From e16e5a34e6f96177ca922dc37b97f659963f926c Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 24 Sep 2018 18:11:11 -0600
Subject: [PATCH 01/68] WIP launcher updates

---
 usr/share/install-launcher.js | 34 ++-----------------
 usr/share/which.js            | 63 +++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 32 deletions(-)
 create mode 100644 usr/share/which.js

diff --git a/usr/share/install-launcher.js b/usr/share/install-launcher.js
index eec6c56..3935fc2 100644
--- a/usr/share/install-launcher.js
+++ b/usr/share/install-launcher.js
@@ -11,7 +11,7 @@ Launcher._killAll = function (fn) {
   var psList = require('ps-list');
   psList().then(function (procs) {
     procs.forEach(function (proc) {
-      if ('node' === proc.name && /\btelebitd\b/i.test(proc.cmd)) {
+      if ('node' === proc.name && /\btelebit(d| daemon)\b/i.test(proc.cmd)) {
         console.log(proc);
         process.kill(proc.pid);
         return true;
@@ -45,37 +45,7 @@ Launcher._detect = function (things, fn) {
     }
   }
 
-  // could have used "command-exists" but I'm trying to stay low-dependency
-  // os.platform(), os.type()
-  if (!/^win/i.test(os.platform())) {
-    if (/^darwin/i.test(os.platform())) {
-      exec('command -v launchctl', things._execOpts, function (err, stdout, stderr) {
-        err = Launcher._getError(err, stderr);
-        fn(err, 'launchctl');
-      });
-    } else {
-      exec('command -v systemctl', things._execOpts, function (err, stdout, stderr) {
-        err = Launcher._getError(err, stderr);
-        fn(err, 'systemctl');
-      });
-    }
-  } else {
-    // https://stackoverflow.com/questions/17908789/how-to-add-an-item-to-registry-to-run-at-startup-without-uac
-    // wininit? regedit? SCM?
-    // REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "My App" /t REG_SZ /F /D "C:\MyAppPath\MyApp.exe"
-    // https://www.microsoft.com/developerblog/2015/11/09/reading-and-writing-to-the-windows-registry-in-process-from-node-js/
-    // https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/reg-add
-    // https://social.msdn.microsoft.com/Forums/en-US/5b318f44-281e-4098-8dee-3ba8435fa391/add-registry-key-for-autostart-of-app-in-ice?forum=quebectools
-    // utils.elevate
-    // https://github.com/CatalystCode/windows-registry-node
-    exec('where reg.exe', things._execOpts, function (err, stdout, stderr) {
-      //console.log((stdout||'').trim());
-      if (stderr) {
-        console.error(stderr);
-      }
-      fn(err, 'reg.exe');
-    });
-  }
+  require('./which.js').launcher(things._execOpts, fn);
 };
 Launcher.install = function (things, fn) {
   if (!fn) { fn = function (err) { if (err) { console.error(err); } }; }
diff --git a/usr/share/which.js b/usr/share/which.js
new file mode 100644
index 0000000..dc23027
--- /dev/null
+++ b/usr/share/which.js
@@ -0,0 +1,63 @@
+'use strict';
+
+var os = require('os');
+var exec = require('child_process').exec;
+
+var which = module.exports;
+
+which._getError = function getError(err, stderr) {
+  if (err) { return err; }
+  if (stderr) {
+    err = new Error(stderr);
+    err.code = 'EWHICH';
+    return err;
+  }
+};
+
+module.exports.which = function (cmd, execOpts, fn) {
+  return module.exports._which({
+    mac: cmd
+  , linux: cmd
+  , win: cmd
+  }, execOpts, fn);
+};
+module.exports.launcher = function (execOpts, fn) {
+  return module.exports._which({
+    mac: 'launchctl'
+  , linux: 'systemctl'
+  , win: 'reg.exe'
+  }, execOpts, fn);
+};
+module.exports._which = function (progs, execOpts, fn) {
+  // could have used "command-exists" but I'm trying to stay low-dependency
+  // os.platform(), os.type()
+  if (!/^win/i.test(os.platform())) {
+    if (/^darwin/i.test(os.platform())) {
+      exec('command -v ' + progs.mac, execOpts, function (err, stdout, stderr) {
+        err = which._getError(err, stderr);
+        fn(err, progs.mac);
+      });
+    } else {
+      exec('command -v ' + progs.linux, execOpts, function (err, stdout, stderr) {
+        err = which._getError(err, stderr);
+        fn(err, progs.linux);
+      });
+    }
+  } else {
+    // https://stackoverflow.com/questions/17908789/how-to-add-an-item-to-registry-to-run-at-startup-without-uac
+    // wininit? regedit? SCM?
+    // REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "My App" /t REG_SZ /F /D "C:\MyAppPath\MyApp.exe"
+    // https://www.microsoft.com/developerblog/2015/11/09/reading-and-writing-to-the-windows-registry-in-process-from-node-js/
+    // https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/reg-add
+    // https://social.msdn.microsoft.com/Forums/en-US/5b318f44-281e-4098-8dee-3ba8435fa391/add-registry-key-for-autostart-of-app-in-ice?forum=quebectools
+    // utils.elevate
+    // https://github.com/CatalystCode/windows-registry-node
+    exec('where ' + progs.win, execOpts, function (err, stdout, stderr) {
+      //console.log((stdout||'').trim());
+      if (stderr) {
+        console.error(stderr);
+      }
+      fn(err, progs.win);
+    });
+  }
+};
-- 
2.38.5


From c3e9bbaa5aa74cf3334c11fdc95ab108361c8c75 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 25 Sep 2018 00:45:32 -0600
Subject: [PATCH 02/68] WIP keep parsing and console output in remote, move
 other stuff out

---
 bin/telebit-remote.js        | 691 +++++++++++++++--------------------
 lib/en-us.toml               |  12 +
 lib/remote-control-client.js | 116 ++++++
 3 files changed, 423 insertions(+), 396 deletions(-)
 create mode 100644 lib/remote-control-client.js

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 14a7b51..429a9c5 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -8,11 +8,11 @@ var os = require('os');
 //var url = require('url');
 var fs = require('fs');
 var path = require('path');
-var http = require('http');
 //var https = require('https');
 var YAML = require('js-yaml');
 var TOML = require('toml');
 var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"), 'utf8'));
+
 /*
 if ('function' !== typeof TOML.stringify) {
   TOML.stringify = require('json2toml');
@@ -314,395 +314,142 @@ function askForConfig(state, mainCb) {
   next();
 }
 
-var utils = {
-  request: function request(opts, fn) {
-    if (!opts) { opts = {}; }
-    var service = opts.service || 'config';
-    var req = http.request({
-      socketPath: state._ipc.path
-    , method: opts.method || 'GET'
-    , path: '/rpc/' + service
-    }, function (resp) {
-      var body = '';
-
-      function finish() {
-        if (200 !== resp.statusCode) {
-          console.warn(resp.statusCode);
-          console.warn(body || ('get' + service + ' failed'));
-          //cb(new Error("not okay"), body);
-          return;
-        }
-
-        if (!body) { fn(null, null); return; }
-
-        try {
-          body = JSON.parse(body);
-        } catch(e) {
-          // ignore
-        }
-
-        fn(null, body);
-      }
-
-      if (resp.headers['content-length']) {
-        resp.on('data', function (chunk) {
-          body += chunk.toString();
-        });
-        resp.on('end', function () {
-          finish();
-        });
-      } else {
-        finish();
-      }
-    });
-    req.on('error', function (err) {
-      // ENOENT - never started, cleanly exited last start, or creating socket at a different path
-      // ECONNREFUSED - leftover socket just needs to be restarted
-      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-        if (opts._taketwo) {
-          console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
-          console.error(err);
-          return;
-        }
-        require('../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
-          if (err) { fn(err); return; }
-          opts._taketwo = true;
-          setTimeout(function () {
-            utils.request(opts, fn);
-          }, 2500);
-        });
-        return;
-      }
-      if ('ENOTSOCK' === err.code) {
-        console.error(err);
-        return;
-      }
-      console.error(err);
-      return;
-    });
-    req.end();
-  }
-, putConfig: function putConfig(service, args, fn) {
-    var req = http.request({
-      socketPath: state._ipc.path
-    , method: 'POST'
-    , path: '/rpc/' + service + '?_body=' + encodeURIComponent(JSON.stringify(args))
-    }, function (resp) {
-
-      function finish() {
-        if ('function' === typeof fn) {
-          fn(null, resp);
-          return;
-        }
-
-        console.info("");
-        if (200 !== resp.statusCode) {
-          console.warn("'" + service + "' may have failed."
-           + " Consider peaking at the logs either with 'journalctl -xeu telebit' or /opt/telebit/var/log/error.log");
-          console.warn(resp.statusCode, body);
-          //cb(new Error("not okay"), body);
-          return;
-        }
-
-        if (!body) {
-          console.info("👌");
-          return;
-        }
-
-        try {
-          body = JSON.parse(body);
-        } catch(e) {
-          // ignore
-        }
-
-        if ("AWAIT_AUTH" === body.code) {
-          console.info(body.message);
-        } else if ("CONFIG" === body.code) {
-          delete body.code;
-          //console.info(TOML.stringify(body));
-          console.info(YAML.safeDump(body));
-        } else {
-          if ('http' === body.module) {
-            // TODO we'll support slingshot-ing in the future
-            if (String(body.local) === String(parseInt(body.local, 10))) {
-              console.info('> Forwarding https://' + body.remote + ' => localhost:' + body.local);
-            } else {
-              console.info('> Serving ' + body.local + ' as https://' + body.remote);
-            }
-          } else if ('tcp' === body.module) {
-              console.info('> Forwarding ' + state.config.relay + ':' + body.remote + ' => localhost:' + body.local);
-          } else if ('ssh' === body.module) {
-              //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
-              console.info('> Forwarding ssh+https (openssl proxy) => localhost:' + body.local);
-          } else {
-            console.info(JSON.stringify(body, null, 2));
-          }
-          console.info();
-        }
-      }
-
-      var body = '';
-      if (resp.headers['content-length']) {
-        resp.on('data', function (chunk) {
-          body += chunk.toString();
-        });
-        resp.on('end', function () {
-          finish();
-        });
-      } else {
-        finish();
-      }
-    });
-    req.on('error', function (err) {
-      console.error('Put Config Error:');
-      console.error(err);
-      return;
-    });
-    req.end();
-  }
-};
-
-// Two styles:
-//     http 3000
-//     http modulename
-function makeRpc(key) {
-  if (key !== argv[0]) {
-    return false;
-  }
-  utils.putConfig(argv[0], argv.slice(1));
-  return true;
-}
-
-function packConfig(config) {
-  return Object.keys(config).map(function (key) {
-    var val = config[key];
-    if ('undefined' === val) {
-      throw new Error("'undefined' used as a string value");
-    }
-    if ('undefined' === typeof val) {
-      //console.warn('[DEBUG]', key, 'is present but undefined');
-      return;
-    }
-    if (val && 'object' === typeof val && !Array.isArray(val)) {
-      val = JSON.stringify(val);
-    }
-    return key + ':' + val; // converts arrays to strings with ,
-  });
-}
-
-function getToken(err, state) {
-  if (err) {
-    console.error("Error while initializing config [init]:");
-    throw err;
-  }
-  state.relay = state.config.relay;
-
-  // { _otp, config: {} }
-  common.api.token(state, {
-    error: function (err/*, next*/) {
-      console.error("[Error] common.api.token:");
-      console.error(err);
-      return;
-    }
-  , directory: function (dir, next) {
-      //console.log('[directory] Telebit Relay Discovered:');
-      //console.log(dir);
-      state._apiDirectory = dir;
-      next();
-    }
-  , tunnelUrl: function (tunnelUrl, next) {
-      //console.log('[tunnelUrl] Telebit Relay Tunnel Socket:', tunnelUrl);
-      state.wss = tunnelUrl;
-      next();
-    }
-  , requested: function (authReq, next) {
-      //console.log("[requested] Pairing Requested");
-      state.config._otp = state.config._otp = authReq.otp;
-
-      if (!state.config.token && state._can_pair) {
-        console.info("");
-        console.info("==============================================");
-        console.info("                 Hey, Listen!                 ");
-        console.info("==============================================");
-        console.info("                                              ");
-        console.info("  GO CHECK YOUR EMAIL!                        ");
-        console.info("                                              ");
-        console.info("  DEVICE PAIR CODE:     0000                  ".replace(/0000/g, state.config._otp));
-        console.info("                                              ");
-        console.info("==============================================");
-        console.info("");
-      }
-
-      next();
-    }
-  , connect: function (pretoken, next) {
-      //console.log("[connect] Enabling Pairing Locally...");
-      state.config.pretoken = pretoken;
-      state._connecting = true;
-
-      // TODO use php-style object querification
-      utils.putConfig('config', packConfig(state.config), function (err/*, body*/) {
-        if (err) {
-          state._error = err;
-          console.error("Error while initializing config [connect]:");
-          console.error(err);
-          return;
-        }
-        console.info("waiting...");
-        next();
-      });
-    }
-  , offer: function (token, next) {
-      //console.log("[offer] Pairing Enabled by Relay");
-      state.config.token = token;
-      if (state._error) {
-        return;
-      }
-      state._connecting = true;
-      try {
-        require('jsonwebtoken').decode(token);
-        //console.log(require('jsonwebtoken').decode(token));
-      } catch(e) {
-        console.warn("[warning] could not decode token");
-      }
-      utils.putConfig('config', packConfig(state.config), function (err/*, body*/) {
-        if (err) {
-          state._error = err;
-          console.error("Error while initializing config [offer]:");
-          console.error(err);
-          return;
-        }
-        //console.log("Pairing Enabled Locally");
-        next();
-      });
-    }
-  , granted: function (_, next) {
-      //console.log("[grant] Pairing complete!");
-      next();
-    }
-  , end: function () {
-      utils.putConfig('enable', [], function (err) {
-        if (err) { console.error(err); return; }
-        console.info("Success");
-
-        // workaround for https://github.com/nodejs/node/issues/21319
-        if (state._useTty) {
-          setTimeout(function () {
-            console.info("Some fun things to try first:\n");
-            console.info("    ~/telebit http ~/public");
-            console.info("    ~/telebit tcp 5050");
-            console.info("    ~/telebit ssh auto");
-            console.info();
-            console.info("Press any key to continue...");
-            console.info();
-            process.exit(0);
-          }, 0.5 * 1000);
-          return;
-        }
-        // end workaround
-
-        parseCli(state);
-      });
-    }
-  });
-}
-
-function parseCli(/*state*/) {
-  var special = [
-    'false', 'none', 'off', 'disable'
-  , 'true', 'auto', 'on', 'enable'
-  ];
-  if (-1 !== argv.indexOf('init')) {
-    utils.putConfig('list', []/*, function (err) {
-    }*/);
-    return;
-  }
-
-  if ([ 'ssh', 'http', 'tcp' ].some(function (key) {
-    if (key !== argv[0]) {
-      return false;
-    }
-    if (argv[1]) {
-      if (String(argv[1]) === String(parseInt(argv[1], 10))) {
-        // looks like a port
-        argv[1] = parseInt(argv[1], 10);
-      } else if (/\/|\\/.test(argv[1])) {
-        // looks like a path
-        argv[1] = path.resolve(argv[1]);
-        // TODO make a default assignment here
-      } else if (-1 === special.indexOf(argv[1])) {
-        console.error("Not sure what you meant by '" + argv[1] + "'.");
-        console.error("Remember: paths should begin with ." + path.sep + ", like '." + path.sep + argv[1] + "'");
-        return true;
-      }
-      utils.putConfig(argv[0], argv.slice(1));
-      return true;
-    }
-    return true;
-  })) {
-    return;
-  }
-
-  if ([ 'status', 'enable', 'disable', 'restart', 'list', 'save' ].some(makeRpc)) {
-    return;
-  }
-
-  help();
-  process.exit(11);
-}
-
-function handleConfig(err, config) {
-  //console.log('CONFIG');
-  //console.log(config);
-  state.config = config;
-  var verstrd = [ pkg.name + ' daemon v' + state.config.version ];
-  if (state.config.version && state.config.version !== pkg.version) {
-    console.info(verstr.join(' '), verstrd.join(' '));
-  } else {
-    console.info(verstr.join(' '));
-  }
-
-  if (err) { console.error(err); process.exit(101); return; }
-
-  //
-  // check for init first, before anything else
-  // because it has arguments that may help in
-  // the next steps
-  //
-  if (-1 !== argv.indexOf('init')) {
-    parsers.init(argv, getToken);
-    return;
-  }
-
-  if (!state.config.relay || !state.config.token) {
-    if (!state.config.relay) {
-      state.config.relay = 'telebit.cloud';
-    }
-
-    //console.log("question the user?", Date.now());
-    askForConfig(state, function (err, state) {
-      // no errors actually get passed, so this is just future-proofing
-      if (err) { throw err; }
-
-      if (!state.config.token && state._can_pair) {
-        state.config._otp = common.otp();
-      }
-
-      //console.log("done questioning:", Date.now());
-      if (!state.token && !state.config.token) {
-        getToken(err, state);
-      } else {
-        parseCli(state);
-      }
-    });
-    return;
-  }
-
-  //console.log("no questioning:");
-  parseCli(state);
-}
+var RC;
 
 function parseConfig(err, text) {
+  function handleConfig(err, config) {
+    //console.log('CONFIG');
+    //console.log(config);
+    state.config = config;
+    var verstrd = [ pkg.name + ' daemon v' + state.config.version ];
+    if (state.config.version && state.config.version !== pkg.version) {
+      console.info(verstr.join(' '), verstrd.join(' '));
+    } else {
+      console.info(verstr.join(' '));
+    }
+
+    if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+      console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
+      console.error(err);
+    } else if ('ENOTSOCK' === err.code) {
+      console.error(err);
+      return;
+    } else {
+      console.error(err);
+    }
+    if (err) { process.exit(101); return; }
+
+    //
+    // check for init first, before anything else
+    // because it has arguments that may help in
+    // the next steps
+    //
+    if (-1 !== argv.indexOf('init')) {
+      parsers.init(argv, function (err) {
+        if (err) {
+          console.error("Error while initializing config [init]:");
+          throw err;
+        }
+        getToken(function (err) {
+          if (err) {
+            console.error("Error while getting token [init]:");
+            throw err;
+          }
+          parseCli(state);
+        });
+      });
+      return;
+    }
+
+    if (!state.config.relay || !state.config.token) {
+      if (!state.config.relay) {
+        state.config.relay = 'telebit.cloud';
+      }
+
+      //console.log("question the user?", Date.now());
+      askForConfig(state, function (err, state) {
+        // no errors actually get passed, so this is just future-proofing
+        if (err) { throw err; }
+
+        if (!state.config.token && state._can_pair) {
+          state.config._otp = common.otp();
+        }
+
+        //console.log("done questioning:", Date.now());
+        if (!state.token && !state.config.token) {
+          if (err) {
+            console.error("Error while initializing config [init]:");
+            throw err;
+          }
+          getToken(function (err) {
+            if (err) {
+              console.error("Error while getting token [init]:");
+              throw err;
+            }
+            parseCli(state);
+          });
+        } else {
+          parseCli(state);
+        }
+      });
+      return;
+    }
+
+    //console.log("no questioning:");
+    parseCli(state);
+  }
+  function parseCli(/*state*/) {
+    var special = [
+      'false', 'none', 'off', 'disable'
+    , 'true', 'auto', 'on', 'enable'
+    ];
+    if (-1 !== argv.indexOf('init')) {
+      RC.request({ service: 'list', method: 'POST', data: [] }, handleRemoteRequest('list'));
+      return;
+    }
+
+    if ([ 'ssh', 'http', 'tcp' ].some(function (key) {
+      if (key !== argv[0]) {
+        return false;
+      }
+      if (argv[1]) {
+        if (String(argv[1]) === String(parseInt(argv[1], 10))) {
+          // looks like a port
+          argv[1] = parseInt(argv[1], 10);
+        } else if (/\/|\\/.test(argv[1])) {
+          // looks like a path
+          argv[1] = path.resolve(argv[1]);
+          // TODO make a default assignment here
+        } else if (-1 === special.indexOf(argv[1])) {
+          console.error("Not sure what you meant by '" + argv[1] + "'.");
+          console.error("Remember: paths should begin with ." + path.sep + ", like '." + path.sep + argv[1] + "'");
+          return true;
+        }
+        RC.request({ service: argv[0], method: 'POST', data: argv.slice(1) }, handleRemoteRequest(argv[0]));
+        return true;
+      }
+      return true;
+    })) {
+      return;
+    }
+
+    // Two styles:
+    //     http 3000
+    //     http modulename
+    function makeRpc(key) {
+      if (key !== argv[0]) {
+        return false;
+      }
+      RC.request({ service: argv[0], method: 'POST', data: argv.slice(1) }, handleRemoteRequest(argv[0]));
+      return true;
+    }
+    if ([ 'status', 'enable', 'disable', 'restart', 'list', 'save' ].some(makeRpc)) {
+      return;
+    }
+
+    help();
+    process.exit(11);
+  }
   try {
     state._clientConfig = JSON.parse(text || '{}');
   } catch(e1) {
@@ -721,13 +468,7 @@ function parseConfig(err, text) {
   }
 
   state._clientConfig = camelCopy(state._clientConfig || {}) || {};
-  common._init(
-    // make a default working dir and log dir
-    state._clientConfig.root || path.join(os.homedir(), '.local/share/telebit')
-  , (state._clientConfig.root && path.join(state._clientConfig.root, 'etc'))
-      || path.resolve(common.DEFAULT_CONFIG_PATH, '..')
-  );
-  state._ipc = common.pipename(state._clientConfig, true);
+  RC = require('../lib/remote-control-client.js').create(state);
 
   if (!Object.keys(state._clientConfig).length) {
     console.info('(' + state._ipc.comment + ": " + state._ipc.path + ')');
@@ -742,7 +483,165 @@ function parseConfig(err, text) {
     }
   }
 
-  utils.request({ service: 'config' }, handleConfig);
+  function handleRemoteRequest(service, fn) {
+    return function (err, body) {
+      if ('function' === typeof fn) {
+        fn(err, body); // XXX was resp
+        return;
+      }
+      console.info("");
+      if (err) {
+        console.warn("'" + service + "' may have failed."
+         + " Consider peaking at the logs either with 'journalctl -xeu telebit' or /opt/telebit/var/log/error.log");
+        console.warn(err.statusCode, err.message);
+        //cb(new Error("not okay"), body);
+        return;
+      }
+
+      if (!body) {
+        console.info("👌");
+        return;
+      }
+
+      try {
+        body = JSON.parse(body);
+      } catch(e) {
+        // ignore
+
+      }
+
+      if ("AWAIT_AUTH" === body.code) {
+        console.info(body.message);
+      } else if ("CONFIG" === body.code) {
+        delete body.code;
+        //console.info(TOML.stringify(body));
+        console.info(YAML.safeDump(body));
+      } else {
+        if ('http' === body.module) {
+          // TODO we'll support slingshot-ing in the future
+          if (String(body.local) === String(parseInt(body.local, 10))) {
+            console.info('> Forwarding https://' + body.remote + ' => localhost:' + body.local);
+          } else {
+            console.info('> Serving ' + body.local + ' as https://' + body.remote);
+          }
+        } else if ('tcp' === body.module) {
+            console.info('> Forwarding ' + state.config.relay + ':' + body.remote + ' => localhost:' + body.local);
+        } else if ('ssh' === body.module) {
+            //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
+            console.info('> Forwarding ssh+https (openssl proxy) => localhost:' + body.local);
+        } else {
+          console.info(JSON.stringify(body, null, 2));
+        }
+        console.info();
+      }
+    };
+  }
+
+  function getToken(fn) {
+    state.relay = state.config.relay;
+
+    // { _otp, config: {} }
+    common.api.token(state, {
+      error: function (err/*, next*/) {
+        console.error("[Error] common.api.token:");
+        console.error(err);
+        return;
+      }
+    , directory: function (dir, next) {
+        //console.log('[directory] Telebit Relay Discovered:');
+        //console.log(dir);
+        state._apiDirectory = dir;
+        next();
+      }
+    , tunnelUrl: function (tunnelUrl, next) {
+        //console.log('[tunnelUrl] Telebit Relay Tunnel Socket:', tunnelUrl);
+        state.wss = tunnelUrl;
+        next();
+      }
+    , requested: function (authReq, next) {
+        //console.log("[requested] Pairing Requested");
+        state.config._otp = state.config._otp = authReq.otp;
+
+        if (!state.config.token && state._can_pair) {
+          console.info(TPLS.remote.code.replace(/0000/g, state.config._otp));
+        }
+
+        next();
+      }
+    , connect: function (pretoken, next) {
+        //console.log("[connect] Enabling Pairing Locally...");
+        state.config.pretoken = pretoken;
+        state._connecting = true;
+
+        // TODO use php-style object querification
+        RC.request({ service: 'config', method: 'POST', data: state.config }, handleRemoteRequest('config', function (err/*, body*/) {
+          if (err) {
+            state._error = err;
+            console.error("Error while initializing config [connect]:");
+            console.error(err);
+            return;
+          }
+          console.info("waiting...");
+          next();
+        }));
+      }
+    , offer: function (token, next) {
+        //console.log("[offer] Pairing Enabled by Relay");
+        state.config.token = token;
+        if (state._error) {
+          return;
+        }
+        state._connecting = true;
+        try {
+          require('jsonwebtoken').decode(token);
+          //console.log(require('jsonwebtoken').decode(token));
+        } catch(e) {
+          console.warn("[warning] could not decode token");
+        }
+        RC.request({ service: 'config', method: 'POST', data: state.config }, handleRemoteRequest('config', function (err/*, body*/) {
+          if (err) {
+            state._error = err;
+            console.error("Error while initializing config [offer]:");
+            console.error(err);
+            return;
+          }
+          //console.log("Pairing Enabled Locally");
+          next();
+        }));
+      }
+    , granted: function (_, next) {
+        //console.log("[grant] Pairing complete!");
+        next();
+      }
+    , end: function () {
+        RC.request({ service: 'enable', method: 'POST', data: [] }, handleRemoteRequest('enable', function (err) {
+          if (err) { console.error(err); return; }
+          console.info("Success");
+
+          // workaround for https://github.com/nodejs/node/issues/21319
+          if (state._useTty) {
+            setTimeout(function () {
+              console.info("Some fun things to try first:\n");
+              console.info("    ~/telebit http ~/public");
+              console.info("    ~/telebit tcp 5050");
+              console.info("    ~/telebit ssh auto");
+              console.info();
+              console.info("Press any key to continue...");
+              console.info();
+              process.exit(0);
+            }, 0.5 * 1000);
+            return;
+          }
+          // end workaround
+
+          //parseCli(state);
+          fn();
+        }));
+      }
+    });
+  }
+
+  RC.request({ service: 'config', method: 'GET' }, handleRemoteRequest('config', handleConfig));
 }
 
 var parsers = {
diff --git a/lib/en-us.toml b/lib/en-us.toml
index c4c845d..167e75a 100644
--- a/lib/en-us.toml
+++ b/lib/en-us.toml
@@ -452,5 +452,17 @@ The secret flags are:
 [remote]
 version = "telebit remote v{version}"
 
+code = "
+==============================================
+                 Hey, Listen!
+==============================================
+
+  GO CHECK YOUR EMAIL!
+
+  DEVICE PAIR CODE:     0000
+
+==============================================
+"
+
 [daemon]
 version = "telebit daemon v{version}"
diff --git a/lib/remote-control-client.js b/lib/remote-control-client.js
new file mode 100644
index 0000000..0f284fd
--- /dev/null
+++ b/lib/remote-control-client.js
@@ -0,0 +1,116 @@
+'use strict';
+
+var os = require('os');
+var path = require('path');
+var http = require('http');
+
+var common = require('./cli-common.js');
+
+function packConfig(config) {
+  return Object.keys(config).map(function (key) {
+    var val = config[key];
+    if ('undefined' === val) {
+      throw new Error("'undefined' used as a string value");
+    }
+    if ('undefined' === typeof val) {
+      //console.warn('[DEBUG]', key, 'is present but undefined');
+      return;
+    }
+    if (val && 'object' === typeof val && !Array.isArray(val)) {
+      val = JSON.stringify(val);
+    }
+    return key + ':' + val; // converts arrays to strings with ,
+  });
+}
+
+module.exports.create = function (state) {
+  common._init(
+    // make a default working dir and log dir
+    state._clientConfig.root || path.join(os.homedir(), '.local/share/telebit')
+  , (state._clientConfig.root && path.join(state._clientConfig.root, 'etc'))
+      || path.resolve(common.DEFAULT_CONFIG_PATH, '..')
+  );
+  state._ipc = common.pipename(state._clientConfig, true);
+
+  function makeResponder(service, resp, fn) {
+    var body = '';
+
+    function finish() {
+      var err;
+
+      if (200 !== resp.statusCode) {
+        err = new Error(body || ('get' + service + ' failed'));
+        err.statusCode = resp.statusCode;
+        err.code = "E_REQUEST";
+      }
+
+      try {
+        body = JSON.parse(body);
+      } catch(e) {
+        // ignore
+      }
+
+      fn(err, body);
+    }
+
+    if (!resp.headers['content-length'] && !resp.headers['content-type']) {
+      finish();
+      return;
+    }
+
+    // TODO use readable
+    resp.on('data', function (chunk) {
+      body += chunk.toString();
+    });
+    resp.on('end', finish);
+  }
+
+  var RC = {};
+  RC.request = function request(opts, fn) {
+    if (!opts) { opts = {}; }
+    var service = opts.service || 'config';
+    var args = opts.data;
+    if (args && 'control' === service) {
+      args = packConfig(args);
+    }
+    var json = JSON.stringify(args);
+    var url = '/rpc/' + service;
+    if (json) {
+      url += ('?_body=' + encodeURIComponent(json));
+    }
+    var method = opts.method || (args && 'POST') || 'GET';
+    var req = http.request({
+      socketPath: state._ipc.path
+    , method: method
+    , path: url
+    }, function (resp) {
+      makeResponder(service, resp, fn);
+    });
+
+    req.on('error', function (err) {
+      // ENOENT - never started, cleanly exited last start, or creating socket at a different path
+      // ECONNREFUSED - leftover socket just needs to be restarted
+      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+        if (opts._taketwo) {
+          fn(err);
+          return;
+        }
+        require('../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
+          if (err) { fn(err); return; }
+          opts._taketwo = true;
+          setTimeout(function () {
+            RC.request(opts, fn);
+          }, 2500);
+        });
+        return;
+      }
+
+      fn(err);
+    });
+    if ('POST' === method && opts.data) {
+      req.write(json || opts.data);
+    }
+    req.end();
+  };
+  return RC;
+};
-- 
2.38.5


From 3e0c97751174b03a10b36b5aa2303cf9ea5f4b76 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 25 Sep 2018 00:54:51 -0600
Subject: [PATCH 03/68] fix a few WIP parser bugs

---
 bin/telebit-remote.js | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 429a9c5..bb4f51f 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -328,16 +328,19 @@ function parseConfig(err, text) {
       console.info(verstr.join(' '));
     }
 
-    if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-      console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
-      console.error(err);
-    } else if ('ENOTSOCK' === err.code) {
-      console.error(err);
+    if (err) {
+      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+        console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
+        console.error(err);
+      } else if ('ENOTSOCK' === err.code) {
+        console.error(err);
+        return;
+      } else {
+        console.error(err);
+      }
+      process.exit(101);
       return;
-    } else {
-      console.error(err);
     }
-    if (err) { process.exit(101); return; }
 
     //
     // check for init first, before anything else
@@ -428,6 +431,7 @@ function parseConfig(err, text) {
         RC.request({ service: argv[0], method: 'POST', data: argv.slice(1) }, handleRemoteRequest(argv[0]));
         return true;
       }
+      help();
       return true;
     })) {
       return;
-- 
2.38.5


From 82f5545d72ed084f7662ceb8c078eb46b7e1abe2 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 25 Sep 2018 01:14:54 -0600
Subject: [PATCH 04/68] wip minor refactoring

---
 bin/telebit-remote.js                         |  3 ++-
 bin/telebitd.js                               |  2 +-
 lib/{remote.js => daemon/index.js}            | 10 ++++++----
 lib/{remote-control-client.js => rc/index.js} |  2 +-
 package.json                                  |  4 ++--
 5 files changed, 12 insertions(+), 9 deletions(-)
 rename lib/{remote.js => daemon/index.js} (98%)
 rename lib/{remote-control-client.js => rc/index.js} (98%)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index bb4f51f..0d53829 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -401,6 +401,7 @@ function parseConfig(err, text) {
     //console.log("no questioning:");
     parseCli(state);
   }
+
   function parseCli(/*state*/) {
     var special = [
       'false', 'none', 'off', 'disable'
@@ -472,7 +473,7 @@ function parseConfig(err, text) {
   }
 
   state._clientConfig = camelCopy(state._clientConfig || {}) || {};
-  RC = require('../lib/remote-control-client.js').create(state);
+  RC = require('../lib/rc/index.js').create(state);
 
   if (!Object.keys(state._clientConfig).length) {
     console.info('(' + state._ipc.comment + ": " + state._ipc.path + ')');
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 4014b8c..245901f 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -24,7 +24,7 @@ var camelCopy = recase.camelCopy.bind(recase);
 var snakeCopy = recase.snakeCopy.bind(recase);
 var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"), 'utf8'));
 
-var TelebitRemote = require('../').TelebitRemote;
+var TelebitRemote = require('../lib/daemon/index.js').TelebitRemote;
 
 var state = { homedir: os.homedir(), servernames: {}, ports: {}, keepAlive: { state: false } };
 
diff --git a/lib/remote.js b/lib/daemon/index.js
similarity index 98%
rename from lib/remote.js
rename to lib/daemon/index.js
index 0f59c7b..22fcd7b 100644
--- a/lib/remote.js
+++ b/lib/daemon/index.js
@@ -28,6 +28,7 @@ function TelebitRemote(state) {
   EventEmitter.call(this);
   var me = this;
   var priv = {};
+  var path = require('path');
 
   //var defaultHttpTimeout = (2 * 60);
   //var activityTimeout = state.activityTimeout || (defaultHttpTimeout - 5) * 1000;
@@ -39,8 +40,9 @@ function TelebitRemote(state) {
   priv.tokens = [];
   var auth;
   if(!state.sortingHat) {
-    state.sortingHat = "./sorting-hat.js";
+    state.sortingHat = path.join(__dirname, '../sorting-hat.js');
   }
+  state._connectionHandler = require(state.sortingHat);
   if (state.token) {
     if ('undefined' === state.token) {
       throw new Error("passed string 'undefined' as token");
@@ -349,7 +351,7 @@ function TelebitRemote(state) {
 
       // TODO use readable streams instead
       wstunneler._socket.pause();
-      require(state.sortingHat).assign(state, tun, function (err, conn) {
+      state._connectionHandler.assign(state, tun, function (err, conn) {
         if (err) {
           err.message = err.message.replace(/:tun_id/, tun._id);
           packerHandlers._onConnectError(cid, tun, err);
@@ -472,12 +474,12 @@ function TelebitRemote(state) {
     priv.timeoutId = null;
     var machine = Packer.create(packerHandlers);
 
-    console.info("[telebit:lib/remote.js] [connect] '" + (state.wss || state.relay) + "'");
+    console.info("[telebit:lib/daemon.js] [connect] '" + (state.wss || state.relay) + "'");
     var tunnelUrl = (state.wss || state.relay).replace(/\/$/, '') + '/'; // + auth;
     wstunneler = new WebSocket(tunnelUrl, { rejectUnauthorized: !state.insecure });
     // XXXXXX
     wstunneler.on('open', function () {
-      console.info("[telebit:lib/remote.js] [open] connected to '" + (state.wss || state.relay) + "'");
+      console.info("[telebit:lib/daemon.js] [open] connected to '" + (state.wss || state.relay) + "'");
       me.emit('connect');
       priv.refreshTimeout();
       priv.timeoutId = setTimeout(priv.checkTimeout, activityTimeout);
diff --git a/lib/remote-control-client.js b/lib/rc/index.js
similarity index 98%
rename from lib/remote-control-client.js
rename to lib/rc/index.js
index 0f284fd..6d9bb12 100644
--- a/lib/remote-control-client.js
+++ b/lib/rc/index.js
@@ -4,7 +4,7 @@ var os = require('os');
 var path = require('path');
 var http = require('http');
 
-var common = require('./cli-common.js');
+var common = require('../cli-common.js');
 
 function packConfig(config) {
   return Object.keys(config).map(function (key) {
diff --git a/package.json b/package.json
index 289ad92..1edbf3e 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "telebit",
-  "version": "0.20.4",
+  "version": "0.20.5-wip",
   "description": "Break out of localhost. Connect to any device from anywhere over any tcp port or securely in a browser. A secure tunnel. A poor man's reverse VPN.",
-  "main": "lib/remote.js",
+  "main": "lib/daemon/index.js",
   "files": [
     "bin",
     "lib",
-- 
2.38.5


From aad592c8931954ddb58396e843a10f8ba1f9203e Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 25 Sep 2018 01:20:15 -0600
Subject: [PATCH 05/68] clarification

---
 bin/telebit.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/telebit.js b/bin/telebit.js
index 21dbc68..c880681 100644
--- a/bin/telebit.js
+++ b/bin/telebit.js
@@ -21,6 +21,7 @@ if ('rsync' === process.argv[2]) {
   require('sclient/bin/sclient.js');
   return;
 }
+// handle ssh client rather than ssh https tunnel
 if ('ssh' === process.argv[2] && /[\w-]+\.[a-z]{2,}/i.test(process.argv[3])) {
   process.argv.splice(1,1,'sclient');
   process.argv.splice(2,1,'ssh');
-- 
2.38.5


From 6c9d13f15507b0b4696160ce93dc31a5fd1d7cde Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 25 Sep 2018 01:26:47 -0600
Subject: [PATCH 06/68] update require path

---
 lib/rc/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/rc/index.js b/lib/rc/index.js
index 6d9bb12..389458d 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -95,7 +95,7 @@ module.exports.create = function (state) {
           fn(err);
           return;
         }
-        require('../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
+        require('../../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
           if (err) { fn(err); return; }
           opts._taketwo = true;
           setTimeout(function () {
-- 
2.38.5


From 8f7e865d491af2c04a78c4a1b31206f975dd31fe Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 25 Sep 2018 02:18:38 -0600
Subject: [PATCH 07/68] move from json-in-querystring to POST bodies

---
 bin/telebit-remote.js |  20 ++++--
 bin/telebitd.js       | 143 +++++++++++++++++++++++++-----------------
 lib/rc/index.js       |   1 +
 3 files changed, 102 insertions(+), 62 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 0d53829..3ba1b1e 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -524,16 +524,28 @@ function parseConfig(err, text) {
       } else {
         if ('http' === body.module) {
           // TODO we'll support slingshot-ing in the future
-          if (String(body.local) === String(parseInt(body.local, 10))) {
-            console.info('> Forwarding https://' + body.remote + ' => localhost:' + body.local);
+          if (body.local) {
+            if (String(body.local) === String(parseInt(body.local, 10))) {
+              console.info('> Forwarding https://' + body.remote + ' => localhost:' + body.local);
+            } else {
+              console.info('> Serving ' + body.local + ' as https://' + body.remote);
+            }
           } else {
-            console.info('> Serving ' + body.local + ' as https://' + body.remote);
+            console.info('> Rejecting End-to-End Encrypted HTTPS for now');
           }
         } else if ('tcp' === body.module) {
+          if (body.local) {
             console.info('> Forwarding ' + state.config.relay + ':' + body.remote + ' => localhost:' + body.local);
+          } else {
+            console.info('> Rejecting Legacy TCP');
+          }
         } else if ('ssh' === body.module) {
-            //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
+          //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
+          if (body.local) {
             console.info('> Forwarding ssh+https (openssl proxy) => localhost:' + body.local);
+          } else {
+            console.info('> Rejecting SSH-over-HTTPS for now');
+          }
         } else {
           console.info(JSON.stringify(body, null, 2));
         }
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 74bbdb1..ee76d64 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -245,11 +245,11 @@ controllers.tcp = function (req, res, opts) {
   if (remotePort) {
     if (!state.ports[remotePort]) {
       active = false;
-      return;
+    } else {
+      // forward-to port-or-module
+      // TODO with the connect event bug fixed, we should now be able to send files over tcp
+      state.ports[remotePort].handler = portOrPath;
     }
-    // forward-to port-or-module
-    // TODO we can't send files over tcp until we fix the connect event bug
-    state.ports[remotePort].handler = portOrPath;
   } else {
     if (!Object.keys(state.ports).some(function (key) {
       if (!state.ports[key].handler) {
@@ -329,7 +329,7 @@ controllers.ssh = function (req, res, opts) {
 function serveControlsHelper() {
   controlServer = http.createServer(function (req, res) {
     var opts = url.parse(req.url, true);
-    if (opts.query._body) {
+    if (false && opts.query._body) {
       try {
         opts.body = JSON.parse(decodeURIComponent(opts.query._body, true));
       } catch(e) {
@@ -591,63 +591,90 @@ function serveControlsHelper() {
       ));
     }
 
-    if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
-      getConfigOnly();
-      return;
+    function route() {
+      if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
+        getConfigOnly();
+        return;
+      }
+      if (/\b(init|config)\b/.test(opts.pathname)) {
+        initOrConfig();
+        return;
+      }
+      if (/restart/.test(opts.pathname)) {
+        restart();
+        return;
+      }
+      //
+      // Check for proper config
+      //
+      if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+        invalidConfig();
+        return;
+      }
+      //
+      // With proper config
+      //
+      if (/http/.test(opts.pathname)) {
+        controllers.http(req, res, opts);
+        return;
+      }
+      if (/tcp/.test(opts.pathname)) {
+        controllers.tcp(req, res, opts);
+        return;
+      }
+      if (/save|commit/.test(opts.pathname)) {
+        saveAndCommit();
+        return;
+      }
+      if (/ssh/.test(opts.pathname)) {
+        controllers.ssh(req, res, opts);
+        return;
+      }
+      if (/enable/.test(opts.pathname)) {
+        enable();
+        return;
+      }
+      if (/disable/.test(opts.pathname)) {
+        disable();
+        return;
+      }
+      if (/status/.test(opts.pathname)) {
+        getStatus();
+        return;
+      }
+      if (/list/.test(opts.pathname)) {
+        listSuccess();
+        return;
+      }
+
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
     }
-    if (/\b(init|config)\b/.test(opts.pathname)) {
-      initOrConfig();
-      return;
-    }
-    if (/restart/.test(opts.pathname)) {
-      restart();
-      return;
-    }
-    //
-    // Check for proper config
-    //
-    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-      invalidConfig();
-      return;
-    }
-    //
-    // With proper config
-    //
-    if (/http/.test(opts.pathname)) {
-      controllers.http(req, res, opts);
-      return;
-    }
-    if (/tcp/.test(opts.pathname)) {
-      controllers.tcp(req, res, opts);
-      return;
-    }
-    if (/save|commit/.test(opts.pathname)) {
-      saveAndCommit();
-      return;
-    }
-    if (/ssh/.test(opts.pathname)) {
-      controllers.ssh(req, res, opts);
-      return;
-    }
-    if (/enable/.test(opts.pathname)) {
-      enable();
-      return;
-    }
-    if (/disable/.test(opts.pathname)) {
-      disable();
-      return;
-    }
-    if (/status/.test(opts.pathname)) {
-      getStatus();
-      return;
-    }
-    if (/list/.test(opts.pathname)) {
-      listSuccess();
+
+    if (!req.headers['content-length'] && !req.headers['content-type']) {
+      route();
       return;
     }
 
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
+    var body = '';
+    req.on('readable', function () {
+      var data;
+      while (true) {
+        data = req.read();
+        if (!data) { break; }
+        body += data.toString();
+      }
+    });
+    req.on('end', function () {
+      try {
+        opts.body = JSON.parse(body);
+      } catch(e) {
+        res.statusCode = 400;
+        res.end('{"error":{"message":"POST body is not valid json"}}');
+        return;
+      }
+      route();
+    });
   });
 
   if (fs.existsSync(state._ipc.path)) {
diff --git a/lib/rc/index.js b/lib/rc/index.js
index 389458d..acd0dc7 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -108,6 +108,7 @@ module.exports.create = function (state) {
       fn(err);
     });
     if ('POST' === method && opts.data) {
+      req.setHeader("content-type", 'application/json');
       req.write(json || opts.data);
     }
     req.end();
-- 
2.38.5


From be7a895dc7798d4a84537076f7c459f573579f33 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 20:37:07 -0600
Subject: [PATCH 08/68] WIP web remote client

---
 bin/telebit-remote.js |    39 +-
 bin/telebitd.js       |   644 +--
 lib/admin/index.html  |    60 +
 lib/admin/js/app.js   |    50 +
 lib/admin/js/vue.js   | 10947 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 11428 insertions(+), 312 deletions(-)
 create mode 100644 lib/admin/index.html
 create mode 100644 lib/admin/js/app.js
 create mode 100644 lib/admin/js/vue.js

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 14a7b51..d97c0d2 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -73,7 +73,6 @@ if (!confpath || /^--/.test(confpath)) {
 }
 
 function askForConfig(state, mainCb) {
-  var fs = require('fs');
   var ttyname = '/dev/tty';
   var stdin = useTty ? fs.createReadStream(ttyname, {
     fd: fs.openSync(ttyname, fs.constants.O_RDONLY | fs.constants.O_NOCTTY)
@@ -318,11 +317,20 @@ var utils = {
   request: function request(opts, fn) {
     if (!opts) { opts = {}; }
     var service = opts.service || 'config';
-    var req = http.request({
-      socketPath: state._ipc.path
-    , method: opts.method || 'GET'
+
+    var reqOpts = {
+      method: opts.method || 'GET'
     , path: '/rpc/' + service
-    }, function (resp) {
+    };
+    var portFile = path.join(path.dirname(state._ipc.path), 'telebit.port');
+    if (fs.existsSync(portFile)) {
+      reqOpts.host = 'localhost';
+      reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
+    } else {
+      reqOpts.socketPath = state._ipc.path;
+    }
+
+    var req = http.request(reqOpts, function (resp) {
       var body = '';
 
       function finish() {
@@ -383,12 +391,20 @@ var utils = {
     req.end();
   }
 , putConfig: function putConfig(service, args, fn) {
-    var req = http.request({
-      socketPath: state._ipc.path
-    , method: 'POST'
-    , path: '/rpc/' + service + '?_body=' + encodeURIComponent(JSON.stringify(args))
-    }, function (resp) {
 
+    var reqOpts = {
+      method: 'POST'
+    , path: '/rpc/' + service + '?_body=' + encodeURIComponent(JSON.stringify(args))
+    };
+    var portFile = path.join(path.dirname(state._ipc.path), 'telebit.port');
+    if (fs.existsSync(portFile)) {
+      reqOpts.host = 'localhost';
+      reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
+    } else {
+      reqOpts.socketPath = state._ipc.path;
+    }
+
+    var req = http.request(reqOpts, function (resp) {
       function finish() {
         if ('function' === typeof fn) {
           fn(null, resp);
@@ -434,6 +450,9 @@ var utils = {
           } else if ('ssh' === body.module) {
               //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
               console.info('> Forwarding ssh+https (openssl proxy) => localhost:' + body.local);
+          } else if ('status' === body.module) {
+            console.info('http://localhost:' + reqOpts.port);
+            console.info(JSON.stringify(body, null, 2));
           } else {
             console.info(JSON.stringify(body, null, 2));
           }
diff --git a/bin/telebitd.js b/bin/telebitd.js
index d70f4df..722cbd8 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -326,329 +326,339 @@ controllers.ssh = function (req, res, opts) {
   state.config.sshAuto = sshAuto;
   sshSuccess();
 };
-function serveControlsHelper() {
-  controlServer = http.createServer(function (req, res) {
-    var opts = url.parse(req.url, true);
-    if (opts.query._body) {
-      try {
-        opts.body = JSON.parse(decodeURIComponent(opts.query._body, true));
-      } catch(e) {
+
+var serveStatic = require('serve-static')(path.join(__dirname, '../lib/admin/'));
+function handleRemoteClient(req, res) {
+  if (/^\/(rpc|api)\//.test(req.url)) {
+    return handleApi(req, res);
+  }
+  serveStatic(req, res, require('finalhandler')(req, res));
+}
+function handleApi(req, res) {
+  var opts = url.parse(req.url, true);
+  if (opts.query._body) {
+    try {
+      opts.body = JSON.parse(decodeURIComponent(opts.query._body, true));
+    } catch(e) {
+      res.statusCode = 500;
+      res.end('{"error":{"message":"?_body={{bad_format}}"}}');
+      return;
+    }
+  }
+
+  function listSuccess() {
+    var dumpy = {
+      servernames: state.servernames
+    , ports: state.ports
+    , ssh: state.config.sshAuto || 'disabled'
+    , code: 'CONFIG'
+    };
+    if (state.otp) {
+      dumpy.device_pair_code = state.otp;
+    }
+
+    if (state._can_pair && state.config.email && !state.token) {
+      dumpy.code = "AWAIT_AUTH";
+      dumpy.message = "Please run 'telebit init' to authenticate.";
+    }
+
+    res.end(JSON.stringify(dumpy));
+  }
+
+  function getConfigOnly() {
+    var resp = JSON.parse(JSON.stringify(state.config));
+    resp.version = pkg.version;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(resp));
+  }
+
+  //
+  // without proper config
+  //
+  function saveAndReport() {
+    console.log('[DEBUG] saveAndReport config write', confpath);
+    console.log(YAML.safeDump(snakeCopy(state.config)));
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
         res.statusCode = 500;
-        res.end('{"error":{"message":"?_body={{bad_format}}"}}');
+        res.setHeader('Content-Type', 'application/json');
+        res.end('{"error":{"message":"Could not save config file after init: ' + err.message.replace(/"/g, "'")
+          + '.\nPerhaps check that the file exists and your user has permissions to write it?"}}');
         return;
       }
+
+      listSuccess();
+    });
+  }
+
+  function initOrConfig() {
+    var conf = {};
+    if (!opts.body) {
+      res.statusCode = 422;
+      res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
+      return;
+    }
+    // relay, email, agree_tos, servernames, ports
+    //
+    opts.body.forEach(function (opt) {
+      var parts = opt.split(/:/);
+      if ('true' === parts[1]) {
+        parts[1] = true;
+      } else if ('false' === parts[1]) {
+        parts[1] = false;
+      } else if ('null' === parts[1]) {
+        parts[1] = null;
+      } else if ('undefined' === parts[1]) {
+        parts[1] = undefined;
+      }
+      conf[parts[0]] = parts[1];
+    });
+
+    // TODO camelCase query
+    state.config.email = conf.email || state.config.email || '';
+    if ('undefined' !== typeof conf.agreeTos
+      || 'undefined' !== typeof conf.agreeTos ) {
+      state.config.agreeTos = conf.agreeTos || conf.agree_tos;
+    }
+    state.otp = conf._otp; // this should only be done on the client side
+    state.config.relay = conf.relay || state.config.relay || '';
+    console.log();
+    console.log('conf.token', typeof conf.token, conf.token);
+    console.log('state.config.token', typeof state.config.token, state.config.token);
+    state.config.token = conf.token || state.config.token || null;
+    state.config.secret = conf.secret || state.config.secret || null;
+    state.pretoken = conf.pretoken || state.config.pretoken || null;
+    if (state.secret) {
+      console.log('state.secret');
+      state.token = common.signToken(state);
+    }
+    if (!state.token) {
+      console.log('!state.token');
+      state.token = conf._token;
+    }
+    console.log();
+    console.log('JSON.stringify(conf)');
+    console.log(JSON.stringify(conf));
+    console.log();
+    console.log('JSON.stringify(state)');
+    console.log(JSON.stringify(state));
+    console.log();
+    if ('undefined' !== typeof conf.newsletter) {
+      state.config.newsletter = conf.newsletter;
+    }
+    if ('undefined' !== typeof conf.communityMember
+      || 'undefined' !== typeof conf.community_member) {
+      state.config.communityMember = conf.communityMember || conf.community_member;
+    }
+    if ('undefined' !== typeof conf.telemetry) {
+      state.config.telemetry = conf.telemetry;
+    }
+    if (conf._servernames) {
+      (conf._servernames||'').split(/,/g).forEach(function (key) {
+        if (!state.config.servernames[key]) {
+          state.config.servernames[key] = { sub: undefined };
+        }
+      });
+    }
+    if (conf._ports) {
+      (conf._ports||'').split(/,/g).forEach(function (key) {
+        if (!state.config.ports[key]) {
+          state.config.ports[key] = {};
+        }
+      });
     }
 
-    function listSuccess() {
-      var dumpy = {
-        servernames: state.servernames
-      , ports: state.ports
-      , ssh: state.config.sshAuto || 'disabled'
-      , code: 'CONFIG'
-      };
-      if (state.otp) {
-        dumpy.device_pair_code = state.otp;
-      }
+    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+      console.warn('missing config');
+      res.statusCode = 400;
 
-      if (state._can_pair && state.config.email && !state.token) {
-        dumpy.code = "AWAIT_AUTH";
-        dumpy.message = "Please run 'telebit init' to authenticate.";
-      }
-
-      res.end(JSON.stringify(dumpy));
-    }
-
-    function getConfigOnly() {
-      var resp = JSON.parse(JSON.stringify(state.config));
-      resp.version = pkg.version;
       res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify(resp));
+      res.end(JSON.stringify({
+        error: {
+          code: "E_INIT"
+        , message: "Missing important config file params"
+        , _params: JSON.stringify(conf)
+        , _config: JSON.stringify(state.config)
+        , _body: JSON.stringify(opts.body)
+        }
+      }));
+      return;
     }
 
-    //
-    // without proper config
-    //
-    function saveAndReport() {
-      console.log('[DEBUG] saveAndReport config write', confpath);
-      console.log(YAML.safeDump(snakeCopy(state.config)));
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          res.statusCode = 500;
-          res.setHeader('Content-Type', 'application/json');
-          res.end('{"error":{"message":"Could not save config file after init: ' + err.message.replace(/"/g, "'")
-            + '.\nPerhaps check that the file exists and your user has permissions to write it?"}}');
-          return;
-        }
+    // init also means enable
+    delete state.config.disable;
+    safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
+  }
 
-        listSuccess();
-      });
+  function restart() {
+    console.info("[telebitd.js] server closing...");
+    state.keepAlive.state = false;
+    if (myRemote) {
+      myRemote.end();
+      myRemote.on('end', respondAndClose);
+      // failsafe
+      setTimeout(function () {
+        console.info("[telebitd.js] closing too slowly, force quit");
+        respondAndClose();
+      }, 5 * 1000);
+    } else {
+      respondAndClose();
     }
 
-    function initOrConfig() {
-      var conf = {};
-      if (!opts.body) {
-        res.statusCode = 422;
-        res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
-        return;
-      }
-      // relay, email, agree_tos, servernames, ports
-      //
-      opts.body.forEach(function (opt) {
-        var parts = opt.split(/:/);
-        if ('true' === parts[1]) {
-          parts[1] = true;
-        } else if ('false' === parts[1]) {
-          parts[1] = false;
-        } else if ('null' === parts[1]) {
-          parts[1] = null;
-        } else if ('undefined' === parts[1]) {
-          parts[1] = undefined;
-        }
-        conf[parts[0]] = parts[1];
+    function respondAndClose() {
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ success: true }));
+      controlServer.close(function () {
+        console.info("[telebitd.js] server closed");
+        setTimeout(function () {
+          // system daemon will restart the process
+          process.exit(22); // use non-success exit code
+        }, 100);
       });
+    }
+  }
 
-      // TODO camelCase query
-      state.config.email = conf.email || state.config.email || '';
-      if ('undefined' !== typeof conf.agreeTos
-        || 'undefined' !== typeof conf.agreeTos ) {
-        state.config.agreeTos = conf.agreeTos || conf.agree_tos;
-      }
-      state.otp = conf._otp; // this should only be done on the client side
-      state.config.relay = conf.relay || state.config.relay || '';
-      console.log();
-      console.log('conf.token', typeof conf.token, conf.token);
-      console.log('state.config.token', typeof state.config.token, state.config.token);
-      state.config.token = conf.token || state.config.token || null;
-      state.config.secret = conf.secret || state.config.secret || null;
-      state.pretoken = conf.pretoken || state.config.pretoken || null;
-      if (state.secret) {
-        console.log('state.secret');
-        state.token = common.signToken(state);
-      }
-      if (!state.token) {
-        console.log('!state.token');
-        state.token = conf._token;
-      }
-      console.log();
-      console.log('JSON.stringify(conf)');
-      console.log(JSON.stringify(conf));
-      console.log();
-      console.log('JSON.stringify(state)');
-      console.log(JSON.stringify(state));
-      console.log();
-      if ('undefined' !== typeof conf.newsletter) {
-        state.config.newsletter = conf.newsletter;
-      }
-      if ('undefined' !== typeof conf.communityMember
-        || 'undefined' !== typeof conf.community_member) {
-        state.config.communityMember = conf.communityMember || conf.community_member;
-      }
-      if ('undefined' !== typeof conf.telemetry) {
-        state.config.telemetry = conf.telemetry;
-      }
-      if (conf._servernames) {
-        (conf._servernames||'').split(/,/g).forEach(function (key) {
-          if (!state.config.servernames[key]) {
-            state.config.servernames[key] = { sub: undefined };
-          }
-        });
-      }
-      if (conf._ports) {
-        (conf._ports||'').split(/,/g).forEach(function (key) {
-          if (!state.config.ports[key]) {
-            state.config.ports[key] = {};
-          }
-        });
-      }
-
-      if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-        console.warn('missing config');
-        res.statusCode = 400;
+  function invalidConfig() {
+    res.statusCode = 400;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+      error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
+    }));
+  }
 
+  function saveAndCommit() {
+    state.config.servernames = state.servernames;
+    state.config.ports = state.ports;
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        res.statusCode = 500;
         res.setHeader('Content-Type', 'application/json');
         res.end(JSON.stringify({
-          error: {
-            code: "E_INIT"
-          , message: "Missing important config file params"
-          , _params: JSON.stringify(conf)
-          , _config: JSON.stringify(state.config)
-          , _body: JSON.stringify(opts.body)
-          }
+          "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
         }));
         return;
       }
-
-      // init also means enable
-      delete state.config.disable;
-      safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
-    }
-
-    function restart() {
-      console.info("[telebitd.js] server closing...");
-      state.keepAlive.state = false;
-      if (myRemote) {
-        myRemote.end();
-        myRemote.on('end', respondAndClose);
-        // failsafe
-        setTimeout(function () {
-          console.info("[telebitd.js] closing too slowly, force quit");
-          respondAndClose();
-        }, 5 * 1000);
-      } else {
-        respondAndClose();
-      }
-
-      function respondAndClose() {
-        res.setHeader('Content-Type', 'application/json');
-        res.end(JSON.stringify({ success: true }));
-        controlServer.close(function () {
-          console.info("[telebitd.js] server closed");
-          setTimeout(function () {
-            // system daemon will restart the process
-            process.exit(22); // use non-success exit code
-          }, 100);
-        });
-      }
-    }
-
-    function invalidConfig() {
-      res.statusCode = 400;
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
-        error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
-      }));
-    }
-
-    function saveAndCommit() {
-      state.config.servernames = state.servernames;
-      state.config.ports = state.ports;
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          res.statusCode = 500;
-          res.setHeader('Content-Type', 'application/json');
-          res.end(JSON.stringify({
-            "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
-          }));
-          return;
-        }
-        listSuccess();
-      });
-    }
-
-    function handleError(err) {
-      res.statusCode = 500;
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
-        error: { message: err.message, code: err.code }
-      }));
-    }
-
-    function enable() {
-      delete state.config.disable;// = undefined;
-      state.keepAlive.state = true;
-
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-          handleError(err);
-          return;
-        }
-        // TODO XXX myRemote.active
-        if (myRemote) {
-          listSuccess();
-          return;
-        }
-        safeStartTelebitRemote(true).then(listSuccess).catch(handleError);
-      });
-    }
-
-    function disable() {
-      state.config.disable = true;
-      state.keepAlive.state = false;
-
-      if (myRemote) { myRemote.end(); myRemote = null; }
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        res.setHeader('Content-Type', 'application/json');
-        if (err) {
-          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-          handleError(err);
-          return;
-        }
-        res.end('{"success":true}');
-      });
-    }
-
-    function getStatus() {
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify(
-        { status: (state.config.disable ? 'disabled' : 'enabled')
-        , ready: ((state.config.relay && (state.config.token || state.config.agreeTos)) ? true : false)
-        , active: !!myRemote
-        , connected: 'maybe (todo)'
-        , version: pkg.version
-        , servernames: state.servernames
-        }
-      ));
-    }
-
-    if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
-      getConfigOnly();
-      return;
-    }
-    if (/\b(init|config)\b/.test(opts.pathname)) {
-      initOrConfig();
-      return;
-    }
-    if (/restart/.test(opts.pathname)) {
-      restart();
-      return;
-    }
-    //
-    // Check for proper config
-    //
-    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-      invalidConfig();
-      return;
-    }
-    //
-    // With proper config
-    //
-    if (/http/.test(opts.pathname)) {
-      controllers.http(req, res, opts);
-      return;
-    }
-    if (/tcp/.test(opts.pathname)) {
-      controllers.tcp(req, res, opts);
-      return;
-    }
-    if (/save|commit/.test(opts.pathname)) {
-      saveAndCommit();
-      return;
-    }
-    if (/ssh/.test(opts.pathname)) {
-      controllers.ssh(req, res, opts);
-      return;
-    }
-    if (/enable/.test(opts.pathname)) {
-      enable();
-      return;
-    }
-    if (/disable/.test(opts.pathname)) {
-      disable();
-      return;
-    }
-    if (/status/.test(opts.pathname)) {
-      getStatus();
-      return;
-    }
-    if (/list/.test(opts.pathname)) {
       listSuccess();
-      return;
-    }
+    });
+  }
 
+  function handleError(err) {
+    res.statusCode = 500;
     res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
-  });
+    res.end(JSON.stringify({
+      error: { message: err.message, code: err.code }
+    }));
+  }
+
+  function enable() {
+    delete state.config.disable;// = undefined;
+    state.keepAlive.state = true;
+
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+        handleError(err);
+        return;
+      }
+      // TODO XXX myRemote.active
+      if (myRemote) {
+        listSuccess();
+        return;
+      }
+      safeStartTelebitRemote(true).then(listSuccess).catch(handleError);
+    });
+  }
+
+  function disable() {
+    state.config.disable = true;
+    state.keepAlive.state = false;
+
+    if (myRemote) { myRemote.end(); myRemote = null; }
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      res.setHeader('Content-Type', 'application/json');
+      if (err) {
+        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+        handleError(err);
+        return;
+      }
+      res.end('{"success":true}');
+    });
+  }
+
+  function getStatus() {
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(
+      { module: 'status'
+      , status: (state.config.disable ? 'disabled' : 'enabled')
+      , ready: ((state.config.relay && (state.config.token || state.config.agreeTos)) ? true : false)
+      , active: !!myRemote
+      , connected: 'maybe (todo)'
+      , version: pkg.version
+      , servernames: state.servernames
+      }
+    ));
+  }
+
+  if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
+    getConfigOnly();
+    return;
+  }
+  if (/\b(init|config)\b/.test(opts.pathname)) {
+    initOrConfig();
+    return;
+  }
+  if (/restart/.test(opts.pathname)) {
+    restart();
+    return;
+  }
+  //
+  // Check for proper config
+  //
+  if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+    invalidConfig();
+    return;
+  }
+  //
+  // With proper config
+  //
+  if (/http/.test(opts.pathname)) {
+    controllers.http(req, res, opts);
+    return;
+  }
+  if (/tcp/.test(opts.pathname)) {
+    controllers.tcp(req, res, opts);
+    return;
+  }
+  if (/save|commit/.test(opts.pathname)) {
+    saveAndCommit();
+    return;
+  }
+  if (/ssh/.test(opts.pathname)) {
+    controllers.ssh(req, res, opts);
+    return;
+  }
+  if (/enable/.test(opts.pathname)) {
+    enable();
+    return;
+  }
+  if (/disable/.test(opts.pathname)) {
+    disable();
+    return;
+  }
+  if (/status/.test(opts.pathname)) {
+    getStatus();
+    return;
+  }
+  if (/list/.test(opts.pathname)) {
+    listSuccess();
+    return;
+  }
+
+  res.setHeader('Content-Type', 'application/json');
+  res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
+}
+function serveControlsHelper() {
+  controlServer = http.createServer(handleRemoteClient);
 
   if (fs.existsSync(state._ipc.path)) {
     fs.unlinkSync(state._ipc.path);
@@ -661,15 +671,30 @@ function serveControlsHelper() {
   , readableAll: true
   , exclusive: false
   };
+  if (!state.config.ipc) {
+    state.config.ipc = {};
+  }
+  if (!state.config.ipc.path) {
+    state.config.ipc.path = path.dirname(state._ipc.path);
+  }
+  require('mkdirp').sync(state.config.ipc.path);
+  if (!state.config.ipc.type) {
+    state.config.ipc.type = 'port';
+  }
+  var portFile = path.join(state.config.ipc.path, 'telebit.port');
+  if (fs.existsSync(portFile)) {
+    state._ipc.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
+  }
+
   if ('socket' === state._ipc.type) {
     require('mkdirp').sync(path.dirname(state._ipc.path));
   }
   // https://nodejs.org/api/net.html#net_server_listen_options_callback
   // path is ignore if port is defined
   // https://git.coolaj86.com/coolaj86/telebit.js/issues/23#issuecomment-326
-  if (state._ipc.port) {
+  if ('port' === state.config.ipc.type) {
     serverOpts.host = 'localhost';
-    serverOpts.port = state._ipc.port;
+    serverOpts.port = state._ipc.port || 0;
   } else {
     serverOpts.path = state._ipc.path;
   }
@@ -682,6 +707,21 @@ function serveControlsHelper() {
     //console.log(this.address());
     console.info("[info] Listening for commands on", address);
   });
+  controlServer.on('error', function (err) {
+    if ('EADDRINUSE' === err.code) {
+      try {
+        fs.unlinkSync(portFile);
+      } catch(e) {
+        // nada
+      }
+      setTimeout(function () {
+        console.log("trying again");
+        serveControlsHelper();
+      }, 1000);
+      return;
+    }
+    console.error('failed to start c&c server:', err);
+  });
 }
 
