN0IG1hbmFnZWQgdG8gZ2V0IGl0IG91dC4gQXQgdGhlIGVuZCwgYmVjYXVzZSB0aGUgZmlyc3QgbGluZSBvZiBhIG1lc3NhZ2UgaXMgdGhlXG4gICAgLy8gbm90aWZpY2F0aW9uIHByZXZpZXcgYW5kIGEgdGltZXN0YW1wIHRoZXJlIHdvdWxkIHNwZW5kIGl0IHNheWluZyBub3RoaW5nLlxuICAgIGxldCBjb250ZW50ID0gYCR7bWVzc2FnZX0gwrcgXFxgJHttZXNzYWdlVGltZXN0YW1wKG5ldyBEYXRlKCkpfVxcYGA7XG4gICAgaWYgKGNvbnRlbnQubGVuZ3RoID4gRElTQ09SRF9NRVNTQUdFX0xJTUlUKSB7XG4gICAgICAgIGNvbnRlbnQgPSBjb250ZW50LnNsaWNlKDAsIERJU0NPUkRfTUVTU0FHRV9MSU1JVCAtIDMpICsgXCIuLi5cIjtcbiAgICB9XG4gICAgZm9yIChsZXQgYXR0ZW1wdCA9IDE7IGF0dGVtcHQgPD0gTUFYX1NFTkRfQVRURU1QVFM7IGF0dGVtcHQrKykge1xuICAgICAgICBsZXQgcmVzcG9uc2UgPSBhd2FpdCBmZXRjaCh3ZWJob29rVVJMLCB7XG4gICAgICAgICAgICBtZXRob2Q6IFwiUE9TVFwiLFxuICAgICAgICAgICAgaGVhZGVyczogeyBcIkNvbnRlbnQtVHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9LFxuICAgICAgICAgICAgYm9keTogSlNPTi5zdHJpbmdpZnkoeyBjb250ZW50IH0pLFxuICAgICAgICB9KTtcbiAgICAgICAgaWYgKHJlc3BvbnNlLm9rKSB7XG4gICAgICAgICAgICByZXR1cm47XG4gICAgICAgIH1cbiAgICAgICAgbGV0IGJvZHkgPSAoYXdhaXQgcmVzcG9uc2UudGV4dCgpKS5zbGljZSgwLCBNQVhfRVJST1JfQk9EWV9MRU5HVEgpO1xuICAgICAgICBpZiAocmVzcG9uc2Uuc3RhdHVzID09PSA0MjkgJiYgYXR0ZW1wdCA8IE1BWF9TRU5EX0FUVEVNUFRTKSB7XG4gICAgICAgICAgICBsZXQgcmV0cnlBZnRlciA9IE51bWJlcihyZXNwb25zZS5oZWFkZXJzLmdldChcInJldHJ5LWFmdGVyXCIpKTtcbiAgICAgICAgICAgIGxldCB3YWl0VGltZSA9IHJldHJ5QWZ0ZXIgJiYgcmV0cnlBZnRlciAqIDEwMDAgfHwgREVGQVVMVF9SQVRFX0xJTUlUX1dBSVQ7XG4gICAgICAgICAgICBhd2FpdCBuZXcgUHJvbWlzZShyZXNvbHZlID0+IHNldFRpbWVvdXQocmVzb2x2ZSwgd2FpdFRpbWUpKTtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGBFeHBlY3RlZCBhIDJ4eCByZXNwb25zZSBmcm9tIHRoZSBEaXNjb3JkIHdlYmhvb2ssIHdhcyAke3Jlc3BvbnNlLnN0YXR1c30gJHtyZXNwb25zZS5zdGF0dXNUZXh0fSwgYm9keSAke2JvZHl9YFxuICAgICAgICApO1xuICAgIH1cbn1cblxuZnVuY3Rpb24gcXVldWVTZW5kKHdlYmhvb2tVUkw6IHN0cmluZywgbWVzc2FnZTogc3RyaW5nKSB7XG4gICAgbGV0IHNlbmQgPSAoKSA9PiBwb3N0VG9XZWJob29rKHdlYmhvb2tVUkwsIG1lc3NhZ2UpO1xuICAgIGxldCByZXN1bHQgPSBzZW5kQ2hhaW4udGhlbihzZW5kLCBzZW5kKTtcbiAgICBzZW5kQ2hhaW4gPSByZXN1bHQuY2F0Y2goKCkgPT4gdW5kZWZpbmVkKTtcbiAgICByZXR1cm4gcmVzdWx0O1xufVxuXG4vKiogU2VuZHMgdG8gYW4gZXhwbGljaXQgd2ViaG9vayBVUkwsIGZvciB0b29saW5nIHRoYXQgYWN0cyBvbiBhIHdlYmhvb2sgYmVmb3JlIChvciBpbnN0ZWFkIG9mKVxuICAgIGNvbmZpZ3VyZURpc2NvcmROb3RpZmljYXRpb25zIC0gc2V0dXAsIG1pZ3JhdGlvbnMsIGNvbm5lY3Rpdml0eSBjaGVja3MuICovXG5leHBvcnQgZnVuY3Rpb24gc2VuZFRvV2ViaG9va1VSTChjb25maWc6IHsgd2ViaG9va1VSTDogc3RyaW5nOyBtZXNzYWdlOiBzdHJpbmcgfSkge1xuICAgIHJldHVybiBxdWV1ZVNlbmQoY29uZmlnLndlYmhvb2tVUkwsIGNvbmZpZy5tZXNzYWdlKTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gY2hlY2tXZWJob29rRmlsZUNoYW5nZWQoKSB7XG4gICAgbGV0IHN0YXRlID0gbm90aWZpY2F0aW9uU3RhdGU7XG4gICAgaWYgKCFzdGF0ZSkge1xuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIGxldCBuZXdXZWJob29rVVJMO1xuICAgIHRyeSB7XG4gICAgICAgIG5ld1dlYmhvb2tVUkwgPSBhd2FpdCByZWFkV2ViaG9va0ZpbGUoc3RhdGUuZmlsZVBhdGgpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgY29uc29sZS5lcnJvcihgcG9ydHNlY3VyZTogRGlzY29yZCB3ZWJob29rIGZpbGUgaXMgbm8gbG9uZ2VyIHJlYWRhYmxlLCBzdGlsbCB1c2luZyB0aGUgbG9hZGVkIHdlYmhvb2suICR7ZX1gKTtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBpZiAobmV3V2ViaG9va1VSTCA9PT0gc3RhdGUud2ViaG9va1VSTCkge1xuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIC8vIFdhcm4gdGhlIG9sZCBjaGFubmVsIGZpcnN0LCB3aXRoIHRoZSBuZXcgd2ViaG9vayByZWRhY3RlZCwgc28gYSBzdG9sZW4gb2xkIHdlYmhvb2sgZG9lcyBub3RcbiAgICAvLyBoYW5kIHRoZSBhdHRhY2tlciBhIHVzYWJsZSBuZXcgb25lLlxuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IHF1ZXVlU2VuZChcbiAgICAgICAgICAgIHN0YXRlLndlYmhvb2tVUkwsXG4gICAgICAgICAgICBgKipwb3J0c2VjdXJlKio6ICoqTk9USUZJQ0FUSU9OUyBBUkUgTU9WSU5HIFRPIEFOT1RIRVIgQ0hBTk5FTCoqYFxuICAgICAgICAgICAgKyBgXFxuXFxuVGhpcyBjaGFubmVsIHN0b3BzIHJlY2VpdmluZyB0aGVtIG5vdy4gSWYgdGhhdCB3YXMgbm90IHlvdSwgc29tZWJvZHkgd2l0aCBhY2Nlc3NgXG4gICAgICAgICAgICArIGAgdG8gdGhpcyBtYWNoaW5lIGp1c3QgcmVkaXJlY3RlZCBpdHMgYWxlcnRzLmBcbiAgICAgICAgICAgICsgYFxcblxcbm5ldyB3ZWJob29rOiBcXGAke3JlZGFjdFdlYmhvb2tVUkwobmV3V2ViaG9va1VSTCl9XFxgYFxuICAgICAgICAgICAgKyBgXFxuc2V0IGluOiBcXGAke3N0YXRlLmZpbGVQYXRofVxcYGBcbiAgICAgICAgKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIGNvbnNvbGUuZXJyb3IoYHBvcnRzZWN1cmU6IGZhaWxlZCB0byB3YXJuIHRoZSBvbGQgRGlzY29yZCB3ZWJob29rIGFib3V0IHRoZSBjaGFuZ2UuICR7ZX1gKTtcbiAgICB9XG4gICAgc3RhdGUud2ViaG9va1VSTCA9IG5ld1dlYmhvb2tVUkw7XG59XG5cbi8qKiBNdXN0IGJlIGNhbGxlZCBvbmNlIG9uIHN0YXJ0dXAsIGJlZm9yZSBhbnkgbm90aWZpY2F0aW9uIGlzIHNlbnQuIEFib3J0cyB0aGUgcHJvY2VzcyBpZiB0aGVcbiAgICB3ZWJob29rIGZpbGUgaXMgbWlzc2luZyBvciBpbnZhbGlkLCB0aGVuIHJlLWNoZWNrcyB0aGUgZmlsZSBvbiBhbiBpbnRlcnZhbCBhbmQgd2FybnMgdGhlIG9sZFxuICAgIHdlYmhvb2sgd2hlbmV2ZXIgaXQgY2hhbmdlcy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBjb25maWd1cmVEaXNjb3JkTm90aWZpY2F0aW9ucyhjb25maWc/OiB7XG4gICAgZmlsZVBhdGg/OiBzdHJpbmc7XG4gICAgY2hlY2tJbnRlcnZhbD86IG51bWJlcjtcbn0pIHtcbiAgICBpZiAobm90aWZpY2F0aW9uU3RhdGUpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBjb25maWd1cmVEaXNjb3JkTm90aWZpY2F0aW9ucyB0byBiZSBjYWxsZWQgb25jZSwgd2FzIGNhbGxlZCBhZ2FpbiAoYWxyZWFkeSB1c2luZyAke25vdGlmaWNhdGlvblN0YXRlLmZpbGVQYXRofSlgKTtcbiAgICB9XG4gICAgbGV0IGZpbGVQYXRoID0gY29uZmlnPy5maWxlUGF0aCB8fCBERUZBVUxUX1dFQkhPT0tfRklMRV9QQVRIO1xuICAgIGxldCBjaGVja0ludGVydmFsID0gY29uZmlnPy5jaGVja0ludGVydmFsIHx8IERFRkFVTFRfQ0hFQ0tfSU5URVJWQUw7XG4gICAgbGV0IHdlYmhvb2tVUkw7XG4gICAgdHJ5IHtcbiAgICAgICAgd2ViaG9va1VSTCA9IGF3YWl0IHJlYWRXZWJob29rRmlsZShmaWxlUGF0aCk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICBjb25zb2xlLmVycm9yKGBwb3J0c2VjdXJlOiByZWZ1c2luZyB0byBzdGFydCB3aXRob3V0IGEgdmFsaWQgRGlzY29yZCB3ZWJob29rIGZpbGUuXFxuJHtlfWApO1xuICAgICAgICBwcm9jZXNzLmV4aXQoMSk7XG4gICAgfVxuICAgIGxldCBjaGVja1RpbWVyID0gc2V0SW50ZXJ2YWwoKCkgPT4ge1xuICAgICAgICBjaGVja1dlYmhvb2tGaWxlQ2hhbmdlZCgpLmNhdGNoKGUgPT4gY29uc29sZS5lcnJvcihgcG9ydHNlY3VyZTogRGlzY29yZCB3ZWJob29rIGZpbGUgY2hlY2sgZmFpbGVkLiAke2V9YCkpO1xuICAgIH0sIGNoZWNrSW50ZXJ2YWwpO1xuICAgIC8vIFRoZSBjaGVjayBzaG91bGQgbmV2ZXIgYmUgdGhlIHJlYXNvbiB0aGUgcHJvY2VzcyBzdGF5cyBhbGl2ZS5cbiAgICBjaGVja1RpbWVyLnVucmVmKCk7XG4gICAgbm90aWZpY2F0aW9uU3RhdGUgPSB7IGZpbGVQYXRoLCB3ZWJob29rVVJMLCBjaGVja1RpbWVyIH07XG4gICAgcmV0dXJuIHsgZmlsZVBhdGgsIGNoZWNrSW50ZXJ2YWwgfTtcbn1cblxuLy8gRE8gTk9UIGFkZCBuZXcgY2FsbHMgdG8gdGhpcy4gRXZlcnkgbWVzc2FnZSBnb2VzIHRvIGEgcmVhbCBEaXNjb3JkIHNlcnZlciBzb21lb25lIHJlYWRzLCBzbyBhXG4vLyBub3RpZmljYXRpb24gaXMgb25seSBldmVyIGFkZGVkIHdoZW4gdGhlIHVzZXIgZXhwbGljaXRseSBhc2tzIGZvciB0aGF0IHNwZWNpZmljIGNhc2UuIFN0YXJ0dXAsXG4vLyBzdWNjZXNzLCBlcnJvcnMsIHJldHJpZXMgYW5kIHJlY292ZXJpZXMgYWxsIGJlbG9uZyBpbiBhIGxvZyBpbnN0ZWFkLlxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHNlbmREaXNjb3JkTm90aWZpY2F0aW9uKG1lc3NhZ2U6IHN0cmluZykge1xuICAgIGxldCBzdGF0ZSA9IG5vdGlmaWNhdGlvblN0YXRlO1xuICAgIGlmICghc3RhdGUpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBjb25maWd1cmVEaXNjb3JkTm90aWZpY2F0aW9ucyB0byBiZSBjYWxsZWQgYmVmb3JlIHNlbmRpbmcsIHdhcyBjYWxsZWQgd2l0aCBtZXNzYWdlICR7bWVzc2FnZS5zbGljZSgwLCBNQVhfRVJST1JfQk9EWV9MRU5HVEgpfWApO1xuICAgIH1cbiAgICBhd2FpdCBxdWV1ZVNlbmQoc3RhdGUud2ViaG9va1VSTCwgbWVzc2FnZSk7XG59XG5cbi8qKiBXaGV0aGVyIG5vdGlmaWNhdGlvbnMgYXJlIHNldCB1cCBpbiB0aGlzIHByb2Nlc3MuIEZvciBjb2RlIHRoYXQgbWF5IHJ1biBvdXRzaWRlIHRoZSBkYWVtb24sXG4gICAgd2hlcmUgc2VuZGluZyBpcyB3b3J0aCBkb2luZyBpZiBpdCBjYW4gYmUgYW5kIG5vdCB3b3J0aCBmYWlsaW5nIG92ZXIgaWYgaXQgY2Fubm90LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFyZURpc2NvcmROb3RpZmljYXRpb25zQ29uZmlndXJlZCgpIHtcbiAgICByZXR1cm4gISFub3RpZmljYXRpb25TdGF0ZTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHN0b3BEaXNjb3JkTm90aWZpY2F0aW9ucygpIHtcbiAgICBpZiAoIW5vdGlmaWNhdGlvblN0YXRlKSB7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgY2xlYXJJbnRlcnZhbChub3RpZmljYXRpb25TdGF0ZS5jaGVja1RpbWVyKTtcbiAgICBub3RpZmljYXRpb25TdGF0ZSA9IHVuZGVmaW5lZDtcbn1cbiJdfQ==
- /* _JS_SOURCE_HASH = "abb6e0b243d1d85cb4a3599020263d0b3164ce4bf2aef2aa81489e304cd43b4c"; */
+ /* _JS_SOURCE_HASH = "a4fe18f537fa6da028d1607b16331b146697f9fabb96c6de058f0b41c5553b17"; */

package/security/notifications/dist/remoteWebhook.ts.cache