 function serveControls() {
diff --git a/lib/admin/index.html b/lib/admin/index.html
new file mode 100644
index 0000000..0b180dc
--- /dev/null
+++ b/lib/admin/index.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Telebit Admin</title>
+</head>
+<body>
+  <div class="v-app">
+    <h1>Telebit Admin</h1>
+
+    <section>
+      <h2>GET /api/config</h2>
+      <pre><code>{{ config }}</code></pre>
+    </section>
+
+    <section>
+      <h2>GET /api/status</h2>
+      <pre><code>{{ status }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/init</h2>
+      <form v-on:submit.stop.prevent="initialize">
+
+        <label for="-email">Email:</label>
+        <input id="-email" v-model="init.email" type="text" placeholder="john@example.com">
+        <br>
+
+        <label for="-teletos"><input id="-teletos" v-model="init.teletos" type="checkbox">
+          Accept Telebit Terms of Service</label>
+        <br>
+
+        <label for="-letos"><input id="-letos" v-model="init.letos" type="checkbox">
+          Accept Let's Encrypt Terms of Service</label>
+        <br>
+
+      </form>
+      <pre><code>{{ init }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/http</h2>
+      <pre><code>{{ http }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/tcp</h2>
+      <pre><code>{{ tcp }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/ssh</h2>
+      <pre><code>{{ ssh }}</code></pre>
+    </section>
+
+  </div>
+
+  <script src="js/vue.js"></script>
+  <script src="js/app.js"></script>
+</body>
+</html>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
new file mode 100644
index 0000000..cef624b
--- /dev/null
+++ b/lib/admin/js/app.js
@@ -0,0 +1,50 @@
+;(function () {
+'use strict';
+
+console.log("hello");
+
+var Vue = window.Vue;
+var api = {};
+
+api.config = function apiConfig() {
+  return window.fetch("/api/config", { method: "GET" }).then(function (resp) {
+    return resp.json().then(function (json) {
+      appData.config = json;
+      return json;
+    });
+  });
+};
+api.status = function apiStatus() {
+  return window.fetch("/api/status", { method: "GET" }).then(function (resp) {
+    return resp.json().then(function (json) {
+      appData.status = json;
+      return json;
+    });
+  });
+};
+
+var appData = {
+  config: null
+, status: null
+, init: {}
+, http: null
+, tcp: null
+, ssh: null
+};
+var appMethods = {
+  initialize: function () {
+    console.log("call initialize");
+  }
+};
+
+new Vue({
+  el: ".v-app"
+, data: appData
+, methods: appMethods
+});
+
+api.config();
+api.status();
+
+window.api = api;
+}());
diff --git a/lib/admin/js/vue.js b/lib/admin/js/vue.js
new file mode 100644
index 0000000..ef171b9
--- /dev/null
+++ b/lib/admin/js/vue.js
@@ -0,0 +1,10947 @@
+/*!
+ * Vue.js v2.5.17
+ * (c) 2014-2018 Evan You
+ * Released under the MIT License.
+ */
+(function (global, factory) {
+	typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+	typeof define === 'function' && define.amd ? define(factory) :
+	(global.Vue = factory());
+}(this, (function () { 'use strict';
+
+/*  */
+
+var emptyObject = Object.freeze({});
+
+// these helpers produces better vm code in JS engines due to their
+// explicitness and function inlining
+function isUndef (v) {
+  return v === undefined || v === null
+}
+
+function isDef (v) {
+  return v !== undefined && v !== null
+}
+
+function isTrue (v) {
+  return v === true
+}
+
+function isFalse (v) {
+  return v === false
+}
+
+/**
+ * Check if value is primitive
+ */
+function isPrimitive (value) {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    // $flow-disable-line
+    typeof value === 'symbol' ||
+    typeof value === 'boolean'
+  )
+}
+
+/**
+ * Quick object check - this is primarily used to tell
+ * Objects from primitive values when we know the value
+ * is a JSON-compliant type.
+ */
+function isObject (obj) {
+  return obj !== null && typeof obj === 'object'
+}
+
+/**
+ * Get the raw type string of a value e.g. [object Object]
+ */
+var _toString = Object.prototype.toString;
+
+function toRawType (value) {
+  return _toString.call(value).slice(8, -1)
+}
+
+/**
+ * Strict object type check. Only returns true
+ * for plain JavaScript objects.
+ */
+function isPlainObject (obj) {
+  return _toString.call(obj) === '[object Object]'
+}
+
+function isRegExp (v) {
+  return _toString.call(v) === '[object RegExp]'
+}
+
+/**
+ * Check if val is a valid array index.
+ */
+function isValidArrayIndex (val) {
+  var n = parseFloat(String(val));
+  return n >= 0 && Math.floor(n) === n && isFinite(val)
+}
+
+/**
+ * Convert a value to a string that is actually rendered.
+ */
+function toString (val) {
+  return val == null
+    ? ''
+    : typeof val === 'object'
+      ? JSON.stringify(val, null, 2)
+      : String(val)
+}
+
+/**
+ * Convert a input value to a number for persistence.
+ * If the conversion fails, return original string.
+ */
+function toNumber (val) {
+  var n = parseFloat(val);
+  return isNaN(n) ? val : n
+}
+
+/**
+ * Make a map and return a function for checking if a key
+ * is in that map.
+ */
+function makeMap (
+  str,
+  expectsLowerCase
+) {
+  var map = Object.create(null);
+  var list = str.split(',');
+  for (var i = 0; i < list.length; i++) {
+    map[list[i]] = true;
+  }
+  return expectsLowerCase
+    ? function (val) { return map[val.toLowerCase()]; }
+    : function (val) { return map[val]; }
+}
+
+/**
+ * Check if a tag is a built-in tag.
+ */
+var isBuiltInTag = makeMap('slot,component', true);
+
+/**
+ * Check if a attribute is a reserved attribute.
+ */
+var isReservedAttribute = makeMap('key,ref,slot,slot-scope,is');
+
+/**
+ * Remove an item from an array
+ */
+function remove (arr, item) {
+  if (arr.length) {
+    var index = arr.indexOf(item);
+    if (index > -1) {
+      return arr.splice(index, 1)
+    }
+  }
+}
+
+/**
+ * Check whether the object has the property.
+ */
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+function hasOwn (obj, key) {
+  return hasOwnProperty.call(obj, key)
+}
+
+/**
+ * Create a cached version of a pure function.
+ */
+function cached (fn) {
+  var cache = Object.create(null);
+  return (function cachedFn (str) {
+    var hit = cache[str];
+    return hit || (cache[str] = fn(str))
+  })
+}
+
+/**
+ * Camelize a hyphen-delimited string.
+ */
+var camelizeRE = /-(\w)/g;
+var camelize = cached(function (str) {
+  return str.replace(camelizeRE, function (_, c) { return c ? c.toUpperCase() : ''; })
+});
+
+/**
+ * Capitalize a string.
+ */
+var capitalize = cached(function (str) {
+  return str.charAt(0).toUpperCase() + str.slice(1)
+});
+
+/**
+ * Hyphenate a camelCase string.
+ */
+var hyphenateRE = /\B([A-Z])/g;
+var hyphenate = cached(function (str) {
+  return str.replace(hyphenateRE, '-$1').toLowerCase()
+});
+
+/**
+ * Simple bind polyfill for environments that do not support it... e.g.
+ * PhantomJS 1.x. Technically we don't need this anymore since native bind is
+ * now more performant in most browsers, but removing it would be breaking for
+ * code that was able to run in PhantomJS 1.x, so this must be kept for
+ * backwards compatibility.
+ */
+
+/* istanbul ignore next */
+function polyfillBind (fn, ctx) {
+  function boundFn (a) {
+    var l = arguments.length;
+    return l
+      ? l > 1
+        ? fn.apply(ctx, arguments)
+        : fn.call(ctx, a)
+      : fn.call(ctx)
+  }
+
+  boundFn._length = fn.length;
+  return boundFn
+}
+
+function nativeBind (fn, ctx) {
+  return fn.bind(ctx)
+}
+
+var bind = Function.prototype.bind
+  ? nativeBind
+  : polyfillBind;
+
+/**
+ * Convert an Array-like object to a real Array.
+ */
+function toArray (list, start) {
+  start = start || 0;
+  var i = list.length - start;
+  var ret = new Array(i);
+  while (i--) {
+    ret[i] = list[i + start];
+  }
+  return ret
+}
+
+/**
+ * Mix properties into target object.
+ */
+function extend (to, _from) {
+  for (var key in _from) {
+    to[key] = _from[key];
+  }
+  return to
+}
+
+/**
+ * Merge an Array of Objects into a single Object.
+ */
+function toObject (arr) {
+  var res = {};
+  for (var i = 0; i < arr.length; i++) {
+    if (arr[i]) {
+      extend(res, arr[i]);
+    }
+  }
+  return res
+}
+
+/**
+ * Perform no operation.
+ * Stubbing args to make Flow happy without leaving useless transpiled code
+ * with ...rest (https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/)
+ */
+function noop (a, b, c) {}
+
+/**
+ * Always return false.
+ */
+var no = function (a, b, c) { return false; };
+
+/**
+ * Return same value
+ */
+var identity = function (_) { return _; };
+
+/**
+ * Generate a static keys string from compiler modules.
+ */
+function genStaticKeys (modules) {
+  return modules.reduce(function (keys, m) {
+    return keys.concat(m.staticKeys || [])
+  }, []).join(',')
+}
+
+/**
+ * Check if two values are loosely equal - that is,
+ * if they are plain objects, do they have the same shape?
+ */
+function looseEqual (a, b) {
+  if (a === b) { return true }
+  var isObjectA = isObject(a);
+  var isObjectB = isObject(b);
+  if (isObjectA && isObjectB) {
+    try {
+      var isArrayA = Array.isArray(a);
+      var isArrayB = Array.isArray(b);
+      if (isArrayA && isArrayB) {
+        return a.length === b.length && a.every(function (e, i) {
+          return looseEqual(e, b[i])
+        })
+      } else if (!isArrayA && !isArrayB) {
+        var keysA = Object.keys(a);
+        var keysB = Object.keys(b);
+        return keysA.length === keysB.length && keysA.every(function (key) {
+          return looseEqual(a[key], b[key])
+        })
+      } else {
+        /* istanbul ignore next */
+        return false
+      }
+    } catch (e) {
+      /* istanbul ignore next */
+      return false
+    }
+  } else if (!isObjectA && !isObjectB) {
+    return String(a) === String(b)
+  } else {
+    return false
+  }
+}
+
+function looseIndexOf (arr, val) {
+  for (var i = 0; i < arr.length; i++) {
+    if (looseEqual(arr[i], val)) { return i }
+  }
+  return -1
+}
+
+/**
+ * Ensure a function is called only once.
+ */
+function once (fn) {
+  var called = false;
+  return function () {
+    if (!called) {
+      called = true;
+      fn.apply(this, arguments);
+    }
+  }
+}
+
+var SSR_ATTR = 'data-server-rendered';
+
+var ASSET_TYPES = [
+  'component',
+  'directive',
+  'filter'
+];
+
+var LIFECYCLE_HOOKS = [
+  'beforeCreate',
+  'created',
+  'beforeMount',
+  'mounted',
+  'beforeUpdate',
+  'updated',
+  'beforeDestroy',
+  'destroyed',
+  'activated',
+  'deactivated',
+  'errorCaptured'
+];
+
+/*  */
+
+var config = ({
+  /**
+   * Option merge strategies (used in core/util/options)
+   */
+  // $flow-disable-line
+  optionMergeStrategies: Object.create(null),
+
+  /**
+   * Whether to suppress warnings.
+   */
+  silent: false,
+
+  /**
+   * Show production mode tip message on boot?
+   */
+  productionTip: "development" !== 'production',
+
+  /**
+   * Whether to enable devtools
+   */
+  devtools: "development" !== 'production',
+
+  /**
+   * Whether to record perf
+   */
+  performance: false,
+
+  /**
+   * Error handler for watcher errors
+   */
+  errorHandler: null,
+
+  /**
+   * Warn handler for watcher warns
+   */
+  warnHandler: null,
+
+  /**
+   * Ignore certain custom elements
+   */
+  ignoredElements: [],
+
+  /**
+   * Custom user key aliases for v-on
+   */
+  // $flow-disable-line
+  keyCodes: Object.create(null),
+
+  /**
+   * Check if a tag is reserved so that it cannot be registered as a
+   * component. This is platform-dependent and may be overwritten.
+   */
+  isReservedTag: no,
+
+  /**
+   * Check if an attribute is reserved so that it cannot be used as a component
+   * prop. This is platform-dependent and may be overwritten.
+   */
+  isReservedAttr: no,
+
+  /**
+   * Check if a tag is an unknown element.
+   * Platform-dependent.
+   */
+  isUnknownElement: no,
+
+  /**
+   * Get the namespace of an element
+   */
+  getTagNamespace: noop,
+
+  /**
+   * Parse the real tag name for the specific platform.
+   */
+  parsePlatformTagName: identity,
+
+  /**
+   * Check if an attribute must be bound using property, e.g. value
+   * Platform-dependent.
+   */
+  mustUseProp: no,
+
+  /**
+   * Exposed for legacy reasons
+   */
+  _lifecycleHooks: LIFECYCLE_HOOKS
+})
+
+/*  */
+
+/**
+ * Check if a string starts with $ or _
+ */
+function isReserved (str) {
+  var c = (str + '').charCodeAt(0);
+  return c === 0x24 || c === 0x5F
+}
+
+/**
+ * Define a property.
+ */
+function def (obj, key, val, enumerable) {
+  Object.defineProperty(obj, key, {
+    value: val,
+    enumerable: !!enumerable,
+    writable: true,
+    configurable: true
+  });
+}
+
+/**
+ * Parse simple path.
+ */
+var bailRE = /[^\w.$]/;
+function parsePath (path) {
+  if (bailRE.test(path)) {
+    return
+  }
+  var segments = path.split('.');
+  return function (obj) {
+    for (var i = 0; i < segments.length; i++) {
+      if (!obj) { return }
+      obj = obj[segments[i]];
+    }
+    return obj
+  }
+}
+
+/*  */
+
+// can we use __proto__?
+var hasProto = '__proto__' in {};
+
+// Browser environment sniffing
+var inBrowser = typeof window !== 'undefined';
+var inWeex = typeof WXEnvironment !== 'undefined' && !!WXEnvironment.platform;
+var weexPlatform = inWeex && WXEnvironment.platform.toLowerCase();
+var UA = inBrowser && window.navigator.userAgent.toLowerCase();
+var isIE = UA && /msie|trident/.test(UA);
+var isIE9 = UA && UA.indexOf('msie 9.0') > 0;
+var isEdge = UA && UA.indexOf('edge/') > 0;
+var isAndroid = (UA && UA.indexOf('android') > 0) || (weexPlatform === 'android');
+var isIOS = (UA && /iphone|ipad|ipod|ios/.test(UA)) || (weexPlatform === 'ios');
+var isChrome = UA && /chrome\/\d+/.test(UA) && !isEdge;
+
+// Firefox has a "watch" function on Object.prototype...
+var nativeWatch = ({}).watch;
+
+var supportsPassive = false;
+if (inBrowser) {
+  try {
+    var opts = {};
+    Object.defineProperty(opts, 'passive', ({
+      get: function get () {
+        /* istanbul ignore next */
+        supportsPassive = true;
+      }
+    })); // https://github.com/facebook/flow/issues/285
+    window.addEventListener('test-passive', null, opts);
+  } catch (e) {}
+}
+
+// this needs to be lazy-evaled because vue may be required before
+// vue-server-renderer can set VUE_ENV
+var _isServer;
+var isServerRendering = function () {
+  if (_isServer === undefined) {
+    /* istanbul ignore if */
+    if (!inBrowser && !inWeex && typeof global !== 'undefined') {
+      // detect presence of vue-server-renderer and avoid
+      // Webpack shimming the process
+      _isServer = global['process'].env.VUE_ENV === 'server';
+    } else {
+      _isServer = false;
+    }
+  }
+  return _isServer
+};
+
+// detect devtools
+var devtools = inBrowser && window.__VUE_DEVTOOLS_GLOBAL_HOOK__;
+
+/* istanbul ignore next */
+function isNative (Ctor) {
+  return typeof Ctor === 'function' && /native code/.test(Ctor.toString())
+}
+
+var hasSymbol =
+  typeof Symbol !== 'undefined' && isNative(Symbol) &&
+  typeof Reflect !== 'undefined' && isNative(Reflect.ownKeys);
+
+var _Set;
+/* istanbul ignore if */ // $flow-disable-line
+if (typeof Set !== 'undefined' && isNative(Set)) {
+  // use native Set when available.
+  _Set = Set;
+} else {
+  // a non-standard Set polyfill that only works with primitive keys.
+  _Set = (function () {
+    function Set () {
+      this.set = Object.create(null);
+    }
+    Set.prototype.has = function has (key) {
+      return this.set[key] === true
+    };
+    Set.prototype.add = function add (key) {
+      this.set[key] = true;
+    };
+    Set.prototype.clear = function clear () {
+      this.set = Object.create(null);
+    };
+
+    return Set;
+  }());
+}
+
+/*  */
+
+var warn = noop;
+var tip = noop;
+var generateComponentTrace = (noop); // work around flow check
+var formatComponentName = (noop);
+
+{
+  var hasConsole = typeof console !== 'undefined';
+  var classifyRE = /(?:^|[-_])(\w)/g;
+  var classify = function (str) { return str
+    .replace(classifyRE, function (c) { return c.toUpperCase(); })
+    .replace(/[-_]/g, ''); };
+
+  warn = function (msg, vm) {
+    var trace = vm ? generateComponentTrace(vm) : '';
+
+    if (config.warnHandler) {
+      config.warnHandler.call(null, msg, vm, trace);
+    } else if (hasConsole && (!config.silent)) {
+      console.error(("[Vue warn]: " + msg + trace));
+    }
+  };
+
+  tip = function (msg, vm) {
+    if (hasConsole && (!config.silent)) {
+      console.warn("[Vue tip]: " + msg + (
+        vm ? generateComponentTrace(vm) : ''
+      ));
+    }
+  };
+
+  formatComponentName = function (vm, includeFile) {
+    if (vm.$root === vm) {
+      return '<Root>'
+    }
+    var options = typeof vm === 'function' && vm.cid != null
+      ? vm.options
+      : vm._isVue
+        ? vm.$options || vm.constructor.options
+        : vm || {};
+    var name = options.name || options._componentTag;
+    var file = options.__file;
+    if (!name && file) {
+      var match = file.match(/([^/\\]+)\.vue$/);
+      name = match && match[1];
+    }
+
+    return (
+      (name ? ("<" + (classify(name)) + ">") : "<Anonymous>") +
+      (file && includeFile !== false ? (" at " + file) : '')
+    )
+  };
+
+  var repeat = function (str, n) {
+    var res = '';
+    while (n) {
+      if (n % 2 === 1) { res += str; }
+      if (n > 1) { str += str; }
+      n >>= 1;
+    }
+    return res
+  };
+
+  generateComponentTrace = function (vm) {
+    if (vm._isVue && vm.$parent) {
+      var tree = [];
+      var currentRecursiveSequence = 0;
+      while (vm) {
+        if (tree.length > 0) {
+          var last = tree[tree.length - 1];
+          if (last.constructor === vm.constructor) {
+            currentRecursiveSequence++;
+            vm = vm.$parent;
+            continue
+          } else if (currentRecursiveSequence > 0) {
+            tree[tree.length - 1] = [last, currentRecursiveSequence];
+            currentRecursiveSequence = 0;
+          }
+        }
+        tree.push(vm);
+        vm = vm.$parent;
+      }
+      return '\n\nfound in\n\n' + tree
+        .map(function (vm, i) { return ("" + (i === 0 ? '---> ' : repeat(' ', 5 + i * 2)) + (Array.isArray(vm)
+            ? ((formatComponentName(vm[0])) + "... (" + (vm[1]) + " recursive calls)")
+            : formatComponentName(vm))); })
+        .join('\n')
+    } else {
+      return ("\n\n(found in " + (formatComponentName(vm)) + ")")
+    }
+  };
+}
+
+/*  */
+
+
+var uid = 0;
+
+/**
+ * A dep is an observable that can have multiple
+ * directives subscribing to it.
+ */
+var Dep = function Dep () {
+  this.id = uid++;
+  this.subs = [];
+};
+
+Dep.prototype.addSub = function addSub (sub) {
+  this.subs.push(sub);
+};
+
+Dep.prototype.removeSub = function removeSub (sub) {
+  remove(this.subs, sub);
+};
+
+Dep.prototype.depend = function depend () {
+  if (Dep.target) {
+    Dep.target.addDep(this);
+  }
+};
+
+Dep.prototype.notify = function notify () {
+  // stabilize the subscriber list first
+  var subs = this.subs.slice();
+  for (var i = 0, l = subs.length; i < l; i++) {
+    subs[i].update();
+  }
+};
+
+// the current target watcher being evaluated.
+// this is globally unique because there could be only one
+// watcher being evaluated at any time.
+Dep.target = null;
+var targetStack = [];
+
+function pushTarget (_target) {
+  if (Dep.target) { targetStack.push(Dep.target); }
+  Dep.target = _target;
+}
+
+function popTarget () {
+  Dep.target = targetStack.pop();
+}
+
+/*  */
+
+var VNode = function VNode (
+  tag,
+  data,
+  children,
+  text,
+  elm,
+  context,
+  componentOptions,
+  asyncFactory
+) {
+  this.tag = tag;
+  this.data = data;
+  this.children = children;
+  this.text = text;
+  this.elm = elm;
+  this.ns = undefined;
+  this.context = context;
+  this.fnContext = undefined;
+  this.fnOptions = undefined;
+  this.fnScopeId = undefined;
+  this.key = data && data.key;
+  this.componentOptions = componentOptions;
+  this.componentInstance = undefined;
+  this.parent = undefined;
+  this.raw = false;
+  this.isStatic = false;
+  this.isRootInsert = true;
+  this.isComment = false;
+  this.isCloned = false;
+  this.isOnce = false;
+  this.asyncFactory = asyncFactory;
+  this.asyncMeta = undefined;
+  this.isAsyncPlaceholder = false;
+};
+
+var prototypeAccessors = { child: { configurable: true } };
+
+// DEPRECATED: alias for componentInstance for backwards compat.
+/* istanbul ignore next */
+prototypeAccessors.child.get = function () {
+  return this.componentInstance
+};
+
+Object.defineProperties( VNode.prototype, prototypeAccessors );
+
+var createEmptyVNode = function (text) {
+  if ( text === void 0 ) text = '';
+
+  var node = new VNode();
+  node.text = text;
+  node.isComment = true;
+  return node
+};
+
+function createTextVNode (val) {
+  return new VNode(undefined, undefined, undefined, String(val))
+}
+
+// optimized shallow clone
+// used for static nodes and slot nodes because they may be reused across
+// multiple renders, cloning them avoids errors when DOM manipulations rely
+// on their elm reference.
+function cloneVNode (vnode) {
+  var cloned = new VNode(
+    vnode.tag,
+    vnode.data,
+    vnode.children,
+    vnode.text,
+    vnode.elm,
+    vnode.context,
+    vnode.componentOptions,
+    vnode.asyncFactory
+  );
+  cloned.ns = vnode.ns;
+  cloned.isStatic = vnode.isStatic;
+  cloned.key = vnode.key;
+  cloned.isComment = vnode.isComment;
+  cloned.fnContext = vnode.fnContext;
+  cloned.fnOptions = vnode.fnOptions;
+  cloned.fnScopeId = vnode.fnScopeId;
+  cloned.isCloned = true;
+  return cloned
+}
+
+/*
+ * not type checking this file because flow doesn't play well with
+ * dynamically accessing methods on Array prototype
+ */
+
+var arrayProto = Array.prototype;
+var arrayMethods = Object.create(arrayProto);
+
+var methodsToPatch = [
+  'push',
+  'pop',
+  'shift',
+  'unshift',
+  'splice',
+  'sort',
+  'reverse'
+];
+
+/**
+ * Intercept mutating methods and emit events
+ */
+methodsToPatch.forEach(function (method) {
+  // cache original method
+  var original = arrayProto[method];
+  def(arrayMethods, method, function mutator () {
+    var args = [], len = arguments.length;
+    while ( len-- ) args[ len ] = arguments[ len ];
+
+    var result = original.apply(this, args);
+    var ob = this.__ob__;
+    var inserted;
+    switch (method) {
+      case 'push':
+      case 'unshift':
+        inserted = args;
+        break
+      case 'splice':
+        inserted = args.slice(2);
+        break
+    }
+    if (inserted) { ob.observeArray(inserted); }
+    // notify change
+    ob.dep.notify();
+    return result
+  });
+});
+
+/*  */
+
+var arrayKeys = Object.getOwnPropertyNames(arrayMethods);
+
+/**
+ * In some cases we may want to disable observation inside a component's
+ * update computation.
+ */
+var shouldObserve = true;
+
+function toggleObserving (value) {
+  shouldObserve = value;
+}
+
+/**
+ * Observer class that is attached to each observed
+ * object. Once attached, the observer converts the target
+ * object's property keys into getter/setters that
+ * collect dependencies and dispatch updates.
+ */
+var Observer = function Observer (value) {
+  this.value = value;
+  this.dep = new Dep();
+  this.vmCount = 0;
+  def(value, '__ob__', this);
+  if (Array.isArray(value)) {
+    var augment = hasProto
+      ? protoAugment
+      : copyAugment;
+    augment(value, arrayMethods, arrayKeys);
+    this.observeArray(value);
+  } else {
+    this.walk(value);
+  }
+};
+
+/**
+ * Walk through each property and convert them into
+ * getter/setters. This method should only be called when
+ * value type is Object.
+ */
+Observer.prototype.walk = function walk (obj) {
+  var keys = Object.keys(obj);
+  for (var i = 0; i < keys.length; i++) {
+    defineReactive(obj, keys[i]);
+  }
+};
+
+/**
+ * Observe a list of Array items.
+ */
+Observer.prototype.observeArray = function observeArray (items) {
+  for (var i = 0, l = items.length; i < l; i++) {
+    observe(items[i]);
+  }
+};
+
+// helpers
+
+/**
+ * Augment an target Object or Array by intercepting
+ * the prototype chain using __proto__
+ */
+function protoAugment (target, src, keys) {
+  /* eslint-disable no-proto */
+  target.__proto__ = src;
+  /* eslint-enable no-proto */
+}
+
+/**
+ * Augment an target Object or Array by defining
+ * hidden properties.
+ */
+/* istanbul ignore next */
+function copyAugment (target, src, keys) {
+  for (var i = 0, l = keys.length; i < l; i++) {
+    var key = keys[i];
+    def(target, key, src[key]);
+  }
+}
+
+/**
+ * Attempt to create an observer instance for a value,
+ * returns the new observer if successfully observed,
+ * or the existing observer if the value already has one.
+ */
+function observe (value, asRootData) {
+  if (!isObject(value) || value instanceof VNode) {
+    return
+  }
+  var ob;
+  if (hasOwn(value, '__ob__') && value.__ob__ instanceof Observer) {
+    ob = value.__ob__;
+  } else if (
+    shouldObserve &&
+    !isServerRendering() &&
+    (Array.isArray(value) || isPlainObject(value)) &&
+    Object.isExtensible(value) &&
+    !value._isVue
+  ) {
+    ob = new Observer(value);
+  }
+  if (asRootData && ob) {
+    ob.vmCount++;
+  }
+  return ob
+}
+
+/**
+ * Define a reactive property on an Object.
+ */
+function defineReactive (
+  obj,
+  key,
+  val,
+  customSetter,
+  shallow
+) {
+  var dep = new Dep();
+
+  var property = Object.getOwnPropertyDescriptor(obj, key);
+  if (property && property.configurable === false) {
+    return
+  }
+
+  // cater for pre-defined getter/setters
+  var getter = property && property.get;
+  if (!getter && arguments.length === 2) {
+    val = obj[key];
+  }
+  var setter = property && property.set;
+
+  var childOb = !shallow && observe(val);
+  Object.defineProperty(obj, key, {
+    enumerable: true,
+    configurable: true,
+    get: function reactiveGetter () {
+      var value = getter ? getter.call(obj) : val;
+      if (Dep.target) {
+        dep.depend();
+        if (childOb) {
+          childOb.dep.depend();
+          if (Array.isArray(value)) {
+            dependArray(value);
+          }
+        }
+      }
+      return value
+    },
+    set: function reactiveSetter (newVal) {
+      var value = getter ? getter.call(obj) : val;
+      /* eslint-disable no-self-compare */
+      if (newVal === value || (newVal !== newVal && value !== value)) {
+        return
+      }
+      /* eslint-enable no-self-compare */
+      if ("development" !== 'production' && customSetter) {
+        customSetter();
+      }
+      if (setter) {
+        setter.call(obj, newVal);
+      } else {
+        val = newVal;
+      }
+      childOb = !shallow && observe(newVal);
+      dep.notify();
+    }
+  });
+}
+
+/**
+ * Set a property on an object. Adds the new property and
+ * triggers change notification if the property doesn't
+ * already exist.
+ */
+function set (target, key, val) {
+  if ("development" !== 'production' &&
+    (isUndef(target) || isPrimitive(target))
+  ) {
+    warn(("Cannot set reactive property on undefined, null, or primitive value: " + ((target))));
+  }
+  if (Array.isArray(target) && isValidArrayIndex(key)) {
+    target.length = Math.max(target.length, key);
+    target.splice(key, 1, val);
+    return val
+  }
+  if (key in target && !(key in Object.prototype)) {
+    target[key] = val;
+    return val
+  }
+  var ob = (target).__ob__;
+  if (target._isVue || (ob && ob.vmCount)) {
+    "development" !== 'production' && warn(
+      'Avoid adding reactive properties to a Vue instance or its root $data ' +
+      'at runtime - declare it upfront in the data option.'
+    );
+    return val
+  }
+  if (!ob) {
+    target[key] = val;
+    return val
+  }
+  defineReactive(ob.value, key, val);
+  ob.dep.notify();
+  return val
+}
+
+/**
+ * Delete a property and trigger change if necessary.
+ */
+function del (target, key) {
+  if ("development" !== 'production' &&
+    (isUndef(target) || isPrimitive(target))
+  ) {
+    warn(("Cannot delete reactive property on undefined, null, or primitive value: " + ((target))));
+  }
+  if (Array.isArray(target) && isValidArrayIndex(key)) {
+    target.splice(key, 1);
+    return
+  }
+  var ob = (target).__ob__;
+  if (target._isVue || (ob && ob.vmCount)) {
+    "development" !== 'production' && warn(
+      'Avoid deleting properties on a Vue instance or its root $data ' +
+      '- just set it to null.'
+    );
+    return
+  }
+  if (!hasOwn(target, key)) {
+    return
+  }
+  delete target[key];
+  if (!ob) {
+    return
+  }
+  ob.dep.notify();
+}
+
+/**
+ * Collect dependencies on array elements when the array is touched, since
+ * we cannot intercept array element access like property getters.
+ */
+function dependArray (value) {
+  for (var e = (void 0), i = 0, l = value.length; i < l; i++) {
+    e = value[i];
+    e && e.__ob__ && e.__ob__.dep.depend();
+    if (Array.isArray(e)) {
+      dependArray(e);
+    }
+  }
+}
+
+/*  */
+
+/**
+ * Option overwriting strategies are functions that handle
+ * how to merge a parent option value and a child option
+ * value into the final value.
+ */
+var strats = config.optionMergeStrategies;
+
+/**
+ * Options with restrictions
+ */
+{
+  strats.el = strats.propsData = function (parent, child, vm, key) {
+    if (!vm) {
+      warn(
+        "option \"" + key + "\" can only be used during instance " +
+        'creation with the `new` keyword.'
+      );
+    }
+    return defaultStrat(parent, child)
+  };
+}
+
+/**
+ * Helper that recursively merges two data objects together.
+ */
+function mergeData (to, from) {
+  if (!from) { return to }
+  var key, toVal, fromVal;
+  var keys = Object.keys(from);
+  for (var i = 0; i < keys.length; i++) {
+    key = keys[i];
+    toVal = to[key];
+    fromVal = from[key];
+    if (!hasOwn(to, key)) {
+      set(to, key, fromVal);
+    } else if (isPlainObject(toVal) && isPlainObject(fromVal)) {
+      mergeData(toVal, fromVal);
+    }
+  }
+  return to
+}
+
+/**
+ * Data
+ */
+function mergeDataOrFn (
+  parentVal,
+  childVal,
+  vm
+) {
+  if (!vm) {
+    // in a Vue.extend merge, both should be functions
+    if (!childVal) {
+      return parentVal
+    }
+    if (!parentVal) {
+      return childVal
+    }
+    // when parentVal & childVal are both present,
+    // we need to return a function that returns the
+    // merged result of both functions... no need to
+    // check if parentVal is a function here because
+    // it has to be a function to pass previous merges.
+    return function mergedDataFn () {
+      return mergeData(
+        typeof childVal === 'function' ? childVal.call(this, this) : childVal,
+        typeof parentVal === 'function' ? parentVal.call(this, this) : parentVal
+      )
+    }
+  } else {
+    return function mergedInstanceDataFn () {
+      // instance merge
+      var instanceData = typeof childVal === 'function'
+        ? childVal.call(vm, vm)
+        : childVal;
+      var defaultData = typeof parentVal === 'function'
+        ? parentVal.call(vm, vm)
+        : parentVal;
+      if (instanceData) {
+        return mergeData(instanceData, defaultData)
+      } else {
+        return defaultData
+      }
+    }
+  }
+}
+
+strats.data = function (
+  parentVal,
+  childVal,
+  vm
+) {
+  if (!vm) {
+    if (childVal && typeof childVal !== 'function') {
+      "development" !== 'production' && warn(
+        'The "data" option should be a function ' +
+        'that returns a per-instance value in component ' +
+        'definitions.',
+        vm
+      );
+
+      return parentVal
+    }
+    return mergeDataOrFn(parentVal, childVal)
+  }
+
+  return mergeDataOrFn(parentVal, childVal, vm)
+};
+
+/**
+ * Hooks and props are merged as arrays.
+ */
+function mergeHook (
+  parentVal,
+  childVal
+) {
+  return childVal
+    ? parentVal
+      ? parentVal.concat(childVal)
+      : Array.isArray(childVal)
+        ? childVal
+        : [childVal]
+    : parentVal
+}
+
+LIFECYCLE_HOOKS.forEach(function (hook) {
+  strats[hook] = mergeHook;
+});
+
+/**
+ * Assets
+ *
+ * When a vm is present (instance creation), we need to do
+ * a three-way merge between constructor options, instance
+ * options and parent options.
+ */
+function mergeAssets (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  var res = Object.create(parentVal || null);
+  if (childVal) {
+    "development" !== 'production' && assertObjectType(key, childVal, vm);
+    return extend(res, childVal)
+  } else {
+    return res
+  }
+}
+
+ASSET_TYPES.forEach(function (type) {
+  strats[type + 's'] = mergeAssets;
+});
+
+/**
+ * Watchers.
+ *
+ * Watchers hashes should not overwrite one
+ * another, so we merge them as arrays.
+ */
+strats.watch = function (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  // work around Firefox's Object.prototype.watch...
+  if (parentVal === nativeWatch) { parentVal = undefined; }
+  if (childVal === nativeWatch) { childVal = undefined; }
+  /* istanbul ignore if */
+  if (!childVal) { return Object.create(parentVal || null) }
+  {
+    assertObjectType(key, childVal, vm);
+  }
+  if (!parentVal) { return childVal }
+  var ret = {};
+  extend(ret, parentVal);
+  for (var key$1 in childVal) {
+    var parent = ret[key$1];
+    var child = childVal[key$1];
+    if (parent && !Array.isArray(parent)) {
+      parent = [parent];
+    }
+    ret[key$1] = parent
+      ? parent.concat(child)
+      : Array.isArray(child) ? child : [child];
+  }
+  return ret
+};
+
+/**
+ * Other object hashes.
+ */
+strats.props =
+strats.methods =
+strats.inject =
+strats.computed = function (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  if (childVal && "development" !== 'production') {
+    assertObjectType(key, childVal, vm);
+  }
+  if (!parentVal) { return childVal }
+  var ret = Object.create(null);
+  extend(ret, parentVal);
+  if (childVal) { extend(ret, childVal); }
+  return ret
+};
+strats.provide = mergeDataOrFn;
+
+/**
+ * Default strategy.
+ */
+var defaultStrat = function (parentVal, childVal) {
+  return childVal === undefined
+    ? parentVal
+    : childVal
+};
+
+/**
+ * Validate component names
+ */
+function checkComponents (options) {
+  for (var key in options.components) {
+    validateComponentName(key);
+  }
+}
+
+function validateComponentName (name) {
+  if (!/^[a-zA-Z][\w-]*$/.test(name)) {
+    warn(
+      'Invalid component name: "' + name + '". Component names ' +
+      'can only contain alphanumeric characters and the hyphen, ' +
+      'and must start with a letter.'
+    );
+  }
+  if (isBuiltInTag(name) || config.isReservedTag(name)) {
+    warn(
+      'Do not use built-in or reserved HTML elements as component ' +
+      'id: ' + name
+    );
+  }
+}
+
+/**
+ * Ensure all props option syntax are normalized into the
+ * Object-based format.
+ */
+function normalizeProps (options, vm) {
+  var props = options.props;
+  if (!props) { return }
+  var res = {};
+  var i, val, name;
+  if (Array.isArray(props)) {
+    i = props.length;
+    while (i--) {
+      val = props[i];
+      if (typeof val === 'string') {
+        name = camelize(val);
+        res[name] = { type: null };
+      } else {
+        warn('props must be strings when using array syntax.');
+      }
+    }
+  } else if (isPlainObject(props)) {
+    for (var key in props) {
+      val = props[key];
+      name = camelize(key);
+      res[name] = isPlainObject(val)
+        ? val
+        : { type: val };
+    }
+  } else {
+    warn(
+      "Invalid value for option \"props\": expected an Array or an Object, " +
+      "but got " + (toRawType(props)) + ".",
+      vm
+    );
+  }
+  options.props = res;
+}
+
+/**
+ * Normalize all injections into Object-based format
+ */
+function normalizeInject (options, vm) {
+  var inject = options.inject;
+  if (!inject) { return }
+  var normalized = options.inject = {};
+  if (Array.isArray(inject)) {
+    for (var i = 0; i < inject.length; i++) {
+      normalized[inject[i]] = { from: inject[i] };
+    }
+  } else if (isPlainObject(inject)) {
+    for (var key in inject) {
+      var val = inject[key];
+      normalized[key] = isPlainObject(val)
+        ? extend({ from: key }, val)
+        : { from: val };
+    }
+  } else {
+    warn(
+      "Invalid value for option \"inject\": expected an Array or an Object, " +
+      "but got " + (toRawType(inject)) + ".",
+      vm
+    );
+  }
+}
+
+/**
+ * Normalize raw function directives into object format.
+ */
+function normalizeDirectives (options) {
+  var dirs = options.directives;
+  if (dirs) {
+    for (var key in dirs) {
+      var def = dirs[key];
+      if (typeof def === 'function') {
+        dirs[key] = { bind: def, update: def };
+      }
+    }
+  }
+}
+
+function assertObjectType (name, value, vm) {
+  if (!isPlainObject(value)) {
+    warn(
+      "Invalid value for option \"" + name + "\": expected an Object, " +
+      "but got " + (toRawType(value)) + ".",
+      vm
+    );
+  }
+}
+
+/**
+ * Merge two option objects into a new one.
+ * Core utility used in both instantiation and inheritance.
+ */
+function mergeOptions (
+  parent,
+  child,
+  vm
+) {
+  {
+    checkComponents(child);
+  }
+
+  if (typeof child === 'function') {
+    child = child.options;
+  }
+
+  normalizeProps(child, vm);
+  normalizeInject(child, vm);
+  normalizeDirectives(child);
+  var extendsFrom = child.extends;
+  if (extendsFrom) {
+    parent = mergeOptions(parent, extendsFrom, vm);
+  }
+  if (child.mixins) {
+    for (var i = 0, l = child.mixins.length; i < l; i++) {
+      parent = mergeOptions(parent, child.mixins[i], vm);
+    }
+  }
+  var options = {};
+  var key;
+  for (key in parent) {
+    mergeField(key);
+  }
+  for (key in child) {
+    if (!hasOwn(parent, key)) {
+      mergeField(key);
+    }
+  }
+  function mergeField (key) {
+    var strat = strats[key] || defaultStrat;
+    options[key] = strat(parent[key], child[key], vm, key);
+  }
+  return options
+}
+
+/**
+ * Resolve an asset.
+ * This function is used because child instances need access
+ * to assets defined in its ancestor chain.
+ */
+function resolveAsset (
+  options,
+  type,
+  id,
+  warnMissing
+) {
+  /* istanbul ignore if */
+  if (typeof id !== 'string') {
+    return
+  }
+  var assets = options[type];
+  // check local registration variations first
+  if (hasOwn(assets, id)) { return assets[id] }
+  var camelizedId = camelize(id);
+  if (hasOwn(assets, camelizedId)) { return assets[camelizedId] }
+  var PascalCaseId = capitalize(camelizedId);
+  if (hasOwn(assets, PascalCaseId)) { return assets[PascalCaseId] }
+  // fallback to prototype chain
+  var res = assets[id] || assets[camelizedId] || assets[PascalCaseId];
+  if ("development" !== 'production' && warnMissing && !res) {
+    warn(
+      'Failed to resolve ' + type.slice(0, -1) + ': ' + id,
+      options
+    );
+  }
+  return res
+}
+
+/*  */
+
+function validateProp (
+  key,
+  propOptions,
+  propsData,
+  vm
+) {
+  var prop = propOptions[key];
+  var absent = !hasOwn(propsData, key);
+  var value = propsData[key];
+  // boolean casting
+  var booleanIndex = getTypeIndex(Boolean, prop.type);
+  if (booleanIndex > -1) {
+    if (absent && !hasOwn(prop, 'default')) {
+      value = false;
+    } else if (value === '' || value === hyphenate(key)) {
+      // only cast empty string / same name to boolean if
+      // boolean has higher priority
+      var stringIndex = getTypeIndex(String, prop.type);
+      if (stringIndex < 0 || booleanIndex < stringIndex) {
+        value = true;
+      }
+    }
+  }
+  // check default value
+  if (value === undefined) {
+    value = getPropDefaultValue(vm, prop, key);
+    // since the default value is a fresh copy,
+    // make sure to observe it.
+    var prevShouldObserve = shouldObserve;
+    toggleObserving(true);
+    observe(value);
+    toggleObserving(prevShouldObserve);
+  }
+  {
+    assertProp(prop, key, value, vm, absent);
+  }
+  return value
+}
+
+/**
+ * Get the default value of a prop.
+ */
+function getPropDefaultValue (vm, prop, key) {
+  // no default, return undefined
+  if (!hasOwn(prop, 'default')) {
+    return undefined
+  }
+  var def = prop.default;
+  // warn against non-factory defaults for Object & Array
+  if ("development" !== 'production' && isObject(def)) {
+    warn(
+      'Invalid default value for prop "' + key + '": ' +
+      'Props with type Object/Array must use a factory function ' +
+      'to return the default value.',
+      vm
+    );
+  }
+  // the raw prop value was also undefined from previous render,
+  // return previous default value to avoid unnecessary watcher trigger
+  if (vm && vm.$options.propsData &&
+    vm.$options.propsData[key] === undefined &&
+    vm._props[key] !== undefined
+  ) {
+    return vm._props[key]
+  }
+  // call factory function for non-Function types
+  // a value is Function if its prototype is function even across different execution context
+  return typeof def === 'function' && getType(prop.type) !== 'Function'
+    ? def.call(vm)
+    : def
+}
+
+/**
+ * Assert whether a prop is valid.
+ */
+function assertProp (
+  prop,
+  name,
+  value,
+  vm,
+  absent
+) {
+  if (prop.required && absent) {
+    warn(
+      'Missing required prop: "' + name + '"',
+      vm
+    );
+    return
+  }
+  if (value == null && !prop.required) {
+    return
+  }
+  var type = prop.type;
+  var valid = !type || type === true;
+  var expectedTypes = [];
+  if (type) {
+    if (!Array.isArray(type)) {
+      type = [type];
+    }
+    for (var i = 0; i < type.length && !valid; i++) {
+      var assertedType = assertType(value, type[i]);
+      expectedTypes.push(assertedType.expectedType || '');
+      valid = assertedType.valid;
+    }
+  }
+  if (!valid) {
+    warn(
+      "Invalid prop: type check failed for prop \"" + name + "\"." +
+      " Expected " + (expectedTypes.map(capitalize).join(', ')) +
+      ", got " + (toRawType(value)) + ".",
+      vm
+    );
+    return
+  }
+  var validator = prop.validator;
+  if (validator) {
+    if (!validator(value)) {
+      warn(
+        'Invalid prop: custom validator check failed for prop "' + name + '".',
+        vm
+      );
+    }
+  }
+}
+
+var simpleCheckRE = /^(String|Number|Boolean|Function|Symbol)$/;
+
+function assertType (value, type) {
+  var valid;
+  var expectedType = getType(type);
+  if (simpleCheckRE.test(expectedType)) {
+    var t = typeof value;
+    valid = t === expectedType.toLowerCase();
+    // for primitive wrapper objects
+    if (!valid && t === 'object') {
+      valid = value instanceof type;
+    }
+  } else if (expectedType === 'Object') {
+    valid = isPlainObject(value);
+  } else if (expectedType === 'Array') {
+    valid = Array.isArray(value);
+  } else {
+    valid = value instanceof type;
+  }
+  return {
+    valid: valid,
+    expectedType: expectedType
+  }
+}
+
+/**
+ * Use function string name to check built-in types,
+ * because a simple equality check will fail when running
+ * across different vms / iframes.
+ */
+function getType (fn) {
+  var match = fn && fn.toString().match(/^\s*function (\w+)/);
+  return match ? match[1] : ''
+}
+
+function isSameType (a, b) {
+  return getType(a) === getType(b)
+}
+
+function getTypeIndex (type, expectedTypes) {
+  if (!Array.isArray(expectedTypes)) {
+    return isSameType(expectedTypes, type) ? 0 : -1
+  }
+  for (var i = 0, len = expectedTypes.length; i < len; i++) {
+    if (isSameType(expectedTypes[i], type)) {
+      return i
+    }
+  }
+  return -1
+}
+
+/*  */
+
+function handleError (err, vm, info) {
+  if (vm) {
+    var cur = vm;
+    while ((cur = cur.$parent)) {
+      var hooks = cur.$options.errorCaptured;
+      if (hooks) {
+        for (var i = 0; i < hooks.length; i++) {
+          try {
+            var capture = hooks[i].call(cur, err, vm, info) === false;
+            if (capture) { return }
+          } catch (e) {
+            globalHandleError(e, cur, 'errorCaptured hook');
+          }
+        }
+      }
+    }
+  }
+  globalHandleError(err, vm, info);
+}
+
+function globalHandleError (err, vm, info) {
+  if (config.errorHandler) {
+    try {
+      return config.errorHandler.call(null, err, vm, info)
+    } catch (e) {
+      logError(e, null, 'config.errorHandler');
+    }
+  }
+  logError(err, vm, info);
+}
+
+function logError (err, vm, info) {
+  {
+    warn(("Error in " + info + ": \"" + (err.toString()) + "\""), vm);
+  }
+  /* istanbul ignore else */
+  if ((inBrowser || inWeex) && typeof console !== 'undefined') {
+    console.error(err);
+  } else {
+    throw err
+  }
+}
+
+/*  */
+/* globals MessageChannel */
+
+var callbacks = [];
+var pending = false;
+
+function flushCallbacks () {
+  pending = false;
+  var copies = callbacks.slice(0);
+  callbacks.length = 0;
+  for (var i = 0; i < copies.length; i++) {
+    copies[i]();
+  }
+}
+
+// Here we have async deferring wrappers using both microtasks and (macro) tasks.
+// In < 2.4 we used microtasks everywhere, but there are some scenarios where
+// microtasks have too high a priority and fire in between supposedly
+// sequential events (e.g. #4521, #6690) or even between bubbling of the same
+// event (#6566). However, using (macro) tasks everywhere also has subtle problems
+// when state is changed right before repaint (e.g. #6813, out-in transitions).
+// Here we use microtask by default, but expose a way to force (macro) task when
+// needed (e.g. in event handlers attached by v-on).
+var microTimerFunc;
+var macroTimerFunc;
+var useMacroTask = false;
+
+// Determine (macro) task defer implementation.
+// Technically setImmediate should be the ideal choice, but it's only available
+// in IE. The only polyfill that consistently queues the callback after all DOM
+// events triggered in the same loop is by using MessageChannel.
+/* istanbul ignore if */
+if (typeof setImmediate !== 'undefined' && isNative(setImmediate)) {
+  macroTimerFunc = function () {
+    setImmediate(flushCallbacks);
+  };
+} else if (typeof MessageChannel !== 'undefined' && (
+  isNative(MessageChannel) ||
+  // PhantomJS
+  MessageChannel.toString() === '[object MessageChannelConstructor]'
+)) {
+  var channel = new MessageChannel();
+  var port = channel.port2;
+  channel.port1.onmessage = flushCallbacks;
+  macroTimerFunc = function () {
+    port.postMessage(1);
+  };
+} else {
+  /* istanbul ignore next */
+  macroTimerFunc = function () {
+    setTimeout(flushCallbacks, 0);
+  };
+}
+
+// Determine microtask defer implementation.
+/* istanbul ignore next, $flow-disable-line */
+if (typeof Promise !== 'undefined' && isNative(Promise)) {
+  var p = Promise.resolve();
+  microTimerFunc = function () {
+    p.then(flushCallbacks);
+    // in problematic UIWebViews, Promise.then doesn't completely break, but
+    // it can get stuck in a weird state where callbacks are pushed into the
+    // microtask queue but the queue isn't being flushed, until the browser
+    // needs to do some other work, e.g. handle a timer. Therefore we can
+    // "force" the microtask queue to be flushed by adding an empty timer.
+    if (isIOS) { setTimeout(noop); }
+  };
+} else {
+  // fallback to macro
+  microTimerFunc = macroTimerFunc;
+}
+
+/**
+ * Wrap a function so that if any code inside triggers state change,
+ * the changes are queued using a (macro) task instead of a microtask.
+ */
+function withMacroTask (fn) {
+  return fn._withTask || (fn._withTask = function () {
+    useMacroTask = true;
+    var res = fn.apply(null, arguments);
+    useMacroTask = false;
+    return res
+  })
+}
+
+function nextTick (cb, ctx) {
+  var _resolve;
+  callbacks.push(function () {
+    if (cb) {
+      try {
+        cb.call(ctx);
+      } catch (e) {
+        handleError(e, ctx, 'nextTick');
+      }
+    } else if (_resolve) {
+      _resolve(ctx);
+    }
+  });
+  if (!pending) {
+    pending = true;
+    if (useMacroTask) {
+      macroTimerFunc();
+    } else {
+      microTimerFunc();
+    }
+  }
+  // $flow-disable-line
+  if (!cb && typeof Promise !== 'undefined') {
+    return new Promise(function (resolve) {
+      _resolve = resolve;
+    })
+  }
+}
+
+/*  */
+
+var mark;
+var measure;
+
+{
+  var perf = inBrowser && window.performance;
+  /* istanbul ignore if */
+  if (
+    perf &&
+    perf.mark &&
+    perf.measure &&
+    perf.clearMarks &&
+    perf.clearMeasures
+  ) {
+    mark = function (tag) { return perf.mark(tag); };
+    measure = function (name, startTag, endTag) {
+      perf.measure(name, startTag, endTag);
+      perf.clearMarks(startTag);
+      perf.clearMarks(endTag);
+      perf.clearMeasures(name);
+    };
+  }
+}
+
+/* not type checking this file because flow doesn't play well with Proxy */
+
+var initProxy;
+
+{
+  var allowedGlobals = makeMap(
+    'Infinity,undefined,NaN,isFinite,isNaN,' +
+    'parseFloat,parseInt,decodeURI,decodeURIComponent,encodeURI,encodeURIComponent,' +
+    'Math,Number,Date,Array,Object,Boolean,String,RegExp,Map,Set,JSON,Intl,' +
+    'require' // for Webpack/Browserify
+  );
+
+  var warnNonPresent = function (target, key) {
+    warn(
+      "Property or method \"" + key + "\" is not defined on the instance but " +
+      'referenced during render. Make sure that this property is reactive, ' +
+      'either in the data option, or for class-based components, by ' +
+      'initializing the property. ' +
+      'See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.',
+      target
+    );
+  };
+
+  var hasProxy =
+    typeof Proxy !== 'undefined' && isNative(Proxy);
+
+  if (hasProxy) {
+    var isBuiltInModifier = makeMap('stop,prevent,self,ctrl,shift,alt,meta,exact');
+    config.keyCodes = new Proxy(config.keyCodes, {
+      set: function set (target, key, value) {
+        if (isBuiltInModifier(key)) {
+          warn(("Avoid overwriting built-in modifier in config.keyCodes: ." + key));
+          return false
+        } else {
+          target[key] = value;
+          return true
+        }
+      }
+    });
+  }
+
+  var hasHandler = {
+    has: function has (target, key) {
+      var has = key in target;
+      var isAllowed = allowedGlobals(key) || key.charAt(0) === '_';
+      if (!has && !isAllowed) {
+        warnNonPresent(target, key);
+      }
+      return has || !isAllowed
+    }
+  };
+
+  var getHandler = {
+    get: function get (target, key) {
+      if (typeof key === 'string' && !(key in target)) {
+        warnNonPresent(target, key);
+      }
+      return target[key]
+    }
+  };
+
+  initProxy = function initProxy (vm) {
+    if (hasProxy) {
+      // determine which proxy handler to use
+      var options = vm.$options;
+      var handlers = options.render && options.render._withStripped
+        ? getHandler
+        : hasHandler;
+      vm._renderProxy = new Proxy(vm, handlers);
+    } else {
+      vm._renderProxy = vm;
+    }
+  };
+}
+
+/*  */
+
+var seenObjects = new _Set();
+
+/**
+ * Recursively traverse an object to evoke all converted
+ * getters, so that every nested property inside the object
+ * is collected as a "deep" dependency.
+ */
+function traverse (val) {
+  _traverse(val, seenObjects);
+  seenObjects.clear();
+}
+
+function _traverse (val, seen) {
+  var i, keys;
+  var isA = Array.isArray(val);
+  if ((!isA && !isObject(val)) || Object.isFrozen(val) || val instanceof VNode) {
+    return
+  }
+  if (val.__ob__) {
+    var depId = val.__ob__.dep.id;
+    if (seen.has(depId)) {
+      return
+    }
+    seen.add(depId);
+  }
+  if (isA) {
+    i = val.length;
+    while (i--) { _traverse(val[i], seen); }
+  } else {
+    keys = Object.keys(val);
+    i = keys.length;
+    while (i--) { _traverse(val[keys[i]], seen); }
+  }
+}
+
+/*  */
+
+var normalizeEvent = cached(function (name) {
+  var passive = name.charAt(0) === '&';
+  name = passive ? name.slice(1) : name;
+  var once$$1 = name.charAt(0) === '~'; // Prefixed last, checked first
+  name = once$$1 ? name.slice(1) : name;
+  var capture = name.charAt(0) === '!';
+  name = capture ? name.slice(1) : name;
+  return {
+    name: name,
+    once: once$$1,
+    capture: capture,
+    passive: passive
+  }
+});
+
+function createFnInvoker (fns) {
+  function invoker () {
+    var arguments$1 = arguments;
+
+    var fns = invoker.fns;
+    if (Array.isArray(fns)) {
+      var cloned = fns.slice();
+      for (var i = 0; i < cloned.length; i++) {
+        cloned[i].apply(null, arguments$1);
+      }
+    } else {
+      // return handler return value for single handlers
+      return fns.apply(null, arguments)
+    }
+  }
+  invoker.fns = fns;
+  return invoker
+}
+
+function updateListeners (
+  on,
+  oldOn,
+  add,
+  remove$$1,
+  vm
+) {
+  var name, def, cur, old, event;
+  for (name in on) {
+    def = cur = on[name];
+    old = oldOn[name];
+    event = normalizeEvent(name);
+    /* istanbul ignore if */
+    if (isUndef(cur)) {
+      "development" !== 'production' && warn(
+        "Invalid handler for event \"" + (event.name) + "\": got " + String(cur),
+        vm
+      );
+    } else if (isUndef(old)) {
+      if (isUndef(cur.fns)) {
+        cur = on[name] = createFnInvoker(cur);
+      }
+      add(event.name, cur, event.once, event.capture, event.passive, event.params);
+    } else if (cur !== old) {
+      old.fns = cur;
+      on[name] = old;
+    }
+  }
+  for (name in oldOn) {
+    if (isUndef(on[name])) {
+      event = normalizeEvent(name);
+      remove$$1(event.name, oldOn[name], event.capture);
+    }
+  }
+}
+
+/*  */
+
+function mergeVNodeHook (def, hookKey, hook) {
+  if (def instanceof VNode) {
+    def = def.data.hook || (def.data.hook = {});
+  }
+  var invoker;
+  var oldHook = def[hookKey];
+
+  function wrappedHook () {
+    hook.apply(this, arguments);
+    // important: remove merged hook to ensure it's called only once
+    // and prevent memory leak
+    remove(invoker.fns, wrappedHook);
+  }
+
+  if (isUndef(oldHook)) {
+    // no existing hook
+    invoker = createFnInvoker([wrappedHook]);
+  } else {
+    /* istanbul ignore if */
+    if (isDef(oldHook.fns) && isTrue(oldHook.merged)) {
+      // already a merged invoker
+      invoker = oldHook;
+      invoker.fns.push(wrappedHook);
+    } else {
+      // existing plain hook
+      invoker = createFnInvoker([oldHook, wrappedHook]);
+    }
+  }
+
+  invoker.merged = true;
+  def[hookKey] = invoker;
+}
+
+/*  */
+
+function extractPropsFromVNodeData (
+  data,
+  Ctor,
+  tag
+) {
+  // we are only extracting raw values here.
+  // validation and default values are handled in the child
+  // component itself.
+  var propOptions = Ctor.options.props;
+  if (isUndef(propOptions)) {
+    return
+  }
+  var res = {};
+  var attrs = data.attrs;
+  var props = data.props;
+  if (isDef(attrs) || isDef(props)) {
+    for (var key in propOptions) {
+      var altKey = hyphenate(key);
+      {
+        var keyInLowerCase = key.toLowerCase();
+        if (
+          key !== keyInLowerCase &&
+          attrs && hasOwn(attrs, keyInLowerCase)
+        ) {
+          tip(
+            "Prop \"" + keyInLowerCase + "\" is passed to component " +
+            (formatComponentName(tag || Ctor)) + ", but the declared prop name is" +
+            " \"" + key + "\". " +
+            "Note that HTML attributes are case-insensitive and camelCased " +
+            "props need to use their kebab-case equivalents when using in-DOM " +
+            "templates. You should probably use \"" + altKey + "\" instead of \"" + key + "\"."
+          );
+        }
+      }
+      checkProp(res, props, key, altKey, true) ||
+      checkProp(res, attrs, key, altKey, false);
+    }
+  }
+  return res
+}
+
+function checkProp (
+  res,
+  hash,
+  key,
+  altKey,
+  preserve
+) {
+  if (isDef(hash)) {
+    if (hasOwn(hash, key)) {
+      res[key] = hash[key];
+      if (!preserve) {
+        delete hash[key];
+      }
+      return true
+    } else if (hasOwn(hash, altKey)) {
+      res[key] = hash[altKey];
+      if (!preserve) {
+        delete hash[altKey];
+      }
+      return true
+    }
+  }
+  return false
+}
+
+/*  */
+
+// The template compiler attempts to minimize the need for normalization by
+// statically analyzing the template at compile time.
+//
+// For plain HTML markup, normalization can be completely skipped because the
+// generated render function is guaranteed to return Array<VNode>. There are
+// two cases where extra normalization is needed:
+
+// 1. When the children contains components - because a functional component
+// may return an Array instead of a single root. In this case, just a simple
+// normalization is needed - if any child is an Array, we flatten the whole
+// thing with Array.prototype.concat. It is guaranteed to be only 1-level deep
+// because functional components already normalize their own children.
+function simpleNormalizeChildren (children) {
+  for (var i = 0; i < children.length; i++) {
+    if (Array.isArray(children[i])) {
+      return Array.prototype.concat.apply([], children)
+    }
+  }
+  return children
+}
+
+// 2. When the children contains constructs that always generated nested Arrays,
+// e.g. <template>, <slot>, v-for, or when the children is provided by user
+// with hand-written render functions / JSX. In such cases a full normalization
+// is needed to cater to all possible types of children values.
+function normalizeChildren (children) {
+  return isPrimitive(children)
+    ? [createTextVNode(children)]
+    : Array.isArray(children)
+      ? normalizeArrayChildren(children)
+      : undefined
+}
+
+function isTextNode (node) {
+  return isDef(node) && isDef(node.text) && isFalse(node.isComment)
+}
+
+function normalizeArrayChildren (children, nestedIndex) {
+  var res = [];
+  var i, c, lastIndex, last;
+  for (i = 0; i < children.length; i++) {
+    c = children[i];
+    if (isUndef(c) || typeof c === 'boolean') { continue }
+    lastIndex = res.length - 1;
+    last = res[lastIndex];
+    //  nested
+    if (Array.isArray(c)) {
+      if (c.length > 0) {
+        c = normalizeArrayChildren(c, ((nestedIndex || '') + "_" + i));
+        // merge adjacent text nodes
+        if (isTextNode(c[0]) && isTextNode(last)) {
+          res[lastIndex] = createTextVNode(last.text + (c[0]).text);
+          c.shift();
+        }
+        res.push.apply(res, c);
+      }
+    } else if (isPrimitive(c)) {
+      if (isTextNode(last)) {
+        // merge adjacent text nodes
+        // this is necessary for SSR hydration because text nodes are
+        // essentially merged when rendered to HTML strings
+        res[lastIndex] = createTextVNode(last.text + c);
+      } else if (c !== '') {
+        // convert primitive to vnode
+        res.push(createTextVNode(c));
+      }
+    } else {
+      if (isTextNode(c) && isTextNode(last)) {
+        // merge adjacent text nodes
+        res[lastIndex] = createTextVNode(last.text + c.text);
+      } else {
+        // default key for nested array children (likely generated by v-for)
+        if (isTrue(children._isVList) &&
+          isDef(c.tag) &&
+          isUndef(c.key) &&
+          isDef(nestedIndex)) {
+          c.key = "__vlist" + nestedIndex + "_" + i + "__";
+        }
+        res.push(c);
+      }
+    }
+  }
+  return res
+}
+
+/*  */
+
+function ensureCtor (comp, base) {
+  if (
+    comp.__esModule ||
+    (hasSymbol && comp[Symbol.toStringTag] === 'Module')
+  ) {
+    comp = comp.default;
+  }
+  return isObject(comp)
+    ? base.extend(comp)
+    : comp
+}
+
+function createAsyncPlaceholder (
+  factory,
+  data,
+  context,
+  children,
+  tag
+) {
+  var node = createEmptyVNode();
+  node.asyncFactory = factory;
+  node.asyncMeta = { data: data, context: context, children: children, tag: tag };
+  return node
+}
+
+function resolveAsyncComponent (
+  factory,
+  baseCtor,
+  context
+) {
+  if (isTrue(factory.error) && isDef(factory.errorComp)) {
+    return factory.errorComp
+  }
+
+  if (isDef(factory.resolved)) {
+    return factory.resolved
+  }
+
+  if (isTrue(factory.loading) && isDef(factory.loadingComp)) {
+    return factory.loadingComp
+  }
+
+  if (isDef(factory.contexts)) {
+    // already pending
+    factory.contexts.push(context);
+  } else {
+    var contexts = factory.contexts = [context];
+    var sync = true;
+
+    var forceRender = function () {
+      for (var i = 0, l = contexts.length; i < l; i++) {
+        contexts[i].$forceUpdate();
+      }
+    };
+
+    var resolve = once(function (res) {
+      // cache resolved
+      factory.resolved = ensureCtor(res, baseCtor);
+      // invoke callbacks only if this is not a synchronous resolve
+      // (async resolves are shimmed as synchronous during SSR)
+      if (!sync) {
+        forceRender();
+      }
+    });
+
+    var reject = once(function (reason) {
+      "development" !== 'production' && warn(
+        "Failed to resolve async component: " + (String(factory)) +
+        (reason ? ("\nReason: " + reason) : '')
+      );
+      if (isDef(factory.errorComp)) {
+        factory.error = true;
+        forceRender();
+      }
+    });
+
+    var res = factory(resolve, reject);
+
+    if (isObject(res)) {
+      if (typeof res.then === 'function') {
+        // () => Promise
+        if (isUndef(factory.resolved)) {
+          res.then(resolve, reject);
+        }
+      } else if (isDef(res.component) && typeof res.component.then === 'function') {
+        res.component.then(resolve, reject);
+
+        if (isDef(res.error)) {
+          factory.errorComp = ensureCtor(res.error, baseCtor);
+        }
+
+        if (isDef(res.loading)) {
+          factory.loadingComp = ensureCtor(res.loading, baseCtor);
+          if (res.delay === 0) {
+            factory.loading = true;
+          } else {
+            setTimeout(function () {
+              if (isUndef(factory.resolved) && isUndef(factory.error)) {
+                factory.loading = true;
+                forceRender();
+              }
+            }, res.delay || 200);
+          }
+        }
+
+        if (isDef(res.timeout)) {
+          setTimeout(function () {
+            if (isUndef(factory.resolved)) {
+              reject(
+                "timeout (" + (res.timeout) + "ms)"
+              );
+            }
+          }, res.timeout);
+        }
+      }
+    }
+
+    sync = false;
+    // return in case resolved synchronously
+    return factory.loading
+      ? factory.loadingComp
+      : factory.resolved
+  }
+}
+
+/*  */
+
+function isAsyncPlaceholder (node) {
+  return node.isComment && node.asyncFactory
+}
+
+/*  */
+
+function getFirstComponentChild (children) {
+  if (Array.isArray(children)) {
+    for (var i = 0; i < children.length; i++) {
+      var c = children[i];
+      if (isDef(c) && (isDef(c.componentOptions) || isAsyncPlaceholder(c))) {
+        return c
+      }
+    }
+  }
+}
+
+/*  */
+
+/*  */
+
+function initEvents (vm) {
+  vm._events = Object.create(null);
+  vm._hasHookEvent = false;
+  // init parent attached events
+  var listeners = vm.$options._parentListeners;
+  if (listeners) {
+    updateComponentListeners(vm, listeners);
+  }
+}
+
+var target;
+
+function add (event, fn, once) {
+  if (once) {
+    target.$once(event, fn);
+  } else {
+    target.$on(event, fn);
+  }
+}
+
+function remove$1 (event, fn) {
+  target.$off(event, fn);
+}
+
+function updateComponentListeners (
+  vm,
+  listeners,
+  oldListeners
+) {
+  target = vm;
+  updateListeners(listeners, oldListeners || {}, add, remove$1, vm);
+  target = undefined;
+}
+
+function eventsMixin (Vue) {
+  var hookRE = /^hook:/;
+  Vue.prototype.$on = function (event, fn) {
+    var this$1 = this;
+
+    var vm = this;
+    if (Array.isArray(event)) {
+      for (var i = 0, l = event.length; i < l; i++) {
+        this$1.$on(event[i], fn);
+      }
+    } else {
+      (vm._events[event] || (vm._events[event] = [])).push(fn);
+      // optimize hook:event cost by using a boolean flag marked at registration
+      // instead of a hash lookup
+      if (hookRE.test(event)) {
+        vm._hasHookEvent = true;
+      }
+    }
+    return vm
+  };
+
+  Vue.prototype.$once = function (event, fn) {
+    var vm = this;
+    function on () {
+      vm.$off(event, on);
+      fn.apply(vm, arguments);
+    }
+    on.fn = fn;
+    vm.$on(event, on);
+    return vm
+  };
+
+  Vue.prototype.$off = function (event, fn) {
+    var this$1 = this;
+
+    var vm = this;
+    // all
+    if (!arguments.length) {
+      vm._events = Object.create(null);
+      return vm
+    }
+    // array of events
+    if (Array.isArray(event)) {
+      for (var i = 0, l = event.length; i < l; i++) {
+        this$1.$off(event[i], fn);
+      }
+      return vm
+    }
+    // specific event
+    var cbs = vm._events[event];
+    if (!cbs) {
+      return vm
+    }
+    if (!fn) {
+      vm._events[event] = null;
+      return vm
+    }
+    if (fn) {
+      // specific handler
+      var cb;
+      var i$1 = cbs.length;
+      while (i$1--) {
+        cb = cbs[i$1];
+        if (cb === fn || cb.fn === fn) {
+          cbs.splice(i$1, 1);
+          break
+        }
+      }
+    }
+    return vm
+  };
+
+  Vue.prototype.$emit = function (event) {
+    var vm = this;
+    {
+      var lowerCaseEvent = event.toLowerCase();
+      if (lowerCaseEvent !== event && vm._events[lowerCaseEvent]) {
+        tip(
+          "Event \"" + lowerCaseEvent + "\" is emitted in component " +
+          (formatComponentName(vm)) + " but the handler is registered for \"" + event + "\". " +
+          "Note that HTML attributes are case-insensitive and you cannot use " +
+          "v-on to listen to camelCase events when using in-DOM templates. " +
+          "You should probably use \"" + (hyphenate(event)) + "\" instead of \"" + event + "\"."
+        );
+      }
+    }
+    var cbs = vm._events[event];
+    if (cbs) {
+      cbs = cbs.length > 1 ? toArray(cbs) : cbs;
+      var args = toArray(arguments, 1);
+      for (var i = 0, l = cbs.length; i < l; i++) {
+        try {
+          cbs[i].apply(vm, args);
+        } catch (e) {
+          handleError(e, vm, ("event handler for \"" + event + "\""));
+        }
+      }
+    }
+    return vm
+  };
+}
+
+/*  */
+
+
+
+/**
+ * Runtime helper for resolving raw children VNodes into a slot object.
+ */
+function resolveSlots (
+  children,
+  context
+) {
+  var slots = {};
+  if (!children) {
+    return slots
+  }
+  for (var i = 0, l = children.length; i < l; i++) {
+    var child = children[i];
+    var data = child.data;
+    // remove slot attribute if the node is resolved as a Vue slot node
+    if (data && data.attrs && data.attrs.slot) {
+      delete data.attrs.slot;
+    }
+    // named slots should only be respected if the vnode was rendered in the
+    // same context.
+    if ((child.context === context || child.fnContext === context) &&
+      data && data.slot != null
+    ) {
+      var name = data.slot;
+      var slot = (slots[name] || (slots[name] = []));
+      if (child.tag === 'template') {
+        slot.push.apply(slot, child.children || []);
+      } else {
+        slot.push(child);
+      }
+    } else {
+      (slots.default || (slots.default = [])).push(child);
+    }
+  }
+  // ignore slots that contains only whitespace
+  for (var name$1 in slots) {
+    if (slots[name$1].every(isWhitespace)) {
+      delete slots[name$1];
+    }
+  }
+  return slots
+}
+
+function isWhitespace (node) {
+  return (node.isComment && !node.asyncFactory) || node.text === ' '
+}
+
+function resolveScopedSlots (
+  fns, // see flow/vnode
+  res
+) {
+  res = res || {};
+  for (var i = 0; i < fns.length; i++) {
+    if (Array.isArray(fns[i])) {
+      resolveScopedSlots(fns[i], res);
+    } else {
+      res[fns[i].key] = fns[i].fn;
+    }
+  }
+  return res
+}
+
+/*  */
+
+var activeInstance = null;
+var isUpdatingChildComponent = false;
+
+function initLifecycle (vm) {
+  var options = vm.$options;
+
+  // locate first non-abstract parent
+  var parent = options.parent;
+  if (parent && !options.abstract) {
+    while (parent.$options.abstract && parent.$parent) {
+      parent = parent.$parent;
+    }
+    parent.$children.push(vm);
+  }
+
+  vm.$parent = parent;
+  vm.$root = parent ? parent.$root : vm;
+
+  vm.$children = [];
+  vm.$refs = {};
+
+  vm._watcher = null;
+  vm._inactive = null;
+  vm._directInactive = false;
+  vm._isMounted = false;
+  vm._isDestroyed = false;
+  vm._isBeingDestroyed = false;
+}
+
+function lifecycleMixin (Vue) {
+  Vue.prototype._update = function (vnode, hydrating) {
+    var vm = this;
+    if (vm._isMounted) {
+      callHook(vm, 'beforeUpdate');
+    }
+    var prevEl = vm.$el;
+    var prevVnode = vm._vnode;
+    var prevActiveInstance = activeInstance;
+    activeInstance = vm;
+    vm._vnode = vnode;
+    // Vue.prototype.__patch__ is injected in entry points
+    // based on the rendering backend used.
+    if (!prevVnode) {
+      // initial render
+      vm.$el = vm.__patch__(
+        vm.$el, vnode, hydrating, false /* removeOnly */,
+        vm.$options._parentElm,
+        vm.$options._refElm
+      );
+      // no need for the ref nodes after initial patch
+      // this prevents keeping a detached DOM tree in memory (#5851)
+      vm.$options._parentElm = vm.$options._refElm = null;
+    } else {
+      // updates
+      vm.$el = vm.__patch__(prevVnode, vnode);
+    }
+    activeInstance = prevActiveInstance;
+    // update __vue__ reference
+    if (prevEl) {
+      prevEl.__vue__ = null;
+    }
+    if (vm.$el) {
+      vm.$el.__vue__ = vm;
+    }
+    // if parent is an HOC, update its $el as well
+    if (vm.$vnode && vm.$parent && vm.$vnode === vm.$parent._vnode) {
+      vm.$parent.$el = vm.$el;
+    }
+    // updated hook is called by the scheduler to ensure that children are
+    // updated in a parent's updated hook.
+  };
+
+  Vue.prototype.$forceUpdate = function () {
+    var vm = this;
+    if (vm._watcher) {
+      vm._watcher.update();
+    }
+  };
+
+  Vue.prototype.$destroy = function () {
+    var vm = this;
+    if (vm._isBeingDestroyed) {
+      return
+    }
+    callHook(vm, 'beforeDestroy');
+    vm._isBeingDestroyed = true;
+    // remove self from parent
+    var parent = vm.$parent;
+    if (parent && !parent._isBeingDestroyed && !vm.$options.abstract) {
+      remove(parent.$children, vm);
+    }
+    // teardown watchers
+    if (vm._watcher) {
+      vm._watcher.teardown();
+    }
+    var i = vm._watchers.length;
+    while (i--) {
+      vm._watchers[i].teardown();
+    }
+    // remove reference from data ob
+    // frozen object may not have observer.
+    if (vm._data.__ob__) {
+      vm._data.__ob__.vmCount--;
+    }
+    // call the last hook...
+    vm._isDestroyed = true;
+    // invoke destroy hooks on current rendered tree
+    vm.__patch__(vm._vnode, null);
+    // fire destroyed hook
+    callHook(vm, 'destroyed');
+    // turn off all instance listeners.
+    vm.$off();
+    // remove __vue__ reference
+    if (vm.$el) {
+      vm.$el.__vue__ = null;
+    }
+    // release circular reference (#6759)
+    if (vm.$vnode) {
+      vm.$vnode.parent = null;
+    }
+  };
+}
+
+function mountComponent (
+  vm,
+  el,
+  hydrating
+) {
+  vm.$el = el;
+  if (!vm.$options.render) {
+    vm.$options.render = createEmptyVNode;
+    {
+      /* istanbul ignore if */
+      if ((vm.$options.template && vm.$options.template.charAt(0) !== '#') ||
+        vm.$options.el || el) {
+        warn(
+          'You are using the runtime-only build of Vue where the template ' +
+          'compiler is not available. Either pre-compile the templates into ' +
+          'render functions, or use the compiler-included build.',
+          vm
+        );
+      } else {
+        warn(
+          'Failed to mount component: template or render function not defined.',
+          vm
+        );
+      }
+    }
+  }
+  callHook(vm, 'beforeMount');
+
+  var updateComponent;
+  /* istanbul ignore if */
+  if ("development" !== 'production' && config.performance && mark) {
+    updateComponent = function () {
+      var name = vm._name;
+      var id = vm._uid;
+      var startTag = "vue-perf-start:" + id;
+      var endTag = "vue-perf-end:" + id;
+
+      mark(startTag);
+      var vnode = vm._render();
+      mark(endTag);
+      measure(("vue " + name + " render"), startTag, endTag);
+
+      mark(startTag);
+      vm._update(vnode, hydrating);
+      mark(endTag);
+      measure(("vue " + name + " patch"), startTag, endTag);
+    };
+  } else {
+    updateComponent = function () {
+      vm._update(vm._render(), hydrating);
+    };
+  }
+
+  // we set this to vm._watcher inside the watcher's constructor
+  // since the watcher's initial patch may call $forceUpdate (e.g. inside child
+  // component's mounted hook), which relies on vm._watcher being already defined
+  new Watcher(vm, updateComponent, noop, null, true /* isRenderWatcher */);
+  hydrating = false;
+
+  // manually mounted instance, call mounted on self
+  // mounted is called for render-created child components in its inserted hook
+  if (vm.$vnode == null) {
+    vm._isMounted = true;
+    callHook(vm, 'mounted');
+  }
+  return vm
+}
+
+function updateChildComponent (
+  vm,
+  propsData,
+  listeners,
+  parentVnode,
+  renderChildren
+) {
+  {
+    isUpdatingChildComponent = true;
+  }
+
+  // determine whether component has slot children
+  // we need to do this before overwriting $options._renderChildren
+  var hasChildren = !!(
+    renderChildren ||               // has new static slots
+    vm.$options._renderChildren ||  // has old static slots
+    parentVnode.data.scopedSlots || // has new scoped slots
+    vm.$scopedSlots !== emptyObject // has old scoped slots
+  );
+
+  vm.$options._parentVnode = parentVnode;
+  vm.$vnode = parentVnode; // update vm's placeholder node without re-render
+
+  if (vm._vnode) { // update child tree's parent
+    vm._vnode.parent = parentVnode;
+  }
+  vm.$options._renderChildren = renderChildren;
+
+  // update $attrs and $listeners hash
+  // these are also reactive so they may trigger child update if the child
+  // used them during render
+  vm.$attrs = parentVnode.data.attrs || emptyObject;
+  vm.$listeners = listeners || emptyObject;
+
+  // update props
+  if (propsData && vm.$options.props) {
+    toggleObserving(false);
+    var props = vm._props;
+    var propKeys = vm.$options._propKeys || [];
+    for (var i = 0; i < propKeys.length; i++) {
+      var key = propKeys[i];
+      var propOptions = vm.$options.props; // wtf flow?
+      props[key] = validateProp(key, propOptions, propsData, vm);
+    }
+    toggleObserving(true);
+    // keep a copy of raw propsData
+    vm.$options.propsData = propsData;
+  }
+
+  // update listeners
+  listeners = listeners || emptyObject;
+  var oldListeners = vm.$options._parentListeners;
+  vm.$options._parentListeners = listeners;
+  updateComponentListeners(vm, listeners, oldListeners);
+
+  // resolve slots + force update if has children
+  if (hasChildren) {
+    vm.$slots = resolveSlots(renderChildren, parentVnode.context);
+    vm.$forceUpdate();
+  }
+
+  {
+    isUpdatingChildComponent = false;
+  }
+}
+
+function isInInactiveTree (vm) {
+  while (vm && (vm = vm.$parent)) {
+    if (vm._inactive) { return true }
+  }
+  return false
+}
+
+function activateChildComponent (vm, direct) {
+  if (direct) {
+    vm._directInactive = false;
+    if (isInInactiveTree(vm)) {
+      return
+    }
+  } else if (vm._directInactive) {
+    return
+  }
+  if (vm._inactive || vm._inactive === null) {
+    vm._inactive = false;
+    for (var i = 0; i < vm.$children.length; i++) {
+      activateChildComponent(vm.$children[i]);
+    }
+    callHook(vm, 'activated');
+  }
+}
+
+function deactivateChildComponent (vm, direct) {
+  if (direct) {
+    vm._directInactive = true;
+    if (isInInactiveTree(vm)) {
+      return
+    }
+  }
+  if (!vm._inactive) {
+    vm._inactive = true;
+    for (var i = 0; i < vm.$children.length; i++) {
+      deactivateChildComponent(vm.$children[i]);
+    }
+    callHook(vm, 'deactivated');
+  }
+}
+
+function callHook (vm, hook) {
+  // #7573 disable dep collection when invoking lifecycle hooks
+  pushTarget();
+  var handlers = vm.$options[hook];
+  if (handlers) {
+    for (var i = 0, j = handlers.length; i < j; i++) {
+      try {
+        handlers[i].call(vm);
+      } catch (e) {
+        handleError(e, vm, (hook + " hook"));
+      }
+    }
+  }
+  if (vm._hasHookEvent) {
+    vm.$emit('hook:' + hook);
+  }
+  popTarget();
+}
+
+/*  */
+
+
+var MAX_UPDATE_COUNT = 100;
+
+var queue = [];
+var activatedChildren = [];
+var has = {};
+var circular = {};
+var waiting = false;
+var flushing = false;
+var index = 0;
+
+/**
+ * Reset the scheduler's state.
+ */
+function resetSchedulerState () {
+  index = queue.length = activatedChildren.length = 0;
+  has = {};
+  {
+    circular = {};
+  }
+  waiting = flushing = false;
+}
+
+/**
+ * Flush both queues and run the watchers.
+ */
+function flushSchedulerQueue () {
+  flushing = true;
+  var watcher, id;
+
+  // Sort queue before flush.
+  // This ensures that:
+  // 1. Components are updated from parent to child. (because parent is always
+  //    created before the child)
+  // 2. A component's user watchers are run before its render watcher (because
+  //    user watchers are created before the render watcher)
+  // 3. If a component is destroyed during a parent component's watcher run,
+  //    its watchers can be skipped.
+  queue.sort(function (a, b) { return a.id - b.id; });
+
+  // do not cache length because more watchers might be pushed
+  // as we run existing watchers
+  for (index = 0; index < queue.length; index++) {
+    watcher = queue[index];
+    id = watcher.id;
+    has[id] = null;
+    watcher.run();
+    // in dev build, check and stop circular updates.
+    if ("development" !== 'production' && has[id] != null) {
+      circular[id] = (circular[id] || 0) + 1;
+      if (circular[id] > MAX_UPDATE_COUNT) {
+        warn(
+          'You may have an infinite update loop ' + (
+            watcher.user
+              ? ("in watcher with expression \"" + (watcher.expression) + "\"")
+              : "in a component render function."
+          ),
+          watcher.vm
+        );
+        break
+      }
+    }
+  }
+
+  // keep copies of post queues before resetting state
+  var activatedQueue = activatedChildren.slice();
+  var updatedQueue = queue.slice();
+
+  resetSchedulerState();
+
+  // call component updated and activated hooks
+  callActivatedHooks(activatedQueue);
+  callUpdatedHooks(updatedQueue);
+
+  // devtool hook
+  /* istanbul ignore if */
+  if (devtools && config.devtools) {
+    devtools.emit('flush');
+  }
+}
+
+function callUpdatedHooks (queue) {
+  var i = queue.length;
+  while (i--) {
+    var watcher = queue[i];
+    var vm = watcher.vm;
+    if (vm._watcher === watcher && vm._isMounted) {
+      callHook(vm, 'updated');
+    }
+  }
+}
+
+/**
+ * Queue a kept-alive component that was activated during patch.
+ * The queue will be processed after the entire tree has been patched.
+ */
+function queueActivatedComponent (vm) {
+  // setting _inactive to false here so that a render function can
+  // rely on checking whether it's in an inactive tree (e.g. router-view)
+  vm._inactive = false;
+  activatedChildren.push(vm);
+}
+
+function callActivatedHooks (queue) {
+  for (var i = 0; i < queue.length; i++) {
+    queue[i]._inactive = true;
+    activateChildComponent(queue[i], true /* true */);
+  }
+}
+
+/**
+ * Push a watcher into the watcher queue.
+ * Jobs with duplicate IDs will be skipped unless it's
+ * pushed when the queue is being flushed.
+ */
+function queueWatcher (watcher) {
+  var id = watcher.id;
+  if (has[id] == null) {
+    has[id] = true;
+    if (!flushing) {
+      queue.push(watcher);
+    } else {
+      // if already flushing, splice the watcher based on its id
+      // if already past its id, it will be run next immediately.
+      var i = queue.length - 1;
+      while (i > index && queue[i].id > watcher.id) {
+        i--;
+      }
+      queue.splice(i + 1, 0, watcher);
+    }
+    // queue the flush
+    if (!waiting) {
+      waiting = true;
+      nextTick(flushSchedulerQueue);
+    }
+  }
+}
+
+/*  */
+
+var uid$1 = 0;
+
+/**
+ * A watcher parses an expression, collects dependencies,
+ * and fires callback when the expression value changes.
+ * This is used for both the $watch() api and directives.
+ */
+var Watcher = function Watcher (
+  vm,
+  expOrFn,
+  cb,
+  options,
+  isRenderWatcher
+) {
+  this.vm = vm;
+  if (isRenderWatcher) {
+    vm._watcher = this;
+  }
+  vm._watchers.push(this);
+  // options
+  if (options) {
+    this.deep = !!options.deep;
+    this.user = !!options.user;
+    this.lazy = !!options.lazy;
+    this.sync = !!options.sync;
+  } else {
+    this.deep = this.user = this.lazy = this.sync = false;
+  }
+  this.cb = cb;
+  this.id = ++uid$1; // uid for batching
+  this.active = true;
+  this.dirty = this.lazy; // for lazy watchers
+  this.deps = [];
+  this.newDeps = [];
+  this.depIds = new _Set();
+  this.newDepIds = new _Set();
+  this.expression = expOrFn.toString();
+  // parse expression for getter
+  if (typeof expOrFn === 'function') {
+    this.getter = expOrFn;
+  } else {
+    this.getter = parsePath(expOrFn);
+    if (!this.getter) {
+      this.getter = function () {};
+      "development" !== 'production' && warn(
+        "Failed watching path: \"" + expOrFn + "\" " +
+        'Watcher only accepts simple dot-delimited paths. ' +
+        'For full control, use a function instead.',
+        vm
+      );
+    }
+  }
+  this.value = this.lazy
+    ? undefined
+    : this.get();
+};
+
+/**
+ * Evaluate the getter, and re-collect dependencies.
+ */
+Watcher.prototype.get = function get () {
+  pushTarget(this);
+  var value;
+  var vm = this.vm;
+  try {
+    value = this.getter.call(vm, vm);
+  } catch (e) {
+    if (this.user) {
+      handleError(e, vm, ("getter for watcher \"" + (this.expression) + "\""));
+    } else {
+      throw e
+    }
+  } finally {
+    // "touch" every property so they are all tracked as
+    // dependencies for deep watching
+    if (this.deep) {
+      traverse(value);
+    }
+    popTarget();
+    this.cleanupDeps();
+  }
+  return value
+};
+
+/**
+ * Add a dependency to this directive.
+ */
+Watcher.prototype.addDep = function addDep (dep) {
+  var id = dep.id;
+  if (!this.newDepIds.has(id)) {
+    this.newDepIds.add(id);
+    this.newDeps.push(dep);
+    if (!this.depIds.has(id)) {
+      dep.addSub(this);
+    }
+  }
+};
+
+/**
+ * Clean up for dependency collection.
+ */
+Watcher.prototype.cleanupDeps = function cleanupDeps () {
+    var this$1 = this;
+
+  var i = this.deps.length;
+  while (i--) {
+    var dep = this$1.deps[i];
+    if (!this$1.newDepIds.has(dep.id)) {
+      dep.removeSub(this$1);
+    }
+  }
+  var tmp = this.depIds;
+  this.depIds = this.newDepIds;
+  this.newDepIds = tmp;
+  this.newDepIds.clear();
+  tmp = this.deps;
+  this.deps = this.newDeps;
+  this.newDeps = tmp;
+  this.newDeps.length = 0;
+};
+
+/**
+ * Subscriber interface.
+ * Will be called when a dependency changes.
+ */
+Watcher.prototype.update = function update () {
+  /* istanbul ignore else */
+  if (this.lazy) {
+    this.dirty = true;
+  } else if (this.sync) {
+    this.run();
+  } else {
+    queueWatcher(this);
+  }
+};
+
+/**
+ * Scheduler job interface.
+ * Will be called by the scheduler.
+ */
+Watcher.prototype.run = function run () {
+  if (this.active) {
+    var value = this.get();
+    if (
+      value !== this.value ||
+      // Deep watchers and watchers on Object/Arrays should fire even
+      // when the value is the same, because the value may
+      // have mutated.
+      isObject(value) ||
+      this.deep
+    ) {
+      // set new value
+      var oldValue = this.value;
+      this.value = value;
+      if (this.user) {
+        try {
+          this.cb.call(this.vm, value, oldValue);
+        } catch (e) {
+          handleError(e, this.vm, ("callback for watcher \"" + (this.expression) + "\""));
+        }
+      } else {
+        this.cb.call(this.vm, value, oldValue);
+      }
+    }
+  }
+};
+
+/**
+ * Evaluate the value of the watcher.
+ * This only gets called for lazy watchers.
+ */
+Watcher.prototype.evaluate = function evaluate () {
+  this.value = this.get();
+  this.dirty = false;
+};
+
+/**
+ * Depend on all deps collected by this watcher.
+ */
+Watcher.prototype.depend = function depend () {
+    var this$1 = this;
+
+  var i = this.deps.length;
+  while (i--) {
+    this$1.deps[i].depend();
+  }
+};
+
+/**
+ * Remove self from all dependencies' subscriber list.
+ */
+Watcher.prototype.teardown = function teardown () {
+    var this$1 = this;
+
+  if (this.active) {
+    // remove self from vm's watcher list
+    // this is a somewhat expensive operation so we skip it
+    // if the vm is being destroyed.
+    if (!this.vm._isBeingDestroyed) {
+      remove(this.vm._watchers, this);
+    }
+    var i = this.deps.length;
+    while (i--) {
+      this$1.deps[i].removeSub(this$1);
+    }
+    this.active = false;
+  }
+};
+
+/*  */
+
+var sharedPropertyDefinition = {
+  enumerable: true,
+  configurable: true,
+  get: noop,
+  set: noop
+};
+
+function proxy (target, sourceKey, key) {
+  sharedPropertyDefinition.get = function proxyGetter () {
+    return this[sourceKey][key]
+  };
+  sharedPropertyDefinition.set = function proxySetter (val) {
+    this[sourceKey][key] = val;
+  };
+  Object.defineProperty(target, key, sharedPropertyDefinition);
+}
+
+function initState (vm) {
+  vm._watchers = [];
+  var opts = vm.$options;
+  if (opts.props) { initProps(vm, opts.props); }
+  if (opts.methods) { initMethods(vm, opts.methods); }
+  if (opts.data) {
+    initData(vm);
+  } else {
+    observe(vm._data = {}, true /* asRootData */);
+  }
+  if (opts.computed) { initComputed(vm, opts.computed); }
+  if (opts.watch && opts.watch !== nativeWatch) {
+    initWatch(vm, opts.watch);
+  }
+}
+
+function initProps (vm, propsOptions) {
+  var propsData = vm.$options.propsData || {};
+  var props = vm._props = {};
+  // cache prop keys so that future props updates can iterate using Array
+  // instead of dynamic object key enumeration.
+  var keys = vm.$options._propKeys = [];
+  var isRoot = !vm.$parent;
+  // root instance props should be converted
+  if (!isRoot) {
+    toggleObserving(false);
+  }
+  var loop = function ( key ) {
+    keys.push(key);
+    var value = validateProp(key, propsOptions, propsData, vm);
+    /* istanbul ignore else */
+    {
+      var hyphenatedKey = hyphenate(key);
+      if (isReservedAttribute(hyphenatedKey) ||
+          config.isReservedAttr(hyphenatedKey)) {
+        warn(
+          ("\"" + hyphenatedKey + "\" is a reserved attribute and cannot be used as component prop."),
+          vm
+        );
+      }
+      defineReactive(props, key, value, function () {
+        if (vm.$parent && !isUpdatingChildComponent) {
+          warn(
+            "Avoid mutating a prop directly since the value will be " +
+            "overwritten whenever the parent component re-renders. " +
+            "Instead, use a data or computed property based on the prop's " +
+            "value. Prop being mutated: \"" + key + "\"",
+            vm
+          );
+        }
+      });
+    }
+    // static props are already proxied on the component's prototype
+    // during Vue.extend(). We only need to proxy props defined at
+    // instantiation here.
+    if (!(key in vm)) {
+      proxy(vm, "_props", key);
+    }
+  };
+
+  for (var key in propsOptions) loop( key );
+  toggleObserving(true);
+}
+
+function initData (vm) {
+  var data = vm.$options.data;
+  data = vm._data = typeof data === 'function'
+    ? getData(data, vm)
+    : data || {};
+  if (!isPlainObject(data)) {
+    data = {};
+    "development" !== 'production' && warn(
+      'data functions should return an object:\n' +
+      'https://vuejs.org/v2/guide/components.html#data-Must-Be-a-Function',
+      vm
+    );
+  }
+  // proxy data on instance
+  var keys = Object.keys(data);
+  var props = vm.$options.props;
+  var methods = vm.$options.methods;
+  var i = keys.length;
+  while (i--) {
+    var key = keys[i];
+    {
+      if (methods && hasOwn(methods, key)) {
+        warn(
+          ("Method \"" + key + "\" has already been defined as a data property."),
+          vm
+        );
+      }
+    }
+    if (props && hasOwn(props, key)) {
+      "development" !== 'production' && warn(
+        "The data property \"" + key + "\" is already declared as a prop. " +
+        "Use prop default value instead.",
+        vm
+      );
+    } else if (!isReserved(key)) {
+      proxy(vm, "_data", key);
+    }
+  }
+  // observe data
+  observe(data, true /* asRootData */);
+}
+
+function getData (data, vm) {
+  // #7573 disable dep collection when invoking data getters
+  pushTarget();
+  try {
+    return data.call(vm, vm)
+  } catch (e) {
+    handleError(e, vm, "data()");
+    return {}
+  } finally {
+    popTarget();
+  }
+}
+
+var computedWatcherOptions = { lazy: true };
+
+function initComputed (vm, computed) {
+  // $flow-disable-line
+  var watchers = vm._computedWatchers = Object.create(null);
+  // computed properties are just getters during SSR
+  var isSSR = isServerRendering();
+
+  for (var key in computed) {
+    var userDef = computed[key];
+    var getter = typeof userDef === 'function' ? userDef : userDef.get;
+    if ("development" !== 'production' && getter == null) {
+      warn(
+        ("Getter is missing for computed property \"" + key + "\"."),
+        vm
+      );
+    }
+
+    if (!isSSR) {
+      // create internal watcher for the computed property.
+      watchers[key] = new Watcher(
+        vm,
+        getter || noop,
+        noop,
+        computedWatcherOptions
+      );
+    }
+
+    // component-defined computed properties are already defined on the
+    // component prototype. We only need to define computed properties defined
+    // at instantiation here.
+    if (!(key in vm)) {
+      defineComputed(vm, key, userDef);
+    } else {
+      if (key in vm.$data) {
+        warn(("The computed property \"" + key + "\" is already defined in data."), vm);
+      } else if (vm.$options.props && key in vm.$options.props) {
+        warn(("The computed property \"" + key + "\" is already defined as a prop."), vm);
+      }
+    }
+  }
+}
+
+function defineComputed (
+  target,
+  key,
+  userDef
+) {
+  var shouldCache = !isServerRendering();
+  if (typeof userDef === 'function') {
+    sharedPropertyDefinition.get = shouldCache
+      ? createComputedGetter(key)
+      : userDef;
+    sharedPropertyDefinition.set = noop;
+  } else {
+    sharedPropertyDefinition.get = userDef.get
+      ? shouldCache && userDef.cache !== false
+        ? createComputedGetter(key)
+        : userDef.get
+      : noop;
+    sharedPropertyDefinition.set = userDef.set
+      ? userDef.set
+      : noop;
+  }
+  if ("development" !== 'production' &&
+      sharedPropertyDefinition.set === noop) {
+    sharedPropertyDefinition.set = function () {
+      warn(
+        ("Computed property \"" + key + "\" was assigned to but it has no setter."),
+        this
+      );
+    };
+  }
+  Object.defineProperty(target, key, sharedPropertyDefinition);
+}
+
+function createComputedGetter (key) {
+  return function computedGetter () {
+    var watcher = this._computedWatchers && this._computedWatchers[key];
+    if (watcher) {
+      if (watcher.dirty) {
+        watcher.evaluate();
+      }
+      if (Dep.target) {
+        watcher.depend();
+      }
+      return watcher.value
+    }
+  }
+}
+
+function initMethods (vm, methods) {
+  var props = vm.$options.props;
+  for (var key in methods) {
+    {
+      if (methods[key] == null) {
+        warn(
+          "Method \"" + key + "\" has an undefined value in the component definition. " +
+          "Did you reference the function correctly?",
+          vm
+        );
+      }
+      if (props && hasOwn(props, key)) {
+        warn(
+          ("Method \"" + key + "\" has already been defined as a prop."),
+          vm
+        );
+      }
+      if ((key in vm) && isReserved(key)) {
+        warn(
+          "Method \"" + key + "\" conflicts with an existing Vue instance method. " +
+          "Avoid defining component methods that start with _ or $."
+        );
+      }
+    }
+    vm[key] = methods[key] == null ? noop : bind(methods[key], vm);
+  }
+}
+
+function initWatch (vm, watch) {
+  for (var key in watch) {
+    var handler = watch[key];
+    if (Array.isArray(handler)) {
+      for (var i = 0; i < handler.length; i++) {
+        createWatcher(vm, key, handler[i]);
+      }
+    } else {
+      createWatcher(vm, key, handler);
+    }
+  }
+}
+
+function createWatcher (
+  vm,
+  expOrFn,
+  handler,
+  options
+) {
+  if (isPlainObject(handler)) {
+    options = handler;
+    handler = handler.handler;
+  }
+  if (typeof handler === 'string') {
+    handler = vm[handler];
+  }
+  return vm.$watch(expOrFn, handler, options)
+}
+
+function stateMixin (Vue) {
+  // flow somehow has problems with directly declared definition object
+  // when using Object.defineProperty, so we have to procedurally build up
+  // the object here.
+  var dataDef = {};
+  dataDef.get = function () { return this._data };
+  var propsDef = {};
+  propsDef.get = function () { return this._props };
+  {
+    dataDef.set = function (newData) {
+      warn(
+        'Avoid replacing instance root $data. ' +
+        'Use nested data properties instead.',
+        this
+      );
+    };
+    propsDef.set = function () {
+      warn("$props is readonly.", this);
+    };
+  }
+  Object.defineProperty(Vue.prototype, '$data', dataDef);
+  Object.defineProperty(Vue.prototype, '$props', propsDef);
+
+  Vue.prototype.$set = set;
+  Vue.prototype.$delete = del;
+
+  Vue.prototype.$watch = function (
+    expOrFn,
+    cb,
+    options
+  ) {
+    var vm = this;
+    if (isPlainObject(cb)) {
+      return createWatcher(vm, expOrFn, cb, options)
+    }
+    options = options || {};
+    options.user = true;
+    var watcher = new Watcher(vm, expOrFn, cb, options);
+    if (options.immediate) {
+      cb.call(vm, watcher.value);
+    }
+    return function unwatchFn () {
+      watcher.teardown();
+    }
+  };
+}
+
+/*  */
+
+function initProvide (vm) {
+  var provide = vm.$options.provide;
+  if (provide) {
+    vm._provided = typeof provide === 'function'
+      ? provide.call(vm)
+      : provide;
+  }
+}
+
+function initInjections (vm) {
+  var result = resolveInject(vm.$options.inject, vm);
+  if (result) {
+    toggleObserving(false);
+    Object.keys(result).forEach(function (key) {
+      /* istanbul ignore else */
+      {
+        defineReactive(vm, key, result[key], function () {
+          warn(
+            "Avoid mutating an injected value directly since the changes will be " +
+            "overwritten whenever the provided component re-renders. " +
+            "injection being mutated: \"" + key + "\"",
+            vm
+          );
+        });
+      }
+    });
+    toggleObserving(true);
+  }
+}
+
+function resolveInject (inject, vm) {
+  if (inject) {
+    // inject is :any because flow is not smart enough to figure out cached
+    var result = Object.create(null);
+    var keys = hasSymbol
+      ? Reflect.ownKeys(inject).filter(function (key) {
+        /* istanbul ignore next */
+        return Object.getOwnPropertyDescriptor(inject, key).enumerable
+      })
+      : Object.keys(inject);
+
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i];
+      var provideKey = inject[key].from;
+      var source = vm;
+      while (source) {
+        if (source._provided && hasOwn(source._provided, provideKey)) {
+          result[key] = source._provided[provideKey];
+          break
+        }
+        source = source.$parent;
+      }
+      if (!source) {
+        if ('default' in inject[key]) {
+          var provideDefault = inject[key].default;
+          result[key] = typeof provideDefault === 'function'
+            ? provideDefault.call(vm)
+            : provideDefault;
+        } else {
+          warn(("Injection \"" + key + "\" not found"), vm);
+        }
+      }
+    }
+    return result
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering v-for lists.
+ */
+function renderList (
+  val,
+  render
+) {
+  var ret, i, l, keys, key;
+  if (Array.isArray(val) || typeof val === 'string') {
+    ret = new Array(val.length);
+    for (i = 0, l = val.length; i < l; i++) {
+      ret[i] = render(val[i], i);
+    }
+  } else if (typeof val === 'number') {
+    ret = new Array(val);
+    for (i = 0; i < val; i++) {
+      ret[i] = render(i + 1, i);
+    }
+  } else if (isObject(val)) {
+    keys = Object.keys(val);
+    ret = new Array(keys.length);
+    for (i = 0, l = keys.length; i < l; i++) {
+      key = keys[i];
+      ret[i] = render(val[key], key, i);
+    }
+  }
+  if (isDef(ret)) {
+    (ret)._isVList = true;
+  }
+  return ret
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering <slot>
+ */
+function renderSlot (
+  name,
+  fallback,
+  props,
+  bindObject
+) {
+  var scopedSlotFn = this.$scopedSlots[name];
+  var nodes;
+  if (scopedSlotFn) { // scoped slot
+    props = props || {};
+    if (bindObject) {
+      if ("development" !== 'production' && !isObject(bindObject)) {
+        warn(
+          'slot v-bind without argument expects an Object',
+          this
+        );
+      }
+      props = extend(extend({}, bindObject), props);
+    }
+    nodes = scopedSlotFn(props) || fallback;
+  } else {
+    var slotNodes = this.$slots[name];
+    // warn duplicate slot usage
+    if (slotNodes) {
+      if ("development" !== 'production' && slotNodes._rendered) {
+        warn(
+          "Duplicate presence of slot \"" + name + "\" found in the same render tree " +
+          "- this will likely cause render errors.",
+          this
+        );
+      }
+      slotNodes._rendered = true;
+    }
+    nodes = slotNodes || fallback;
+  }
+
+  var target = props && props.slot;
+  if (target) {
+    return this.$createElement('template', { slot: target }, nodes)
+  } else {
+    return nodes
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for resolving filters
+ */
+function resolveFilter (id) {
+  return resolveAsset(this.$options, 'filters', id, true) || identity
+}
+
+/*  */
+
+function isKeyNotMatch (expect, actual) {
+  if (Array.isArray(expect)) {
+    return expect.indexOf(actual) === -1
+  } else {
+    return expect !== actual
+  }
+}
+
+/**
+ * Runtime helper for checking keyCodes from config.
+ * exposed as Vue.prototype._k
+ * passing in eventKeyName as last argument separately for backwards compat
+ */
+function checkKeyCodes (
+  eventKeyCode,
+  key,
+  builtInKeyCode,
+  eventKeyName,
+  builtInKeyName
+) {
+  var mappedKeyCode = config.keyCodes[key] || builtInKeyCode;
+  if (builtInKeyName && eventKeyName && !config.keyCodes[key]) {
+    return isKeyNotMatch(builtInKeyName, eventKeyName)
+  } else if (mappedKeyCode) {
+    return isKeyNotMatch(mappedKeyCode, eventKeyCode)
+  } else if (eventKeyName) {
+    return hyphenate(eventKeyName) !== key
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for merging v-bind="object" into a VNode's data.
+ */
+function bindObjectProps (
+  data,
+  tag,
+  value,
+  asProp,
+  isSync
+) {
+  if (value) {
+    if (!isObject(value)) {
+      "development" !== 'production' && warn(
+        'v-bind without argument expects an Object or Array value',
+        this
+      );
+    } else {
+      if (Array.isArray(value)) {
+        value = toObject(value);
+      }
+      var hash;
+      var loop = function ( key ) {
+        if (
+          key === 'class' ||
+          key === 'style' ||
+          isReservedAttribute(key)
+        ) {
+          hash = data;
+        } else {
+          var type = data.attrs && data.attrs.type;
+          hash = asProp || config.mustUseProp(tag, type, key)
+            ? data.domProps || (data.domProps = {})
+            : data.attrs || (data.attrs = {});
+        }
+        if (!(key in hash)) {
+          hash[key] = value[key];
+
+          if (isSync) {
+            var on = data.on || (data.on = {});
+            on[("update:" + key)] = function ($event) {
+              value[key] = $event;
+            };
+          }
+        }
+      };
+
+      for (var key in value) loop( key );
+    }
+  }
+  return data
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering static trees.
+ */