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.ensureRemoteWebhook = exports.REPLACE_KEYWORD = void 0;
+const discord_1 = require("./discord");
+const remoteSSH_1 = require("../helpers/remoteSSH");
+exports.REPLACE_KEYWORD = "replace";
+const UNPARSEABLE_LABEL = "(unparseable)";
+/** Puts a webhook on a remote host, refusing to clobber a different existing one unless asked.
+    Returns what happened, so callers can decide whether to keep going. */
+async function ensureRemoteWebhook(config) {
+    let { host, webhookURL, replace } = config;
+    let filePath = config.filePath || discord_1.DEFAULT_WEBHOOK_FILE_PATH;
+    let replacedURL = "";
+    let existingContents = await (0, remoteSSH_1.readRemoteFile)({ host, filePath });
+    if (existingContents) {
+        // A corrupt existing file still counts as a conflict, so "replace" can repair it instead
+        // of the setup dead ending on a parse error.
+        let existingURL = UNPARSEABLE_LABEL;
+        try {
+            existingURL = (0, discord_1.parseWebhookFile)({ contents: existingContents, sourceName: `${host}:${filePath}` });
+        }
+        catch (e) {
+            console.error(`${host}:${filePath} exists but could not be parsed. ${e}`);
+        }
+        if (existingURL === webhookURL) {
+            return { outcome: "unchanged", filePath };
+        }
+        if (!replace) {
+            throw new Error(`Expected no conflicting webhook on ${host}, but ${filePath} already holds a different one.\n`
+                + `Existing: ${existingURL}\n`
+                + `New:      ${webhookURL}\n`
+                + `Pass "${exports.REPLACE_KEYWORD}" to overwrite it.`);
+        }
+        replacedURL = existingURL;
+    }
+    await (0, remoteSSH_1.writeRemoteFile)({
+        host,
+        filePath,
+        contents: (0, discord_1.formatWebhookFile)(webhookURL),
+        fileMode: "600",
+        directoryMode: "700",
+    });
+    let writtenContents = await (0, remoteSSH_1.readRemoteFile)({ host, filePath });
+    if (!writtenContents) {
+        throw new Error(`Expected ${filePath} to exist on ${host} after writing, no such file exists`);
+    }
+    let writtenURL = (0, discord_1.parseWebhookFile)({ contents: writtenContents, sourceName: `${host}:${filePath}` });
+    if (writtenURL !== webhookURL) {
+        throw new Error(`Expected ${host}:${filePath} to hold the new webhook, was ${writtenURL}`);
+    }
+    if (replacedURL && replacedURL !== UNPARSEABLE_LABEL) {
+        // The new webhook is redacted, so this channel can identify the replacement without
+        // receiving a webhook it could post to.