+function renderStatic (
+  index,
+  isInFor
+) {
+  var cached = this._staticTrees || (this._staticTrees = []);
+  var tree = cached[index];
+  // if has already-rendered static tree and not inside v-for,
+  // we can reuse the same tree.
+  if (tree && !isInFor) {
+    return tree
+  }
+  // otherwise, render a fresh tree.
+  tree = cached[index] = this.$options.staticRenderFns[index].call(
+    this._renderProxy,
+    null,
+    this // for render fns generated for functional component templates
+  );
+  markStatic(tree, ("__static__" + index), false);
+  return tree
+}
+
+/**
+ * Runtime helper for v-once.
+ * Effectively it means marking the node as static with a unique key.
+ */
+function markOnce (
+  tree,
+  index,
+  key
+) {
+  markStatic(tree, ("__once__" + index + (key ? ("_" + key) : "")), true);
+  return tree
+}
+
+function markStatic (
+  tree,
+  key,
+  isOnce
+) {
+  if (Array.isArray(tree)) {
+    for (var i = 0; i < tree.length; i++) {
+      if (tree[i] && typeof tree[i] !== 'string') {
+        markStaticNode(tree[i], (key + "_" + i), isOnce);
+      }
+    }
+  } else {
+    markStaticNode(tree, key, isOnce);
+  }
+}
+
+function markStaticNode (node, key, isOnce) {
+  node.isStatic = true;
+  node.key = key;
+  node.isOnce = isOnce;
+}
+
+/*  */
+
+function bindObjectListeners (data, value) {
+  if (value) {
+    if (!isPlainObject(value)) {
+      "development" !== 'production' && warn(
+        'v-on without argument expects an Object value',
+        this
+      );
+    } else {
+      var on = data.on = data.on ? extend({}, data.on) : {};
+      for (var key in value) {
+        var existing = on[key];
+        var ours = value[key];
+        on[key] = existing ? [].concat(existing, ours) : ours;
+      }
+    }
+  }
+  return data
+}
+
+/*  */
+
+function installRenderHelpers (target) {
+  target._o = markOnce;
+  target._n = toNumber;
+  target._s = toString;
+  target._l = renderList;
+  target._t = renderSlot;
+  target._q = looseEqual;
+  target._i = looseIndexOf;
+  target._m = renderStatic;
+  target._f = resolveFilter;
+  target._k = checkKeyCodes;
+  target._b = bindObjectProps;
+  target._v = createTextVNode;
+  target._e = createEmptyVNode;
+  target._u = resolveScopedSlots;
+  target._g = bindObjectListeners;
+}
+
+/*  */
+
+function FunctionalRenderContext (
+  data,
+  props,
+  children,
+  parent,
+  Ctor
+) {
+  var options = Ctor.options;
+  // ensure the createElement function in functional components
+  // gets a unique context - this is necessary for correct named slot check
+  var contextVm;
+  if (hasOwn(parent, '_uid')) {
+    contextVm = Object.create(parent);
+    // $flow-disable-line
+    contextVm._original = parent;
+  } else {
+    // the context vm passed in is a functional context as well.
+    // in this case we want to make sure we are able to get a hold to the
+    // real context instance.
+    contextVm = parent;
+    // $flow-disable-line
+    parent = parent._original;
+  }
+  var isCompiled = isTrue(options._compiled);
+  var needNormalization = !isCompiled;
+
+  this.data = data;
+  this.props = props;
+  this.children = children;
+  this.parent = parent;
+  this.listeners = data.on || emptyObject;
+  this.injections = resolveInject(options.inject, parent);
+  this.slots = function () { return resolveSlots(children, parent); };
+
+  // support for compiled functional template
+  if (isCompiled) {
+    // exposing $options for renderStatic()
+    this.$options = options;
+    // pre-resolve slots for renderSlot()
+    this.$slots = this.slots();
+    this.$scopedSlots = data.scopedSlots || emptyObject;
+  }
+
+  if (options._scopeId) {
+    this._c = function (a, b, c, d) {
+      var vnode = createElement(contextVm, a, b, c, d, needNormalization);
+      if (vnode && !Array.isArray(vnode)) {
+        vnode.fnScopeId = options._scopeId;
+        vnode.fnContext = parent;
+      }
+      return vnode
+    };
+  } else {
+    this._c = function (a, b, c, d) { return createElement(contextVm, a, b, c, d, needNormalization); };
+  }
+}
+
+installRenderHelpers(FunctionalRenderContext.prototype);
+
+function createFunctionalComponent (
+  Ctor,
+  propsData,
+  data,
+  contextVm,
+  children
+) {
+  var options = Ctor.options;
+  var props = {};
+  var propOptions = options.props;
+  if (isDef(propOptions)) {
+    for (var key in propOptions) {
+      props[key] = validateProp(key, propOptions, propsData || emptyObject);
+    }
+  } else {
+    if (isDef(data.attrs)) { mergeProps(props, data.attrs); }
+    if (isDef(data.props)) { mergeProps(props, data.props); }
+  }
+
+  var renderContext = new FunctionalRenderContext(
+    data,
+    props,
+    children,
+    contextVm,
+    Ctor
+  );
+
+  var vnode = options.render.call(null, renderContext._c, renderContext);
+
+  if (vnode instanceof VNode) {
+    return cloneAndMarkFunctionalResult(vnode, data, renderContext.parent, options)
+  } else if (Array.isArray(vnode)) {
+    var vnodes = normalizeChildren(vnode) || [];
+    var res = new Array(vnodes.length);
+    for (var i = 0; i < vnodes.length; i++) {
+      res[i] = cloneAndMarkFunctionalResult(vnodes[i], data, renderContext.parent, options);
+    }
+    return res
+  }
+}
+
+function cloneAndMarkFunctionalResult (vnode, data, contextVm, options) {
+  // #7817 clone node before setting fnContext, otherwise if the node is reused
+  // (e.g. it was from a cached normal slot) the fnContext causes named slots
+  // that should not be matched to match.
+  var clone = cloneVNode(vnode);
+  clone.fnContext = contextVm;
+  clone.fnOptions = options;
+  if (data.slot) {
+    (clone.data || (clone.data = {})).slot = data.slot;
+  }
+  return clone
+}
+
+function mergeProps (to, from) {
+  for (var key in from) {
+    to[camelize(key)] = from[key];
+  }
+}
+
+/*  */
+
+
+
+
+// Register the component hook to weex native render engine.
+// The hook will be triggered by native, not javascript.
+
+
+// Updates the state of the component to weex native render engine.
+
+/*  */
+
+// https://github.com/Hanks10100/weex-native-directive/tree/master/component
+
+// listening on native callback
+
+/*  */
+
+/*  */
+
+// inline hooks to be invoked on component VNodes during patch
+var componentVNodeHooks = {
+  init: function init (
+    vnode,
+    hydrating,
+    parentElm,
+    refElm
+  ) {
+    if (
+      vnode.componentInstance &&
+      !vnode.componentInstance._isDestroyed &&
+      vnode.data.keepAlive
+    ) {
+      // kept-alive components, treat as a patch
+      var mountedNode = vnode; // work around flow
+      componentVNodeHooks.prepatch(mountedNode, mountedNode);
+    } else {
+      var child = vnode.componentInstance = createComponentInstanceForVnode(
+        vnode,
+        activeInstance,
+        parentElm,
+        refElm
+      );
+      child.$mount(hydrating ? vnode.elm : undefined, hydrating);
+    }
+  },
+
+  prepatch: function prepatch (oldVnode, vnode) {
+    var options = vnode.componentOptions;
+    var child = vnode.componentInstance = oldVnode.componentInstance;
+    updateChildComponent(
+      child,
+      options.propsData, // updated props
+      options.listeners, // updated listeners
+      vnode, // new parent vnode
+      options.children // new children
+    );
+  },
+
+  insert: function insert (vnode) {
+    var context = vnode.context;
+    var componentInstance = vnode.componentInstance;
+    if (!componentInstance._isMounted) {
+      componentInstance._isMounted = true;
+      callHook(componentInstance, 'mounted');
+    }
+    if (vnode.data.keepAlive) {
+      if (context._isMounted) {
+        // vue-router#1212
+        // During updates, a kept-alive component's child components may
+        // change, so directly walking the tree here may call activated hooks
+        // on incorrect children. Instead we push them into a queue which will
+        // be processed after the whole patch process ended.
+        queueActivatedComponent(componentInstance);
+      } else {
+        activateChildComponent(componentInstance, true /* direct */);
+      }
+    }
+  },
+
+  destroy: function destroy (vnode) {
+    var componentInstance = vnode.componentInstance;
+    if (!componentInstance._isDestroyed) {
+      if (!vnode.data.keepAlive) {
+        componentInstance.$destroy();
+      } else {
+        deactivateChildComponent(componentInstance, true /* direct */);
+      }
+    }
+  }
+};
+
+var hooksToMerge = Object.keys(componentVNodeHooks);
+
+function createComponent (
+  Ctor,
+  data,
+  context,
+  children,
+  tag
+) {
+  if (isUndef(Ctor)) {
+    return
+  }
+
+  var baseCtor = context.$options._base;
+
+  // plain options object: turn it into a constructor
+  if (isObject(Ctor)) {
+    Ctor = baseCtor.extend(Ctor);
+  }
+
+  // if at this stage it's not a constructor or an async component factory,
+  // reject.
+  if (typeof Ctor !== 'function') {
+    {
+      warn(("Invalid Component definition: " + (String(Ctor))), context);
+    }
+    return
+  }
+
+  // async component
+  var asyncFactory;
+  if (isUndef(Ctor.cid)) {
+    asyncFactory = Ctor;
+    Ctor = resolveAsyncComponent(asyncFactory, baseCtor, context);
+    if (Ctor === undefined) {
+      // return a placeholder node for async component, which is rendered
+      // as a comment node but preserves all the raw information for the node.
+      // the information will be used for async server-rendering and hydration.
+      return createAsyncPlaceholder(
+        asyncFactory,
+        data,
+        context,
+        children,
+        tag
+      )
+    }
+  }
+
+  data = data || {};
+
+  // resolve constructor options in case global mixins are applied after
+  // component constructor creation
+  resolveConstructorOptions(Ctor);
+
+  // transform component v-model data into props & events
+  if (isDef(data.model)) {
+    transformModel(Ctor.options, data);
+  }
+
+  // extract props
+  var propsData = extractPropsFromVNodeData(data, Ctor, tag);
+
+  // functional component
+  if (isTrue(Ctor.options.functional)) {
+    return createFunctionalComponent(Ctor, propsData, data, context, children)
+  }
+
+  // extract listeners, since these needs to be treated as
+  // child component listeners instead of DOM listeners
+  var listeners = data.on;
+  // replace with listeners with .native modifier
+  // so it gets processed during parent component patch.
+  data.on = data.nativeOn;
+
+  if (isTrue(Ctor.options.abstract)) {
+    // abstract components do not keep anything
+    // other than props & listeners & slot
+
+    // work around flow
+    var slot = data.slot;
+    data = {};
+    if (slot) {
+      data.slot = slot;
+    }
+  }
+
+  // install component management hooks onto the placeholder node
+  installComponentHooks(data);
+
+  // return a placeholder vnode
+  var name = Ctor.options.name || tag;
+  var vnode = new VNode(
+    ("vue-component-" + (Ctor.cid) + (name ? ("-" + name) : '')),
+    data, undefined, undefined, undefined, context,
+    { Ctor: Ctor, propsData: propsData, listeners: listeners, tag: tag, children: children },
+    asyncFactory
+  );
+
+  // Weex specific: invoke recycle-list optimized @render function for
+  // extracting cell-slot template.
+  // https://github.com/Hanks10100/weex-native-directive/tree/master/component
+  /* istanbul ignore if */
+  return vnode
+}
+
+function createComponentInstanceForVnode (
+  vnode, // we know it's MountedComponentVNode but flow doesn't
+  parent, // activeInstance in lifecycle state
+  parentElm,
+  refElm
+) {
+  var options = {
+    _isComponent: true,
+    parent: parent,
+    _parentVnode: vnode,
+    _parentElm: parentElm || null,
+    _refElm: refElm || null
+  };
+  // check inline-template render functions
+  var inlineTemplate = vnode.data.inlineTemplate;
+  if (isDef(inlineTemplate)) {
+    options.render = inlineTemplate.render;
+    options.staticRenderFns = inlineTemplate.staticRenderFns;
+  }
+  return new vnode.componentOptions.Ctor(options)
+}
+
+function installComponentHooks (data) {
+  var hooks = data.hook || (data.hook = {});
+  for (var i = 0; i < hooksToMerge.length; i++) {
+    var key = hooksToMerge[i];
+    hooks[key] = componentVNodeHooks[key];
+  }
+}
+
+// transform component v-model info (value and callback) into
+// prop and event handler respectively.
+function transformModel (options, data) {
+  var prop = (options.model && options.model.prop) || 'value';
+  var event = (options.model && options.model.event) || 'input';(data.props || (data.props = {}))[prop] = data.model.value;
+  var on = data.on || (data.on = {});
+  if (isDef(on[event])) {
+    on[event] = [data.model.callback].concat(on[event]);
+  } else {
+    on[event] = data.model.callback;
+  }
+}
+
+/*  */
+
+var SIMPLE_NORMALIZE = 1;
+var ALWAYS_NORMALIZE = 2;
+
+// wrapper function for providing a more flexible interface
+// without getting yelled at by flow
+function createElement (
+  context,
+  tag,
+  data,
+  children,
+  normalizationType,
+  alwaysNormalize
+) {
+  if (Array.isArray(data) || isPrimitive(data)) {
+    normalizationType = children;
+    children = data;
+    data = undefined;
+  }
+  if (isTrue(alwaysNormalize)) {
+    normalizationType = ALWAYS_NORMALIZE;
+  }
+  return _createElement(context, tag, data, children, normalizationType)
+}
+
+function _createElement (
+  context,
+  tag,
+  data,
+  children,
+  normalizationType
+) {
+  if (isDef(data) && isDef((data).__ob__)) {
+    "development" !== 'production' && warn(
+      "Avoid using observed data object as vnode data: " + (JSON.stringify(data)) + "\n" +
+      'Always create fresh vnode data objects in each render!',
+      context
+    );
+    return createEmptyVNode()
+  }
+  // object syntax in v-bind
+  if (isDef(data) && isDef(data.is)) {
+    tag = data.is;
+  }
+  if (!tag) {
+    // in case of component :is set to falsy value
+    return createEmptyVNode()
+  }
+  // warn against non-primitive key
+  if ("development" !== 'production' &&
+    isDef(data) && isDef(data.key) && !isPrimitive(data.key)
+  ) {
+    {
+      warn(
+        'Avoid using non-primitive value as key, ' +
+        'use string/number value instead.',
+        context
+      );
+    }
+  }
+  // support single function children as default scoped slot
+  if (Array.isArray(children) &&
+    typeof children[0] === 'function'
+  ) {
+    data = data || {};
+    data.scopedSlots = { default: children[0] };
+    children.length = 0;
+  }
+  if (normalizationType === ALWAYS_NORMALIZE) {
+    children = normalizeChildren(children);
+  } else if (normalizationType === SIMPLE_NORMALIZE) {
+    children = simpleNormalizeChildren(children);
+  }
+  var vnode, ns;
+  if (typeof tag === 'string') {
+    var Ctor;
+    ns = (context.$vnode && context.$vnode.ns) || config.getTagNamespace(tag);
+    if (config.isReservedTag(tag)) {
+      // platform built-in elements
+      vnode = new VNode(
+        config.parsePlatformTagName(tag), data, children,
+        undefined, undefined, context
+      );
+    } else if (isDef(Ctor = resolveAsset(context.$options, 'components', tag))) {
+      // component
+      vnode = createComponent(Ctor, data, context, children, tag);
+    } else {
+      // unknown or unlisted namespaced elements
+      // check at runtime because it may get assigned a namespace when its
+      // parent normalizes children
+      vnode = new VNode(
+        tag, data, children,
+        undefined, undefined, context
+      );
+    }
+  } else {
+    // direct component options / constructor
+    vnode = createComponent(tag, data, context, children);
+  }
+  if (Array.isArray(vnode)) {
+    return vnode
+  } else if (isDef(vnode)) {
+    if (isDef(ns)) { applyNS(vnode, ns); }
+    if (isDef(data)) { registerDeepBindings(data); }
+    return vnode
+  } else {
+    return createEmptyVNode()
+  }
+}
+
+function applyNS (vnode, ns, force) {
+  vnode.ns = ns;
+  if (vnode.tag === 'foreignObject') {
+    // use default namespace inside foreignObject
+    ns = undefined;
+    force = true;
+  }
+  if (isDef(vnode.children)) {
+    for (var i = 0, l = vnode.children.length; i < l; i++) {
+      var child = vnode.children[i];
+      if (isDef(child.tag) && (
+        isUndef(child.ns) || (isTrue(force) && child.tag !== 'svg'))) {
+        applyNS(child, ns, force);
+      }
+    }
+  }
+}
+
+// ref #5318
+// necessary to ensure parent re-render when deep bindings like :style and
+// :class are used on slot nodes
+function registerDeepBindings (data) {
+  if (isObject(data.style)) {
+    traverse(data.style);
+  }
+  if (isObject(data.class)) {
+    traverse(data.class);
+  }
+}
+
+/*  */
+
+function initRender (vm) {
+  vm._vnode = null; // the root of the child tree
+  vm._staticTrees = null; // v-once cached trees
+  var options = vm.$options;
+  var parentVnode = vm.$vnode = options._parentVnode; // the placeholder node in parent tree
+  var renderContext = parentVnode && parentVnode.context;
+  vm.$slots = resolveSlots(options._renderChildren, renderContext);
+  vm.$scopedSlots = emptyObject;
+  // bind the createElement fn to this instance
+  // so that we get proper render context inside it.
+  // args order: tag, data, children, normalizationType, alwaysNormalize
+  // internal version is used by render functions compiled from templates
+  vm._c = function (a, b, c, d) { return createElement(vm, a, b, c, d, false); };
+  // normalization is always applied for the public version, used in
+  // user-written render functions.
+  vm.$createElement = function (a, b, c, d) { return createElement(vm, a, b, c, d, true); };
+
+  // $attrs & $listeners are exposed for easier HOC creation.
+  // they need to be reactive so that HOCs using them are always updated
+  var parentData = parentVnode && parentVnode.data;
+
+  /* istanbul ignore else */
+  {
+    defineReactive(vm, '$attrs', parentData && parentData.attrs || emptyObject, function () {
+      !isUpdatingChildComponent && warn("$attrs is readonly.", vm);
+    }, true);
+    defineReactive(vm, '$listeners', options._parentListeners || emptyObject, function () {
+      !isUpdatingChildComponent && warn("$listeners is readonly.", vm);
+    }, true);
+  }
+}
+
+function renderMixin (Vue) {
+  // install runtime convenience helpers
+  installRenderHelpers(Vue.prototype);
+
+  Vue.prototype.$nextTick = function (fn) {
+    return nextTick(fn, this)
+  };
+
+  Vue.prototype._render = function () {
+    var vm = this;
+    var ref = vm.$options;
+    var render = ref.render;
+    var _parentVnode = ref._parentVnode;
+
+    // reset _rendered flag on slots for duplicate slot check
+    {
+      for (var key in vm.$slots) {
+        // $flow-disable-line
+        vm.$slots[key]._rendered = false;
+      }
+    }
+
+    if (_parentVnode) {
+      vm.$scopedSlots = _parentVnode.data.scopedSlots || emptyObject;
+    }
+
+    // set parent vnode. this allows render functions to have access
+    // to the data on the placeholder node.
+    vm.$vnode = _parentVnode;
+    // render self
+    var vnode;
+    try {
+      vnode = render.call(vm._renderProxy, vm.$createElement);
+    } catch (e) {
+      handleError(e, vm, "render");
+      // return error render result,
+      // or previous vnode to prevent render error causing blank component
+      /* istanbul ignore else */
+      {
+        if (vm.$options.renderError) {
+          try {
+            vnode = vm.$options.renderError.call(vm._renderProxy, vm.$createElement, e);
+          } catch (e) {
+            handleError(e, vm, "renderError");
+            vnode = vm._vnode;
+          }
+        } else {
+          vnode = vm._vnode;
+        }
+      }
+    }
+    // return empty vnode in case the render function errored out
+    if (!(vnode instanceof VNode)) {
+      if ("development" !== 'production' && Array.isArray(vnode)) {
+        warn(
+          'Multiple root nodes returned from render function. Render function ' +
+          'should return a single root node.',
+          vm
+        );
+      }
+      vnode = createEmptyVNode();
+    }
+    // set parent
+    vnode.parent = _parentVnode;
+    return vnode
+  };
+}
+
+/*  */
+
+var uid$3 = 0;
+
+function initMixin (Vue) {
+  Vue.prototype._init = function (options) {
+    var vm = this;
+    // a uid
+    vm._uid = uid$3++;
+
+    var startTag, endTag;
+    /* istanbul ignore if */
+    if ("development" !== 'production' && config.performance && mark) {
+      startTag = "vue-perf-start:" + (vm._uid);
+      endTag = "vue-perf-end:" + (vm._uid);
+      mark(startTag);
+    }
+
+    // a flag to avoid this being observed
+    vm._isVue = true;
+    // merge options
+    if (options && options._isComponent) {
+      // optimize internal component instantiation
+      // since dynamic options merging is pretty slow, and none of the
+      // internal component options needs special treatment.
+      initInternalComponent(vm, options);
+    } else {
+      vm.$options = mergeOptions(
+        resolveConstructorOptions(vm.constructor),
+        options || {},
+        vm
+      );
+    }
+    /* istanbul ignore else */
+    {
+      initProxy(vm);
+    }
+    // expose real self
+    vm._self = vm;
+    initLifecycle(vm);
+    initEvents(vm);
+    initRender(vm);
+    callHook(vm, 'beforeCreate');
+    initInjections(vm); // resolve injections before data/props
+    initState(vm);
+    initProvide(vm); // resolve provide after data/props
+    callHook(vm, 'created');
+
+    /* istanbul ignore if */
+    if ("development" !== 'production' && config.performance && mark) {
+      vm._name = formatComponentName(vm, false);
+      mark(endTag);
+      measure(("vue " + (vm._name) + " init"), startTag, endTag);
+    }
+
+    if (vm.$options.el) {
+      vm.$mount(vm.$options.el);
+    }
+  };
+}
+
+function initInternalComponent (vm, options) {
+  var opts = vm.$options = Object.create(vm.constructor.options);
+  // doing this because it's faster than dynamic enumeration.
+  var parentVnode = options._parentVnode;
+  opts.parent = options.parent;
+  opts._parentVnode = parentVnode;
+  opts._parentElm = options._parentElm;
+  opts._refElm = options._refElm;
+
+  var vnodeComponentOptions = parentVnode.componentOptions;
+  opts.propsData = vnodeComponentOptions.propsData;
+  opts._parentListeners = vnodeComponentOptions.listeners;
+  opts._renderChildren = vnodeComponentOptions.children;
+  opts._componentTag = vnodeComponentOptions.tag;
+
+  if (options.render) {
+    opts.render = options.render;
+    opts.staticRenderFns = options.staticRenderFns;
+  }
+}
+
+function resolveConstructorOptions (Ctor) {
+  var options = Ctor.options;
+  if (Ctor.super) {
+    var superOptions = resolveConstructorOptions(Ctor.super);
+    var cachedSuperOptions = Ctor.superOptions;
+    if (superOptions !== cachedSuperOptions) {
+      // super option changed,
+      // need to resolve new options.
+      Ctor.superOptions = superOptions;
+      // check if there are any late-modified/attached options (#4976)
+      var modifiedOptions = resolveModifiedOptions(Ctor);
+      // update base extend options
+      if (modifiedOptions) {
+        extend(Ctor.extendOptions, modifiedOptions);
+      }
+      options = Ctor.options = mergeOptions(superOptions, Ctor.extendOptions);
+      if (options.name) {
+        options.components[options.name] = Ctor;
+      }
+    }
+  }
+  return options
+}
+
+function resolveModifiedOptions (Ctor) {
+  var modified;
+  var latest = Ctor.options;
+  var extended = Ctor.extendOptions;
+  var sealed = Ctor.sealedOptions;
+  for (var key in latest) {
+    if (latest[key] !== sealed[key]) {
+      if (!modified) { modified = {}; }
+      modified[key] = dedupe(latest[key], extended[key], sealed[key]);
+    }
+  }
+  return modified
+}
+
+function dedupe (latest, extended, sealed) {
+  // compare latest and sealed to ensure lifecycle hooks won't be duplicated
+  // between merges
+  if (Array.isArray(latest)) {
+    var res = [];
+    sealed = Array.isArray(sealed) ? sealed : [sealed];
+    extended = Array.isArray(extended) ? extended : [extended];
+    for (var i = 0; i < latest.length; i++) {
+      // push original options and not sealed options to exclude duplicated options
+      if (extended.indexOf(latest[i]) >= 0 || sealed.indexOf(latest[i]) < 0) {
+        res.push(latest[i]);
+      }
+    }
+    return res
+  } else {
+    return latest
+  }
+}
+
+function Vue (options) {
+  if ("development" !== 'production' &&
+    !(this instanceof Vue)
+  ) {
+    warn('Vue is a constructor and should be called with the `new` keyword');
+  }
+  this._init(options);
+}
+
+initMixin(Vue);
+stateMixin(Vue);
+eventsMixin(Vue);
+lifecycleMixin(Vue);
+renderMixin(Vue);
+
+/*  */
+
+function initUse (Vue) {
+  Vue.use = function (plugin) {
+    var installedPlugins = (this._installedPlugins || (this._installedPlugins = []));
+    if (installedPlugins.indexOf(plugin) > -1) {
+      return this
+    }
+
+    // additional parameters
+    var args = toArray(arguments, 1);
+    args.unshift(this);
+    if (typeof plugin.install === 'function') {
+      plugin.install.apply(plugin, args);
+    } else if (typeof plugin === 'function') {
+      plugin.apply(null, args);
+    }
+    installedPlugins.push(plugin);
+    return this
+  };
+}
+
+/*  */
+
+function initMixin$1 (Vue) {
+  Vue.mixin = function (mixin) {
+    this.options = mergeOptions(this.options, mixin);
+    return this
+  };
+}
+
+/*  */
+
+function initExtend (Vue) {
+  /**
+   * Each instance constructor, including Vue, has a unique
+   * cid. This enables us to create wrapped "child
+   * constructors" for prototypal inheritance and cache them.
+   */
+  Vue.cid = 0;
+  var cid = 1;
+
+  /**
+   * Class inheritance
+   */
+  Vue.extend = function (extendOptions) {
+    extendOptions = extendOptions || {};
+    var Super = this;
+    var SuperId = Super.cid;
+    var cachedCtors = extendOptions._Ctor || (extendOptions._Ctor = {});
+    if (cachedCtors[SuperId]) {
+      return cachedCtors[SuperId]
+    }
+
+    var name = extendOptions.name || Super.options.name;
+    if ("development" !== 'production' && name) {
+      validateComponentName(name);
+    }
+
+    var Sub = function VueComponent (options) {
+      this._init(options);
+    };
+    Sub.prototype = Object.create(Super.prototype);
+    Sub.prototype.constructor = Sub;
+    Sub.cid = cid++;
+    Sub.options = mergeOptions(
+      Super.options,
+      extendOptions
+    );
+    Sub['super'] = Super;
+
+    // For props and computed properties, we define the proxy getters on
+    // the Vue instances at extension time, on the extended prototype. This
+    // avoids Object.defineProperty calls for each instance created.
+    if (Sub.options.props) {
+      initProps$1(Sub);
+    }
+    if (Sub.options.computed) {
+      initComputed$1(Sub);
+    }
+
+    // allow further extension/mixin/plugin usage
+    Sub.extend = Super.extend;
+    Sub.mixin = Super.mixin;
+    Sub.use = Super.use;
+
+    // create asset registers, so extended classes
+    // can have their private assets too.
+    ASSET_TYPES.forEach(function (type) {
+      Sub[type] = Super[type];
+    });
+    // enable recursive self-lookup
+    if (name) {
+      Sub.options.components[name] = Sub;
+    }
+
+    // keep a reference to the super options at extension time.
+    // later at instantiation we can check if Super's options have
+    // been updated.
+    Sub.superOptions = Super.options;
+    Sub.extendOptions = extendOptions;
+    Sub.sealedOptions = extend({}, Sub.options);
+
+    // cache constructor
+    cachedCtors[SuperId] = Sub;
+    return Sub
+  };
+}
+
+function initProps$1 (Comp) {
+  var props = Comp.options.props;
+  for (var key in props) {
+    proxy(Comp.prototype, "_props", key);
+  }
+}
+
+function initComputed$1 (Comp) {
+  var computed = Comp.options.computed;
+  for (var key in computed) {
+    defineComputed(Comp.prototype, key, computed[key]);
+  }
+}
+
+/*  */
+
+function initAssetRegisters (Vue) {
+  /**
+   * Create asset registration methods.
+   */
+  ASSET_TYPES.forEach(function (type) {
+    Vue[type] = function (
+      id,
+      definition
+    ) {
+      if (!definition) {
+        return this.options[type + 's'][id]
+      } else {
+        /* istanbul ignore if */
+        if ("development" !== 'production' && type === 'component') {
+          validateComponentName(id);
+        }
+        if (type === 'component' && isPlainObject(definition)) {
+          definition.name = definition.name || id;
+          definition = this.options._base.extend(definition);
+        }
+        if (type === 'directive' && typeof definition === 'function') {
+          definition = { bind: definition, update: definition };
+        }
+        this.options[type + 's'][id] = definition;
+        return definition
+      }
+    };
+  });
+}
+
+/*  */
+
+function getComponentName (opts) {
+  return opts && (opts.Ctor.options.name || opts.tag)
+}
+
+function matches (pattern, name) {
+  if (Array.isArray(pattern)) {
+    return pattern.indexOf(name) > -1
+  } else if (typeof pattern === 'string') {
+    return pattern.split(',').indexOf(name) > -1
+  } else if (isRegExp(pattern)) {
+    return pattern.test(name)
+  }
+  /* istanbul ignore next */
+  return false
+}
+
+function pruneCache (keepAliveInstance, filter) {
+  var cache = keepAliveInstance.cache;
+  var keys = keepAliveInstance.keys;
+  var _vnode = keepAliveInstance._vnode;
+  for (var key in cache) {
+    var cachedNode = cache[key];
+    if (cachedNode) {
+      var name = getComponentName(cachedNode.componentOptions);
+      if (name && !filter(name)) {
+        pruneCacheEntry(cache, key, keys, _vnode);
+      }
+    }
+  }
+}
+
+function pruneCacheEntry (
+  cache,
+  key,
+  keys,
+  current
+) {
+  var cached$$1 = cache[key];
+  if (cached$$1 && (!current || cached$$1.tag !== current.tag)) {
+    cached$$1.componentInstance.$destroy();
+  }
+  cache[key] = null;
+  remove(keys, key);
+}
+
+var patternTypes = [String, RegExp, Array];
+
+var KeepAlive = {
+  name: 'keep-alive',
+  abstract: true,
+
+  props: {
+    include: patternTypes,
+    exclude: patternTypes,
+    max: [String, Number]
+  },
+
+  created: function created () {
+    this.cache = Object.create(null);
+    this.keys = [];
+  },
+
+  destroyed: function destroyed () {
+    var this$1 = this;
+
+    for (var key in this$1.cache) {
+      pruneCacheEntry(this$1.cache, key, this$1.keys);
+    }
+  },
+
+  mounted: function mounted () {
+    var this$1 = this;
+
+    this.$watch('include', function (val) {
+      pruneCache(this$1, function (name) { return matches(val, name); });
+    });
+    this.$watch('exclude', function (val) {
+      pruneCache(this$1, function (name) { return !matches(val, name); });
+    });
+  },
+
+  render: function render () {
+    var slot = this.$slots.default;
+    var vnode = getFirstComponentChild(slot);
+    var componentOptions = vnode && vnode.componentOptions;
+    if (componentOptions) {
+      // check pattern
+      var name = getComponentName(componentOptions);
+      var ref = this;
+      var include = ref.include;
+      var exclude = ref.exclude;
+      if (
+        // not included
+        (include && (!name || !matches(include, name))) ||
+        // excluded
+        (exclude && name && matches(exclude, name))
+      ) {
+        return vnode
+      }
+
+      var ref$1 = this;
+      var cache = ref$1.cache;
+      var keys = ref$1.keys;
+      var key = vnode.key == null
+        // same constructor may get registered as different local components
+        // so cid alone is not enough (#3269)
+        ? componentOptions.Ctor.cid + (componentOptions.tag ? ("::" + (componentOptions.tag)) : '')
+        : vnode.key;
+      if (cache[key]) {
+        vnode.componentInstance = cache[key].componentInstance;
+        // make current key freshest
+        remove(keys, key);
+        keys.push(key);
+      } else {
+        cache[key] = vnode;
+        keys.push(key);
+        // prune oldest entry
+        if (this.max && keys.length > parseInt(this.max)) {
+          pruneCacheEntry(cache, keys[0], keys, this._vnode);
+        }
+      }
+
+      vnode.data.keepAlive = true;
+    }
+    return vnode || (slot && slot[0])
+  }
+}
+
+var builtInComponents = {
+  KeepAlive: KeepAlive
+}
+
+/*  */
+
+function initGlobalAPI (Vue) {
+  // config
+  var configDef = {};
+  configDef.get = function () { return config; };
+  {
+    configDef.set = function () {
+      warn(
+        'Do not replace the Vue.config object, set individual fields instead.'
+      );
+    };
+  }
+  Object.defineProperty(Vue, 'config', configDef);
+
+  // exposed util methods.
+  // NOTE: these are not considered part of the public API - avoid relying on
+  // them unless you are aware of the risk.
+  Vue.util = {
+    warn: warn,
+    extend: extend,
+    mergeOptions: mergeOptions,
+    defineReactive: defineReactive
+  };
+
+  Vue.set = set;
+  Vue.delete = del;
+  Vue.nextTick = nextTick;
+
+  Vue.options = Object.create(null);
+  ASSET_TYPES.forEach(function (type) {
+    Vue.options[type + 's'] = Object.create(null);
+  });
+
+  // this is used to identify the "base" constructor to extend all plain-object
+  // components with in Weex's multi-instance scenarios.
+  Vue.options._base = Vue;
+
+  extend(Vue.options.components, builtInComponents);
+
+  initUse(Vue);
+  initMixin$1(Vue);
+  initExtend(Vue);
+  initAssetRegisters(Vue);
+}
+
+initGlobalAPI(Vue);
+
+Object.defineProperty(Vue.prototype, '$isServer', {
+  get: isServerRendering
+});
+
+Object.defineProperty(Vue.prototype, '$ssrContext', {
+  get: function get () {
+    /* istanbul ignore next */
+    return this.$vnode && this.$vnode.ssrContext
+  }
+});
+
+// expose FunctionalRenderContext for ssr runtime helper installation
+Object.defineProperty(Vue, 'FunctionalRenderContext', {
+  value: FunctionalRenderContext
+});
+
+Vue.version = '2.5.17';
+
+/*  */
+
+// these are reserved for web because they are directly compiled away
+// during template compilation
+var isReservedAttr = makeMap('style,class');
+
+// attributes that should be using props for binding
+var acceptValue = makeMap('input,textarea,option,select,progress');
+var mustUseProp = function (tag, type, attr) {
+  return (
+    (attr === 'value' && acceptValue(tag)) && type !== 'button' ||
+    (attr === 'selected' && tag === 'option') ||
+    (attr === 'checked' && tag === 'input') ||
+    (attr === 'muted' && tag === 'video')
+  )
+};
+
+var isEnumeratedAttr = makeMap('contenteditable,draggable,spellcheck');
+
+var isBooleanAttr = makeMap(
+  'allowfullscreen,async,autofocus,autoplay,checked,compact,controls,declare,' +
+  'default,defaultchecked,defaultmuted,defaultselected,defer,disabled,' +
+  'enabled,formnovalidate,hidden,indeterminate,inert,ismap,itemscope,loop,multiple,' +
+  'muted,nohref,noresize,noshade,novalidate,nowrap,open,pauseonexit,readonly,' +
+  'required,reversed,scoped,seamless,selected,sortable,translate,' +
+  'truespeed,typemustmatch,visible'
+);
+
+var xlinkNS = 'http://www.w3.org/1999/xlink';
+
+var isXlink = function (name) {
+  return name.charAt(5) === ':' && name.slice(0, 5) === 'xlink'
+};
+
+var getXlinkProp = function (name) {
+  return isXlink(name) ? name.slice(6, name.length) : ''
+};
+
+var isFalsyAttrValue = function (val) {
+  return val == null || val === false
+};
+
+/*  */
+
+function genClassForVnode (vnode) {
+  var data = vnode.data;
+  var parentNode = vnode;
+  var childNode = vnode;
+  while (isDef(childNode.componentInstance)) {
+    childNode = childNode.componentInstance._vnode;
+    if (childNode && childNode.data) {
+      data = mergeClassData(childNode.data, data);
+    }
+  }
+  while (isDef(parentNode = parentNode.parent)) {
+    if (parentNode && parentNode.data) {
+      data = mergeClassData(data, parentNode.data);
+    }
+  }
+  return renderClass(data.staticClass, data.class)
+}
+
+function mergeClassData (child, parent) {
+  return {
+    staticClass: concat(child.staticClass, parent.staticClass),
+    class: isDef(child.class)
+      ? [child.class, parent.class]
+      : parent.class
+  }
+}
+
+function renderClass (
+  staticClass,
+  dynamicClass
+) {
+  if (isDef(staticClass) || isDef(dynamicClass)) {
+    return concat(staticClass, stringifyClass(dynamicClass))
+  }
+  /* istanbul ignore next */
+  return ''
+}
+
+function concat (a, b) {
+  return a ? b ? (a + ' ' + b) : a : (b || '')
+}
+
+function stringifyClass (value) {
+  if (Array.isArray(value)) {
+    return stringifyArray(value)
+  }
+  if (isObject(value)) {
+    return stringifyObject(value)
+  }
+  if (typeof value === 'string') {
+    return value
+  }
+  /* istanbul ignore next */
+  return ''
+}
+
+function stringifyArray (value) {
+  var res = '';
+  var stringified;
+  for (var i = 0, l = value.length; i < l; i++) {
+    if (isDef(stringified = stringifyClass(value[i])) && stringified !== '') {
+      if (res) { res += ' '; }
+      res += stringified;
+    }
+  }
+  return res
+}
+
+function stringifyObject (value) {
+  var res = '';
+  for (var key in value) {
+    if (value[key]) {
+      if (res) { res += ' '; }
+      res += key;
+    }
+  }
+  return res
+}
+
+/*  */
+
+var namespaceMap = {
+  svg: 'http://www.w3.org/2000/svg',
+  math: 'http://www.w3.org/1998/Math/MathML'
+};
+
+var isHTMLTag = makeMap(
+  'html,body,base,head,link,meta,style,title,' +
+  'address,article,aside,footer,header,h1,h2,h3,h4,h5,h6,hgroup,nav,section,' +
+  'div,dd,dl,dt,figcaption,figure,picture,hr,img,li,main,ol,p,pre,ul,' +
+  'a,b,abbr,bdi,bdo,br,cite,code,data,dfn,em,i,kbd,mark,q,rp,rt,rtc,ruby,' +
+  's,samp,small,span,strong,sub,sup,time,u,var,wbr,area,audio,map,track,video,' +
+  'embed,object,param,source,canvas,script,noscript,del,ins,' +
+  'caption,col,colgroup,table,thead,tbody,td,th,tr,' +
+  'button,datalist,fieldset,form,input,label,legend,meter,optgroup,option,' +
+  'output,progress,select,textarea,' +
+  'details,dialog,menu,menuitem,summary,' +
+  'content,element,shadow,template,blockquote,iframe,tfoot'
+);
+
+// this map is intentionally selective, only covering SVG elements that may
+// contain child elements.
+var isSVG = makeMap(
+  'svg,animate,circle,clippath,cursor,defs,desc,ellipse,filter,font-face,' +
+  'foreignObject,g,glyph,image,line,marker,mask,missing-glyph,path,pattern,' +
+  'polygon,polyline,rect,switch,symbol,text,textpath,tspan,use,view',
+  true
+);
+
+var isPreTag = function (tag) { return tag === 'pre'; };
+
+var isReservedTag = function (tag) {
+  return isHTMLTag(tag) || isSVG(tag)
+};
+
+function getTagNamespace (tag) {
+  if (isSVG(tag)) {
+    return 'svg'
+  }
+  // basic support for MathML
+  // note it doesn't support other MathML elements being component roots
+  if (tag === 'math') {
+    return 'math'
+  }
+}
+
+var unknownElementCache = Object.create(null);
+function isUnknownElement (tag) {
+  /* istanbul ignore if */
+  if (!inBrowser) {
+    return true
+  }
+  if (isReservedTag(tag)) {
+    return false
+  }
+  tag = tag.toLowerCase();
+  /* istanbul ignore if */
+  if (unknownElementCache[tag] != null) {
+    return unknownElementCache[tag]
+  }
+  var el = document.createElement(tag);
+  if (tag.indexOf('-') > -1) {
+    // http://stackoverflow.com/a/28210364/1070244
+    return (unknownElementCache[tag] = (
+      el.constructor === window.HTMLUnknownElement ||
+      el.constructor === window.HTMLElement
+    ))
+  } else {
+    return (unknownElementCache[tag] = /HTMLUnknownElement/.test(el.toString()))
+  }
+}
+
+var isTextInputType = makeMap('text,number,password,search,email,tel,url');
+
+/*  */
+
+/**
+ * Query an element selector if it's not an element already.
+ */
+function query (el) {
+  if (typeof el === 'string') {
+    var selected = document.querySelector(el);
+    if (!selected) {
+      "development" !== 'production' && warn(
+        'Cannot find element: ' + el
+      );
+      return document.createElement('div')
+    }
+    return selected
+  } else {
+    return el
+  }
+}
+
+/*  */
+
+function createElement$1 (tagName, vnode) {
+  var elm = document.createElement(tagName);
+  if (tagName !== 'select') {
+    return elm
+  }
+  // false or null will remove the attribute but undefined will not
+  if (vnode.data && vnode.data.attrs && vnode.data.attrs.multiple !== undefined) {
+    elm.setAttribute('multiple', 'multiple');
+  }
+  return elm
+}
+
+function createElementNS (namespace, tagName) {
+  return document.createElementNS(namespaceMap[namespace], tagName)
+}
+
+function createTextNode (text) {
+  return document.createTextNode(text)
+}
+
+function createComment (text) {
+  return document.createComment(text)
+}
+
+function insertBefore (parentNode, newNode, referenceNode) {
+  parentNode.insertBefore(newNode, referenceNode);
+}
+
+function removeChild (node, child) {
+  node.removeChild(child);
+}
+
+function appendChild (node, child) {
+  node.appendChild(child);
+}
+
+function parentNode (node) {
+  return node.parentNode
+}
+
+function nextSibling (node) {
+  return node.nextSibling
+}
+
+function tagName (node) {
+  return node.tagName
+}
+
+function setTextContent (node, text) {
+  node.textContent = text;
+}
+
+function setStyleScope (node, scopeId) {
+  node.setAttribute(scopeId, '');
+}
+
+
+var nodeOps = Object.freeze({
+	createElement: createElement$1,
+	createElementNS: createElementNS,
+	createTextNode: createTextNode,
+	createComment: createComment,
+	insertBefore: insertBefore,
+	removeChild: removeChild,
+	appendChild: appendChild,
+	parentNode: parentNode,
+	nextSibling: nextSibling,
+	tagName: tagName,
+	setTextContent: setTextContent,
+	setStyleScope: setStyleScope
+});
+
+/*  */
+
+var ref = {
+  create: function create (_, vnode) {
+    registerRef(vnode);
+  },
+  update: function update (oldVnode, vnode) {
+    if (oldVnode.data.ref !== vnode.data.ref) {
+      registerRef(oldVnode, true);
+      registerRef(vnode);
+    }
+  },
+  destroy: function destroy (vnode) {
+    registerRef(vnode, true);
+  }
+}
+
+function registerRef (vnode, isRemoval) {
+  var key = vnode.data.ref;
+  if (!isDef(key)) { return }
+
+  var vm = vnode.context;
+  var ref = vnode.componentInstance || vnode.elm;
+  var refs = vm.$refs;
+  if (isRemoval) {
+    if (Array.isArray(refs[key])) {
+      remove(refs[key], ref);
+    } else if (refs[key] === ref) {
+      refs[key] = undefined;
+    }
+  } else {
+    if (vnode.data.refInFor) {
+      if (!Array.isArray(refs[key])) {
+        refs[key] = [ref];
+      } else if (refs[key].indexOf(ref) < 0) {
+        // $flow-disable-line
+        refs[key].push(ref);
+      }
+    } else {
+      refs[key] = ref;
+    }
+  }
+}
+
+/**
+ * Virtual DOM patching algorithm based on Snabbdom by
+ * Simon Friis Vindum (@paldepind)
+ * Licensed under the MIT License
+ * https://github.com/paldepind/snabbdom/blob/master/LICENSE
+ *
+ * modified by Evan You (@yyx990803)
+ *
+ * Not type-checking this because this file is perf-critical and the cost
+ * of making flow understand it is not worth it.
+ */
+
+var emptyNode = new VNode('', {}, []);
+
+var hooks = ['create', 'activate', 'update', 'remove', 'destroy'];
+
+function sameVnode (a, b) {
+  return (
+    a.key === b.key && (
+      (
+        a.tag === b.tag &&
+        a.isComment === b.isComment &&
+        isDef(a.data) === isDef(b.data) &&
+        sameInputType(a, b)
+      ) || (
+        isTrue(a.isAsyncPlaceholder) &&
+        a.asyncFactory === b.asyncFactory &&
+        isUndef(b.asyncFactory.error)
+      )
+    )
+  )
+}
+
+function sameInputType (a, b) {
+  if (a.tag !== 'input') { return true }
+  var i;
+  var typeA = isDef(i = a.data) && isDef(i = i.attrs) && i.type;
+  var typeB = isDef(i = b.data) && isDef(i = i.attrs) && i.type;
+  return typeA === typeB || isTextInputType(typeA) && isTextInputType(typeB)
+}
+
+function createKeyToOldIdx (children, beginIdx, endIdx) {
+  var i, key;
+  var map = {};
+  for (i = beginIdx; i <= endIdx; ++i) {
+    key = children[i].key;
+    if (isDef(key)) { map[key] = i; }
+  }
+  return map
+}
+
+function createPatchFunction (backend) {
+  var i, j;
+  var cbs = {};
+
+  var modules = backend.modules;
+  var nodeOps = backend.nodeOps;
+
+  for (i = 0; i < hooks.length; ++i) {
+    cbs[hooks[i]] = [];
+    for (j = 0; j < modules.length; ++j) {
+      if (isDef(modules[j][hooks[i]])) {
+        cbs[hooks[i]].push(modules[j][hooks[i]]);
+      }
+    }
+  }
+
+  function emptyNodeAt (elm) {
+    return new VNode(nodeOps.tagName(elm).toLowerCase(), {}, [], undefined, elm)
+  }
+
+  function createRmCb (childElm, listeners) {
+    function remove () {
+      if (--remove.listeners === 0) {
+        removeNode(childElm);
+      }
+    }
+    remove.listeners = listeners;
+    return remove
+  }
+
+  function removeNode (el) {
+    var parent = nodeOps.parentNode(el);
+    // element may have already been removed due to v-html / v-text
+    if (isDef(parent)) {
+      nodeOps.removeChild(parent, el);
+    }
+  }
+
+  function isUnknownElement$$1 (vnode, inVPre) {
+    return (
+      !inVPre &&
+      !vnode.ns &&
+      !(
+        config.ignoredElements.length &&
+        config.ignoredElements.some(function (ignore) {
+          return isRegExp(ignore)
+            ? ignore.test(vnode.tag)
+            : ignore === vnode.tag
+        })
+      ) &&
+      config.isUnknownElement(vnode.tag)
+    )
+  }
+
+  var creatingElmInVPre = 0;
+
+  function createElm (
+    vnode,
+    insertedVnodeQueue,
+    parentElm,
+    refElm,
+    nested,
+    ownerArray,
+    index
+  ) {
+    if (isDef(vnode.elm) && isDef(ownerArray)) {
+      // This vnode was used in a previous render!
+      // now it's used as a new node, overwriting its elm would cause
+      // potential patch errors down the road when it's used as an insertion
+      // reference node. Instead, we clone the node on-demand before creating
+      // associated DOM element for it.
+      vnode = ownerArray[index] = cloneVNode(vnode);
+    }
+
+    vnode.isRootInsert = !nested; // for transition enter check
+    if (createComponent(vnode, insertedVnodeQueue, parentElm, refElm)) {
+      return
+    }
+
+    var data = vnode.data;
+    var children = vnode.children;
+    var tag = vnode.tag;
+    if (isDef(tag)) {
+      {
+        if (data && data.pre) {
+          creatingElmInVPre++;
+        }
+        if (isUnknownElement$$1(vnode, creatingElmInVPre)) {
+          warn(
+            'Unknown custom element: <' + tag + '> - did you ' +
+            'register the component correctly? For recursive components, ' +
+            'make sure to provide the "name" option.',
+            vnode.context
+          );
+        }
+      }
+
+      vnode.elm = vnode.ns
+        ? nodeOps.createElementNS(vnode.ns, tag)
+        : nodeOps.createElement(tag, vnode);
+      setScope(vnode);
+
+      /* istanbul ignore if */
+      {
+        createChildren(vnode, children, insertedVnodeQueue);
+        if (isDef(data)) {
+          invokeCreateHooks(vnode, insertedVnodeQueue);
+        }
+        insert(parentElm, vnode.elm, refElm);
+      }
+
+      if ("development" !== 'production' && data && data.pre) {
+        creatingElmInVPre--;
+      }
+    } else if (isTrue(vnode.isComment)) {
+      vnode.elm = nodeOps.createComment(vnode.text);
+      insert(parentElm, vnode.elm, refElm);
+    } else {
+      vnode.elm = nodeOps.createTextNode(vnode.text);
+      insert(parentElm, vnode.elm, refElm);
+    }
+  }
+
+  function createComponent (vnode, insertedVnodeQueue, parentElm, refElm) {
+    var i = vnode.data;
+    if (isDef(i)) {
+      var isReactivated = isDef(vnode.componentInstance) && i.keepAlive;
+      if (isDef(i = i.hook) && isDef(i = i.init)) {
+        i(vnode, false /* hydrating */, parentElm, refElm);
+      }
+      // after calling the init hook, if the vnode is a child component
+      // it should've created a child instance and mounted it. the child
+      // component also has set the placeholder vnode's elm.
+      // in that case we can just return the element and be done.
+      if (isDef(vnode.componentInstance)) {
+        initComponent(vnode, insertedVnodeQueue);
+        if (isTrue(isReactivated)) {
+          reactivateComponent(vnode, insertedVnodeQueue, parentElm, refElm);
+        }
+        return true
+      }
+    }
+  }
+
+  function initComponent (vnode, insertedVnodeQueue) {
+    if (isDef(vnode.data.pendingInsert)) {
+      insertedVnodeQueue.push.apply(insertedVnodeQueue, vnode.data.pendingInsert);
+      vnode.data.pendingInsert = null;
+    }
+    vnode.elm = vnode.componentInstance.$el;
+    if (isPatchable(vnode)) {
+      invokeCreateHooks(vnode, insertedVnodeQueue);
+      setScope(vnode);
+    } else {
+      // empty component root.
+      // skip all element-related modules except for ref (#3455)
+      registerRef(vnode);
+      // make sure to invoke the insert hook
+      insertedVnodeQueue.push(vnode);
+    }
+  }
+
+  function reactivateComponent (vnode, insertedVnodeQueue, parentElm, refElm) {
+    var i;
+    // hack for #4339: a reactivated component with inner transition
+    // does not trigger because the inner node's created hooks are not called
+    // again. It's not ideal to involve module-specific logic in here but
+    // there doesn't seem to be a better way to do it.
+    var innerNode = vnode;
+    while (innerNode.componentInstance) {
+      innerNode = innerNode.componentInstance._vnode;
+      if (isDef(i = innerNode.data) && isDef(i = i.transition)) {
+        for (i = 0; i < cbs.activate.length; ++i) {
+          cbs.activate[i](emptyNode, innerNode);
+        }
+        insertedVnodeQueue.push(innerNode);
+        break
+      }
+    }
+    // unlike a newly created component,
+    // a reactivated keep-alive component doesn't insert itself
+    insert(parentElm, vnode.elm, refElm);
+  }
+
+  function insert (parent, elm, ref$$1) {
+    if (isDef(parent)) {
+      if (isDef(ref$$1)) {
+        if (ref$$1.parentNode === parent) {
+          nodeOps.insertBefore(parent, elm, ref$$1);
+        }
+      } else {
+        nodeOps.appendChild(parent, elm);
+      }
+    }
+  }
+
+  function createChildren (vnode, children, insertedVnodeQueue) {
+    if (Array.isArray(children)) {
+      {
+        checkDuplicateKeys(children);
+      }
+      for (var i = 0; i < children.length; ++i) {
+        createElm(children[i], insertedVnodeQueue, vnode.elm, null, true, children, i);
+      }
+    } else if (isPrimitive(vnode.text)) {
+      nodeOps.appendChild(vnode.elm, nodeOps.createTextNode(String(vnode.text)));
+    }
+  }
+
+  function isPatchable (vnode) {
+    while (vnode.componentInstance) {
+      vnode = vnode.componentInstance._vnode;
+    }
+    return isDef(vnode.tag)
+  }
+
+  function invokeCreateHooks (vnode, insertedVnodeQueue) {
+    for (var i$1 = 0; i$1 < cbs.create.length; ++i$1) {
+      cbs.create[i$1](emptyNode, vnode);
+    }
+    i = vnode.data.hook; // Reuse variable
+    if (isDef(i)) {
+      if (isDef(i.create)) { i.create(emptyNode, vnode); }
+      if (isDef(i.insert)) { insertedVnodeQueue.push(vnode); }
+    }
+  }
+
+  // set scope id attribute for scoped CSS.
+  // this is implemented as a special case to avoid the overhead
+  // of going through the normal attribute patching process.
+  function setScope (vnode) {
+    var i;
+    if (isDef(i = vnode.fnScopeId)) {
+      nodeOps.setStyleScope(vnode.elm, i);
+    } else {
+      var ancestor = vnode;
+      while (ancestor) {
+        if (isDef(i = ancestor.context) && isDef(i = i.$options._scopeId)) {
+          nodeOps.setStyleScope(vnode.elm, i);
+        }
+        ancestor = ancestor.parent;
+      }
+    }
+    // for slot content they should also get the scopeId from the host instance.
+    if (isDef(i = activeInstance) &&
+      i !== vnode.context &&
+      i !== vnode.fnContext &&
+      isDef(i = i.$options._scopeId)
+    ) {
+      nodeOps.setStyleScope(vnode.elm, i);
+    }
+  }
+
+  function addVnodes (parentElm, refElm, vnodes, startIdx, endIdx, insertedVnodeQueue) {
+    for (; startIdx <= endIdx; ++startIdx) {
+      createElm(vnodes[startIdx], insertedVnodeQueue, parentElm, refElm, false, vnodes, startIdx);
+    }
+  }
+
+  function invokeDestroyHook (vnode) {
+    var i, j;
+    var data = vnode.data;
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.destroy)) { i(vnode); }
+      for (i = 0; i < cbs.destroy.length; ++i) { cbs.destroy[i](vnode); }
+    }
+    if (isDef(i = vnode.children)) {
+      for (j = 0; j < vnode.children.length; ++j) {
+        invokeDestroyHook(vnode.children[j]);
+      }
+    }
+  }
+
+  function removeVnodes (parentElm, vnodes, startIdx, endIdx) {
+    for (; startIdx <= endIdx; ++startIdx) {
+      var ch = vnodes[startIdx];
+      if (isDef(ch)) {
+        if (isDef(ch.tag)) {
+          removeAndInvokeRemoveHook(ch);
+          invokeDestroyHook(ch);
+        } else { // Text node
+          removeNode(ch.elm);
+        }
+      }
+    }
+  }
+
+  function removeAndInvokeRemoveHook (vnode, rm) {
+    if (isDef(rm) || isDef(vnode.data)) {
+      var i;
+      var listeners = cbs.remove.length + 1;
+      if (isDef(rm)) {
+        // we have a recursively passed down rm callback
+        // increase the listeners count
+        rm.listeners += listeners;
+      } else {
+        // directly removing
+        rm = createRmCb(vnode.elm, listeners);
+      }
+      // recursively invoke hooks on child component root node
+      if (isDef(i = vnode.componentInstance) && isDef(i = i._vnode) && isDef(i.data)) {
+        removeAndInvokeRemoveHook(i, rm);
+      }
+      for (i = 0; i < cbs.remove.length; ++i) {
+        cbs.remove[i](vnode, rm);
+      }
+      if (isDef(i = vnode.data.hook) && isDef(i = i.remove)) {
+        i(vnode, rm);
+      } else {
+        rm();
+      }
+    } else {
+      removeNode(vnode.elm);
+    }
+  }
+
+  function updateChildren (parentElm, oldCh, newCh, insertedVnodeQueue, removeOnly) {
+    var oldStartIdx = 0;
+    var newStartIdx = 0;
+    var oldEndIdx = oldCh.length - 1;
+    var oldStartVnode = oldCh[0];
+    var oldEndVnode = oldCh[oldEndIdx];
+    var newEndIdx = newCh.length - 1;
+    var newStartVnode = newCh[0];
+    var newEndVnode = newCh[newEndIdx];
+    var oldKeyToIdx, idxInOld, vnodeToMove, refElm;
+
+    // removeOnly is a special flag used only by <transition-group>
+    // to ensure removed elements stay in correct relative positions
+    // during leaving transitions
+    var canMove = !removeOnly;
+
+    {
+      checkDuplicateKeys(newCh);
+    }
+
+    while (oldStartIdx <= oldEndIdx && newStartIdx <= newEndIdx) {
+      if (isUndef(oldStartVnode)) {
+        oldStartVnode = oldCh[++oldStartIdx]; // Vnode has been moved left
+      } else if (isUndef(oldEndVnode)) {
+        oldEndVnode = oldCh[--oldEndIdx];
+      } else if (sameVnode(oldStartVnode, newStartVnode)) {
+        patchVnode(oldStartVnode, newStartVnode, insertedVnodeQueue);
+        oldStartVnode = oldCh[++oldStartIdx];
+        newStartVnode = newCh[++newStartIdx];
+      } else if (sameVnode(oldEndVnode, newEndVnode)) {
+        patchVnode(oldEndVnode, newEndVnode, insertedVnodeQueue);
+        oldEndVnode = oldCh[--oldEndIdx];
+        newEndVnode = newCh[--newEndIdx];
+      } else if (sameVnode(oldStartVnode, newEndVnode)) { // Vnode moved right
+        patchVnode(oldStartVnode, newEndVnode, insertedVnodeQueue);
+        canMove && nodeOps.insertBefore(parentElm, oldStartVnode.elm, nodeOps.nextSibling(oldEndVnode.elm));
+        oldStartVnode = oldCh[++oldStartIdx];
+        newEndVnode = newCh[--newEndIdx];
+      } else if (sameVnode(oldEndVnode, newStartVnode)) { // Vnode moved left
+        patchVnode(oldEndVnode, newStartVnode, insertedVnodeQueue);
+        canMove && nodeOps.insertBefore(parentElm, oldEndVnode.elm, oldStartVnode.elm);
+        oldEndVnode = oldCh[--oldEndIdx];
+        newStartVnode = newCh[++newStartIdx];
+      } else {
+        if (isUndef(oldKeyToIdx)) { oldKeyToIdx = createKeyToOldIdx(oldCh, oldStartIdx, oldEndIdx); }
+        idxInOld = isDef(newStartVnode.key)
+          ? oldKeyToIdx[newStartVnode.key]
+          : findIdxInOld(newStartVnode, oldCh, oldStartIdx, oldEndIdx);
+        if (isUndef(idxInOld)) { // New element
+          createElm(newStartVnode, insertedVnodeQueue, parentElm, oldStartVnode.elm, false, newCh, newStartIdx);
+        } else {
+          vnodeToMove = oldCh[idxInOld];
+          if (sameVnode(vnodeToMove, newStartVnode)) {
+            patchVnode(vnodeToMove, newStartVnode, insertedVnodeQueue);
+            oldCh[idxInOld] = undefined;
+            canMove && nodeOps.insertBefore(parentElm, vnodeToMove.elm, oldStartVnode.elm);
+          } else {
+            // same key but different element. treat as new element
+            createElm(newStartVnode, insertedVnodeQueue, parentElm, oldStartVnode.elm, false, newCh, newStartIdx);
+          }
+        }
+        newStartVnode = newCh[++newStartIdx];
+      }
+    }
+    if (oldStartIdx > oldEndIdx) {
+      refElm = isUndef(newCh[newEndIdx + 1]) ? null : newCh[newEndIdx + 1].elm;
+      addVnodes(parentElm, refElm, newCh, newStartIdx, newEndIdx, insertedVnodeQueue);
+    } else if (newStartIdx > newEndIdx) {
+      removeVnodes(parentElm, oldCh, oldStartIdx, oldEndIdx);
+    }
+  }
+
+  function checkDuplicateKeys (children) {
+    var seenKeys = {};
+    for (var i = 0; i < children.length; i++) {
+      var vnode = children[i];
+      var key = vnode.key;
+      if (isDef(key)) {
+        if (seenKeys[key]) {
+          warn(
+            ("Duplicate keys detected: '" + key + "'. This may cause an update error."),
+            vnode.context
+          );
+        } else {
+          seenKeys[key] = true;
+        }
+      }
+    }
+  }
+
+  function findIdxInOld (node, oldCh, start, end) {
+    for (var i = start; i < end; i++) {
+      var c = oldCh[i];
+      if (isDef(c) && sameVnode(node, c)) { return i }
+    }
+  }
+
+  function patchVnode (oldVnode, vnode, insertedVnodeQueue, removeOnly) {
+    if (oldVnode === vnode) {
+      return
+    }
+
+    var elm = vnode.elm = oldVnode.elm;
+
+    if (isTrue(oldVnode.isAsyncPlaceholder)) {
+      if (isDef(vnode.asyncFactory.resolved)) {
+        hydrate(oldVnode.elm, vnode, insertedVnodeQueue);
+      } else {
+        vnode.isAsyncPlaceholder = true;
+      }
+      return
+    }
+
+    // reuse element for static trees.
+    // note we only do this if the vnode is cloned -
+    // if the new node is not cloned it means the render functions have been
+    // reset by the hot-reload-api and we need to do a proper re-render.
+    if (isTrue(vnode.isStatic) &&
+      isTrue(oldVnode.isStatic) &&
+      vnode.key === oldVnode.key &&
+      (isTrue(vnode.isCloned) || isTrue(vnode.isOnce))
+    ) {
+      vnode.componentInstance = oldVnode.componentInstance;
+      return
+    }
+
+    var i;
+    var data = vnode.data;
+    if (isDef(data) && isDef(i = data.hook) && isDef(i = i.prepatch)) {
+      i(oldVnode, vnode);
+    }
+
+    var oldCh = oldVnode.children;
+    var ch = vnode.children;
+    if (isDef(data) && isPatchable(vnode)) {
+      for (i = 0; i < cbs.update.length; ++i) { cbs.update[i](oldVnode, vnode); }
+      if (isDef(i = data.hook) && isDef(i = i.update)) { i(oldVnode, vnode); }
+    }
+    if (isUndef(vnode.text)) {
+      if (isDef(oldCh) && isDef(ch)) {
+        if (oldCh !== ch) { updateChildren(elm, oldCh, ch, insertedVnodeQueue, removeOnly); }
+      } else if (isDef(ch)) {
+        if (isDef(oldVnode.text)) { nodeOps.setTextContent(elm, ''); }
+        addVnodes(elm, null, ch, 0, ch.length - 1, insertedVnodeQueue);
+      } else if (isDef(oldCh)) {
+        removeVnodes(elm, oldCh, 0, oldCh.length - 1);
+      } else if (isDef(oldVnode.text)) {
+        nodeOps.setTextContent(elm, '');
+      }
+    } else if (oldVnode.text !== vnode.text) {
+      nodeOps.setTextContent(elm, vnode.text);
+    }
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.postpatch)) { i(oldVnode, vnode); }
+    }
+  }
+
+  function invokeInsertHook (vnode, queue, initial) {
+    // delay insert hooks for component root nodes, invoke them after the
+    // element is really inserted
+    if (isTrue(initial) && isDef(vnode.parent)) {
+      vnode.parent.data.pendingInsert = queue;
+    } else {
+      for (var i = 0; i < queue.length; ++i) {
+        queue[i].data.hook.insert(queue[i]);
+      }
+    }
+  }
+
+  var hydrationBailed = false;
+  // list of modules that can skip create hook during hydration because they
+  // are already rendered on the client or has no need for initialization
+  // Note: style is excluded because it relies on initial clone for future
+  // deep updates (#7063).
+  var isRenderedModule = makeMap('attrs,class,staticClass,staticStyle,key');
+
+  // Note: this is a browser-only function so we can assume elms are DOM nodes.
+  function hydrate (elm, vnode, insertedVnodeQueue, inVPre) {
+    var i;
+    var tag = vnode.tag;
+    var data = vnode.data;
+    var children = vnode.children;
+    inVPre = inVPre || (data && data.pre);
+    vnode.elm = elm;
+
+    if (isTrue(vnode.isComment) && isDef(vnode.asyncFactory)) {
+      vnode.isAsyncPlaceholder = true;
+      return true
+    }
+    // assert node match
+    {
+      if (!assertNodeMatch(elm, vnode, inVPre)) {
+        return false
+      }
+    }
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.init)) { i(vnode, true /* hydrating */); }
+      if (isDef(i = vnode.componentInstance)) {
+        // child component. it should have hydrated its own tree.
+        initComponent(vnode, insertedVnodeQueue);
+        return true
+      }
+    }
+    if (isDef(tag)) {
+      if (isDef(children)) {
+        // empty element, allow client to pick up and populate children
+        if (!elm.hasChildNodes()) {
+          createChildren(vnode, children, insertedVnodeQueue);
+        } else {
+          // v-html and domProps: innerHTML
+          if (isDef(i = data) && isDef(i = i.domProps) && isDef(i = i.innerHTML)) {
+            if (i !== elm.innerHTML) {
+              /* istanbul ignore if */
+              if ("development" !== 'production' &&
+                typeof console !== 'undefined' &&
+                !hydrationBailed
+              ) {
+                hydrationBailed = true;
+                console.warn('Parent: ', elm);
+                console.warn('server innerHTML: ', i);
+                console.warn('client innerHTML: ', elm.innerHTML);
+              }
+              return false
+            }
+          } else {
+            // iterate and compare children lists
+            var childrenMatch = true;
+            var childNode = elm.firstChild;
+            for (var i$1 = 0; i$1 < children.length; i$1++) {
+              if (!childNode || !hydrate(childNode, children[i$1], insertedVnodeQueue, inVPre)) {
+                childrenMatch = false;
+                break
+              }
+              childNode = childNode.nextSibling;
+            }
+            // if childNode is not null, it means the actual childNodes list is
+            // longer than the virtual children list.
+            if (!childrenMatch || childNode) {
+              /* istanbul ignore if */
+              if ("development" !== 'production' &&
+                typeof console !== 'undefined' &&
+                !hydrationBailed
+              ) {
+                hydrationBailed = true;
+                console.warn('Parent: ', elm);
+                console.warn('Mismatching childNodes vs. VNodes: ', elm.childNodes, children);
+              }
+              return false
+            }
+          }
+        }
+      }
+      if (isDef(data)) {
+        var fullInvoke = false;
+        for (var key in data) {
+          if (!isRenderedModule(key)) {
+            fullInvoke = true;
+            invokeCreateHooks(vnode, insertedVnodeQueue);
+            break
+          }
+        }
+        if (!fullInvoke && data['class']) {
+          // ensure collecting deps for deep class bindings for future updates
+          traverse(data['class']);
+        }
+      }
+    } else if (elm.data !== vnode.text) {
+      elm.data = vnode.text;
+    }
+    return true
+  }
+
+  function assertNodeMatch (node, vnode, inVPre) {
+    if (isDef(vnode.tag)) {
+      return vnode.tag.indexOf('vue-component') === 0 || (
+        !isUnknownElement$$1(vnode, inVPre) &&
+        vnode.tag.toLowerCase() === (node.tagName && node.tagName.toLowerCase())
+      )
+    } else {
+      return node.nodeType === (vnode.isComment ? 8 : 3)
+    }
+  }
+
+  return function patch (oldVnode, vnode, hydrating, removeOnly, parentElm, refElm) {
+    if (isUndef(vnode)) {
+      if (isDef(oldVnode)) { invokeDestroyHook(oldVnode); }
+      return
+    }
+
+    var isInitialPatch = false;
+    var insertedVnodeQueue = [];
+
+    if (isUndef(oldVnode)) {
+      // empty mount (likely as component), create new root element
+      isInitialPatch = true;
+      createElm(vnode, insertedVnodeQueue, parentElm, refElm);
+    } else {
+      var isRealElement = isDef(oldVnode.nodeType);
+      if (!isRealElement && sameVnode(oldVnode, vnode)) {
+        // patch existing root node
+        patchVnode(oldVnode, vnode, insertedVnodeQueue, removeOnly);
+      } else {
+        if (isRealElement) {
+          // mounting to a real element
+          // check if this is server-rendered content and if we can perform
+          // a successful hydration.
+          if (oldVnode.nodeType === 1 && oldVnode.hasAttribute(SSR_ATTR)) {
+            oldVnode.removeAttribute(SSR_ATTR);
+            hydrating = true;
+          }
+          if (isTrue(hydrating)) {
+            if (hydrate(oldVnode, vnode, insertedVnodeQueue)) {
+              invokeInsertHook(vnode, insertedVnodeQueue, true);
+              return oldVnode
+            } else {
+              warn(
+                'The client-side rendered virtual DOM tree is not matching ' +
+                'server-rendered content. This is likely caused by incorrect ' +
+                'HTML markup, for example nesting block-level elements inside ' +
+                '<p>, or missing <tbody>. Bailing hydration and performing ' +
+                'full client-side render.'
+              );
+            }
+          }
+          // either not server-rendered, or hydration failed.
+          // create an empty node and replace it
+          oldVnode = emptyNodeAt(oldVnode);
+        }
+
+        // replacing existing element
+        var oldElm = oldVnode.elm;
+        var parentElm$1 = nodeOps.parentNode(oldElm);
+
+        // create new node
+        createElm(
+          vnode,
+          insertedVnodeQueue,
+          // extremely rare edge case: do not insert if old element is in a
+          // leaving transition. Only happens when combining transition +
+          // keep-alive + HOCs. (#4590)
+          oldElm._leaveCb ? null : parentElm$1,
+          nodeOps.nextSibling(oldElm)
+        );
+
+        // update parent placeholder node element, recursively
+        if (isDef(vnode.parent)) {
+          var ancestor = vnode.parent;
+          var patchable = isPatchable(vnode);
+          while (ancestor) {
+            for (var i = 0; i < cbs.destroy.length; ++i) {
+              cbs.destroy[i](ancestor);
+            }
+            ancestor.elm = vnode.elm;
+            if (patchable) {
+              for (var i$1 = 0; i$1 < cbs.create.length; ++i$1) {
+                cbs.create[i$1](emptyNode, ancestor);
+              }
+              // #6513
+              // invoke insert hooks that may have been merged by create hooks.
+              // e.g. for directives that uses the "inserted" hook.
+              var insert = ancestor.data.hook.insert;
+              if (insert.merged) {
+                // start at index 1 to avoid re-invoking component mounted hook
+                for (var i$2 = 1; i$2 < insert.fns.length; i$2++) {
+                  insert.fns[i$2]();
+                }
+              }
+            } else {
+              registerRef(ancestor);
+            }
+            ancestor = ancestor.parent;
+          }
+        }
+
+        // destroy old node
+        if (isDef(parentElm$1)) {
+          removeVnodes(parentElm$1, [oldVnode], 0, 0);
+        } else if (isDef(oldVnode.tag)) {
+          invokeDestroyHook(oldVnode);
+        }
+      }
+    }
+
+    invokeInsertHook(vnode, insertedVnodeQueue, isInitialPatch);
+    return vnode.elm
+  }
+}
+
+/*  */
+
+var directives = {
+  create: updateDirectives,
+  update: updateDirectives,
+  destroy: function unbindDirectives (vnode) {
+    updateDirectives(vnode, emptyNode);
+  }
+}
+
+function updateDirectives (oldVnode, vnode) {
+  if (oldVnode.data.directives || vnode.data.directives) {
+    _update(oldVnode, vnode);
+  }
+}
+
+function _update (oldVnode, vnode) {
+  var isCreate = oldVnode === emptyNode;
+  var isDestroy = vnode === emptyNode;
+  var oldDirs = normalizeDirectives$1(oldVnode.data.directives, oldVnode.context);
+  var newDirs = normalizeDirectives$1(vnode.data.directives, vnode.context);
+
+  var dirsWithInsert = [];
+  var dirsWithPostpatch = [];
+
+  var key, oldDir, dir;
+  for (key in newDirs) {
+    oldDir = oldDirs[key];
+    dir = newDirs[key];
+    if (!oldDir) {
+      // new directive, bind
+      callHook$1(dir, 'bind', vnode, oldVnode);
+      if (dir.def && dir.def.inserted) {
+        dirsWithInsert.push(dir);
+      }
+    } else {
+      // existing directive, update
+      dir.oldValue = oldDir.value;
+      callHook$1(dir, 'update', vnode, oldVnode);
+      if (dir.def && dir.def.componentUpdated) {
+        dirsWithPostpatch.push(dir);
+      }
+    }
+  }
+
+  if (dirsWithInsert.length) {
+    var callInsert = function () {
+      for (var i = 0; i < dirsWithInsert.length; i++) {
+        callHook$1(dirsWithInsert[i], 'inserted', vnode, oldVnode);
+      }
+    };
+    if (isCreate) {
+      mergeVNodeHook(vnode, 'insert', callInsert);
+    } else {
+      callInsert();
+    }
+  }
+
+  if (dirsWithPostpatch.length) {
+    mergeVNodeHook(vnode, 'postpatch', function () {
+      for (var i = 0; i < dirsWithPostpatch.length; i++) {
+        callHook$1(dirsWithPostpatch[i], 'componentUpdated', vnode, oldVnode);
+      }
+    });
+  }
+
+  if (!isCreate) {
+    for (key in oldDirs) {
+      if (!newDirs[key]) {
+        // no longer present, unbind
+        callHook$1(oldDirs[key], 'unbind', oldVnode, oldVnode, isDestroy);
+      }
+    }
+  }
+}
+
+var emptyModifiers = Object.create(null);
+
+function normalizeDirectives$1 (
+  dirs,
+  vm
+) {
+  var res = Object.create(null);
+  if (!dirs) {
+    // $flow-disable-line
+    return res
+  }
+  var i, dir;
+  for (i = 0; i < dirs.length; i++) {
+    dir = dirs[i];
+    if (!dir.modifiers) {
+      // $flow-disable-line
+      dir.modifiers = emptyModifiers;
+    }
+    res[getRawDirName(dir)] = dir;
+    dir.def = resolveAsset(vm.$options, 'directives', dir.name, true);
+  }
+  // $flow-disable-line
+  return res
+}
+
+function getRawDirName (dir) {
+  return dir.rawName || ((dir.name) + "." + (Object.keys(dir.modifiers || {}).join('.')))
+}
+
+function callHook$1 (dir, hook, vnode, oldVnode, isDestroy) {
+  var fn = dir.def && dir.def[hook];
+  if (fn) {
+    try {
+      fn(vnode.elm, dir, vnode, oldVnode, isDestroy);
+    } catch (e) {
+      handleError(e, vnode.context, ("directive " + (dir.name) + " " + hook + " hook"));
+    }
+  }
+}
+
+var baseModules = [
+  ref,
+  directives
+]
+
+/*  */
+
+function updateAttrs (oldVnode, vnode) {
+  var opts = vnode.componentOptions;
+  if (isDef(opts) && opts.Ctor.options.inheritAttrs === false) {
+    return
+  }
+  if (isUndef(oldVnode.data.attrs) && isUndef(vnode.data.attrs)) {
+    return
+  }
+  var key, cur, old;
+  var elm = vnode.elm;
+  var oldAttrs = oldVnode.data.attrs || {};
+  var attrs = vnode.data.attrs || {};
+  // clone observed objects, as the user probably wants to mutate it
+  if (isDef(attrs.__ob__)) {
+    attrs = vnode.data.attrs = extend({}, attrs);
+  }
+
+  for (key in attrs) {
+    cur = attrs[key];
+    old = oldAttrs[key];
+    if (old !== cur) {
+      setAttr(elm, key, cur);
+    }
+  }
+  // #4391: in IE9, setting type can reset value for input[type=radio]
+  // #6666: IE/Edge forces progress value down to 1 before setting a max
+  /* istanbul ignore if */
+  if ((isIE || isEdge) && attrs.value !== oldAttrs.value) {
+    setAttr(elm, 'value', attrs.value);
+  }
+  for (key in oldAttrs) {
+    if (isUndef(attrs[key])) {
+      if (isXlink(key)) {
+        elm.removeAttributeNS(xlinkNS, getXlinkProp(key));
+      } else if (!isEnumeratedAttr(key)) {
+        elm.removeAttribute(key);
+      }
+    }
+  }
+}
+
+function setAttr (el, key, value) {
+  if (el.tagName.indexOf('-') > -1) {
+    baseSetAttr(el, key, value);
+  } else if (isBooleanAttr(key)) {
+    // set attribute for blank value
+    // e.g. <option disabled>Select one</option>
+    if (isFalsyAttrValue(value)) {
+      el.removeAttribute(key);
+    } else {
+      // technically allowfullscreen is a boolean attribute for <iframe>,
+      // but Flash expects a value of "true" when used on <embed> tag
+      value = key === 'allowfullscreen' && el.tagName === 'EMBED'
+        ? 'true'
+        : key;
+      el.setAttribute(key, value);
+    }
+  } else if (isEnumeratedAttr(key)) {
+    el.setAttribute(key, isFalsyAttrValue(value) || value === 'false' ? 'false' : 'true');
+  } else if (isXlink(key)) {
+    if (isFalsyAttrValue(value)) {
+      el.removeAttributeNS(xlinkNS, getXlinkProp(key));
+    } else {
+      el.setAttributeNS(xlinkNS, key, value);
+    }
+  } else {
+    baseSetAttr(el, key, value);
+  }
+}
+
+function baseSetAttr (el, key, value) {
+  if (isFalsyAttrValue(value)) {
+    el.removeAttribute(key);
+  } else {
+    // #7138: IE10 & 11 fires input event when setting placeholder on
+    // <textarea>... block the first input event and remove the blocker
+    // immediately.
+    /* istanbul ignore if */
+    if (
+      isIE && !isIE9 &&
+      el.tagName === 'TEXTAREA' &&
+      key === 'placeholder' && !el.__ieph
+    ) {
+      var blocker = function (e) {
+        e.stopImmediatePropagation();
+        el.removeEventListener('input', blocker);
+      };
+      el.addEventListener('input', blocker);
+      // $flow-disable-line
+      el.__ieph = true; /* IE placeholder patched */
+    }
+    el.setAttribute(key, value);
+  }
+}
+
+var attrs = {
+  create: updateAttrs,
+  update: updateAttrs
+}
+
+/*  */
+
+function updateClass (oldVnode, vnode) {
+  var el = vnode.elm;
+  var data = vnode.data;
+  var oldData = oldVnode.data;
+  if (
+    isUndef(data.staticClass) &&
+    isUndef(data.class) && (
+      isUndef(oldData) || (
+        isUndef(oldData.staticClass) &&
+        isUndef(oldData.class)
+      )
+    )
+  ) {
+    return
+  }
+
+  var cls = genClassForVnode(vnode);
+
+  // handle transition classes
+  var transitionClass = el._transitionClasses;
+  if (isDef(transitionClass)) {
+    cls = concat(cls, stringifyClass(transitionClass));
+  }
+
+  // set the class
+  if (cls !== el._prevClass) {
+    el.setAttribute('class', cls);
+    el._prevClass = cls;
+  }
+}
+
+var klass = {
+  create: updateClass,
+  update: updateClass
+}
+
+/*  */
+
+var validDivisionCharRE = /[\w).+\-_$\]]/;
+
+function parseFilters (exp) {
+  var inSingle = false;
+  var inDouble = false;
+  var inTemplateString = false;
+  var inRegex = false;
+  var curly = 0;
+  var square = 0;
+  var paren = 0;
+  var lastFilterIndex = 0;
+  var c, prev, i, expression, filters;
+
+  for (i = 0; i < exp.length; i++) {
+    prev = c;
+    c = exp.charCodeAt(i);
+    if (inSingle) {
+      if (c === 0x27 && prev !== 0x5C) { inSingle = false; }
+    } else if (inDouble) {
+      if (c === 0x22 && prev !== 0x5C) { inDouble = false; }
+    } else if (inTemplateString) {
+      if (c === 0x60 && prev !== 0x5C) { inTemplateString = false; }
+    } else if (inRegex) {
+      if (c === 0x2f && prev !== 0x5C) { inRegex = false; }
+    } else if (
+      c === 0x7C && // pipe
+      exp.charCodeAt(i + 1) !== 0x7C &&
+      exp.charCodeAt(i - 1) !== 0x7C &&
+      !curly && !square && !paren
+    ) {
+      if (expression === undefined) {
+        // first filter, end of expression
+        lastFilterIndex = i + 1;
+        expression = exp.slice(0, i).trim();
+      } else {
+        pushFilter();
+      }
+    } else {
+      switch (c) {
+        case 0x22: inDouble = true; break         // "
+        case 0x27: inSingle = true; break         // '
+        case 0x60: inTemplateString = true; break // `
+        case 0x28: paren++; break                 // (
+        case 0x29: paren--; break                 // )
+        case 0x5B: square++; break                // [
+        case 0x5D: square--; break                // ]
+        case 0x7B: curly++; break                 // {
+        case 0x7D: curly--; break                 // }
+      }
+      if (c === 0x2f) { // /
+        var j = i - 1;
+        var p = (void 0);
+        // find first non-whitespace prev char
+        for (; j >= 0; j--) {
+          p = exp.charAt(j);
+          if (p !== ' ') { break }
+        }
+        if (!p || !validDivisionCharRE.test(p)) {
+          inRegex = true;
+        }
+      }
+    }
+  }
+
+  if (expression === undefined) {
+    expression = exp.slice(0, i).trim();
+  } else if (lastFilterIndex !== 0) {
+    pushFilter();
+  }
+
+  function pushFilter () {
+    (filters || (filters = [])).push(exp.slice(lastFilterIndex, i).trim());
+    lastFilterIndex = i + 1;
+  }
+
+  if (filters) {
+    for (i = 0; i < filters.length; i++) {
+      expression = wrapFilter(expression, filters[i]);
+    }
+  }
+
+  return expression
+}
+
+function wrapFilter (exp, filter) {
+  var i = filter.indexOf('(');
+  if (i < 0) {
+    // _f: resolveFilter
+    return ("_f(\"" + filter + "\")(" + exp + ")")
+  } else {
+    var name = filter.slice(0, i);
+    var args = filter.slice(i + 1);
+    return ("_f(\"" + name + "\")(" + exp + (args !== ')' ? ',' + args : args))
+  }
+}
+
+/*  */
+
+function baseWarn (msg) {
+  console.error(("[Vue compiler]: " + msg));
+}
+
+function pluckModuleFunction (
+  modules,
+  key
+) {
+  return modules
+    ? modules.map(function (m) { return m[key]; }).filter(function (_) { return _; })
+    : []
+}
+
+function addProp (el, name, value) {
+  (el.props || (el.props = [])).push({ name: name, value: value });
+  el.plain = false;
+}
+
+function addAttr (el, name, value) {
+  (el.attrs || (el.attrs = [])).push({ name: name, value: value });
+  el.plain = false;
+}
+
+// add a raw attr (use this in preTransforms)
+function addRawAttr (el, name, value) {
+  el.attrsMap[name] = value;
+  el.attrsList.push({ name: name, value: value });
+}
+
+function addDirective (
+  el,
+  name,
+  rawName,
+  value,
+  arg,
+  modifiers
+) {
+  (el.directives || (el.directives = [])).push({ name: name, rawName: rawName, value: value, arg: arg, modifiers: modifiers });
+  el.plain = false;
+}
+
+function addHandler (
+  el,
+  name,
+  value,
+  modifiers,
+  important,
+  warn
+) {
+  modifiers = modifiers || emptyObject;
+  // warn prevent and passive modifier
+  /* istanbul ignore if */
+  if (
+    "development" !== 'production' && warn &&
+    modifiers.prevent && modifiers.passive
+  ) {
+    warn(
+      'passive and prevent can\'t be used together. ' +
+      'Passive handler can\'t prevent default event.'
+    );
+  }
+
+  // check capture modifier
+  if (modifiers.capture) {
+    delete modifiers.capture;
+    name = '!' + name; // mark the event as captured
+  }
+  if (modifiers.once) {
+    delete modifiers.once;
+    name = '~' + name; // mark the event as once
+  }
+  /* istanbul ignore if */
+  if (modifiers.passive) {
+    delete modifiers.passive;
+    name = '&' + name; // mark the event as passive
+  }
+
+  // normalize click.right and click.middle since they don't actually fire
+  // this is technically browser-specific, but at least for now browsers are
+  // the only target envs that have right/middle clicks.
+  if (name === 'click') {
+    if (modifiers.right) {
+      name = 'contextmenu';
+      delete modifiers.right;
+    } else if (modifiers.middle) {
+      name = 'mouseup';
+    }
+  }
+
+  var events;
+  if (modifiers.native) {
+    delete modifiers.native;
+    events = el.nativeEvents || (el.nativeEvents = {});
+  } else {
+    events = el.events || (el.events = {});
+  }
+
+  var newHandler = {
+    value: value.trim()
+  };
+  if (modifiers !== emptyObject) {
+    newHandler.modifiers = modifiers;
+  }
+
+  var handlers = events[name];
+  /* istanbul ignore if */
+  if (Array.isArray(handlers)) {
+    important ? handlers.unshift(newHandler) : handlers.push(newHandler);
+  } else if (handlers) {
+    events[name] = important ? [newHandler, handlers] : [handlers, newHandler];
+  } else {
+    events[name] = newHandler;
+  }
+
+  el.plain = false;
+}
+
+function getBindingAttr (
+  el,
+  name,
+  getStatic
+) {
+  var dynamicValue =
+    getAndRemoveAttr(el, ':' + name) ||
+    getAndRemoveAttr(el, 'v-bind:' + name);
+  if (dynamicValue != null) {
+    return parseFilters(dynamicValue)
+  } else if (getStatic !== false) {
+    var staticValue = getAndRemoveAttr(el, name);
+    if (staticValue != null) {
+      return JSON.stringify(staticValue)
+    }
+  }
+}
+
+// note: this only removes the attr from the Array (attrsList) so that it
+// doesn't get processed by processAttrs.
+// By default it does NOT remove it from the map (attrsMap) because the map is
+// needed during codegen.
+function getAndRemoveAttr (
+  el,
+  name,
+  removeFromMap
+) {
+  var val;
+  if ((val = el.attrsMap[name]) != null) {
+    var list = el.attrsList;
+    for (var i = 0, l = list.length; i < l; i++) {
+      if (list[i].name === name) {
+        list.splice(i, 1);
+        break
+      }
+    }
+  }
+  if (removeFromMap) {
+    delete el.attrsMap[name];
+  }
+  return val
+}
+
+/*  */
+
+/**
+ * Cross-platform code generation for component v-model
+ */
+function genComponentModel (
+  el,
+  value,
+  modifiers
+) {
+  var ref = modifiers || {};
+  var number = ref.number;
+  var trim = ref.trim;
+
+  var baseValueExpression = '$$v';
+  var valueExpression = baseValueExpression;
+  if (trim) {
+    valueExpression =
+      "(typeof " + baseValueExpression + " === 'string'" +
+      "? " + baseValueExpression + ".trim()" +
+      ": " + baseValueExpression + ")";
+  }
+  if (number) {
+    valueExpression = "_n(" + valueExpression + ")";
+  }
+  var assignment = genAssignmentCode(value, valueExpression);
+
+  el.model = {
+    value: ("(" + value + ")"),
+    expression: ("\"" + value + "\""),
+    callback: ("function (" + baseValueExpression + ") {" + assignment + "}")
+  };
+}
+
+/**
+ * Cross-platform codegen helper for generating v-model value assignment code.
+ */
+function genAssignmentCode (
+  value,
+  assignment
+) {
+  var res = parseModel(value);
+  if (res.key === null) {
+    return (value + "=" + assignment)
+  } else {
+    return ("$set(" + (res.exp) + ", " + (res.key) + ", " + assignment + ")")
+  }
+}
+
+/**
+ * Parse a v-model expression into a base path and a final key segment.
+ * Handles both dot-path and possible square brackets.
+ *
+ * Possible cases:
+ *
+ * - test
+ * - test[key]
+ * - test[test1[key]]
+ * - test["a"][key]
+ * - xxx.test[a[a].test1[key]]
+ * - test.xxx.a["asa"][test1[key]]
+ *
+ */
+
+var len;
+var str;
+var chr;
+var index$1;
+var expressionPos;
+var expressionEndPos;
+
+
+
+function parseModel (val) {
+  // Fix https://github.com/vuejs/vue/pull/7730
+  // allow v-model="obj.val " (trailing whitespace)
+  val = val.trim();
+  len = val.length;
+
+  if (val.indexOf('[') < 0 || val.lastIndexOf(']') < len - 1) {
+    index$1 = val.lastIndexOf('.');
+    if (index$1 > -1) {
+      return {
+        exp: val.slice(0, index$1),
+        key: '"' + val.slice(index$1 + 1) + '"'
+      }
+    } else {
+      return {
+        exp: val,
+        key: null
+      }
+    }
+  }
+
+  str = val;
+  index$1 = expressionPos = expressionEndPos = 0;
+
+  while (!eof()) {
+    chr = next();
+    /* istanbul ignore if */
+    if (isStringStart(chr)) {
+      parseString(chr);
+    } else if (chr === 0x5B) {
+      parseBracket(chr);
+    }
+  }
+
+  return {
+    exp: val.slice(0, expressionPos),
+    key: val.slice(expressionPos + 1, expressionEndPos)
+  }
+}
+
+function next () {
+  return str.charCodeAt(++index$1)
+}
+
+function eof () {
+  return index$1 >= len
+}
+
+function isStringStart (chr) {
+  return chr === 0x22 || chr === 0x27
+}
+
+function parseBracket (chr) {
+  var inBracket = 1;
+  expressionPos = index$1;
+  while (!eof()) {
+    chr = next();
+    if (isStringStart(chr)) {
+      parseString(chr);
+      continue
+    }
+    if (chr === 0x5B) { inBracket++; }
+    if (chr === 0x5D) { inBracket--; }
+    if (inBracket === 0) {
+      expressionEndPos = index$1;
+      break
+    }
+  }
+}
+
+function parseString (chr) {
+  var stringQuote = chr;
+  while (!eof()) {
+    chr = next();
+    if (chr === stringQuote) {
+      break
+    }
+  }
+}
+
+/*  */
+
+var warn$1;
+
+// in some cases, the event used has to be determined at runtime
+// so we used some reserved tokens during compile.
+var RANGE_TOKEN = '__r';
+var CHECKBOX_RADIO_TOKEN = '__c';
+
+function model (
+  el,
+  dir,
+  _warn
+) {
+  warn$1 = _warn;
+  var value = dir.value;
+  var modifiers = dir.modifiers;
+  var tag = el.tag;
+  var type = el.attrsMap.type;
+
+  {
+    // inputs with type="file" are read only and setting the input's
+    // value will throw an error.
+    if (tag === 'input' && type === 'file') {
+      warn$1(
+        "<" + (el.tag) + " v-model=\"" + value + "\" type=\"file\">:\n" +
+        "File inputs are read only. Use a v-on:change listener instead."
+      );
+    }
+  }
+
+  if (el.component) {
+    genComponentModel(el, value, modifiers);
+    // component v-model doesn't need extra runtime
+    return false
+  } else if (tag === 'select') {
+    genSelect(el, value, modifiers);
+  } else if (tag === 'input' && type === 'checkbox') {
+    genCheckboxModel(el, value, modifiers);
+  } else if (tag === 'input' && type === 'radio') {
+    genRadioModel(el, value, modifiers);
+  } else if (tag === 'input' || tag === 'textarea') {
+    genDefaultModel(el, value, modifiers);
+  } else if (!config.isReservedTag(tag)) {
+    genComponentModel(el, value, modifiers);
+    // component v-model doesn't need extra runtime
+    return false
+  } else {
+    warn$1(
+      "<" + (el.tag) + " v-model=\"" + value + "\">: " +
+      "v-model is not supported on this element type. " +
+      'If you are working with contenteditable, it\'s recommended to ' +
+      'wrap a library dedicated for that purpose inside a custom component.'
+    );
+  }
+
+  // ensure runtime directive metadata
+  return true
+}
+
+function genCheckboxModel (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var valueBinding = getBindingAttr(el, 'value') || 'null';
+  var trueValueBinding = getBindingAttr(el, 'true-value') || 'true';
+  var falseValueBinding = getBindingAttr(el, 'false-value') || 'false';
+  addProp(el, 'checked',
+    "Array.isArray(" + value + ")" +
+    "?_i(" + value + "," + valueBinding + ")>-1" + (
+      trueValueBinding === 'true'
+        ? (":(" + value + ")")
+        : (":_q(" + value + "," + trueValueBinding + ")")
+    )
+  );
+  addHandler(el, 'change',
+    "var $$a=" + value + "," +
+        '$$el=$event.target,' +
+        "$$c=$$el.checked?(" + trueValueBinding + "):(" + falseValueBinding + ");" +
+    'if(Array.isArray($$a)){' +
+      "var $$v=" + (number ? '_n(' + valueBinding + ')' : valueBinding) + "," +
+          '$$i=_i($$a,$$v);' +
+      "if($$el.checked){$$i<0&&(" + (genAssignmentCode(value, '$$a.concat([$$v])')) + ")}" +
+      "else{$$i>-1&&(" + (genAssignmentCode(value, '$$a.slice(0,$$i).concat($$a.slice($$i+1))')) + ")}" +
+    "}else{" + (genAssignmentCode(value, '$$c')) + "}",
+    null, true
+  );
+}
+
+function genRadioModel (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var valueBinding = getBindingAttr(el, 'value') || 'null';
+  valueBinding = number ? ("_n(" + valueBinding + ")") : valueBinding;
+  addProp(el, 'checked', ("_q(" + value + "," + valueBinding + ")"));
+  addHandler(el, 'change', genAssignmentCode(value, valueBinding), null, true);
+}
+
+function genSelect (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var selectedVal = "Array.prototype.filter" +
+    ".call($event.target.options,function(o){return o.selected})" +
+    ".map(function(o){var val = \"_value\" in o ? o._value : o.value;" +
+    "return " + (number ? '_n(val)' : 'val') + "})";
+
+  var assignment = '$event.target.multiple ? $$selectedVal : $$selectedVal[0]';
+  var code = "var $$selectedVal = " + selectedVal + ";";
+  code = code + " " + (genAssignmentCode(value, assignment));
+  addHandler(el, 'change', code, null, true);
+}
+
+function genDefaultModel (
+  el,
+  value,
+  modifiers
+) {
+  var type = el.attrsMap.type;
+
+  // warn if v-bind:value conflicts with v-model
+  // except for inputs with v-bind:type
+  {
+    var value$1 = el.attrsMap['v-bind:value'] || el.attrsMap[':value'];
+    var typeBinding = el.attrsMap['v-bind:type'] || el.attrsMap[':type'];
+    if (value$1 && !typeBinding) {
+      var binding = el.attrsMap['v-bind:value'] ? 'v-bind:value' : ':value';
+      warn$1(
+        binding + "=\"" + value$1 + "\" conflicts with v-model on the same element " +
+        'because the latter already expands to a value binding internally'
+      );
+    }
+  }
+
+  var ref = modifiers || {};
+  var lazy = ref.lazy;
+  var number = ref.number;
+  var trim = ref.trim;
+  var needCompositionGuard = !lazy && type !== 'range';
+  var event = lazy
+    ? 'change'
+    : type === 'range'
+      ? RANGE_TOKEN
+      : 'input';
+
+  var valueExpression = '$event.target.value';
+  if (trim) {
+    valueExpression = "$event.target.value.trim()";
+  }
+  if (number) {
+    valueExpression = "_n(" + valueExpression + ")";
+  }
+
+  var code = genAssignmentCode(value, valueExpression);
+  if (needCompositionGuard) {
+    code = "if($event.target.composing)return;" + code;
+  }
+
+  addProp(el, 'value', ("(" + value + ")"));
+  addHandler(el, event, code, null, true);
+  if (trim || number) {
+    addHandler(el, 'blur', '$forceUpdate()');
+  }
+}
+
+/*  */
+
+// normalize v-model event tokens that can only be determined at runtime.
+// it's important to place the event as the first in the array because
+// the whole point is ensuring the v-model callback gets called before
+// user-attached handlers.
+function normalizeEvents (on) {
+  /* istanbul ignore if */
+  if (isDef(on[RANGE_TOKEN])) {
+    // IE input[type=range] only supports `change` event
+    var event = isIE ? 'change' : 'input';
+    on[event] = [].concat(on[RANGE_TOKEN], on[event] || []);
+    delete on[RANGE_TOKEN];
+  }
+  // This was originally intended to fix #4521 but no longer necessary
+  // after 2.5. Keeping it for backwards compat with generated code from < 2.4
+  /* istanbul ignore if */
+  if (isDef(on[CHECKBOX_RADIO_TOKEN])) {
+    on.change = [].concat(on[CHECKBOX_RADIO_TOKEN], on.change || []);
+    delete on[CHECKBOX_RADIO_TOKEN];
+  }
+}
+
+var target$1;
+
+function createOnceHandler (handler, event, capture) {
+  var _target = target$1; // save current target element in closure
+  return function onceHandler () {
+    var res = handler.apply(null, arguments);
+    if (res !== null) {
+      remove$2(event, onceHandler, capture, _target);
+    }
+  }
+}
+
+function add$1 (
+  event,
+  handler,
+  once$$1,
+  capture,
+  passive
+) {
+  handler = withMacroTask(handler);
+  if (once$$1) { handler = createOnceHandler(handler, event, capture); }
+  target$1.addEventListener(
+    event,
+    handler,
+    supportsPassive
+      ? { capture: capture, passive: passive }
+      : capture
+  );
+}
+
+function remove$2 (
+  event,
+  handler,
+  capture,
+  _target
+) {
+  (_target || target$1).removeEventListener(
+    event,
+    handler._withTask || handler,
+    capture
+  );
+}
+
+function updateDOMListeners (oldVnode, vnode) {
+  if (isUndef(oldVnode.data.on) && isUndef(vnode.data.on)) {
+    return
+  }
+  var on = vnode.data.on || {};
+  var oldOn = oldVnode.data.on || {};
+  target$1 = vnode.elm;
+  normalizeEvents(on);
+  updateListeners(on, oldOn, add$1, remove$2, vnode.context);
+  target$1 = undefined;
+}
+
+var events = {
+  create: updateDOMListeners,
+  update: updateDOMListeners
+}
+
+/*  */
+
+function updateDOMProps (oldVnode, vnode) {
+  if (isUndef(oldVnode.data.domProps) && isUndef(vnode.data.domProps)) {
+    return
+  }
+  var key, cur;
+  var elm = vnode.elm;
+  var oldProps = oldVnode.data.domProps || {};
+  var props = vnode.data.domProps || {};
+  // clone observed objects, as the user probably wants to mutate it
+  if (isDef(props.__ob__)) {
+    props = vnode.data.domProps = extend({}, props);
+  }
+
+  for (key in oldProps) {
+    if (isUndef(props[key])) {
+      elm[key] = '';
+    }
+  }
+  for (key in props) {
+    cur = props[key];
+    // ignore children if the node has textContent or innerHTML,
+    // as these will throw away existing DOM nodes and cause removal errors
+    // on subsequent patches (#3360)
+    if (key === 'textContent' || key === 'innerHTML') {
+      if (vnode.children) { vnode.children.length = 0; }
+      if (cur === oldProps[key]) { continue }
+      // #6601 work around Chrome version <= 55 bug where single textNode
+      // replaced by innerHTML/textContent retains its parentNode property
+      if (elm.childNodes.length === 1) {
+        elm.removeChild(elm.childNodes[0]);
+      }
+    }
+
+    if (key === 'value') {
+      // store value as _value as well since
+      // non-string values will be stringified
+      elm._value = cur;
+      // avoid resetting cursor position when value is the same
+      var strCur = isUndef(cur) ? '' : String(cur);
+      if (shouldUpdateValue(elm, strCur)) {
+        elm.value = strCur;
+      }
+    } else {
+      elm[key] = cur;
+    }
+  }
+}
+
+// check platforms/web/util/attrs.js acceptValue
+
+
+function shouldUpdateValue (elm, checkVal) {
+  return (!elm.composing && (
+    elm.tagName === 'OPTION' ||
+    isNotInFocusAndDirty(elm, checkVal) ||
+    isDirtyWithModifiers(elm, checkVal)
+  ))
+}
+
+function isNotInFocusAndDirty (elm, checkVal) {
+  // return true when textbox (.number and .trim) loses focus and its value is
+  // not equal to the updated value
+  var notInFocus = true;
+  // #6157
+  // work around IE bug when accessing document.activeElement in an iframe
+  try { notInFocus = document.activeElement !== elm; } catch (e) {}
+  return notInFocus && elm.value !== checkVal
+}
+
+function isDirtyWithModifiers (elm, newVal) {
+  var value = elm.value;
+  var modifiers = elm._vModifiers; // injected by v-model runtime
+  if (isDef(modifiers)) {
+    if (modifiers.lazy) {
+      // inputs with lazy should only be updated when not in focus
+      return false
+    }
+    if (modifiers.number) {
+      return toNumber(value) !== toNumber(newVal)
+    }
+    if (modifiers.trim) {
+      return value.trim() !== newVal.trim()
+    }
+  }
+  return value !== newVal
+}
+
+var domProps = {
+  create: updateDOMProps,
+  update: updateDOMProps
+}
+
+/*  */
+
+var parseStyleText = cached(function (cssText) {
+  var res = {};
+  var listDelimiter = /;(?![^(]*\))/g;
+  var propertyDelimiter = /:(.+)/;
+  cssText.split(listDelimiter).forEach(function (item) {
+    if (item) {
+      var tmp = item.split(propertyDelimiter);
+      tmp.length > 1 && (res[tmp[0].trim()] = tmp[1].trim());
+    }
+  });
+  return res
+});
+
+// merge static and dynamic style data on the same vnode
+function normalizeStyleData (data) {
+  var style = normalizeStyleBinding(data.style);
+  // static style is pre-processed into an object during compilation
+  // and is always a fresh object, so it's safe to merge into it
+  return data.staticStyle
+    ? extend(data.staticStyle, style)
+    : style
+}
+
+// normalize possible array / string values into Object
+function normalizeStyleBinding (bindingStyle) {
+  if (Array.isArray(bindingStyle)) {
+    return toObject(bindingStyle)
+  }
+  if (typeof bindingStyle === 'string') {
+    return parseStyleText(bindingStyle)
+  }
+  return bindingStyle
+}
+
+/**
+ * parent component style should be after child's
+ * so that parent component's style could override it
+ */
+function getStyle (vnode, checkChild) {
+  var res = {};
+  var styleData;
+
+  if (checkChild) {
+    var childNode = vnode;
+    while (childNode.componentInstance) {
+      childNode = childNode.componentInstance._vnode;
+      if (
+        childNode && childNode.data &&
+        (styleData = normalizeStyleData(childNode.data))
+      ) {
+        extend(res, styleData);
+      }
+    }
+  }
+
+  if ((styleData = normalizeStyleData(vnode.data))) {
+    extend(res, styleData);
+  }
+
+  var parentNode = vnode;
+  while ((parentNode = parentNode.parent)) {
+    if (parentNode.data && (styleData = normalizeStyleData(parentNode.data))) {
+      extend(res, styleData);
+    }
+  }
+  return res
+}
+
+/*  */
+
+var cssVarRE = /^--/;
+var importantRE = /\s*!important$/;
+var setProp = function (el, name, val) {
+  /* istanbul ignore if */
+  if (cssVarRE.test(name)) {
+    el.style.setProperty(name, val);
+  } else if (importantRE.test(val)) {
+    el.style.setProperty(name, val.replace(importantRE, ''), 'important');
+  } else {
+    var normalizedName = normalize(name);
+    if (Array.isArray(val)) {
+      // Support values array created by autoprefixer, e.g.
+      // {display: ["-webkit-box", "-ms-flexbox", "flex"]}
+      // Set them one by one, and the browser will only set those it can recognize
+      for (var i = 0, len = val.length; i < len; i++) {
+        el.style[normalizedName] = val[i];
+      }
+    } else {
+      el.style[normalizedName] = val;
+    }
+  }
+};
+
+var vendorNames = ['Webkit', 'Moz', 'ms'];
+
+var emptyStyle;
+var normalize = cached(function (prop) {
+  emptyStyle = emptyStyle || document.createElement('div').style;
+  prop = camelize(prop);
+  if (prop !== 'filter' && (prop in emptyStyle)) {
+    return prop
+  }
+  var capName = prop.charAt(0).toUpperCase() + prop.slice(1);
+  for (var i = 0; i < vendorNames.length; i++) {
+    var name = vendorNames[i] + capName;
+    if (name in emptyStyle) {
+      return name
+    }
+  }
+});
+
+function updateStyle (oldVnode, vnode) {
+  var data = vnode.data;
+  var oldData = oldVnode.data;
+
+  if (isUndef(data.staticStyle) && isUndef(data.style) &&
+    isUndef(oldData.staticStyle) && isUndef(oldData.style)
+  ) {
+    return
+  }
+
+  var cur, name;
+  var el = vnode.elm;
+  var oldStaticStyle = oldData.staticStyle;
+  var oldStyleBinding = oldData.normalizedStyle || oldData.style || {};
+
+  // if static style exists, stylebinding already merged into it when doing normalizeStyleData
+  var oldStyle = oldStaticStyle || oldStyleBinding;
+
+  var style = normalizeStyleBinding(vnode.data.style) || {};
+
+  // store normalized style under a different key for next diff
+  // make sure to clone it if it's reactive, since the user likely wants
+  // to mutate it.
+  vnode.data.normalizedStyle = isDef(style.__ob__)
+    ? extend({}, style)
+    : style;
+
+  var newStyle = getStyle(vnode, true);
+
+  for (name in oldStyle) {
+    if (isUndef(newStyle[name])) {
+      setProp(el, name, '');
+    }
+  }
+  for (name in newStyle) {
+    cur = newStyle[name];
+    if (cur !== oldStyle[name]) {
+      // ie9 setting to null has no effect, must use empty string
+      setProp(el, name, cur == null ? '' : cur);
+    }
+  }
+}
+
+var style = {
+  create: updateStyle,
+  update: updateStyle
+}
+
+/*  */
+
+/**
+ * Add class with compatibility for SVG since classList is not supported on
+ * SVG elements in IE
+ */
+function addClass (el, cls) {
+  /* istanbul ignore if */
+  if (!cls || !(cls = cls.trim())) {
+    return
+  }
+
+  /* istanbul ignore else */
+  if (el.classList) {
+    if (cls.indexOf(' ') > -1) {
+      cls.split(/\s+/).forEach(function (c) { return el.classList.add(c); });
+    } else {
+      el.classList.add(cls);
+    }
+  } else {
+    var cur = " " + (el.getAttribute('class') || '') + " ";
+    if (cur.indexOf(' ' + cls + ' ') < 0) {
+      el.setAttribute('class', (cur + cls).trim());
+    }
+  }
+}
+
+/**
+ * Remove class with compatibility for SVG since classList is not supported on
+ * SVG elements in IE
+ */
+function removeClass (el, cls) {
+  /* istanbul ignore if */
+  if (!cls || !(cls = cls.trim())) {
+    return
+  }
+
+  /* istanbul ignore else */
+  if (el.classList) {
+    if (cls.indexOf(' ') > -1) {
+      cls.split(/\s+/).forEach(function (c) { return el.classList.remove(c); });
+    } else {
+      el.classList.remove(cls);
+    }
+    if (!el.classList.length) {
+      el.removeAttribute('class');
+    }
+  } else {
+    var cur = " " + (el.getAttribute('class') || '') + " ";
+    var tar = ' ' + cls + ' ';
+    while (cur.indexOf(tar) >= 0) {
+      cur = cur.replace(tar, ' ');
+    }
+    cur = cur.trim();
+    if (cur) {
+      el.setAttribute('class', cur);
+    } else {
+      el.removeAttribute('class');
+    }
+  }
+}
+
+/*  */
+
+function resolveTransition (def) {
+  if (!def) {
+    return
+  }
+  /* istanbul ignore else */
+  if (typeof def === 'object') {
+    var res = {};
+    if (def.css !== false) {
+      extend(res, autoCssTransition(def.name || 'v'));
+    }
+    extend(res, def);
+    return res
+  } else if (typeof def === 'string') {
+    return autoCssTransition(def)
+  }
+}
+
+var autoCssTransition = cached(function (name) {
+  return {
+    enterClass: (name + "-enter"),
+    enterToClass: (name + "-enter-to"),
+    enterActiveClass: (name + "-enter-active"),
+    leaveClass: (name + "-leave"),
+    leaveToClass: (name + "-leave-to"),
+    leaveActiveClass: (name + "-leave-active")
+  }
+});
+
+var hasTransition = inBrowser && !isIE9;
+var TRANSITION = 'transition';
+var ANIMATION = 'animation';
+
+// Transition property/event sniffing
+var transitionProp = 'transition';
+var transitionEndEvent = 'transitionend';
+var animationProp = 'animation';
+var animationEndEvent = 'animationend';
+if (hasTransition) {
+  /* istanbul ignore if */
+  if (window.ontransitionend === undefined &&
+    window.onwebkittransitionend !== undefined
+  ) {
+    transitionProp = 'WebkitTransition';
+    transitionEndEvent = 'webkitTransitionEnd';
+  }
+  if (window.onanimationend === undefined &&
+    window.onwebkitanimationend !== undefined
+  ) {
+    animationProp = 'WebkitAnimation';
+    animationEndEvent = 'webkitAnimationEnd';
+  }
+}
+
+// binding to window is necessary to make hot reload work in IE in strict mode
+var raf = inBrowser
+  ? window.requestAnimationFrame
+    ? window.requestAnimationFrame.bind(window)
+    : setTimeout
+  : /* istanbul ignore next */ function (fn) { return fn(); };
+
+function nextFrame (fn) {
+  raf(function () {
+    raf(fn);
+  });
+}
+
+function addTransitionClass (el, cls) {
+  var transitionClasses = el._transitionClasses || (el._transitionClasses = []);
+  if (transitionClasses.indexOf(cls) < 0) {
+    transitionClasses.push(cls);
+    addClass(el, cls);
+  }
+}
+
+function removeTransitionClass (el, cls) {
+  if (el._transitionClasses) {
+    remove(el._transitionClasses, cls);
+  }
+  removeClass(el, cls);
+}
+
+function whenTransitionEnds (
+  el,
+  expectedType,
+  cb
+) {
+  var ref = getTransitionInfo(el, expectedType);
+  var type = ref.type;
+  var timeout = ref.timeout;
+  var propCount = ref.propCount;
+  if (!type) { return cb() }
+  var event = type === TRANSITION ? transitionEndEvent : animationEndEvent;
+  var ended = 0;
+  var end = function () {
+    el.removeEventListener(event, onEnd);
+    cb();
+  };
+  var onEnd = function (e) {
+    if (e.target === el) {
+      if (++ended >= propCount) {
+        end();
+      }
+    }
+  };
+  setTimeout(function () {
+    if (ended < propCount) {
+      end();
+    }
+  }, timeout + 1);
+  el.addEventListener(event, onEnd);
+}
+
+var transformRE = /\b(transform|all)(,|$)/;
+
+function getTransitionInfo (el, expectedType) {
+  var styles = window.getComputedStyle(el);
+  var transitionDelays = styles[transitionProp + 'Delay'].split(', ');
+  var transitionDurations = styles[transitionProp + 'Duration'].split(', ');
+  var transitionTimeout = getTimeout(transitionDelays, transitionDurations);
+  var animationDelays = styles[animationProp + 'Delay'].split(', ');
+  var animationDurations = styles[animationProp + 'Duration'].split(', ');
+  var animationTimeout = getTimeout(animationDelays, animationDurations);
+
+  var type;
+  var timeout = 0;
+  var propCount = 0;
+  /* istanbul ignore if */
+  if (expectedType === TRANSITION) {
+    if (transitionTimeout > 0) {
+      type = TRANSITION;
+      timeout = transitionTimeout;
+      propCount = transitionDurations.length;
+    }
+  } else if (expectedType === ANIMATION) {
+    if (animationTimeout > 0) {
+      type = ANIMATION;
+      timeout = animationTimeout;
+      propCount = animationDurations.length;
+    }
+  } else {
+    timeout = Math.max(transitionTimeout, animationTimeout);
+    type = timeout > 0
+      ? transitionTimeout > animationTimeout
+        ? TRANSITION
+        : ANIMATION
+      : null;
+    propCount = type
+      ? type === TRANSITION
+        ? transitionDurations.length
+        : animationDurations.length
+      : 0;
+  }
+  var hasTransform =
+    type === TRANSITION &&
+    transformRE.test(styles[transitionProp + 'Property']);
+  return {
+    type: type,
+    timeout: timeout,
+    propCount: propCount,
+    hasTransform: hasTransform
+  }
+}
+
+function getTimeout (delays, durations) {
+  /* istanbul ignore next */
+  while (delays.length < durations.length) {
+    delays = delays.concat(delays);
+  }
+
+  return Math.max.apply(null, durations.map(function (d, i) {
+    return toMs(d) + toMs(delays[i])
+  }))
+}
+
+function toMs (s) {
+  return Number(s.slice(0, -1)) * 1000
+}
+
+/*  */
+
+function enter (vnode, toggleDisplay) {
+  var el = vnode.elm;
+
+  // call leave callback now
+  if (isDef(el._leaveCb)) {
+    el._leaveCb.cancelled = true;
+    el._leaveCb();
+  }
+
+  var data = resolveTransition(vnode.data.transition);
+  if (isUndef(data)) {
+    return
+  }
+
+  /* istanbul ignore if */
+  if (isDef(el._enterCb) || el.nodeType !== 1) {
+    return
+  }
+
+  var css = data.css;
+  var type = data.type;
+  var enterClass = data.enterClass;
+  var enterToClass = data.enterToClass;
+  var enterActiveClass = data.enterActiveClass;
+  var appearClass = data.appearClass;
+  var appearToClass = data.appearToClass;
+  var appearActiveClass = data.appearActiveClass;
+  var beforeEnter = data.beforeEnter;
+  var enter = data.enter;
+  var afterEnter = data.afterEnter;
+  var enterCancelled = data.enterCancelled;
+  var beforeAppear = data.beforeAppear;
+  var appear = data.appear;
+  var afterAppear = data.afterAppear;
+  var appearCancelled = data.appearCancelled;
+  var duration = data.duration;
+
+  // activeInstance will always be the <transition> component managing this
+  // transition. One edge case to check is when the <transition> is placed
+  // as the root node of a child component. In that case we need to check
+  // <transition>'s parent for appear check.
+  var context = activeInstance;
+  var transitionNode = activeInstance.$vnode;
+  while (transitionNode && transitionNode.parent) {
+    transitionNode = transitionNode.parent;
+    context = transitionNode.context;
+  }
+
+  var isAppear = !context._isMounted || !vnode.isRootInsert;
+
+  if (isAppear && !appear && appear !== '') {
+    return
+  }
+
+  var startClass = isAppear && appearClass
+    ? appearClass
+    : enterClass;
+  var activeClass = isAppear && appearActiveClass
+    ? appearActiveClass
+    : enterActiveClass;
+  var toClass = isAppear && appearToClass
+    ? appearToClass
+    : enterToClass;
+
+  var beforeEnterHook = isAppear
+    ? (beforeAppear || beforeEnter)
+    : beforeEnter;
+  var enterHook = isAppear
+    ? (typeof appear === 'function' ? appear : enter)
+    : enter;
+  var afterEnterHook = isAppear
+    ? (afterAppear || afterEnter)
+    : afterEnter;
+  var enterCancelledHook = isAppear
+    ? (appearCancelled || enterCancelled)
+    : enterCancelled;
+
+  var explicitEnterDuration = toNumber(
+    isObject(duration)
+      ? duration.enter
+      : duration
+  );
+
+  if ("development" !== 'production' && explicitEnterDuration != null) {
+    checkDuration(explicitEnterDuration, 'enter', vnode);
+  }
+
+  var expectsCSS = css !== false && !isIE9;
+  var userWantsControl = getHookArgumentsLength(enterHook);
+
+  var cb = el._enterCb = once(function () {
+    if (expectsCSS) {
+      removeTransitionClass(el, toClass);
+      removeTransitionClass(el, activeClass);
+    }
+    if (cb.cancelled) {
+      if (expectsCSS) {
+        removeTransitionClass(el, startClass);
+      }
+      enterCancelledHook && enterCancelledHook(el);
+    } else {
+      afterEnterHook && afterEnterHook(el);
+    }
+    el._enterCb = null;
+  });
+
+  if (!vnode.data.show) {
+    // remove pending leave element on enter by injecting an insert hook
+    mergeVNodeHook(vnode, 'insert', function () {
+      var parent = el.parentNode;
+      var pendingNode = parent && parent._pending && parent._pending[vnode.key];
+      if (pendingNode &&
+        pendingNode.tag === vnode.tag &&
+        pendingNode.elm._leaveCb
+      ) {
+        pendingNode.elm._leaveCb();
+      }
+      enterHook && enterHook(el, cb);
+    });
+  }
+
+  // start enter transition
+  beforeEnterHook && beforeEnterHook(el);
+  if (expectsCSS) {
+    addTransitionClass(el, startClass);
+    addTransitionClass(el, activeClass);
+    nextFrame(function () {
+      removeTransitionClass(el, startClass);
+      if (!cb.cancelled) {
+        addTransitionClass(el, toClass);
+        if (!userWantsControl) {
+          if (isValidDuration(explicitEnterDuration)) {
+            setTimeout(cb, explicitEnterDuration);
+          } else {
+            whenTransitionEnds(el, type, cb);
+          }
+        }
+      }
+    });
+  }
+
+  if (vnode.data.show) {
+    toggleDisplay && toggleDisplay();
+    enterHook && enterHook(el, cb);
+  }
+
+  if (!expectsCSS && !userWantsControl) {
+    cb();
+  }
+}
+
+function leave (vnode, rm) {
+  var el = vnode.elm;
+
+  // call enter callback now
+  if (isDef(el._enterCb)) {
+    el._enterCb.cancelled = true;
+    el._enterCb();
+  }
+
+  var data = resolveTransition(vnode.data.transition);
+  if (isUndef(data) || el.nodeType !== 1) {
+    return rm()
+  }
+
+  /* istanbul ignore if */
+  if (isDef(el._leaveCb)) {
+    return
+  }
+
+  var css = data.css;
+  var type = data.type;
+  var leaveClass = data.leaveClass;
+  var leaveToClass = data.leaveToClass;
+  var leaveActiveClass = data.leaveActiveClass;
+  var beforeLeave = data.beforeLeave;
+  var leave = data.leave;
+  var afterLeave = data.afterLeave;
+  var leaveCancelled = data.leaveCancelled;
+  var delayLeave = data.delayLeave;
+  var duration = data.duration;
+
+  var expectsCSS = css !== false && !isIE9;
+  var userWantsControl = getHookArgumentsLength(leave);
+
+  var explicitLeaveDuration = toNumber(
+    isObject(duration)
+      ? duration.leave
+      : duration
+  );
+
+  if ("development" !== 'production' && isDef(explicitLeaveDuration)) {
+    checkDuration(explicitLeaveDuration, 'leave', vnode);
+  }
+
+  var cb = el._leaveCb = once(function () {
+    if (el.parentNode && el.parentNode._pending) {
+      el.parentNode._pending[vnode.key] = null;
+    }
+    if (expectsCSS) {
+      removeTransitionClass(el, leaveToClass);
+      removeTransitionClass(el, leaveActiveClass);
+    }
+    if (cb.cancelled) {
+      if (expectsCSS) {
+        removeTransitionClass(el, leaveClass);
+      }
+      leaveCancelled && leaveCancelled(el);
+    } else {
+      rm();
+      afterLeave && afterLeave(el);
+    }
+    el._leaveCb = null;
+  });
+
+  if (delayLeave) {
+    delayLeave(performLeave);
+  } else {
+    performLeave();
+  }
+
+  function performLeave () {
+    // the delayed leave may have already been cancelled
+    if (cb.cancelled) {
+      return
+    }
+    // record leaving element
+    if (!vnode.data.show) {
+      (el.parentNode._pending || (el.parentNode._pending = {}))[(vnode.key)] = vnode;
+    }
+    beforeLeave && beforeLeave(el);
+    if (expectsCSS) {
+      addTransitionClass(el, leaveClass);
+      addTransitionClass(el, leaveActiveClass);
+      nextFrame(function () {
+        removeTransitionClass(el, leaveClass);
+        if (!cb.cancelled) {
+          addTransitionClass(el, leaveToClass);
+          if (!userWantsControl) {
+            if (isValidDuration(explicitLeaveDuration)) {
+              setTimeout(cb, explicitLeaveDuration);
+            } else {
+              whenTransitionEnds(el, type, cb);
+            }
+          }
+        }
+      });
+    }
+    leave && leave(el, cb);
+    if (!expectsCSS && !userWantsControl) {
+      cb();
+    }
+  }
+}
+
+// only used in dev mode
+function checkDuration (val, name, vnode) {
+  if (typeof val !== 'number') {
+    warn(
+      "<transition> explicit " + name + " duration is not a valid number - " +
+      "got " + (JSON.stringify(val)) + ".",
+      vnode.context
+    );
+  } else if (isNaN(val)) {
+    warn(
+      "<transition> explicit " + name + " duration is NaN - " +
+      'the duration expression might be incorrect.',
+      vnode.context
+    );
+  }
+}
+
+function isValidDuration (val) {
+  return typeof val === 'number' && !isNaN(val)
+}
+
+/**
+ * Normalize a transition hook's argument length. The hook may be:
+ * - a merged hook (invoker) with the original in .fns
+ * - a wrapped component method (check ._length)
+ * - a plain function (.length)
+ */
+function getHookArgumentsLength (fn) {
+  if (isUndef(fn)) {
+    return false
+  }
+  var invokerFns = fn.fns;
+  if (isDef(invokerFns)) {
+    // invoker
+    return getHookArgumentsLength(
+      Array.isArray(invokerFns)
+        ? invokerFns[0]
+        : invokerFns
+    )
+  } else {
+    return (fn._length || fn.length) > 1
+  }
+}
+
+function _enter (_, vnode) {
+  if (vnode.data.show !== true) {
+    enter(vnode);
+  }
+}
+
+var transition = inBrowser ? {
+  create: _enter,
+  activate: _enter,
+  remove: function remove$$1 (vnode, rm) {
+    /* istanbul ignore else */
+    if (vnode.data.show !== true) {
+      leave(vnode, rm);
+    } else {
+      rm();
+    }
+  }
+} : {}
+
+var platformModules = [
+  attrs,
+  klass,
+  events,
+  domProps,
+  style,
+  transition
+]
+
+/*  */
+
+// the directive module should be applied last, after all
+// built-in modules have been applied.
+var modules = platformModules.concat(baseModules);
+
+var patch = createPatchFunction({ nodeOps: nodeOps, modules: modules });
+
+/**
+ * Not type checking this file because flow doesn't like attaching
+ * properties to Elements.
+ */
+
+/* istanbul ignore if */
+if (isIE9) {
+  // http://www.matts411.com/post/internet-explorer-9-oninput/
+  document.addEventListener('selectionchange', function () {
+    var el = document.activeElement;
+    if (el && el.vmodel) {
+      trigger(el, 'input');
+    }
+  });
+}
+
+var directive = {
+  inserted: function inserted (el, binding, vnode, oldVnode) {
+    if (vnode.tag === 'select') {
+      // #6903
+      if (oldVnode.elm && !oldVnode.elm._vOptions) {
+        mergeVNodeHook(vnode, 'postpatch', function () {
+          directive.componentUpdated(el, binding, vnode);
+        });
+      } else {
+        setSelected(el, binding, vnode.context);
+      }
+      el._vOptions = [].map.call(el.options, getValue);
+    } else if (vnode.tag === 'textarea' || isTextInputType(el.type)) {
+      el._vModifiers = binding.modifiers;
+      if (!binding.modifiers.lazy) {
+        el.addEventListener('compositionstart', onCompositionStart);
+        el.addEventListener('compositionend', onCompositionEnd);
+        // Safari < 10.2 & UIWebView doesn't fire compositionend when
+        // switching focus before confirming composition choice
+        // this also fixes the issue where some browsers e.g. iOS Chrome
+        // fires "change" instead of "input" on autocomplete.
+        el.addEventListener('change', onCompositionEnd);
+        /* istanbul ignore if */
+        if (isIE9) {
+          el.vmodel = true;
+        }
+      }
+    }
+  },
+
+  componentUpdated: function componentUpdated (el, binding, vnode) {
+    if (vnode.tag === 'select') {
+      setSelected(el, binding, vnode.context);
+      // in case the options rendered by v-for have changed,
+      // it's possible that the value is out-of-sync with the rendered options.
+      // detect such cases and filter out values that no longer has a matching
+      // option in the DOM.
+      var prevOptions = el._vOptions;
+      var curOptions = el._vOptions = [].map.call(el.options, getValue);
+      if (curOptions.some(function (o, i) { return !looseEqual(o, prevOptions[i]); })) {
+        // trigger change event if
+        // no matching option found for at least one value
+        var needReset = el.multiple
+          ? binding.value.some(function (v) { return hasNoMatchingOption(v, curOptions); })
+          : binding.value !== binding.oldValue && hasNoMatchingOption(binding.value, curOptions);
+        if (needReset) {
+          trigger(el, 'change');
+        }
+      }
+    }
+  }
+};
+
+function setSelected (el, binding, vm) {
+  actuallySetSelected(el, binding, vm);
+  /* istanbul ignore if */
+  if (isIE || isEdge) {
+    setTimeout(function () {
+      actuallySetSelected(el, binding, vm);
+    }, 0);
+  }
+}
+
+function actuallySetSelected (el, binding, vm) {
+  var value = binding.value;
+  var isMultiple = el.multiple;
+  if (isMultiple && !Array.isArray(value)) {
+    "development" !== 'production' && warn(
+      "<select multiple v-model=\"" + (binding.expression) + "\"> " +
+      "expects an Array value for its binding, but got " + (Object.prototype.toString.call(value).slice(8, -1)),
+      vm
+    );
+    return
+  }
+  var selected, option;
+  for (var i = 0, l = el.options.length; i < l; i++) {
+    option = el.options[i];
+    if (isMultiple) {
+      selected = looseIndexOf(value, getValue(option)) > -1;
+      if (option.selected !== selected) {
+        option.selected = selected;
+      }
+    } else {
+      if (looseEqual(getValue(option), value)) {
+        if (el.selectedIndex !== i) {
+          el.selectedIndex = i;
+        }
+        return
+      }
+    }
+  }
+  if (!isMultiple) {
+    el.selectedIndex = -1;
+  }
+}
+
+function hasNoMatchingOption (value, options) {
+  return options.every(function (o) { return !looseEqual(o, value); })
+}
+
+function getValue (option) {
+  return '_value' in option
+    ? option._value
+    : option.value
+}
+
+function onCompositionStart (e) {
+  e.target.composing = true;
+}
+
+function onCompositionEnd (e) {
+  // prevent triggering an input event for no reason
+  if (!e.target.composing) { return }
+  e.target.composing = false;
+  trigger(e.target, 'input');
+}
+
+function trigger (el, type) {
+  var e = document.createEvent('HTMLEvents');
+  e.initEvent(type, true, true);
+  el.dispatchEvent(e);
+}
+
+/*  */
+
+// recursively search for possible transition defined inside the component root
+function locateNode (vnode) {
+  return vnode.componentInstance && (!vnode.data || !vnode.data.transition)
+    ? locateNode(vnode.componentInstance._vnode)
+    : vnode
+}
+
+var show = {
+  bind: function bind (el, ref, vnode) {
+    var value = ref.value;
+
+    vnode = locateNode(vnode);
+    var transition$$1 = vnode.data && vnode.data.transition;
+    var originalDisplay = el.__vOriginalDisplay =
+      el.style.display === 'none' ? '' : el.style.display;
+    if (value && transition$$1) {
+      vnode.data.show = true;
+      enter(vnode, function () {
+        el.style.display = originalDisplay;
+      });
+    } else {
+      el.style.display = value ? originalDisplay : 'none';
+    }
+  },
+
+  update: function update (el, ref, vnode) {
+    var value = ref.value;
+    var oldValue = ref.oldValue;
+
+    /* istanbul ignore if */
+    if (!value === !oldValue) { return }
+    vnode = locateNode(vnode);
+    var transition$$1 = vnode.data && vnode.data.transition;
+    if (transition$$1) {
+      vnode.data.show = true;
+      if (value) {
+        enter(vnode, function () {
+          el.style.display = el.__vOriginalDisplay;
+        });
+      } else {
+        leave(vnode, function () {
+          el.style.display = 'none';
+        });
+      }
+    } else {
+      el.style.display = value ? el.__vOriginalDisplay : 'none';
+    }
+  },
+
+  unbind: function unbind (
+    el,
+    binding,
+    vnode,
+    oldVnode,
+    isDestroy
+  ) {
+    if (!isDestroy) {
+      el.style.display = el.__vOriginalDisplay;
+    }
+  }
+}
+
+var platformDirectives = {
+  model: directive,
+  show: show
+}
+
+/*  */
+
+// Provides transition support for a single element/component.
+// supports transition mode (out-in / in-out)
+
+var transitionProps = {
+  name: String,
+  appear: Boolean,
+  css: Boolean,
+  mode: String,
+  type: String,
+  enterClass: String,
+  leaveClass: String,
+  enterToClass: String,
+  leaveToClass: String,
+  enterActiveClass: String,
+  leaveActiveClass: String,
+  appearClass: String,
+  appearActiveClass: String,
+  appearToClass: String,
+  duration: [Number, String, Object]
+};
+
+// in case the child is also an abstract component, e.g. <keep-alive>
+// we want to recursively retrieve the real component to be rendered
+function getRealChild (vnode) {
+  var compOptions = vnode && vnode.componentOptions;
+  if (compOptions && compOptions.Ctor.options.abstract) {
+    return getRealChild(getFirstComponentChild(compOptions.children))
+  } else {
+    return vnode
+  }
+}
+
+function extractTransitionData (comp) {
+  var data = {};
+  var options = comp.$options;
+  // props
+  for (var key in options.propsData) {
+    data[key] = comp[key];
+  }
+  // events.
+  // extract listeners and pass them directly to the transition methods
+  var listeners = options._parentListeners;
+  for (var key$1 in listeners) {
+    data[camelize(key$1)] = listeners[key$1];
+  }
+  return data
+}
+
+function placeholder (h, rawChild) {
+  if (/\d-keep-alive$/.test(rawChild.tag)) {
+    return h('keep-alive', {
+      props: rawChild.componentOptions.propsData
+    })
+  }
+}
+
+function hasParentTransition (vnode) {
+  while ((vnode = vnode.parent)) {
+    if (vnode.data.transition) {
+      return true
+    }
+  }
+}
+
+function isSameChild (child, oldChild) {
+  return oldChild.key === child.key && oldChild.tag === child.tag
+}
+
+var Transition = {
+  name: 'transition',
+  props: transitionProps,
+  abstract: true,
+
+  render: function render (h) {
+    var this$1 = this;
+
+    var children = this.$slots.default;
+    if (!children) {
+      return
+    }
+
+    // filter out text nodes (possible whitespaces)
+    children = children.filter(function (c) { return c.tag || isAsyncPlaceholder(c); });
+    /* istanbul ignore if */
+    if (!children.length) {
+      return
+    }
+
+    // warn multiple elements
+    if ("development" !== 'production' && children.length > 1) {
+      warn(
+        '<transition> can only be used on a single element. Use ' +
+        '<transition-group> for lists.',
+        this.$parent
+      );
+    }
+
+    var mode = this.mode;
+
+    // warn invalid mode
+    if ("development" !== 'production' &&
+      mode && mode !== 'in-out' && mode !== 'out-in'
+    ) {
+      warn(
+        'invalid <transition> mode: ' + mode,
+        this.$parent
+      );
+    }
+
+    var rawChild = children[0];
+
+    // if this is a component root node and the component's
+    // parent container node also has transition, skip.
+    if (hasParentTransition(this.$vnode)) {
+      return rawChild
+    }
+
+    // apply transition data to child
+    // use getRealChild() to ignore abstract components e.g. keep-alive
+    var child = getRealChild(rawChild);
+    /* istanbul ignore if */
+    if (!child) {
+      return rawChild
+    }
+
+    if (this._leaving) {
+      return placeholder(h, rawChild)
+    }
+
+    // ensure a key that is unique to the vnode type and to this transition
+    // component instance. This key will be used to remove pending leaving nodes
+    // during entering.
+    var id = "__transition-" + (this._uid) + "-";
+    child.key = child.key == null
+      ? child.isComment
+        ? id + 'comment'
+        : id + child.tag
+      : isPrimitive(child.key)
+        ? (String(child.key).indexOf(id) === 0 ? child.key : id + child.key)
+        : child.key;
+
+    var data = (child.data || (child.data = {})).transition = extractTransitionData(this);
+    var oldRawChild = this._vnode;
+    var oldChild = getRealChild(oldRawChild);
+
+    // mark v-show
+    // so that the transition module can hand over the control to the directive
+    if (child.data.directives && child.data.directives.some(function (d) { return d.name === 'show'; })) {
+      child.data.show = true;
+    }
+
+    if (
+      oldChild &&
+      oldChild.data &&
+      !isSameChild(child, oldChild) &&
+      !isAsyncPlaceholder(oldChild) &&
+      // #6687 component root is a comment node
+      !(oldChild.componentInstance && oldChild.componentInstance._vnode.isComment)
+    ) {
+      // replace old child transition data with fresh one
+      // important for dynamic transitions!
+      var oldData = oldChild.data.transition = extend({}, data);
+      // handle transition mode
+      if (mode === 'out-in') {
+        // return placeholder node and queue update when leave finishes
+        this._leaving = true;
+        mergeVNodeHook(oldData, 'afterLeave', function () {
+          this$1._leaving = false;
+          this$1.$forceUpdate();
+        });
+        return placeholder(h, rawChild)
+      } else if (mode === 'in-out') {
+        if (isAsyncPlaceholder(child)) {
+          return oldRawChild
+        }
+        var delayedLeave;
+        var performLeave = function () { delayedLeave(); };
+        mergeVNodeHook(data, 'afterEnter', performLeave);
+        mergeVNodeHook(data, 'enterCancelled', performLeave);
+        mergeVNodeHook(oldData, 'delayLeave', function (leave) { delayedLeave = leave; });
+      }
+    }
+
+    return rawChild
+  }
+}
+
+/*  */
+
+// Provides transition support for list items.
+// supports move transitions using the FLIP technique.
+
+// Because the vdom's children update algorithm is "unstable" - i.e.
+// it doesn't guarantee the relative positioning of removed elements,
+// we force transition-group to update its children into two passes:
+// in the first pass, we remove all nodes that need to be removed,
+// triggering their leaving transition; in the second pass, we insert/move
+// into the final desired state. This way in the second pass removed
+// nodes will remain where they should be.
+
+var props = extend({
+  tag: String,
+  moveClass: String
+}, transitionProps);
+
+delete props.mode;
+
+var TransitionGroup = {
+  props: props,
+
+  render: function render (h) {
+    var tag = this.tag || this.$vnode.data.tag || 'span';
+    var map = Object.create(null);
+    var prevChildren = this.prevChildren = this.children;
+    var rawChildren = this.$slots.default || [];
+    var children = this.children = [];
+    var transitionData = extractTransitionData(this);
+
+    for (var i = 0; i < rawChildren.length; i++) {
+      var c = rawChildren[i];
+      if (c.tag) {
+        if (c.key != null && String(c.key).indexOf('__vlist') !== 0) {
+          children.push(c);
+          map[c.key] = c
+          ;(c.data || (c.data = {})).transition = transitionData;
+        } else {
+          var opts = c.componentOptions;
+          var name = opts ? (opts.Ctor.options.name || opts.tag || '') : c.tag;
+          warn(("<transition-group> children must be keyed: <" + name + ">"));
+        }
+      }
+    }
+
+    if (prevChildren) {
+      var kept = [];
+      var removed = [];
+      for (var i$1 = 0; i$1 < prevChildren.length; i$1++) {
+        var c$1 = prevChildren[i$1];
+        c$1.data.transition = transitionData;
+        c$1.data.pos = c$1.elm.getBoundingClientRect();
+        if (map[c$1.key]) {
+          kept.push(c$1);
+        } else {
+          removed.push(c$1);
+        }
+      }
+      this.kept = h(tag, null, kept);
+      this.removed = removed;
+    }
+
+    return h(tag, null, children)
+  },
+
+  beforeUpdate: function beforeUpdate () {
+    // force removing pass
+    this.__patch__(
+      this._vnode,
+      this.kept,
+      false, // hydrating
+      true // removeOnly (!important, avoids unnecessary moves)
+    );
+    this._vnode = this.kept;
+  },
+
+  updated: function updated () {
+    var children = this.prevChildren;
+    var moveClass = this.moveClass || ((this.name || 'v') + '-move');
+    if (!children.length || !this.hasMove(children[0].elm, moveClass)) {
+      return
+    }
+
+    // we divide the work into three loops to avoid mixing DOM reads and writes
+    // in each iteration - which helps prevent layout thrashing.
+    children.forEach(callPendingCbs);
+    children.forEach(recordPosition);
+    children.forEach(applyTranslation);
+
+    // force reflow to put everything in position
+    // assign to this to avoid being removed in tree-shaking
+    // $flow-disable-line
+    this._reflow = document.body.offsetHeight;
+
+    children.forEach(function (c) {
+      if (c.data.moved) {
+        var el = c.elm;
+        var s = el.style;
+        addTransitionClass(el, moveClass);
+        s.transform = s.WebkitTransform = s.transitionDuration = '';
+        el.addEventListener(transitionEndEvent, el._moveCb = function cb (e) {
+          if (!e || /transform$/.test(e.propertyName)) {
+            el.removeEventListener(transitionEndEvent, cb);
+            el._moveCb = null;
+            removeTransitionClass(el, moveClass);
+          }
+        });
+      }
+    });
+  },
+
+  methods: {
+    hasMove: function hasMove (el, moveClass) {
+      /* istanbul ignore if */
+      if (!hasTransition) {
+        return false
+      }
+      /* istanbul ignore if */
+      if (this._hasMove) {
+        return this._hasMove
+      }
+      // Detect whether an element with the move class applied has
+      // CSS transitions. Since the element may be inside an entering
+      // transition at this very moment, we make a clone of it and remove
+      // all other transition classes applied to ensure only the move class
+      // is applied.
+      var clone = el.cloneNode();
+      if (el._transitionClasses) {
+        el._transitionClasses.forEach(function (cls) { removeClass(clone, cls); });
+      }
+      addClass(clone, moveClass);
+      clone.style.display = 'none';
+      this.$el.appendChild(clone);
+      var info = getTransitionInfo(clone);
+      this.$el.removeChild(clone);
+      return (this._hasMove = info.hasTransform)
+    }
+  }
+}
+
+function callPendingCbs (c) {
+  /* istanbul ignore if */
+  if (c.elm._moveCb) {
+    c.elm._moveCb();
+  }
+  /* istanbul ignore if */
+  if (c.elm._enterCb) {
+    c.elm._enterCb();
+  }
+}
+
+function recordPosition (c) {
+  c.data.newPos = c.elm.getBoundingClientRect();
+}
+
+function applyTranslation (c) {
+  var oldPos = c.data.pos;
+  var newPos = c.data.newPos;
+  var dx = oldPos.left - newPos.left;
+  var dy = oldPos.top - newPos.top;
+  if (dx || dy) {
+    c.data.moved = true;
+    var s = c.elm.style;
+    s.transform = s.WebkitTransform = "translate(" + dx + "px," + dy + "px)";
+    s.transitionDuration = '0s';
+  }
+}
+
+var platformComponents = {
+  Transition: Transition,
+  TransitionGroup: TransitionGroup
+}
+
+/*  */
+
+// install platform specific utils
+Vue.config.mustUseProp = mustUseProp;
+Vue.config.isReservedTag = isReservedTag;
+Vue.config.isReservedAttr = isReservedAttr;
+Vue.config.getTagNamespace = getTagNamespace;
+Vue.config.isUnknownElement = isUnknownElement;
+
+// install platform runtime directives & components
+extend(Vue.options.directives, platformDirectives);
+extend(Vue.options.components, platformComponents);
+
+// install platform patch function
+Vue.prototype.__patch__ = inBrowser ? patch : noop;
+
+// public mount method
+Vue.prototype.$mount = function (
+  el,
+  hydrating
+) {
+  el = el && inBrowser ? query(el) : undefined;
+  return mountComponent(this, el, hydrating)
+};
+
+// devtools global hook
+/* istanbul ignore next */
+if (inBrowser) {
+  setTimeout(function () {
+    if (config.devtools) {
+      if (devtools) {
+        devtools.emit('init', Vue);
+      } else if (
+        "development" !== 'production' &&
+        "development" !== 'test' &&
+        isChrome
+      ) {
+        console[console.info ? 'info' : 'log'](
+          'Download the Vue Devtools extension for a better development experience:\n' +
+          'https://github.com/vuejs/vue-devtools'
+        );
+      }
+    }
+    if ("development" !== 'production' &&
+      "development" !== 'test' &&
+      config.productionTip !== false &&
+      typeof console !== 'undefined'
+    ) {
+      console[console.info ? 'info' : 'log'](
+        "You are running Vue in development mode.\n" +
+        "Make sure to turn on production mode when deploying for production.\n" +
+        "See more tips at https://vuejs.org/guide/deployment.html"
+      );
+    }
+  }, 0);
+}
+
+/*  */
+
+var defaultTagRE = /\{\{((?:.|\n)+?)\}\}/g;
+var regexEscapeRE = /[-.*+?^${}()|[\]\/\\]/g;
+
+var buildRegex = cached(function (delimiters) {
+  var open = delimiters[0].replace(regexEscapeRE, '\\$&');
+  var close = delimiters[1].replace(regexEscapeRE, '\\$&');
+  return new RegExp(open + '((?:.|\\n)+?)' + close, 'g')
+});
+
+
+
+function parseText (
+  text,
+  delimiters
+) {
+  var tagRE = delimiters ? buildRegex(delimiters) : defaultTagRE;
+  if (!tagRE.test(text)) {
+    return
+  }
+  var tokens = [];
+  var rawTokens = [];
+  var lastIndex = tagRE.lastIndex = 0;
+  var match, index, tokenValue;
+  while ((match = tagRE.exec(text))) {
+    index = match.index;
+    // push text token
+    if (index > lastIndex) {
+      rawTokens.push(tokenValue = text.slice(lastIndex, index));
+      tokens.push(JSON.stringify(tokenValue));
+    }
+    // tag token
+    var exp = parseFilters(match[1].trim());
+    tokens.push(("_s(" + exp + ")"));
+    rawTokens.push({ '@binding': exp });
+    lastIndex = index + match[0].length;
+  }
+  if (lastIndex < text.length) {
+    rawTokens.push(tokenValue = text.slice(lastIndex));
+    tokens.push(JSON.stringify(tokenValue));
+  }
+  return {
+    expression: tokens.join('+'),
+    tokens: rawTokens
+  }
+}
+
+/*  */
+
+function transformNode (el, options) {
+  var warn = options.warn || baseWarn;
+  var staticClass = getAndRemoveAttr(el, 'class');
+  if ("development" !== 'production' && staticClass) {
+    var res = parseText(staticClass, options.delimiters);
+    if (res) {
+      warn(
+        "class=\"" + staticClass + "\": " +
+        'Interpolation inside attributes has been removed. ' +
+        'Use v-bind or the colon shorthand instead. For example, ' +
+        'instead of <div class="{{ val }}">, use <div :class="val">.'
+      );
+    }
+  }
+  if (staticClass) {
+    el.staticClass = JSON.stringify(staticClass);
+  }
+  var classBinding = getBindingAttr(el, 'class', false /* getStatic */);
+  if (classBinding) {
+    el.classBinding = classBinding;
+  }
+}
+
+function genData (el) {
+  var data = '';
+  if (el.staticClass) {
+    data += "staticClass:" + (el.staticClass) + ",";
+  }
+  if (el.classBinding) {
+    data += "class:" + (el.classBinding) + ",";
+  }
+  return data
+}
+
+var klass$1 = {
+  staticKeys: ['staticClass'],
+  transformNode: transformNode,
+  genData: genData
+}
+
+/*  */
+
+function transformNode$1 (el, options) {
+  var warn = options.warn || baseWarn;
+  var staticStyle = getAndRemoveAttr(el, 'style');
+  if (staticStyle) {
+    /* istanbul ignore if */
+    {
+      var res = parseText(staticStyle, options.delimiters);
+      if (res) {
+        warn(
+          "style=\"" + staticStyle + "\": " +
+          'Interpolation inside attributes has been removed. ' +
+          'Use v-bind or the colon shorthand instead. For example, ' +
+          'instead of <div style="{{ val }}">, use <div :style="val">.'
+        );
+      }
+    }
+    el.staticStyle = JSON.stringify(parseStyleText(staticStyle));
+  }
+
+  var styleBinding = getBindingAttr(el, 'style', false /* getStatic */);
+  if (styleBinding) {
+    el.styleBinding = styleBinding;
+  }
+}
+
+function genData$1 (el) {
+  var data = '';
+  if (el.staticStyle) {
+    data += "staticStyle:" + (el.staticStyle) + ",";
+  }
+  if (el.styleBinding) {
+    data += "style:(" + (el.styleBinding) + "),";
+  }
+  return data
+}
+
+var style$1 = {
+  staticKeys: ['staticStyle'],
+  transformNode: transformNode$1,
+  genData: genData$1
+}
+
+/*  */
+
+var decoder;
+
+var he = {
+  decode: function decode (html) {
+    decoder = decoder || document.createElement('div');
+    decoder.innerHTML = html;
+    return decoder.textContent
+  }
+}
+
+/*  */
+
+var isUnaryTag = makeMap(
+  'area,base,br,col,embed,frame,hr,img,input,isindex,keygen,' +
+  'link,meta,param,source,track,wbr'
+);
+
+// Elements that you can, intentionally, leave open
+// (and which close themselves)
+var canBeLeftOpenTag = makeMap(
+  'colgroup,dd,dt,li,options,p,td,tfoot,th,thead,tr,source'
+);
+
+// HTML5 tags https://html.spec.whatwg.org/multipage/indices.html#elements-3
+// Phrasing Content https://html.spec.whatwg.org/multipage/dom.html#phrasing-content
+var isNonPhrasingTag = makeMap(
+  'address,article,aside,base,blockquote,body,caption,col,colgroup,dd,' +
+  'details,dialog,div,dl,dt,fieldset,figcaption,figure,footer,form,' +
+  'h1,h2,h3,h4,h5,h6,head,header,hgroup,hr,html,legend,li,menuitem,meta,' +
+  'optgroup,option,param,rp,rt,source,style,summary,tbody,td,tfoot,th,thead,' +
+  'title,tr,track'
+);
+
+/**
+ * Not type-checking this file because it's mostly vendor code.
+ */
+
+/*!
+ * HTML Parser By John Resig (ejohn.org)
+ * Modified by Juriy "kangax" Zaytsev
+ * Original code by Erik Arvidsson, Mozilla Public License
+ * http://erik.eae.net/simplehtmlparser/simplehtmlparser.js
+ */
+
+// Regular Expressions for parsing tags and attributes
+var attribute = /^\s*([^\s"'<>\/=]+)(?:\s*(=)\s*(?:"([^"]*)"+|'([^']*)'+|([^\s"'=<>`]+)))?/;
+// could use https://www.w3.org/TR/1999/REC-xml-names-19990114/#NT-QName
+// but for Vue templates we can enforce a simple charset
+var ncname = '[a-zA-Z_][\\w\\-\\.]*';
+var qnameCapture = "((?:" + ncname + "\\:)?" + ncname + ")";
+var startTagOpen = new RegExp(("^<" + qnameCapture));
+var startTagClose = /^\s*(\/?)>/;
+var endTag = new RegExp(("^<\\/" + qnameCapture + "[^>]*>"));
+var doctype = /^<!DOCTYPE [^>]+>/i;
+// #7298: escape - to avoid being pased as HTML comment when inlined in page
+var comment = /^<!\--/;
+var conditionalComment = /^<!\[/;
+
+var IS_REGEX_CAPTURING_BROKEN = false;
+'x'.replace(/x(.)?/g, function (m, g) {
+  IS_REGEX_CAPTURING_BROKEN = g === '';
+});
+
+// Special Elements (can contain anything)
+var isPlainTextElement = makeMap('script,style,textarea', true);
+var reCache = {};
+
+var decodingMap = {
+  '&lt;': '<',
+  '&gt;': '>',
+  '&quot;': '"',
+  '&amp;': '&',
+  '&#10;': '\n',
+  '&#9;': '\t'
+};
+var encodedAttr = /&(?:lt|gt|quot|amp);/g;
+var encodedAttrWithNewLines = /&(?:lt|gt|quot|amp|#10|#9);/g;
+
+// #5992
+var isIgnoreNewlineTag = makeMap('pre,textarea', true);
+var shouldIgnoreFirstNewline = function (tag, html) { return tag && isIgnoreNewlineTag(tag) && html[0] === '\n'; };
+
+function decodeAttr (value, shouldDecodeNewlines) {
+  var re = shouldDecodeNewlines ? encodedAttrWithNewLines : encodedAttr;
+  return value.replace(re, function (match) { return decodingMap[match]; })
+}
+
+function parseHTML (html, options) {
+  var stack = [];
+  var expectHTML = options.expectHTML;
+  var isUnaryTag$$1 = options.isUnaryTag || no;
+  var canBeLeftOpenTag$$1 = options.canBeLeftOpenTag || no;
+  var index = 0;
+  var last, lastTag;
+  while (html) {
+    last = html;
+    // Make sure we're not in a plaintext content element like script/style
+    if (!lastTag || !isPlainTextElement(lastTag)) {
+      var textEnd = html.indexOf('<');
+      if (textEnd === 0) {
+        // Comment:
+        if (comment.test(html)) {
+          var commentEnd = html.indexOf('-->');
+
+          if (commentEnd >= 0) {
+            if (options.shouldKeepComment) {
+              options.comment(html.substring(4, commentEnd));
+            }
+            advance(commentEnd + 3);
+            continue
+          }
+        }
+
+        // http://en.wikipedia.org/wiki/Conditional_comment#Downlevel-revealed_conditional_comment
+        if (conditionalComment.test(html)) {
+          var conditionalEnd = html.indexOf(']>');
+
+          if (conditionalEnd >= 0) {
+            advance(conditionalEnd + 2);
+            continue
+          }
+        }
+
+        // Doctype:
+        var doctypeMatch = html.match(doctype);
+        if (doctypeMatch) {
+          advance(doctypeMatch[0].length);
+          continue
+        }
+
+        // End tag:
+        var endTagMatch = html.match(endTag);
+        if (endTagMatch) {
+          var curIndex = index;
+          advance(endTagMatch[0].length);
+          parseEndTag(endTagMatch[1], curIndex, index);
+          continue
+        }
+
+        // Start tag:
+        var startTagMatch = parseStartTag();
+        if (startTagMatch) {
+          handleStartTag(startTagMatch);
+          if (shouldIgnoreFirstNewline(lastTag, html)) {
+            advance(1);
+          }
+          continue
+        }
+      }
+
+      var text = (void 0), rest = (void 0), next = (void 0);
+      if (textEnd >= 0) {
+        rest = html.slice(textEnd);
+        while (
+          !endTag.test(rest) &&
+          !startTagOpen.test(rest) &&
+          !comment.test(rest) &&
+          !conditionalComment.test(rest)
+        ) {
+          // < in plain text, be forgiving and treat it as text
+          next = rest.indexOf('<', 1);
+          if (next < 0) { break }
+          textEnd += next;
+          rest = html.slice(textEnd);
+        }
+        text = html.substring(0, textEnd);
+        advance(textEnd);
+      }
+
+      if (textEnd < 0) {
+        text = html;
+        html = '';
+      }
+
+      if (options.chars && text) {
+        options.chars(text);
+      }
+    } else {
+      var endTagLength = 0;
+      var stackedTag = lastTag.toLowerCase();
+      var reStackedTag = reCache[stackedTag] || (reCache[stackedTag] = new RegExp('([\\s\\S]*?)(</' + stackedTag + '[^>]*>)', 'i'));
+      var rest$1 = html.replace(reStackedTag, function (all, text, endTag) {
+        endTagLength = endTag.length;
+        if (!isPlainTextElement(stackedTag) && stackedTag !== 'noscript') {
+          text = text
+            .replace(/<!\--([\s\S]*?)-->/g, '$1') // #7298
+            .replace(/<!\[CDATA\[([\s\S]*?)]]>/g, '$1');
+        }
+        if (shouldIgnoreFirstNewline(stackedTag, text)) {
+          text = text.slice(1);
+        }
+        if (options.chars) {
+          options.chars(text);
+        }
+        return ''
+      });
+      index += html.length - rest$1.length;
+      html = rest$1;
+      parseEndTag(stackedTag, index - endTagLength, index);
+    }
+
+    if (html === last) {
+      options.chars && options.chars(html);
+      if ("development" !== 'production' && !stack.length && options.warn) {
+        options.warn(("Mal-formatted tag at end of template: \"" + html + "\""));
+      }
+      break
+    }
+  }
+
+  // Clean up any remaining tags
+  parseEndTag();
+
+  function advance (n) {
+    index += n;
+    html = html.substring(n);
+  }
+
+  function parseStartTag () {
+    var start = html.match(startTagOpen);
+    if (start) {
+      var match = {
+        tagName: start[1],
+        attrs: [],
+        start: index
+      };
+      advance(start[0].length);
+      var end, attr;
+      while (!(end = html.match(startTagClose)) && (attr = html.match(attribute))) {
+        advance(attr[0].length);
+        match.attrs.push(attr);
+      }
+      if (end) {
+        match.unarySlash = end[1];
+        advance(end[0].length);
+        match.end = index;
+        return match
+      }
+    }
+  }
+
+  function handleStartTag (match) {
+    var tagName = match.tagName;
+    var unarySlash = match.unarySlash;
+
+    if (expectHTML) {
+      if (lastTag === 'p' && isNonPhrasingTag(tagName)) {
+        parseEndTag(lastTag);
+      }
+      if (canBeLeftOpenTag$$1(tagName) && lastTag === tagName) {
+        parseEndTag(tagName);
+      }
+    }
+
+    var unary = isUnaryTag$$1(tagName) || !!unarySlash;
+
+    var l = match.attrs.length;
+    var attrs = new Array(l);
+    for (var i = 0; i < l; i++) {
+      var args = match.attrs[i];
+      // hackish work around FF bug https://bugzilla.mozilla.org/show_bug.cgi?id=369778
+      if (IS_REGEX_CAPTURING_BROKEN && args[0].indexOf('""') === -1) {
+        if (args[3] === '') { delete args[3]; }
+        if (args[4] === '') { delete args[4]; }
+        if (args[5] === '') { delete args[5]; }
+      }
+      var value = args[3] || args[4] || args[5] || '';
+      var shouldDecodeNewlines = tagName === 'a' && args[1] === 'href'
+        ? options.shouldDecodeNewlinesForHref
+        : options.shouldDecodeNewlines;
+      attrs[i] = {
+        name: args[1],
+        value: decodeAttr(value, shouldDecodeNewlines)
+      };
+    }
+
+    if (!unary) {
+      stack.push({ tag: tagName, lowerCasedTag: tagName.toLowerCase(), attrs: attrs });
+      lastTag = tagName;
+    }
+
+    if (options.start) {
+      options.start(tagName, attrs, unary, match.start, match.end);
+    }
+  }
+
+  function parseEndTag (tagName, start, end) {
+    var pos, lowerCasedTagName;
+    if (start == null) { start = index; }
+    if (end == null) { end = index; }
+
+    if (tagName) {
+      lowerCasedTagName = tagName.toLowerCase();
+    }
+
+    // Find the closest opened tag of the same type
+    if (tagName) {
+      for (pos = stack.length - 1; pos >= 0; pos--) {
+        if (stack[pos].lowerCasedTag === lowerCasedTagName) {
+          break
+        }
+      }
+    } else {
+      // If no tag name is provided, clean shop
+      pos = 0;
+    }
+
+    if (pos >= 0) {
+      // Close all the open elements, up the stack
+      for (var i = stack.length - 1; i >= pos; i--) {
+        if ("development" !== 'production' &&
+          (i > pos || !tagName) &&
+          options.warn
+        ) {
+          options.warn(
+            ("tag <" + (stack[i].tag) + "> has no matching end tag.")
+          );
+        }
+        if (options.end) {
+          options.end(stack[i].tag, start, end);
+        }
+      }
+
+      // Remove the open elements from the stack
+      stack.length = pos;
+      lastTag = pos && stack[pos - 1].tag;
+    } else if (lowerCasedTagName === 'br') {
+      if (options.start) {
+        options.start(tagName, [], true, start, end);
+      }
+    } else if (lowerCasedTagName === 'p') {
+      if (options.start) {
+        options.start(tagName, [], false, start, end);
+      }
+      if (options.end) {
+        options.end(tagName, start, end);
+      }
+    }
+  }
+}
+
+/*  */
+
+var onRE = /^@|^v-on:/;
+var dirRE = /^v-|^@|^:/;
+var forAliasRE = /([^]*?)\s+(?:in|of)\s+([^]*)/;
+var forIteratorRE = /,([^,\}\]]*)(?:,([^,\}\]]*))?$/;
+var stripParensRE = /^\(|\)$/g;
+
+var argRE = /:(.*)$/;
+var bindRE = /^:|^v-bind:/;
+var modifierRE = /\.[^.]+/g;
+
+var decodeHTMLCached = cached(he.decode);
+
+// configurable state
+var warn$2;
+var delimiters;
+var transforms;
+var preTransforms;
+var postTransforms;
+var platformIsPreTag;
+var platformMustUseProp;
+var platformGetTagNamespace;
+
+
+
+function createASTElement (
+  tag,
+  attrs,
+  parent
+) {
+  return {
+    type: 1,
+    tag: tag,
+    attrsList: attrs,
+    attrsMap: makeAttrsMap(attrs),
+    parent: parent,
+    children: []
+  }
+}
+
+/**
+ * Convert HTML string to AST.
+ */
+function parse (
+  template,
+  options
+) {
+  warn$2 = options.warn || baseWarn;
+
+  platformIsPreTag = options.isPreTag || no;
+  platformMustUseProp = options.mustUseProp || no;
+  platformGetTagNamespace = options.getTagNamespace || no;
+
+  transforms = pluckModuleFunction(options.modules, 'transformNode');
+  preTransforms = pluckModuleFunction(options.modules, 'preTransformNode');
+  postTransforms = pluckModuleFunction(options.modules, 'postTransformNode');
+
+  delimiters = options.delimiters;
+
+  var stack = [];
+  var preserveWhitespace = options.preserveWhitespace !== false;
+  var root;
+  var currentParent;
+  var inVPre = false;
+  var inPre = false;
+  var warned = false;
+
+  function warnOnce (msg) {
+    if (!warned) {
+      warned = true;
+      warn$2(msg);
+    }
+  }
+
+  function closeElement (element) {
+    // check pre state
+    if (element.pre) {
+      inVPre = false;
+    }
+    if (platformIsPreTag(element.tag)) {
+      inPre = false;
+    }
+    // apply post-transforms
+    for (var i = 0; i < postTransforms.length; i++) {
+      postTransforms[i](element, options);
+    }
+  }
+
+  parseHTML(template, {
+    warn: warn$2,
+    expectHTML: options.expectHTML,
+    isUnaryTag: options.isUnaryTag,
+    canBeLeftOpenTag: options.canBeLeftOpenTag,
+    shouldDecodeNewlines: options.shouldDecodeNewlines,
+    shouldDecodeNewlinesForHref: options.shouldDecodeNewlinesForHref,
+    shouldKeepComment: options.comments,
+    start: function start (tag, attrs, unary) {
+      // check namespace.
+      // inherit parent ns if there is one
+      var ns = (currentParent && currentParent.ns) || platformGetTagNamespace(tag);
+
+      // handle IE svg bug
+      /* istanbul ignore if */
+      if (isIE && ns === 'svg') {
+        attrs = guardIESVGBug(attrs);
+      }
+
+      var element = createASTElement(tag, attrs, currentParent);
+      if (ns) {
+        element.ns = ns;
+      }
+
+      if (isForbiddenTag(element) && !isServerRendering()) {
+        element.forbidden = true;
+        "development" !== 'production' && warn$2(
+          'Templates should only be responsible for mapping the state to the ' +
+          'UI. Avoid placing tags with side-effects in your templates, such as ' +
+          "<" + tag + ">" + ', as they will not be parsed.'
+        );
+      }
+
+      // apply pre-transforms
+      for (var i = 0; i < preTransforms.length; i++) {
+        element = preTransforms[i](element, options) || element;
+      }
+
+      if (!inVPre) {
+        processPre(element);
+        if (element.pre) {
+          inVPre = true;
+        }
+      }
+      if (platformIsPreTag(element.tag)) {
+        inPre = true;
+      }
+      if (inVPre) {
+        processRawAttrs(element);
+      } else if (!element.processed) {
+        // structural directives
+        processFor(element);
+        processIf(element);
+        processOnce(element);
+        // element-scope stuff
+        processElement(element, options);
+      }
+
+      function checkRootConstraints (el) {
+        {
+          if (el.tag === 'slot' || el.tag === 'template') {
+            warnOnce(
+              "Cannot use <" + (el.tag) + "> as component root element because it may " +
+              'contain multiple nodes.'
+            );
+          }
+          if (el.attrsMap.hasOwnProperty('v-for')) {
+            warnOnce(
+              'Cannot use v-for on stateful component root element because ' +
+              'it renders multiple elements.'
+            );
+          }
+        }
+      }
+
+      // tree management
+      if (!root) {
+        root = element;
+        checkRootConstraints(root);
+      } else if (!stack.length) {
+        // allow root elements with v-if, v-else-if and v-else
+        if (root.if && (element.elseif || element.else)) {
+          checkRootConstraints(element);
+          addIfCondition(root, {
+            exp: element.elseif,
+            block: element
+          });
+        } else {
+          warnOnce(
+            "Component template should contain exactly one root element. " +
+            "If you are using v-if on multiple elements, " +
+            "use v-else-if to chain them instead."
+          );
+        }
+      }
+      if (currentParent && !element.forbidden) {
+        if (element.elseif || element.else) {
+          processIfConditions(element, currentParent);
+        } else if (element.slotScope) { // scoped slot
+          currentParent.plain = false;
+          var name = element.slotTarget || '"default"';(currentParent.scopedSlots || (currentParent.scopedSlots = {}))[name] = element;
+        } else {
+          currentParent.children.push(element);
+          element.parent = currentParent;
+        }
+      }
+      if (!unary) {
+        currentParent = element;
+        stack.push(element);
+      } else {
+        closeElement(element);
+      }
+    },
+
+    end: function end () {
+      // remove trailing whitespace
+      var element = stack[stack.length - 1];
+      var lastNode = element.children[element.children.length - 1];
+      if (lastNode && lastNode.type === 3 && lastNode.text === ' ' && !inPre) {
+        element.children.pop();
+      }
+      // pop stack
+      stack.length -= 1;
+      currentParent = stack[stack.length - 1];
+      closeElement(element);
+    },
+
+    chars: function chars (text) {
+      if (!currentParent) {
+        {
+          if (text === template) {
+            warnOnce(
+              'Component template requires a root element, rather than just text.'
+            );
+          } else if ((text = text.trim())) {
+            warnOnce(
+              ("text \"" + text + "\" outside root element will be ignored.")
+            );
+          }
+        }
+        return
+      }
+      // IE textarea placeholder bug
+      /* istanbul ignore if */
+      if (isIE &&
+        currentParent.tag === 'textarea' &&
+        currentParent.attrsMap.placeholder === text
+      ) {
+        return
+      }
+      var children = currentParent.children;
+      text = inPre || text.trim()
+        ? isTextTag(currentParent) ? text : decodeHTMLCached(text)
+        // only preserve whitespace if its not right after a starting tag
+        : preserveWhitespace && children.length ? ' ' : '';
+      if (text) {
+        var res;
+        if (!inVPre && text !== ' ' && (res = parseText(text, delimiters))) {
+          children.push({
+            type: 2,
+            expression: res.expression,
+            tokens: res.tokens,
+            text: text
+          });
+        } else if (text !== ' ' || !children.length || children[children.length - 1].text !== ' ') {
+          children.push({
+            type: 3,
+            text: text
+          });
+        }
+      }
+    },
+    comment: function comment (text) {
+      currentParent.children.push({
+        type: 3,
+        text: text,
+        isComment: true
+      });
+    }
+  });
+  return root
+}
+
+function processPre (el) {
+  if (getAndRemoveAttr(el, 'v-pre') != null) {
+    el.pre = true;
+  }
+}
+
+function processRawAttrs (el) {
+  var l = el.attrsList.length;
+  if (l) {
+    var attrs = el.attrs = new Array(l);
+    for (var i = 0; i < l; i++) {
+      attrs[i] = {
+        name: el.attrsList[i].name,
+        value: JSON.stringify(el.attrsList[i].value)
+      };
+    }
+  } else if (!el.pre) {
+    // non root node in pre blocks with no attributes
+    el.plain = true;
+  }
+}
+
+function processElement (element, options) {
+  processKey(element);
+
+  // determine whether this is a plain element after
+  // removing structural attributes
+  element.plain = !element.key && !element.attrsList.length;
+
+  processRef(element);
+  processSlot(element);
+  processComponent(element);
+  for (var i = 0; i < transforms.length; i++) {
+    element = transforms[i](element, options) || element;
+  }
+  processAttrs(element);
+}
+
+function processKey (el) {
+  var exp = getBindingAttr(el, 'key');
+  if (exp) {
+    if ("development" !== 'production' && el.tag === 'template') {
+      warn$2("<template> cannot be keyed. Place the key on real elements instead.");
+    }
+    el.key = exp;
+  }
+}
+
+function processRef (el) {
+  var ref = getBindingAttr(el, 'ref');
+  if (ref) {
+    el.ref = ref;
+    el.refInFor = checkInFor(el);
+  }
+}
+
+function processFor (el) {
+  var exp;
+  if ((exp = getAndRemoveAttr(el, 'v-for'))) {
+    var res = parseFor(exp);
+    if (res) {
+      extend(el, res);
+    } else {
+      warn$2(
+        ("Invalid v-for expression: " + exp)
+      );
+    }
+  }
+}
+
+
+
+function parseFor (exp) {
+  var inMatch = exp.match(forAliasRE);
+  if (!inMatch) { return }
+  var res = {};
+  res.for = inMatch[2].trim();
+  var alias = inMatch[1].trim().replace(stripParensRE, '');
+  var iteratorMatch = alias.match(forIteratorRE);
+  if (iteratorMatch) {
+    res.alias = alias.replace(forIteratorRE, '');
+    res.iterator1 = iteratorMatch[1].trim();
+    if (iteratorMatch[2]) {
+      res.iterator2 = iteratorMatch[2].trim();
+    }
+  } else {
+    res.alias = alias;
+  }
+  return res
+}
+
+function processIf (el) {
+  var exp = getAndRemoveAttr(el, 'v-if');
+  if (exp) {
+    el.if = exp;
+    addIfCondition(el, {
+      exp: exp,
+      block: el
+    });
+  } else {
+    if (getAndRemoveAttr(el, 'v-else') != null) {
+      el.else = true;
+    }
+    var elseif = getAndRemoveAttr(el, 'v-else-if');
+    if (elseif) {
+      el.elseif = elseif;
+    }
+  }
+}
+
+function processIfConditions (el, parent) {
+  var prev = findPrevElement(parent.children);
+  if (prev && prev.if) {
+    addIfCondition(prev, {
+      exp: el.elseif,
+      block: el
+    });
+  } else {
+    warn$2(
+      "v-" + (el.elseif ? ('else-if="' + el.elseif + '"') : 'else') + " " +
+      "used on element <" + (el.tag) + "> without corresponding v-if."
+    );
+  }
+}
+
+function findPrevElement (children) {
+  var i = children.length;
+  while (i--) {
+    if (children[i].type === 1) {
+      return children[i]
+    } else {
+      if ("development" !== 'production' && children[i].text !== ' ') {
+        warn$2(
+          "text \"" + (children[i].text.trim()) + "\" between v-if and v-else(-if) " +
+          "will be ignored."
+        );
+      }
+      children.pop();
+    }
+  }
+}
+
+function addIfCondition (el, condition) {
+  if (!el.ifConditions) {
+    el.ifConditions = [];
+  }
+  el.ifConditions.push(condition);
+}
+
+function processOnce (el) {
+  var once$$1 = getAndRemoveAttr(el, 'v-once');
+  if (once$$1 != null) {
+    el.once = true;
+  }
+}
+
+function processSlot (el) {
+  if (el.tag === 'slot') {
+    el.slotName = getBindingAttr(el, 'name');
+    if ("development" !== 'production' && el.key) {
+      warn$2(
+        "`key` does not work on <slot> because slots are abstract outlets " +
+        "and can possibly expand into multiple elements. " +
+        "Use the key on a wrapping element instead."
+      );
+    }
+  } else {
+    var slotScope;
+    if (el.tag === 'template') {
+      slotScope = getAndRemoveAttr(el, 'scope');
+      /* istanbul ignore if */
+      if ("development" !== 'production' && slotScope) {
+        warn$2(
+          "the \"scope\" attribute for scoped slots have been deprecated and " +
+          "replaced by \"slot-scope\" since 2.5. The new \"slot-scope\" attribute " +
+          "can also be used on plain elements in addition to <template> to " +
+          "denote scoped slots.",
+          true
+        );
+      }
+      el.slotScope = slotScope || getAndRemoveAttr(el, 'slot-scope');
+    } else if ((slotScope = getAndRemoveAttr(el, 'slot-scope'))) {
+      /* istanbul ignore if */
+      if ("development" !== 'production' && el.attrsMap['v-for']) {
+        warn$2(
+          "Ambiguous combined usage of slot-scope and v-for on <" + (el.tag) + "> " +
+          "(v-for takes higher priority). Use a wrapper <template> for the " +
+          "scoped slot to make it clearer.",
+          true
+        );
+      }
+      el.slotScope = slotScope;
+    }
+    var slotTarget = getBindingAttr(el, 'slot');
+    if (slotTarget) {
+      el.slotTarget = slotTarget === '""' ? '"default"' : slotTarget;
+      // preserve slot as an attribute for native shadow DOM compat
+      // only for non-scoped slots.
+      if (el.tag !== 'template' && !el.slotScope) {
+        addAttr(el, 'slot', slotTarget);
+      }
+    }
+  }
+}
+
+function processComponent (el) {
+  var binding;
+  if ((binding = getBindingAttr(el, 'is'))) {
+    el.component = binding;
+  }
+  if (getAndRemoveAttr(el, 'inline-template') != null) {
+    el.inlineTemplate = true;
+  }
+}
+
+function processAttrs (el) {
+  var list = el.attrsList;
+  var i, l, name, rawName, value, modifiers, isProp;
+  for (i = 0, l = list.length; i < l; i++) {
+    name = rawName = list[i].name;
+    value = list[i].value;
+    if (dirRE.test(name)) {
+      // mark element as dynamic
+      el.hasBindings = true;
+      // modifiers
+      modifiers = parseModifiers(name);
+      if (modifiers) {
+        name = name.replace(modifierRE, '');
+      }
+      if (bindRE.test(name)) { // v-bind
+        name = name.replace(bindRE, '');
+        value = parseFilters(value);
+        isProp = false;
+        if (modifiers) {
+          if (modifiers.prop) {
+            isProp = true;
+            name = camelize(name);
+            if (name === 'innerHtml') { name = 'innerHTML'; }
+          }
+          if (modifiers.camel) {
+            name = camelize(name);
+          }
+          if (modifiers.sync) {
+            addHandler(
+              el,
+              ("update:" + (camelize(name))),
+              genAssignmentCode(value, "$event")
+            );
+          }
+        }
+        if (isProp || (
+          !el.component && platformMustUseProp(el.tag, el.attrsMap.type, name)
+        )) {
+          addProp(el, name, value);
+        } else {
+          addAttr(el, name, value);
+        }
+      } else if (onRE.test(name)) { // v-on
+        name = name.replace(onRE, '');
+        addHandler(el, name, value, modifiers, false, warn$2);
+      } else { // normal directives
+        name = name.replace(dirRE, '');
+        // parse arg
+        var argMatch = name.match(argRE);
+        var arg = argMatch && argMatch[1];
+        if (arg) {
+          name = name.slice(0, -(arg.length + 1));
+        }
+        addDirective(el, name, rawName, value, arg, modifiers);
+        if ("development" !== 'production' && name === 'model') {
+          checkForAliasModel(el, value);
+        }
+      }
+    } else {
+      // literal attribute
+      {
+        var res = parseText(value, delimiters);
+        if (res) {
+          warn$2(
+            name + "=\"" + value + "\": " +
+            'Interpolation inside attributes has been removed. ' +
+            'Use v-bind or the colon shorthand instead. For example, ' +
+            'instead of <div id="{{ val }}">, use <div :id="val">.'
+          );
+        }
+      }
+      addAttr(el, name, JSON.stringify(value));
+      // #6887 firefox doesn't update muted state if set via attribute
+      // even immediately after element creation
+      if (!el.component &&
+          name === 'muted' &&
+          platformMustUseProp(el.tag, el.attrsMap.type, name)) {
+        addProp(el, name, 'true');
+      }
+    }
+  }
+}
+
+function checkInFor (el) {
+  var parent = el;
+  while (parent) {
+    if (parent.for !== undefined) {
+      return true
+    }
+    parent = parent.parent;
+  }
+  return false
+}
+
+function parseModifiers (name) {
+  var match = name.match(modifierRE);
+  if (match) {
+    var ret = {};
+    match.forEach(function (m) { ret[m.slice(1)] = true; });
+    return ret
+  }
+}
+
+function makeAttrsMap (attrs) {
+  var map = {};
+  for (var i = 0, l = attrs.length; i < l; i++) {
+    if (
+      "development" !== 'production' &&
+      map[attrs[i].name] && !isIE && !isEdge
+    ) {
+      warn$2('duplicate attribute: ' + attrs[i].name);
+    }
+    map[attrs[i].name] = attrs[i].value;
+  }
+  return map
+}
+
+// for script (e.g. type="x/template") or style, do not decode content
+function isTextTag (el) {
+  return el.tag === 'script' || el.tag === 'style'
+}
+
+function isForbiddenTag (el) {
+  return (
+    el.tag === 'style' ||
+    (el.tag === 'script' && (
+      !el.attrsMap.type ||
+      el.attrsMap.type === 'text/javascript'
+    ))
+  )
+}
+
+var ieNSBug = /^xmlns:NS\d+/;
+var ieNSPrefix = /^NS\d+:/;
+
+/* istanbul ignore next */
+function guardIESVGBug (attrs) {
+  var res = [];
+  for (var i = 0; i < attrs.length; i++) {
+    var attr = attrs[i];
+    if (!ieNSBug.test(attr.name)) {
+      attr.name = attr.name.replace(ieNSPrefix, '');
+      res.push(attr);
+    }
+  }
+  return res
+}
+
+function checkForAliasModel (el, value) {
+  var _el = el;
+  while (_el) {
+    if (_el.for && _el.alias === value) {
+      warn$2(
+        "<" + (el.tag) + " v-model=\"" + value + "\">: " +
+        "You are binding v-model directly to a v-for iteration alias. " +
+        "This will not be able to modify the v-for source array because " +
+        "writing to the alias is like modifying a function local variable. " +
+        "Consider using an array of objects and use v-model on an object property instead."
+      );
+    }
+    _el = _el.parent;
+  }
+}
+
+/*  */
+
+/**
+ * Expand input[v-model] with dyanmic type bindings into v-if-else chains
+ * Turn this:
+ *   <input v-model="data[type]" :type="type">
+ * into this:
+ *   <input v-if="type === 'checkbox'" type="checkbox" v-model="data[type]">
+ *   <input v-else-if="type === 'radio'" type="radio" v-model="data[type]">
+ *   <input v-else :type="type" v-model="data[type]">
+ */
+
+function preTransformNode (el, options) {
+  if (el.tag === 'input') {
+    var map = el.attrsMap;
+    if (!map['v-model']) {
+      return
+    }
+
+    var typeBinding;
+    if (map[':type'] || map['v-bind:type']) {
+      typeBinding = getBindingAttr(el, 'type');
+    }
+    if (!map.type && !typeBinding && map['v-bind']) {
+      typeBinding = "(" + (map['v-bind']) + ").type";
+    }
+
+    if (typeBinding) {
+      var ifCondition = getAndRemoveAttr(el, 'v-if', true);
+      var ifConditionExtra = ifCondition ? ("&&(" + ifCondition + ")") : "";
+      var hasElse = getAndRemoveAttr(el, 'v-else', true) != null;
+      var elseIfCondition = getAndRemoveAttr(el, 'v-else-if', true);
+      // 1. checkbox
+      var branch0 = cloneASTElement(el);
+      // process for on the main node
+      processFor(branch0);
+      addRawAttr(branch0, 'type', 'checkbox');
+      processElement(branch0, options);
+      branch0.processed = true; // prevent it from double-processed
+      branch0.if = "(" + typeBinding + ")==='checkbox'" + ifConditionExtra;
+      addIfCondition(branch0, {
+        exp: branch0.if,
+        block: branch0
+      });
+      // 2. add radio else-if condition
+      var branch1 = cloneASTElement(el);
+      getAndRemoveAttr(branch1, 'v-for', true);
+      addRawAttr(branch1, 'type', 'radio');
+      processElement(branch1, options);
+      addIfCondition(branch0, {
+        exp: "(" + typeBinding + ")==='radio'" + ifConditionExtra,
+        block: branch1
+      });
+      // 3. other
+      var branch2 = cloneASTElement(el);
+      getAndRemoveAttr(branch2, 'v-for', true);
+      addRawAttr(branch2, ':type', typeBinding);
+      processElement(branch2, options);
+      addIfCondition(branch0, {
+        exp: ifCondition,
+        block: branch2
+      });
+
+      if (hasElse) {
+        branch0.else = true;
+      } else if (elseIfCondition) {
+        branch0.elseif = elseIfCondition;
+      }
+
+      return branch0
+    }
+  }
+}
+
+function cloneASTElement (el) {
+  return createASTElement(el.tag, el.attrsList.slice(), el.parent)
+}
+
+var model$2 = {
+  preTransformNode: preTransformNode
+}
+
+var modules$1 = [
+  klass$1,
+  style$1,
+  model$2
+]
+
+/*  */
+
+function text (el, dir) {
+  if (dir.value) {
+    addProp(el, 'textContent', ("_s(" + (dir.value) + ")"));
+  }
+}
+
+/*  */
+
+function html (el, dir) {
+  if (dir.value) {
+    addProp(el, 'innerHTML', ("_s(" + (dir.value) + ")"));
+  }
+}
+
+var directives$1 = {
+  model: model,
+  text: text,
+  html: html
+}
+
+/*  */
+
+var baseOptions = {
+  expectHTML: true,
+  modules: modules$1,
+  directives: directives$1,
+  isPreTag: isPreTag,
+  isUnaryTag: isUnaryTag,
+  mustUseProp: mustUseProp,
+  canBeLeftOpenTag: canBeLeftOpenTag,
+  isReservedTag: isReservedTag,
+  getTagNamespace: getTagNamespace,
+  staticKeys: genStaticKeys(modules$1)
+};
+
+/*  */
+
+var isStaticKey;
+var isPlatformReservedTag;
+
+var genStaticKeysCached = cached(genStaticKeys$1);
+
+/**
+ * Goal of the optimizer: walk the generated template AST tree
+ * and detect sub-trees that are purely static, i.e. parts of
+ * the DOM that never needs to change.
+ *
+ * Once we detect these sub-trees, we can:
+ *
+ * 1. Hoist them into constants, so that we no longer need to
+ *    create fresh nodes for them on each re-render;
+ * 2. Completely skip them in the patching process.
+ */
+function optimize (root, options) {
+  if (!root) { return }
+  isStaticKey = genStaticKeysCached(options.staticKeys || '');
+  isPlatformReservedTag = options.isReservedTag || no;
+  // first pass: mark all non-static nodes.
+  markStatic$1(root);
+  // second pass: mark static roots.
+  markStaticRoots(root, false);
+}
+
+function genStaticKeys$1 (keys) {
+  return makeMap(
+    'type,tag,attrsList,attrsMap,plain,parent,children,attrs' +
+    (keys ? ',' + keys : '')
+  )
+}
+
+function markStatic$1 (node) {
+  node.static = isStatic(node);
+  if (node.type === 1) {
+    // do not make component slot content static. this avoids
+    // 1. components not able to mutate slot nodes
+    // 2. static slot content fails for hot-reloading
+    if (
+      !isPlatformReservedTag(node.tag) &&
+      node.tag !== 'slot' &&
+      node.attrsMap['inline-template'] == null
+    ) {
+      return
+    }
+    for (var i = 0, l = node.children.length; i < l; i++) {
+      var child = node.children[i];
+      markStatic$1(child);
+      if (!child.static) {
+        node.static = false;
+      }
+    }
+    if (node.ifConditions) {
+      for (var i$1 = 1, l$1 = node.ifConditions.length; i$1 < l$1; i$1++) {
+        var block = node.ifConditions[i$1].block;
+        markStatic$1(block);
+        if (!block.static) {
+          node.static = false;
+        }
+      }
+    }
+  }
+}
+
+function markStaticRoots (node, isInFor) {
+  if (node.type === 1) {
+    if (node.static || node.once) {
+      node.staticInFor = isInFor;
+    }
+    // For a node to qualify as a static root, it should have children that
+    // are not just static text. Otherwise the cost of hoisting out will
+    // outweigh the benefits and it's better off to just always render it fresh.
+    if (node.static && node.children.length && !(
+      node.children.length === 1 &&
+      node.children[0].type === 3
+    )) {
+      node.staticRoot = true;
+      return
+    } else {
+      node.staticRoot = false;
+    }
+    if (node.children) {
+      for (var i = 0, l = node.children.length; i < l; i++) {
+        markStaticRoots(node.children[i], isInFor || !!node.for);
+      }
+    }
+    if (node.ifConditions) {
+      for (var i$1 = 1, l$1 = node.ifConditions.length; i$1 < l$1; i$1++) {
+        markStaticRoots(node.ifConditions[i$1].block, isInFor);
+      }
+    }
+  }
+}
+
+function isStatic (node) {
+  if (node.type === 2) { // expression
+    return false
+  }
+  if (node.type === 3) { // text
+    return true
+  }
+  return !!(node.pre || (
+    !node.hasBindings && // no dynamic bindings
+    !node.if && !node.for && // not v-if or v-for or v-else
+    !isBuiltInTag(node.tag) && // not a built-in
+    isPlatformReservedTag(node.tag) && // not a component
+    !isDirectChildOfTemplateFor(node) &&
+    Object.keys(node).every(isStaticKey)
+  ))
+}
+
+function isDirectChildOfTemplateFor (node) {
+  while (node.parent) {
+    node = node.parent;
+    if (node.tag !== 'template') {
+      return false
+    }
+    if (node.for) {
+      return true
+    }
+  }
+  return false
+}
+
+/*  */
+
+var fnExpRE = /^([\w$_]+|\([^)]*?\))\s*=>|^function\s*\(/;
+var simplePathRE = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*|\['[^']*?']|\["[^"]*?"]|\[\d+]|\[[A-Za-z_$][\w$]*])*$/;
+
+// KeyboardEvent.keyCode aliases
+var keyCodes = {
+  esc: 27,
+  tab: 9,
+  enter: 13,
+  space: 32,
+  up: 38,
+  left: 37,
+  right: 39,
+  down: 40,
+  'delete': [8, 46]
+};
+
+// KeyboardEvent.key aliases
+var keyNames = {
+  esc: 'Escape',
+  tab: 'Tab',
+  enter: 'Enter',
+  space: ' ',
+  // #7806: IE11 uses key names without `Arrow` prefix for arrow keys.
+  up: ['Up', 'ArrowUp'],
+  left: ['Left', 'ArrowLeft'],
+  right: ['Right', 'ArrowRight'],
+  down: ['Down', 'ArrowDown'],
+  'delete': ['Backspace', 'Delete']
+};
+
+// #4868: modifiers that prevent the execution of the listener
+// need to explicitly return null so that we can determine whether to remove
+// the listener for .once
+var genGuard = function (condition) { return ("if(" + condition + ")return null;"); };
+
+var modifierCode = {
+  stop: '$event.stopPropagation();',
+  prevent: '$event.preventDefault();',
+  self: genGuard("$event.target !== $event.currentTarget"),
+  ctrl: genGuard("!$event.ctrlKey"),
+  shift: genGuard("!$event.shiftKey"),
+  alt: genGuard("!$event.altKey"),
+  meta: genGuard("!$event.metaKey"),
+  left: genGuard("'button' in $event && $event.button !== 0"),
+  middle: genGuard("'button' in $event && $event.button !== 1"),
+  right: genGuard("'button' in $event && $event.button !== 2")
+};
+
+function genHandlers (
+  events,
+  isNative,
+  warn
+) {
+  var res = isNative ? 'nativeOn:{' : 'on:{';
+  for (var name in events) {
+    res += "\"" + name + "\":" + (genHandler(name, events[name])) + ",";
+  }
+  return res.slice(0, -1) + '}'
+}
+
+function genHandler (
+  name,
+  handler
+) {
+  if (!handler) {
+    return 'function(){}'
+  }
+
+  if (Array.isArray(handler)) {
+    return ("[" + (handler.map(function (handler) { return genHandler(name, handler); }).join(',')) + "]")
+  }
+
+  var isMethodPath = simplePathRE.test(handler.value);
+  var isFunctionExpression = fnExpRE.test(handler.value);
+
+  if (!handler.modifiers) {
+    if (isMethodPath || isFunctionExpression) {
+      return handler.value
+    }
+    /* istanbul ignore if */
+    return ("function($event){" + (handler.value) + "}") // inline statement
+  } else {
+    var code = '';
+    var genModifierCode = '';
+    var keys = [];
+    for (var key in handler.modifiers) {
+      if (modifierCode[key]) {
+        genModifierCode += modifierCode[key];
+        // left/right
+        if (keyCodes[key]) {
+          keys.push(key);
+        }
+      } else if (key === 'exact') {
+        var modifiers = (handler.modifiers);
+        genModifierCode += genGuard(
+          ['ctrl', 'shift', 'alt', 'meta']
+            .filter(function (keyModifier) { return !modifiers[keyModifier]; })
+            .map(function (keyModifier) { return ("$event." + keyModifier + "Key"); })
+            .join('||')
+        );
+      } else {
+        keys.push(key);
+      }
+    }
+    if (keys.length) {
+      code += genKeyFilter(keys);
+    }
+    // Make sure modifiers like prevent and stop get executed after key filtering
+    if (genModifierCode) {
+      code += genModifierCode;
+    }
+    var handlerCode = isMethodPath
+      ? ("return " + (handler.value) + "($event)")
+      : isFunctionExpression
+        ? ("return (" + (handler.value) + ")($event)")
+        : handler.value;
+    /* istanbul ignore if */
+    return ("function($event){" + code + handlerCode + "}")
+  }
+}
+
+function genKeyFilter (keys) {
+  return ("if(!('button' in $event)&&" + (keys.map(genFilterCode).join('&&')) + ")return null;")
+}
+
+function genFilterCode (key) {
+  var keyVal = parseInt(key, 10);
+  if (keyVal) {
+    return ("$event.keyCode!==" + keyVal)
+  }
+  var keyCode = keyCodes[key];
+  var keyName = keyNames[key];
+  return (
+    "_k($event.keyCode," +
+    (JSON.stringify(key)) + "," +
+    (JSON.stringify(keyCode)) + "," +
+    "$event.key," +
+    "" + (JSON.stringify(keyName)) +
+    ")"
+  )
+}
+
+/*  */
+
+function on (el, dir) {
+  if ("development" !== 'production' && dir.modifiers) {
+    warn("v-on without argument does not support modifiers.");
+  }
+  el.wrapListeners = function (code) { return ("_g(" + code + "," + (dir.value) + ")"); };
+}
+
+/*  */
+
+function bind$1 (el, dir) {
+  el.wrapData = function (code) {
+    return ("_b(" + code + ",'" + (el.tag) + "'," + (dir.value) + "," + (dir.modifiers && dir.modifiers.prop ? 'true' : 'false') + (dir.modifiers && dir.modifiers.sync ? ',true' : '') + ")")
+  };
+}
+
+/*  */
+
+var baseDirectives = {
+  on: on,
+  bind: bind$1,
+  cloak: noop
+}
+
+/*  */
+
+var CodegenState = function CodegenState (options) {
+  this.options = options;
+  this.warn = options.warn || baseWarn;
+  this.transforms = pluckModuleFunction(options.modules, 'transformCode');
+  this.dataGenFns = pluckModuleFunction(options.modules, 'genData');
+  this.directives = extend(extend({}, baseDirectives), options.directives);
+  var isReservedTag = options.isReservedTag || no;
+  this.maybeComponent = function (el) { return !isReservedTag(el.tag); };
+  this.onceId = 0;
+  this.staticRenderFns = [];
+};
+
+
+
+function generate (
+  ast,
+  options
+) {
+  var state = new CodegenState(options);
+  var code = ast ? genElement(ast, state) : '_c("div")';
+  return {
+    render: ("with(this){return " + code + "}"),
+    staticRenderFns: state.staticRenderFns
+  }
+}
+
+function genElement (el, state) {
+  if (el.staticRoot && !el.staticProcessed) {
+    return genStatic(el, state)
+  } else if (el.once && !el.onceProcessed) {
+    return genOnce(el, state)
+  } else if (el.for && !el.forProcessed) {
+    return genFor(el, state)
+  } else if (el.if && !el.ifProcessed) {
+    return genIf(el, state)
+  } else if (el.tag === 'template' && !el.slotTarget) {
+    return genChildren(el, state) || 'void 0'
+  } else if (el.tag === 'slot') {
+    return genSlot(el, state)
+  } else {
+    // component or element
+    var code;
+    if (el.component) {
+      code = genComponent(el.component, el, state);
+    } else {
+      var data = el.plain ? undefined : genData$2(el, state);
+
+      var children = el.inlineTemplate ? null : genChildren(el, state, true);
+      code = "_c('" + (el.tag) + "'" + (data ? ("," + data) : '') + (children ? ("," + children) : '') + ")";
+    }
+    // module transforms
+    for (var i = 0; i < state.transforms.length; i++) {
+      code = state.transforms[i](el, code);
+    }
+    return code
+  }
+}
+
+// hoist static sub-trees out
+function genStatic (el, state) {
+  el.staticProcessed = true;
+  state.staticRenderFns.push(("with(this){return " + (genElement(el, state)) + "}"));
+  return ("_m(" + (state.staticRenderFns.length - 1) + (el.staticInFor ? ',true' : '') + ")")
+}
+
+// v-once
+function genOnce (el, state) {
+  el.onceProcessed = true;
+  if (el.if && !el.ifProcessed) {
+    return genIf(el, state)
+  } else if (el.staticInFor) {
+    var key = '';
+    var parent = el.parent;
+    while (parent) {
+      if (parent.for) {
+        key = parent.key;
+        break
+      }
+      parent = parent.parent;
+    }
+    if (!key) {
+      "development" !== 'production' && state.warn(
+        "v-once can only be used inside v-for that is keyed. "
+      );
+      return genElement(el, state)
+    }
+    return ("_o(" + (genElement(el, state)) + "," + (state.onceId++) + "," + key + ")")
+  } else {
+    return genStatic(el, state)
+  }
+}
+
+function genIf (
+  el,
+  state,
+  altGen,
+  altEmpty
+) {
+  el.ifProcessed = true; // avoid recursion
+  return genIfConditions(el.ifConditions.slice(), state, altGen, altEmpty)
+}
+
+function genIfConditions (
+  conditions,
+  state,
+  altGen,
+  altEmpty
+) {
+  if (!conditions.length) {
+    return altEmpty || '_e()'
+  }
+
+  var condition = conditions.shift();
+  if (condition.exp) {
+    return ("(" + (condition.exp) + ")?" + (genTernaryExp(condition.block)) + ":" + (genIfConditions(conditions, state, altGen, altEmpty)))
+  } else {
+    return ("" + (genTernaryExp(condition.block)))
+  }
+
+  // v-if with v-once should generate code like (a)?_m(0):_m(1)
+  function genTernaryExp (el) {
+    return altGen
+      ? altGen(el, state)
+      : el.once
+        ? genOnce(el, state)
+        : genElement(el, state)
+  }
+}
+
+function genFor (
+  el,
+  state,
+  altGen,
+  altHelper
+) {
+  var exp = el.for;
+  var alias = el.alias;
+  var iterator1 = el.iterator1 ? ("," + (el.iterator1)) : '';
+  var iterator2 = el.iterator2 ? ("," + (el.iterator2)) : '';
+
+  if ("development" !== 'production' &&
+    state.maybeComponent(el) &&
+    el.tag !== 'slot' &&
+    el.tag !== 'template' &&
+    !el.key
+  ) {
+    state.warn(
+      "<" + (el.tag) + " v-for=\"" + alias + " in " + exp + "\">: component lists rendered with " +
+      "v-for should have explicit keys. " +
+      "See https://vuejs.org/guide/list.html#key for more info.",
+      true /* tip */
+    );
+  }
+
+  el.forProcessed = true; // avoid recursion
+  return (altHelper || '_l') + "((" + exp + ")," +
+    "function(" + alias + iterator1 + iterator2 + "){" +
+      "return " + ((altGen || genElement)(el, state)) +
+    '})'
+}
+
+function genData$2 (el, state) {
+  var data = '{';
+
+  // directives first.
+  // directives may mutate the el's other properties before they are generated.
+  var dirs = genDirectives(el, state);
+  if (dirs) { data += dirs + ','; }
+
+  // key
+  if (el.key) {
+    data += "key:" + (el.key) + ",";
+  }
+  // ref
+  if (el.ref) {
+    data += "ref:" + (el.ref) + ",";
+  }
+  if (el.refInFor) {
+    data += "refInFor:true,";
+  }
+  // pre
+  if (el.pre) {
+    data += "pre:true,";
+  }
+  // record original tag name for components using "is" attribute
+  if (el.component) {
+    data += "tag:\"" + (el.tag) + "\",";
+  }
+  // module data generation functions
+  for (var i = 0; i < state.dataGenFns.length; i++) {
+    data += state.dataGenFns[i](el);
+  }
+  // attributes
+  if (el.attrs) {
+    data += "attrs:{" + (genProps(el.attrs)) + "},";
+  }
+  // DOM props
+  if (el.props) {
+    data += "domProps:{" + (genProps(el.props)) + "},";
+  }
+  // event handlers
+  if (el.events) {
+    data += (genHandlers(el.events, false, state.warn)) + ",";
+  }
+  if (el.nativeEvents) {
+    data += (genHandlers(el.nativeEvents, true, state.warn)) + ",";
+  }
+  // slot target
+  // only for non-scoped slots
+  if (el.slotTarget && !el.slotScope) {
+    data += "slot:" + (el.slotTarget) + ",";
+  }
+  // scoped slots
+  if (el.scopedSlots) {
+    data += (genScopedSlots(el.scopedSlots, state)) + ",";
+  }
+  // component v-model
+  if (el.model) {
+    data += "model:{value:" + (el.model.value) + ",callback:" + (el.model.callback) + ",expression:" + (el.model.expression) + "},";
+  }
+  // inline-template
+  if (el.inlineTemplate) {
+    var inlineTemplate = genInlineTemplate(el, state);
+    if (inlineTemplate) {
+      data += inlineTemplate + ",";
+    }
+  }
+  data = data.replace(/,$/, '') + '}';
+  // v-bind data wrap
+  if (el.wrapData) {
+    data = el.wrapData(data);
+  }
+  // v-on data wrap
+  if (el.wrapListeners) {
+    data = el.wrapListeners(data);
+  }
+  return data
+}
+
+function genDirectives (el, state) {
+  var dirs = el.directives;
+  if (!dirs) { return }
+  var res = 'directives:[';
+  var hasRuntime = false;
+  var i, l, dir, needRuntime;
+  for (i = 0, l = dirs.length; i < l; i++) {
+    dir = dirs[i];
+    needRuntime = true;
+    var gen = state.directives[dir.name];
+    if (gen) {
+      // compile-time directive that manipulates AST.
+      // returns true if it also needs a runtime counterpart.
+      needRuntime = !!gen(el, dir, state.warn);
+    }
+    if (needRuntime) {
+      hasRuntime = true;
+      res += "{name:\"" + (dir.name) + "\",rawName:\"" + (dir.rawName) + "\"" + (dir.value ? (",value:(" + (dir.value) + "),expression:" + (JSON.stringify(dir.value))) : '') + (dir.arg ? (",arg:\"" + (dir.arg) + "\"") : '') + (dir.modifiers ? (",modifiers:" + (JSON.stringify(dir.modifiers))) : '') + "},";
+    }
+  }
+  if (hasRuntime) {
+    return res.slice(0, -1) + ']'
+  }
+}
+
+function genInlineTemplate (el, state) {
+  var ast = el.children[0];
+  if ("development" !== 'production' && (
+    el.children.length !== 1 || ast.type !== 1
+  )) {
+    state.warn('Inline-template components must have exactly one child element.');
+  }
+  if (ast.type === 1) {
+    var inlineRenderFns = generate(ast, state.options);
+    return ("inlineTemplate:{render:function(){" + (inlineRenderFns.render) + "},staticRenderFns:[" + (inlineRenderFns.staticRenderFns.map(function (code) { return ("function(){" + code + "}"); }).join(',')) + "]}")
+  }
+}
+
+function genScopedSlots (
+  slots,
+  state
+) {
+  return ("scopedSlots:_u([" + (Object.keys(slots).map(function (key) {
+      return genScopedSlot(key, slots[key], state)
+    }).join(',')) + "])")
+}
+
+function genScopedSlot (
+  key,
+  el,
+  state
+) {
+  if (el.for && !el.forProcessed) {
+    return genForScopedSlot(key, el, state)
+  }
+  var fn = "function(" + (String(el.slotScope)) + "){" +
+    "return " + (el.tag === 'template'
+      ? el.if
+        ? ((el.if) + "?" + (genChildren(el, state) || 'undefined') + ":undefined")
+        : genChildren(el, state) || 'undefined'
+      : genElement(el, state)) + "}";
+  return ("{key:" + key + ",fn:" + fn + "}")
+}
+
+function genForScopedSlot (
+  key,
+  el,
+  state
+) {
+  var exp = el.for;
+  var alias = el.alias;
+  var iterator1 = el.iterator1 ? ("," + (el.iterator1)) : '';
+  var iterator2 = el.iterator2 ? ("," + (el.iterator2)) : '';
+  el.forProcessed = true; // avoid recursion
+  return "_l((" + exp + ")," +
+    "function(" + alias + iterator1 + iterator2 + "){" +
+      "return " + (genScopedSlot(key, el, state)) +
+    '})'
+}
+
+function genChildren (
+  el,
+  state,
+  checkSkip,
+  altGenElement,
+  altGenNode
+) {
+  var children = el.children;
+  if (children.length) {
+    var el$1 = children[0];
+    // optimize single v-for
+    if (children.length === 1 &&
+      el$1.for &&
+      el$1.tag !== 'template' &&
+      el$1.tag !== 'slot'
+    ) {
+      return (altGenElement || genElement)(el$1, state)
+    }
+    var normalizationType = checkSkip
+      ? getNormalizationType(children, state.maybeComponent)
+      : 0;
+    var gen = altGenNode || genNode;
+    return ("[" + (children.map(function (c) { return gen(c, state); }).join(',')) + "]" + (normalizationType ? ("," + normalizationType) : ''))
+  }
+}
+
+// determine the normalization needed for the children array.
+// 0: no normalization needed
+// 1: simple normalization needed (possible 1-level deep nested array)
+// 2: full normalization needed
+function getNormalizationType (
+  children,
+  maybeComponent
+) {
+  var res = 0;
+  for (var i = 0; i < children.length; i++) {
+    var el = children[i];
+    if (el.type !== 1) {
+      continue
+    }
+    if (needsNormalization(el) ||
+        (el.ifConditions && el.ifConditions.some(function (c) { return needsNormalization(c.block); }))) {
+      res = 2;
+      break
+    }
+    if (maybeComponent(el) ||
+        (el.ifConditions && el.ifConditions.some(function (c) { return maybeComponent(c.block); }))) {
+      res = 1;
+    }
+  }
+  return res
+}
+
+function needsNormalization (el) {
+  return el.for !== undefined || el.tag === 'template' || el.tag === 'slot'
+}
+
+function genNode (node, state) {
+  if (node.type === 1) {
+    return genElement(node, state)
+  } if (node.type === 3 && node.isComment) {
+    return genComment(node)
+  } else {
+    return genText(node)
+  }
+}
+
+function genText (text) {
+  return ("_v(" + (text.type === 2
+    ? text.expression // no need for () because already wrapped in _s()
+    : transformSpecialNewlines(JSON.stringify(text.text))) + ")")
+}
+
+function genComment (comment) {
+  return ("_e(" + (JSON.stringify(comment.text)) + ")")
+}
+
+function genSlot (el, state) {
+  var slotName = el.slotName || '"default"';
+  var children = genChildren(el, state);
+  var res = "_t(" + slotName + (children ? ("," + children) : '');
+  var attrs = el.attrs && ("{" + (el.attrs.map(function (a) { return ((camelize(a.name)) + ":" + (a.value)); }).join(',')) + "}");
+  var bind$$1 = el.attrsMap['v-bind'];
+  if ((attrs || bind$$1) && !children) {
+    res += ",null";
+  }
+  if (attrs) {
+    res += "," + attrs;
+  }
+  if (bind$$1) {
+    res += (attrs ? '' : ',null') + "," + bind$$1;
+  }
+  return res + ')'
+}
+
+// componentName is el.component, take it as argument to shun flow's pessimistic refinement
+function genComponent (
+  componentName,
+  el,
+  state
+) {
+  var children = el.inlineTemplate ? null : genChildren(el, state, true);
+  return ("_c(" + componentName + "," + (genData$2(el, state)) + (children ? ("," + children) : '') + ")")
+}
+
+function genProps (props) {
+  var res = '';
+  for (var i = 0; i < props.length; i++) {
+    var prop = props[i];
+    /* istanbul ignore if */
+    {
+      res += "\"" + (prop.name) + "\":" + (transformSpecialNewlines(prop.value)) + ",";
+    }
+  }
+  return res.slice(0, -1)
+}
+
+// #3895, #4268
+function transformSpecialNewlines (text) {
+  return text
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029')
+}
+
+/*  */
+
+// these keywords should not appear inside expressions, but operators like
+// typeof, instanceof and in are allowed
+var prohibitedKeywordRE = new RegExp('\\b' + (
+  'do,if,for,let,new,try,var,case,else,with,await,break,catch,class,const,' +
+  'super,throw,while,yield,delete,export,import,return,switch,default,' +
+  'extends,finally,continue,debugger,function,arguments'
+).split(',').join('\\b|\\b') + '\\b');
+
+// these unary operators should not be used as property/method names
+var unaryOperatorsRE = new RegExp('\\b' + (
+  'delete,typeof,void'
+).split(',').join('\\s*\\([^\\)]*\\)|\\b') + '\\s*\\([^\\)]*\\)');
+
+// strip strings in expressions
+var stripStringRE = /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*\$\{|\}(?:[^`\\]|\\.)*`|`(?:[^`\\]|\\.)*`/g;
+
+// detect problematic expressions in a template
+function detectErrors (ast) {
+  var errors = [];
+  if (ast) {
+    checkNode(ast, errors);
+  }
+  return errors
+}
+
+function checkNode (node, errors) {
+  if (node.type === 1) {
+    for (var name in node.attrsMap) {
+      if (dirRE.test(name)) {
+        var value = node.attrsMap[name];
+        if (value) {
+          if (name === 'v-for') {
+            checkFor(node, ("v-for=\"" + value + "\""), errors);
+          } else if (onRE.test(name)) {
+            checkEvent(value, (name + "=\"" + value + "\""), errors);
+          } else {
+            checkExpression(value, (name + "=\"" + value + "\""), errors);
+          }
+        }
+      }
+    }
+    if (node.children) {
+      for (var i = 0; i < node.children.length; i++) {
+        checkNode(node.children[i], errors);
+      }
+    }
+  } else if (node.type === 2) {
+    checkExpression(node.expression, node.text, errors);
+  }
+}
+
+function checkEvent (exp, text, errors) {
+  var stipped = exp.replace(stripStringRE, '');
+  var keywordMatch = stipped.match(unaryOperatorsRE);
+  if (keywordMatch && stipped.charAt(keywordMatch.index - 1) !== '$') {
+    errors.push(
+      "avoid using JavaScript unary operator as property name: " +
+      "\"" + (keywordMatch[0]) + "\" in expression " + (text.trim())
+    );
+  }
+  checkExpression(exp, text, errors);
+}
+
+function checkFor (node, text, errors) {
+  checkExpression(node.for || '', text, errors);
+  checkIdentifier(node.alias, 'v-for alias', text, errors);
+  checkIdentifier(node.iterator1, 'v-for iterator', text, errors);
+  checkIdentifier(node.iterator2, 'v-for iterator', text, errors);
+}
+
+function checkIdentifier (
+  ident,
+  type,
+  text,
+  errors
+) {
+  if (typeof ident === 'string') {
+    try {
+      new Function(("var " + ident + "=_"));
+    } catch (e) {
+      errors.push(("invalid " + type + " \"" + ident + "\" in expression: " + (text.trim())));
+    }
+  }
+}
+
+function checkExpression (exp, text, errors) {
+  try {
+    new Function(("return " + exp));
+  } catch (e) {
+    var keywordMatch = exp.replace(stripStringRE, '').match(prohibitedKeywordRE);
+    if (keywordMatch) {
+      errors.push(
+        "avoid using JavaScript keyword as property name: " +
+        "\"" + (keywordMatch[0]) + "\"\n  Raw expression: " + (text.trim())
+      );
+    } else {
+      errors.push(
+        "invalid expression: " + (e.message) + " in\n\n" +
+        "    " + exp + "\n\n" +
+        "  Raw expression: " + (text.trim()) + "\n"
+      );
+    }
+  }
+}
+
+/*  */
+
+function createFunction (code, errors) {
+  try {
+    return new Function(code)
+  } catch (err) {
+    errors.push({ err: err, code: code });
+    return noop
+  }
+}
+
+function createCompileToFunctionFn (compile) {
+  var cache = Object.create(null);
+
+  return function compileToFunctions (
+    template,
+    options,
+    vm
+  ) {
+    options = extend({}, options);
+    var warn$$1 = options.warn || warn;
+    delete options.warn;
+
+    /* istanbul ignore if */
+    {
+      // detect possible CSP restriction
+      try {
+        new Function('return 1');
+      } catch (e) {
+        if (e.toString().match(/unsafe-eval|CSP/)) {
+          warn$$1(
+            'It seems you are using the standalone build of Vue.js in an ' +
+            'environment with Content Security Policy that prohibits unsafe-eval. ' +
+            'The template compiler cannot work in this environment. Consider ' +
+            'relaxing the policy to allow unsafe-eval or pre-compiling your ' +
+            'templates into render functions.'
+          );
+        }
+      }
+    }
+
+    // check cache
+    var key = options.delimiters
+      ? String(options.delimiters) + template
+      : template;
+    if (cache[key]) {
+      return cache[key]
+    }
+
+    // compile
+    var compiled = compile(template, options);
+
+    // check compilation errors/tips
+    {
+      if (compiled.errors && compiled.errors.length) {
+        warn$$1(
+          "Error compiling template:\n\n" + template + "\n\n" +
+          compiled.errors.map(function (e) { return ("- " + e); }).join('\n') + '\n',
+          vm
+        );
+      }
+      if (compiled.tips && compiled.tips.length) {
+        compiled.tips.forEach(function (msg) { return tip(msg, vm); });
+      }
+    }
+
+    // turn code into functions
+    var res = {};
+    var fnGenErrors = [];
+    res.render = createFunction(compiled.render, fnGenErrors);
+    res.staticRenderFns = compiled.staticRenderFns.map(function (code) {
+      return createFunction(code, fnGenErrors)
+    });
+
+    // check function generation errors.
+    // this should only happen if there is a bug in the compiler itself.
+    // mostly for codegen development use
+    /* istanbul ignore if */
+    {
+      if ((!compiled.errors || !compiled.errors.length) && fnGenErrors.length) {
+        warn$$1(
+          "Failed to generate render function:\n\n" +
+          fnGenErrors.map(function (ref) {
+            var err = ref.err;
+            var code = ref.code;
+
+            return ((err.toString()) + " in\n\n" + code + "\n");
+        }).join('\n'),
+          vm
+        );
+      }
+    }
+
+    return (cache[key] = res)
+  }
+}
+
+/*  */
+
+function createCompilerCreator (baseCompile) {
+  return function createCompiler (baseOptions) {
+    function compile (
+      template,
+      options
+    ) {
+      var finalOptions = Object.create(baseOptions);
+      var errors = [];
+      var tips = [];
+      finalOptions.warn = function (msg, tip) {
+        (tip ? tips : errors).push(msg);
+      };
+
+      if (options) {
+        // merge custom modules
+        if (options.modules) {
+          finalOptions.modules =
+            (baseOptions.modules || []).concat(options.modules);
+        }
+        // merge custom directives
+        if (options.directives) {
+          finalOptions.directives = extend(
+            Object.create(baseOptions.directives || null),
+            options.directives
+          );
+        }
+        // copy other options
+        for (var key in options) {
+          if (key !== 'modules' && key !== 'directives') {
+            finalOptions[key] = options[key];
+          }
+        }
+      }
+
+      var compiled = baseCompile(template, finalOptions);
+      {
+        errors.push.apply(errors, detectErrors(compiled.ast));
+      }
+      compiled.errors = errors;
+      compiled.tips = tips;
+      return compiled
+    }
+
+    return {
+      compile: compile,
+      compileToFunctions: createCompileToFunctionFn(compile)
+    }
+  }
+}
+
+/*  */
+
+// `createCompilerCreator` allows creating compilers that use alternative
+// parser/optimizer/codegen, e.g the SSR optimizing compiler.
+// Here we just export a default compiler using the default parts.
+var createCompiler = createCompilerCreator(function baseCompile (
+  template,
+  options
+) {
+  var ast = parse(template.trim(), options);
+  if (options.optimize !== false) {
+    optimize(ast, options);
+  }
+  var code = generate(ast, options);
+  return {
+    ast: ast,
+    render: code.render,
+    staticRenderFns: code.staticRenderFns
+  }
+});
+
+/*  */
+
+var ref$1 = createCompiler(baseOptions);
+var compileToFunctions = ref$1.compileToFunctions;
+
+/*  */
+
+// check whether current browser encodes a char inside attribute values
+var div;
+function getShouldDecode (href) {
+  div = div || document.createElement('div');
+  div.innerHTML = href ? "<a href=\"\n\"/>" : "<div a=\"\n\"/>";
+  return div.innerHTML.indexOf('&#10;') > 0
+}
+
+// #3663: IE encodes newlines inside attribute values while other browsers don't
+var shouldDecodeNewlines = inBrowser ? getShouldDecode(false) : false;
+// #6828: chrome encodes content in a[href]
+var shouldDecodeNewlinesForHref = inBrowser ? getShouldDecode(true) : false;
+
+/*  */
+
+var idToTemplate = cached(function (id) {
+  var el = query(id);
+  return el && el.innerHTML
+});
+
+var mount = Vue.prototype.$mount;
+Vue.prototype.$mount = function (
+  el,
+  hydrating
+) {
+  el = el && query(el);
+
+  /* istanbul ignore if */
+  if (el === document.body || el === document.documentElement) {
+    "development" !== 'production' && warn(
+      "Do not mount Vue to <html> or <body> - mount to normal elements instead."
+    );
+    return this
+  }
+
+  var options = this.$options;
+  // resolve template/el and convert to render function
+  if (!options.render) {
+    var template = options.template;
+    if (template) {
+      if (typeof template === 'string') {
+        if (template.charAt(0) === '#') {
+          template = idToTemplate(template);
+          /* istanbul ignore if */
+          if ("development" !== 'production' && !template) {
+            warn(
+              ("Template element not found or is empty: " + (options.template)),
+              this
+            );
+          }
+        }
+      } else if (template.nodeType) {
+        template = template.innerHTML;
+      } else {
+        {
+          warn('invalid template option:' + template, this);
+        }
+        return this
+      }
+    } else if (el) {
+      template = getOuterHTML(el);
+    }
+    if (template) {
+      /* istanbul ignore if */
+      if ("development" !== 'production' && config.performance && mark) {
+        mark('compile');
+      }
+
+      var ref = compileToFunctions(template, {
+        shouldDecodeNewlines: shouldDecodeNewlines,
+        shouldDecodeNewlinesForHref: shouldDecodeNewlinesForHref,
+        delimiters: options.delimiters,
+        comments: options.comments
+      }, this);
+      var render = ref.render;
+      var staticRenderFns = ref.staticRenderFns;
+      options.render = render;
+      options.staticRenderFns = staticRenderFns;
+
+      /* istanbul ignore if */
+      if ("development" !== 'production' && config.performance && mark) {
+        mark('compile end');
+        measure(("vue " + (this._name) + " compile"), 'compile', 'compile end');
+      }
+    }
+  }
+  return mount.call(this, el, hydrating)
+};
+
+/**
+ * Get outerHTML of elements, taking care
+ * of SVG elements in IE as well.
+ */
+function getOuterHTML (el) {
+  if (el.outerHTML) {
+    return el.outerHTML
+  } else {
+    var container = document.createElement('div');
+    container.appendChild(el.cloneNode(true));
+    return container.innerHTML
+  }
+}
+
+Vue.compile = compileToFunctions;
+
+return Vue;
+
+})));
-- 
2.38.5