+        try {
+            await (0, discord_1.sendToWebhookURL)({
+                webhookURL: replacedURL,
+                message: `**portsecure**: the Discord webhook for \`${host}\` was replaced with`
+                    + ` \`${(0, discord_1.redactWebhookURL)(webhookURL)}\`.`
+                    + ` This channel will stop receiving notifications for that host.`,
+            });
+        }
+        catch (e) {
+            // The replacement already happened, so a dead old webhook must not fail the setup.
+            console.error(`Could not notify the old webhook that it was replaced. ${e}`);
+        }
+    }
+    // Failing here means the file is in place but the webhook itself does not work, which is
+    // exactly what the operator needs to hear about.
+    await (0, discord_1.sendToWebhookURL)({
+        webhookURL,
+        message: `**portsecure**: notifications are now configured for \`${host}\`.`
+            + ` This channel will receive its security notifications.`,
+    });
+    return { outcome: replacedURL && "replaced" || "created", filePath };
+}
+exports.ensureRemoteWebhook = ensureRemoteWebhook;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlV2ViaG9vay5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInJlbW90ZVdlYmhvb2sudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsdUNBQStIO0FBQy9ILG9EQUF1RTtBQUUxRCxRQUFBLGVBQWUsR0FBRyxTQUFTLENBQUM7QUFDekMsTUFBTSxpQkFBaUIsR0FBRyxlQUFlLENBQUM7QUFFMUM7MEVBQzBFO0FBQ25FLEtBQUssVUFBVSxtQkFBbUIsQ0FBQyxNQUt6QztJQUNHLElBQUksRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUMzQyxJQUFJLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxJQUFJLG1DQUF5QixDQUFDO0lBRTVELElBQUksV0FBVyxHQUFHLEVBQUUsQ0FBQztJQUNyQixJQUFJLGdCQUFnQixHQUFHLE1BQU0sSUFBQSwwQkFBYyxFQUFDLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDaEUsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1FBQ25CLHlGQUF5RjtRQUN6Riw2Q0FBNkM7UUFDN0MsSUFBSSxXQUFXLEdBQUcsaUJBQWlCLENBQUM7UUFDcEMsSUFBSSxDQUFDO1lBQ0QsV0FBVyxHQUFHLElBQUEsMEJBQWdCLEVBQUMsRUFBRSxRQUFRLEVBQUUsZ0JBQWdCLEVBQUUsVUFBVSxFQUFFLEdBQUcsSUFBSSxJQUFJLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN0RyxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNULE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxJQUFJLElBQUksUUFBUSxvQ0FBb0MsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM5RSxDQUFDO1FBQ0QsSUFBSSxXQUFXLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDN0IsT0FBTyxFQUFFLE9BQU8sRUFBRSxXQUFvQixFQUFFLFFBQVEsRUFBRSxDQUFDO1FBQ3ZELENBQUM7UUFDRCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksS0FBSyxDQUNYLHNDQUFzQyxJQUFJLFNBQVMsUUFBUSxtQ0FBbUM7a0JBQzVGLGFBQWEsV0FBVyxJQUFJO2tCQUM1QixhQUFhLFVBQVUsSUFBSTtrQkFDM0IsU0FBUyx1QkFBZSxvQkFBb0IsQ0FDakQsQ0FBQztRQUNOLENBQUM7UUFDRCxXQUFXLEdBQUcsV0FBVyxDQUFDO0lBQzlCLENBQUM7SUFFRCxNQUFNLElBQUEsMkJBQWUsRUFBQztRQUNsQixJQUFJO1FBQ0osUUFBUTtRQUNSLFFBQVEsRUFBRSxJQUFBLDJCQUFpQixFQUFDLFVBQVUsQ0FBQztRQUN2QyxRQUFRLEVBQUUsS0FBSztRQUNmLGFBQWEsRUFBRSxLQUFLO0tBQ3ZCLENBQUMsQ0FBQztJQUVILElBQUksZUFBZSxHQUFHLE1BQU0sSUFBQSwwQkFBYyxFQUFDLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDL0QsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMsWUFBWSxRQUFRLGdCQUFnQixJQUFJLHFDQUFxQyxDQUFDLENBQUM7SUFDbkcsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLElBQUEsMEJBQWdCLEVBQUMsRUFBRSxRQUFRLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxHQUFHLElBQUksSUFBSSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDcEcsSUFBSSxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxZQUFZLElBQUksSUFBSSxRQUFRLGlDQUFpQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFFRCxJQUFJLFdBQVcsSUFBSSxXQUFXLEtBQUssaUJBQWlCLEVBQUUsQ0FBQztRQUNuRCxvRkFBb0Y7UUFDcEYsd0NBQXdDO1FBQ3hDLElBQUksQ0FBQztZQUNELE1BQU0sSUFBQSwwQkFBZ0IsRUFBQztnQkFDbkIsVUFBVSxFQUFFLFdBQVc7Z0JBQ3ZCLE9BQU8sRUFBRSw2Q0FBNkMsSUFBSSxzQkFBc0I7c0JBQzFFLE1BQU0sSUFBQSwwQkFBZ0IsRUFBQyxVQUFVLENBQUMsS0FBSztzQkFDdkMsZ0VBQWdFO2FBQ3pFLENBQUMsQ0FBQztRQUNQLENBQUM7UUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1QsbUZBQW1GO1lBQ25GLE9BQU8sQ0FBQyxLQUFLLENBQUMsMERBQTBELENBQUMsRUFBRSxDQUFDLENBQUM7UUFDakYsQ0FBQztJQUNMLENBQUM7SUFFRCx5RkFBeUY7SUFDekYsaURBQWlEO0lBQ2pELE1BQU0sSUFBQSwwQkFBZ0IsRUFBQztRQUNuQixVQUFVO1FBQ1YsT0FBTyxFQUFFLDBEQUEwRCxJQUFJLEtBQUs7Y0FDdEUsd0RBQXdEO0tBQ2pFLENBQUMsQ0FBQztJQUVILE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxJQUFJLFVBQW1CLElBQUksU0FBa0IsRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUMzRixDQUFDO0FBNUVELGtEQTRFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IERFRkFVTFRfV0VCSE9PS19GSUxFX1BBVEgsIGZvcm1hdFdlYmhvb2tGaWxlLCBwYXJzZVdlYmhvb2tGaWxlLCByZWRhY3RXZWJob29rVVJMLCBzZW5kVG9XZWJob29rVVJMIH0gZnJvbSBcIi4vZGlzY29yZFwiO1xuaW1wb3J0IHsgcmVhZFJlbW90ZUZpbGUsIHdyaXRlUmVtb3RlRmlsZSB9IGZyb20gXCIuLi9oZWxwZXJzL3JlbW90ZVNTSFwiO1xuXG5leHBvcnQgY29uc3QgUkVQTEFDRV9LRVlXT1JEID0gXCJyZXBsYWNlXCI7XG5jb25zdCBVTlBBUlNFQUJMRV9MQUJFTCA9IFwiKHVucGFyc2VhYmxlKVwiO1xuXG4vKiogUHV0cyBhIHdlYmhvb2sgb24gYSByZW1vdGUgaG9zdCwgcmVmdXNpbmcgdG8gY2xvYmJlciBhIGRpZmZlcmVudCBleGlzdGluZyBvbmUgdW5sZXNzIGFza2VkLlxuICAgIFJldHVybnMgd2hhdCBoYXBwZW5lZCwgc28gY2FsbGVycyBjYW4gZGVjaWRlIHdoZXRoZXIgdG8ga2VlcCBnb2luZy4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBlbnN1cmVSZW1vdGVXZWJob29rKGNvbmZpZzoge1xuICAgIGhvc3Q6IHN0cmluZztcbiAgICB3ZWJob29rVVJMOiBzdHJpbmc7XG4gICAgcmVwbGFjZTogYm9vbGVhbjtcbiAgICBmaWxlUGF0aD86IHN0cmluZztcbn0pIHtcbiAgICBsZXQgeyBob3N0LCB3ZWJob29rVVJMLCByZXBsYWNlIH0gPSBjb25maWc7XG4gICAgbGV0IGZpbGVQYXRoID0gY29uZmlnLmZpbGVQYXRoIHx8IERFRkFVTFRfV0VCSE9PS19GSUxFX1BBVEg7XG5cbiAgICBsZXQgcmVwbGFjZWRVUkwgPSBcIlwiO1xuICAgIGxldCBleGlzdGluZ0NvbnRlbnRzID0gYXdhaXQgcmVhZFJlbW90ZUZpbGUoeyBob3N0LCBmaWxlUGF0aCB9KTtcbiAgICBpZiAoZXhpc3RpbmdDb250ZW50cykge1xuICAgICAgICAvLyBBIGNvcnJ1cHQgZXhpc3RpbmcgZmlsZSBzdGlsbCBjb3VudHMgYXMgYSBjb25mbGljdCwgc28gXCJyZXBsYWNlXCIgY2FuIHJlcGFpciBpdCBpbnN0ZWFkXG4gICAgICAgIC8vIG9mIHRoZSBzZXR1cCBkZWFkIGVuZGluZyBvbiBhIHBhcnNlIGVycm9yLlxuICAgICAgICBsZXQgZXhpc3RpbmdVUkwgPSBVTlBBUlNFQUJMRV9MQUJFTDtcbiAgICAgICAgdHJ5IHtcbiAgICAgICAgICAgIGV4aXN0aW5nVVJMID0gcGFyc2VXZWJob29rRmlsZSh7IGNvbnRlbnRzOiBleGlzdGluZ0NvbnRlbnRzLCBzb3VyY2VOYW1lOiBgJHtob3N0fToke2ZpbGVQYXRofWAgfSk7XG4gICAgICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgICAgIGNvbnNvbGUuZXJyb3IoYCR7aG9zdH06JHtmaWxlUGF0aH0gZXhpc3RzIGJ1dCBjb3VsZCBub3QgYmUgcGFyc2VkLiAke2V9YCk7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKGV4aXN0aW5nVVJMID09PSB3ZWJob29rVVJMKSB7XG4gICAgICAgICAgICByZXR1cm4geyBvdXRjb21lOiBcInVuY2hhbmdlZFwiIGFzIGNvbnN0LCBmaWxlUGF0aCB9O1xuICAgICAgICB9XG4gICAgICAgIGlmICghcmVwbGFjZSkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgICAgICAgIGBFeHBlY3RlZCBubyBjb25mbGljdGluZyB3ZWJob29rIG9uICR7aG9zdH0sIGJ1dCAke2ZpbGVQYXRofSBhbHJlYWR5IGhvbGRzIGEgZGlmZmVyZW50IG9uZS5cXG5gXG4gICAgICAgICAgICAgICAgKyBgRXhpc3Rpbmc6ICR7ZXhpc3RpbmdVUkx9XFxuYFxuICAgICAgICAgICAgICAgICsgYE5ldzogICAgICAke3dlYmhvb2tVUkx9XFxuYFxuICAgICAgICAgICAgICAgICsgYFBhc3MgXCIke1JFUExBQ0VfS0VZV09SRH1cIiB0byBvdmVyd3JpdGUgaXQuYFxuICAgICAgICAgICAgKTtcbiAgICAgICAgfVxuICAgICAgICByZXBsYWNlZFVSTCA9IGV4aXN0aW5nVVJMO1xuICAgIH1cblxuICAgIGF3YWl0IHdyaXRlUmVtb3RlRmlsZSh7XG4gICAgICAgIGhvc3QsXG4gICAgICAgIGZpbGVQYXRoLFxuICAgICAgICBjb250ZW50czogZm9ybWF0V2ViaG9va0ZpbGUod2ViaG9va1VSTCksXG4gICAgICAgIGZpbGVNb2RlOiBcIjYwMFwiLFxuICAgICAgICBkaXJlY3RvcnlNb2RlOiBcIjcwMFwiLFxuICAgIH0pO1xuXG4gICAgbGV0IHdyaXR0ZW5Db250ZW50cyA9IGF