From a6e4bda317511a85fb390a1d3866f3af96cb977c Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 21:02:57 -0600
Subject: [PATCH 09/68] move control handler to own function

---
 bin/telebitd.js | 685 ++++++++++++++++++++++++------------------------
 1 file changed, 347 insertions(+), 338 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index ee76d64..4613b96 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -326,356 +326,365 @@ controllers.ssh = function (req, res, opts) {
   state.config.sshAuto = sshAuto;
   sshSuccess();
 };
-function serveControlsHelper() {
-  controlServer = http.createServer(function (req, res) {
-    var opts = url.parse(req.url, true);
-    if (false && opts.query._body) {
-      try {
-        opts.body = JSON.parse(decodeURIComponent(opts.query._body, true));
-      } catch(e) {
-        res.statusCode = 500;
-        res.end('{"error":{"message":"?_body={{bad_format}}"}}');
-        return;
-      }
-    }
 
-    function listSuccess() {
-      var dumpy = {
-        servernames: state.servernames
-      , ports: state.ports
-      , ssh: state.config.sshAuto || 'disabled'
-      , code: 'CONFIG'
-      };
-      if (state.otp) {
-        dumpy.device_pair_code = state.otp;
-      }
-
-      if (state._can_pair && state.config.email && !state.token) {
-        dumpy.code = "AWAIT_AUTH";
-        dumpy.message = "Please run 'telebit init' to authenticate.";
-      }
-
-      res.end(JSON.stringify(dumpy));
-    }
-
-    function getConfigOnly() {
-      var resp = JSON.parse(JSON.stringify(state.config));
-      resp.version = pkg.version;
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify(resp));
-    }
-
-    //
-    // without proper config
-    //
-    function saveAndReport() {
-      console.log('[DEBUG] saveAndReport config write', confpath);
-      console.log(YAML.safeDump(snakeCopy(state.config)));
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          res.statusCode = 500;
-          res.setHeader('Content-Type', 'application/json');
-          res.end('{"error":{"message":"Could not save config file after init: ' + err.message.replace(/"/g, "'")
-            + '.\nPerhaps check that the file exists and your user has permissions to write it?"}}');
-          return;
-        }
-
-        listSuccess();
-      });
-    }
-
-    function initOrConfig() {
-      var conf = {};
-      if (!opts.body) {
-        res.statusCode = 422;
-        res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
-        return;
-      }
-      // relay, email, agree_tos, servernames, ports
-      //
-      opts.body.forEach(function (opt) {
-        var parts = opt.split(/:/);
-        if ('true' === parts[1]) {
-          parts[1] = true;
-        } else if ('false' === parts[1]) {
-          parts[1] = false;
-        } else if ('null' === parts[1]) {
-          parts[1] = null;
-        } else if ('undefined' === parts[1]) {
-          parts[1] = undefined;
-        }
-        conf[parts[0]] = parts[1];
-      });
-
-      // TODO camelCase query
-      state.config.email = conf.email || state.config.email || '';
-      if ('undefined' !== typeof conf.agreeTos
-        || 'undefined' !== typeof conf.agreeTos ) {
-        state.config.agreeTos = conf.agreeTos || conf.agree_tos;
-      }
-      state.otp = conf._otp; // this should only be done on the client side
-      state.config.relay = conf.relay || state.config.relay || '';
-      console.log();
-      console.log('conf.token', typeof conf.token, conf.token);
-      console.log('state.config.token', typeof state.config.token, state.config.token);
-      state.config.token = conf.token || state.config.token || null;
-      state.config.secret = conf.secret || state.config.secret || null;
-      state.pretoken = conf.pretoken || state.config.pretoken || null;
-      if (state.secret) {
-        console.log('state.secret');
-        state.token = common.signToken(state);
-      }
-      if (!state.token) {
-        console.log('!state.token');
-        state.token = conf._token;
-      }
-      console.log();
-      console.log('JSON.stringify(conf)');
-      console.log(JSON.stringify(conf));
-      console.log();
-      console.log('JSON.stringify(state)');
-      console.log(JSON.stringify(state));
-      console.log();
-      if ('undefined' !== typeof conf.newsletter) {
-        state.config.newsletter = conf.newsletter;
-      }
-      if ('undefined' !== typeof conf.communityMember
-        || 'undefined' !== typeof conf.community_member) {
-        state.config.communityMember = conf.communityMember || conf.community_member;
-      }
-      if ('undefined' !== typeof conf.telemetry) {
-        state.config.telemetry = conf.telemetry;
-      }
-      if (conf._servernames) {
-        (conf._servernames||'').split(/,/g).forEach(function (key) {
-          if (!state.config.servernames[key]) {
-            state.config.servernames[key] = { sub: undefined };
-          }
-        });
-      }
-      if (conf._ports) {
-        (conf._ports||'').split(/,/g).forEach(function (key) {
-          if (!state.config.ports[key]) {
-            state.config.ports[key] = {};
-          }
-        });
-      }
-
-      if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-        console.warn('missing config');
-        res.statusCode = 400;
-
-        res.setHeader('Content-Type', 'application/json');
-        res.end(JSON.stringify({
-          error: {
-            code: "E_INIT"
-          , message: "Missing important config file params"
-          , _params: JSON.stringify(conf)
-          , _config: JSON.stringify(state.config)
-          , _body: JSON.stringify(opts.body)
-          }
-        }));
-        return;
-      }
-
-      // init also means enable
-      delete state.config.disable;
-      safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
-    }
-
-    function restart() {
-      console.info("[telebitd.js] server closing...");
-      state.keepAlive.state = false;
-      if (myRemote) {
-        myRemote.end();
-        myRemote.on('end', respondAndClose);
-        // failsafe
-        setTimeout(function () {
-          console.info("[telebitd.js] closing too slowly, force quit");
-          respondAndClose();
-        }, 5 * 1000);
-      } else {
-        respondAndClose();
-      }
-
-      function respondAndClose() {
-        res.setHeader('Content-Type', 'application/json');
-        res.end(JSON.stringify({ success: true }));
-        controlServer.close(function () {
-          console.info("[telebitd.js] server closed");
-          setTimeout(function () {
-            // system daemon will restart the process
-            process.exit(22); // use non-success exit code
-          }, 100);
-        });
-      }
-    }
-
-    function invalidConfig() {
-      res.statusCode = 400;
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
-        error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
-      }));
-    }
-
-    function saveAndCommit() {
-      state.config.servernames = state.servernames;
-      state.config.ports = state.ports;
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          res.statusCode = 500;
-          res.setHeader('Content-Type', 'application/json');
-          res.end(JSON.stringify({
-            "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
-          }));
-          return;
-        }
-        listSuccess();
-      });
-    }
-
-    function handleError(err) {
+var serveStatic = require('serve-static')(path.join(__dirname, '../lib/admin/'));
+function handleRemoteClient(req, res) {
+  if (/^\/(rpc|api)\//.test(req.url)) {
+    return handleApi(req, res);
+  }
+  serveStatic(req, res, require('finalhandler')(req, res));
+}
+function handleApi(req, res) {
+  var opts = url.parse(req.url, true);
+  if (false && opts.query._body) {
+    try {
+      opts.body = JSON.parse(decodeURIComponent(opts.query._body, true));
+    } catch(e) {
       res.statusCode = 500;
+      res.end('{"error":{"message":"?_body={{bad_format}}"}}');
+      return;
+    }
+  }
+
+  function listSuccess() {
+    var dumpy = {
+      servernames: state.servernames
+    , ports: state.ports
+    , ssh: state.config.sshAuto || 'disabled'
+    , code: 'CONFIG'
+    };
+    if (state.otp) {
+      dumpy.device_pair_code = state.otp;
+    }
+
+    if (state._can_pair && state.config.email && !state.token) {
+      dumpy.code = "AWAIT_AUTH";
+      dumpy.message = "Please run 'telebit init' to authenticate.";
+    }
+
+    res.end(JSON.stringify(dumpy));
+  }
+
+  function getConfigOnly() {
+    var resp = JSON.parse(JSON.stringify(state.config));
+    resp.version = pkg.version;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(resp));
+  }
+
+  //
+  // without proper config
+  //
+  function saveAndReport() {
+    console.log('[DEBUG] saveAndReport config write', confpath);
+    console.log(YAML.safeDump(snakeCopy(state.config)));
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        res.statusCode = 500;
+        res.setHeader('Content-Type', 'application/json');
+        res.end('{"error":{"message":"Could not save config file after init: ' + err.message.replace(/"/g, "'")
+          + '.\nPerhaps check that the file exists and your user has permissions to write it?"}}');
+        return;
+      }
+
+      listSuccess();
+    });
+  }
+
+  function initOrConfig() {
+    var conf = {};
+    if (!opts.body) {
+      res.statusCode = 422;
+      res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
+      return;
+    }
+    // relay, email, agree_tos, servernames, ports
+    //
+    opts.body.forEach(function (opt) {
+      var parts = opt.split(/:/);
+      if ('true' === parts[1]) {
+        parts[1] = true;
+      } else if ('false' === parts[1]) {
+        parts[1] = false;
+      } else if ('null' === parts[1]) {
+        parts[1] = null;
+      } else if ('undefined' === parts[1]) {
+        parts[1] = undefined;
+      }
+      conf[parts[0]] = parts[1];
+    });
+
+    // TODO camelCase query
+    state.config.email = conf.email || state.config.email || '';
+    if ('undefined' !== typeof conf.agreeTos
+      || 'undefined' !== typeof conf.agreeTos ) {
+      state.config.agreeTos = conf.agreeTos || conf.agree_tos;
+    }
+    state.otp = conf._otp; // this should only be done on the client side
+    state.config.relay = conf.relay || state.config.relay || '';
+    console.log();
+    console.log('conf.token', typeof conf.token, conf.token);
+    console.log('state.config.token', typeof state.config.token, state.config.token);
+    state.config.token = conf.token || state.config.token || null;
+    state.config.secret = conf.secret || state.config.secret || null;
+    state.pretoken = conf.pretoken || state.config.pretoken || null;
+    if (state.secret) {
+      console.log('state.secret');
+      state.token = common.signToken(state);
+    }
+    if (!state.token) {
+      console.log('!state.token');
+      state.token = conf._token;
+    }
+    console.log();
+    console.log('JSON.stringify(conf)');
+    console.log(JSON.stringify(conf));
+    console.log();
+    console.log('JSON.stringify(state)');
+    console.log(JSON.stringify(state));
+    console.log();
+    if ('undefined' !== typeof conf.newsletter) {
+      state.config.newsletter = conf.newsletter;
+    }
+    if ('undefined' !== typeof conf.communityMember
+      || 'undefined' !== typeof conf.community_member) {
+      state.config.communityMember = conf.communityMember || conf.community_member;
+    }
+    if ('undefined' !== typeof conf.telemetry) {
+      state.config.telemetry = conf.telemetry;
+    }
+    if (conf._servernames) {
+      (conf._servernames||'').split(/,/g).forEach(function (key) {
+        if (!state.config.servernames[key]) {
+          state.config.servernames[key] = { sub: undefined };
+        }
+      });
+    }
+    if (conf._ports) {
+      (conf._ports||'').split(/,/g).forEach(function (key) {
+        if (!state.config.ports[key]) {
+          state.config.ports[key] = {};
+        }
+      });
+    }
+
+    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+      console.warn('missing config');
+      res.statusCode = 400;
+
       res.setHeader('Content-Type', 'application/json');
       res.end(JSON.stringify({
-        error: { message: err.message, code: err.code }
+        error: {
+          code: "E_INIT"
+        , message: "Missing important config file params"
+        , _params: JSON.stringify(conf)
+        , _config: JSON.stringify(state.config)
+        , _body: JSON.stringify(opts.body)
+        }
       }));
-    }
-
-    function enable() {
-      delete state.config.disable;// = undefined;
-      state.keepAlive.state = true;
-
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-          handleError(err);
-          return;
-        }
-        // TODO XXX myRemote.active
-        if (myRemote) {
-          listSuccess();
-          return;
-        }
-        safeStartTelebitRemote(true).then(listSuccess).catch(handleError);
-      });
-    }
-
-    function disable() {
-      state.config.disable = true;
-      state.keepAlive.state = false;
-
-      if (myRemote) { myRemote.end(); myRemote = null; }
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        res.setHeader('Content-Type', 'application/json');
-        if (err) {
-          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-          handleError(err);
-          return;
-        }
-        res.end('{"success":true}');
-      });
-    }
-
-    function getStatus() {
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify(
-        { status: (state.config.disable ? 'disabled' : 'enabled')
-        , ready: ((state.config.relay && (state.config.token || state.config.agreeTos)) ? true : false)
-        , active: !!myRemote
-        , connected: 'maybe (todo)'
-        , version: pkg.version
-        , servernames: state.servernames
-        }
-      ));
-    }
-
-    function route() {
-      if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
-        getConfigOnly();
-        return;
-      }
-      if (/\b(init|config)\b/.test(opts.pathname)) {
-        initOrConfig();
-        return;
-      }
-      if (/restart/.test(opts.pathname)) {
-        restart();
-        return;
-      }
-      //
-      // Check for proper config
-      //
-      if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-        invalidConfig();
-        return;
-      }
-      //
-      // With proper config
-      //
-      if (/http/.test(opts.pathname)) {
-        controllers.http(req, res, opts);
-        return;
-      }
-      if (/tcp/.test(opts.pathname)) {
-        controllers.tcp(req, res, opts);
-        return;
-      }
-      if (/save|commit/.test(opts.pathname)) {
-        saveAndCommit();
-        return;
-      }
-      if (/ssh/.test(opts.pathname)) {
-        controllers.ssh(req, res, opts);
-        return;
-      }
-      if (/enable/.test(opts.pathname)) {
-        enable();
-        return;
-      }
-      if (/disable/.test(opts.pathname)) {
-        disable();
-        return;
-      }
-      if (/status/.test(opts.pathname)) {
-        getStatus();
-        return;
-      }
-      if (/list/.test(opts.pathname)) {
-        listSuccess();
-        return;
-      }
-
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
-    }
-
-    if (!req.headers['content-length'] && !req.headers['content-type']) {
-      route();
       return;
     }
 
-    var body = '';
-    req.on('readable', function () {
-      var data;
-      while (true) {
-        data = req.read();
-        if (!data) { break; }
-        body += data.toString();
-      }
-    });
-    req.on('end', function () {
-      try {
-        opts.body = JSON.parse(body);
-      } catch(e) {
-        res.statusCode = 400;
-        res.end('{"error":{"message":"POST body is not valid json"}}');
+    // init also means enable
+    delete state.config.disable;
+    safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
+  }
+
+  function restart() {
+    console.info("[telebitd.js] server closing...");
+    state.keepAlive.state = false;
+    if (myRemote) {
+      myRemote.end();
+      myRemote.on('end', respondAndClose);
+      // failsafe
+      setTimeout(function () {
+        console.info("[telebitd.js] closing too slowly, force quit");
+        respondAndClose();
+      }, 5 * 1000);
+    } else {
+      respondAndClose();
+    }
+
+    function respondAndClose() {
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ success: true }));
+      controlServer.close(function () {
+        console.info("[telebitd.js] server closed");
+        setTimeout(function () {
+          // system daemon will restart the process
+          process.exit(22); // use non-success exit code
+        }, 100);
+      });
+    }
+  }
+
+  function invalidConfig() {
+    res.statusCode = 400;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+      error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
+    }));
+  }
+
+  function saveAndCommit() {
+    state.config.servernames = state.servernames;
+    state.config.ports = state.ports;
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        res.statusCode = 500;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({
+          "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
+        }));
         return;
       }
-      route();
+      listSuccess();
     });
+  }
+
+  function handleError(err) {
+    res.statusCode = 500;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+      error: { message: err.message, code: err.code }
+    }));
+  }
+
+  function enable() {
+    delete state.config.disable;// = undefined;
+    state.keepAlive.state = true;
+
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+        handleError(err);
+        return;
+      }
+      // TODO XXX myRemote.active
+      if (myRemote) {
+        listSuccess();
+        return;
+      }
+      safeStartTelebitRemote(true).then(listSuccess).catch(handleError);
+    });
+  }
+
+  function disable() {
+    state.config.disable = true;
+    state.keepAlive.state = false;
+
+    if (myRemote) { myRemote.end(); myRemote = null; }
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      res.setHeader('Content-Type', 'application/json');
+      if (err) {
+        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+        handleError(err);
+        return;
+      }
+      res.end('{"success":true}');
+    });
+  }
+
+  function getStatus() {
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(
+      { status: (state.config.disable ? 'disabled' : 'enabled')
+      , ready: ((state.config.relay && (state.config.token || state.config.agreeTos)) ? true : false)
+      , active: !!myRemote
+      , connected: 'maybe (todo)'
+      , version: pkg.version
+      , servernames: state.servernames
+      }
+    ));
+  }
+
+  function route() {
+    if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
+      getConfigOnly();
+      return;
+    }
+    if (/\b(init|config)\b/.test(opts.pathname)) {
+      initOrConfig();
+      return;
+    }
+    if (/restart/.test(opts.pathname)) {
+      restart();
+      return;
+    }
+    //
+    // Check for proper config
+    //
+    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+      invalidConfig();
+      return;
+    }
+    //
+    // With proper config
+    //
+    if (/http/.test(opts.pathname)) {
+      controllers.http(req, res, opts);
+      return;
+    }
+    if (/tcp/.test(opts.pathname)) {
+      controllers.tcp(req, res, opts);
+      return;
+    }
+    if (/save|commit/.test(opts.pathname)) {
+      saveAndCommit();
+      return;
+    }
+    if (/ssh/.test(opts.pathname)) {
+      controllers.ssh(req, res, opts);
+      return;
+    }
+    if (/enable/.test(opts.pathname)) {
+      enable();
+      return;
+    }
+    if (/disable/.test(opts.pathname)) {
+      disable();
+      return;
+    }
+    if (/status/.test(opts.pathname)) {
+      getStatus();
+      return;
+    }
+    if (/list/.test(opts.pathname)) {
+      listSuccess();
+      return;
+    }
+
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
+  }
+
+  if (!req.headers['content-length'] && !req.headers['content-type']) {
+    route();
+    return;
+  }
+
+  var body = '';
+  req.on('readable', function () {
+    var data;
+    while (true) {
+      data = req.read();
+      if (!data) { break; }
+      body += data.toString();
+    }
   });
+  req.on('end', function () {
+    try {
+      opts.body = JSON.parse(body);
+    } catch(e) {
+      res.statusCode = 400;
+      res.end('{"error":{"message":"POST body is not valid json"}}');
+      return;
+    }
+    route();
+  });
+}
+function serveControlsHelper() {
+  controlServer = http.createServer(handleRemoteClient);
 
   if (fs.existsSync(state._ipc.path)) {
     fs.unlinkSync(state._ipc.path);
-- 
2.38.5


From 26939a62cf1cd472ef0acdf598ec321d29312ddb Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 21:06:59 -0600
Subject: [PATCH 10/68] add route function

---
 bin/telebitd.js | 133 +++++++++++++++++++++++++++++-------------------
 1 file changed, 80 insertions(+), 53 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 722cbd8..7c17f97 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -599,63 +599,90 @@ function handleApi(req, res) {
     ));
   }
 
-  if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
-    getConfigOnly();
-    return;
+  function route() {
+    if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
+      getConfigOnly();
+      return;
+    }
+    if (/\b(init|config)\b/.test(opts.pathname)) {
+      initOrConfig();
+      return;
+    }
+    if (/restart/.test(opts.pathname)) {
+      restart();
+      return;
+    }
+    //
+    // Check for proper config
+    //
+    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+      invalidConfig();
+      return;
+    }
+    //
+    // With proper config
+    //
+    if (/http/.test(opts.pathname)) {
+      controllers.http(req, res, opts);
+      return;
+    }
+    if (/tcp/.test(opts.pathname)) {
+      controllers.tcp(req, res, opts);
+      return;
+    }
+    if (/save|commit/.test(opts.pathname)) {
+      saveAndCommit();
+      return;
+    }
+    if (/ssh/.test(opts.pathname)) {
+      controllers.ssh(req, res, opts);
+      return;
+    }
+    if (/enable/.test(opts.pathname)) {
+      enable();
+      return;
+    }
+    if (/disable/.test(opts.pathname)) {
+      disable();
+      return;
+    }
+    if (/status/.test(opts.pathname)) {
+      getStatus();
+      return;
+    }
+    if (/list/.test(opts.pathname)) {
+      listSuccess();
+      return;
+    }
+
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
   }
-  if (/\b(init|config)\b/.test(opts.pathname)) {
-    initOrConfig();
-    return;
-  }
-  if (/restart/.test(opts.pathname)) {
-    restart();
-    return;
-  }
-  //
-  // Check for proper config
-  //
-  if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-    invalidConfig();
-    return;
-  }
-  //
-  // With proper config
-  //
-  if (/http/.test(opts.pathname)) {
-    controllers.http(req, res, opts);
-    return;
-  }
-  if (/tcp/.test(opts.pathname)) {
-    controllers.tcp(req, res, opts);
-    return;
-  }
-  if (/save|commit/.test(opts.pathname)) {
-    saveAndCommit();
-    return;
-  }
-  if (/ssh/.test(opts.pathname)) {
-    controllers.ssh(req, res, opts);
-    return;
-  }
-  if (/enable/.test(opts.pathname)) {
-    enable();
-    return;
-  }
-  if (/disable/.test(opts.pathname)) {
-    disable();
-    return;
-  }
-  if (/status/.test(opts.pathname)) {
-    getStatus();
-    return;
-  }
-  if (/list/.test(opts.pathname)) {
-    listSuccess();
+
+  if (!req.headers['content-length'] && !req.headers['content-type']) {
+    route();
     return;
   }
 
-  res.setHeader('Content-Type', 'application/json');
-  res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
+  var body = '';
+  req.on('readable', function () {
+    var data;
+    while (true) {
+      data = req.read();
+      if (!data) { break; }
+      body += data.toString();
+    }
+  });
+  req.on('end', function () {
+    try {
+      opts.body = JSON.parse(body);
+    } catch(e) {
+      res.statusCode = 400;
+      res.end('{"error":{"message":"POST body is not valid json"}}');
+      return;
+    }
+    route();
+  });
 }
 function serveControlsHelper() {
   controlServer = http.createServer(handleRemoteClient);
-- 
2.38.5


From 0bdaacb8aa5d83a55b3574ffa89944f4f5cd7da4 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 21:30:29 -0600
Subject: [PATCH 11/68] allow port in remote client

---
 lib/rc/index.js | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/rc/index.js b/lib/rc/index.js
index acd0dc7..174f130 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -79,11 +79,19 @@ module.exports.create = function (state) {
       url += ('?_body=' + encodeURIComponent(json));
     }
     var method = opts.method || (args && 'POST') || 'GET';
-    var req = http.request({
-      socketPath: state._ipc.path
-    , method: method
+    var reqOpts = {
+      method: method
     , path: url
-    }, function (resp) {
+    };
+    var fs = require('fs');
+    var portFile = path.join(path.dirname(state._ipc.path), 'telebit.port');
+    if (fs.existsSync(portFile)) {
+      reqOpts.host = 'localhost';
+      reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
+    } else {
+      reqOpts.socketPath = state._ipc.path;
+    }
+    var req = http.request(reqOpts, function (resp) {
       makeResponder(service, resp, fn);
     });
 
-- 
2.38.5


From 79d01e2c31ae273b1e994e8628a5672723e8ca2c Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 21:48:28 -0600
Subject: [PATCH 12/68] show port on status

---
 bin/telebit-remote.js | 4 ++++
 lib/rc/index.js       | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 3ba1b1e..c7d28ed 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -546,6 +546,10 @@ function parseConfig(err, text) {
           } else {
             console.info('> Rejecting SSH-over-HTTPS for now');
           }
+        } else if ('status' === body.module) {
+          // TODO funny one this one
+          console.info('http://localhost:' + (body.port || state.config.ipc.port));
+          console.info(JSON.stringify(body, null, 2));
         } else {
           console.info(JSON.stringify(body, null, 2));
         }
diff --git a/lib/rc/index.js b/lib/rc/index.js
index 174f130..c3b8fe0 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -88,6 +88,12 @@ module.exports.create = function (state) {
     if (fs.existsSync(portFile)) {
       reqOpts.host = 'localhost';
       reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
+      if (!state.config.ipc) {
+        state.config.ipc = {};
+      }
+      state.config.ipc.type = 'port';
+      state.config.ipc.path = path.dirname(state._ipc.path);
+      state.config.ipc.port = reqOpts.port;
     } else {
       reqOpts.socketPath = state._ipc.path;
     }
-- 
2.38.5


From 66758f4dbf6cd5fc66e22a6b243c6d9d71336a0f Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 22:17:10 -0600
Subject: [PATCH 13/68] post merge bugfix

---
 bin/telebit-remote.js |  4 +++-
 bin/telebitd.js       |  1 +
 lib/rc/index.js       | 10 +++++-----
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index c7d28ed..9cf37b0 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -548,7 +548,9 @@ function parseConfig(err, text) {
           }
         } else if ('status' === body.module) {
           // TODO funny one this one
-          console.info('http://localhost:' + (body.port || state.config.ipc.port));
+          if (body.port) {
+            console.info('http://localhost:' + (body.port));
+          }
           console.info(JSON.stringify(body, null, 2));
         } else {
           console.info(JSON.stringify(body, null, 2));
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 1d72074..cbbaf74 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -589,6 +589,7 @@ function handleApi(req, res) {
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify(
       { module: 'status'
+      , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
       , status: (state.config.disable ? 'disabled' : 'enabled')
       , ready: ((state.config.relay && (state.config.token || state.config.agreeTos)) ? true : false)
       , active: !!myRemote
diff --git a/lib/rc/index.js b/lib/rc/index.js
index c3b8fe0..fd6da53 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -88,12 +88,12 @@ module.exports.create = function (state) {
     if (fs.existsSync(portFile)) {
       reqOpts.host = 'localhost';
       reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
-      if (!state.config.ipc) {
-        state.config.ipc = {};
+      if (!state.ipc) {
+        state.ipc = {};
       }
-      state.config.ipc.type = 'port';
-      state.config.ipc.path = path.dirname(state._ipc.path);
-      state.config.ipc.port = reqOpts.port;
+      state.ipc.type = 'port';
+      state.ipc.path = path.dirname(state._ipc.path);
+      state.ipc.port = reqOpts.port;
     } else {
       reqOpts.socketPath = state._ipc.path;
     }
-- 
2.38.5


From b75552a287f3413a7e69fcba128aa3a190d86d24 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 15 Oct 2018 23:08:27 -0600
Subject: [PATCH 14/68] add uptime info

---
 bin/telebitd.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index cbbaf74..006cc41 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -23,6 +23,8 @@ var recase = require('recase').create({});
 var camelCopy = recase.camelCopy.bind(recase);
 var snakeCopy = recase.snakeCopy.bind(recase);
 var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"), 'utf8'));
+var startTime = Date.now();
+var connectTimes = [];
 
 var TelebitRemote = require('../lib/daemon/index.js').TelebitRemote;
 
@@ -586,6 +588,7 @@ function handleApi(req, res) {
   }
 
   function getStatus() {
+    var now = Date.now();
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify(
       { module: 'status'
@@ -596,6 +599,10 @@ function handleApi(req, res) {
       , connected: 'maybe (todo)'
       , version: pkg.version
       , servernames: state.servernames
+      , proctime: Math.round(process.uptime() * 1000)
+      , uptime: now - startTime
+      , runtime: connectTimes.length && (now - connectTimes[0]) || 0
+      , reconnects: connectTimes.length
       }
     ));
   }
@@ -995,6 +1002,7 @@ function rawStartTelebitRemote(keepAlive) {
         }
 
         function onConnect() {
+          connectTimes.unshift(Date.now());
           console.info('[connect] relay established');
           myRemote.removeListener('error', onConnectError);
           myRemote.once('error', function (err) {
-- 
2.38.5


From 81ee4b27a5d9714b6db4cc0dc315e4af8fd8e057 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 17 Oct 2018 20:46:56 -0600
Subject: [PATCH 15/68] move email prompt to locale doc file

---
 bin/telebit-remote.js | 11 +----------
 lib/en-us.toml        | 12 ++++++++++++
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 9cf37b0..b6fcb3c 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -98,16 +98,7 @@ function askForConfig(state, mainCb) {
   var firstSet = [
     function askEmail(cb) {
       if (state.config.email) { cb(); return; }
-      //console.info("");
-      console.info("Welcome!");
-      console.info("");
-      console.info("By using Telebit you agree to:");
-      console.info("");
-      console.info("    [x] Accept the Telebit™ terms of service");
-      console.info("    [x] Accept the Let's Encrypt™ terms of service");
-      console.info("");
-      console.info("Enter your email to agree and login/create your account:");
-      console.info("");
+      console.info(TPLS.remote.setup.email);
       // TODO attempt to read email from npmrc or the like?
       rl.question('email: ', function (email) {
         email = /@/.test(email) && email.trim();
diff --git a/lib/en-us.toml b/lib/en-us.toml
index 2bf476d..21d77e7 100644
--- a/lib/en-us.toml
+++ b/lib/en-us.toml
@@ -464,5 +464,17 @@ code = "
 ==============================================
 "
 
+[remote.setup]
+
+email = "Welcome!
+
+By using Telebit you agree to:
+
+      [x] Accept the Telebit™ terms of service
+      [x] Accept the Let's Encrypt™ terms of service
+
+Enter your email to agree and login/create your account:
+"
+
 [daemon]
 version = "telebit daemon v{version}"
-- 
2.38.5


From 07e9bd7ed92ec5b55b59ab7369640a6d4df10a20 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 18 Oct 2018 01:11:37 -0600
Subject: [PATCH 16/68] wip web setup

---
 lib/admin/documentation/index.html | 60 +++++++++++++++++++++
 lib/admin/index.html               | 85 +++++++++++++++++++-----------
 lib/admin/js/app.js                | 27 +++++++++-
 3 files changed, 141 insertions(+), 31 deletions(-)
 create mode 100644 lib/admin/documentation/index.html

diff --git a/lib/admin/documentation/index.html b/lib/admin/documentation/index.html
new file mode 100644
index 0000000..88cb646
--- /dev/null
+++ b/lib/admin/documentation/index.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Telebit Documentation</title>
+</head>
+<body>
+  <div class="v-app">
+    <h1>Telebit (Remote) Documentation</h1>
+
+    <section>
+      <h2>GET /api/config</h2>
+      <pre><code>{{ config }}</code></pre>
+    </section>
+
+    <section>
+      <h2>GET /api/status</h2>
+      <pre><code>{{ status }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/init</h2>
+      <form v-on:submit.stop.prevent="initialize">
+
+        <label for="-email">Email:</label>
+        <input id="-email" v-model="init.email" type="text" placeholder="john@example.com">
+        <br>
+
+        <label for="-teletos"><input id="-teletos" v-model="init.teletos" type="checkbox">
+          Accept Telebit Terms of Service</label>
+        <br>
+
+        <label for="-letos"><input id="-letos" v-model="init.letos" type="checkbox">
+          Accept Let's Encrypt Terms of Service</label>
+        <br>
+
+      </form>
+      <pre><code>{{ init }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/http</h2>
+      <pre><code>{{ http }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/tcp</h2>
+      <pre><code>{{ tcp }}</code></pre>
+    </section>
+
+    <section>
+      <h2>POST /api/ssh</h2>
+      <pre><code>{{ ssh }}</code></pre>
+    </section>
+
+  </div>
+
+  <script src="/js/vue.js"></script>
+  <script src="/js/app.js"></script>
+</body>
+</html>
diff --git a/lib/admin/index.html b/lib/admin/index.html
index 0b180dc..bf11dba 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -1,60 +1,85 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <title>Telebit Admin</title>
+  <title>Telebit Setup</title>
 </head>
 <body>
   <div class="v-app">
-    <h1>Telebit Admin</h1>
+    <h1>Telebit (Remote) Setup</h1>
 
-    <section>
-      <h2>GET /api/config</h2>
-      <pre><code>{{ config }}</code></pre>
-    </section>
-
-    <section>
-      <h2>GET /api/status</h2>
-      <pre><code>{{ status }}</code></pre>
-    </section>
-
-    <section>
-      <h2>POST /api/init</h2>
+    <section v-if="views.section.create">
+      <h2>Create Account</h2>
       <form v-on:submit.stop.prevent="initialize">
 
         <label for="-email">Email:</label>
-        <input id="-email" v-model="init.email" type="text" placeholder="john@example.com">
+        <input id="-email" v-model="init.email" type="text" placeholder="john@example.com" required>
         <br>
 
-        <label for="-teletos"><input id="-teletos" v-model="init.teletos" type="checkbox">
+        <label for="-teletos"><input id="-teletos" v-model="init.teletos" type="checkbox" required>
           Accept Telebit Terms of Service</label>
         <br>
 
-        <label for="-letos"><input id="-letos" v-model="init.letos" type="checkbox">
+        <label for="-letos"><input id="-letos" v-model="init.letos" type="checkbox" required>
           Accept Let's Encrypt Terms of Service</label>
         <br>
 
+        <label for="-notifications">Notification Preferences</label>
+        <select id="-notifications" v-model="init.notifications">
+          <option value="newsletter">Occassional Newsletter</option>
+          <option value="important" default><strong>Important Messages Only</strong></option>
+          <option value="required">Required Only</option>
+        </select>
+
+        <small>
+        <p v-if="'newsletter' == init.notifications">
+        You'll receive a friendly note now and then in addition to the important updates.
+        </p>
+        <p v-if="'important' == init.notifications">
+        You'll only receive updates that we believe will be of the most value to you, and the required updates.
+        </p>
+        <p v-if="'required' == init.notifications">
+        You'll only receive security updates, transactional and account-related messages, and legal notices.
+        </p>
+        </small>
+
+        <label for="-relay">[Advanced] Relay:</label>
+        <input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
+        <br>
+        <button type="button" v-on:click="defaultRelay">Use Default</button>
+        <button type="button" v-on:click="betaRelay">Use Beta</button>
+        <br>
+
+        <button type="submit">Accept &amp; Continue</button>
+
       </form>
       <pre><code>{{ init }}</code></pre>
     </section>
 
-    <section>
-      <h2>POST /api/http</h2>
-      <pre><code>{{ http }}</code></pre>
-    </section>
+    <section v-if="views.section.advanced">
+      <h2>Advanced Setup</h2>
+      <form v-on:submit.stop.prevent="initialize">
 
-    <section>
-      <h2>POST /api/tcp</h2>
-      <pre><code>{{ tcp }}</code></pre>
-    </section>
+        <label for="-secret">Relay Secret:</label>
+        <input id="-secret" v-model="init.secret" type="text" placeholder="ex: xxxxxxxxxxxx">
+        <br>
 
-    <section>
-      <h2>POST /api/ssh</h2>
-      <pre><code>{{ ssh }}</code></pre>
+        <label for="-telemetry"><input id="-telemetry" v-model="init.telemetry" type="checkbox">
+          Contribute to Telebit by sharing telemetry</label>
+        <br>
+
+        <label for="-relay">[Advanced] Relay:</label>
+        <input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
+        <br>
+
+        <button type="submit">Accept &amp; Continue</button>
+
+      </form>
+      <pre><code>{{ init }}</code></pre>
     </section>
 
   </div>
 
-  <script src="js/vue.js"></script>
-  <script src="js/app.js"></script>
+  <script src="/js/vue.js"></script>
+  <script src="/js/app.js"></script>
 </body>
 </html>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index cef624b..021f781 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -23,17 +23,42 @@ api.status = function apiStatus() {
   });
 };
 
+// TODO test for internet connectivity (and telebit connectivity)
+var DEFAULT_RELAY = 'telebit.cloud';
+var BETA_RELAY = 'telebit.ppl.family';
 var appData = {
   config: null
 , status: null
-, init: {}
+, init: {
+    teletos: true
+  , letos: true
+  , notifications: "important"
+  , relay: DEFAULT_RELAY
+  }
 , http: null
 , tcp: null
 , ssh: null
+, views: {
+    section: {
+      create: true
+    }
+  }
 };
 var appMethods = {
   initialize: function () {
     console.log("call initialize");
+    if (!appData.init.relay) {
+      appData.init.relay = DEFAULT_RELAY;
+    }
+    if (DEFAULT_RELAY !== appData.init.relay) {
+      window.alert("TODO: Custom Relay Not Implemented Yet");
+    }
+  }
+, defaultRelay: function () {
+    appData.init.relay = DEFAULT_RELAY;
+  }
+, betaRelay: function () {
+    appData.init.relay = BETA_RELAY;
   }
 };
 
-- 
2.38.5


From f2e60dae5e47016cf01d2a72cb5f57b4e1b98f0a Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 18 Oct 2018 01:11:54 -0600
Subject: [PATCH 17/68] wip i18n cli

---
 bin/telebit-remote.js | 13 +++++--------
 bin/telebitd.js       |  6 ++++++
 lib/en-us.toml        |  8 ++++++++
 3 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index b6fcb3c..3ef5ebc 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -123,13 +123,10 @@ function askForConfig(state, mainCb) {
             return;
           }
           if (200 !== resp.statusCode || (Buffer.isBuffer(body) || 'object' !== typeof body) || !body.api_host) {
-            console.warn("===================");
-            console.warn("      WARNING      ");
-            console.warn("===================");
-            console.warn("");
-            console.warn("[" + resp.statusCode + "] '" + urlstr + "'");
-            console.warn("This server does not describe a current telebit version (but it may still work).");
-            console.warn("");
+            console.warn(TPLS.remote.setup.fail_relay_check
+              .replace(/{{\s*status_code\s*}}/, resp.statusCode)
+              .replace(/{{\s*url\s*}}/, urlstr)
+            );
             console.warn(body);
           } else if (body && body.pair_request) {
             state._can_pair = true;
@@ -158,7 +155,7 @@ function askForConfig(state, mainCb) {
     }
   ];
   var standardSet = [
-    // There are questions that we need to aks in the CLI
+    // There are questions that we need to ask in the CLI
     // if we can't guarantee that they are being asked in the web interface
     function askAgree(cb) {
       if (state.config.agreeTos) { cb(); return; }
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 006cc41..10071d7 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -400,6 +400,12 @@ function handleApi(req, res) {
       res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
       return;
     }
+    if (!Array.isArray(opts.body)) {
+      // TODO
+      res.statusCode = 500;
+      res.end('{"error":{"message":"[internal error (our fault)] module \'init\' expected an array"}}');
+      return;
+    }
     // relay, email, agree_tos, servernames, ports
     //
     opts.body.forEach(function (opt) {
diff --git a/lib/en-us.toml b/lib/en-us.toml
index 21d77e7..161d6c9 100644
--- a/lib/en-us.toml
+++ b/lib/en-us.toml
@@ -476,5 +476,13 @@ By using Telebit you agree to:
 Enter your email to agree and login/create your account:
 "
 
+fail_relay_check = "===================
+      WARNING
+===================
+
+[{{status_code}}] '{{url}}'
+This server does not describe a current telebit version (but it may still work).
+"
+
 [daemon]
 version = "telebit daemon v{version}"
-- 
2.38.5


From f0222baff6579a62e43c77f650296591373e9d97 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 18 Oct 2018 01:52:30 -0600
Subject: [PATCH 18/68] wip adapt common init for web setup

---
 lib/admin/index.html    |   1 +
 lib/admin/js/app.js     |   8 ++
 lib/admin/js/telebit.js | 247 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 256 insertions(+)
 create mode 100644 lib/admin/js/telebit.js

diff --git a/lib/admin/index.html b/lib/admin/index.html
index bf11dba..97855c8 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -80,6 +80,7 @@
   </div>
 
   <script src="/js/vue.js"></script>
+  <script src="/js/telebit.js"></script>
   <script src="/js/app.js"></script>
 </body>
 </html>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 021f781..8554aa2 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -4,6 +4,7 @@
 console.log("hello");
 
 var Vue = window.Vue;
+var Telebit = window.TELEBIT;
 var api = {};
 
 api.config = function apiConfig() {
@@ -53,6 +54,13 @@ var appMethods = {
     if (DEFAULT_RELAY !== appData.init.relay) {
       window.alert("TODO: Custom Relay Not Implemented Yet");
     }
+    Telebit.api.directory({ relay: appData.init.relay }, function (err, dir) {
+      if (err) {
+        window.alert("Error:" + (err.message || JSON.stringify(err, null, 2)));
+        return;
+      }
+      window.alert("Success:" + JSON.stringify(dir, null, 2));
+    });
   }
 , defaultRelay: function () {
     appData.init.relay = DEFAULT_RELAY;
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
new file mode 100644
index 0000000..7ba8a31
--- /dev/null
+++ b/lib/admin/js/telebit.js
@@ -0,0 +1,247 @@
+;(function (exports) {
+'use strict';
+
+var common = exports.TELEBIT = {};
+
+if ('undefined' !== typeof fetch) {
+  common.requestAsync = function (opts) {
+    if (opts.json && true !== opts.json) {
+      opts.body = opts.json;
+    }
+    if (opts.json) {
+      if (!opts.headers) { opts.headers = {}; }
+      if (opts.body) {
+        opts.headers['Content-Type'] = 'application/json';
+      } else {
+        opts.headers.Accepts = 'application/json';
+      }
+    }
+    return window.fetch(opts.url, opts).then(function (resp) {
+      return resp.json().then(function (json) {
+        var headers = {};
+        resp.headers.forEach(function (k, v) {
+          headers[k] = v;
+        });
+        return { statusCode: resp.status, headers: headers, body: json };
+      });
+    });
+  };
+} else {
+  common.requestAsync = require('util').promisify(require('@coolaj86/urequest'));
+}
+
+common.parseUrl = function (hostname) {
+  // add scheme, if missing
+  if (!/:\/\//.test(hostname)) {
+    hostname = 'https://' + hostname;
+  }
+  var location = new URL(hostname);
+  hostname = location.hostname + (location.port ? ':' + location.port : '');
+  hostname = location.protocol.replace(/https?/, 'https') + '//' + hostname + location.pathname;
+  return hostname;
+};
+common.parseHostname = function (hostname) {
+  var location = new URL(hostname);
+  if (!location.protocol || /\./.test(location.protocol)) {
+    hostname = 'https://' + hostname;
+    location = new URL(hostname);
+  }
+  //hostname = location.hostname + (location.port ? ':' + location.port : '');
+  //hostname = location.protocol.replace(/https?/, 'https') + '//' + hostname + location.pathname;
+  return location.hostname;
+};
+
+common.apiDirectory = '_apis/telebit.cloud/index.json';
+
+common.otp = function getOtp() {
+  return Math.round(Math.random() * 9999).toString().padStart(4, '0');
+};
+common.signToken = function (state) {
+  var jwt = require('jsonwebtoken');
+  var tokenData = {
+    domains: Object.keys(state.config.servernames || {}).filter(function (name) {
+      return /\./.test(name);
+    })
+  , ports: Object.keys(state.config.ports || {}).filter(function (port) {
+      port = parseInt(port, 10);
+      return port > 0 && port <= 65535;
+    })
+  , aud: state._relayUrl
+  , iss: Math.round(Date.now() / 1000)
+  };
+
+  return jwt.sign(tokenData, state.config.secret);
+};
+common.api = {};
+common.api.directory = function (state, next) {
+  console.log('state:');
+  console.log(state);
+  state._relayUrl = common.parseUrl(state.relay);
+  common.requestAsync({ url: state._relayUrl + common.apiDirectory, json: true }).then(function (resp) {
+    var dir = resp.body;
+    if (!dir) { dir = { api_host: ':hostname', tunnel: { method: "wss", pathname: "" } }; }
+    state._apiDirectory = dir;
+    next(null, dir);
+  }).catch(function (err) {
+    next(err);
+  });
+};
+common.api._parseWss = function (state, dir) {
+  if (!dir || !dir.api_host) {
+    dir = { api_host: ':hostname', tunnel: { method: "wss", pathname: "" } };
+  }
+  state._relayHostname = common.parseHostname(state.relay);
+  return dir.tunnel.method + '://' + dir.api_host.replace(/:hostname/g, state._relayHostname) + dir.tunnel.pathname;
+};
+common.api.wss = function (state, cb) {
+  common.api.directory(state, function (err, dir) {
+    cb(err, common.api._parseWss(state, dir));
+  });
+};
+common.api.token = function (state, handlers) {
+  common.api.directory(state, function (err, dir) {
+    // directory, requested, connect, tunnelUrl, offer, granted, end
+    function afterDir() {
+      if (common.debug) { console.log('[debug] after dir'); }
+      state.wss = common.api._parseWss(state, dir);
+
+      handlers.tunnelUrl(state.wss, function () {
+        if (common.debug) { console.log('[debug] after tunnelUrl'); }
+        if (state.config.secret /* && !state.config.token */) {
+          state.config._token = common.signToken(state);
+        }
+        state.token = state.token || state.config.token || state.config._token;
+        if (state.token) {
+          if (common.debug) { console.log('[debug] token via token or secret'); }
+          // { token, pretoken }
+          handlers.connect(state.token, function () {
+            handlers.end(null, function () {});
+          });
+          return;
+        }
+
+        // backwards compat (TODO remove)
+        if (err || !dir || !dir.pair_request) {
+          if (common.debug) { console.log('[debug] no dir, connect'); }
+          handlers.error(new Error("No token found or generated, and no pair_request api found."));
+          return;
+        }
+
+        // TODO sign token with own private key, including public key and thumbprint
+        //      (much like ACME JOSE account)
+        var otp = state.config._otp; // common.otp();
+        var authReq = {
+          subject: state.config.email
+        , subject_scheme: 'mailto'
+          // TODO create domains list earlier
+        , scope: (state.config._servernames || Object.keys(state.config.servernames || {}))
+            .concat(state.config._ports || Object.keys(state.config.ports || {})).join(',')
+        , otp: otp
+        // TODO make call to daemon for this info beforehand
+        /*
+        , hostname: os.hostname()
+          // Used for User-Agent
+        , os_type: os.type()
+        , os_platform: os.platform()
+        , os_release: os.release()
+        , os_arch: os.arch()
+        */
+        };
+        var pairRequestUrl = new URL(dir.pair_request.pathname, 'https://' + dir.api_host.replace(/:hostname/g, state._relayHostname));
+        var req = {
+          url: pairRequestUrl
+        , method: dir.pair_request.method
+        , json: authReq
+        };
+        var firstReq = true;
+        var firstReady = true;
+
+        function gotoNext(req) {
+          if (common.debug) { console.log('[debug] gotoNext called'); }
+          if (common.debug) { console.log(req); }
+          common.requestAsync(req).then(function (resp) {
+            var body = resp.body;
+
+            function checkLocation() {
+              if (common.debug) { console.log('[debug] checkLocation'); }
+              if (common.debug) { console.log(body); }
+              // pending, try again
+              if ('pending' === body.status && resp.headers.location) {
+                if (common.debug) { console.log('[debug] pending'); }
+                setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
+                return;
+              }
+
+              if ('ready' === body.status) {
+                if (common.debug) { console.log('[debug] ready'); }
+                if (firstReady) {
+                  if (common.debug) { console.log('[debug] first ready'); }
+                  firstReady = false;
+                  state.token = body.access_token;
+                  state.config.token = state.token;
+                  handlers.offer(body.access_token, function () {
+                    /*ignore*/
+                  });
+                }
+                setTimeout(gotoNext, 2 * 1000, req);
+                return;
+              }
+
+              if ('complete' === body.status) {
+                if (common.debug) { console.log('[debug] complete'); }
+                handlers.granted(null, function () {
+                  handlers.end(null, function () {});
+                });
+                return;
+              }
+
+              if (common.debug) { console.log('[debug] bad status'); }
+              var err = new Error("Bad State:" + body.status);
+              err._request = req;
+              handlers.error(err, function () {});
+            }
+
+            if (firstReq) {
+              if (common.debug) { console.log('[debug] first req'); }
+              handlers.requested(authReq, function () {
+                handlers.connect(body.access_token || body.jwt, function () {
+                  var err;
+                  if (!resp.headers.location) {
+                    err = new Error("bad authentication request response");
+                    err._resp = resp.toJSON && resp.toJSON();
+                    handlers.error(err, function () {});
+                    return;
+                  }
+                  setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
+                });
+              });
+              firstReq = false;
+              return;
+            } else {
+              if (common.debug) { console.log('[debug] other req'); }
+              checkLocation();
+            }
+          }).catch(function (err) {
+            if (common.debug) { console.log('[debug] gotoNext error'); }
+            err._request = req;
+            err._hint = '[telebitd.js] pair request';
+            handlers.error(err, function () {});
+          });
+        }
+
+        gotoNext(req);
+
+      });
+    }
+
+    if (dir && dir.api_host) {
+      handlers.directory(dir, afterDir);
+    } else {
+      // backwards compat
+      dir = { api_host: ':hostname', tunnel: { method: "wss", pathname: "" } };
+      afterDir();
+    }
+  });
+
+};
+}('undefined' !== typeof module ? module.exports : window));
-- 
2.38.5


From 40d78b463f20075651413f41bbf3cef2b229cef3 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 20 Oct 2018 16:46:53 -0600
Subject: [PATCH 19/68] use local relay to avoid cors

---
 bin/telebitd.js         | 20 ++++++++++++++++++++
 lib/admin/js/telebit.js | 29 ++++++++++++++++++++++++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 10071d7..4149f2d 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -15,6 +15,8 @@ var url = require('url');
 var path = require('path');
 var os = require('os');
 var fs = require('fs');
+var urequest = require('@coolaj86/urequest');
+var urequestAsync = require('util').promisify(urequest);
 var common = require('../lib/cli-common.js');
 var http = require('http');
 var TOML = require('toml');
@@ -328,6 +330,20 @@ controllers.ssh = function (req, res, opts) {
   state.config.sshAuto = sshAuto;
   sshSuccess();
 };
+controllers.relay = function (req, res, opts) {
+  if (!opts.body) {
+    res.statusCode = 422;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({"error":{"message":"module \'relay\' needs more arguments"}}));
+    return;
+  }
+
+  return urequestAsync(opts.body).then(function (resp) {
+    res.setHeader('Content-Type', 'application/json');
+    var resp = resp.toJSON();
+    res.end(JSON.stringify(resp));
+  });
+};
 
 var serveStatic = require('serve-static')(path.join(__dirname, '../lib/admin/'));
 function handleRemoteClient(req, res) {
@@ -668,6 +684,10 @@ function handleApi(req, res) {
       listSuccess();
       return;
     }
+    if (/relay/.test(opts.pathname)) {
+      controllers.relay(req, res, opts);
+      return;
+    }
 
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index 7ba8a31..bb7fe75 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -3,8 +3,17 @@
 
 var common = exports.TELEBIT = {};
 
+/* global Promise */
+var PromiseA;
+if ('undefined' !== typeof Promise) {
+  PromiseA = Promise;
+} else {
+  throw new Error("no Promise implementation defined");
+}
+
 if ('undefined' !== typeof fetch) {
   common.requestAsync = function (opts) {
+    /*
     if (opts.json && true !== opts.json) {
       opts.body = opts.json;
     }
@@ -16,13 +25,31 @@ if ('undefined' !== typeof fetch) {
         opts.headers.Accepts = 'application/json';
       }
     }
-    return window.fetch(opts.url, opts).then(function (resp) {
+    */
+    // funnel requests through the local server
+    // (avoid CORS, for now)
+    var relayOpts = {
+      url: '/api/relay'
+    , method: 'POST'
+    , headers: {
+        'Content-Type': 'application/json'
+      , 'Accepts': 'application/json'
+      }
+    , body: JSON.stringify(opts)
+    };
+    return window.fetch(relayOpts.url, relayOpts).then(function (resp) {
       return resp.json().then(function (json) {
+        /*
         var headers = {};
         resp.headers.forEach(function (k, v) {
           headers[k] = v;
         });
         return { statusCode: resp.status, headers: headers, body: json };
+        */
+        if (json.error) {
+          return PromiseA.reject(new Error(json.error && json.error.message || JSON.stringify(json.error)));
+        }
+        return json;
       });
     });
   };
-- 
2.38.5


From b81f0ecedebca7baff3c6bd986190ecf3c093907 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 20 Oct 2018 19:11:16 -0600
Subject: [PATCH 20/68] use details and summary for advanced

---
 lib/admin/index.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/admin/index.html b/lib/admin/index.html
index 97855c8..f6bfa12 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -42,12 +42,14 @@
         </p>
         </small>
 
-        <label for="-relay">[Advanced] Relay:</label>
-        <input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
+        <details><summary><small>Advanced</small></summary>
+        <label for="-relay">Relay:</label><input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
         <br>
         <button type="button" v-on:click="defaultRelay">Use Default</button>
         <button type="button" v-on:click="betaRelay">Use Beta</button>
         <br>
+        <br>
+        </details>
 
         <button type="submit">Accept &amp; Continue</button>
 
-- 
2.38.5


From 9e1c9c00ca0db130dd606b7627289bed459c5645 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 20 Oct 2018 23:25:14 -0600
Subject: [PATCH 21/68] web ui updates

---
 lib/admin/index.html    |  41 ++++--
 lib/admin/js/app.js     | 124 +++++++++++++++--
 lib/admin/js/telebit.js | 299 +++++++++++++++++++++-------------------
 3 files changed, 301 insertions(+), 163 deletions(-)

diff --git a/lib/admin/index.html b/lib/admin/index.html
index f6bfa12..1a743f5 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -7,7 +7,7 @@
   <div class="v-app">
     <h1>Telebit (Remote) Setup</h1>
 
-    <section v-if="views.section.create">
+    <section v-if="views.section.setup">
       <h2>Create Account</h2>
       <form v-on:submit.stop.prevent="initialize">
 
@@ -43,12 +43,23 @@
         </small>
 
         <details><summary><small>Advanced</small></summary>
-        <label for="-relay">Relay:</label><input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
+
+        <label for="-relay">Relay:</label>
+          <input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
         <br>
         <button type="button" v-on:click="defaultRelay">Use Default</button>
         <button type="button" v-on:click="betaRelay">Use Beta</button>
         <br>
         <br>
+
+        <label for="-acme-server">ACME (Let's Encrypt) Server:</label>
+          <input id="-acme-server" v-model="init.acmeServer" type="text" placeholder="https://acme-v02.api.letsencrypt.org/directory">
+        <br>
+        <button type="button" v-on:click="productionAcme">Use Production</button>
+        <button type="button" v-on:click="stagingAcme">Use Staging</button>
+        <br>
+        <br>
+
         </details>
 
         <button type="submit">Accept &amp; Continue</button>
@@ -58,22 +69,32 @@
     </section>
 
     <section v-if="views.section.advanced">
-      <h2>Advanced Setup</h2>
-      <form v-on:submit.stop.prevent="initialize">
+      <h2>Advanced Setup for {{ init.relay }}</h2>
+      <form v-on:submit.stop.prevent="advance">
 
-        <label for="-secret">Relay Secret:</label>
+        <strong><label for="-secret">Relay Shared Secret:</label></strong>
         <input id="-secret" v-model="init.secret" type="text" placeholder="ex: xxxxxxxxxxxx">
         <br>
 
+        <strong><label for="-domains">Domains:</label></strong>
+        <br>
+        <small>(comma separated list of domains to use for http, tls, https, etc)</small>
+        <br>
+        <input id="-domains" v-model="init.domains" type="text" placeholder="ex: whatever.com, example.com">
+        <br>
+
+        <strong><label for="-ports">TCP Ports:</label></strong>
+        <br>
+        <small>(comman separated list of ports, excluding 80 and 443, typically port over 1024)</small>
+        <br>
+        <input id="-ports" v-model="init.ports" type="text" placeholder="ex: 5050, 3000, 8080">
+        <br>
+
         <label for="-telemetry"><input id="-telemetry" v-model="init.telemetry" type="checkbox">
           Contribute to Telebit by sharing telemetry</label>
         <br>
 
-        <label for="-relay">[Advanced] Relay:</label>
-        <input id="-relay" v-model="init.relay" type="text" placeholder="telebit.cloud">
-        <br>
-
-        <button type="submit">Accept &amp; Continue</button>
+        <button type="submit">Finish</button>
 
       </form>
       <pre><code>{{ init }}</code></pre>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 8554aa2..a624af2 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -1,14 +1,29 @@
 ;(function () {
 'use strict';
 
-console.log("hello");
-
 var Vue = window.Vue;
 var Telebit = window.TELEBIT;
 var api = {};
 
+/*globals AbortController*/
+function safeFetch(url, opts) {
+  var controller = new AbortController();
+  var tok = setTimeout(function () {
+    controller.abort();
+  }, 4000);
+  if (!opts) {
+    opts = {};
+  }
+  opts.signal = controller.signal;
+  return window.fetch(url, opts).finally(function () {
+    clearTimeout(tok);
+  });
+}
+
 api.config = function apiConfig() {
-  return window.fetch("/api/config", { method: "GET" }).then(function (resp) {
+  return safeFetch("/api/config", {
+    method: "GET"
+  }).then(function (resp) {
     return resp.json().then(function (json) {
       appData.config = json;
       return json;
@@ -16,17 +31,43 @@ api.config = function apiConfig() {
   });
 };
 api.status = function apiStatus() {
-  return window.fetch("/api/status", { method: "GET" }).then(function (resp) {
+  return safeFetch("/api/status", { method: "GET" }).then(function (resp) {
     return resp.json().then(function (json) {
       appData.status = json;
       return json;
     });
   });
 };
+api.initialize = function apiInitialize() {
+  var opts = {
+    method: "POST"
+  , headers: {
+      'Content-Type': 'application/json'
+    }
+  , body: JSON.stringify({
+      foo: 'bar'
+    })
+  };
+  return safeFetch("/api/init", opts).then(function (resp) {
+    return resp.json().then(function (json) {
+      appData.initResult = json;
+      window.alert("Error: [success] " + JSON.stringify(json, null, 2));
+      return json;
+    }).catch(function (err) {
+      window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
+    });
+  });
+};
 
 // TODO test for internet connectivity (and telebit connectivity)
 var DEFAULT_RELAY = 'telebit.cloud';
 var BETA_RELAY = 'telebit.ppl.family';
+var TELEBIT_RELAYS = [
+  DEFAULT_RELAY
+, BETA_RELAY
+];
+var PRODUCTION_ACME = 'https://acme-v02.api.letsencrypt.org/directory';
+var STAGING_ACME = 'https://acme-staging-v02.api.letsencrypt.org/directory';
 var appData = {
   config: null
 , status: null
@@ -35,40 +76,93 @@ var appData = {
   , letos: true
   , notifications: "important"
   , relay: DEFAULT_RELAY
+  , telemetry: true
+  , acmeServer: PRODUCTION_ACME
   }
 , http: null
 , tcp: null
 , ssh: null
 , views: {
     section: {
-      create: true
+      setup: false
+    , advanced: false
     }
   }
 };
+var telebitState = {};
 var appMethods = {
   initialize: function () {
     console.log("call initialize");
     if (!appData.init.relay) {
       appData.init.relay = DEFAULT_RELAY;
     }
-    if (DEFAULT_RELAY !== appData.init.relay) {
-      window.alert("TODO: Custom Relay Not Implemented Yet");
-    }
-    Telebit.api.directory({ relay: appData.init.relay }, function (err, dir) {
-      if (err) {
-        window.alert("Error:" + (err.message || JSON.stringify(err, null, 2)));
+    appData.init.relay = appData.init.relay.toLowerCase();
+    telebitState = { relay: appData.init.relay };
+    return Telebit.api.directory(telebitState).then(function (dir) {
+      if (!dir.api_host) {
+        window.alert("Error: '" + telebitState.relay + "' does not appear to be a valid telebit service");
         return;
       }
-      window.alert("Success:" + JSON.stringify(dir, null, 2));
+      if (-1 !== TELEBIT_RELAYS.indexOf(appData.init.relay)) {
+        return api.initialize();
+      } else {
+        changeState('advanced');
+      }
+    }).catch(function (err) {
+      window.alert("Error: [directory] " + (err.message || JSON.stringify(err, null, 2)));
     });
   }
+, advance: function () {
+    return api.initialize();
+  }
+, productionAcme: function () {
+    console.log("prod acme:");
+    appData.init.acmeServer = PRODUCTION_ACME;
+    console.log(appData.init.acmeServer);
+  }
+, stagingAcme: function () {
+    console.log("staging acme:");
+    appData.init.acmeServer = STAGING_ACME;
+    console.log(appData.init.acmeServer);
+  }
 , defaultRelay: function () {
     appData.init.relay = DEFAULT_RELAY;
   }
 , betaRelay: function () {
     appData.init.relay = BETA_RELAY;
   }
+, defaultRhubarb: function () {
+    appData.init.rhubarb = DEFAULT_RELAY;
+  }
+, betaRhubarb: function () {
+    appData.init.rhubarb = BETA_RELAY;
+  }
 };
+var appStates = {
+  setup: function () {
+    appData.views.section = { setup: true };
+  }
+, advanced: function () {
+    appData.views.section = { advanced: true };
+  }
+};
+
+function changeState(newstate) {
+  location.hash = '#/' + newstate + '/';
+}
+window.addEventListener('hashchange', setState, false);
+function setState(/*ev*/) {
+  //ev.oldURL
+  //ev.newURL
+  var parts = location.hash.substr(1).replace(/^\//, '').replace(/\/$/, '').split('/');
+  var fn = appStates;
+  parts.forEach(function (s) {
+    console.log("state:", s);
+    fn = fn[s];
+  });
+  fn();
+  //appMethods.states[newstate]();
+}
 
 new Vue({
   el: ".v-app"
@@ -76,8 +170,12 @@ new Vue({
 , methods: appMethods
 });
 
+
 api.config();
-api.status();
+api.status().then(function () {
+  changeState('setup');
+  setState();
+});
 
 window.api = api;
 }());
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index bb7fe75..46e4da1 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -11,6 +11,7 @@ if ('undefined' !== typeof Promise) {
   throw new Error("no Promise implementation defined");
 }
 
+/*globals AbortController*/
 if ('undefined' !== typeof fetch) {
   common.requestAsync = function (opts) {
     /*
@@ -37,7 +38,16 @@ if ('undefined' !== typeof fetch) {
       }
     , body: JSON.stringify(opts)
     };
+    var controller = new AbortController();
+    var tok = setTimeout(function () {
+      controller.abort();
+    }, 4000);
+    if (!relayOpts) {
+      relayOpts = {};
+    }
+    relayOpts.signal = controller.signal;
     return window.fetch(relayOpts.url, relayOpts).then(function (resp) {
+      clearTimeout(tok);
       return resp.json().then(function (json) {
         /*
         var headers = {};
@@ -100,17 +110,20 @@ common.signToken = function (state) {
   return jwt.sign(tokenData, state.config.secret);
 };
 common.api = {};
-common.api.directory = function (state, next) {
-  console.log('state:');
+common.api.directory = function (state) {
+  console.log('[DEBUG] state:');
   console.log(state);
   state._relayUrl = common.parseUrl(state.relay);
-  common.requestAsync({ url: state._relayUrl + common.apiDirectory, json: true }).then(function (resp) {
+  if (!state._relays) { state._relays = {}; }
+  if (state._relays[state._relayUrl]) {
+    return PromiseA.resolve(state._relays[state._relayUrl]);
+  }
+  return common.requestAsync({ url: state._relayUrl + common.apiDirectory, json: true }).then(function (resp) {
     var dir = resp.body;
-    if (!dir) { dir = { api_host: ':hostname', tunnel: { method: "wss", pathname: "" } }; }
-    state._apiDirectory = dir;
-    next(null, dir);
+    state._relays[state._relayUrl] = dir;
+    return dir;
   }).catch(function (err) {
-    next(err);
+    return PromiseA.reject(err);
   });
 };
 common.api._parseWss = function (state, dir) {
@@ -121,153 +134,159 @@ common.api._parseWss = function (state, dir) {
   return dir.tunnel.method + '://' + dir.api_host.replace(/:hostname/g, state._relayHostname) + dir.tunnel.pathname;
 };
 common.api.wss = function (state, cb) {
-  common.api.directory(state, function (err, dir) {
-    cb(err, common.api._parseWss(state, dir));
-  });
+  common.api.directory(state).then(function (dir) {
+    cb(null, common.api._parseWss(state, dir));
+  }).catch(cb);
 };
 common.api.token = function (state, handlers) {
-  common.api.directory(state, function (err, dir) {
-    // directory, requested, connect, tunnelUrl, offer, granted, end
-    function afterDir() {
-      if (common.debug) { console.log('[debug] after dir'); }
-      state.wss = common.api._parseWss(state, dir);
+  // directory, requested, connect, tunnelUrl, offer, granted, end
+  function afterDir(err, dir) {
+    if (common.debug) { console.log('[debug] after dir'); }
+    state.wss = common.api._parseWss(state, dir);
 
-      handlers.tunnelUrl(state.wss, function () {
-        if (common.debug) { console.log('[debug] after tunnelUrl'); }
-        if (state.config.secret /* && !state.config.token */) {
-          state.config._token = common.signToken(state);
-        }
-        state.token = state.token || state.config.token || state.config._token;
-        if (state.token) {
-          if (common.debug) { console.log('[debug] token via token or secret'); }
-          // { token, pretoken }
-          handlers.connect(state.token, function () {
-            handlers.end(null, function () {});
-          });
-          return;
-        }
+    handlers.tunnelUrl(state.wss, function () {
+      if (common.debug) { console.log('[debug] after tunnelUrl'); }
+      if (state.config.secret /* && !state.config.token */) {
+        state.config._token = common.signToken(state);
+      }
+      state.token = state.token || state.config.token || state.config._token;
+      if (state.token) {
+        if (common.debug) { console.log('[debug] token via token or secret'); }
+        // { token, pretoken }
+        handlers.connect(state.token, function () {
+          handlers.end(null, function () {});
+        });
+        return;
+      }
 
-        // backwards compat (TODO remove)
-        if (err || !dir || !dir.pair_request) {
-          if (common.debug) { console.log('[debug] no dir, connect'); }
-          handlers.error(new Error("No token found or generated, and no pair_request api found."));
-          return;
-        }
+      // backwards compat (TODO remove)
+      if (err || !dir || !dir.pair_request) {
+        if (common.debug) { console.log('[debug] no dir, connect'); }
+        handlers.error(new Error("No token found or generated, and no pair_request api found."));
+        return;
+      }
 
-        // TODO sign token with own private key, including public key and thumbprint
-        //      (much like ACME JOSE account)
-        var otp = state.config._otp; // common.otp();
-        var authReq = {
-          subject: state.config.email
-        , subject_scheme: 'mailto'
-          // TODO create domains list earlier
-        , scope: (state.config._servernames || Object.keys(state.config.servernames || {}))
-            .concat(state.config._ports || Object.keys(state.config.ports || {})).join(',')
-        , otp: otp
-        // TODO make call to daemon for this info beforehand
-        /*
-        , hostname: os.hostname()
-          // Used for User-Agent
-        , os_type: os.type()
-        , os_platform: os.platform()
-        , os_release: os.release()
-        , os_arch: os.arch()
-        */
-        };
-        var pairRequestUrl = new URL(dir.pair_request.pathname, 'https://' + dir.api_host.replace(/:hostname/g, state._relayHostname));
-        var req = {
-          url: pairRequestUrl
-        , method: dir.pair_request.method
-        , json: authReq
-        };
-        var firstReq = true;
-        var firstReady = true;
+      // TODO sign token with own private key, including public key and thumbprint
+      //      (much like ACME JOSE account)
+      var otp = state.config._otp; // common.otp();
+      var authReq = {
+        subject: state.config.email
+      , subject_scheme: 'mailto'
+        // TODO create domains list earlier
+      , scope: (state.config._servernames || Object.keys(state.config.servernames || {}))
+          .concat(state.config._ports || Object.keys(state.config.ports || {})).join(',')
+      , otp: otp
+      // TODO make call to daemon for this info beforehand
+      /*
+      , hostname: os.hostname()
+        // Used for User-Agent
+      , os_type: os.type()
+      , os_platform: os.platform()
+      , os_release: os.release()
+      , os_arch: os.arch()
+      */
+      };
+      var pairRequestUrl = new URL(dir.pair_request.pathname, 'https://' + dir.api_host.replace(/:hostname/g, state._relayHostname));
+      var req = {
+        url: pairRequestUrl
+      , method: dir.pair_request.method
+      , json: authReq
+      };
+      var firstReq = true;
+      var firstReady = true;
 
-        function gotoNext(req) {
-          if (common.debug) { console.log('[debug] gotoNext called'); }
-          if (common.debug) { console.log(req); }
-          common.requestAsync(req).then(function (resp) {
-            var body = resp.body;
+      function gotoNext(req) {
+        if (common.debug) { console.log('[debug] gotoNext called'); }
+        if (common.debug) { console.log(req); }
+        common.requestAsync(req).then(function (resp) {
+          var body = resp.body;
 
-            function checkLocation() {
-              if (common.debug) { console.log('[debug] checkLocation'); }
-              if (common.debug) { console.log(body); }
-              // pending, try again
-              if ('pending' === body.status && resp.headers.location) {
-                if (common.debug) { console.log('[debug] pending'); }
-                setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
-                return;
-              }
-
-              if ('ready' === body.status) {
-                if (common.debug) { console.log('[debug] ready'); }
-                if (firstReady) {
-                  if (common.debug) { console.log('[debug] first ready'); }
-                  firstReady = false;
-                  state.token = body.access_token;
-                  state.config.token = state.token;
-                  handlers.offer(body.access_token, function () {
-                    /*ignore*/
-                  });
-                }
-                setTimeout(gotoNext, 2 * 1000, req);
-                return;
-              }
-
-              if ('complete' === body.status) {
-                if (common.debug) { console.log('[debug] complete'); }
-                handlers.granted(null, function () {
-                  handlers.end(null, function () {});
-                });
-                return;
-              }
-
-              if (common.debug) { console.log('[debug] bad status'); }
-              var err = new Error("Bad State:" + body.status);
-              err._request = req;
-              handlers.error(err, function () {});
-            }
-
-            if (firstReq) {
-              if (common.debug) { console.log('[debug] first req'); }
-              handlers.requested(authReq, function () {
-                handlers.connect(body.access_token || body.jwt, function () {
-                  var err;
-                  if (!resp.headers.location) {
-                    err = new Error("bad authentication request response");
-                    err._resp = resp.toJSON && resp.toJSON();
-                    handlers.error(err, function () {});
-                    return;
-                  }
-                  setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
-                });
-              });
-              firstReq = false;
+          function checkLocation() {
+            if (common.debug) { console.log('[debug] checkLocation'); }
+            if (common.debug) { console.log(body); }
+            // pending, try again
+            if ('pending' === body.status && resp.headers.location) {
+              if (common.debug) { console.log('[debug] pending'); }
+              setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
               return;
-            } else {
-              if (common.debug) { console.log('[debug] other req'); }
-              checkLocation();
             }
-          }).catch(function (err) {
-            if (common.debug) { console.log('[debug] gotoNext error'); }
+
+            if ('ready' === body.status) {
+              if (common.debug) { console.log('[debug] ready'); }
+              if (firstReady) {
+                if (common.debug) { console.log('[debug] first ready'); }
+                firstReady = false;
+                state.token = body.access_token;
+                state.config.token = state.token;
+                handlers.offer(body.access_token, function () {
+                  /*ignore*/
+                });
+              }
+              setTimeout(gotoNext, 2 * 1000, req);
+              return;
+            }
+
+            if ('complete' === body.status) {
+              if (common.debug) { console.log('[debug] complete'); }
+              handlers.granted(null, function () {
+                handlers.end(null, function () {});
+              });
+              return;
+            }
+
+            if (common.debug) { console.log('[debug] bad status'); }
+            var err = new Error("Bad State:" + body.status);
             err._request = req;
-            err._hint = '[telebitd.js] pair request';
             handlers.error(err, function () {});
-          });
-        }
+          }
 
-        gotoNext(req);
+          if (firstReq) {
+            if (common.debug) { console.log('[debug] first req'); }
+            handlers.requested(authReq, function () {
+              handlers.connect(body.access_token || body.jwt, function () {
+                var err;
+                if (!resp.headers.location) {
+                  err = new Error("bad authentication request response");
+                  err._resp = resp.toJSON && resp.toJSON();
+                  handlers.error(err, function () {});
+                  return;
+                }
+                setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
+              });
+            });
+            firstReq = false;
+            return;
+          } else {
+            if (common.debug) { console.log('[debug] other req'); }
+            checkLocation();
+          }
+        }).catch(function (err) {
+          if (common.debug) { console.log('[debug] gotoNext error'); }
+          err._request = req;
+          err._hint = '[telebitd.js] pair request';
+          handlers.error(err, function () {});
+        });
+      }
 
-      });
-    }
-
-    if (dir && dir.api_host) {
-      handlers.directory(dir, afterDir);
-    } else {
-      // backwards compat
-      dir = { api_host: ':hostname', tunnel: { method: "wss", pathname: "" } };
-      afterDir();
+      gotoNext(req);
+
+    });
+  }
+
+  // backwards compat (TODO verify we can remove this)
+  var failoverDir = '{ "api_host": ":hostname", "tunnel": { "method": "wss", "pathname": "" } }';
+  common.api.directory(state).then(function (dir) {
+    if (!dir.api_host) {
+      dir = JSON.parse(failoverDir);
+      return afterDir(null, dir);
     }
+    handlers.directory(dir).then(function (dir) {
+      return afterDir(null, dir);
+    }).catch(function (err) {
+      return PromiseA.reject(err);
+    });
+  }).catch(function (err) {
+    return afterDir(err, JSON.parse(failoverDir));
   });
 
 };
-- 
2.38.5


From e6b7ba575f9f5058c39b4291a7e5a3af4c84f031 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 21 Oct 2018 03:32:04 -0600
Subject: [PATCH 22/68] wip trying to get auth request and token...

---
 bin/telebitd.js               |   5 +-
 lib/admin/index.html          |   1 +
 lib/admin/js/app.js           |  56 ++++++----
 lib/admin/js/telebit-token.js | 123 +++++++++++++++++++++
 lib/admin/js/telebit.js       | 197 +++++++++++++++++++++-------------
 5 files changed, 282 insertions(+), 100 deletions(-)
 create mode 100644 lib/admin/js/telebit-token.js

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 4149f2d..96e9f59 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -338,9 +338,12 @@ controllers.relay = function (req, res, opts) {
     return;
   }
 
+  console.log('POST /api/relay:');
+  console.log(opts.body);
+  console.log();
   return urequestAsync(opts.body).then(function (resp) {
     res.setHeader('Content-Type', 'application/json');
-    var resp = resp.toJSON();
+    resp = resp.toJSON();
     res.end(JSON.stringify(resp));
   });
 };
diff --git a/lib/admin/index.html b/lib/admin/index.html
index 1a743f5..c63b5d1 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -104,6 +104,7 @@
 
   <script src="/js/vue.js"></script>
   <script src="/js/telebit.js"></script>
+  <script src="/js/telebit-token.js"></script>
   <script src="/js/app.js"></script>
 </body>
 </html>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index a624af2..f937748 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -5,7 +5,7 @@ var Vue = window.Vue;
 var Telebit = window.TELEBIT;
 var api = {};
 
-/*globals AbortController*/
+/*
 function safeFetch(url, opts) {
   var controller = new AbortController();
   var tok = setTimeout(function () {
@@ -19,28 +19,29 @@ function safeFetch(url, opts) {
     clearTimeout(tok);
   });
 }
+*/
 
 api.config = function apiConfig() {
-  return safeFetch("/api/config", {
-    method: "GET"
+  return Telebit.reqLocalAsync({
+    url: "/api/config"
+  , method: "GET"
   }).then(function (resp) {
-    return resp.json().then(function (json) {
-      appData.config = json;
-      return json;
-    });
+    var json = resp.body;
+    appData.config = json;
+    return json;
   });
 };
 api.status = function apiStatus() {
-  return safeFetch("/api/status", { method: "GET" }).then(function (resp) {
-    return resp.json().then(function (json) {
-      appData.status = json;
-      return json;
-    });
+  return Telebit.reqLocalAsync({ url: "/api/status", method: "GET" }).then(function (resp) {
+    var json = resp.body;
+    appData.status = json;
+    return json;
   });
 };
 api.initialize = function apiInitialize() {
   var opts = {
-    method: "POST"
+    url: "/api/init"
+  , method: "POST"
   , headers: {
       'Content-Type': 'application/json'
     }
@@ -48,14 +49,13 @@ api.initialize = function apiInitialize() {
       foo: 'bar'
     })
   };
-  return safeFetch("/api/init", opts).then(function (resp) {
-    return resp.json().then(function (json) {
-      appData.initResult = json;
-      window.alert("Error: [success] " + JSON.stringify(json, null, 2));
-      return json;
-    }).catch(function (err) {
-      window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
-    });
+  return Telebit.reqLocalAsync(opts).then(function (resp) {
+    var json = resp.body;
+    appData.initResult = json;
+    window.alert("Error: [success] " + JSON.stringify(json, null, 2));
+    return json;
+  }).catch(function (err) {
+    window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
   });
 };
 
@@ -104,15 +104,27 @@ var appMethods = {
         return;
       }
       if (-1 !== TELEBIT_RELAYS.indexOf(appData.init.relay)) {
-        return api.initialize();
+        if (!telebitState.config) { telebitState.config = {}; }
+        if (!telebitState.config.relay) { telebitState.config.relay = telebitState.relay; }
+        telebitState.config.email = appData.init.email;
+        telebitState.config._otp = Telebit.otp();
+        return Telebit.authorize(telebitState).then(function () {
+          console.log('1 api.init...');
+          return api.initialize();
+        }).catch(function (err) {
+          console.error(err);
+          window.alert("Error: [authorize] " + (err.message || JSON.stringify(err, null, 2)));
+        });
       } else {
         changeState('advanced');
       }
     }).catch(function (err) {
+      console.error(err);
       window.alert("Error: [directory] " + (err.message || JSON.stringify(err, null, 2)));
     });
   }
 , advance: function () {
+    console.log('2 api.init...');
     return api.initialize();
   }
 , productionAcme: function () {
diff --git a/lib/admin/js/telebit-token.js b/lib/admin/js/telebit-token.js
new file mode 100644
index 0000000..4b09245
--- /dev/null
+++ b/lib/admin/js/telebit-token.js
@@ -0,0 +1,123 @@
+;(function (exports) {
+'use strict';
+
+/* global Promise */
+var PromiseA;
+if ('undefined' !== typeof Promise) {
+  PromiseA = Promise;
+} else {
+  throw new Error("no Promise implementation defined");
+}
+
+var common = exports.TELEBIT || require('./lib/common.js');
+
+common.authorize = common.getToken = function getToken(state) {
+  state.relay = state.config.relay;
+
+  // { _otp, config: {} }
+  return common.api.token(state, {
+    error: function (err) {
+      console.error("[Error] common.api.token handlers.error:");
+      console.error(err);
+      return PromiseA.reject(err);
+    }
+  , directory: function (dir) {
+      //console.log('[directory] Telebit Relay Discovered:');
+      //console.log(dir);
+      state._apiDirectory = dir;
+      return PromiseA.resolve();
+    }
+  , tunnelUrl: function (tunnelUrl) {
+      //console.log('[tunnelUrl] Telebit Relay Tunnel Socket:', tunnelUrl);
+      state.wss = tunnelUrl;
+      return PromiseA.resolve();
+    }
+  , requested: function (authReq) {
+      console.log("[requested] Pairing Requested");
+      state.config._otp = state.config._otp = authReq.otp;
+
+      if (!state.config.token && state._can_pair) {
+        console.info("0000".replace(/0000/g, state.config._otp));
+      }
+
+      return PromiseA.resolve();
+    }
+  , connect: function (pretoken) {
+      console.log("[connect] Enabling Pairing Locally...");
+      state.config.pretoken = pretoken;
+      state._connecting = true;
+
+      return common.reqLocalAsync({ url: '/api/config', method: 'POST', data: state.config || {} }).then(function () {
+        console.info("waiting...");
+        return PromiseA.resolve();
+      }).catch(function (err) {
+        state._error = err;
+        console.error("Error while initializing config [connect]:");
+        console.error(err);
+        return PromiseA.reject(err);
+      });
+    }
+  , offer: function (token) {
+      //console.log("[offer] Pairing Enabled by Relay");
+      state.config.token = token;
+      if (state._error) {
+        return;
+      }
+      state._connecting = true;
+      try {
+        //require('jsonwebtoken').decode(token);
+        token = token.split('.');
+        token[0] = token[0].replace(/_/g, '/').replace(/-/g, '+');
+        while (token[0].length % 4) { token[0] += '='; }
+        btoa(token[0]);
+        token[1] = token[1].replace(/_/g, '/').replace(/-/g, '+');
+        while (token[1].length % 4) { token[1] += '='; }
+        btoa(token[1]);
+        //console.log(require('jsonwebtoken').decode(token));
+      } catch(e) {
+        console.warn("[warning] could not decode token");
+      }
+      return common.reqLocalAsync({ url: '/api/config', method: 'POST', data: state.config }).then(function () {
+        //console.log("Pairing Enabled Locally");
+        return PromiseA.resolve();
+      }).catch(function (err) {
+        state._error = err;
+        console.error("Error while initializing config [offer]:");
+        console.error(err);
+        return PromiseA.reject(err);
+      });
+    }
+  , granted: function (/*_*/) {
+      //console.log("[grant] Pairing complete!");
+      return PromiseA.resolve();
+    }
+  , end: function () {
+      return common.reqLocalAsync({ url: '/api/enable', method: 'POST', data: [] }).then(function () {
+        console.info("Success");
+
+        // workaround for https://github.com/nodejs/node/issues/21319
+        if (state._useTty) {
+          setTimeout(function () {
+            console.info("Some fun things to try first:\n");
+            console.info("    ~/telebit http ~/public");
+            console.info("    ~/telebit tcp 5050");
+            console.info("    ~/telebit ssh auto");
+            console.info();
+            console.info("Press any key to continue...");
+            console.info();
+            process.exit(0);
+          }, 0.5 * 1000);
+          return;
+        }
+        // end workaround
+
+        //parseCli(state);
+      }).catch(function (err) {
+        console.error('[end] [error]', err);
+        return PromiseA.reject(err);
+      });
+    }
+  });
+};
+
+}('undefined' === typeof module ? window : module.exports));
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index 46e4da1..6747e83 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -2,6 +2,7 @@
 'use strict';
 
 var common = exports.TELEBIT = {};
+common.debug = true;
 
 /* global Promise */
 var PromiseA;
@@ -14,19 +15,6 @@ if ('undefined' !== typeof Promise) {
 /*globals AbortController*/
 if ('undefined' !== typeof fetch) {
   common.requestAsync = function (opts) {
-    /*
-    if (opts.json && true !== opts.json) {
-      opts.body = opts.json;
-    }
-    if (opts.json) {
-      if (!opts.headers) { opts.headers = {}; }
-      if (opts.body) {
-        opts.headers['Content-Type'] = 'application/json';
-      } else {
-        opts.headers.Accepts = 'application/json';
-      }
-    }
-    */
     // funnel requests through the local server
     // (avoid CORS, for now)
     var relayOpts = {
@@ -49,13 +37,6 @@ if ('undefined' !== typeof fetch) {
     return window.fetch(relayOpts.url, relayOpts).then(function (resp) {
       clearTimeout(tok);
       return resp.json().then(function (json) {
-        /*
-        var headers = {};
-        resp.headers.forEach(function (k, v) {
-          headers[k] = v;
-        });
-        return { statusCode: resp.status, headers: headers, body: json };
-        */
         if (json.error) {
           return PromiseA.reject(new Error(json.error && json.error.message || JSON.stringify(json.error)));
         }
@@ -63,8 +44,38 @@ if ('undefined' !== typeof fetch) {
       });
     });
   };
+  common.reqLocalAsync = function (opts) {
+    if (!opts) { opts = {}; }
+    if (opts.json && true !== opts.json) {
+      opts.body = opts.json;
+    }
+    if (opts.json) {
+      if (!opts.headers) { opts.headers = {}; }
+      if (opts.body) {
+        opts.headers['Content-Type'] = 'application/json';
+      } else {
+        opts.headers.Accepts = 'application/json';
+      }
+    }
+    var controller = new AbortController();
+    var tok = setTimeout(function () {
+      controller.abort();
+    }, 4000);
+    opts.signal = controller.signal;
+    return window.fetch(opts.url, opts).then(function (resp) {
+      clearTimeout(tok);
+      return resp.json().then(function (json) {
+        var headers = {};
+        resp.headers.forEach(function (k, v) {
+          headers[k] = v;
+        });
+        return { statusCode: resp.status, headers: headers, body: json };
+      });
+    });
+  };
 } else {
   common.requestAsync = require('util').promisify(require('@coolaj86/urequest'));
+  common.reqLocalAsync = require('util').promisify(require('@coolaj86/urequest'));
 }
 
 common.parseUrl = function (hostname) {
@@ -78,7 +89,12 @@ common.parseUrl = function (hostname) {
   return hostname;
 };
 common.parseHostname = function (hostname) {
-  var location = new URL(hostname);
+  var location = {};
+  try {
+    location = new URL(hostname);
+  } catch(e) {
+    // ignore
+  }
   if (!location.protocol || /\./.test(location.protocol)) {
     hostname = 'https://' + hostname;
     location = new URL(hostname);
@@ -109,6 +125,17 @@ common.signToken = function (state) {
 
   return jwt.sign(tokenData, state.config.secret);
 };
+common.promiseTimeout = function (ms) {
+  var x = new PromiseA(function (resolve) {
+    x._tok = setTimeout(function () {
+      resolve();
+    }, ms);
+  });
+  x.cancel = function () {
+    clearTimeout(x._tok);
+  };
+  return x;
+};
 common.api = {};
 common.api.directory = function (state) {
   console.log('[DEBUG] state:');
@@ -118,11 +145,14 @@ common.api.directory = function (state) {
   if (state._relays[state._relayUrl]) {
     return PromiseA.resolve(state._relays[state._relayUrl]);
   }
+  console.error('aaaaaaaaabsnthsnth');
   return common.requestAsync({ url: state._relayUrl + common.apiDirectory, json: true }).then(function (resp) {
+    console.error('123aaaaaaaaabsnthsnth');
     var dir = resp.body;
     state._relays[state._relayUrl] = dir;
     return dir;
   }).catch(function (err) {
+    console.error('bsnthsnth');
     return PromiseA.reject(err);
   });
 };
@@ -133,18 +163,18 @@ common.api._parseWss = function (state, dir) {
   state._relayHostname = common.parseHostname(state.relay);
   return dir.tunnel.method + '://' + dir.api_host.replace(/:hostname/g, state._relayHostname) + dir.tunnel.pathname;
 };
-common.api.wss = function (state, cb) {
-  common.api.directory(state).then(function (dir) {
-    cb(null, common.api._parseWss(state, dir));
-  }).catch(cb);
+common.api.wss = function (state) {
+  return common.api.directory(state).then(function (dir) {
+    return common.api._parseWss(state, dir);
+  });
 };
 common.api.token = function (state, handlers) {
   // directory, requested, connect, tunnelUrl, offer, granted, end
-  function afterDir(err, dir) {
+  function afterDir(dir) {
     if (common.debug) { console.log('[debug] after dir'); }
     state.wss = common.api._parseWss(state, dir);
 
-    handlers.tunnelUrl(state.wss, function () {
+    return PromiseA.resolve(handlers.tunnelUrl(state.wss)).then(function () {
       if (common.debug) { console.log('[debug] after tunnelUrl'); }
       if (state.config.secret /* && !state.config.token */) {
         state.config._token = common.signToken(state);
@@ -153,21 +183,19 @@ common.api.token = function (state, handlers) {
       if (state.token) {
         if (common.debug) { console.log('[debug] token via token or secret'); }
         // { token, pretoken }
-        handlers.connect(state.token, function () {
-          handlers.end(null, function () {});
+        return PromiseA.resolve(handlers.connect(state.token)).then(function () {
+          return PromiseA.resolve(handlers.end(null));
         });
-        return;
       }
 
-      // backwards compat (TODO remove)
-      if (err || !dir || !dir.pair_request) {
+      if (!dir.pair_request) {
         if (common.debug) { console.log('[debug] no dir, connect'); }
-        handlers.error(new Error("No token found or generated, and no pair_request api found."));
-        return;
+        return PromiseA.resolve(handlers.error(err || new Error("No token found or generated, and no pair_request api found.")));
       }
 
       // TODO sign token with own private key, including public key and thumbprint
       //      (much like ACME JOSE account)
+      // TODO handle agree
       var otp = state.config._otp; // common.otp();
       var authReq = {
         subject: state.config.email
@@ -187,8 +215,21 @@ common.api.token = function (state, handlers) {
       */
       };
       var pairRequestUrl = new URL(dir.pair_request.pathname, 'https://' + dir.api_host.replace(/:hostname/g, state._relayHostname));
+      console.log('pairRequestUrl:', pairRequestUrl);
+      //console.log('pairRequestUrl:', JSON.stringify(pairRequestUrl.toJSON()));
       var req = {
-        url: pairRequestUrl
+        // WHATWG URL defines .toJSON() but, of course, it's not implemented
+        // because... why would we implement JavaScript objects in the DOM
+        // when we can have perfectly incompatible non-JS objects?
+        url: {
+          host: pairRequestUrl.host
+        , hostname: pairRequestUrl.hostname
+        , href: pairRequestUrl.href
+        , pathname: pairRequestUrl.pathname
+        , port: pairRequestUrl.port
+        , protocol: pairRequestUrl.protocol
+        , search: pairRequestUrl.search
+        }
       , method: dir.pair_request.method
       , json: authReq
       };
@@ -198,7 +239,7 @@ common.api.token = function (state, handlers) {
       function gotoNext(req) {
         if (common.debug) { console.log('[debug] gotoNext called'); }
         if (common.debug) { console.log(req); }
-        common.requestAsync(req).then(function (resp) {
+        return common.requestAsync(req).then(function (resp) {
           var body = resp.body;
 
           function checkLocation() {
@@ -207,86 +248,88 @@ common.api.token = function (state, handlers) {
             // pending, try again
             if ('pending' === body.status && resp.headers.location) {
               if (common.debug) { console.log('[debug] pending'); }
-              setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
-              return;
-            }
-
-            if ('ready' === body.status) {
+              return common.promiseTimeout(2 * 1000).then(function () {
+                return gotoNext({ url: resp.headers.location, json: true });
+              });
+            } else if ('ready' === body.status) {
               if (common.debug) { console.log('[debug] ready'); }
               if (firstReady) {
                 if (common.debug) { console.log('[debug] first ready'); }
                 firstReady = false;
                 state.token = body.access_token;
                 state.config.token = state.token;
-                handlers.offer(body.access_token, function () {
+                // falls through on purpose
+                PromiseA.resolve(handlers.offer(body.access_token)).then(function () {
                   /*ignore*/
                 });
               }
-              setTimeout(gotoNext, 2 * 1000, req);
-              return;
-            }
-
-            if ('complete' === body.status) {
-              if (common.debug) { console.log('[debug] complete'); }
-              handlers.granted(null, function () {
-                handlers.end(null, function () {});
+              return common.promiseTimeout(2 * 1000).then(function () {
+                return gotoNext(req);
               });
-              return;
+            } else if ('complete' === body.status) {
+              if (common.debug) { console.log('[debug] complete'); }
+              return PromiseA.resolve(handlers.granted(null)).then(function () {
+                return PromiseA.resolve(handlers.end(null)).then(function () {});
+              });
+            } else {
+              if (common.debug) { console.log('[debug] bad status'); }
+              var err = new Error("Bad State:" + body.status);
+              err._request = req;
+              return PromiseA.resolve(handlers.error(err));
             }
-
-            if (common.debug) { console.log('[debug] bad status'); }
-            var err = new Error("Bad State:" + body.status);
-            err._request = req;
-            handlers.error(err, function () {});
           }
 
           if (firstReq) {
             if (common.debug) { console.log('[debug] first req'); }
-            handlers.requested(authReq, function () {
-              handlers.connect(body.access_token || body.jwt, function () {
+            if (!body.access_token && !body.jwt) {
+              return PromiseA.reject(new Error("something wrong with pre-authorization request"));
+            }
+            firstReq = false;
+            return PromiseA.resolve(handlers.requested(authReq)).then(function () {
+              return PromiseA.resolve(handlers.connect(body.access_token || body.jwt)).then(function () {
                 var err;
                 if (!resp.headers.location) {
                   err = new Error("bad authentication request response");
                   err._resp = resp.toJSON && resp.toJSON();
-                  handlers.error(err, function () {});
-                  return;
+                  return PromiseA.resolve(handlers.error(err)).then(function () {});
                 }
-                setTimeout(gotoNext, 2 * 1000, { url: resp.headers.location, json: true });
+                return common.promiseTimeout(2 * 1000).then(function () {
+                  return gotoNext({ url: resp.headers.location, json: true });
+                });
               });
             });
-            firstReq = false;
-            return;
           } else {
             if (common.debug) { console.log('[debug] other req'); }
-            checkLocation();
+            return checkLocation();
           }
         }).catch(function (err) {
           if (common.debug) { console.log('[debug] gotoNext error'); }
           err._request = req;
           err._hint = '[telebitd.js] pair request';
-          handlers.error(err, function () {});
+          return PromiseA.resolve(handlers.error(err)).then(function () {});
         });
       }
 
-      gotoNext(req);
+      return gotoNext(req);
 
     });
   }
 
   // backwards compat (TODO verify we can remove this)
   var failoverDir = '{ "api_host": ":hostname", "tunnel": { "method": "wss", "pathname": "" } }';
-  common.api.directory(state).then(function (dir) {
-    if (!dir.api_host) {
-      dir = JSON.parse(failoverDir);
-      return afterDir(null, dir);
-    }
-    handlers.directory(dir).then(function (dir) {
-      return afterDir(null, dir);
-    }).catch(function (err) {
-      return PromiseA.reject(err);
-    });
+  return common.api.directory(state).then(function (dir) {
+    console.log('[debug] [directory]', dir);
+    if (!dir.api_host) { dir = JSON.parse(failoverDir); }
+    return dir;
   }).catch(function (err) {
-    return afterDir(err, JSON.parse(failoverDir));
+    console.warn('[warn] [directory] fetch fail, using failover');
+    console.warn(err);
+    return JSON.parse(failoverDir);
+  }).then(function (dir) {
+    return PromiseA.resolve(handlers.directory(dir)).then(function () {
+      console.log('[debug] [directory]', dir);
+      return afterDir(dir);
+    });
   });
 
 };
-- 
2.38.5


From 61a5af2124675ed4cec2b4a2793ac038559e2687 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 21 Oct 2018 04:01:21 -0600
Subject: [PATCH 23/68] chimney

---
 bin/telebitd.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 96e9f59..42846d9 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -338,9 +338,6 @@ controllers.relay = function (req, res, opts) {
     return;
   }
 
-  console.log('POST /api/relay:');
-  console.log(opts.body);
-  console.log();
   return urequestAsync(opts.body).then(function (resp) {
     res.setHeader('Content-Type', 'application/json');
     resp = resp.toJSON();
-- 
2.38.5


From 075342920d3c4c400cf7d2d1c756a61ef3194c5f Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 21 Oct 2018 04:10:39 -0600
Subject: [PATCH 24/68] fixes...

---
 lib/admin/js/telebit-token.js | 6 +++---
 lib/admin/js/telebit.js       | 7 +++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/admin/js/telebit-token.js b/lib/admin/js/telebit-token.js
index 4b09245..2cb3204 100644
--- a/lib/admin/js/telebit-token.js
+++ b/lib/admin/js/telebit-token.js
@@ -47,7 +47,7 @@ common.authorize = common.getToken = function getToken(state) {
       state.config.pretoken = pretoken;
       state._connecting = true;
 
-      return common.reqLocalAsync({ url: '/api/config', method: 'POST', data: state.config || {} }).then(function () {
+      return common.reqLocalAsync({ url: '/api/config', method: 'POST', body: state.config }).then(function () {
         console.info("waiting...");
         return PromiseA.resolve();
       }).catch(function (err) {
@@ -77,7 +77,7 @@ common.authorize = common.getToken = function getToken(state) {
       } catch(e) {
         console.warn("[warning] could not decode token");
       }
-      return common.reqLocalAsync({ url: '/api/config', method: 'POST', data: state.config }).then(function () {
+      return common.reqLocalAsync({ url: '/api/config', method: 'POST', body: state.config }).then(function () {
         //console.log("Pairing Enabled Locally");
         return PromiseA.resolve();
       }).catch(function (err) {
@@ -92,7 +92,7 @@ common.authorize = common.getToken = function getToken(state) {
       return PromiseA.resolve();
     }
   , end: function () {
-      return common.reqLocalAsync({ url: '/api/enable', method: 'POST', data: [] }).then(function () {
+      return common.reqLocalAsync({ url: '/api/enable', method: 'POST', body: [] }).then(function () {
         console.info("Success");
 
         // workaround for https://github.com/nodejs/node/issues/21319
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index 6747e83..e6c8907 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -226,9 +226,12 @@ common.api.token = function (state, handlers) {
         , hostname: pairRequestUrl.hostname
         , href: pairRequestUrl.href
         , pathname: pairRequestUrl.pathname
-        , port: pairRequestUrl.port
+          // because why wouldn't node require 'path' on a json object and accept 'pathname' on a URL object...
+          // https://twitter.com/coolaj86/status/1053947919890403328
+        , path: pairRequestUrl.pathname
+        , port: pairRequestUrl.port || null
         , protocol: pairRequestUrl.protocol
-        , search: pairRequestUrl.search
+        , search: pairRequestUrl.search || null
         }
       , method: dir.pair_request.method
       , json: authReq
-- 
2.38.5


From 4b64490bdc8087a34d9d4d52e63e4f6ed995aae7 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 22 Oct 2018 00:13:03 -0600
Subject: [PATCH 25/68] handle config object (or old array) and some web ui
 fixes

---
 bin/telebitd.js | 100 +++++++++++++++++++++++++++---------------------
 1 file changed, 57 insertions(+), 43 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 42846d9..0879391 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -386,6 +386,7 @@ function handleApi(req, res) {
   function getConfigOnly() {
     var resp = JSON.parse(JSON.stringify(state.config));
     resp.version = pkg.version;
+    resp._otp = state.otp;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify(resp));
   }
@@ -416,50 +417,63 @@ function handleApi(req, res) {
       res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
       return;
     }
-    if (!Array.isArray(opts.body)) {
-      // TODO
-      res.statusCode = 500;
-      res.end('{"error":{"message":"[internal error (our fault)] module \'init\' expected an array"}}');
-      return;
-    }
-    // relay, email, agree_tos, servernames, ports
-    //
-    opts.body.forEach(function (opt) {
-      var parts = opt.split(/:/);
-      if ('true' === parts[1]) {
-        parts[1] = true;
-      } else if ('false' === parts[1]) {
-        parts[1] = false;
-      } else if ('null' === parts[1]) {
-        parts[1] = null;
-      } else if ('undefined' === parts[1]) {
-        parts[1] = undefined;
-      }
-      conf[parts[0]] = parts[1];
-    });
 
-    // TODO camelCase query
-    state.config.email = conf.email || state.config.email || '';
-    if ('undefined' !== typeof conf.agreeTos
-      || 'undefined' !== typeof conf.agreeTos ) {
-      state.config.agreeTos = conf.agreeTos || conf.agree_tos;
+    if (Array.isArray(opts.body)) {
+      // relay, email, agree_tos, servernames, ports
+      //
+      opts.body.forEach(function (opt) {
+        var parts = opt.split(/:/);
+        if ('true' === parts[1]) {
+          parts[1] = true;
+        } else if ('false' === parts[1]) {
+          parts[1] = false;
+        } else if ('null' === parts[1]) {
+          parts[1] = null;
+        } else if ('undefined' === parts[1]) {
+          parts[1] = undefined;
+        }
+        conf[parts[0]] = parts[1];
+      });
+    } else {
+      conf = opts.body;
     }
-    state.otp = conf._otp; // this should only be done on the client side
-    state.config.relay = conf.relay || state.config.relay || '';
+
+    conf = camelCopy(conf);
+
+    // TODO deep merge
+    // greenlock config
+    if (!state.config.greenlock) { state.config.greenlock = {}; }
+    if (conf.greenlock) {
+      if ('undefined' !== typeof conf.greenlock.agree) {
+        state.config.greenlock.agree = conf.greenlock.agree;
+      }
+      if (conf.greenlock.server) { state.config.greenlock.server = conf.greenlock.server; }
+      if (conf.greenlock.version) { state.config.greenlock.version = conf.greenlock.version; }
+    }
+
+    // main config
+    if (conf.email) { state.config.email = conf.email; }
+    if (conf.relay) { state.config.relay = conf.relay; }
+    if (conf.token) { state.config.token = conf.token; }
+    if (conf.secret) { state.config.secret = conf.secret; }
+    if ('undefined' !== typeof conf.agreeTos) {
+      state.config.agreeTos = conf.agreeTos;
+    }
+
+    // to state
+    if (conf.pretoken) { state.pretoken = conf.pretoken; }
+    if (conf._otp) {
+      state.otp = conf._otp; // TODO should this only be done on the client side?
+      delete conf._otp;
+    }
+
     console.log();
     console.log('conf.token', typeof conf.token, conf.token);
     console.log('state.config.token', typeof state.config.token, state.config.token);
-    state.config.token = conf.token || state.config.token || null;
-    state.config.secret = conf.secret || state.config.secret || null;
-    state.pretoken = conf.pretoken || state.config.pretoken || null;
-    if (state.secret) {
-      console.log('state.secret');
-      state.token = common.signToken(state);
-    }
-    if (!state.token) {
-      console.log('!state.token');
-      state.token = conf._token;
-    }
+
+    if (state.secret) { console.log('state.secret'); state.token = common.signToken(state); }
+    if (!state.token) { console.log('!state.token'); state.token = conf._token; }
+
     console.log();
     console.log('JSON.stringify(conf)');
     console.log(JSON.stringify(conf));
@@ -630,6 +644,10 @@ function handleApi(req, res) {
   }
 
   function route() {
+    if (/\b(relay)\b/.test(opts.pathname)) {
+      controllers.relay(req, res, opts);
+      return;
+    }
     if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
       getConfigOnly();
       return;
@@ -684,10 +702,6 @@ function handleApi(req, res) {
       listSuccess();
       return;
     }
-    if (/relay/.test(opts.pathname)) {
-      controllers.relay(req, res, opts);
-      return;
-    }
 
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
-- 
2.38.5


From c5e78110288552d77adf5f7972d7dd531e02e8ef Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 22 Oct 2018 00:17:49 -0600
Subject: [PATCH 26/68] refactoring for web ui and resumable state

---
 lib/admin/index.html          |  18 ++++
 lib/admin/js/app.js           | 147 ++++++++++++++++++++++-----
 lib/admin/js/telebit-token.js |  35 +++----
 lib/admin/js/telebit.js       | 181 +++++++++++++++++-----------------
 4 files changed, 243 insertions(+), 138 deletions(-)

diff --git a/lib/admin/index.html b/lib/admin/index.html
index c63b5d1..b10cbb7 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -4,9 +4,19 @@
   <title>Telebit Setup</title>
 </head>
 <body>
+  <script>document.body.hidden = true;</script>
+
   <div class="v-app">
     <h1>Telebit (Remote) Setup</h1>
 
+    <section v-if="views.flash.error">
+      {{ views.flash.error }}
+    </section>
+
+    <section v-if="views.section.loading">
+      Loading...
+    </section>
+
     <section v-if="views.section.setup">
       <h2>Create Account</h2>
       <form v-on:submit.stop.prevent="initialize">
@@ -100,6 +110,14 @@
       <pre><code>{{ init }}</code></pre>
     </section>
 
+    <section v-if="views.section.otp">
+      <pre><code><h2>{{ init.otp }}</h2></code></pre>
+    </section>
+
+    <section v-if="views.section.status">
+      <pre><code>{{ status }}</code></pre>
+    </section>
+
   </div>
 
   <script src="/js/vue.js"></script>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index f937748..2cfedd5 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -34,20 +34,17 @@ api.config = function apiConfig() {
 api.status = function apiStatus() {
   return Telebit.reqLocalAsync({ url: "/api/status", method: "GET" }).then(function (resp) {
     var json = resp.body;
-    appData.status = json;
     return json;
   });
 };
 api.initialize = function apiInitialize() {
   var opts = {
-    url: "/api/init"
+    url: "/api/xxinitxx"
   , method: "POST"
   , headers: {
       'Content-Type': 'application/json'
     }
-  , body: JSON.stringify({
-      foo: 'bar'
-    })
+  , body: JSON.stringify(telebitState.config)
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -59,6 +56,47 @@ api.initialize = function apiInitialize() {
   });
 };
 
+function showOtp(otp, pollUrl) {
+  localStorage.setItem('poll_url', pollUrl);
+  telebitState.pollUrl = pollUrl;
+  appData.init.otp = otp;
+  changeState('otp');
+}
+function doConfigure() {
+  if (telebitState.dir.pair_request) {
+    telebitState._can_pair = true;
+  }
+
+  //
+  // Read config from form
+  //
+
+  // Create Empty Config, If Necessary
+  if (!telebitState.config) { telebitState.config = {}; }
+  if (!telebitState.config.greenlock) { telebitState.config.greenlock = {}; }
+
+  // Populate Config
+  if (appData.init.teletos && appData.init.letos) { telebitState.config.agreeTos = true; }
+  if (appData.init.relay) { telebitState.config.relay = appData.init.relay; }
+  if (appData.init.email) { telebitState.config.email = appData.init.email; }
+  if ('undefined' !== typeof appData.init.letos) { telebitState.config.greenlock.agree = appData.init.letos; }
+  if ('newsletter' === appData.init.notifications) {
+    telebitState.config.newsletter = true; telebitState.config.communityMember = true;
+  }
+  if ('important' === appData.init.notifications) { telebitState.config.communityMember = true; }
+  if (appData.init.acmeVersion) { telebitState.config.greenlock.version = appData.init.acmeVersion; }
+  if (appData.init.acmeServer) { telebitState.config.greenlock.server = appData.init.acmeServer; }
+
+  // Temporary State
+  telebitState._otp = Telebit.otp();
+  appData.init.otp = telebitState._otp;
+
+  return Telebit.authorize(telebitState, showOtp).then(function () {
+    console.log('1 api.init...');
+    return api.initialize();
+  });
+}
+
 // TODO test for internet connectivity (and telebit connectivity)
 var DEFAULT_RELAY = 'telebit.cloud';
 var BETA_RELAY = 'telebit.ppl.family';
@@ -83,9 +121,15 @@ var appData = {
 , tcp: null
 , ssh: null
 , views: {
-    section: {
-      setup: false
+    flash: {
+      error: ""
+    }
+  , section: {
+      loading: true
+    , setup: false
     , advanced: false
+    , otp: false
+    , status: false
     }
   }
 };
@@ -98,34 +142,28 @@ var appMethods = {
     }
     appData.init.relay = appData.init.relay.toLowerCase();
     telebitState = { relay: appData.init.relay };
+
     return Telebit.api.directory(telebitState).then(function (dir) {
       if (!dir.api_host) {
         window.alert("Error: '" + telebitState.relay + "' does not appear to be a valid telebit service");
         return;
       }
+
+      telebitState.dir = dir;
+
+      // If it's one of the well-known relays
       if (-1 !== TELEBIT_RELAYS.indexOf(appData.init.relay)) {
-        if (!telebitState.config) { telebitState.config = {}; }
-        if (!telebitState.config.relay) { telebitState.config.relay = telebitState.relay; }
-        telebitState.config.email = appData.init.email;
-        telebitState.config._otp = Telebit.otp();
-        return Telebit.authorize(telebitState).then(function () {
-          console.log('1 api.init...');
-          return api.initialize();
-        }).catch(function (err) {
-          console.error(err);
-          window.alert("Error: [authorize] " + (err.message || JSON.stringify(err, null, 2)));
-        });
+        return doConfigure();
       } else {
         changeState('advanced');
       }
     }).catch(function (err) {
       console.error(err);
-      window.alert("Error: [directory] " + (err.message || JSON.stringify(err, null, 2)));
+      window.alert("Error: [initialize] " + (err.message || JSON.stringify(err, null, 2)));
     });
   }
 , advance: function () {
-    console.log('2 api.init...');
-    return api.initialize();
+    return doConfigure();
   }
 , productionAcme: function () {
     console.log("prod acme:");
@@ -157,10 +195,26 @@ var appStates = {
 , advanced: function () {
     appData.views.section = { advanced: true };
   }
+, otp: function () {
+    appData.views.section = { otp: true };
+  }
+, status: function () {
+    appData.views.section = { status: true };
+    return api.status().then(function (status) {
+      appData.status = status;
+    });
+  }
 };
 
 function changeState(newstate) {
-  location.hash = '#/' + newstate + '/';
+  var newhash = '#/' + newstate + '/';
+  if (location.hash === newhash) {
+    if (!telebitState.firstState) {
+      telebitState.firstState = true;
+      setState();
+    }
+  }
+  location.hash = newhash;
 }
 window.addEventListener('hashchange', setState, false);
 function setState(/*ev*/) {
@@ -183,11 +237,52 @@ new Vue({
 });
 
 
-api.config();
-api.status().then(function () {
-  changeState('setup');
-  setState();
+api.config().then(function (config) {
+  telebitState.config = config;
+  if (config.greenlock) {
+    appData.init.acmeServer = config.greenlock.server;
+  }
+  if (config.relay) {
+    appData.init.relay = config.relay;
+  }
+  if (config.email) {
+    appData.init.email = config.email;
+  }
+  if (config.agreeTos) {
+    appData.init.letos = config.agreeTos;
+    appData.init.teletos = config.agreeTos;
+  }
+  if (config._otp) {
+    appData.init.otp = config._otp;
+  }
+
+  telebitState.pollUrl = config._pollUrl || localStorage.getItem('poll_url');
+
+  if ((!config.token && !config._otp) || !config.relay || !config.email || !config.agreeTos) {
+    changeState('setup');
+    setState();
+    return;
+  }
+  if (!config.token && config._otp) {
+    changeState('otp');
+    setState();
+    // this will skip ahead as necessary
+    return Telebit.authorize(telebitState, showOtp).then(function () {
+      console.log('2 api.init...');
+      return api.initialize();
+    });
+  }
+
+  // TODO handle default state
+  changeState('status');
+}).catch(function (err) {
+  appData.views.flash.error = err.message || JSON.stringify(err, null, 2);
 });
 
 window.api = api;
+
+setTimeout(function () {
+  document.body.hidden = false;
+}, 50);
+
 }());
diff --git a/lib/admin/js/telebit-token.js b/lib/admin/js/telebit-token.js
index 2cb3204..0c3fcfe 100644
--- a/lib/admin/js/telebit-token.js
+++ b/lib/admin/js/telebit-token.js
@@ -11,19 +11,14 @@ if ('undefined' !== typeof Promise) {
 
 var common = exports.TELEBIT || require('./lib/common.js');
 
-common.authorize = common.getToken = function getToken(state) {
+common.authorize = common.getToken = function getToken(state, showOtp) {
   state.relay = state.config.relay;
 
   // { _otp, config: {} }
   return common.api.token(state, {
-    error: function (err) {
-      console.error("[Error] common.api.token handlers.error:");
-      console.error(err);
-      return PromiseA.reject(err);
-    }
+    error: function (err) { console.error("[Error] common.api.token handlers.error: \n", err); return PromiseA.reject(err); }
   , directory: function (dir) {
-      //console.log('[directory] Telebit Relay Discovered:');
-      //console.log(dir);
+      /*console.log('[directory] Telebit Relay Discovered:', dir);*/
       state._apiDirectory = dir;
       return PromiseA.resolve();
     }
@@ -32,12 +27,13 @@ common.authorize = common.getToken = function getToken(state) {
       state.wss = tunnelUrl;
       return PromiseA.resolve();
     }
-  , requested: function (authReq) {
+  , requested: function (authReq, pollUrl) {
       console.log("[requested] Pairing Requested");
-      state.config._otp = state.config._otp = authReq.otp;
+      state._otp = state._otp = authReq.otp;
 
       if (!state.config.token && state._can_pair) {
-        console.info("0000".replace(/0000/g, state.config._otp));
+        console.info("0000".replace(/0000/g, state._otp));
+        showOtp(authReq.otp, pollUrl);
       }
 
       return PromiseA.resolve();
@@ -47,7 +43,9 @@ common.authorize = common.getToken = function getToken(state) {
       state.config.pretoken = pretoken;
       state._connecting = true;
 
-      return common.reqLocalAsync({ url: '/api/config', method: 'POST', body: state.config }).then(function () {
+      // This will only be saved to the session
+      state.config._otp = state._otp;
+      return common.reqLocalAsync({ url: '/api/config', method: 'POST', body: state.config, json: true }).then(function () {
         console.info("waiting...");
         return PromiseA.resolve();
       }).catch(function (err) {
@@ -59,6 +57,7 @@ common.authorize = common.getToken = function getToken(state) {
     }
   , offer: function (token) {
       //console.log("[offer] Pairing Enabled by Relay");
+      state.token = token;
       state.config.token = token;
       if (state._error) {
         return;
@@ -77,7 +76,7 @@ common.authorize = common.getToken = function getToken(state) {
       } catch(e) {
         console.warn("[warning] could not decode token");
       }
-      return common.reqLocalAsync({ url: '/api/config', method: 'POST', body: state.config }).then(function () {
+      return common.reqLocalAsync({ url: '/api/config', method: 'POST', body: state.config, json: true }).then(function () {
         //console.log("Pairing Enabled Locally");
         return PromiseA.resolve();
       }).catch(function (err) {
@@ -87,12 +86,9 @@ common.authorize = common.getToken = function getToken(state) {
         return PromiseA.reject(err);
       });
     }
-  , granted: function (/*_*/) {
-      //console.log("[grant] Pairing complete!");
-      return PromiseA.resolve();
-    }
+  , granted: function (/*_*/) { /*console.log("[grant] Pairing complete!");*/ return PromiseA.resolve(); }
   , end: function () {
-      return common.reqLocalAsync({ url: '/api/enable', method: 'POST', body: [] }).then(function () {
+      return common.reqLocalAsync({ url: '/api/enable', method: 'POST', body: [], json: true }).then(function () {
         console.info("Success");
 
         // workaround for https://github.com/nodejs/node/issues/21319
@@ -112,9 +108,6 @@ common.authorize = common.getToken = function getToken(state) {
         // end workaround
 
         //parseCli(state);
-      }).catch(function (err) {
-        console.error('[end] [error]', err);
-        return PromiseA.reject(err);
       });
     }
   });
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index e6c8907..d0ab85c 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -48,11 +48,15 @@ if ('undefined' !== typeof fetch) {
     if (!opts) { opts = {}; }
     if (opts.json && true !== opts.json) {
       opts.body = opts.json;
+      opts.json = true;
     }
     if (opts.json) {
       if (!opts.headers) { opts.headers = {}; }
       if (opts.body) {
         opts.headers['Content-Type'] = 'application/json';
+        if ('string' !== typeof opts.body) {
+          opts.body = JSON.stringify(opts.body);
+        }
       } else {
         opts.headers.Accepts = 'application/json';
       }
@@ -126,15 +130,16 @@ common.signToken = function (state) {
   return jwt.sign(tokenData, state.config.secret);
 };
 common.promiseTimeout = function (ms) {
-  var x = new PromiseA(function (resolve) {
-    x._tok = setTimeout(function () {
+  var tok;
+  var p = new PromiseA(function (resolve) {
+    tok = setTimeout(function () {
       resolve();
     }, ms);
   });
-  x.cancel = function () {
-    clearTimeout(x._tok);
+  p.cancel = function () {
+    clearTimeout(tok);
   };
-  return x;
+  return p;
 };
 common.api = {};
 common.api.directory = function (state) {
@@ -145,15 +150,10 @@ common.api.directory = function (state) {
   if (state._relays[state._relayUrl]) {
     return PromiseA.resolve(state._relays[state._relayUrl]);
   }
-  console.error('aaaaaaaaabsnthsnth');
   return common.requestAsync({ url: state._relayUrl + common.apiDirectory, json: true }).then(function (resp) {
-    console.error('123aaaaaaaaabsnthsnth');
     var dir = resp.body;
     state._relays[state._relayUrl] = dir;
     return dir;
-  }).catch(function (err) {
-    console.error('bsnthsnth');
-    return PromiseA.reject(err);
   });
 };
 common.api._parseWss = function (state, dir) {
@@ -169,15 +169,63 @@ common.api.wss = function (state) {
   });
 };
 common.api.token = function (state, handlers) {
+
+  var firstReady = true;
+  function pollStatus(req) {
+    if (common.debug) { console.log('[debug] pollStatus called'); }
+    if (common.debug) { console.log(req); }
+    return common.requestAsync(req).then(function checkLocation(resp) {
+      var body = resp.body;
+      if (common.debug) { console.log('[debug] checkLocation'); }
+      if (common.debug) { console.log(body); }
+      // pending, try again
+      if ('pending' === body.status && resp.headers.location) {
+        if (common.debug) { console.log('[debug] pending'); }
+        return common.promiseTimeout(2 * 1000).then(function () {
+          return pollStatus({ url: resp.headers.location, json: true });
+        });
+      } else if ('ready' === body.status) {
+        if (common.debug) { console.log('[debug] ready'); }
+        if (firstReady) {
+          if (common.debug) { console.log('[debug] first ready'); }
+          firstReady = false;
+          // falls through on purpose
+          PromiseA.resolve(handlers.offer(body.access_token)).then(function () {
+            /*ignore*/
+          });
+        }
+        return common.promiseTimeout(2 * 1000).then(function () {
+          return pollStatus(req);
+        });
+      } else if ('complete' === body.status) {
+        if (common.debug) { console.log('[debug] complete'); }
+        return PromiseA.resolve(handlers.granted(null)).then(function () {
+          return PromiseA.resolve(handlers.end(null)).then(function () {});
+        });
+      } else {
+        if (common.debug) { console.log('[debug] bad status'); }
+        var err = new Error("Bad State:" + body.status);
+        err._request = req;
+        return PromiseA.reject(err);
+      }
+    }).catch(function (err) {
+      if (common.debug) { console.log('[debug] pollStatus error'); }
+      err._request = req;
+      err._hint = '[telebitd.js] pair request';
+      return PromiseA.resolve(handlers.error(err)).then(function () {});
+    });
+  }
+
   // directory, requested, connect, tunnelUrl, offer, granted, end
-  function afterDir(dir) {
+  function requestAuth(dir) {
     if (common.debug) { console.log('[debug] after dir'); }
     state.wss = common.api._parseWss(state, dir);
 
     return PromiseA.resolve(handlers.tunnelUrl(state.wss)).then(function () {
       if (common.debug) { console.log('[debug] after tunnelUrl'); }
       if (state.config.secret /* && !state.config.token */) {
-        state.config._token = common.signToken(state);
+        // TODO make token here in the browser
+        //state.config._token = common.signToken(state);
       }
       state.token = state.token || state.config.token || state.config._token;
       if (state.token) {
@@ -190,13 +238,13 @@ common.api.token = function (state, handlers) {
 
       if (!dir.pair_request) {
         if (common.debug) { console.log('[debug] no dir, connect'); }
-        return PromiseA.resolve(handlers.error(err || new Error("No token found or generated, and no pair_request api found.")));
+        return PromiseA.resolve(handlers.error(new Error("No token found or generated, and no pair_request api found.")));
       }
 
       // TODO sign token with own private key, including public key and thumbprint
       //      (much like ACME JOSE account)
       // TODO handle agree
-      var otp = state.config._otp; // common.otp();
+      var otp = state._otp; // common.otp();
       var authReq = {
         subject: state.config.email
       , subject_scheme: 'mailto'
@@ -236,88 +284,39 @@ common.api.token = function (state, handlers) {
       , method: dir.pair_request.method
       , json: authReq
       };
-      var firstReq = true;
-      var firstReady = true;
 
-      function gotoNext(req) {
-        if (common.debug) { console.log('[debug] gotoNext called'); }
-        if (common.debug) { console.log(req); }
-        return common.requestAsync(req).then(function (resp) {
-          var body = resp.body;
-
-          function checkLocation() {
-            if (common.debug) { console.log('[debug] checkLocation'); }
-            if (common.debug) { console.log(body); }
-            // pending, try again
-            if ('pending' === body.status && resp.headers.location) {
-              if (common.debug) { console.log('[debug] pending'); }
-              return common.promiseTimeout(2 * 1000).then(function () {
-                return gotoNext({ url: resp.headers.location, json: true });
-              });
-            } else if ('ready' === body.status) {
-              if (common.debug) { console.log('[debug] ready'); }
-              if (firstReady) {
-                if (common.debug) { console.log('[debug] first ready'); }
-                firstReady = false;
-                state.token = body.access_token;
-                state.config.token = state.token;
-                // falls through on purpose
-                PromiseA.resolve(handlers.offer(body.access_token)).then(function () {
-                  /*ignore*/
-                });
-              }
-              return common.promiseTimeout(2 * 1000).then(function () {
-                return gotoNext(req);
-              });
-            } else if ('complete' === body.status) {
-              if (common.debug) { console.log('[debug] complete'); }
-              return PromiseA.resolve(handlers.granted(null)).then(function () {
-                return PromiseA.resolve(handlers.end(null)).then(function () {});
-              });
-            } else {
-              if (common.debug) { console.log('[debug] bad status'); }
-              var err = new Error("Bad State:" + body.status);
-              err._request = req;
-              return PromiseA.resolve(handlers.error(err));
+      return common.requestAsync(req).then(function doFirst(resp) {
+        var body = resp.body;
+        if (common.debug) { console.log('[debug] first req'); }
+        if (!body.access_token && !body.jwt) {
+          return PromiseA.reject(new Error("something wrong with pre-authorization request"));
+        }
+        return PromiseA.resolve(handlers.requested(authReq, resp.headers.location)).then(function () {
+          return PromiseA.resolve(handlers.connect(body.access_token || body.jwt)).then(function () {
+            var err;
+            if (!resp.headers.location) {
+              err = new Error("bad authentication request response");
+              err._resp = resp.toJSON && resp.toJSON();
+              return PromiseA.resolve(handlers.error(err)).then(function () {});
             }
-          }
-
-          if (firstReq) {
-            if (common.debug) { console.log('[debug] first req'); }
-            if (!body.access_token && !body.jwt) {
-              return PromiseA.reject(new Error("something wrong with pre-authorization request"));
-            }
-            firstReq = false;
-            return PromiseA.resolve(handlers.requested(authReq)).then(function () {
-              return PromiseA.resolve(handlers.connect(body.access_token || body.jwt)).then(function () {
-                var err;
-                if (!resp.headers.location) {
-                  err = new Error("bad authentication request response");
-                  err._resp = resp.toJSON && resp.toJSON();
-                  return PromiseA.resolve(handlers.error(err)).then(function () {});
-                }
-                return common.promiseTimeout(2 * 1000).then(function () {
-                  return gotoNext({ url: resp.headers.location, json: true });
-                });
-              });
+            return common.promiseTimeout(2 * 1000).then(function () {
+              return pollStatus({ url: resp.headers.location, json: true });
             });
-          } else {
-            if (common.debug) { console.log('[debug] other req'); }
-            return checkLocation();
-          }
-        }).catch(function (err) {
-          if (common.debug) { console.log('[debug] gotoNext error'); }
-          err._request = req;
-          err._hint = '[telebitd.js] pair request';
-          return PromiseA.resolve(handlers.error(err)).then(function () {});
+          });
         });
-      }
-
-      return gotoNext(req);
-
+      }).catch(function (err) {
+        if (common.debug) { console.log('[debug] gotoFirst error'); }
+        err._request = req;
+        err._hint = '[telebitd.js] pair request';
+        return PromiseA.resolve(handlers.error(err)).then(function () {});
+      });
     });
   }
 
+  if (state.pollUrl) {
+    return pollStatus({ url: state.pollUrl, json: true });
+  }
+
   // backwards compat (TODO verify we can remove this)
   var failoverDir = '{ "api_host": ":hostname", "tunnel": { "method": "wss", "pathname": "" } }';
   return common.api.directory(state).then(function (dir) {
@@ -331,9 +330,9 @@ common.api.token = function (state, handlers) {
   }).then(function (dir) {
     return PromiseA.resolve(handlers.directory(dir)).then(function () {
       console.log('[debug] [directory]', dir);
-      return afterDir(dir);
+      return requestAuth(dir);
     });
   });
-
 };
+
 }('undefined' !== typeof module ? module.exports : window));
-- 
2.38.5


From ce20b058e69ab349964a40f6451302e22ca5927f Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Mon, 22 Oct 2018 22:36:46 -0600
Subject: [PATCH 27/68] updates to status page

---
 bin/telebitd.js      | 21 ++++++----
 lib/admin/index.html | 15 ++++++-
 lib/admin/js/app.js  | 99 +++++++++++++++++++++++++++++++++++++-------
 3 files changed, 110 insertions(+), 25 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 0879391..46fd747 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -27,6 +27,7 @@ var snakeCopy = recase.snakeCopy.bind(recase);
 var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"), 'utf8'));
 var startTime = Date.now();
 var connectTimes = [];
+var isConnected = false;
 
 var TelebitRemote = require('../lib/daemon/index.js').TelebitRemote;
 
@@ -628,17 +629,17 @@ function handleApi(req, res) {
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify(
       { module: 'status'
-      , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
-      , status: (state.config.disable ? 'disabled' : 'enabled')
-      , ready: ((state.config.relay && (state.config.token || state.config.agreeTos)) ? true : false)
-      , active: !!myRemote
-      , connected: 'maybe (todo)'
       , version: pkg.version
-      , servernames: state.servernames
+      , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
+      , enabled: !state.config.disable
+      , active: !!myRemote
+      , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
+      , connected: isConnected
       , proctime: Math.round(process.uptime() * 1000)
       , uptime: now - startTime
-      , runtime: connectTimes.length && (now - connectTimes[0]) || 0
+      , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
       , reconnects: connectTimes.length
+      , servernames: state.servernames
       }
     ));
   }
@@ -707,7 +708,8 @@ function handleApi(req, res) {
     res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
   }
 
-  if (!req.headers['content-length'] && !req.headers['content-type']) {
+  var hasLength = req.headers['content-length'] > 0;
+  if (!hasLength && !req.headers['content-type']) {
     route();
     return;
   }
@@ -1042,6 +1044,7 @@ function rawStartTelebitRemote(keepAlive) {
         }
 
         function onConnect() {
+          isConnected = true;
           connectTimes.unshift(Date.now());
           console.info('[connect] relay established');
           myRemote.removeListener('error', onConnectError);
@@ -1060,6 +1063,7 @@ function rawStartTelebitRemote(keepAlive) {
 
         function onConnectError(err) {
           myRemote = null;
+          isConnected = false;
           if (handleError(err, 'onConnectError')) {
             if (!keepAlive.state) {
               reject(err);
@@ -1075,6 +1079,7 @@ function rawStartTelebitRemote(keepAlive) {
         }
 
         function retryLoop() {
+          isConnected = false;
           console.warn('[Warn] disconnected. Will retry?', keepAlive.state);
           if (keepAlive.state) {
             safeReload(10 * 1000).then(resolve).catch(reject);
diff --git a/lib/admin/index.html b/lib/admin/index.html
index b10cbb7..9af0f31 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -7,7 +7,7 @@
   <script>document.body.hidden = true;</script>
 
   <div class="v-app">
-    <h1>Telebit (Remote) Setup</h1>
+    <h1>Telebit (Remote) Setup v{{ config.version }}</h1>
 
     <section v-if="views.flash.error">
       {{ views.flash.error }}
@@ -115,6 +115,19 @@
     </section>
 
     <section v-if="views.section.status">
+      <button v-if="!status.enabled" v-on:click="enable">Enable</button>
+      <button v-if="status.enabled" v-on:click="disable">Disable</button>
+      <br>
+      http://localhost:{{ status.port }}
+      <br>
+      Proctime: {{ statusProctime }}
+      <br>
+      Uptime: {{ statusUptime }}
+      <br>
+      Runtime: {{ statusRuntime }}
+      <br>
+      Reconnects: {{ status.reconnects }}
+      <br>
       <pre><code>{{ status }}</code></pre>
     </section>
 
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 2cfedd5..a40a5bc 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -37,14 +37,26 @@ api.status = function apiStatus() {
     return json;
   });
 };
-api.initialize = function apiInitialize() {
+api.enable = function apiEnable() {
   var opts = {
-    url: "/api/xxinitxx"
+    url: "/api/enable"
   , method: "POST"
-  , headers: {
-      'Content-Type': 'application/json'
-    }
-  , body: JSON.stringify(telebitState.config)
+  //, headers: { 'Content-Type': 'application/json' }
+  };
+  return Telebit.reqLocalAsync(opts).then(function (resp) {
+    var json = resp.body;
+    appData.initResult = json;
+    window.alert("Error: [success] " + JSON.stringify(json, null, 2));
+    return json;
+  }).catch(function (err) {
+    window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
+  });
+};
+api.disable = function apiDisable() {
+  var opts = {
+    url: "/api/disable"
+  , method: "POST"
+  //, headers: { 'Content-Type': 'application/json' }
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -107,8 +119,8 @@ var TELEBIT_RELAYS = [
 var PRODUCTION_ACME = 'https://acme-v02.api.letsencrypt.org/directory';
 var STAGING_ACME = 'https://acme-staging-v02.api.letsencrypt.org/directory';
 var appData = {
-  config: null
-, status: null
+  config: {}
+, status: {}
 , init: {
     teletos: true
   , letos: true
@@ -181,11 +193,11 @@ var appMethods = {
 , betaRelay: function () {
     appData.init.relay = BETA_RELAY;
   }
-, defaultRhubarb: function () {
-    appData.init.rhubarb = DEFAULT_RELAY;
+, enable: function () {
+    api.enable();
   }
-, betaRhubarb: function () {
-    appData.init.rhubarb = BETA_RELAY;
+, disable: function () {
+    api.disable();
   }
 };
 var appStates = {
@@ -200,9 +212,15 @@ var appStates = {
   }
 , status: function () {
     appData.views.section = { status: true };
-    return api.status().then(function (status) {
-      appData.status = status;
-    });
+    var tok = setInterval(function () {
+      api.status().then(function (status) {
+        appData.status = status;
+      });
+    }, 2000);
+
+    return function cancelState() {
+      clearInterval(tok);
+    };
   }
 };
 
@@ -216,23 +234,72 @@ function changeState(newstate) {
   }
   location.hash = newhash;
 }
+/*globals Promise*/
 window.addEventListener('hashchange', setState, false);
 function setState(/*ev*/) {
   //ev.oldURL
   //ev.newURL
+  if (appData.exit) {
+    appData.exit.then(function (exit) {
+      if ('function' === typeof appData.exit) {
+        exit();
+      }
+    });
+  }
   var parts = location.hash.substr(1).replace(/^\//, '').replace(/\/$/, '').split('/');
   var fn = appStates;
   parts.forEach(function (s) {
     console.log("state:", s);
     fn = fn[s];
   });
-  fn();
+  appData.exit = Promise.resolve(fn());
   //appMethods.states[newstate]();
 }
 
+function msToHumanReadable(ms) {
+  var uptime = ms;
+  var uptimed = uptime / 1000;
+  var minute = 60;
+  var hour = 60 * minute;
+  var day = 24 * hour;
+  var days = 0;
+  var times = [];
+  while (uptimed > day) {
+    uptimed -= day;
+    days += 1;
+  }
+  times.push(days + " days ");
+  var hours = 0;
+  while (uptimed > hour) {
+    uptimed -= hour;
+    hours += 1;
+  }
+  times.push(hours.toString().padStart(2, "0") + " h ");
+  var minutes = 0;
+  while (uptimed > minute) {
+    uptimed -= minute;
+    minutes += 1;
+  }
+  times.push(minutes.toString().padStart(2, "0") + " m ");
+  var seconds = Math.round(uptimed);
+  times.push(seconds.toString().padStart(2, "0") + " s ");
+  return times.join('');
+}
+
 new Vue({
   el: ".v-app"
 , data: appData
+, computed: {
+    statusProctime: function () {
+      return msToHumanReadable(this.status.proctime);
+    }
+  , statusRuntime: function () {
+      return msToHumanReadable(this.status.runtime);
+    }
+  , statusUptime: function () {
+      return msToHumanReadable(this.status.uptime);
+    }
+  }
 , methods: appMethods
 });
 
-- 
2.38.5


From 2679a20d1ccdcd96192785e6a8284662f5f40487 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 23 Oct 2018 00:44:59 -0600
Subject: [PATCH 28/68] updates for config file

---
 bin/telebitd.js      | 12 +++---
 lib/admin/index.html | 58 +++++++++++++++++++++++++-
 lib/admin/js/app.js  | 96 +++++++++++++++++++++++++++++++++++++++-----
 3 files changed, 150 insertions(+), 16 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 46fd747..decc22e 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -135,9 +135,9 @@ controllers.http = function (req, res, opts) {
     return;
   }
   var active = true;
-  var portOrPath = opts.body[0];
+  var portOrPath = opts.body.handler || opts.body[0];
   var appname = getAppname(portOrPath);
-  var subdomain = opts.body[1];
+  var subdomain = opts.body.name || opts.body[1];
   var remoteHost;
 
   // Assign an FQDN to brief subdomains
@@ -310,8 +310,9 @@ controllers.ssh = function (req, res, opts) {
     });
   }
 
-  var sshAuto = opts.body[0];
-  if (-1 !== [ 'false', 'none', 'off', 'disable' ].indexOf(sshAuto)) {
+  var rawSshAuto = opts.body.port || opts.body[0];
+  var sshAuto = rawSshAuto;
+  if (-1 !== [ -1, 'false', 'none', 'off', 'disable' ].indexOf(sshAuto)) {
     state.config.sshAuto = false;
     sshSuccess();
     return;
@@ -325,7 +326,7 @@ controllers.ssh = function (req, res, opts) {
   if (!sshAuto || sshAuto <= 0 || sshAuto > 65535) {
     res.statusCode = 400;
     res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({ error: { message: "bad ssh_auto option '" + opts.body[0] + "'" } }));
+    res.end(JSON.stringify({ error: { message: "bad ssh_auto option '" + rawSshAuto + "'" } }));
     return;
   }
   state.config.sshAuto = sshAuto;
@@ -640,6 +641,7 @@ function handleApi(req, res) {
       , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
       , reconnects: connectTimes.length
       , servernames: state.servernames
+      , ssh: state.config.sshAuto
       }
     ));
   }
diff --git a/lib/admin/index.html b/lib/admin/index.html
index 9af0f31..a0e9028 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -115,10 +115,64 @@
     </section>
 
     <section v-if="views.section.status">
-      <button v-if="!status.enabled" v-on:click="enable">Enable</button>
-      <button v-if="status.enabled" v-on:click="disable">Disable</button>
+      <button v-if="!status.enabled" v-on:click="enable">Enable Traffic</button>
+      <button v-if="status.enabled" v-on:click="disable">Disable Traffic</button>
       <br>
+      <br>
+
       http://localhost:{{ status.port }}
+      <br>
+      <br>
+
+      SSH:
+      <span v-if="status.ssh">{{ status.ssh }}
+        <button v-on:click="ssh(-1)">Disable SSH</button></span>
+      <span v-if="!status.ssh"><input type="text" v-model="state.ssh" placeholder="22">
+        <button v-on:click="ssh(state.ssh)">Enable SSH</button></span>
+      <br>
+      <br>
+
+      Path Hosting:
+      <ul>
+        <li v-for="domain in status.pathHosting">
+          {{ domain.name }}
+          <input type="text" v-model="domain.path" v-bind:placeholder="domain.handler">
+          <button
+            v-if="domain.handler == domain.path"
+            v-on:click="changePathHost(domain, domain.path)">Save</button>
+          <button v-on:click="deletePathHost(domain)">X</button>
+        </li>
+      </ul>
+      <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
+        <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
+        <select v-model="newHttp.name">
+          <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
+        </select>
+        <input v-model="newHttp.handler" type="text" placeholder="path (ex: ~/Public)" required>
+        <button>Add</button>
+      </form>
+      <br>
+
+      Port Forwarding:
+      <ul>
+        <li v-for="domain in status.portForwards">
+          {{ domain.name }}
+          <input type="text" v-model="domain._port" v-bind:placeholder="domain.handler">
+          <button
+            v-if="domain.handler == domain._port"
+            v-on:click="changePortForward(domain, domain._port)">Save</button>
+          <button v-on:click="deletePortForward(domain)">X</button>
+        </li>
+      </ul>
+      <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
+        <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
+        <select v-model="newHttp.name">
+          <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
+        </select>
+        <input v-model="newHttp.handler" type="number" placeholder="port (ex: 3000)" required>
+        <button>Add</button>
+      </form>
+
       <br>
       Proctime: {{ statusProctime }}
       <br>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index a40a5bc..2dbedf2 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -37,6 +37,36 @@ api.status = function apiStatus() {
     return json;
   });
 };
+api.http = function apiHttp(name, handler) {
+  var opts = {
+    url: "/api/http"
+  , method: "POST"
+  , headers: { 'Content-Type': 'application/json' }
+  , json: { name: name, handler: handler }
+  };
+  return Telebit.reqLocalAsync(opts).then(function (resp) {
+    var json = resp.body;
+    appData.initResult = json;
+    return json;
+  }).catch(function (err) {
+    window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
+  });
+};
+api.ssh = function apiSsh(port) {
+  var opts = {
+    url: "/api/ssh"
+  , method: "POST"
+  , headers: { 'Content-Type': 'application/json' }
+  , json: { port: port }
+  };
+  return Telebit.reqLocalAsync(opts).then(function (resp) {
+    var json = resp.body;
+    appData.initResult = json;
+    return json;
+  }).catch(function (err) {
+    window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
+  });
+};
 api.enable = function apiEnable() {
   var opts = {
     url: "/api/enable"
@@ -45,11 +75,10 @@ api.enable = function apiEnable() {
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
-    appData.initResult = json;
-    window.alert("Error: [success] " + JSON.stringify(json, null, 2));
+    console.log('enable', json);
     return json;
   }).catch(function (err) {
-    window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
+    window.alert("Error: [enable] " + (err.message || JSON.stringify(err, null, 2)));
   });
 };
 api.disable = function apiDisable() {
@@ -60,11 +89,10 @@ api.disable = function apiDisable() {
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
-    appData.initResult = json;
-    window.alert("Error: [success] " + JSON.stringify(json, null, 2));
+    console.log('disable', json);
     return json;
   }).catch(function (err) {
-    window.alert("Error: [init] " + (err.message || JSON.stringify(err, null, 2)));
+    window.alert("Error: [disable] " + (err.message || JSON.stringify(err, null, 2)));
   });
 };
 
@@ -129,9 +157,7 @@ var appData = {
   , telemetry: true
   , acmeServer: PRODUCTION_ACME
   }
-, http: null
-, tcp: null
-, ssh: null
+, state: {}
 , views: {
     flash: {
       error: ""
@@ -144,6 +170,7 @@ var appData = {
     , status: false
     }
   }
+, newHttp: {}
 };
 var telebitState = {};
 var appMethods = {
@@ -199,6 +226,28 @@ var appMethods = {
 , disable: function () {
     api.disable();
   }
+, ssh: function (port) {
+    // -1 to disable
+    // 0 is auto (22)
+    // 1-65536
+    api.ssh(port || 22);
+  }
+, createHttp: function (domain, handler) {
+    api.http(domain.name, handler);
+    appData.newHttp = {};
+  }
+, changePortForward: function (domain, port) {
+    api.http(domain.name, port);
+  }
+, deletePortForward: function (domain) {
+    api.http(domain.name, 'none');
+  }
+, changePathHost: function (domain, path) {
+    api.http(domain.name, path);
+  }
+, deletePathHost: function (domain) {
+    api.http(domain.name, 'none');
+  }
 };
 var appStates = {
   setup: function () {
@@ -214,7 +263,36 @@ var appStates = {
     appData.views.section = { status: true };
     var tok = setInterval(function () {
       api.status().then(function (status) {
+        var wilddomains = [];
+        var rootdomains = [];
+        var subdomains = [];
+        var directories = [];
+        var portforwards = [];
+        var free = [];
         appData.status = status;
+        Object.keys(appData.status.servernames).forEach(function (k) {
+          var s = appData.status.servernames[k];
+          s.name = k;
+          if (s.wildcard) { wilddomains.push(s); }
+          if (!s.sub && !s.wildcard) { rootdomains.push(s); }
+          if (s.sub) { subdomains.push(s); }
+          if (s.handler) {
+            if (s.handler.toString() === parseInt(s.handler, 10).toString()) {
+              s._port = s.handler;
+              portforwards.push(s);
+            } else {
+              s.path = s.handler;
+              directories.push(s);
+            }
+          } else {
+            free.push(s);
+          }
+        });
+        appData.status.portForwards = portforwards;
+        appData.status.pathHosting = directories;
+        appData.status.wildDomains = wilddomains;
+        appData.newHttp.name = (appData.status.wildDomains[0] || {}).name;
+        appData.state.ssh = (appData.status.ssh > 0) && appData.status.ssh || undefined;
       });
     }, 2000);
 
-- 
2.38.5


From 08c18b8c94182c87749b22dfd60d163150c213de Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 23 Oct 2018 13:03:36 -0600
Subject: [PATCH 29/68] async transitions, but don't delay

---
 lib/admin/js/app.js | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 2dbedf2..9add25b 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -260,9 +260,8 @@ var appStates = {
     appData.views.section = { otp: true };
   }
 , status: function () {
-    appData.views.section = { status: true };
-    var tok = setInterval(function () {
-      api.status().then(function (status) {
+    function updateStatus() {
+      return api.status().then(function (status) {
         var wilddomains = [];
         var rootdomains = [];
         var subdomains = [];
@@ -294,11 +293,15 @@ var appStates = {
         appData.newHttp.name = (appData.status.wildDomains[0] || {}).name;
         appData.state.ssh = (appData.status.ssh > 0) && appData.status.ssh || undefined;
       });
-    }, 2000);
+    }
+    var tok = setInterval(updateStatus, 2000);
 
-    return function cancelState() {
-      clearInterval(tok);
-    };
+    return updateStatus().then(function () {
+      appData.views.section = { status: true };
+      return function cancelState() {
+        clearInterval(tok);
+      };
+    });
   }
 };
 
-- 
2.38.5


From b18a6aa01c91d4e88a8d26043d7b9381b6a5c2f6 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 23 Oct 2018 13:18:58 -0600
Subject: [PATCH 30/68] show error when status is error

---
 lib/admin/js/app.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 9add25b..095c7c2 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -260,8 +260,15 @@ var appStates = {
     appData.views.section = { otp: true };
   }
 , status: function () {
+    function exitState() {
+      clearInterval(tok);
+    }
+
     function updateStatus() {
       return api.status().then(function (status) {
+        if (status.error) {
+          appData.views.flash.error = status.error.message || JSON.stringify(status.error, null, 2);
+        }
         var wilddomains = [];
         var rootdomains = [];
         var subdomains = [];
@@ -298,9 +305,7 @@ var appStates = {
 
     return updateStatus().then(function () {
       appData.views.section = { status: true };
-      return function cancelState() {
-        clearInterval(tok);
-      };
+      return exitState;
     });
   }
 };
-- 
2.38.5


From d743c51d86503179535a43310978e9e903f1d96c Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 24 Oct 2018 23:34:12 -0600
Subject: [PATCH 31/68] change to status after auth

---
 lib/admin/js/app.js | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 095c7c2..3dd907d 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -132,8 +132,7 @@ function doConfigure() {
   appData.init.otp = telebitState._otp;
 
   return Telebit.authorize(telebitState, showOtp).then(function () {
-    console.log('1 api.init...');
-    return api.initialize();
+    return changeState('status');
   });
 }
 
@@ -421,8 +420,7 @@ api.config().then(function (config) {
     setState();
     // this will skip ahead as necessary
     return Telebit.authorize(telebitState, showOtp).then(function () {
-      console.log('2 api.init...');
-      return api.initialize();
+      return changeState('status');
     });
   }
 
-- 
2.38.5


From 40921b58fffe5d8a50d11cb0b786cfe9ef4527e6 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 31 Oct 2018 23:16:55 -0600
Subject: [PATCH 32/68] function to test ssh safety

---
 lib/ssh.js | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 lib/ssh.js

diff --git a/lib/ssh.js b/lib/ssh.js
new file mode 100644
index 0000000..37adf4c
--- /dev/null
+++ b/lib/ssh.js
@@ -0,0 +1,72 @@
+'use strict';
+
+/*global Promise*/
+var PromiseA = Promise;
+var crypto = require('crypto');
+var util = require('util');
+var readFile = util.promisify(require('fs').readFile);
+var exec = require('child_process').exec;
+
+function sshAllowsPassword(user) {
+  // SSH on Windows is a thing now (beta 2015, standard 2018)
+  // https://stackoverflow.com/questions/313111/is-there-a-dev-null-on-windows
+  var nullfile = '/dev/null';
+  if (/^win/i.test(process.platform)) {
+    nullfile = 'NUL';
+  }
+  var args = [
+    'ssh', '-v', '-n'
+  , '-o', 'Batchmode=yes'
+  , '-o', 'StrictHostKeyChecking=no'
+  , '-o', 'UserKnownHostsFile=' + nullfile
+  , user + '@localhost'
+  , '| true'
+  ];
+  return new PromiseA(function (resolve) {
+    // not using promisify because all 3 arguments convey information
+    exec(args.join(' '), function (err, stdout, stderr) {
+      stdout = (stdout||'').toString('utf8');
+      stderr = (stderr||'').toString('utf8');
+      if (/\bpassword\b/.test(stdout) || /\bpassword\b/.test(stderr)) {
+        resolve(true);
+        return;
+      }
+      if (/\bAuthentications\b/.test(stdout) || /\bAuthentications\b/.test(stderr)) {
+        resolve(false);
+        return;
+      }
+      resolve();
+    });
+  });
+}
+
+module.exports.checkSecurity = function () {
+  var conf = {};
+  var sshdConf = '/etc/ssh/sshd_config';
+  var noRootPasswordRe = /(^|[\r\n]+)\s*PermitRootLogin\s+(prohibit-password|without-password|no)\s*/i;
+  var noPasswordRe = /(^|[\r\n]+)\s*PasswordAuthentication\s+no\s*/i;
+  return readFile(sshdConf, null).then(function (sshd) {
+    sshd = sshd.toString('utf8');
+    conf.disallowPasswordRoot = noRootPasswordRe.test(sshd);
+    conf.disallowPassword = noPasswordRe.test(sshd);
+  }).catch(function () {
+    // ignore error as that might not be the correct sshd_config location
+  }).then(function () {
+    var doesntExist = crypto.randomBytes(16).toString('hex');
+    return sshAllowsPassword(doesntExist).then(function (maybe) {
+      conf.allowsPassword = maybe;
+      return sshAllowsPassword('root').then(function (maybe) {
+        conf.allowsRootPassword = maybe;
+      });
+    });
+  }).then(function () {
+    return conf;
+  });
+};
+
+if (require.main === module) {
+  module.exports.checkSecurity().then(function (conf) {
+    console.log(conf);
+    return conf;
+  });
+}
-- 
2.38.5


From 7f18482566f99c41fd582923a4850ead2b7546b2 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 31 Oct 2018 23:47:13 -0600
Subject: [PATCH 33/68] more exact checking

---
 lib/ssh.js | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/ssh.js b/lib/ssh.js
index 37adf4c..3097023 100644
--- a/lib/ssh.js
+++ b/lib/ssh.js
@@ -28,14 +28,14 @@ function sshAllowsPassword(user) {
       stdout = (stdout||'').toString('utf8');
       stderr = (stderr||'').toString('utf8');
       if (/\bpassword\b/.test(stdout) || /\bpassword\b/.test(stderr)) {
-        resolve(true);
+        resolve('yes');
         return;
       }
       if (/\bAuthentications\b/.test(stdout) || /\bAuthentications\b/.test(stderr)) {
-        resolve(false);
+        resolve('no');
         return;
       }
-      resolve();
+      resolve('maybe');
     });
   });
 }
@@ -43,21 +43,21 @@ function sshAllowsPassword(user) {
 module.exports.checkSecurity = function () {
   var conf = {};
   var sshdConf = '/etc/ssh/sshd_config';
-  var noRootPasswordRe = /(^|[\r\n]+)\s*PermitRootLogin\s+(prohibit-password|without-password|no)\s*/i;
-  var noPasswordRe = /(^|[\r\n]+)\s*PasswordAuthentication\s+no\s*/i;
+  var noRootPasswordRe = /(?:^|[\r\n]+)\s*PermitRootLogin\s+(prohibit-password|without-password|no)\s*/i;
+  var noPasswordRe = /(?:^|[\r\n]+)\s*PasswordAuthentication\s+(no)\s*/i;
   return readFile(sshdConf, null).then(function (sshd) {
     sshd = sshd.toString('utf8');
-    conf.disallowPasswordRoot = noRootPasswordRe.test(sshd);
-    conf.disallowPassword = noPasswordRe.test(sshd);
+    var match;
+    match = sshd.match(noRootPasswordRe);
+    conf.permit_root_login = match ? match[1] : 'yes';
+    match = sshd.match(noPasswordRe);
+    conf.password_authentication = match ? match[1] : 'yes';
   }).catch(function () {
     // ignore error as that might not be the correct sshd_config location
   }).then(function () {
     var doesntExist = crypto.randomBytes(16).toString('hex');
     return sshAllowsPassword(doesntExist).then(function (maybe) {
-      conf.allowsPassword = maybe;
-      return sshAllowsPassword('root').then(function (maybe) {
-        conf.allowsRootPassword = maybe;
-      });
+      conf.requests_password = maybe;
     });
   }).then(function () {
     return conf;
-- 
2.38.5


From 142fb0942ca6466b5750a3f56936848b1713eb21 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 31 Oct 2018 23:49:40 -0600
Subject: [PATCH 34/68] show local ssh config

---
 bin/telebitd.js | 37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index decc22e..75408dc 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -628,22 +628,27 @@ function handleApi(req, res) {
   function getStatus() {
     var now = Date.now();
     res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify(
-      { module: 'status'
-      , version: pkg.version
-      , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
-      , enabled: !state.config.disable
-      , active: !!myRemote
-      , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
-      , connected: isConnected
-      , proctime: Math.round(process.uptime() * 1000)
-      , uptime: now - startTime
-      , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
-      , reconnects: connectTimes.length
-      , servernames: state.servernames
-      , ssh: state.config.sshAuto
-      }
-    ));
+    require('../lib/ssh.js').checkSecurity().then(function (ssh) {
+      res.end(JSON.stringify(
+        { module: 'status'
+        , version: pkg.version
+        , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
+        , enabled: !state.config.disable
+        , active: !!myRemote
+        , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
+        , connected: isConnected
+        , proctime: Math.round(process.uptime() * 1000)
+        , uptime: now - startTime
+        , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
+        , reconnects: connectTimes.length
+        , servernames: state.servernames
+        , ssh: state.config.sshAuto
+        , ssh_permit_root_login: ssh.permit_root_login
+        , ssh_password_authentication: ssh.password_authentication
+        , ssh_requests_password: ssh.requests_password
+        }
+      ));
+    });
   }
 
   function route() {
-- 
2.38.5


From 34bcf79d98194c8cd31c6a44adc5a521d1e8c1d3 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 1 Nov 2018 00:56:39 -0600
Subject: [PATCH 35/68] use default sshd_config on windows also

---
 lib/ssh.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/ssh.js b/lib/ssh.js
index 3097023..8d761ab 100644
--- a/lib/ssh.js
+++ b/lib/ssh.js
@@ -42,9 +42,13 @@ function sshAllowsPassword(user) {
 
 module.exports.checkSecurity = function () {
   var conf = {};
-  var sshdConf = '/etc/ssh/sshd_config';
   var noRootPasswordRe = /(?:^|[\r\n]+)\s*PermitRootLogin\s+(prohibit-password|without-password|no)\s*/i;
   var noPasswordRe = /(?:^|[\r\n]+)\s*PasswordAuthentication\s+(no)\s*/i;
+  var sshdConf = '/etc/ssh/sshd_config';
+  if (/^win/i.test(process.platform)) {
+    // TODO use %PROGRAMDATA%\ssh\sshd_config
+    sshdConf = 'C:\\ProgramData\\ssh\\sshd_config';
+  }
   return readFile(sshdConf, null).then(function (sshd) {
     sshd = sshd.toString('utf8');
     var match;
-- 
2.38.5


From 535c9732c6f70e25ce3858704e2116d5679e5452 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 1 Nov 2018 02:19:07 -0600
Subject: [PATCH 36/68] rearrange a few things

---
 bin/telebitd.js      |   2 +-
 lib/admin/index.html | 127 ++++++++++++++++++++++----------------
 lib/admin/js/app.js  | 142 +++++++++++++++++++++++++++++++------------
 3 files changed, 178 insertions(+), 93 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 75408dc..8314e30 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -637,7 +637,7 @@ function handleApi(req, res) {
         , active: !!myRemote
         , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
         , connected: isConnected
-        , proctime: Math.round(process.uptime() * 1000)
+        //, proctime: Math.round(process.uptime() * 1000)
         , uptime: now - startTime
         , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
         , reconnects: connectTimes.length
diff --git a/lib/admin/index.html b/lib/admin/index.html
index a0e9028..6a08197 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -115,74 +115,95 @@
     </section>
 