3YWl0IHJlYWRSZW1vdGVGaWxlKHsgaG9zdCwgZmlsZVBhdGggfSk7XG4gICAgaWYgKCF3cml0dGVuQ29udGVudHMpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2ZpbGVQYXRofSB0byBleGlzdCBvbiAke2hvc3R9IGFmdGVyIHdyaXRpbmcsIG5vIHN1Y2ggZmlsZSBleGlzdHNgKTtcbiAgICB9XG4gICAgbGV0IHdyaXR0ZW5VUkwgPSBwYXJzZVdlYmhvb2tGaWxlKHsgY29udGVudHM6IHdyaXR0ZW5Db250ZW50cywgc291cmNlTmFtZTogYCR7aG9zdH06JHtmaWxlUGF0aH1gIH0pO1xuICAgIGlmICh3cml0dGVuVVJMICE9PSB3ZWJob29rVVJMKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgJHtob3N0fToke2ZpbGVQYXRofSB0byBob2xkIHRoZSBuZXcgd2ViaG9vaywgd2FzICR7d3JpdHRlblVSTH1gKTtcbiAgICB9XG5cbiAgICBpZiAocmVwbGFjZWRVUkwgJiYgcmVwbGFjZWRVUkwgIT09IFVOUEFSU0VBQkxFX0xBQkVMKSB7XG4gICAgICAgIC8vIFRoZSBuZXcgd2ViaG9vayBpcyByZWRhY3RlZCwgc28gdGhpcyBjaGFubmVsIGNhbiBpZGVudGlmeSB0aGUgcmVwbGFjZW1lbnQgd2l0aG91dFxuICAgICAgICAvLyByZWNlaXZpbmcgYSB3ZWJob29rIGl0IGNvdWxkIHBvc3QgdG8uXG4gICAgICAgIHRyeSB7XG4gICAgICAgICAgICBhd2FpdCBzZW5kVG9XZWJob29rVVJMKHtcbiAgICAgICAgICAgICAgICB3ZWJob29rVVJMOiByZXBsYWNlZFVSTCxcbiAgICAgICAgICAgICAgICBtZXNzYWdlOiBgKipwb3J0c2VjdXJlKio6IHRoZSBEaXNjb3JkIHdlYmhvb2sgZm9yIFxcYCR7aG9zdH1cXGAgd2FzIHJlcGxhY2VkIHdpdGhgXG4gICAgICAgICAgICAgICAgICAgICsgYCBcXGAke3JlZGFjdFdlYmhvb2tVUkwod2ViaG9va1VSTCl9XFxgLmBcbiAgICAgICAgICAgICAgICAgICAgKyBgIFRoaXMgY2hhbm5lbCB3aWxsIHN0b3AgcmVjZWl2aW5nIG5vdGlmaWNhdGlvbnMgZm9yIHRoYXQgaG9zdC5gLFxuICAgICAgICAgICAgfSk7XG4gICAgICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgICAgIC8vIFRoZSByZXBsYWNlbWVudCBhbHJlYWR5IGhhcHBlbmVkLCBzbyBhIGRlYWQgb2xkIHdlYmhvb2sgbXVzdCBub3QgZmFpbCB0aGUgc2V0dXAuXG4gICAgICAgICAgICBjb25zb2xlLmVycm9yKGBDb3VsZCBub3Qgbm90aWZ5IHRoZSBvbGQgd2ViaG9vayB0aGF0IGl0IHdhcyByZXBsYWNlZC4gJHtlfWApO1xuICAgICAgICB9XG4gICAgfVxuXG4gICAgLy8gRmFpbGluZyBoZXJlIG1lYW5zIHRoZSBmaWxlIGlzIGluIHBsYWNlIGJ1dCB0aGUgd2ViaG9vayBpdHNlbGYgZG9lcyBub3Qgd29yaywgd2hpY2ggaXNcbiAgICAvLyBleGFjdGx5IHdoYXQgdGhlIG9wZXJhdG9yIG5lZWRzIHRvIGhlYXIgYWJvdXQuXG4gICAgYXdhaXQgc2VuZFRvV2ViaG9va1VSTCh7XG4gICAgICAgIHdlYmhvb2tVUkwsXG4gICAgICAgIG1lc3NhZ2U6IGAqKnBvcnRzZWN1cmUqKjogbm90aWZpY2F0aW9ucyBhcmUgbm93IGNvbmZpZ3VyZWQgZm9yIFxcYCR7aG9zdH1cXGAuYFxuICAgICAgICAgICAgKyBgIFRoaXMgY2hhbm5lbCB3aWxsIHJlY2VpdmUgaXRzIHNlY3VyaXR5IG5vdGlmaWNhdGlvbnMuYCxcbiAgICB9KTtcblxuICAgIHJldHVybiB7IG91dGNvbWU6IHJlcGxhY2VkVVJMICYmIFwicmVwbGFjZWRcIiBhcyBjb25zdCB8fCBcImNyZWF0ZWRcIiBhcyBjb25zdCwgZmlsZVBhdGggfTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "7383d5b5b9fee5c3deb4ea3e75d9c556e64aef84ab8d71e7683a02bc87c5070a"; */