     <section v-if="views.section.status">
-      <button v-if="!status.enabled" v-on:click="enable">Enable Traffic</button>
-      <button v-if="status.enabled" v-on:click="disable">Disable Traffic</button>
-      <br>
-      <br>
-
       http://localhost:{{ status.port }}
       <br>
       <br>
 
-      SSH:
-      <span v-if="status.ssh">{{ status.ssh }}
-        <button v-on:click="ssh(-1)">Disable SSH</button></span>
-      <span v-if="!status.ssh"><input type="text" v-model="state.ssh" placeholder="22">
-        <button v-on:click="ssh(state.ssh)">Enable SSH</button></span>
-      <br>
-      <br>
+      <section v-if="views.section.status_chooser">
+        <button v-on:click.prevent.stop="changeState('status/share')">Share Files &amp; Folders</button>
+        <button v-on:click.prevent.stop="changeState('status/host')">Host a Website or Webapp</button>
+        <button v-on:click.prevent.stop="changeState('status/access')">Remote Access via SSH</button>
+      </section>
 
-      Path Hosting:
-      <ul>
-        <li v-for="domain in status.pathHosting">
-          {{ domain.name }}
-          <input type="text" v-model="domain.path" v-bind:placeholder="domain.handler">
-          <button
-            v-if="domain.handler == domain.path"
-            v-on:click="changePathHost(domain, domain.path)">Save</button>
-          <button v-on:click="deletePathHost(domain)">X</button>
-        </li>
-      </ul>
-      <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
-        <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
-        <select v-model="newHttp.name">
-          <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
-        </select>
-        <input v-model="newHttp.handler" type="text" placeholder="path (ex: ~/Public)" required>
-        <button>Add</button>
-      </form>
-      <br>
+      <section v-if="views.section.status_access">
+        SSH:
+        <span v-if="status.ssh">{{ status.ssh }}
+          <button v-on:click="ssh(-1)">Disable SSH</button></span>
+        <span v-if="!status.ssh"><input type="text" v-model="state.ssh" placeholder="22">
+          <button v-on:click="ssh(state.ssh)">Enable SSH</button></span>
+        <br>
+        <br>
+        <div v-if="state.ssh_active">SSH is currently running</div>
+        <div v-if="!state.ssh_active">SSH is not currently running</div>
+        <br>
+        <div v-if="state.ssh_insecure">Password Authentication is NOT disabled.
+          Please consider updating your <code>sshd_config</code> and restarting ssh.
+          <pre><code>{{ status }}</code></pre>
+        </div>
+        <div v-if="!state.ssh_insecure">Key-Only Authentication is enabled :)</div>
+        <br>
+      </section>
 
-      Port Forwarding:
-      <ul>
-        <li v-for="domain in status.portForwards">
-          {{ domain.name }}
-          <input type="text" v-model="domain._port" v-bind:placeholder="domain.handler">
-          <button
-            v-if="domain.handler == domain._port"
-            v-on:click="changePortForward(domain, domain._port)">Save</button>
-          <button v-on:click="deletePortForward(domain)">X</button>
-        </li>
-      </ul>
-      <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
-        <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
-        <select v-model="newHttp.name">
-          <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
-        </select>
-        <input v-model="newHttp.handler" type="number" placeholder="port (ex: 3000)" required>
-        <button>Add</button>
-      </form>
+      <section v-if="views.section.status_share">
+        Path Hosting:
+        <ul>
+          <li v-for="domain in status.pathHosting">
+            {{ domain.name }}
+            <input type="text" v-model="domain.path" v-bind:placeholder="domain.handler">
+            <button
+              v-if="domain.handler == domain.path"
+              v-on:click="changePathHost(domain, domain.path)">Save</button>
+            <button v-on:click="deletePathHost(domain)">X</button>
+          </li>
+        </ul>
+        <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
+          <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
+          <select v-model="newHttp.name">
+            <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
+          </select>
+          <input v-model="newHttp.handler" type="text" placeholder="path (ex: ~/Public)" required>
+          <button>Add</button>
+        </form>
+        <br>
+      </section>
+
+      <section v-if="views.section.status_host">
+        Port Forwarding:
+        <ul>
+          <li v-for="domain in status.portForwards">
+            {{ domain.name }}
+            <input type="text" v-model="domain._port" v-bind:placeholder="domain.handler">
+            <button
+              v-if="domain.handler == domain._port"
+              v-on:click="changePortForward(domain, domain._port)">Save</button>
+            <button v-on:click="deletePortForward(domain)">X</button>
+          </li>
+        </ul>
+        <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
+          <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
+          <select v-model="newHttp.name">
+            <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
+          </select>
+          <input v-model="newHttp.handler" type="number" placeholder="port (ex: 3000)" required>
+          <button>Add</button>
+        </form>
+      </section>
 
-      <br>
-      Proctime: {{ statusProctime }}
       <br>
       Uptime: {{ statusUptime }}
       <br>
       Runtime: {{ statusRuntime }}
       <br>
       Reconnects: {{ status.reconnects }}
+
+      <details><summary><small>Advanced</small></summary>
+      <button v-if="!status.enabled" v-on:click="enable">Enable Traffic</button>
+      <button v-if="status.enabled" v-on:click="disable">Disable Traffic</button>
       <br>
+      <br>
+
       <pre><code>{{ status }}</code></pre>
+      </details>
     </section>
 
   </div>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 3dd907d..708dbfb 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -247,6 +247,7 @@ var appMethods = {
 , deletePathHost: function (domain) {
     api.http(domain.name, 'none');
   }
+, changeState: changeState
 };
 var appStates = {
   setup: function () {
@@ -263,51 +264,113 @@ var appStates = {
       clearInterval(tok);
     }
 
-    function updateStatus() {
-      return api.status().then(function (status) {
-        if (status.error) {
-          appData.views.flash.error = status.error.message || JSON.stringify(status.error, null, 2);
-        }
-        var wilddomains = [];
-        var rootdomains = [];
-        var subdomains = [];
-        var directories = [];
-        var portforwards = [];
-        var free = [];
-        appData.status = status;
-        Object.keys(appData.status.servernames).forEach(function (k) {
-          var s = appData.status.servernames[k];
-          s.name = k;
-          if (s.wildcard) { wilddomains.push(s); }
-          if (!s.sub && !s.wildcard) { rootdomains.push(s); }
-          if (s.sub) { subdomains.push(s); }
-          if (s.handler) {
-            if (s.handler.toString() === parseInt(s.handler, 10).toString()) {
-              s._port = s.handler;
-              portforwards.push(s);
-            } else {
-              s.path = s.handler;
-              directories.push(s);
-            }
-          } else {
-            free.push(s);
-          }
-        });
-        appData.status.portForwards = portforwards;
-        appData.status.pathHosting = directories;
-        appData.status.wildDomains = wilddomains;
-        appData.newHttp.name = (appData.status.wildDomains[0] || {}).name;
-        appData.state.ssh = (appData.status.ssh > 0) && appData.status.ssh || undefined;
-      });
-    }
     var tok = setInterval(updateStatus, 2000);
 
     return updateStatus().then(function () {
-      appData.views.section = { status: true };
+      appData.views.section = { status: true, status_chooser: true };
       return exitState;
     });
   }
 };
+appStates.status.share = function () {
+  function exitState() {
+    clearInterval(tok);
+  }
+
+  var tok = setInterval(updateStatus, 2000);
+
+  appData.views.section = { status: true, status_share: true };
+  return updateStatus().then(function () {
+    return exitState;
+  });
+};
+appStates.status.host = function () {
+  function exitState() {
+    clearInterval(tok);
+  }
+
+  var tok = setInterval(updateStatus, 2000);
+
+  appData.views.section = { status: true, status_host: true };
+  return updateStatus().then(function () {
+    return exitState;
+  });
+};
+appStates.status.access = function () {
+  function exitState() {
+    clearInterval(tok);
+  }
+
+  var tok = setInterval(updateStatus, 2000);
+
+  appData.views.section = { status: true, status_access: true };
+  return updateStatus().then(function () {
+    return exitState;
+  });
+};
+
+function updateStatus() {
+  return api.status().then(function (status) {
+    if (status.error) {
+      appData.views.flash.error = status.error.message || JSON.stringify(status.error, null, 2);
+    }
+    var wilddomains = [];
+    var rootdomains = [];
+    var subdomains = [];
+    var directories = [];
+    var portforwards = [];
+    var free = [];
+    appData.status = status;
+    if ('maybe' === status.ssh_requests_password) {
+      appData.status.ssh_active = false;
+    } else {
+      appData.status.ssh_active = true;
+      if ('yes' === status.ssh_requests_password) {
+        appData.status.ssh_insecure = true;
+      }
+    }
+    if ('yes' === status.ssh_password_authentication) {
+      appData.status.ssh_insecure = true;
+    }
+    if ('yes' === status.ssh_permit_root_login) {
+      appData.status.ssh_insecure = true;
+    }
+
+    // only update what's changed
+    if (appData.state.ssh !== appData.status.ssh) {
+      appData.state.ssh = appData.status.ssh;
+    }
+    if (appData.state.ssh_insecure !== appData.status.ssh_insecure) {
+      appData.state.ssh_insecure = appData.status.ssh_insecure;
+    }
+    if (appData.state.ssh_active !== appData.status.ssh_active) {
+      appData.state.ssh_active = appData.status.ssh_active;
+    }
+    Object.keys(appData.status.servernames).forEach(function (k) {
+      var s = appData.status.servernames[k];
+      s.name = k;
+      if (s.wildcard) { wilddomains.push(s); }
+      if (!s.sub && !s.wildcard) { rootdomains.push(s); }
+      if (s.sub) { subdomains.push(s); }
+      if (s.handler) {
+        if (s.handler.toString() === parseInt(s.handler, 10).toString()) {
+          s._port = s.handler;
+          portforwards.push(s);
+        } else {
+          s.path = s.handler;
+          directories.push(s);
+        }
+      } else {
+        free.push(s);
+      }
+    });
+    appData.status.portForwards = portforwards;
+    appData.status.pathHosting = directories;
+    appData.status.wildDomains = wilddomains;
+    appData.newHttp.name = (appData.status.wildDomains[0] || {}).name;
+    appData.state.ssh = (appData.status.ssh > 0) && appData.status.ssh || undefined;
+  });
+}
 
 function changeState(newstate) {
   var newhash = '#/' + newstate + '/';
@@ -325,13 +388,14 @@ function setState(/*ev*/) {
   //ev.oldURL
   //ev.newURL
   if (appData.exit) {
+    console.log('previous state exiting');
     appData.exit.then(function (exit) {
       if ('function' === typeof appData.exit) {
         exit();
       }
     });
   }
-  var parts = location.hash.substr(1).replace(/^\//, '').replace(/\/$/, '').split('/');
+  var parts = location.hash.substr(1).replace(/^\//, '').replace(/\/$/, '').split('/').filter(Boolean);
   var fn = appStates;
   parts.forEach(function (s) {
     console.log("state:", s);
-- 
2.38.5


From fff8f318c09e9bb5a438edf30c6bd2742d6ab796 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 1 Nov 2018 03:11:47 -0600
Subject: [PATCH 37/68] handle shares a little better

---
 bin/telebitd.js      | 36 +++++++++++++++++++++++++++++++-----
 lib/admin/index.html |  6 +++---
 lib/admin/js/app.js  | 28 +++++++++++++++++++---------
 3 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 8314e30..1e0881b 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -128,18 +128,38 @@ controllers.http = function (req, res, opts) {
     name = name.replace(/\./, '-').replace(/-+/, '-');
     return name;
   }
+
+  function assign(target, handler, indexes) {
+    target.handler = handler;
+    if (indexes) {
+      target.indexes = true;
+    } else {
+      delete target.indexes;
+    }
+  }
+
   if (!opts.body) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"module \'http\' needs more arguments"}}));
     return;
   }
+
   var active = true;
   var portOrPath = opts.body.handler || opts.body[0];
-  var appname = getAppname(portOrPath);
   var subdomain = opts.body.name || opts.body[1];
+  var indexes = opts.body.indexes;
   var remoteHost;
 
+  if (!subdomain) {
+    res.statusCode = 422;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({ error: { message: "module 'http' needs more arguments" } }));
+    return;
+  }
+
+  var appname = getAppname(portOrPath);
+
   // Assign an FQDN to brief subdomains
   // ex: foo => foo.rando.telebit.cloud
   if (subdomain && !/\./.test(subdomain)) {
@@ -174,7 +194,13 @@ controllers.http = function (req, res, opts) {
         return;
       }
     });
-    delete state.servernames[subdomain];
+    if (state.servernames[subdomain]) {
+      // TODO remove all non-essential keys
+      delete state.servernames[subdomain].handler;
+      if (state.servernames[subdomain].sub) {
+        delete state.servernames[subdomain];
+      }
+    }
     remoteHost = 'none';
   } else if (subdomain && 'none' !== subdomain) {
     // use a subdomain with this handler
@@ -188,7 +214,7 @@ controllers.http = function (req, res, opts) {
     if ('none' === portOrPath) {
       delete state.servernames[subdomain].handler;
     } else {
-      state.servernames[subdomain].handler = portOrPath;
+      assign(state.servernames[subdomain], portOrPath, indexes);
     }
     remoteHost = subdomain;
   } else {
@@ -207,7 +233,7 @@ controllers.http = function (req, res, opts) {
         if (!state.servernames[prefix]) {
           state.servernames[prefix] = { sub: undefined };
         }
-        state.servernames[prefix].handler = portOrPath;
+        assign(state.servernames[prefix], portOrPath, indexes);
         remoteHost = prefix;
         return true;
       }
@@ -215,7 +241,7 @@ controllers.http = function (req, res, opts) {
       Object.keys(state.servernames).some(function (key) {
         //var prefix = appname + '.' + key;
         var prefix = key;
-        state.servernames[key].handler = portOrPath;
+        assign(state.servernames[key], portOrPath, indexes);
         remoteHost = prefix;
         return true;
       });
diff --git a/lib/admin/index.html b/lib/admin/index.html
index 6a08197..a629605 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -156,8 +156,8 @@
             <button v-on:click="deletePathHost(domain)">X</button>
           </li>
         </ul>
-        <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
-          <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
+        <form v-on:submit.prevent.stop="createShare(newHttp.sub, newHttp.name, newHttp.handler)">
+          <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: pub)">
           <select v-model="newHttp.name">
             <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
           </select>
@@ -179,7 +179,7 @@
             <button v-on:click="deletePortForward(domain)">X</button>
           </li>
         </ul>
-        <form v-on:submit="createHttp(newHttp.name, newHttp.handler)">
+        <form v-on:submit="createHost(newHttp.sub, newHttp.name, newHttp.handler)">
           <input v-model="newHttp.sub" type="text" placeholder="subdomain (ex: api)">
           <select v-model="newHttp.name">
             <option v-for="w in status.wildDomains" v-bind:value="w.name">{{ w.name }}</option>
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 708dbfb..9b3b772 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -37,12 +37,12 @@ api.status = function apiStatus() {
     return json;
   });
 };
-api.http = function apiHttp(name, handler) {
+api.http = function apiHttp(o) {
   var opts = {
     url: "/api/http"
   , method: "POST"
   , headers: { 'Content-Type': 'application/json' }
-  , json: { name: name, handler: handler }
+  , json: { name: o.name, handler: o.handler, indexes: o.indexes }
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -231,21 +231,31 @@ var appMethods = {
     // 1-65536
     api.ssh(port || 22);
   }
-, createHttp: function (domain, handler) {
-    api.http(domain.name, handler);
+, createShare: function (sub, domain, handler) {
+    if (sub) {
+      domain = sub + '.' + domain;
+    }
+    api.http({ name: domain, handler: handler, indexes: true });
+    appData.newHttp = {};
+  }
+, createHost: function (sub, domain, handler) {
+    if (sub) {
+      domain = sub + '.' + domain;
+    }
+    api.http({ name: domain, handler: handler, 'x-forwarded-for': name });
     appData.newHttp = {};
   }
 , changePortForward: function (domain, port) {
-    api.http(domain.name, port);
+    api.http({ name: domain.name, handler: port });
   }
 , deletePortForward: function (domain) {
-    api.http(domain.name, 'none');
+    api.http({ name: domain.name, handler: 'none' });
   }
 , changePathHost: function (domain, path) {
-    api.http(domain.name, path);
+    api.http({ name: domain.name, handler: path });
   }
 , deletePathHost: function (domain) {
-    api.http(domain.name, 'none');
+    api.http({ name: domain.name, handler: 'none' });
   }
 , changeState: changeState
 };
@@ -390,7 +400,7 @@ function setState(/*ev*/) {
   if (appData.exit) {
     console.log('previous state exiting');
     appData.exit.then(function (exit) {
-      if ('function' === typeof appData.exit) {
+      if ('function' === typeof exit) {
         exit();
       }
     });
-- 
2.38.5


From 7758e3b5edfd11a5f27c042cb1a0a232810f8e50 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 1 Nov 2018 03:18:42 -0600
Subject: [PATCH 38/68] forms now work on enter key

---
 lib/admin/index.html | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/lib/admin/index.html b/lib/admin/index.html
index a629605..e6ffba2 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -148,12 +148,13 @@
         Path Hosting:
         <ul>
           <li v-for="domain in status.pathHosting">
+            <form v-on:submit.prevent.stop="changePathHost(domain, domain.path)">
             {{ domain.name }}
             <input type="text" v-model="domain.path" v-bind:placeholder="domain.handler">
-            <button
-              v-if="domain.handler == domain.path"
-              v-on:click="changePathHost(domain, domain.path)">Save</button>
-            <button v-on:click="deletePathHost(domain)">X</button>
+            <button type="submit"
+              v-if="domain.handler == domain.path">Save</button>
+            <button type="button" v-on:click="deletePathHost(domain)">X</button>
+            </form>
           </li>
         </ul>
         <form v-on:submit.prevent.stop="createShare(newHttp.sub, newHttp.name, newHttp.handler)">
@@ -171,12 +172,13 @@
         Port Forwarding:
         <ul>
           <li v-for="domain in status.portForwards">
+            <form v-on:submit.prevent.stop="changePortForward(domain, domain._port)">
             {{ domain.name }}
             <input type="text" v-model="domain._port" v-bind:placeholder="domain.handler">
-            <button
-              v-if="domain.handler == domain._port"
-              v-on:click="changePortForward(domain, domain._port)">Save</button>
-            <button v-on:click="deletePortForward(domain)">X</button>
+            <button type="submit"
+              v-if="domain.handler == domain._port">Save</button>
+            <button type="button" v-on:click="deletePortForward(domain)">X</button>
+            </form>
           </li>
         </ul>
         <form v-on:submit="createHost(newHttp.sub, newHttp.name, newHttp.handler)">
-- 
2.38.5


From 0996d78ecd76f66af093c2063d4677f811098246 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 1 Nov 2018 03:49:36 -0600
Subject: [PATCH 39/68] add note on ssh

---
 lib/admin/index.html | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/admin/index.html b/lib/admin/index.html
index e6ffba2..51a748a 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -142,6 +142,22 @@
         </div>
         <div v-if="!state.ssh_insecure">Key-Only Authentication is enabled :)</div>
         <br>
+        <div class="alert alert-info">
+          <strong>Important:</strong> Accessing this device with other SSH clients:
+          <br>
+          In order to use your other ssh clients with telebit you will need to put them into
+          <strong>ssh+https mode</strong>.
+
+          We recommend downloading <code><a href="https://telebit.cloud/sclient/" target="_blank">sclient</a></code>
+          to do so, because it makes it as simple as adding <code>-o ProxyCommand="sclient %h"</code> to your
+          ssh command to enable ssh+https:
+          <pre><code>ssh -o ProxyCommand="sclient %h" {{ newHttp.name }}</code></pre>
+          <br>
+          However, most clients can also use <code>openssl s_client</code>, which does the same thing, but is
+          more difficult to remember:
+          <pre><code>proxy_cmd='openssl s_client -connect %h:443 -servername %h -quiet'
+ssh -o ProxyCommand="$proxy_cmd" hot-skunk-45.telebit.io</code></pre>
+        </div>
       </section>
 
       <section v-if="views.section.status_share">
-- 
2.38.5


From d5a622444e79c6b24e20651ed30e0642fe84ad41 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Fri, 2 Nov 2018 10:31:31 -0600
Subject: [PATCH 40/68] don't require subdomain

---
 bin/telebitd.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 1e0881b..ccd32d8 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -141,7 +141,7 @@ controllers.http = function (req, res, opts) {
   if (!opts.body) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"module \'http\' needs more arguments"}}));
+    res.end(JSON.stringify({"error":{"message":"module \'http\' needs some arguments"}}));
     return;
   }
 
@@ -151,10 +151,10 @@ controllers.http = function (req, res, opts) {
   var indexes = opts.body.indexes;
   var remoteHost;
 
-  if (!subdomain) {
+  if (!portOrPath) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({ error: { message: "module 'http' needs more arguments" } }));
+    res.end(JSON.stringify({ error: { message: "module 'http' needs port or path" } }));
     return;
   }
 
-- 
2.38.5


From 75f538fa16f7b2ea85b7dc1781042b9ae251a5ea Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 4 Nov 2018 14:28:07 -0700
Subject: [PATCH 41/68] minor cleanup, throw on previously unchecked error

---
 bin/telebit-remote.js |  6 +++---
 lib/rc/index.js       | 13 ++++++++-----
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 3ef5ebc..16e1a3b 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -306,8 +306,8 @@ var RC;
 
 function parseConfig(err, text) {
   function handleConfig(err, config) {
-    //console.log('CONFIG');
-    //console.log(config);
+    if (err) { throw err; }
+
     state.config = config;
     var verstrd = [ pkg.name + ' daemon v' + state.config.version ];
     if (state.config.version && state.config.version !== pkg.version) {
@@ -652,7 +652,7 @@ function parseConfig(err, text) {
     });
   }
 
-  RC.request({ service: 'config', method: 'GET' }, handleRemoteRequest('config', handleConfig));
+  RC.request({ service: 'config', method: 'GET' }, handleConfig);
 }
 
 var parsers = {
diff --git a/lib/rc/index.js b/lib/rc/index.js
index fd6da53..aa1f3d0 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -39,15 +39,18 @@ module.exports.create = function (state) {
       var err;
 
       if (200 !== resp.statusCode) {
-        err = new Error(body || ('get' + service + ' failed'));
+        err = new Error(body || ('get ' + service + ' failed'));
         err.statusCode = resp.statusCode;
         err.code = "E_REQUEST";
       }
 
-      try {
-        body = JSON.parse(body);
-      } catch(e) {
-        // ignore
+      if (body) {
+        try {
+          body = JSON.parse(body);
+        } catch(e) {
+          console.error('Error:', err);
+          // ignore
+        }
       }
 
       fn(err, body);
-- 
2.38.5


From 583ffabdff2334cba3615564270c890b70c9a422 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 27 Feb 2019 20:51:47 -0700
Subject: [PATCH 42/68] minor updates

---
 README.md         |    6 +-
 bin/telebit.js    |    0
 package-lock.json | 1031 +++++++++++++++++++++++++++++++++++++++++++++
 package.json      |    2 +
 4 files changed, 1037 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 bin/telebit.js
 create mode 100644 package-lock.json

diff --git a/README.md b/README.md
index fc10c3c..eb9b26c 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
 # Telebit&trade; Remote
 
-Because friends don't let friends localhost&trade;
+The T-Rex Long-Arm of the Internet
+
+<small>because friends don't let friends localhost</small>
 
 | Sponsored by [ppl](https://ppl.family)
 | **Telebit Remote**
@@ -524,7 +526,7 @@ rm -rf ~/.config/telebit ~/.local/share/telebit
 Browser Library
 =======
 
-This is implemented with websockets, so you should be able to
+This is implemented with websockets, so browser compatibility is a hopeful future outcome. Would love help.
 
 LICENSE
 =======
diff --git a/bin/telebit.js b/bin/telebit.js
old mode 100644
new mode 100755
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..851faff
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,1031 @@
+{
+  "name": "telebit",
+  "version": "0.21.0-wip.1",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "@coolaj86/urequest": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@coolaj86/urequest/-/urequest-1.3.6.tgz",
+      "integrity": "sha512-9rBXLFSb5D19opGeXdD/WuiFJsA4Pk2r8VUGEAeUZUxB1a2zB47K85BKAx3Gy9i4nZwg22ejlJA+q9DVrpQlbA=="
+    },
+    "accepts": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.5.tgz",
+      "integrity": "sha1-63d99gEXI6OxTopywIBcjoZ0a9I=",
+      "requires": {
+        "mime-types": "~2.1.18",
+        "negotiator": "0.6.1"
+      }
+    },
+    "acme": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/acme/-/acme-1.1.0.tgz",
+      "integrity": "sha512-l2UAkE7aEKdYZ2dSok/ONxKLWj4HrSSPwuGsQE42LM8m6NukRXPKSWXyusqR4m+LhvN76183VvA8IDOOnLjSlw==",
+      "requires": {
+        "acme-v2": "^1.1.0",
+        "bluebird": "^3.5.1"
+      }
+    },
+    "acme-v2": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/acme-v2/-/acme-v2-1.1.0.tgz",
+      "integrity": "sha512-yODrKcfaqDwRM/nVZdupww7s7y/D1q6QMe8nbYPifVEO7JYi653FaoPbUFRXFKTEzFhJ4HNXZMGUKmLYJQq/Ag==",
+      "requires": {
+        "@coolaj86/urequest": "^1.1.1",
+        "rsa-compat": "^1.3.0"
+      }
+    },
+    "any-promise": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
+      "integrity": "sha1-q8av7tzqUugJzcA3au0845Y10X8="
+    },
+    "argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "requires": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI="
+    },
+    "asn1js": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-1.2.12.tgz",
+      "integrity": "sha1-h9XueXWWri0qPLAkciDcQv/D8hE="
+    },
+    "async-limiter": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/async-limiter/-/async-limiter-1.0.0.tgz",
+      "integrity": "sha512-jp/uFnooOiO+L211eZOoSyzpOITMXx1rBITauYykG3BRYPu8h0UcxsPNB04RR5vo4Tyz3+ay17tR6JVf9qzYWg=="
+    },
+    "batch": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/batch/-/batch-0.6.1.tgz",
+      "integrity": "sha1-3DQxT05nkxgJP8dgJyUl+UvyXBY="
+    },
+    "bluebird": {
+      "version": "3.5.1",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.5.1.tgz",
+      "integrity": "sha512-MKiLiV+I1AA596t9w1sQJ8jkiSr5+ZKi0WKrYGUn6d1Fx+Ij4tIj+m2WMQSGczs5jZVxV339chE8iwk6F64wjA=="
+    },
+    "body-parser": {
+      "version": "1.18.3",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz",
+      "integrity": "sha1-WykhmP/dVTs6DyDe0FkrlWlVyLQ=",
+      "requires": {
+        "bytes": "3.0.0",
+        "content-type": "~1.0.4",
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "http-errors": "~1.6.3",
+        "iconv-lite": "0.4.23",
+        "on-finished": "~2.3.0",
+        "qs": "6.5.2",
+        "raw-body": "2.3.3",
+        "type-is": "~1.6.16"
+      }
+    },
+    "buffer-alloc": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/buffer-alloc/-/buffer-alloc-1.2.0.tgz",
+      "integrity": "sha512-CFsHQgjtW1UChdXgbyJGtnm+O/uLQeZdtbDo8mfUgYXCHSM1wgrVxXm6bSyrUuErEb+4sYVGCzASBRot7zyrow==",
+      "requires": {
+        "buffer-alloc-unsafe": "^1.1.0",
+        "buffer-fill": "^1.0.0"
+      }
+    },
+    "buffer-alloc-unsafe": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz",
+      "integrity": "sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg=="
+    },
+    "buffer-equal-constant-time": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+      "integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk="
+    },
+    "buffer-fill": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz",
+      "integrity": "sha1-+PeLdniYiO858gXNY39o5wISKyw="
+    },
+    "buffer-from": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.0.tgz",
+      "integrity": "sha512-c5mRlguI/Pe2dSZmpER62rSCu0ryKmWddzRYsuXc50U2/g8jMOulc31VZMa4mYx31U5xsmSOpDCgH88Vl9cDGQ=="
+    },
+    "buffer-v6-polyfill": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/buffer-v6-polyfill/-/buffer-v6-polyfill-1.0.5.tgz",
+      "integrity": "sha1-0c2v61YAvvbCjWFElkJWvRLgFnc="
+    },
+    "bytes": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
+      "integrity": "sha1-0ygVQE1olpn4Wk6k+odV3ROpYEg="
+    },
+    "certpem": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/certpem/-/certpem-1.0.1.tgz",
+      "integrity": "sha1-+koljEBXllxGVwCCL7jYB9fy2fU=",
+      "requires": {
+        "asn1js": "^1.2.12",
+        "buffer-v6-polyfill": "^1.0.3",
+        "node.extend": "^1.1.5",
+        "pkijs": "^1.3.27"
+      }
+    },
+    "content-disposition": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.2.tgz",
+      "integrity": "sha1-DPaLud318r55YcOoUXjLhdunjLQ="
+    },
+    "content-type": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
+      "integrity": "sha512-hIP3EEPs8tB9AT1L+NUqtwOAps4mk2Zob89MWXMHjHWg9milF/j4osnnQLXBCBFBk/tvIG/tUc9mOUJiPBhPXA=="
+    },
+    "cookie": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.3.1.tgz",
+      "integrity": "sha1-5+Ch+e9DtMi6klxcWpboBtFoc7s="
+    },
+    "cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
+    },
+    "core-util-is": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
+      "integrity": "sha1-tf1UIgqivFq1eqtxQMlAdUUDwac="
+    },
+    "csv-parser": {
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/csv-parser/-/csv-parser-1.12.1.tgz",
+      "integrity": "sha512-r45M92nLnGP246ot0Yo5RvbiiMF5Bw/OTIdWJ3OQ4Vbv4hpOeoXVIPxdSmUw+fPJlQOseY+iigJyLSfPMIrddQ==",
+      "requires": {
+        "buffer-alloc": "^1.1.0",
+        "buffer-from": "^1.0.0",
+        "generate-function": "^1.0.1",
+        "generate-object-property": "^1.0.0",
+        "inherits": "^2.0.1",
+        "minimist": "^1.2.0",
+        "ndjson": "^1.4.0"
+      },
+      "dependencies": {
+        "minimist": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+          "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ="
+        }
+      }
+    },
+    "debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "requires": {
+        "ms": "2.0.0"
+      }
+    },
+    "depd": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha1-m81S4UwJd2PnSbJ0xDRu0uVgtak="
+    },
+    "destroy": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.0.4.tgz",
+      "integrity": "sha1-l4hXRCxEdJ5CBmE+N5RiBYJqvYA="
+    },
+    "ecdsa-sig-formatter": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.10.tgz",
+      "integrity": "sha1-HFlQAPBKiJffuFAAiSoPTDOvhsM=",
+      "requires": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha1-WQxhFWsK4vTwJVcyoViyZrxWsh0="
+    },
+    "encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k="
+    },
+    "escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
+    },
+    "esprima": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.0.tgz",
+      "integrity": "sha512-oftTcaMu/EGrEIu904mWteKIv8vMuOgGYo7EhVJJN00R/EED9DCua/xxHRdYnKtcECzVg7xOWhflvJMnqcFZjw=="
+    },
+    "etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc="
+    },
+    "express": {
+      "version": "4.16.4",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.16.4.tgz",
+      "integrity": "sha512-j12Uuyb4FMrd/qQAm6uCHAkPtO8FDTRJZBDd5D2KOL2eLaz1yUNdUB/NOIyq0iU4q4cFarsUCrnFDPBcnksuOg==",
+      "requires": {
+        "accepts": "~1.3.5",
+        "array-flatten": "1.1.1",
+        "body-parser": "1.18.3",
+        "content-disposition": "0.5.2",
+        "content-type": "~1.0.4",
+        "cookie": "0.3.1",
+        "cookie-signature": "1.0.6",
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "1.1.1",
+        "fresh": "0.5.2",
+        "merge-descriptors": "1.0.1",
+        "methods": "~1.1.2",
+        "on-finished": "~2.3.0",
+        "parseurl": "~1.3.2",
+        "path-to-regexp": "0.1.7",
+        "proxy-addr": "~2.0.4",
+        "qs": "6.5.2",
+        "range-parser": "~1.2.0",
+        "safe-buffer": "5.1.2",
+        "send": "0.16.2",
+        "serve-static": "1.13.2",
+        "setprototypeof": "1.1.0",
+        "statuses": "~1.4.0",
+        "type-is": "~1.6.16",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      }
+    },
+    "finalhandler": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.1.tgz",
+      "integrity": "sha512-Y1GUDo39ez4aHAw7MysnUD5JzYX+WaIj8I57kO3aEPT1fFRL4sr7mjei97FgnwhAyyzRYmQZaTHb2+9uZ1dPtg==",
+      "requires": {
+        "debug": "2.6.9",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.3.0",
+        "parseurl": "~1.3.2",
+        "statuses": "~1.4.0",
+        "unpipe": "~1.0.0"
+      }
+    },
+    "forwarded": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.1.2.tgz",
+      "integrity": "sha1-mMI9qxF1ZXuMBXPozszZGw/xjIQ="
+    },
+    "fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha1-PYyt2Q2XZWn6g1qx+OSyOhBWBac="
+    },
+    "from2": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/from2/-/from2-2.3.0.tgz",
+      "integrity": "sha1-i/tVAr3kpNNs/e6gB/zKIdfjgq8=",
+      "requires": {
+        "inherits": "^2.0.1",
+        "readable-stream": "^2.0.0"
+      }
+    },
+    "fs-symlink": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/fs-symlink/-/fs-symlink-1.2.1.tgz",
+      "integrity": "sha1-G+uoPqncqBI2AOPwuaUbGGQLvEA=",
+      "requires": {
+        "mkdirp": "^0.5.0",
+        "mkdirp-then": "1",
+        "mz": "^2.0.0"
+      }
+    },
+    "generate-function": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-1.1.0.tgz",
+      "integrity": "sha1-VMIbCAGSsW2Yd3ecW7gWZudyNl8="
+    },
+    "generate-object-property": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/generate-object-property/-/generate-object-property-1.2.0.tgz",
+      "integrity": "sha1-nA4cQDCM6AT0eDYYuTf6iPmdUNA=",
+      "requires": {
+        "is-property": "^1.0.0"
+      }
+    },
+    "get-stream": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-2.3.1.tgz",
+      "integrity": "sha1-Xzj5PzRgCWZu4BUKBUFn+Rvdld4=",
+      "requires": {
+        "object-assign": "^4.0.1",
+        "pinkie-promise": "^2.0.0"
+      }
+    },
+    "greenlock": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/greenlock/-/greenlock-2.3.2.tgz",
+      "integrity": "sha512-8jxb7gnKPMqUMBxa7ET3qTIALzEh30Na6TccIzaly62THZfiQtdPhVe9y26oaOEx5JGUMhc83FFo2hboeJz+ow==",
+      "requires": {
+        "acme": "^1.0.6",
+        "acme-v2": "^1.0.6",
+        "asn1js": "^1.2.12",
+        "bluebird": "^3.5.1",
+        "certpem": "^1.0.0",
+        "le-challenge-fs": "^2.0.2",
+        "le-sni-auto": "^2.1.3",
+        "le-store-certbot": "^2.1.0",
+        "node.extend": "^1.1.5",
+        "pkijs": "^1.3.27",
+        "rsa-compat": "^1.4.0"
+      }
+    },
+    "hoek": {
+      "version": "2.16.3",
+      "resolved": "https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz",
+      "integrity": "sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0="
+    },
+    "http-errors": {
+      "version": "1.6.3",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.3.tgz",
+      "integrity": "sha1-i1VoC7S+KDoLW/TqLjhYC+HZMg0=",
+      "requires": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.3",
+        "setprototypeof": "1.1.0",
+        "statuses": ">= 1.4.0 < 2"
+      }
+    },
+    "iconv-lite": {
+      "version": "0.4.23",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.23.tgz",
+      "integrity": "sha512-neyTUVFtahjf0mB3dZT77u+8O0QB89jFdnBkd5P1JgYPbPaia3gXXOVL2fq8VyU2gMMD7SaN7QukTB/pmXYvDA==",
+      "requires": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      }
+    },
+    "inherits": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
+      "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4="
+    },
+    "into-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/into-stream/-/into-stream-2.0.1.tgz",
+      "integrity": "sha1-25sANpRFPq4JHYpchMwRUHt4HTE=",
+      "requires": {
+        "from2": "^2.1.1"
+      }
+    },
+    "ipaddr.js": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.8.0.tgz",
+      "integrity": "sha1-6qM9bd16zo9/b+DJygRA5wZzix4="
+    },
+    "is": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/is/-/is-3.2.1.tgz",
+      "integrity": "sha1-0Kwq1V63sL7JJqUmb2xmKqqD3KU="
+    },
+    "is-property": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
+      "integrity": "sha1-V/4cTkhHTt1lsJkR8msc1Ald2oQ="
+    },
+    "isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE="
+    },
+    "isemail": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/isemail/-/isemail-1.2.0.tgz",
+      "integrity": "sha1-vgPfjMPineTSxd9lASY/H6RZXpo="
+    },
+    "joi": {
+      "version": "6.10.1",
+      "resolved": "https://registry.npmjs.org/joi/-/joi-6.10.1.tgz",
+      "integrity": "sha1-TVDDGAeRIgAP5fFq8f+OGRe3fgY=",
+      "requires": {
+        "hoek": "2.x.x",
+        "isemail": "1.x.x",
+        "moment": "2.x.x",
+        "topo": "1.x.x"
+      }
+    },
+    "js-yaml": {
+      "version": "3.12.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz",
+      "integrity": "sha512-PIt2cnwmPfL4hKNwqeiuz4bKfnzHTBv6HyVgjahA6mPLwPDzjDWrplJBMjHUFxku/N3FlmrbyPclad+I+4mJ3A==",
+      "requires": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      }
+    },
+    "json-stringify-safe": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
+      "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
+    },
+    "jsonwebtoken": {
+      "version": "7.4.3",
+      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.4.3.tgz",
+      "integrity": "sha1-d/UCHeBYtgWheD+hKD6ZgS5kVjg=",
+      "requires": {
+        "joi": "^6.10.1",
+        "jws": "^3.1.4",
+        "lodash.once": "^4.0.0",
+        "ms": "^2.0.0",
+        "xtend": "^4.0.1"
+      }
+    },
+    "jwa": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/jwa/-/jwa-1.1.6.tgz",
+      "integrity": "sha512-tBO/cf++BUsJkYql/kBbJroKOgHWEigTKBAjjBEmrMGYd1QMBC74Hr4Wo2zCZw6ZrVhlJPvoMrkcOnlWR/DJfw==",
+      "requires": {
+        "buffer-equal-constant-time": "1.0.1",
+        "ecdsa-sig-formatter": "1.0.10",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "jws": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/jws/-/jws-3.1.5.tgz",
+      "integrity": "sha512-GsCSexFADNQUr8T5HPJvayTjvPIfoyJPtLQBwn5a4WZQchcrPMPMAWcC1AzJVRDKyD6ZPROPAxgv6rfHViO4uQ==",
+      "requires": {
+        "jwa": "^1.1.5",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "keypairs": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.0.1.tgz",
+      "integrity": "sha512-vwzW+HWfifpSbjGP+qg3P2IXNrTc4tuFRxiVmddwZbV6jYkbARJOnGMQhG36OeBxW5/Ec1iBKDFTyoxjn+dLLg==",
+      "requires": {
+        "eckles": "^1.4.0",
+        "rasha": "^1.2.1"
+      },
+      "dependencies": {
+        "eckles": {
+          "version": "1.4.0",
+          "resolved": "https://registry.npmjs.org/eckles/-/eckles-1.4.0.tgz",
+          "integrity": "sha512-Bm5dpwhsBuoCHvKCY3gAvP8XFyXH7im8uAu3szykpVNbFBdC+lOuV8vLC8fvTYRZBfFqB+k/P6ud/ZPVO2V2tA=="
+        }
+      }
+    },
+    "le-challenge-fs": {
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/le-challenge-fs/-/le-challenge-fs-2.0.8.tgz",
+      "integrity": "sha1-ttRYo38JfoffPYtf9nATc3q51aI=",
+      "requires": {
+        "mkdirp": "^0.5.1"
+      }
+    },
+    "le-sni-auto": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/le-sni-auto/-/le-sni-auto-2.1.5.tgz",
+      "integrity": "sha512-AUlFpYifutAAs0D0UwVVD5Jzf+X2J6+VNb03LCOFVAezQNpNcQFsWwrZzd+y24gF7jYHGBbD25q8gURQ5rhL8w==",
+      "requires": {
+        "bluebird": "^3.5.1"
+      }
+    },
+    "le-store-certbot": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/le-store-certbot/-/le-store-certbot-2.1.3.tgz",
+      "integrity": "sha512-bUzbk4SfOKURUyLam4R7kI+7zGsO7/w/9mjeSDK+fAFLebjz/XND5VDzHotFEEbaOcu0UldD1/Dx3VShYnOFnw==",
+      "requires": {
+        "bluebird": "^3.5.1",
+        "fs-symlink": "^1.2.1",
+        "mkdirp": "^0.5.1",
+        "pyconf": "^1.1.2",
+        "safe-replace": "^1.0.2"
+      }
+    },
+    "lodash.once": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
+      "integrity": "sha1-DdOXEhPHxW34gJd9UEyI+0cal6w="
+    },
+    "media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha1-hxDXrwqmJvj/+hzgAWhUUmMlV0g="
+    },
+    "merge-descriptors": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
+      "integrity": "sha1-sAqqVW3YtEVoFQ7J0blT8/kMu2E="
+    },
+    "methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4="
+    },
+    "mime": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.4.1.tgz",
+      "integrity": "sha512-KI1+qOZu5DcW6wayYHSzR/tXKCDC5Om4s1z2QJjDULzLcmf3DvzS7oluY4HCTrc+9FiKmWUgeNLg7W3uIQvxtQ=="
+    },
+    "mime-db": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.33.0.tgz",
+      "integrity": "sha512-BHJ/EKruNIqJf/QahvxwQZXKygOQ256myeN/Ew+THcAa5q+PjyTTMMeNQC4DZw5AwfvelsUrA6B67NKMqXDbzQ=="
+    },
+    "mime-types": {
+      "version": "2.1.18",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.18.tgz",
+      "integrity": "sha512-lc/aahn+t4/SWV/qcmumYjymLsWfN3ELhpmVuUFjgsORruuZPVSwAQryq+HHGvO/SI2KVX26bx+En+zhM8g8hQ==",
+      "requires": {
+        "mime-db": "~1.33.0"
+      }
+    },
+    "minimist": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz",
+      "integrity": "sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0="
+    },
+    "mkdirp": {
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz",
+      "integrity": "sha1-MAV0OOrGz3+MR2fzhkjWaX11yQM=",
+      "requires": {
+        "minimist": "0.0.8"
+      }
+    },
+    "mkdirp-then": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/mkdirp-then/-/mkdirp-then-1.2.0.tgz",
+      "integrity": "sha1-pJLIecpNhz9e5FAI+PVf0BUN48U=",
+      "requires": {
+        "any-promise": "^1.1.0",
+        "mkdirp": "^0.5.0"
+      }
+    },
+    "moment": {
+      "version": "2.22.2",
+      "resolved": "https://registry.npmjs.org/moment/-/moment-2.22.2.tgz",
+      "integrity": "sha1-PCV/mDn8DpP/UxSWMiOeuQeD/2Y="
+    },
+    "ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g="
+    },
+    "mz": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
+      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
+      "requires": {
+        "any-promise": "^1.0.0",
+        "object-assign": "^4.0.1",
+        "thenify-all": "^1.0.0"
+      }
+    },
+    "ndjson": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/ndjson/-/ndjson-1.5.0.tgz",
+      "integrity": "sha1-rmA7NrE0vOw0e0UkIrC/mNWDLsg=",
+      "requires": {
+        "json-stringify-safe": "^5.0.1",
+        "minimist": "^1.2.0",
+        "split2": "^2.1.0",
+        "through2": "^2.0.3"
+      },
+      "dependencies": {
+        "minimist": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+          "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ="
+        }
+      }
+    },
+    "neat-csv": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/neat-csv/-/neat-csv-2.1.0.tgz",
+      "integrity": "sha1-BvWDYMTDuVW9Rn3cha5FEaOQekw=",
+      "requires": {
+        "csv-parser": "^1.6.0",
+        "get-stream": "^2.1.0",
+        "into-stream": "^2.0.0"
+      }
+    },
+    "negotiator": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.1.tgz",
+      "integrity": "sha1-KzJxhOiZIQEXeyhWP7XnECrNDKk="
+    },
+    "node.extend": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/node.extend/-/node.extend-1.1.6.tgz",
+      "integrity": "sha1-p7iCyC1sk6SGOlUEvV3o7IYli5Y=",
+      "requires": {
+        "is": "^3.1.0"
+      }
+    },
+    "object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM="
+    },
+    "on-finished": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
+      "integrity": "sha1-IPEzZIGwg811M3mSoWlxqi2QaUc=",
+      "requires": {
+        "ee-first": "1.1.1"
+      }
+    },
+    "parseurl": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.2.tgz",
+      "integrity": "sha1-/CidTtiZMRlGDBViUyYs3I3mW/M="
+    },
+    "path-to-regexp": {
+      "version": "0.1.7",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
+      "integrity": "sha1-32BBeABfUi8V60SQ5yR6G/qmf4w="
+    },
+    "pify": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz",
+      "integrity": "sha1-5aSs0sEB/fPZpNB/DbxNtJ3SgXY="
+    },
+    "pinkie": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/pinkie/-/pinkie-2.0.4.tgz",
+      "integrity": "sha1-clVrgM+g1IqXToDnckjoDtT3+HA="
+    },
+    "pinkie-promise": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/pinkie-promise/-/pinkie-promise-2.0.1.tgz",
+      "integrity": "sha1-ITXW36ejWMBprJsXh3YogihFD/o=",
+      "requires": {
+        "pinkie": "^2.0.0"
+      }
+    },
+    "pkijs": {
+      "version": "1.3.33",
+      "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-1.3.33.tgz",
+      "integrity": "sha1-ponvYhE7fDSOH/wJll0iOeW7TJI="
+    },
+    "process-nextick-args": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.0.tgz",
+      "integrity": "sha512-MtEC1TqN0EU5nephaJ4rAtThHtC86dNN9qCuEhtshvpVBkAW5ZO7BASN9REnF9eoXGcRub+pFuKEpOHE+HbEMw=="
+    },
+    "proxy-addr": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.4.tgz",
+      "integrity": "sha512-5erio2h9jp5CHGwcybmxmVqHmnCBZeewlfJ0pex+UW7Qny7OOZXTtH56TGNyBizkgiOwhJtMKrVzDTeKcySZwA==",
+      "requires": {
+        "forwarded": "~0.1.2",
+        "ipaddr.js": "1.8.0"
+      }
+    },
+    "proxy-packer": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/proxy-packer/-/proxy-packer-2.0.2.tgz",
+      "integrity": "sha512-EQxdOMAYc8zINq9MsV7Vm55hjuNo4eC9z6GlqizCkeE5HldvnOCjsYJnwul+feey6RAJzp34klkD+9+0h2sXLQ=="
+    },
+    "ps-list": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/ps-list/-/ps-list-5.0.0.tgz",
+      "integrity": "sha512-EnMjo990nDlzBVoV/m2Vo2+Ja3sO1Ikgo3TcLF2KI1DVW3SYEt8zouS40X4Z/tfULam5R3ig8a/rhmvE3mRq5w==",
+      "requires": {
+        "pify": "^3.0.0",
+        "tasklist": "^3.1.0"
+      }
+    },
+    "pyconf": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/pyconf/-/pyconf-1.1.5.tgz",
+      "integrity": "sha512-zXEg0oUJ4mY6azqVvRy6rePTIHZGhDQG3z9PVkE60uUabS9uILiIkHobU2Jzcs3tBltMBqyEATZZezRR/UFjkg==",
+      "requires": {
+        "safe-replace": "^1.0.2"
+      }
+    },
+    "qs": {
+      "version": "6.5.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz",
+      "integrity": "sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA=="
+    },
+    "range-parser": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.0.tgz",
+      "integrity": "sha1-9JvmtIeJTdxA3MlKMi9hEJLgDV4="
+    },
+    "rasha": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/rasha/-/rasha-1.2.1.tgz",
+      "integrity": "sha512-cs4Hu/rVF3/Qucq+V7lxSz449VfHNMVXJaeajAHno9H5FC1PWlmS4NM6IAX5jPKFF0IC2rOdHdf7iNxQuIWZag=="
+    },
+    "raw-body": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.3.3.tgz",
+      "integrity": "sha512-9esiElv1BrZoI3rCDuOuKCBRbuApGGaDPQfjSflGxdy4oyzqghxu6klEkkVIvBje+FF0BX9coEv8KqW6X/7njw==",
+      "requires": {
+        "bytes": "3.0.0",
+        "http-errors": "1.6.3",
+        "iconv-lite": "0.4.23",
+        "unpipe": "1.0.0"
+      }
+    },
+    "readable-stream": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.6.tgz",
+      "integrity": "sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==",
+      "requires": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "recase": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/recase/-/recase-1.0.4.tgz",
+      "integrity": "sha1-asoF8GFV5u0bY2LmIQUKEdvZ+FE="
+    },
+    "redirect-https": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/redirect-https/-/redirect-https-1.1.5.tgz",
+      "integrity": "sha512-40okBDSPOoK3E8ttlKxG60vBJMmxT+UPS43zrIkWo6QlNrRgvj/jY/trvATXpCN4XpuySdYsQnXxgfB8QBsBHg==",
+      "requires": {
+        "escape-html": "^1.0.3"
+      }
+    },
+    "rsa-compat": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/rsa-compat/-/rsa-compat-1.4.2.tgz",
+      "integrity": "sha512-Ic0WfTwdiZ8DlSRDe3frod/8XGCZufwnsH4ap+6Ldt+j9bCCxIyoJZwlCvAL2NDeEO7ax0p/H0FmypprDF6B6w==",
+      "requires": {
+        "node-forge": "^0.6.41"
+      },
+      "dependencies": {
+        "node-forge": {
+          "version": "0.6.49",
+          "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.6.49.tgz",
+          "integrity": "sha1-8e6V1ddGI5OP4Z1piqWibVTS9g8="
+        }
+      }
+    },
+    "safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+    },
+    "safe-replace": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.0.2.tgz",
+      "integrity": "sha1-sYGrQJWs32qwqPhAUXSRyoqZIro="
+    },
+    "safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
+    },
+    "sclient": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/sclient/-/sclient-1.4.1.tgz",
+      "integrity": "sha512-IsSIlWg9MjqknF3YtT6+ewCszAUeZfwLu2bNLSzbqoduc6t73K+zs/L2L5wmmgDL6BapBxqgwqBBchhizxS0JA=="
+    },
+    "sec": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/sec/-/sec-1.0.0.tgz",
+      "integrity": "sha1-Az1go60g7PLgCUDRT5eCNGV3QzU="
+    },
+    "send": {
+      "version": "0.16.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.16.2.tgz",
+      "integrity": "sha512-E64YFPUssFHEFBvpbbjr44NCLtI1AohxQ8ZSiJjQLskAdKuriYEP6VyGEsRDH8ScozGpkaX1BGvhanqCwkcEZw==",
+      "requires": {
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "destroy": "~1.0.4",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "0.5.2",
+        "http-errors": "~1.6.2",
+        "mime": "1.4.1",
+        "ms": "2.0.0",
+        "on-finished": "~2.3.0",
+        "range-parser": "~1.2.0",
+        "statuses": "~1.4.0"
+      }
+    },
+    "serve-index": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/serve-index/-/serve-index-1.9.1.tgz",
+      "integrity": "sha1-03aNabHn2C5c4FD/9bRTvqEqkjk=",
+      "requires": {
+        "accepts": "~1.3.4",
+        "batch": "0.6.1",
+        "debug": "2.6.9",
+        "escape-html": "~1.0.3",
+        "http-errors": "~1.6.2",
+        "mime-types": "~2.1.17",
+        "parseurl": "~1.3.2"
+      }
+    },
+    "serve-static": {
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.13.2.tgz",
+      "integrity": "sha512-p/tdJrO4U387R9oMjb1oj7qSMaMfmOyd4j9hOFoxZe2baQszgHcSWjuya/CiT5kgZZKRudHNOA0pYXOl8rQ5nw==",
+      "requires": {
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.2",
+        "send": "0.16.2"
+      }
+    },
+    "serve-tpl-attachment": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/serve-tpl-attachment/-/serve-tpl-attachment-1.0.4.tgz",
+      "integrity": "sha512-lv0t/G/x/Ikk780y+RChulnp42Q3xWStmgU4Yz2HXzO2uE+vJXfG7ntAzffgpuJSY29/arbAaqfEuI/NI5hNnA==",
+      "requires": {
+        "accepts": "^1.3.5",
+        "batch": "^0.6.1",
+        "mime-types": "^2.1.19"
+      },
+      "dependencies": {
+        "mime-db": {
+          "version": "1.35.0",
+          "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.35.0.tgz",
+          "integrity": "sha512-JWT/IcCTsB0Io3AhWUMjRqucrHSPsSf2xKLaRldJVULioggvkJvggZ3VXNNSRkCddE6D+BUI4HEIZIA2OjwIvg=="
+        },
+        "mime-types": {
+          "version": "2.1.19",
+          "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.19.tgz",
+          "integrity": "sha512-P1tKYHVSZ6uFo26mtnve4HQFE3koh1UWVkp8YUC+ESBHe945xWSoXuHHiGarDqcEZ+whpCDnlNw5LON0kLo+sw==",
+          "requires": {
+            "mime-db": "~1.35.0"
+          }
+        }
+      }
+    },
+    "setprototypeof": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.0.tgz",
+      "integrity": "sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ=="
+    },
+    "sni": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/sni/-/sni-1.0.0.tgz",
+      "integrity": "sha1-b6Qr35d23i43zsYBIua+yD3wBvU="
+    },
+    "socket-pair": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/socket-pair/-/socket-pair-1.0.4.tgz",
+      "integrity": "sha512-OEjlBOVBZpGBDvcjyYwFLZLGwNc8yMewKMirtoaR1WnX/XI2jo8ylsCEH4C6eXmcj5blQisECacN7yc3xlrwAA==",
+      "requires": {
+        "bluebird": "^3.5.1"
+      }
+    },
+    "split2": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-2.2.0.tgz",
+      "integrity": "sha512-RAb22TG39LhI31MbreBgIuKiIKhVsawfTgEGqKHTK87aG+ul/PB8Sqoi3I7kVdRWiCfrKxK3uo4/YUkpNvhPbw==",
+      "requires": {
+        "through2": "^2.0.2"
+      }
+    },
+    "sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw="
+    },
+    "statuses": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.4.0.tgz",
+      "integrity": "sha512-zhSCtt8v2NDrRlPQpCNtw/heZLtfUDqxBM1udqikb/Hbk52LK4nQSwr10u77iopCW5LsyHpuXS0GnEc48mLeew=="
+    },
+    "string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "requires": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
+    "tasklist": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/tasklist/-/tasklist-3.1.0.tgz",
+      "integrity": "sha1-hzqYpORcvez6LC7hiGU1MFfmNpY=",
+      "requires": {
+        "neat-csv": "^2.1.0",
+        "pify": "^2.2.0",
+        "sec": "^1.0.0"
+      },
+      "dependencies": {
+        "pify": {
+          "version": "2.3.0",
+          "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
+          "integrity": "sha1-7RQaasBDqEnqWISY59yosVMw6Qw="
+        }
+      }
+    },
+    "thenify": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.0.tgz",
+      "integrity": "sha1-5p44obq+lpsBCCB5eLn2K4hgSDk=",
+      "requires": {
+        "any-promise": "^1.0.0"
+      }
+    },
+    "thenify-all": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
+      "integrity": "sha1-GhkY1ALY/D+Y+/I02wvMjMEOlyY=",
+      "requires": {
+        "thenify": ">= 3.1.0 < 4"
+      }
+    },
+    "through2": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.3.tgz",
+      "integrity": "sha1-AARWmzfHx0ujnEPzzteNGtlBQL4=",
+      "requires": {
+        "readable-stream": "^2.1.5",
+        "xtend": "~4.0.1"
+      }
+    },
+    "toml": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-0.4.1.tgz",
+      "integrity": "sha1-Iv5QHFe+WpV9o4JcHd5YS7LmL3M="
+    },
+    "topo": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/topo/-/topo-1.1.0.tgz",
+      "integrity": "sha1-6ddRYV0buH3IZdsYL6HKCl71NtU=",
+      "requires": {
+        "hoek": "2.x.x"
+      }
+    },
+    "type-is": {
+      "version": "1.6.16",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.16.tgz",
+      "integrity": "sha512-HRkVv/5qY2G6I8iab9cI7v1bOIdhm94dVjQCPFElW9W+3GeDOSHmy2EBYe4VTApuzolPcmgFTN3ftVJRKR2J9Q==",
+      "requires": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.18"
+      }
+    },
+    "unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha1-sr9O6FFKrmFltIF4KdIbLvSZBOw="
+    },
+    "util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8="
+    },
+    "utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM="
+    },
+    "vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw="
+    },
+    "ws": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-6.0.0.tgz",
+      "integrity": "sha512-c2UlYcAZp1VS8AORtpq6y4RJIkJ9dQz18W32SpR/qXGfLDZ2jU4y4wKvvZwqbi7U6gxFQTeE+urMbXU/tsDy4w==",
+      "requires": {
+        "async-limiter": "~1.0.0"
+      }
+    },
+    "xtend": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.1.tgz",
+      "integrity": "sha1-pcbVMr5lbiPbgg77lDofBJmNY68="
+    }
+  }
+}
diff --git a/package.json b/package.json
index 959fbac..cb08ef7 100644
--- a/package.json
+++ b/package.json
@@ -54,10 +54,12 @@
   "homepage": "https://git.coolaj86.com/coolaj86/telebit.js#readme",
   "dependencies": {
     "@coolaj86/urequest": "^1.3.5",
+    "express": "^4.16.4",
     "finalhandler": "^1.1.1",
     "greenlock": "^2.3.1",
     "js-yaml": "^3.11.0",
     "jsonwebtoken": "^7.1.9",
+    "keypairs": "^1.0.1",
     "mkdirp": "^0.5.1",
     "proxy-packer": "^2.0.2",
     "ps-list": "^5.0.0",
-- 
2.38.5


From 693a524549d996175a97afc3ac8979a6a66465fa Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 28 Feb 2019 00:00:23 -0700
Subject: [PATCH 43/68] use eggspress for routing

---
 bin/telebitd.js   | 645 ++++++++++++++++++++++------------------------
 lib/eggspress.js  |  78 ++++++
 package-lock.json | 171 ------------
 package.json      |   1 -
 4 files changed, 391 insertions(+), 504 deletions(-)
 create mode 100644 lib/eggspress.js

diff --git a/bin/telebitd.js b/bin/telebitd.js
index ccd32d8..7d7c4c5 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -28,6 +28,7 @@ var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"),
 var startTime = Date.now();
 var connectTimes = [];
 var isConnected = false;
+var eggspress = require('../lib/eggspress.js');
 
 var TelebitRemote = require('../lib/daemon/index.js').TelebitRemote;
 
@@ -112,7 +113,7 @@ function saveConfig(cb) {
   fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), cb);
 }
 var controllers = {};
-controllers.http = function (req, res, opts) {
+controllers.http = function (req, res) {
   function getAppname(pathname) {
     // port number
     if (String(pathname) === String(parseInt(pathname, 10))) {
@@ -138,7 +139,7 @@ controllers.http = function (req, res, opts) {
     }
   }
 
-  if (!opts.body) {
+  if (!req.body) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"module \'http\' needs some arguments"}}));
@@ -146,9 +147,9 @@ controllers.http = function (req, res, opts) {
   }
 
   var active = true;
-  var portOrPath = opts.body.handler || opts.body[0];
-  var subdomain = opts.body.name || opts.body[1];
-  var indexes = opts.body.indexes;
+  var portOrPath = req.body.handler || req.body[0];
+  var subdomain = req.body.name || req.body[1];
+  var indexes = req.body.indexes;
   var remoteHost;
 
   if (!portOrPath) {
@@ -260,8 +261,8 @@ controllers.http = function (req, res, opts) {
     }));
   });
 };
-controllers.tcp = function (req, res, opts) {
-  if (!opts.body) {
+controllers.tcp = function (req, res) {
+  if (!req.body) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({ error: { message: "module 'tcp' needs more arguments" } }));
@@ -269,8 +270,8 @@ controllers.tcp = function (req, res, opts) {
   }
 
   var active;
-  var remotePort = opts.body[1];
-  var portOrPath = opts.body[0];
+  var remotePort = req.body[1];
+  var portOrPath = req.body[0];
 
   // portnum
   if (remotePort) {
@@ -309,8 +310,8 @@ controllers.tcp = function (req, res, opts) {
     }));
   });
 };
-controllers.ssh = function (req, res, opts) {
-  if (!opts.body) {
+controllers.ssh = function (req, res) {
+  if (!req.body) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"module 'ssh' needs more arguments"}}));
@@ -336,7 +337,7 @@ controllers.ssh = function (req, res, opts) {
     });
   }
 
-  var rawSshAuto = opts.body.port || opts.body[0];
+  var rawSshAuto = req.body.port || req.body[0];
   var sshAuto = rawSshAuto;
   if (-1 !== [ -1, 'false', 'none', 'off', 'disable' ].indexOf(sshAuto)) {
     state.config.sshAuto = false;
@@ -358,41 +359,64 @@ controllers.ssh = function (req, res, opts) {
   state.config.sshAuto = sshAuto;
   sshSuccess();
 };
-controllers.relay = function (req, res, opts) {
-  if (!opts.body) {
+controllers.relay = function (req, res) {
+  if (!req.body) {
     res.statusCode = 422;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"module \'relay\' needs more arguments"}}));
     return;
   }
 
-  return urequestAsync(opts.body).then(function (resp) {
+  return urequestAsync(req.body).then(function (resp) {
     res.setHeader('Content-Type', 'application/json');
     resp = resp.toJSON();
     res.end(JSON.stringify(resp));
   });
 };
 
-var serveStatic = require('serve-static')(path.join(__dirname, '../lib/admin/'));
-function handleRemoteClient(req, res) {
-  if (/^\/(rpc|api)\//.test(req.url)) {
-    return handleApi(req, res);
-  }
-  serveStatic(req, res, require('finalhandler')(req, res));
-}
-function handleApi(req, res) {
-  var opts = url.parse(req.url, true);
-  if (false && opts.query._body) {
-    try {
-      opts.body = JSON.parse(decodeURIComponent(opts.query._body, true));
-    } catch(e) {
-      res.statusCode = 500;
-      res.end('{"error":{"message":"?_body={{bad_format}}"}}');
+function handleApi() {
+  var app = eggspress();
+
+  app.use('/', function (req, res, next) {
+    var opts = url.parse(req.url, true);
+    if (false && opts.query._body) {
+      try {
+        req.body = JSON.parse(decodeURIComponent(opts.query._body, true));
+      } catch(e) {
+        res.statusCode = 500;
+        res.end('{"error":{"message":"?_body={{bad_format}}"}}');
+        return;
+      }
+    }
+
+    var hasLength = req.headers['content-length'] > 0;
+    if (!hasLength && !req.headers['content-type']) {
+      next();
       return;
     }
-  }
 
-  function listSuccess() {
+    var body = '';
+    req.on('readable', function () {
+      var data;
+      while (true) {
+        data = req.read();
+        if (!data) { break; }
+        body += data.toString();
+      }
+    });
+    req.on('end', function () {
+      try {
+        req.body = JSON.parse(body);
+      } catch(e) {
+        res.statusCode = 400;
+        res.end('{"error":{"message":"POST body is not valid json"}}');
+        return;
+      }
+      next();
+    });
+  });
+
+  function listSuccess(req, res) {
     var dumpy = {
       servernames: state.servernames
     , ports: state.ports
@@ -411,7 +435,7 @@ function handleApi(req, res) {
     res.end(JSON.stringify(dumpy));
   }
 
-  function getConfigOnly() {
+  function getConfigOnly(req, res) {
     var resp = JSON.parse(JSON.stringify(state.config));
     resp.version = pkg.version;
     resp._otp = state.otp;
@@ -422,7 +446,7 @@ function handleApi(req, res) {
   //
   // without proper config
   //
-  function saveAndReport() {
+  function saveAndReport(req, res) {
     console.log('[DEBUG] saveAndReport config write', confpath);
     console.log(YAML.safeDump(snakeCopy(state.config)));
     fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
@@ -438,337 +462,294 @@ function handleApi(req, res) {
     });
   }
 
-  function initOrConfig() {
-    var conf = {};
-    if (!opts.body) {
-      res.statusCode = 422;
-      res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
-      return;
-    }
-
-    if (Array.isArray(opts.body)) {
-      // relay, email, agree_tos, servernames, ports
-      //
-      opts.body.forEach(function (opt) {
-        var parts = opt.split(/:/);
-        if ('true' === parts[1]) {
-          parts[1] = true;
-        } else if ('false' === parts[1]) {
-          parts[1] = false;
-        } else if ('null' === parts[1]) {
-          parts[1] = null;
-        } else if ('undefined' === parts[1]) {
-          parts[1] = undefined;
-        }
-        conf[parts[0]] = parts[1];
-      });
-    } else {
-      conf = opts.body;
-    }
-
-    conf = camelCopy(conf);
-
-    // TODO deep merge
-    // greenlock config
-    if (!state.config.greenlock) { state.config.greenlock = {}; }
-    if (conf.greenlock) {
-      if ('undefined' !== typeof conf.greenlock.agree) {
-        state.config.greenlock.agree = conf.greenlock.agree;
+    function initOrConfig(req, res) {
+      var conf = {};
+      if (!req.body) {
+        res.statusCode = 422;
+        res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
+        return;
       }
-      if (conf.greenlock.server) { state.config.greenlock.server = conf.greenlock.server; }
-      if (conf.greenlock.version) { state.config.greenlock.version = conf.greenlock.version; }
-    }
 
-    // main config
-    if (conf.email) { state.config.email = conf.email; }
-    if (conf.relay) { state.config.relay = conf.relay; }
-    if (conf.token) { state.config.token = conf.token; }
-    if (conf.secret) { state.config.secret = conf.secret; }
-    if ('undefined' !== typeof conf.agreeTos) {
-      state.config.agreeTos = conf.agreeTos;
-    }
+      if (Array.isArray(req.body)) {
+        // relay, email, agree_tos, servernames, ports
+        //
+        req.body.forEach(function (opt) {
+          var parts = opt.split(/:/);
+          if ('true' === parts[1]) {
+            parts[1] = true;
+          } else if ('false' === parts[1]) {
+            parts[1] = false;
+          } else if ('null' === parts[1]) {
+            parts[1] = null;
+          } else if ('undefined' === parts[1]) {
+            parts[1] = undefined;
+          }
+          conf[parts[0]] = parts[1];
+        });
+      } else {
+        conf = req.body;
+      }
 
-    // to state
-    if (conf.pretoken) { state.pretoken = conf.pretoken; }
-    if (conf._otp) {
-      state.otp = conf._otp; // TODO should this only be done on the client side?
-      delete conf._otp;
-    }
+      conf = camelCopy(conf);
 
-    console.log();
-    console.log('conf.token', typeof conf.token, conf.token);
-    console.log('state.config.token', typeof state.config.token, state.config.token);
-
-    if (state.secret) { console.log('state.secret'); state.token = common.signToken(state); }
-    if (!state.token) { console.log('!state.token'); state.token = conf._token; }
-
-    console.log();
-    console.log('JSON.stringify(conf)');
-    console.log(JSON.stringify(conf));
-    console.log();
-    console.log('JSON.stringify(state)');
-    console.log(JSON.stringify(state));
-    console.log();
-    if ('undefined' !== typeof conf.newsletter) {
-      state.config.newsletter = conf.newsletter;
-    }
-    if ('undefined' !== typeof conf.communityMember
-      || 'undefined' !== typeof conf.community_member) {
-      state.config.communityMember = conf.communityMember || conf.community_member;
-    }
-    if ('undefined' !== typeof conf.telemetry) {
-      state.config.telemetry = conf.telemetry;
-    }
-    if (conf._servernames) {
-      (conf._servernames||'').split(/,/g).forEach(function (key) {
-        if (!state.config.servernames[key]) {
-          state.config.servernames[key] = { sub: undefined };
+      // TODO deep merge
+      // greenlock config
+      if (!state.config.greenlock) { state.config.greenlock = {}; }
+      if (conf.greenlock) {
+        if ('undefined' !== typeof conf.greenlock.agree) {
+          state.config.greenlock.agree = conf.greenlock.agree;
         }
-      });
-    }
-    if (conf._ports) {
-      (conf._ports||'').split(/,/g).forEach(function (key) {
-        if (!state.config.ports[key]) {
-          state.config.ports[key] = {};
-        }
-      });
-    }
+        if (conf.greenlock.server) { state.config.greenlock.server = conf.greenlock.server; }
+        if (conf.greenlock.version) { state.config.greenlock.version = conf.greenlock.version; }
+      }
 
-    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-      console.warn('missing config');
-      res.statusCode = 400;
+      // main config
+      if (conf.email) { state.config.email = conf.email; }
+      if (conf.relay) { state.config.relay = conf.relay; }
+      if (conf.token) { state.config.token = conf.token; }
+      if (conf.secret) { state.config.secret = conf.secret; }
+      if ('undefined' !== typeof conf.agreeTos) {
+        state.config.agreeTos = conf.agreeTos;
+      }
 
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
-        error: {
-          code: "E_INIT"
-        , message: "Missing important config file params"
-        , _params: JSON.stringify(conf)
-        , _config: JSON.stringify(state.config)
-        , _body: JSON.stringify(opts.body)
-        }
-      }));
-      return;
-    }
+      // to state
+      if (conf.pretoken) { state.pretoken = conf.pretoken; }
+      if (conf._otp) {
+        state.otp = conf._otp; // TODO should this only be done on the client side?
+        delete conf._otp;
+      }
 
-    // init also means enable
-    delete state.config.disable;
-    safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
-  }
+      console.log();
+      console.log('conf.token', typeof conf.token, conf.token);
+      console.log('state.config.token', typeof state.config.token, state.config.token);
 
-  function restart() {
-    console.info("[telebitd.js] server closing...");
-    state.keepAlive.state = false;
-    if (myRemote) {
-      myRemote.end();
-      myRemote.on('end', respondAndClose);
-      // failsafe
-      setTimeout(function () {
-        console.info("[telebitd.js] closing too slowly, force quit");
-        respondAndClose();
-      }, 5 * 1000);
-    } else {
-      respondAndClose();
-    }
+      if (state.secret) { console.log('state.secret'); state.token = common.signToken(state); }
+      if (!state.token) { console.log('!state.token'); state.token = conf._token; }
 
-    function respondAndClose() {
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({ success: true }));
-      controlServer.close(function () {
-        console.info("[telebitd.js] server closed");
-        setTimeout(function () {
-          // system daemon will restart the process
-          process.exit(22); // use non-success exit code
-        }, 100);
-      });
-    }
-  }
+      console.log();
+      console.log('JSON.stringify(conf)');
+      console.log(JSON.stringify(conf));
+      console.log();
+      console.log('JSON.stringify(state)');
+      console.log(JSON.stringify(state));
+      console.log();
+      if ('undefined' !== typeof conf.newsletter) {
+        state.config.newsletter = conf.newsletter;
+      }
+      if ('undefined' !== typeof conf.communityMember
+        || 'undefined' !== typeof conf.community_member) {
+        state.config.communityMember = conf.communityMember || conf.community_member;
+      }
+      if ('undefined' !== typeof conf.telemetry) {
+        state.config.telemetry = conf.telemetry;
+      }
+      if (conf._servernames) {
+        (conf._servernames||'').split(/,/g).forEach(function (key) {
+          if (!state.config.servernames[key]) {
+            state.config.servernames[key] = { sub: undefined };
+          }
+        });
+      }
+      if (conf._ports) {
+        (conf._ports||'').split(/,/g).forEach(function (key) {
+          if (!state.config.ports[key]) {
+            state.config.ports[key] = {};
+          }
+        });
+      }
 
-  function invalidConfig() {
-    res.statusCode = 400;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({
-      error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
-    }));
-  }
+      if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+        console.warn('missing config');
+        res.statusCode = 400;
 
-  function saveAndCommit() {
-    state.config.servernames = state.servernames;
-    state.config.ports = state.ports;
-    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-      if (err) {
-        res.statusCode = 500;
         res.setHeader('Content-Type', 'application/json');
         res.end(JSON.stringify({
-          "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
+          error: {
+            code: "E_INIT"
+          , message: "Missing important config file params"
+          , _params: JSON.stringify(conf)
+          , _config: JSON.stringify(state.config)
+          , _body: JSON.stringify(req.body)
+          }
         }));
         return;
       }
-      listSuccess();
-    });
-  }
 
-  function handleError(err) {
-    res.statusCode = 500;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({
-      error: { message: err.message, code: err.code }
-    }));
-  }
+      // init also means enable
+      delete state.config.disable;
+      safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
+    }
 
-  function enable() {
-    delete state.config.disable;// = undefined;
-    state.keepAlive.state = true;
-
-    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-      if (err) {
-        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-        handleError(err);
-        return;
-      }
-      // TODO XXX myRemote.active
+    function restart(req, res) {
+      console.info("[telebitd.js] server closing...");
+      state.keepAlive.state = false;
       if (myRemote) {
-        listSuccess();
+        myRemote.end();
+        myRemote.on('end', respondAndClose);
+        // failsafe
+        setTimeout(function () {
+          console.info("[telebitd.js] closing too slowly, force quit");
+          respondAndClose();
+        }, 5 * 1000);
+      } else {
+        respondAndClose();
+      }
+
+      function respondAndClose() {
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ success: true }));
+        controlServer.close(function () {
+          console.info("[telebitd.js] server closed");
+          setTimeout(function () {
+            // system daemon will restart the process
+            process.exit(22); // use non-success exit code
+          }, 100);
+        });
+      }
+    }
+
+    function mustHaveValidConfig(req, res, next) {
+      //
+      // Check for proper config
+      //
+      if (state.config.relay && state.config.email && state.config.agreeTos) {
+        next();
         return;
       }
-      safeStartTelebitRemote(true).then(listSuccess).catch(handleError);
-    });
-  }
 
-  function disable() {
-    state.config.disable = true;
-    state.keepAlive.state = false;
-
-    if (myRemote) { myRemote.end(); myRemote = null; }
-    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      res.statusCode = 400;
       res.setHeader('Content-Type', 'application/json');
-      if (err) {
-        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-        handleError(err);
-        return;
-      }
-      res.end('{"success":true}');
-    });
-  }
+      res.end(JSON.stringify({
+        error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
+      }));
+    }
 
-  function getStatus() {
-    var now = Date.now();
-    res.setHeader('Content-Type', 'application/json');
-    require('../lib/ssh.js').checkSecurity().then(function (ssh) {
-      res.end(JSON.stringify(
-        { module: 'status'
-        , version: pkg.version
-        , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
-        , enabled: !state.config.disable
-        , active: !!myRemote
-        , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
-        , connected: isConnected
-        //, proctime: Math.round(process.uptime() * 1000)
-        , uptime: now - startTime
-        , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
-        , reconnects: connectTimes.length
-        , servernames: state.servernames
-        , ssh: state.config.sshAuto
-        , ssh_permit_root_login: ssh.permit_root_login
-        , ssh_password_authentication: ssh.password_authentication
-        , ssh_requests_password: ssh.requests_password
+    function saveAndCommit(req, res) {
+      state.config.servernames = state.servernames;
+      state.config.ports = state.ports;
+      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+        if (err) {
+          res.statusCode = 500;
+          res.setHeader('Content-Type', 'application/json');
+          res.end(JSON.stringify({
+            "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
+          }));
+          return;
         }
-      ));
-    });
-  }
-
-  function route() {
-    if (/\b(relay)\b/.test(opts.pathname)) {
-      controllers.relay(req, res, opts);
-      return;
-    }
-    if (/\b(config)\b/.test(opts.pathname) && /get/i.test(req.method)) {
-      getConfigOnly();
-      return;
-    }
-    if (/\b(init|config)\b/.test(opts.pathname)) {
-      initOrConfig();
-      return;
-    }
-    if (/restart/.test(opts.pathname)) {
-      restart();
-      return;
-    }
-    //
-    // Check for proper config
-    //
-    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-      invalidConfig();
-      return;
-    }
-    //
-    // With proper config
-    //
-    if (/http/.test(opts.pathname)) {
-      controllers.http(req, res, opts);
-      return;
-    }
-    if (/tcp/.test(opts.pathname)) {
-      controllers.tcp(req, res, opts);
-      return;
-    }
-    if (/save|commit/.test(opts.pathname)) {
-      saveAndCommit();
-      return;
-    }
-    if (/ssh/.test(opts.pathname)) {
-      controllers.ssh(req, res, opts);
-      return;
-    }
-    if (/enable/.test(opts.pathname)) {
-      enable();
-      return;
-    }
-    if (/disable/.test(opts.pathname)) {
-      disable();
-      return;
-    }
-    if (/status/.test(opts.pathname)) {
-      getStatus();
-      return;
-    }
-    if (/list/.test(opts.pathname)) {
-      listSuccess();
-      return;
+        listSuccess();
+      });
     }
 
+    function handleError(err, req, res) {
+      res.statusCode = 500;
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({
+        error: { message: err.message, code: err.code }
+      }));
+    }
+
+    function enable(req, res) {
+      delete state.config.disable;// = undefined;
+      state.keepAlive.state = true;
+
+      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+        if (err) {
+          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+          handleError(err, req, res);
+          return;
+        }
+        // TODO XXX myRemote.active
+        if (myRemote) {
+          listSuccess(req, res);
+          return;
+        }
+        safeStartTelebitRemote(true).then(listSuccess).catch(function () {
+          handleError(err, req, res);
+        });
+      });
+    }
+
+    function disable(req, res) {
+      state.config.disable = true;
+      state.keepAlive.state = false;
+
+      if (myRemote) { myRemote.end(); myRemote = null; }
+      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+        res.setHeader('Content-Type', 'application/json');
+        if (err) {
+          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+          handleError(err);
+          return;
+        }
+        res.end('{"success":true}');
+      });
+    }
+
+    function getStatus(req, res) {
+      var now = Date.now();
+      res.setHeader('Content-Type', 'application/json');
+      require('../lib/ssh.js').checkSecurity().then(function (ssh) {
+        res.end(JSON.stringify(
+          { module: 'status'
+          , version: pkg.version
+          , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
+          , enabled: !state.config.disable
+          , active: !!myRemote
+          , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
+          , connected: isConnected
+          //, proctime: Math.round(process.uptime() * 1000)
+          , uptime: now - startTime
+          , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
+          , reconnects: connectTimes.length
+          , servernames: state.servernames
+          , ssh: state.config.sshAuto
+          , ssh_permit_root_login: ssh.permit_root_login
+          , ssh_password_authentication: ssh.password_authentication
+          , ssh_requests_password: ssh.requests_password
+          }
+        ));
+      });
+    }
+
+  // TODO turn strings into regexes to match beginnings
+  app.use(/\b(relay)\b/, controllers.relay);
+  app.get(/\b(config)\b/, getConfigOnly);
+  app.use(/\b(init|config)\b/, initOrConfig);
+  app.use(/\b(restart)\b/, restart);
+
+  // Position is important with eggspress
+  // This should stay here, right before the other methods
+  app.use('/', mustHaveValidConfig);
+
+  //
+  // With proper config
+  //
+  app.use(/\b(http)\b/, controllers.http);
+  app.use(/\b(tcp)\b/, controllers.tcp);
+  app.use(/\b(save|commit)\b/, saveAndCommit);
+  app.use(/\b(ssh)\b/, controllers.ssh);
+  app.use(/\b(enable)\b/, enable);
+  app.use(/\b(disable)\b/, disable);
+  app.use(/\b(status)\b/, getStatus);
+  app.use(/\b(list)\b/, listSuccess);
+  app.use('/', function (req, res) {
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
-  }
-
-  var hasLength = req.headers['content-length'] > 0;
-  if (!hasLength && !req.headers['content-type']) {
-    route();
-    return;
-  }
-
-  var body = '';
-  req.on('readable', function () {
-    var data;
-    while (true) {
-      data = req.read();
-      if (!data) { break; }
-      body += data.toString();
-    }
-  });
-  req.on('end', function () {
-    try {
-      opts.body = JSON.parse(body);
-    } catch(e) {
-      res.statusCode = 400;
-      res.end('{"error":{"message":"POST body is not valid json"}}');
-      return;
-    }
-    route();
   });
+
+  return app;
 }
+
 function serveControlsHelper() {
-  controlServer = http.createServer(handleRemoteClient);
+  var app = eggspress();
+  var serveStatic = require('serve-static')(path.join(__dirname, '../lib/admin/'));
+  var apiHandler = handleApi();
+
+  app.use('/rpc/', apiHandler);
+  app.use('/api/', apiHandler);
+  app.use('/', serveStatic);
+
+  controlServer = http.createServer(app);
 
   if (fs.existsSync(state._ipc.path)) {
     fs.unlinkSync(state._ipc.path);
diff --git a/lib/eggspress.js b/lib/eggspress.js
new file mode 100644
index 0000000..0979a29
--- /dev/null
+++ b/lib/eggspress.js
@@ -0,0 +1,78 @@
+'use strict';
+
+module.exports = function eggspress() {
+  //var patternsMap = {};
+  var allPatterns = [];
+  var app = function (req, res) {
+    var patterns = allPatterns.slice(0).reverse();
+    function next() {
+      var todo = patterns.pop();
+      if (!todo) {
+        console.log('[eggspress] Did not match any patterns', req.url);
+        require('finalhandler')(req, res)();
+        return;
+      }
+
+      // '', GET, POST, DELETE
+      if (todo[2] && req.method.toLowerCase() !== todo[2]) {
+        //console.log("[eggspress] HTTP method doesn't match", req.url);
+        next();
+        return;
+      }
+
+      if (!req.url.match(todo[0])) {
+        //console.log("[eggspress] pattern doesn't match", todo[0], req.url);
+        next();
+        return;
+      } else if ('string' === typeof todo[0] && 0 !== req.url.match(todo[0]).index) {
+        //console.log("[eggspress] string pattern is not the start", todo[0], req.url);
+        next();
+        return;
+      }
+
+      try {
+        //console.log("[eggspress] matched pattern", todo[0], req.url);
+        todo[1](req, res, next);
+      } catch(e) {
+        console.error("[eggspress] error", todo[2], todo[0], req.url);
+        console.error(e);
+        // TODO make a nice error message
+        res.end(e.message);
+        return;
+      }
+    }
+    next();
+  };
+
+  app.use = function (pattern, fn) {
+    return app._use('', pattern, fn);
+  };
+  [ 'GET', 'POST', 'DELETE' ].forEach(function (method) {
+    app[method.toLowerCase()] = function (pattern, fn) {
+      return app._use(method, pattern, fn);
+    };
+  });
+
+  app.post = function (pattern, fn) {
+    return app._use('POST', pattern, fn);
+  };
+  app._use = function (method, pattern, fn) {
+    // always end in a slash, for now
+    if ('string' === typeof pattern) {
+      pattern = pattern.replace(/\/$/, '')  + '/';
+    }
+    /*
+    if (!patternsMap[pattern]) {
+      patternsMap[pattern] = [];
+    }
+    patternsMap[pattern].push(fn);
+    patterns = Object.keys(patternsMap).sort(function (a, b) {
+      return b.length - a.length;
+    });
+    */
+    allPatterns.push([pattern, fn, method.toLowerCase()]);
+    return app;
+  };
+
+  return app;
+};
diff --git a/package-lock.json b/package-lock.json
index 851faff..58e2c53 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -49,11 +49,6 @@
         "sprintf-js": "~1.0.2"
       }
     },
-    "array-flatten": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI="
-    },
     "asn1js": {
       "version": "1.2.12",
       "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-1.2.12.tgz",
@@ -74,23 +69,6 @@
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.5.1.tgz",
       "integrity": "sha512-MKiLiV+I1AA596t9w1sQJ8jkiSr5+ZKi0WKrYGUn6d1Fx+Ij4tIj+m2WMQSGczs5jZVxV339chE8iwk6F64wjA=="
     },
-    "body-parser": {
-      "version": "1.18.3",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz",
-      "integrity": "sha1-WykhmP/dVTs6DyDe0FkrlWlVyLQ=",
-      "requires": {
-        "bytes": "3.0.0",
-        "content-type": "~1.0.4",
-        "debug": "2.6.9",
-        "depd": "~1.1.2",
-        "http-errors": "~1.6.3",
-        "iconv-lite": "0.4.23",
-        "on-finished": "~2.3.0",
-        "qs": "6.5.2",
-        "raw-body": "2.3.3",
-        "type-is": "~1.6.16"
-      }
-    },
     "buffer-alloc": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/buffer-alloc/-/buffer-alloc-1.2.0.tgz",
@@ -125,11 +103,6 @@
       "resolved": "https://registry.npmjs.org/buffer-v6-polyfill/-/buffer-v6-polyfill-1.0.5.tgz",
       "integrity": "sha1-0c2v61YAvvbCjWFElkJWvRLgFnc="
     },
-    "bytes": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
-      "integrity": "sha1-0ygVQE1olpn4Wk6k+odV3ROpYEg="
-    },
     "certpem": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/certpem/-/certpem-1.0.1.tgz",
@@ -141,26 +114,6 @@
         "pkijs": "^1.3.27"
       }
     },
-    "content-disposition": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.2.tgz",
-      "integrity": "sha1-DPaLud318r55YcOoUXjLhdunjLQ="
-    },
-    "content-type": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
-      "integrity": "sha512-hIP3EEPs8tB9AT1L+NUqtwOAps4mk2Zob89MWXMHjHWg9milF/j4osnnQLXBCBFBk/tvIG/tUc9mOUJiPBhPXA=="
-    },
-    "cookie": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.3.1.tgz",
-      "integrity": "sha1-5+Ch+e9DtMi6klxcWpboBtFoc7s="
-    },
-    "cookie-signature": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
-      "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
-    },
     "core-util-is": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
@@ -238,43 +191,6 @@
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc="
     },
-    "express": {
-      "version": "4.16.4",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.16.4.tgz",
-      "integrity": "sha512-j12Uuyb4FMrd/qQAm6uCHAkPtO8FDTRJZBDd5D2KOL2eLaz1yUNdUB/NOIyq0iU4q4cFarsUCrnFDPBcnksuOg==",
-      "requires": {
-        "accepts": "~1.3.5",
-        "array-flatten": "1.1.1",
-        "body-parser": "1.18.3",
-        "content-disposition": "0.5.2",
-        "content-type": "~1.0.4",
-        "cookie": "0.3.1",
-        "cookie-signature": "1.0.6",
-        "debug": "2.6.9",
-        "depd": "~1.1.2",
-        "encodeurl": "~1.0.2",
-        "escape-html": "~1.0.3",
-        "etag": "~1.8.1",
-        "finalhandler": "1.1.1",
-        "fresh": "0.5.2",
-        "merge-descriptors": "1.0.1",
-        "methods": "~1.1.2",
-        "on-finished": "~2.3.0",
-        "parseurl": "~1.3.2",
-        "path-to-regexp": "0.1.7",
-        "proxy-addr": "~2.0.4",
-        "qs": "6.5.2",
-        "range-parser": "~1.2.0",
-        "safe-buffer": "5.1.2",
-        "send": "0.16.2",
-        "serve-static": "1.13.2",
-        "setprototypeof": "1.1.0",
-        "statuses": "~1.4.0",
-        "type-is": "~1.6.16",
-        "utils-merge": "1.0.1",
-        "vary": "~1.1.2"
-      }
-    },
     "finalhandler": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.1.tgz",
@@ -289,11 +205,6 @@
         "unpipe": "~1.0.0"
       }
     },
-    "forwarded": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.1.2.tgz",
-      "integrity": "sha1-mMI9qxF1ZXuMBXPozszZGw/xjIQ="
-    },
     "fresh": {
       "version": "0.5.2",
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
@@ -374,14 +285,6 @@
         "statuses": ">= 1.4.0 < 2"
       }
     },
-    "iconv-lite": {
-      "version": "0.4.23",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.23.tgz",
-      "integrity": "sha512-neyTUVFtahjf0mB3dZT77u+8O0QB89jFdnBkd5P1JgYPbPaia3gXXOVL2fq8VyU2gMMD7SaN7QukTB/pmXYvDA==",
-      "requires": {
-        "safer-buffer": ">= 2.1.2 < 3"
-      }
-    },
     "inherits": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
@@ -395,11 +298,6 @@
         "from2": "^2.1.1"
       }
     },
-    "ipaddr.js": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.8.0.tgz",
-      "integrity": "sha1-6qM9bd16zo9/b+DJygRA5wZzix4="
-    },
     "is": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/is/-/is-3.2.1.tgz",
@@ -525,21 +423,6 @@
       "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
       "integrity": "sha1-DdOXEhPHxW34gJd9UEyI+0cal6w="
     },
-    "media-typer": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha1-hxDXrwqmJvj/+hzgAWhUUmMlV0g="
-    },
-    "merge-descriptors": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
-      "integrity": "sha1-sAqqVW3YtEVoFQ7J0blT8/kMu2E="
-    },
-    "methods": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
-      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4="
-    },
     "mime": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/mime/-/mime-1.4.1.tgz",
@@ -659,11 +542,6 @@
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.2.tgz",
       "integrity": "sha1-/CidTtiZMRlGDBViUyYs3I3mW/M="
     },
-    "path-to-regexp": {
-      "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
-      "integrity": "sha1-32BBeABfUi8V60SQ5yR6G/qmf4w="
-    },
     "pify": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/pify/-/pify-3.0.0.tgz",
@@ -692,15 +570,6 @@
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.0.tgz",
       "integrity": "sha512-MtEC1TqN0EU5nephaJ4rAtThHtC86dNN9qCuEhtshvpVBkAW5ZO7BASN9REnF9eoXGcRub+pFuKEpOHE+HbEMw=="
     },
-    "proxy-addr": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.4.tgz",
-      "integrity": "sha512-5erio2h9jp5CHGwcybmxmVqHmnCBZeewlfJ0pex+UW7Qny7OOZXTtH56TGNyBizkgiOwhJtMKrVzDTeKcySZwA==",
-      "requires": {
-        "forwarded": "~0.1.2",
-        "ipaddr.js": "1.8.0"
-      }
-    },
     "proxy-packer": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/proxy-packer/-/proxy-packer-2.0.2.tgz",
@@ -723,11 +592,6 @@
         "safe-replace": "^1.0.2"
       }
     },
-    "qs": {
-      "version": "6.5.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz",
-      "integrity": "sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA=="
-    },
     "range-parser": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.0.tgz",
@@ -738,17 +602,6 @@
       "resolved": "https://registry.npmjs.org/rasha/-/rasha-1.2.1.tgz",
       "integrity": "sha512-cs4Hu/rVF3/Qucq+V7lxSz449VfHNMVXJaeajAHno9H5FC1PWlmS4NM6IAX5jPKFF0IC2rOdHdf7iNxQuIWZag=="
     },
-    "raw-body": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.3.3.tgz",
-      "integrity": "sha512-9esiElv1BrZoI3rCDuOuKCBRbuApGGaDPQfjSflGxdy4oyzqghxu6klEkkVIvBje+FF0BX9coEv8KqW6X/7njw==",
-      "requires": {
-        "bytes": "3.0.0",
-        "http-errors": "1.6.3",
-        "iconv-lite": "0.4.23",
-        "unpipe": "1.0.0"
-      }
-    },
     "readable-stream": {
       "version": "2.3.6",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.6.tgz",
@@ -801,11 +654,6 @@
       "resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.0.2.tgz",
       "integrity": "sha1-sYGrQJWs32qwqPhAUXSRyoqZIro="
     },
-    "safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
-    },
     "sclient": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/sclient/-/sclient-1.4.1.tgz",
@@ -985,15 +833,6 @@
         "hoek": "2.x.x"
       }
     },
-    "type-is": {
-      "version": "1.6.16",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.16.tgz",
-      "integrity": "sha512-HRkVv/5qY2G6I8iab9cI7v1bOIdhm94dVjQCPFElW9W+3GeDOSHmy2EBYe4VTApuzolPcmgFTN3ftVJRKR2J9Q==",
-      "requires": {
-        "media-typer": "0.3.0",
-        "mime-types": "~2.1.18"
-      }
-    },
     "unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
@@ -1004,16 +843,6 @@
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8="
     },
-    "utils-merge": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM="
-    },
-    "vary": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw="
-    },
     "ws": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-6.0.0.tgz",
diff --git a/package.json b/package.json
index cb08ef7..e8dcfaf 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,6 @@
   "homepage": "https://git.coolaj86.com/coolaj86/telebit.js#readme",
   "dependencies": {
     "@coolaj86/urequest": "^1.3.5",
-    "express": "^4.16.4",
     "finalhandler": "^1.1.1",
     "greenlock": "^2.3.1",
     "js-yaml": "^3.11.0",
-- 
2.38.5


From 21115b95435d61da2954509e5a434fa75b8202ed Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 28 Feb 2019 01:42:56 -0700
Subject: [PATCH 44/68] address npm's security audit warnings

---
 bin/telebit-remote.js   |   8 +-
 lib/admin/js/telebit.js |   4 +-
 lib/cli-common.js       |   4 +-
 lib/jwt-test.js         |  19 +++
 lib/jwt.js              |  43 ++++++
 package-lock.json       | 293 ++++++++++------------------------------
 package.json            |   3 +-
 7 files changed, 146 insertions(+), 228 deletions(-)
 create mode 100644 lib/jwt-test.js
 create mode 100644 lib/jwt.js

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 16e1a3b..99183c2 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -12,6 +12,7 @@ var path = require('path');
 var YAML = require('js-yaml');
 var TOML = require('toml');
 var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"), 'utf8'));
+var JWT = require('../lib/jwt.js');
 
 /*
 if ('function' !== typeof TOML.stringify) {
@@ -232,10 +233,9 @@ function askForConfig(state, mainCb) {
       //console.info("\tPrivate key (hex)");
       console.info("");
       rl.question('auth: ', function (resp) {
-        var jwt = require('jsonwebtoken');
         resp = (resp || '').trim();
         try {
-          jwt.decode(resp);
+          JWT.decode(resp);
           state.config.token = resp;
         } catch(e) {
           // is not jwt
@@ -604,8 +604,8 @@ function parseConfig(err, text) {
         }
         state._connecting = true;
         try {
-          require('jsonwebtoken').decode(token);
-          //console.log(require('jsonwebtoken').decode(token));
+          JWT.decode(token);
+          //console.log(JWT.decode(token));
         } catch(e) {
           console.warn("[warning] could not decode token");
         }
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index d0ab85c..7ab35c7 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -114,7 +114,7 @@ common.otp = function getOtp() {
   return Math.round(Math.random() * 9999).toString().padStart(4, '0');
 };
 common.signToken = function (state) {
-  var jwt = require('jsonwebtoken');
+  var JWT = require('./jwt.js');
   var tokenData = {
     domains: Object.keys(state.config.servernames || {}).filter(function (name) {
       return /\./.test(name);
@@ -127,7 +127,7 @@ common.signToken = function (state) {
   , iss: Math.round(Date.now() / 1000)
   };
 
-  return jwt.sign(tokenData, state.config.secret);
+  return JWT.sign(tokenData, state.config.secret);
 };
 common.promiseTimeout = function (ms) {
   var tok;
diff --git a/lib/cli-common.js b/lib/cli-common.js
index 9b04c18..e432a1b 100644
--- a/lib/cli-common.js
+++ b/lib/cli-common.js
@@ -118,7 +118,7 @@ common.otp = function getOtp() {
   return Math.round(Math.random() * 9999).toString().padStart(4, '0');
 };
 common.signToken = function (state) {
-  var jwt = require('jsonwebtoken');
+  var JWT = require('./jwt.js');
   var tokenData = {
     domains: Object.keys(state.config.servernames || {}).filter(function (name) {
       return /\./.test(name);
@@ -131,7 +131,7 @@ common.signToken = function (state) {
   , iss: Math.round(Date.now() / 1000)
   };
 
-  return jwt.sign(tokenData, state.config.secret);
+  return JWT.sign(tokenData, state.config.secret);
 };
 common.api = {};
 common.api.directory = function (state, next) {
diff --git a/lib/jwt-test.js b/lib/jwt-test.js
new file mode 100644
index 0000000..37f95a7
--- /dev/null
+++ b/lib/jwt-test.js
@@ -0,0 +1,19 @@
+'use strict';
+
+var crypto = require('crypto');
+var FAT = require('jsonwebtoken');
+var JWT = require('./jwt.js');
+
+var key = "justanothersecretsecret";
+var keyid = crypto.createHash('sha256').update(key).digest('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+
+var tok1 = FAT.sign({ foo: "hello" }, key, { keyid: keyid });
+var tok2 = JWT.sign({ foo: "hello" }, key);
+
+if (tok1 !== tok2) {
+  console.error(JWT.decode(tok1));
+  console.error(JWT.decode(tok2));
+  throw new Error("our jwt doesn't match auth0/jsonwebtoken");
+}
+
+console.info('Pass');
diff --git a/lib/jwt.js b/lib/jwt.js
new file mode 100644
index 0000000..c7d16fe
--- /dev/null
+++ b/lib/jwt.js
@@ -0,0 +1,43 @@
+'use strict';
+
+var crypto = require('crypto');
+var JWT = module.exports;
+
+JWT.decode = function (jwt) {
+  var parts;
+
+  try {
+    parts = jwt.split('.');
+    return {
+      header: JSON.parse(Buffer.from(parts[0], 'base64'))
+    , payload: JSON.parse(Buffer.from(parts[1], 'base64'))
+    , signature: parts[2] //Buffer.from(parts[2], 'base64')
+    };
+  } catch(e) {
+    throw new Error("JWT Parse Error: could not split, base64 decode, and JSON.parse token " + jwt);
+  }
+};
+
+JWT.verify = function (jwt) {
+  var decoded = JWT.decode(jwt);
+  throw new Error("not implemented yet");
+};
+
+function base64ToUrlSafe(str) {
+  return str
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '')
+  ;
+}
+
+JWT.sign = function (claims, key) {
+  if (!claims.iat && false !== claims.iat) {
+    claims.iat = Math.round(Date.now()/1000);
+  }
+  var thumb = base64ToUrlSafe(crypto.createHash('sha256').update(key).digest('base64'));
+  var protect = base64ToUrlSafe(Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT', kid: thumb })).toString('base64'));
+  var payload = base64ToUrlSafe(Buffer.from(JSON.stringify(claims)).toString('base64'));
+  var signature = base64ToUrlSafe(crypto.createHmac('sha256', key).update(protect + '.' + payload).digest('base64'));
+  return protect + '.' + payload + '.' + signature;
+};
diff --git a/package-lock.json b/package-lock.json
index 58e2c53..22a9787 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,28 +19,22 @@
       }
     },
     "acme": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/acme/-/acme-1.1.0.tgz",
-      "integrity": "sha512-l2UAkE7aEKdYZ2dSok/ONxKLWj4HrSSPwuGsQE42LM8m6NukRXPKSWXyusqR4m+LhvN76183VvA8IDOOnLjSlw==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/acme/-/acme-1.2.0.tgz",
+      "integrity": "sha512-lG9Wq0Ol2OLpVrusq5OQ+KCT06rXaGjbHcDhKtNO6Hr3J3swISaCYi0slwLpEA9DGV+QhDkAnZ6qsXAo86SM5Q==",
       "requires": {
-        "acme-v2": "^1.1.0",
-        "bluebird": "^3.5.1"
+        "acme-v2": "^1.3.1"
       }
     },
     "acme-v2": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/acme-v2/-/acme-v2-1.1.0.tgz",
-      "integrity": "sha512-yODrKcfaqDwRM/nVZdupww7s7y/D1q6QMe8nbYPifVEO7JYi653FaoPbUFRXFKTEzFhJ4HNXZMGUKmLYJQq/Ag==",
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/acme-v2/-/acme-v2-1.5.2.tgz",
+      "integrity": "sha512-Ux0cFCxHeaGGeGyPGMLHBLIGF05OYaxuh4TvaVzwkVVRib/gPpioa50CGj2pnQimH/MRkg0VtWCEdfE45MV/0g==",
       "requires": {
-        "@coolaj86/urequest": "^1.1.1",
-        "rsa-compat": "^1.3.0"
+        "@coolaj86/urequest": "^1.3.6",
+        "rsa-compat": "^1.9.2"
       }
     },
-    "any-promise": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
-      "integrity": "sha1-q8av7tzqUugJzcA3au0845Y10X8="
-    },
     "argparse": {
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
@@ -49,11 +43,6 @@
         "sprintf-js": "~1.0.2"
       }
     },
-    "asn1js": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-1.2.12.tgz",
-      "integrity": "sha1-h9XueXWWri0qPLAkciDcQv/D8hE="
-    },
     "async-limiter": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/async-limiter/-/async-limiter-1.0.0.tgz",
@@ -64,6 +53,15 @@
       "resolved": "https://registry.npmjs.org/batch/-/batch-0.6.1.tgz",
       "integrity": "sha1-3DQxT05nkxgJP8dgJyUl+UvyXBY="
     },
+    "bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "optional": true,
+      "requires": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
     "bluebird": {
       "version": "3.5.1",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.5.1.tgz",
@@ -83,11 +81,6 @@
       "resolved": "https://registry.npmjs.org/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz",
       "integrity": "sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg=="
     },
-    "buffer-equal-constant-time": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
-      "integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk="
-    },
     "buffer-fill": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz",
@@ -98,21 +91,10 @@
       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.0.tgz",
       "integrity": "sha512-c5mRlguI/Pe2dSZmpER62rSCu0ryKmWddzRYsuXc50U2/g8jMOulc31VZMa4mYx31U5xsmSOpDCgH88Vl9cDGQ=="
     },
-    "buffer-v6-polyfill": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/buffer-v6-polyfill/-/buffer-v6-polyfill-1.0.5.tgz",
-      "integrity": "sha1-0c2v61YAvvbCjWFElkJWvRLgFnc="
-    },
-    "certpem": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/certpem/-/certpem-1.0.1.tgz",
-      "integrity": "sha1-+koljEBXllxGVwCCL7jYB9fy2fU=",
-      "requires": {
-        "asn1js": "^1.2.12",
-        "buffer-v6-polyfill": "^1.0.3",
-        "node.extend": "^1.1.5",
-        "pkijs": "^1.3.27"
-      }
+    "cert-info": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/cert-info/-/cert-info-1.5.0.tgz",
+      "integrity": "sha512-3fE0DDJJ7FWwMsUqLqBd+FY5LQACK24R1p129BTCYMEe00Nql2Q9Dkr6TEBlZ8XJnNaSbjzf3qBLjLrD8KLutw=="
     },
     "core-util-is": {
       "version": "1.0.2",
@@ -158,14 +140,6 @@
       "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.0.4.tgz",
       "integrity": "sha1-l4hXRCxEdJ5CBmE+N5RiBYJqvYA="
     },
-    "ecdsa-sig-formatter": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.10.tgz",
-      "integrity": "sha1-HFlQAPBKiJffuFAAiSoPTDOvhsM=",
-      "requires": {
-        "safe-buffer": "^5.0.1"
-      }
-    },
     "ee-first": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -191,6 +165,12 @@
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc="
     },
+    "file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "optional": true
+    },
     "finalhandler": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.1.tgz",
@@ -219,16 +199,6 @@
         "readable-stream": "^2.0.0"
       }
     },
-    "fs-symlink": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/fs-symlink/-/fs-symlink-1.2.1.tgz",
-      "integrity": "sha1-G+uoPqncqBI2AOPwuaUbGGQLvEA=",
-      "requires": {
-        "mkdirp": "^0.5.0",
-        "mkdirp-then": "1",
-        "mz": "^2.0.0"
-      }
-    },
     "generate-function": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-1.1.0.tgz",
@@ -252,28 +222,19 @@
       }
     },
     "greenlock": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/greenlock/-/greenlock-2.3.2.tgz",
-      "integrity": "sha512-8jxb7gnKPMqUMBxa7ET3qTIALzEh30Na6TccIzaly62THZfiQtdPhVe9y26oaOEx5JGUMhc83FFo2hboeJz+ow==",
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/greenlock/-/greenlock-2.6.7.tgz",
+      "integrity": "sha512-cN8PU0tbpTyd0JiNhP78n6ZUYWhQs9fh4cuLjusKt0TjX0limP/u26wYGNK1cbgb9NsOeiox/wRhpGPh6EBocg==",
       "requires": {
-        "acme": "^1.0.6",
-        "acme-v2": "^1.0.6",
-        "asn1js": "^1.2.12",
-        "bluebird": "^3.5.1",
-        "certpem": "^1.0.0",
+        "acme": "^1.2.0",
+        "acme-v2": "^1.5.0",
+        "cert-info": "^1.5.0",
         "le-challenge-fs": "^2.0.2",
         "le-sni-auto": "^2.1.3",
-        "le-store-certbot": "^2.1.0",
-        "node.extend": "^1.1.5",
-        "pkijs": "^1.3.27",
-        "rsa-compat": "^1.4.0"
+        "le-store-certbot": "^2.1.7",
+        "rsa-compat": "^1.9.2"
       }
     },
-    "hoek": {
-      "version": "2.16.3",
-      "resolved": "https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz",
-      "integrity": "sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0="
-    },
     "http-errors": {
       "version": "1.6.3",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.3.tgz",
@@ -298,11 +259,6 @@
         "from2": "^2.1.1"
       }
     },
-    "is": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/is/-/is-3.2.1.tgz",
-      "integrity": "sha1-0Kwq1V63sL7JJqUmb2xmKqqD3KU="
-    },
     "is-property": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
@@ -313,22 +269,6 @@
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
       "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE="
     },
-    "isemail": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/isemail/-/isemail-1.2.0.tgz",
-      "integrity": "sha1-vgPfjMPineTSxd9lASY/H6RZXpo="
-    },
-    "joi": {
-      "version": "6.10.1",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-6.10.1.tgz",
-      "integrity": "sha1-TVDDGAeRIgAP5fFq8f+OGRe3fgY=",
-      "requires": {
-        "hoek": "2.x.x",
-        "isemail": "1.x.x",
-        "moment": "2.x.x",
-        "topo": "1.x.x"
-      }
-    },
     "js-yaml": {
       "version": "3.12.0",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz",
@@ -343,37 +283,6 @@
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
       "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
     },
-    "jsonwebtoken": {
-      "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.4.3.tgz",
-      "integrity": "sha1-d/UCHeBYtgWheD+hKD6ZgS5kVjg=",
-      "requires": {
-        "joi": "^6.10.1",
-        "jws": "^3.1.4",
-        "lodash.once": "^4.0.0",
-        "ms": "^2.0.0",
-        "xtend": "^4.0.1"
-      }
-    },
-    "jwa": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/jwa/-/jwa-1.1.6.tgz",
-      "integrity": "sha512-tBO/cf++BUsJkYql/kBbJroKOgHWEigTKBAjjBEmrMGYd1QMBC74Hr4Wo2zCZw6ZrVhlJPvoMrkcOnlWR/DJfw==",
-      "requires": {
-        "buffer-equal-constant-time": "1.0.1",
-        "ecdsa-sig-formatter": "1.0.10",
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "jws": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/jws/-/jws-3.1.5.tgz",
-      "integrity": "sha512-GsCSexFADNQUr8T5HPJvayTjvPIfoyJPtLQBwn5a4WZQchcrPMPMAWcC1AzJVRDKyD6ZPROPAxgv6rfHViO4uQ==",
-      "requires": {
-        "jwa": "^1.1.5",
-        "safe-buffer": "^5.0.1"
-      }
-    },
     "keypairs": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.0.1.tgz",
@@ -399,30 +308,23 @@
       }
     },
     "le-sni-auto": {
-      "version": "2.1.5",
-      "resolved": "https://registry.npmjs.org/le-sni-auto/-/le-sni-auto-2.1.5.tgz",
-      "integrity": "sha512-AUlFpYifutAAs0D0UwVVD5Jzf+X2J6+VNb03LCOFVAezQNpNcQFsWwrZzd+y24gF7jYHGBbD25q8gURQ5rhL8w==",
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/le-sni-auto/-/le-sni-auto-2.1.6.tgz",
+      "integrity": "sha512-LcfkF2yQ1nrep+ZfyG+SfR3pHphKFD3zMZ9FKervGfTfvgScCv/XGbX+vxsGZEKZjvzxKbFZ/5LdSCXuLXUU6A==",
       "requires": {
         "bluebird": "^3.5.1"
       }
     },
     "le-store-certbot": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/le-store-certbot/-/le-store-certbot-2.1.3.tgz",
-      "integrity": "sha512-bUzbk4SfOKURUyLam4R7kI+7zGsO7/w/9mjeSDK+fAFLebjz/XND5VDzHotFEEbaOcu0UldD1/Dx3VShYnOFnw==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/le-store-certbot/-/le-store-certbot-2.2.1.tgz",
+      "integrity": "sha512-BhljZjTULhbNBAT6RBiv4TeZegFraMxURYEvh3WRUI048zmXf4ZfC8gwbdu5fnD2tTCsS9fbsCOAQyrFBl4jlA==",
       "requires": {
-        "bluebird": "^3.5.1",
-        "fs-symlink": "^1.2.1",
         "mkdirp": "^0.5.1",
-        "pyconf": "^1.1.2",
-        "safe-replace": "^1.0.2"
+        "pyconf": "^1.1.5",
+        "safe-replace": "^1.0.3"
       }
     },
-    "lodash.once": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz",
-      "integrity": "sha1-DdOXEhPHxW34gJd9UEyI+0cal6w="
-    },
     "mime": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/mime/-/mime-1.4.1.tgz",
@@ -454,34 +356,16 @@
         "minimist": "0.0.8"
       }
     },
-    "mkdirp-then": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/mkdirp-then/-/mkdirp-then-1.2.0.tgz",
-      "integrity": "sha1-pJLIecpNhz9e5FAI+PVf0BUN48U=",
-      "requires": {
-        "any-promise": "^1.1.0",
-        "mkdirp": "^0.5.0"
-      }
-    },
-    "moment": {
-      "version": "2.22.2",
-      "resolved": "https://registry.npmjs.org/moment/-/moment-2.22.2.tgz",
-      "integrity": "sha1-PCV/mDn8DpP/UxSWMiOeuQeD/2Y="
-    },
     "ms": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
       "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g="
     },
-    "mz": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
-      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
-      "requires": {
-        "any-promise": "^1.0.0",
-        "object-assign": "^4.0.1",
-        "thenify-all": "^1.0.0"
-      }
+    "nan": {
+      "version": "2.12.1",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.12.1.tgz",
+      "integrity": "sha512-JY7V6lRkStKcKTvHO5NVSQRv+RV+FIL5pvDoLiAtSL9pKlC5x9PKQcZDsq7m4FO4d57mkhC6Z+QhAh3Jdk5JFw==",
+      "optional": true
     },
     "ndjson": {
       "version": "1.5.0",
@@ -516,13 +400,11 @@
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.1.tgz",
       "integrity": "sha1-KzJxhOiZIQEXeyhWP7XnECrNDKk="
     },
-    "node.extend": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/node.extend/-/node.extend-1.1.6.tgz",
-      "integrity": "sha1-p7iCyC1sk6SGOlUEvV3o7IYli5Y=",
-      "requires": {
-        "is": "^3.1.0"
-      }
+    "node-forge": {
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.7.6.tgz",
+      "integrity": "sha512-sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==",
+      "optional": true
     },
     "object-assign": {
       "version": "4.1.1",
@@ -560,11 +442,6 @@
         "pinkie": "^2.0.0"
       }
     },
-    "pkijs": {
-      "version": "1.3.33",
-      "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-1.3.33.tgz",
-      "integrity": "sha1-ponvYhE7fDSOH/wJll0iOeW7TJI="
-    },
     "process-nextick-args": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.0.tgz",
@@ -585,9 +462,9 @@
       }
     },
     "pyconf": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/pyconf/-/pyconf-1.1.5.tgz",
-      "integrity": "sha512-zXEg0oUJ4mY6azqVvRy6rePTIHZGhDQG3z9PVkE60uUabS9uILiIkHobU2Jzcs3tBltMBqyEATZZezRR/UFjkg==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/pyconf/-/pyconf-1.1.6.tgz",
+      "integrity": "sha512-4ujjwqch6nViWduSLc3/QFrDdJJAvAE7NRBarSGLANwh0tNW0MbXeJE8ZziJZvzRnUEN5scYwsS+ItYU1uj6dQ==",
       "requires": {
         "safe-replace": "^1.0.2"
       }
@@ -630,18 +507,12 @@
       }
     },
     "rsa-compat": {
-      "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/rsa-compat/-/rsa-compat-1.4.2.tgz",
-      "integrity": "sha512-Ic0WfTwdiZ8DlSRDe3frod/8XGCZufwnsH4ap+6Ldt+j9bCCxIyoJZwlCvAL2NDeEO7ax0p/H0FmypprDF6B6w==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/rsa-compat/-/rsa-compat-1.9.2.tgz",
+      "integrity": "sha512-XY4I/74W+QENMd99zVsyHQcxYxWTXd0EihVXsI4oeb1bz7DYxEKasQrjyzYPnR1tZT7fTPu5HP/vTKfs9lzdGA==",
       "requires": {
-        "node-forge": "^0.6.41"
-      },
-      "dependencies": {
-        "node-forge": {
-          "version": "0.6.49",
-          "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.6.49.tgz",
-          "integrity": "sha1-8e6V1ddGI5OP4Z1piqWibVTS9g8="
-        }
+        "node-forge": "^0.7.6",
+        "ursa-optional": "^0.9.10"
       }
     },
     "safe-buffer": {
@@ -650,9 +521,9 @@
       "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
     },
     "safe-replace": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.0.2.tgz",
-      "integrity": "sha1-sYGrQJWs32qwqPhAUXSRyoqZIro="
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.1.0.tgz",
+      "integrity": "sha512-9/V2E0CDsKs9DWOOwJH7jYpSl9S3N05uyevNjvsnDauBqRowBPOyot1fIvV5N2IuZAbYyvrTXrYFVG0RZInfFw=="
     },
     "sclient": {
       "version": "1.4.1",
@@ -795,22 +666,6 @@
         }
       }
     },
-    "thenify": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.0.tgz",
-      "integrity": "sha1-5p44obq+lpsBCCB5eLn2K4hgSDk=",
-      "requires": {
-        "any-promise": "^1.0.0"
-      }
-    },
-    "thenify-all": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
-      "integrity": "sha1-GhkY1ALY/D+Y+/I02wvMjMEOlyY=",
-      "requires": {
-        "thenify": ">= 3.1.0 < 4"
-      }
-    },
     "through2": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.3.tgz",
@@ -825,19 +680,21 @@
       "resolved": "https://registry.npmjs.org/toml/-/toml-0.4.1.tgz",
       "integrity": "sha1-Iv5QHFe+WpV9o4JcHd5YS7LmL3M="
     },
-    "topo": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/topo/-/topo-1.1.0.tgz",
-      "integrity": "sha1-6ddRYV0buH3IZdsYL6HKCl71NtU=",
-      "requires": {
-        "hoek": "2.x.x"
-      }
-    },
     "unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
       "integrity": "sha1-sr9O6FFKrmFltIF4KdIbLvSZBOw="
     },
+    "ursa-optional": {
+      "version": "0.9.10",
+      "resolved": "https://registry.npmjs.org/ursa-optional/-/ursa-optional-0.9.10.tgz",
+      "integrity": "sha512-RvEbhnxlggX4MXon7KQulTFiJQtLJZpSb9ZSa7ZTkOW0AzqiVTaLjI4vxaSzJBDH9dwZ3ltZadFiBaZslp6haA==",
+      "optional": true,
+      "requires": {
+        "bindings": "^1.3.0",
+        "nan": "^2.11.1"
+      }
+    },
     "util-deprecate": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
diff --git a/package.json b/package.json
index e8dcfaf..08692a6 100644
--- a/package.json
+++ b/package.json
@@ -55,9 +55,8 @@
   "dependencies": {
     "@coolaj86/urequest": "^1.3.5",
     "finalhandler": "^1.1.1",
-    "greenlock": "^2.3.1",
+    "greenlock": "^2.6.7",
     "js-yaml": "^3.11.0",
-    "jsonwebtoken": "^7.1.9",
     "keypairs": "^1.0.1",
     "mkdirp": "^0.5.1",
     "proxy-packer": "^2.0.2",
-- 
2.38.5


From 1c9396216ab3b483869c356984c60950a7bbd483 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 6 Mar 2019 23:18:26 -0700
Subject: [PATCH 45/68] generate and store private key for telebit-remote

---
 bin/telebit-remote.js    |  52 ++++-
 lib/keystore-fallback.js |  26 +++
 lib/keystore-test.js     |  22 ++
 lib/keystore.js          |  40 ++++
 package-lock.json        | 437 +++++++++++++++++++++++++++++++++++++--
 package.json             |   5 +-
 6 files changed, 564 insertions(+), 18 deletions(-)
 create mode 100644 lib/keystore-fallback.js
 create mode 100644 lib/keystore-test.js
 create mode 100644 lib/keystore.js

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 99183c2..66f9cdd 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -26,6 +26,9 @@ var camelCopy = recase.camelCopy.bind(recase);
 var urequest = require('@coolaj86/urequest');
 var common = require('../lib/cli-common.js');
 
+var defaultConfPath = path.join(os.homedir(), '.config/telebit');
+var defaultConfFile = path.join(defaultConfPath, 'telebit.yml');
+
 var argv = process.argv.slice(2);
 
 var argIndex = argv.indexOf('--config');
@@ -40,6 +43,30 @@ if (-1 === argIndex) {
 }
 if (-1 !== argIndex) {
   confpath = argv.splice(argIndex, 2)[1];
+  state.configArg = confpath;
+  // shortname
+  if (state.configArg) {
+    if (/^[\w:\.\-]+$/.test(state.configArg)) {
+      state.configDir = defaultConfPath;
+      state.configFile = path.join(defaultConfPath, confpath + '.yml');
+    } else if (/[\/\\]$/.test(state.configArg)) {
+      state.configDir = state.configArg;
+      state.configFile = path.join(state.configDir, 'telebit.yml');
+    } else if (/[\/\\][^\.\/\\]\.[^\.\/\\]$/.test(state.configArg)) {
+      state.configDir = path.pathname(state.configArg);
+      state.configFile = state.configArg;
+    } else {
+      console.error();
+      console.error("Not a valid config path, file, or shortname: '%s'", state.configArg);
+      console.error();
+      console.error("Valid config options look like this:");
+      console.error(" Full path: ~/.config/telebit/telebit.yml (full path)");
+      console.error(" Directory: ~/.config/telebit/            (directory)");
+      console.error(" Shortname: lucky-duck                    (shortname)");
+      process.exit(37);
+    }
+    confpath = state.configFile;
+  }
 }
 argIndex = argv.indexOf('--tty');
 if (-1 !== argIndex) {
@@ -58,7 +85,9 @@ function help() {
 
 var verstr = [ pkg.name + ' remote v' + pkg.version ];
 if (!confpath) {
-  confpath = path.join(os.homedir(), '.config/telebit/telebit.yml');
+  state.configDir = defaultConfPath;
+  state.configFile = defaultConfFile;
+  confpath = state.configFile;
   verstr.push('(--config \'' + confpath.replace(new RegExp('^' + os.homedir()), '~') + '\')');
 }
 
@@ -732,6 +761,25 @@ var parsers = {
   }
 };
 
-fs.readFile(confpath, 'utf8', parseConfig);
+var keystore = require('../lib/keystore.js').create(state);
+var keyname = 'telebit-remote';
+state.keystore = keystore;
+state.keystoreSecure = !keystore.insecure;
+keystore.get(keyname).then(function (jwk) {
+  if (jwk && jwk.kty) {
+    state.key = jwk;
+    fs.readFile(confpath, 'utf8', parseConfig);
+    return;
+  }
+
+  console.info('Generating Private Key...');
+  return require('keypairs').generate().then(function (jwk) {
+    return keystore.set(keyname, jwk).then(function () {
+      console.info("Generated New %s %s Private Key.", jwk.kty, (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8));
+      state.key = jwk;
+      fs.readFile(confpath, 'utf8', parseConfig);
+    });
+  });
+});
 
 }());
diff --git a/lib/keystore-fallback.js b/lib/keystore-fallback.js
new file mode 100644
index 0000000..782a3c4
--- /dev/null
+++ b/lib/keystore-fallback.js
@@ -0,0 +1,26 @@
+'use strict';
+
+var fs = require('fs').promises;
+var path = require('path');
+
+module.exports.create = function (opts) {
+  return {
+    getPassword: function (service, name) {
+      var f = path.join(opts.configDir, name + '.key');
+      return fs.readFile(f, 'utf8').catch(function (err) {
+        if ('ENOEXIST' === err.code) {
+          return;
+        }
+      });
+    }
+  , setPassword: function (service, name, key) {
+      var f = path.join(opts.configDir, name + '.key');
+      return fs.writeFile(f, key, 'utf8');
+    }
+  , deletePassword: function (service, name) {
+      var f = path.join(opts.configDir, name + '.key');
+      return fs.unlink(f);
+    }
+  , insecure: true
+  };
+};
diff --git a/lib/keystore-test.js b/lib/keystore-test.js
new file mode 100644
index 0000000..859203c
--- /dev/null
+++ b/lib/keystore-test.js
@@ -0,0 +1,22 @@
+'use strict';
+
+var keystore = require('./keystore.js').create({
+  configDir: require('path').join(require('os').homedir(), '.local/telebit/')
+});
+var name = "testy-mctestface-1";
+return keystore.get(name).then(function (jwk) {
+  console.log("get1", typeof jwk, jwk);
+  if (!jwk || !jwk.kty) {
+    return require('keypairs').generate().then(function (jwk) {
+      var json = JSON.stringify(jwk.private);
+      return keystore.set(name, json).then(function () {
+        return keystore.get(name).then(function (val2) {
+          console.log("get2", val2);
+        });
+      }).catch(function (err) {
+        console.log('badness', err);
+      });
+    });
+  }
+  return jwk;
+});
diff --git a/lib/keystore.js b/lib/keystore.js
new file mode 100644
index 0000000..69c6bbd
--- /dev/null
+++ b/lib/keystore.js
@@ -0,0 +1,40 @@
+'use strict';
+
+module.exports.create = function (opts) {
+  var service = "Telebit";
+  var keytar;
+  try {
+    keytar = require('keytar');
+  } catch(e) {
+    console.warn("Could not load native key management. Keys will be stored in plain text.");
+    keytar = require('./keystore-fallback.js').create(opts);
+    keytar.insecure = true;
+  }
+
+  return {
+    get: function (name) {
+      return keytar.getPassword(service, name).then(maybeParse);
+    }
+  , set: function (name, value) {
+      return keytar.setPassword(service, name, maybeStringify(value));
+    }
+  , delete: function (name) {
+      return keytar.deletePassword(service, name);
+    }
+  , insecure: keytar.insecure
+  };
+};
+
+function maybeParse(str) {
+  if (str && '{' === str[0]) {
+    return JSON.parse(str);
+  }
+  return str;
+}
+
+function maybeStringify(obj) {
+  if ('string' !== typeof obj && 'object' === typeof obj) {
+    return JSON.stringify(obj);
+  }
+  return obj;
+}
diff --git a/package-lock.json b/package-lock.json
index 22a9787..f8adae0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -35,6 +35,28 @@
         "rsa-compat": "^1.9.2"
       }
     },
+    "ansi-regex": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
+      "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
+      "optional": true
+    },
+    "aproba": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/aproba/-/aproba-1.2.0.tgz",
+      "integrity": "sha512-Y9J6ZjXtoYh8RnXVCMOU/ttDmk1aBjunq9vO0ta5x85WDQiQfUF9sIPBITdbiiIVcBo03Hi3jMxigBtsddlXRw==",
+      "optional": true
+    },
+    "are-we-there-yet": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-1.1.5.tgz",
+      "integrity": "sha512-5hYdAkZlcG8tOLujVDTgCT+uPX0VnpAH28gWsLfzpXYm7wP6mp5Q/gYyR7YQ0cKVJcXJnl3j2kpBan13PtQf6w==",
+      "optional": true,
+      "requires": {
+        "delegates": "^1.0.0",
+        "readable-stream": "^2.0.6"
+      }
+    },
     "argparse": {
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
@@ -62,6 +84,16 @@
         "file-uri-to-path": "1.0.0"
       }
     },
+    "bl": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-1.2.2.tgz",
+      "integrity": "sha512-e8tQYnZodmebYDWGH7KMRvtzKXaJHx3BbilrgZCfvyLUYdKpK1t5PSPmpkny/SgiTSCnjfLW7v5rlONXVFkQEA==",
+      "optional": true,
+      "requires": {
+        "readable-stream": "^2.3.5",
+        "safe-buffer": "^5.1.1"
+      }
+    },
     "bluebird": {
       "version": "3.5.1",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.5.1.tgz",
@@ -96,6 +128,24 @@
       "resolved": "https://registry.npmjs.org/cert-info/-/cert-info-1.5.0.tgz",
       "integrity": "sha512-3fE0DDJJ7FWwMsUqLqBd+FY5LQACK24R1p129BTCYMEe00Nql2Q9Dkr6TEBlZ8XJnNaSbjzf3qBLjLrD8KLutw=="
     },
+    "chownr": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.1.tgz",
+      "integrity": "sha512-j38EvO5+LHX84jlo6h4UzmOwi0UgW61WRyPtJz4qaadK5eY3BTS5TY/S1Stc3Uk2lIM6TPevAlULiEJwie860g==",
+      "optional": true
+    },
+    "code-point-at": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/code-point-at/-/code-point-at-1.1.0.tgz",
+      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c=",
+      "optional": true
+    },
+    "console-control-strings": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
+      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4=",
+      "optional": true
+    },
     "core-util-is": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
@@ -130,6 +180,27 @@
         "ms": "2.0.0"
       }
     },
+    "decompress-response": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-3.3.0.tgz",
+      "integrity": "sha1-gKTdMjdIOEv6JICDYirt7Jgq3/M=",
+      "optional": true,
+      "requires": {
+        "mimic-response": "^1.0.0"
+      }
+    },
+    "deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "optional": true
+    },
+    "delegates": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
+      "integrity": "sha1-hMbhWbgZBP3KWaDvRM2HDTElD5o=",
+      "optional": true
+    },
     "depd": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
@@ -140,6 +211,17 @@
       "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.0.4.tgz",
       "integrity": "sha1-l4hXRCxEdJ5CBmE+N5RiBYJqvYA="
     },
+    "detect-libc": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz",
+      "integrity": "sha1-+hN8S9aY7fVc1c0CrFWfkaTEups=",
+      "optional": true
+    },
+    "eckles": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/eckles/-/eckles-1.4.1.tgz",
+      "integrity": "sha512-auWyk/k8oSkVHaD4RxkPadKsLUcIwKgr/h8F7UZEueFDBO7BsE4y+H6IMUDbfqKIFPg/9MxV6KcBdJCmVVcxSA=="
+    },
     "ee-first": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -150,6 +232,15 @@
       "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
       "integrity": "sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k="
     },
+    "end-of-stream": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.1.tgz",
+      "integrity": "sha512-1MkrZNvWTKCaigbn+W15elq2BB/L22nqrSY5DKlo3X6+vclJm8Bb5djXJBmEX6fS3+zCh/F4VBK5Z2KxJt4s2Q==",
+      "optional": true,
+      "requires": {
+        "once": "^1.4.0"
+      }
+    },
     "escape-html": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
@@ -165,6 +256,12 @@
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc="
     },
+    "expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "optional": true
+    },
     "file-uri-to-path": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
@@ -199,6 +296,28 @@
         "readable-stream": "^2.0.0"
       }
     },
+    "fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "optional": true
+    },
+    "gauge": {
+      "version": "2.7.4",
+      "resolved": "https://registry.npmjs.org/gauge/-/gauge-2.7.4.tgz",
+      "integrity": "sha1-LANAXHU4w51+s3sxcCLjJfsBi/c=",
+      "optional": true,
+      "requires": {
+        "aproba": "^1.0.3",
+        "console-control-strings": "^1.0.0",
+        "has-unicode": "^2.0.0",
+        "object-assign": "^4.1.0",
+        "signal-exit": "^3.0.0",
+        "string-width": "^1.0.1",
+        "strip-ansi": "^3.0.1",
+        "wide-align": "^1.1.0"
+      }
+    },
     "generate-function": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-1.1.0.tgz",
@@ -221,6 +340,12 @@
         "pinkie-promise": "^2.0.0"
       }
     },
+    "github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha1-l/tdlr/eiXMxPyDoKI75oWf6ZM4=",
+      "optional": true
+    },
     "greenlock": {
       "version": "2.6.7",
       "resolved": "https://registry.npmjs.org/greenlock/-/greenlock-2.6.7.tgz",
@@ -235,6 +360,12 @@
         "rsa-compat": "^1.9.2"
       }
     },
+    "has-unicode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz",
+      "integrity": "sha1-4Ob+aijPUROIVeCG0Wkedx3iqLk=",
+      "optional": true
+    },
     "http-errors": {
       "version": "1.6.3",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.3.tgz",
@@ -251,6 +382,12 @@
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
       "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4="
     },
+    "ini": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.5.tgz",
+      "integrity": "sha512-RZY5huIKCMRWDUqZlEi72f/lmXKMvuszcMBduliQ3nnWbx9X/ZBQO7DijMEYS9EhHBb2qacRUMtC7svLwe0lcw==",
+      "optional": true
+    },
     "into-stream": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/into-stream/-/into-stream-2.0.1.tgz",
@@ -259,6 +396,15 @@
         "from2": "^2.1.1"
       }
     },
+    "is-fullwidth-code-point": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-1.0.0.tgz",
+      "integrity": "sha1-754xOG8DGn8NZDr4L95QxFfvAMs=",
+      "optional": true,
+      "requires": {
+        "number-is-nan": "^1.0.0"
+      }
+    },
     "is-property": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
@@ -284,19 +430,22 @@
       "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
     },
     "keypairs": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.0.1.tgz",
-      "integrity": "sha512-vwzW+HWfifpSbjGP+qg3P2IXNrTc4tuFRxiVmddwZbV6jYkbARJOnGMQhG36OeBxW5/Ec1iBKDFTyoxjn+dLLg==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.5.tgz",
+      "integrity": "sha512-VKUxQ4iQB5LvVMtObOzNmZRfgXLTr5GMr+wg9A2BnILArBLrtg/DIuWRJQpDNRRfAGRQjHXxSVOW+7xpzIAY1Q==",
       "requires": {
-        "eckles": "^1.4.0",
-        "rasha": "^1.2.1"
-      },
-      "dependencies": {
-        "eckles": {
-          "version": "1.4.0",
-          "resolved": "https://registry.npmjs.org/eckles/-/eckles-1.4.0.tgz",
-          "integrity": "sha512-Bm5dpwhsBuoCHvKCY3gAvP8XFyXH7im8uAu3szykpVNbFBdC+lOuV8vLC8fvTYRZBfFqB+k/P6ud/ZPVO2V2tA=="
-        }
+        "eckles": "^1.4.1",
+        "rasha": "^1.2.4"
+      }
+    },
+    "keytar": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/keytar/-/keytar-4.4.1.tgz",
+      "integrity": "sha512-6xEe7ybXSR5EZC+z0GI2yqLYZjV1tyPQY2xSZ8rGsBxrrLEh8VR/Lfqv59uGX+I+W+OZxH0jCXN1dU1++ify4g==",
+      "optional": true,
+      "requires": {
+        "nan": "2.12.1",
+        "prebuild-install": "5.2.4"
       }
     },
     "le-challenge-fs": {
@@ -343,6 +492,12 @@
         "mime-db": "~1.33.0"
       }
     },
+    "mimic-response": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-1.0.1.tgz",
+      "integrity": "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ==",
+      "optional": true
+    },
     "minimist": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz",
@@ -367,6 +522,12 @@
       "integrity": "sha512-JY7V6lRkStKcKTvHO5NVSQRv+RV+FIL5pvDoLiAtSL9pKlC5x9PKQcZDsq7m4FO4d57mkhC6Z+QhAh3Jdk5JFw==",
       "optional": true
     },
+    "napi-build-utils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-1.0.1.tgz",
+      "integrity": "sha512-boQj1WFgQH3v4clhu3mTNfP+vOBxorDlE8EKiMjUlLG3C4qAESnn9AxIOkFgTR2c9LtzNjPrjS60cT27ZKBhaA==",
+      "optional": true
+    },
     "ndjson": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/ndjson/-/ndjson-1.5.0.tgz",
@@ -400,12 +561,45 @@
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.1.tgz",
       "integrity": "sha1-KzJxhOiZIQEXeyhWP7XnECrNDKk="
     },
+    "node-abi": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-2.7.1.tgz",
+      "integrity": "sha512-OV8Bq1OrPh6z+Y4dqwo05HqrRL9YNF7QVMRfq1/pguwKLG+q9UB/Lk0x5qXjO23JjJg+/jqCHSTaG1P3tfKfuw==",
+      "optional": true,
+      "requires": {
+        "semver": "^5.4.1"
+      }
+    },
     "node-forge": {
       "version": "0.7.6",
       "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.7.6.tgz",
       "integrity": "sha512-sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==",
       "optional": true
     },
+    "noop-logger": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/noop-logger/-/noop-logger-0.1.1.tgz",
+      "integrity": "sha1-lKKxYzxPExdVMAfYlm/Q6EG2pMI=",
+      "optional": true
+    },
+    "npmlog": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-4.1.2.tgz",
+      "integrity": "sha512-2uUqazuKlTaSI/dC8AzicUck7+IrEaOnN/e0jd3Xtt1KcGpwx30v50mL7oPyr/h9bL3E4aZccVwpwP+5W9Vjkg==",
+      "optional": true,
+      "requires": {
+        "are-we-there-yet": "~1.1.2",
+        "console-control-strings": "~1.1.0",
+        "gauge": "~2.7.3",
+        "set-blocking": "~2.0.0"
+      }
+    },
+    "number-is-nan": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/number-is-nan/-/number-is-nan-1.0.1.tgz",
+      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0=",
+      "optional": true
+    },
     "object-assign": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
@@ -419,6 +613,21 @@
         "ee-first": "1.1.1"
       }
     },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "optional": true,
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "os-homedir": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/os-homedir/-/os-homedir-1.0.2.tgz",
+      "integrity": "sha1-/7xJiDNuDoM94MFox+8VISGqf7M=",
+      "optional": true
+    },
     "parseurl": {
       "version": "1.3.2",
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.2.tgz",
@@ -442,6 +651,38 @@
         "pinkie": "^2.0.0"
       }
     },
+    "prebuild-install": {
+      "version": "5.2.4",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-5.2.4.tgz",
+      "integrity": "sha512-CG3JnpTZXdmr92GW4zbcba4jkDha6uHraJ7hW4Fn8j0mExxwOKK20hqho8ZuBDCKYCHYIkFM1P2jhtG+KpP4fg==",
+      "optional": true,
+      "requires": {
+        "detect-libc": "^1.0.3",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.0",
+        "mkdirp": "^0.5.1",
+        "napi-build-utils": "^1.0.1",
+        "node-abi": "^2.7.0",
+        "noop-logger": "^0.1.1",
+        "npmlog": "^4.0.1",
+        "os-homedir": "^1.0.1",
+        "pump": "^2.0.1",
+        "rc": "^1.2.7",
+        "simple-get": "^2.7.0",
+        "tar-fs": "^1.13.0",
+        "tunnel-agent": "^0.6.0",
+        "which-pm-runs": "^1.0.0"
+      },
+      "dependencies": {
+        "minimist": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+          "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
+          "optional": true
+        }
+      }
+    },
     "process-nextick-args": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.0.tgz",
@@ -461,6 +702,16 @@
         "tasklist": "^3.1.0"
       }
     },
+    "pump": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-2.0.1.tgz",
+      "integrity": "sha512-ruPMNRkN3MHP1cWJc9OWr+T/xDP0jhXYCLfJcBuX54hhfIBnaQmAUMfDcG4DM5UMWByBbJY69QSphm3jtDKIkA==",
+      "optional": true,
+      "requires": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
     "pyconf": {
       "version": "1.1.6",
       "resolved": "https://registry.npmjs.org/pyconf/-/pyconf-1.1.6.tgz",
@@ -475,9 +726,29 @@
       "integrity": "sha1-9JvmtIeJTdxA3MlKMi9hEJLgDV4="
     },
     "rasha": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/rasha/-/rasha-1.2.1.tgz",
-      "integrity": "sha512-cs4Hu/rVF3/Qucq+V7lxSz449VfHNMVXJaeajAHno9H5FC1PWlmS4NM6IAX5jPKFF0IC2rOdHdf7iNxQuIWZag=="
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/rasha/-/rasha-1.2.4.tgz",
+      "integrity": "sha512-GsIwKv+hYSumJyK9wkTDaERLwvWaGYh1WuI7JMTBISfYt13TkKFU/HFzlY4n72p8VfXZRUYm0AqaYhkZVxOC3Q=="
+    },
+    "rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "optional": true,
+      "requires": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "dependencies": {
+        "minimist": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+          "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
+          "optional": true
+        }
+      }
     },
     "readable-stream": {
       "version": "2.3.6",
@@ -535,6 +806,12 @@
       "resolved": "https://registry.npmjs.org/sec/-/sec-1.0.0.tgz",
       "integrity": "sha1-Az1go60g7PLgCUDRT5eCNGV3QzU="
     },
+    "semver": {
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.6.0.tgz",
+      "integrity": "sha512-RS9R6R35NYgQn++fkDWaOmqGoj4Ek9gGs+DPxNUZKuwE183xjJroKvyo1IzVFeXvUrvmALy6FWD5xrdJT25gMg==",
+      "optional": true
+    },
     "send": {
       "version": "0.16.2",
       "resolved": "https://registry.npmjs.org/send/-/send-0.16.2.tgz",
@@ -605,11 +882,40 @@
         }
       }
     },
+    "set-blocking": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
+      "integrity": "sha1-BF+XgtARrppoA93TgrJDkrPYkPc=",
+      "optional": true
+    },
     "setprototypeof": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.0.tgz",
       "integrity": "sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ=="
     },
+    "signal-exit": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.2.tgz",
+      "integrity": "sha1-tf3AjxKH6hF4Yo5BXiUTK3NkbG0=",
+      "optional": true
+    },
+    "simple-concat": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.0.tgz",
+      "integrity": "sha1-c0TLuLbib7J9ZrL8hvn21Zl1IcY=",
+      "optional": true
+    },
+    "simple-get": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-2.8.1.tgz",
+      "integrity": "sha512-lSSHRSw3mQNUGPAYRqo7xy9dhKmxFXIjLjp4KHpf99GEH2VH7C3AM+Qfx6du6jhfUi6Vm7XnbEVEf7Wb6N8jRw==",
+      "optional": true,
+      "requires": {
+        "decompress-response": "^3.3.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
     "sni": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/sni/-/sni-1.0.0.tgz",
@@ -641,6 +947,17 @@
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.4.0.tgz",
       "integrity": "sha512-zhSCtt8v2NDrRlPQpCNtw/heZLtfUDqxBM1udqikb/Hbk52LK4nQSwr10u77iopCW5LsyHpuXS0GnEc48mLeew=="
     },
+    "string-width": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-1.0.2.tgz",
+      "integrity": "sha1-EYvfW4zcUaKn5w0hHgfisLmxB9M=",
+      "optional": true,
+      "requires": {
+        "code-point-at": "^1.0.0",
+        "is-fullwidth-code-point": "^1.0.0",
+        "strip-ansi": "^3.0.0"
+      }
+    },
     "string_decoder": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
@@ -649,6 +966,60 @@
         "safe-buffer": "~5.1.0"
       }
     },
+    "strip-ansi": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
+      "integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
+      "optional": true,
+      "requires": {
+        "ansi-regex": "^2.0.0"
+      }
+    },
+    "strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha1-PFMZQukIwml8DsNEhYwobHygpgo=",
+      "optional": true
+    },
+    "tar-fs": {
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-1.16.3.tgz",
+      "integrity": "sha512-NvCeXpYx7OsmOh8zIOP/ebG55zZmxLE0etfWRbWok+q2Qo8x/vOR/IJT1taADXPe+jsiu9axDb3X4B+iIgNlKw==",
+      "optional": true,
+      "requires": {
+        "chownr": "^1.0.1",
+        "mkdirp": "^0.5.1",
+        "pump": "^1.0.0",
+        "tar-stream": "^1.1.2"
+      },
+      "dependencies": {
+        "pump": {
+          "version": "1.0.3",
+          "resolved": "https://registry.npmjs.org/pump/-/pump-1.0.3.tgz",
+          "integrity": "sha512-8k0JupWme55+9tCVE+FS5ULT3K6AbgqrGa58lTT49RpyfwwcGedHqaC5LlQNdEAumn/wFsu6aPwkuPMioy8kqw==",
+          "optional": true,
+          "requires": {
+            "end-of-stream": "^1.1.0",
+            "once": "^1.3.1"
+          }
+        }
+      }
+    },
+    "tar-stream": {
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-1.6.2.tgz",
+      "integrity": "sha512-rzS0heiNf8Xn7/mpdSVVSMAWAoy9bfb1WOTYC78Z0UQKeKa/CWS8FOq0lKGNa8DWKAn9gxjCvMLYc5PGXYlK2A==",
+      "optional": true,
+      "requires": {
+        "bl": "^1.0.0",
+        "buffer-alloc": "^1.2.0",
+        "end-of-stream": "^1.0.0",
+        "fs-constants": "^1.0.0",
+        "readable-stream": "^2.3.0",
+        "to-buffer": "^1.1.1",
+        "xtend": "^4.0.0"
+      }
+    },
     "tasklist": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/tasklist/-/tasklist-3.1.0.tgz",
@@ -675,11 +1046,26 @@
         "xtend": "~4.0.1"
       }
     },
+    "to-buffer": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/to-buffer/-/to-buffer-1.1.1.tgz",
+      "integrity": "sha512-lx9B5iv7msuFYE3dytT+KE5tap+rNYw+K4jVkb9R/asAb+pbBSM17jtunHplhBe6RRJdZx3Pn2Jph24O32mOVg==",
+      "optional": true
+    },
     "toml": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/toml/-/toml-0.4.1.tgz",
       "integrity": "sha1-Iv5QHFe+WpV9o4JcHd5YS7LmL3M="
     },
+    "tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0=",
+      "optional": true,
+      "requires": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
     "unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
@@ -700,6 +1086,27 @@
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8="
     },
+    "which-pm-runs": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/which-pm-runs/-/which-pm-runs-1.0.0.tgz",
+      "integrity": "sha1-Zws6+8VS4LVd9rd4DKdGFfI60cs=",
+      "optional": true
+    },
+    "wide-align": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.3.tgz",
+      "integrity": "sha512-QGkOQc8XL6Bt5PwnsExKBPuMKBxnGxWWW3fU55Xt4feHozMUhdUMaBCk290qpm/wG5u/RSKzwdAC4i51YigihA==",
+      "optional": true,
+      "requires": {
+        "string-width": "^1.0.2 || 2"
+      }
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "optional": true
+    },
     "ws": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-6.0.0.tgz",
diff --git a/package.json b/package.json
index 08692a6..29df0ee 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,7 @@
     "finalhandler": "^1.1.1",
     "greenlock": "^2.6.7",
     "js-yaml": "^3.11.0",
-    "keypairs": "^1.0.1",
+    "keypairs": "^1.2.5",
     "mkdirp": "^0.5.1",
     "proxy-packer": "^2.0.2",
     "ps-list": "^5.0.0",
@@ -72,6 +72,9 @@
     "toml": "^0.4.1",
     "ws": "^6.0.0"
   },
+  "optionalDependencies": {
+    "keytar": "^4.4.1"
+  },
   "trulyOptionalDependencies": {
     "bluebird": "^3.5.1"
   },
-- 
2.38.5


From 1fda5b15d09b3165215ffe10a7f023eff2b95ce8 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 6 Mar 2019 23:28:28 -0700
Subject: [PATCH 46/68] bugfix key storage

---
 bin/telebit-remote.js | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 66f9cdd..29f25de 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -765,19 +765,23 @@ var keystore = require('../lib/keystore.js').create(state);
 var keyname = 'telebit-remote';
 state.keystore = keystore;
 state.keystoreSecure = !keystore.insecure;
-keystore.get(keyname).then(function (jwk) {
-  if (jwk && jwk.kty) {
-    state.key = jwk;
+keystore.get(keyname).then(function (key) {
+  if (key && key.kty) {
+    state.key = key;
     fs.readFile(confpath, 'utf8', parseConfig);
     return;
   }
 
-  console.info('Generating Private Key...');
-  return require('keypairs').generate().then(function (jwk) {
+  var keypairs = require('keypairs');
+  return keypairs.generate().then(function (pair) {
+    var jwk = pair.private;
     return keystore.set(keyname, jwk).then(function () {
-      console.info("Generated New %s %s Private Key.", jwk.kty, (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8));
-      state.key = jwk;
-      fs.readFile(confpath, 'utf8', parseConfig);
+      return keypairs.thumbprint({ jwk: pair.public }).then(function (kid) {
+        var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
+        console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
+        state.key = jwk;
+        fs.readFile(confpath, 'utf8', parseConfig);
+      });
     });
   });
 });
-- 
2.38.5


From 58dab177daf06144ce840005a71a15865175869b Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 7 Mar 2019 01:38:21 -0700
Subject: [PATCH 47/68] shims for jwt and jws authentication

---
 bin/telebit-remote.js |  10 +--
 bin/telebitd.js       | 149 ++++++++++++++++++++++++++++++++----------
 lib/eggspress.js      |   6 +-
 lib/rc/index.js       |  41 ++++++++++--
 package-lock.json     |   6 +-
 package.json          |   2 +-
 6 files changed, 163 insertions(+), 51 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 29f25de..5a4aab1 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -13,6 +13,7 @@ var YAML = require('js-yaml');
 var TOML = require('toml');
 var TPLS = TOML.parse(fs.readFileSync(path.join(__dirname, "../lib/en-us.toml"), 'utf8'));
 var JWT = require('../lib/jwt.js');
+var keypairs = require('keypairs');
 
 /*
 if ('function' !== typeof TOML.stringify) {
@@ -766,17 +767,18 @@ var keyname = 'telebit-remote';
 state.keystore = keystore;
 state.keystoreSecure = !keystore.insecure;
 keystore.get(keyname).then(function (key) {
-  if (key && key.kty) {
+  if (key && key.kty && key.kid) {
     state.key = key;
+    state.pub = keypairs.neuter({ jwk: key });
     fs.readFile(confpath, 'utf8', parseConfig);
     return;
   }
 
-  var keypairs = require('keypairs');
   return keypairs.generate().then(function (pair) {
     var jwk = pair.private;
-    return keystore.set(keyname, jwk).then(function () {
-      return keypairs.thumbprint({ jwk: pair.public }).then(function (kid) {
+    return keypairs.thumbprint({ jwk: pair.public }).then(function (kid) {
+      jwk.kid = kid;
+      return keystore.set(keyname, jwk).then(function () {
         var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
         console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
         state.key = jwk;
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 7d7c4c5..9f5e622 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -11,7 +11,7 @@ try {
 
 var pkg = require('../package.json');
 
-var url = require('url');
+//var url = require('url');
 var path = require('path');
 var os = require('os');
 var fs = require('fs');
@@ -374,46 +374,123 @@ controllers.relay = function (req, res) {
   });
 };
 
+function jsonEggspress(req, res, next) {
+  /*
+  var opts = url.parse(req.url, true);
+  if (false && opts.query._body) {
+    try {
+      req.body = JSON.parse(decodeURIComponent(opts.query._body, true));
+    } catch(e) {
+      res.statusCode = 500;
+      res.end('{"error":{"message":"?_body={{bad_format}}"}}');
+      return;
+    }
+  }
+  */
+
+  var hasLength = req.headers['content-length'] > 0;
+  if (!hasLength && !req.headers['content-type']) {
+    next();
+    return;
+  }
+
+  var body = '';
+  req.on('readable', function () {
+    var data;
+    while (true) {
+      data = req.read();
+      if (!data) { break; }
+      body += data.toString();
+    }
+  });
+  req.on('end', function () {
+    try {
+      req.body = JSON.parse(body);
+    } catch(e) {
+      res.statusCode = 400;
+      res.end('{"error":{"message":"POST body is not valid json"}}');
+      return;
+    }
+    next();
+  });
+}
+
+function decodeJwt(jwt) {
+  var parts = jwt.split('.');
+  var jws = {
+    protected: parts[0]
+  , payload: parts[0]
+  , signature: parts[2] //Buffer.from(parts[2], 'base64')
+  };
+  jws.header = JSON.parse(Buffer.from(jws.protected, 'base64'));
+  jws.claims = JSON.parse(Buffer.from(jws.payload, 'base64'));
+  return jws;
+}
+function jwtEggspress(req, res, next) {
+  var jwt = (req.headers.authorization||'').replace(/Bearer /i, '');
+  if (!jwt) { next(); return; }
+
+  try {
+    req.jwt = decodeJwt(jwt);
+  } catch(e) {
+    // ignore
+  }
+
+  // TODO verify if possible
+  next();
+}
+
+function verifyJws(jwk, jws) {
+  return require('keypairs').export({ jwk: jwk }).then(function (pem) {
+    var alg = 'RSA-SHA' + jws.header.alg.replace(/[^\d]+/i, '');
+    // XXX
+    // TODO check for public key in keytar
+    // XXX
+    return require('crypto')
+      .createVerify(alg)
+      .update(jws.protected + '.' + jws.payload)
+      .verify(pem, jws.signature, 'base64');
+  });
+}
+
+function jwsEggspress(req, res, next) {
+  // TODO check header application/jose+json ??
+  if (!req.body || !(req.body.protected && req.body.payload && req.body.signature)) {
+    next();
+    return;
+  }
+  req.jws = req.body;
+  req.jws.header = JSON.parse(Buffer.from(req.jws.protected, 'base64'));
+  req.body = Buffer.from(req.jws.payload, 'base64');
+  if ('{'.charCodeAt(0) === req.body[0] || '['.charCodeAt(0) === req.body[0]) {
+    req.body = JSON.parse(req.body);
+  }
+  if (req.jws.header.jwk) {
+    verifyJws(req.jws.header.jwk, req.jws).then(function (verified) {
+      req.jws.selfVerified = verified;
+      next();
+    });
+    return;
+  }
+
+  // TODO verify if possible
+  next();
+}
+
 function handleApi() {
   var app = eggspress();
 
+  app.use('/', jwtEggspress);
+  app.use('/', jsonEggspress);
+  app.use('/', jwsEggspress);
   app.use('/', function (req, res, next) {
-    var opts = url.parse(req.url, true);
-    if (false && opts.query._body) {
-      try {
-        req.body = JSON.parse(decodeURIComponent(opts.query._body, true));
-      } catch(e) {
-        res.statusCode = 500;
-        res.end('{"error":{"message":"?_body={{bad_format}}"}}');
-        return;
-      }
+    if (req.jwt) {
+      console.log('jwt', req.jwt);
+    } else if (req.jws) {
+      console.log('jws', req.jws);
+      console.log('body', req.body);
     }
-
-    var hasLength = req.headers['content-length'] > 0;
-    if (!hasLength && !req.headers['content-type']) {
-      next();
-      return;
-    }
-
-    var body = '';
-    req.on('readable', function () {
-      var data;
-      while (true) {
-        data = req.read();
-        if (!data) { break; }
-        body += data.toString();
-      }
-    });
-    req.on('end', function () {
-      try {
-        req.body = JSON.parse(body);
-      } catch(e) {
-        res.statusCode = 400;
-        res.end('{"error":{"message":"POST body is not valid json"}}');
-        return;
-      }
-      next();
-    });
+    next();
   });
 
   function listSuccess(req, res) {
diff --git a/lib/eggspress.js b/lib/eggspress.js
index 0979a29..1f76b63 100644
--- a/lib/eggspress.js
+++ b/lib/eggspress.js
@@ -5,7 +5,11 @@ module.exports = function eggspress() {
   var allPatterns = [];
   var app = function (req, res) {
     var patterns = allPatterns.slice(0).reverse();
-    function next() {
+    function next(err) {
+      if (err) {
+        req.end(err.message);
+        return;
+      }
       var todo = patterns.pop();
       if (!todo) {
         console.log('[eggspress] Did not match any patterns', req.url);
diff --git a/lib/rc/index.js b/lib/rc/index.js
index aa1f3d0..d418da0 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -3,9 +3,11 @@
 var os = require('os');
 var path = require('path');
 var http = require('http');
+var keypairs = require('keypairs');
 
 var common = require('../cli-common.js');
 
+/*
 function packConfig(config) {
   return Object.keys(config).map(function (key) {
     var val = config[key];
@@ -22,6 +24,7 @@ function packConfig(config) {
     return key + ':' + val; // converts arrays to strings with ,
   });
 }
+*/
 
 module.exports.create = function (state) {
   common._init(
@@ -72,16 +75,20 @@ module.exports.create = function (state) {
   RC.request = function request(opts, fn) {
     if (!opts) { opts = {}; }
     var service = opts.service || 'config';
+    /*
     var args = opts.data;
     if (args && 'control' === service) {
       args = packConfig(args);
     }
-    var json = JSON.stringify(args);
+    var json = JSON.stringify(opts.data);
+    */
     var url = '/rpc/' + service;
+    /*
     if (json) {
       url += ('?_body=' + encodeURIComponent(json));
     }
-    var method = opts.method || (args && 'POST') || 'GET';
+    */
+    var method = opts.method || (opts.data && 'POST') || 'GET';
     var reqOpts = {
       method: method
     , path: url
@@ -124,11 +131,33 @@ module.exports.create = function (state) {
 
       fn(err);
     });
-    if ('POST' === method && opts.data) {
-      req.setHeader("content-type", 'application/json');
-      req.write(json || opts.data);
+
+    // Simple GET
+    if ('POST' !== method || !opts.data) {
+      return keypairs.signJwt({
+        jwk: state.key
+      , claims: { iss: false, exp: Math.round(Date.now()/1000) + (15 * 60) }
+      //TODO , exp: '15m'
+      }).then(function (jwt) {
+        req.setHeader("authorization", 'bearer ' + jwt);
+        req.end();
+      });
     }
-    req.end();
+
+    return keypairs.signJws({
+      jwk: state.key
+    , protected: {
+        // alg will be filled out automatically
+        jwk: state.pub
+      , nonce: require('crypto').randomBytes(16).toString('hex') // TODO get from server
+      , url: 'https://' + reqOpts.host + reqOpts.path
+      }
+    , payload: JSON.stringify(opts.data)
+    }).then(function (jws) {
+      req.setHeader("content-type", 'application/json');
+      req.write(JSON.stringify(jws));
+      req.end();
+    });
   };
   return RC;
 };
diff --git a/package-lock.json b/package-lock.json
index f8adae0..628f60f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -430,9 +430,9 @@
       "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
     },
     "keypairs": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.5.tgz",
-      "integrity": "sha512-VKUxQ4iQB5LvVMtObOzNmZRfgXLTr5GMr+wg9A2BnILArBLrtg/DIuWRJQpDNRRfAGRQjHXxSVOW+7xpzIAY1Q==",
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.6.tgz",
+      "integrity": "sha512-sJDaZvJqHWUawJjrOGKJvKGLfPh0eo2WV7td4RSL88w3BjPYCYI9PkqBn0hLqc6uw0HFSqZMikhGn/jgPpcWnQ==",
       "requires": {
         "eckles": "^1.4.1",
         "rasha": "^1.2.4"
diff --git a/package.json b/package.json
index 29df0ee..155dae4 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,7 @@
     "finalhandler": "^1.1.1",
     "greenlock": "^2.6.7",
     "js-yaml": "^3.11.0",
-    "keypairs": "^1.2.5",
+    "keypairs": "^1.2.6",
     "mkdirp": "^0.5.1",
     "proxy-packer": "^2.0.2",
     "ps-list": "^5.0.0",
-- 
2.38.5


From 53cc3ccaba110796f0cb7cacbd1e12e5b7de6b56 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 9 Mar 2019 05:05:37 -0700
Subject: [PATCH 48/68] add basic key handling to server

---
 bin/telebit-remote.js    |  31 +++++++--
 bin/telebitd.js          | 134 +++++++++++++++++++++++++++++++--------
 lib/eggspress.js         |  15 +++--
 lib/keystore-fallback.js |  17 ++++-
 lib/keystore.js          |  11 +++-
 package-lock.json        |  36 +++++------
 package.json             |   3 +-
 7 files changed, 189 insertions(+), 58 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 5a4aab1..66b3c65 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -763,11 +763,31 @@ var parsers = {
 };
 
 var keystore = require('../lib/keystore.js').create(state);
-var keyname = 'telebit-remote';
 state.keystore = keystore;
 state.keystoreSecure = !keystore.insecure;
-keystore.get(keyname).then(function (key) {
-  if (key && key.kty && key.kid) {
+keystore.all().then(function (list) {
+  var keyext = '.key.jwk.json';
+  var key;
+  var convert;
+  // TODO create map by account and index into that map to get the master key
+  // and sort keys in the process
+  list.some(function (el) {
+    if (keyext === el.account.slice(-keyext.length)
+      && el.password.kty && el.password.kid) {
+      key = el.password;
+      return true;
+    }
+  });
+  if (!key) {
+    list.some(function (el) {
+      if (el.password.kty) {
+        convert = el.password;
+        return true;
+      }
+    });
+  }
+
+  if (key) {
     state.key = key;
     state.pub = keypairs.neuter({ jwk: key });
     fs.readFile(confpath, 'utf8', parseConfig);
@@ -776,9 +796,10 @@ keystore.get(keyname).then(function (key) {
 
   return keypairs.generate().then(function (pair) {
     var jwk = pair.private;
-    return keypairs.thumbprint({ jwk: pair.public }).then(function (kid) {
+    if (convert) { jwk = convert; }
+    return keypairs.thumbprint({ jwk: jwk }).then(function (kid) {
       jwk.kid = kid;
-      return keystore.set(keyname, jwk).then(function () {
+      return keystore.set(kid + keyext, jwk).then(function () {
         var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
         console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
         state.key = jwk;
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 9f5e622..baae480 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -73,14 +73,11 @@ if (!confpath || /^--/.test(confpath)) {
 }
 
 state._confpath = confpath;
-var tokenpath = path.join(path.dirname(state._confpath), 'access_token.txt');
-var token;
-try {
-  token = fs.readFileSync(tokenpath, 'ascii').trim();
-  //console.log('[DEBUG] access_token', typeof token, token);
-} catch(e) {
-  // ignore
-}
+var keystore = require('../lib/keystore.js').create({
+  name: "Telebit Daemon"
+, configDir: path.basename(confpath)
+});
+
 var controlServer;
 var myRemote;
 
@@ -442,14 +439,12 @@ function jwtEggspress(req, res, next) {
 
 function verifyJws(jwk, jws) {
   return require('keypairs').export({ jwk: jwk }).then(function (pem) {
-    var alg = 'RSA-SHA' + jws.header.alg.replace(/[^\d]+/i, '');
-    // XXX
-    // TODO check for public key in keytar
-    // XXX
+    var alg = 'SHA' + jws.header.alg.replace(/[^\d]+/i, '');
+    var sig = ecdsaAsn1SigToJwtSig(jws.header.alg, jws.signature);
     return require('crypto')
       .createVerify(alg)
       .update(jws.protected + '.' + jws.payload)
-      .verify(pem, jws.signature, 'base64');
+      .verify(pem, sig, 'base64');
   });
 }
 
@@ -465,16 +460,31 @@ function jwsEggspress(req, res, next) {
   if ('{'.charCodeAt(0) === req.body[0] || '['.charCodeAt(0) === req.body[0]) {
     req.body = JSON.parse(req.body);
   }
-  if (req.jws.header.jwk) {
-    verifyJws(req.jws.header.jwk, req.jws).then(function (verified) {
-      req.jws.selfVerified = verified;
-      next();
-    });
-    return;
+
+  var vjwk;
+  jwks.some(function (jwk) {
+    if (jwk.kid === req.jws.header.kid) {
+      vjwk = jwk;
+    }
+  });
+  if ((0 === jwks.length && req.jws.header.jwk)) {
+    vjwk = req.jws.header.jwk;
+    if (!vjwk.kid) { throw Error("Impossible: no key id"); }
   }
 
-  // TODO verify if possible
-  next();
+  return verifyJws(vjwk, req.jws).then(function (verified) {
+    if (true !== verified) {
+      return;
+    }
+    req.jws.verified = verified;
+
+    if (0 !== jwks.length) {
+      return;
+    }
+    return keystore.set(vjwk.kid + '.pub.jwk.json', vjwk);
+  }).then(function () {
+    next();
+  });
 }
 
 function handleApi() {
@@ -883,7 +893,9 @@ function serveControlsHelper() {
         // nada
       }
       setTimeout(function () {
-        console.log("trying again");
+        console.log("Could not start control server (%s), trying again...", err.code);
+        console.log(portFile);
+        console.log(serverOpts);
         serveControlsHelper();
       }, 1000);
       return;
@@ -1313,15 +1325,19 @@ state.handlers = {
       return;
     }
     state.token = opts.jwt || opts.access_token;
+    // TODO don't put token in config
     state.config.token = opts.jwt || opts.access_token;
-    console.info("Updating '" + tokenpath + "' with new token:");
+    console.info("Placing new token in keystore.");
     try {
-      fs.writeFileSync(tokenpath, opts.jwt);
       fs.writeFileSync(confpath, YAML.safeDump(snakeCopy(state.config)));
     } catch (e) {
       console.error("Token not saved:");
       console.error(e);
     }
+    return keystore.set("access_token.jwt", opts.jwt || opts.access_token).catch(function (e) {
+      console.error("Token not saved:");
+      console.error(e);
+    });
   }
 };
 
@@ -1358,6 +1374,72 @@ state.net = state.net || {
   }
 };
 
-fs.readFile(confpath, 'utf8', parseConfig);
-
+var token;
+var tokenname = "access_token.jwt";
+// backwards-compatibility shim
+try {
+  var tokenpath = path.join(path.dirname(state._confpath), 'access_token.txt');
+  token = fs.readFileSync(tokenpath, 'ascii').trim();
+  keystore.set(tokenname, token).then(onKeystore).catch(function (err) {
+    console.error('keystore failure:');
+    console.error(err);
+  });
+} catch(e) {
+  onKeystore();
+}
+var jwks = [];
+function onKeystore() {
+  return keystore.all().then(function (list) {
+    list.forEach(function (el) {
+      if (tokenname === el.account) {
+        token = el.password;
+        return;
+      }
+      // these are secret because just adding the
+      // willy-nilly to the fs can allow arbitrary tokens
+      if (/\.pub\.jwk\.json$/.test(el.account)) {
+        // pre-parsed
+        jwks.push(el.password);
+        return;
+      }
+    });
+    fs.readFile(confpath, 'utf8', parseConfig);
+  });
+}
 }());
+
+function ecdsaAsn1SigToJwtSig(alg, b64sig) {
+  // ECDSA JWT signatures differ from "normal" ECDSA signatures
+  // https://tools.ietf.org/html/rfc7518#section-3.4
+  if (!/^ES/i.test(alg)) { return b64sig; }
+
+  var bufsig = Buffer.from(b64sig, 'base64');
+  var hlen = bufsig.byteLength / 2; // should be even
+  var r = bufsig.slice(0, hlen);
+  var s = bufsig.slice(hlen);
+  // unpad positive ints less than 32 bytes wide
+  while (!r[0]) { r = r.slice(1); }
+  while (!s[0]) { s = s.slice(1); }
+  // pad (or re-pad) ambiguously non-negative BigInts to 33 bytes wide
+  if (0x80 & r[0]) { r = Buffer.concat([Buffer.from([0]), r]); }
+  if (0x80 & s[0]) { s = Buffer.concat([Buffer.from([0]), s]); }
+
+  var len = 2 + r.byteLength + 2 + s.byteLength;
+  var head = [0x30];
+  // hard code 0x80 + 1 because it won't be longer than
+  // two SHA512 plus two pad bytes (130 bytes <= 256)
+  if (len >= 0x80) { head.push(0x81); }
+  head.push(len);
+
+  var buf = Buffer.concat([
+    Buffer.from(head)
+  , Buffer.from([0x02, r.byteLength]), r
+  , Buffer.from([0x02, s.byteLength]), s
+  ]);
+
+  return buf.toString('base64')
+    .replace(/-/g, '+')
+    .replace(/_/g, '/')
+    .replace(/=/g, '')
+  ;
+}
diff --git a/lib/eggspress.js b/lib/eggspress.js
index 1f76b63..cc10f88 100644
--- a/lib/eggspress.js
+++ b/lib/eggspress.js
@@ -34,14 +34,21 @@ module.exports = function eggspress() {
         return;
       }
 
-      try {
-        //console.log("[eggspress] matched pattern", todo[0], req.url);
-        todo[1](req, res, next);
-      } catch(e) {
+      function fail(e) {
         console.error("[eggspress] error", todo[2], todo[0], req.url);
         console.error(e);
         // TODO make a nice error message
         res.end(e.message);
+      }
+
+      try {
+        console.log("[eggspress] matched pattern", todo[0], req.url);
+        var p = todo[1](req, res, next);
+        if (p && p.catch) {
+          p.catch(fail);
+        }
+      } catch(e) {
+        fail(e);
         return;
       }
     }
diff --git a/lib/keystore-fallback.js b/lib/keystore-fallback.js
index 782a3c4..f0a91e2 100644
--- a/lib/keystore-fallback.js
+++ b/lib/keystore-fallback.js
@@ -1,12 +1,14 @@
 'use strict';
+/*global Promise*/
 
 var fs = require('fs').promises;
 var path = require('path');
 
 module.exports.create = function (opts) {
+  var keyext = '.key';
   return {
     getPassword: function (service, name) {
-      var f = path.join(opts.configDir, name + '.key');
+      var f = path.join(opts.configDir, name + keyext);
       return fs.readFile(f, 'utf8').catch(function (err) {
         if ('ENOEXIST' === err.code) {
           return;
@@ -14,13 +16,22 @@ module.exports.create = function (opts) {
       });
     }
   , setPassword: function (service, name, key) {
-      var f = path.join(opts.configDir, name + '.key');
+      var f = path.join(opts.configDir, name + keyext);
       return fs.writeFile(f, key, 'utf8');
     }
   , deletePassword: function (service, name) {
-      var f = path.join(opts.configDir, name + '.key');
+      var f = path.join(opts.configDir, name + keyext);
       return fs.unlink(f);
     }
+  , findCredentials: function (/*service*/) {
+      return fs.readDir(opts.configDir).then(function (nodes) {
+        return Promise.all(nodes.filter(function (node) {
+          return keyext === node.slice(-4);
+        }).map(function (node) {
+          return fs.readFile(path.join(opts.configDir, node + keyext));
+        }));
+      });
+    }
   , insecure: true
   };
 };
diff --git a/lib/keystore.js b/lib/keystore.js
index 69c6bbd..876e151 100644
--- a/lib/keystore.js
+++ b/lib/keystore.js
@@ -1,10 +1,11 @@
 'use strict';
 
 module.exports.create = function (opts) {
-  var service = "Telebit";
+  var service = opts.name || "Telebit";
   var keytar;
   try {
     keytar = require('keytar');
+    // TODO test that long "passwords" (JWTs and JWKs) can be stored in all OSes
   } catch(e) {
     console.warn("Could not load native key management. Keys will be stored in plain text.");
     keytar = require('./keystore-fallback.js').create(opts);
@@ -21,6 +22,14 @@ module.exports.create = function (opts) {
   , delete: function (name) {
       return keytar.deletePassword(service, name);
     }
+  , all: function () {
+      return keytar.findCredentials(service).then(function (list) {
+        return list.map(function (el) {
+          el.password = maybeParse(el.password);
+          return el;
+        });
+      });
+    }
   , insecure: keytar.insecure
   };
 };
diff --git a/package-lock.json b/package-lock.json
index 628f60f..076c11c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -38,8 +38,7 @@
     "ansi-regex": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
-      "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
-      "optional": true
+      "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8="
     },
     "aproba": {
       "version": "1.2.0",
@@ -137,14 +136,12 @@
     "code-point-at": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/code-point-at/-/code-point-at-1.1.0.tgz",
-      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c=",
-      "optional": true
+      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c="
     },
     "console-control-strings": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
-      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4=",
-      "optional": true
+      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4="
     },
     "core-util-is": {
       "version": "1.0.2",
@@ -236,7 +233,6 @@
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.1.tgz",
       "integrity": "sha512-1MkrZNvWTKCaigbn+W15elq2BB/L22nqrSY5DKlo3X6+vclJm8Bb5djXJBmEX6fS3+zCh/F4VBK5Z2KxJt4s2Q==",
-      "optional": true,
       "requires": {
         "once": "^1.4.0"
       }
@@ -400,7 +396,6 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-1.0.0.tgz",
       "integrity": "sha1-754xOG8DGn8NZDr4L95QxFfvAMs=",
-      "optional": true,
       "requires": {
         "number-is-nan": "^1.0.0"
       }
@@ -429,10 +424,20 @@
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
       "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus="
     },
+    "keyfetch": {
+      "version": "1.1.8",
+      "resolved": "https://registry.npmjs.org/keyfetch/-/keyfetch-1.1.8.tgz",
+      "integrity": "sha512-a8E1E25mHiv2zZnrBM6WNfQi4hG43TgVg1JG/D61WiTBAM07OJzSuy3j00H2pWPF6MCofBmA+KTzSu145nZWuA==",
+      "requires": {
+        "@coolaj86/urequest": "^1.3.6",
+        "eckles": "^1.4.0",
+        "rasha": "^1.2.1"
+      }
+    },
     "keypairs": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.6.tgz",
-      "integrity": "sha512-sJDaZvJqHWUawJjrOGKJvKGLfPh0eo2WV7td4RSL88w3BjPYCYI9PkqBn0hLqc6uw0HFSqZMikhGn/jgPpcWnQ==",
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.12.tgz",
+      "integrity": "sha512-zYjYdDvo7G4AIkkZVM3WEJBTRUIrFzYswYNqCxcCPHUsgbBBdewSHAH1CiaQ+VA6Yb7BLEPIv8gFrRz5wJrgsw==",
       "requires": {
         "eckles": "^1.4.1",
         "rasha": "^1.2.4"
@@ -597,8 +602,7 @@
     "number-is-nan": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/number-is-nan/-/number-is-nan-1.0.1.tgz",
-      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0=",
-      "optional": true
+      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0="
     },
     "object-assign": {
       "version": "4.1.1",
@@ -617,7 +621,6 @@
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
-      "optional": true,
       "requires": {
         "wrappy": "1"
       }
@@ -951,7 +954,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/string-width/-/string-width-1.0.2.tgz",
       "integrity": "sha1-EYvfW4zcUaKn5w0hHgfisLmxB9M=",
-      "optional": true,
       "requires": {
         "code-point-at": "^1.0.0",
         "is-fullwidth-code-point": "^1.0.0",
@@ -970,7 +972,6 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
       "integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
-      "optional": true,
       "requires": {
         "ansi-regex": "^2.0.0"
       }
@@ -1104,8 +1105,7 @@
     "wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
-      "optional": true
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
     },
     "ws": {
       "version": "6.0.0",
diff --git a/package.json b/package.json
index 155dae4..354dd8c 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,8 @@
     "finalhandler": "^1.1.1",
     "greenlock": "^2.6.7",
     "js-yaml": "^3.11.0",
-    "keypairs": "^1.2.6",
+    "keyfetch": "^1.1.8",
+    "keypairs": "^1.2.12",
     "mkdirp": "^0.5.1",
     "proxy-packer": "^2.0.2",
     "ps-list": "^5.0.0",
-- 
2.38.5


From 16be216c991eaab3866a8fbb5d559cdfcae94cbe Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 10 Mar 2019 00:36:50 -0700
Subject: [PATCH 49/68] fix whitespace

---
 bin/telebitd.js | 448 ++++++++++++++++++++++++------------------------
 1 file changed, 224 insertions(+), 224 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index baae480..190c955 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -549,254 +549,254 @@ function handleApi() {
     });
   }
 
-    function initOrConfig(req, res) {
-      var conf = {};
-      if (!req.body) {
-        res.statusCode = 422;
-        res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
-        return;
-      }
+  function initOrConfig(req, res) {
+    var conf = {};
+    if (!req.body) {
+      res.statusCode = 422;
+      res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
+      return;
+    }
 
-      if (Array.isArray(req.body)) {
-        // relay, email, agree_tos, servernames, ports
-        //
-        req.body.forEach(function (opt) {
-          var parts = opt.split(/:/);
-          if ('true' === parts[1]) {
-            parts[1] = true;
-          } else if ('false' === parts[1]) {
-            parts[1] = false;
-          } else if ('null' === parts[1]) {
-            parts[1] = null;
-          } else if ('undefined' === parts[1]) {
-            parts[1] = undefined;
-          }
-          conf[parts[0]] = parts[1];
-        });
-      } else {
-        conf = req.body;
-      }
-
-      conf = camelCopy(conf);
-
-      // TODO deep merge
-      // greenlock config
-      if (!state.config.greenlock) { state.config.greenlock = {}; }
-      if (conf.greenlock) {
-        if ('undefined' !== typeof conf.greenlock.agree) {
-          state.config.greenlock.agree = conf.greenlock.agree;
+    if (Array.isArray(req.body)) {
+      // relay, email, agree_tos, servernames, ports
+      //
+      req.body.forEach(function (opt) {
+        var parts = opt.split(/:/);
+        if ('true' === parts[1]) {
+          parts[1] = true;
+        } else if ('false' === parts[1]) {
+          parts[1] = false;
+        } else if ('null' === parts[1]) {
+          parts[1] = null;
+        } else if ('undefined' === parts[1]) {
+          parts[1] = undefined;
         }
-        if (conf.greenlock.server) { state.config.greenlock.server = conf.greenlock.server; }
-        if (conf.greenlock.version) { state.config.greenlock.version = conf.greenlock.version; }
-      }
+        conf[parts[0]] = parts[1];
+      });
+    } else {
+      conf = req.body;
+    }
 
-      // main config
-      if (conf.email) { state.config.email = conf.email; }
-      if (conf.relay) { state.config.relay = conf.relay; }
-      if (conf.token) { state.config.token = conf.token; }
-      if (conf.secret) { state.config.secret = conf.secret; }
-      if ('undefined' !== typeof conf.agreeTos) {
-        state.config.agreeTos = conf.agreeTos;
-      }
+    conf = camelCopy(conf);
 
-      // to state
-      if (conf.pretoken) { state.pretoken = conf.pretoken; }
-      if (conf._otp) {
-        state.otp = conf._otp; // TODO should this only be done on the client side?
-        delete conf._otp;
+    // TODO deep merge
+    // greenlock config
+    if (!state.config.greenlock) { state.config.greenlock = {}; }
+    if (conf.greenlock) {
+      if ('undefined' !== typeof conf.greenlock.agree) {
+        state.config.greenlock.agree = conf.greenlock.agree;
       }
+      if (conf.greenlock.server) { state.config.greenlock.server = conf.greenlock.server; }
+      if (conf.greenlock.version) { state.config.greenlock.version = conf.greenlock.version; }
+    }
 
-      console.log();
-      console.log('conf.token', typeof conf.token, conf.token);
-      console.log('state.config.token', typeof state.config.token, state.config.token);
+    // main config
+    if (conf.email) { state.config.email = conf.email; }
+    if (conf.relay) { state.config.relay = conf.relay; }
+    if (conf.token) { state.config.token = conf.token; }
+    if (conf.secret) { state.config.secret = conf.secret; }
+    if ('undefined' !== typeof conf.agreeTos) {
+      state.config.agreeTos = conf.agreeTos;
+    }
 
-      if (state.secret) { console.log('state.secret'); state.token = common.signToken(state); }
-      if (!state.token) { console.log('!state.token'); state.token = conf._token; }
+    // to state
+    if (conf.pretoken) { state.pretoken = conf.pretoken; }
+    if (conf._otp) {
+      state.otp = conf._otp; // TODO should this only be done on the client side?
+      delete conf._otp;
+    }
 
-      console.log();
-      console.log('JSON.stringify(conf)');
-      console.log(JSON.stringify(conf));
-      console.log();
-      console.log('JSON.stringify(state)');
-      console.log(JSON.stringify(state));
-      console.log();
-      if ('undefined' !== typeof conf.newsletter) {
-        state.config.newsletter = conf.newsletter;
-      }
-      if ('undefined' !== typeof conf.communityMember
-        || 'undefined' !== typeof conf.community_member) {
-        state.config.communityMember = conf.communityMember || conf.community_member;
-      }
-      if ('undefined' !== typeof conf.telemetry) {
-        state.config.telemetry = conf.telemetry;
-      }
-      if (conf._servernames) {
-        (conf._servernames||'').split(/,/g).forEach(function (key) {
-          if (!state.config.servernames[key]) {
-            state.config.servernames[key] = { sub: undefined };
-          }
-        });
-      }
-      if (conf._ports) {
-        (conf._ports||'').split(/,/g).forEach(function (key) {
-          if (!state.config.ports[key]) {
-            state.config.ports[key] = {};
-          }
-        });
-      }
+    console.log();
+    console.log('conf.token', typeof conf.token, conf.token);
+    console.log('state.config.token', typeof state.config.token, state.config.token);
 
-      if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
-        console.warn('missing config');
-        res.statusCode = 400;
+    if (state.secret) { console.log('state.secret'); state.token = common.signToken(state); }
+    if (!state.token) { console.log('!state.token'); state.token = conf._token; }
 
+    console.log();
+    console.log('JSON.stringify(conf)');
+    console.log(JSON.stringify(conf));
+    console.log();
+    console.log('JSON.stringify(state)');
+    console.log(JSON.stringify(state));
+    console.log();
+    if ('undefined' !== typeof conf.newsletter) {
+      state.config.newsletter = conf.newsletter;
+    }
+    if ('undefined' !== typeof conf.communityMember
+      || 'undefined' !== typeof conf.community_member) {
+      state.config.communityMember = conf.communityMember || conf.community_member;
+    }
+    if ('undefined' !== typeof conf.telemetry) {
+      state.config.telemetry = conf.telemetry;
+    }
+    if (conf._servernames) {
+      (conf._servernames||'').split(/,/g).forEach(function (key) {
+        if (!state.config.servernames[key]) {
+          state.config.servernames[key] = { sub: undefined };
+        }
+      });
+    }
+    if (conf._ports) {
+      (conf._ports||'').split(/,/g).forEach(function (key) {
+        if (!state.config.ports[key]) {
+          state.config.ports[key] = {};
+        }
+      });
+    }
+
+    if (!state.config.relay || !state.config.email || !state.config.agreeTos) {
+      console.warn('missing config');
+      res.statusCode = 400;
+
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({
+        error: {
+          code: "E_INIT"
+        , message: "Missing important config file params"
+        , _params: JSON.stringify(conf)
+        , _config: JSON.stringify(state.config)
+        , _body: JSON.stringify(req.body)
+        }
+      }));
+      return;
+    }
+
+    // init also means enable
+    delete state.config.disable;
+    safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
+  }
+
+  function restart(req, res) {
+    console.info("[telebitd.js] server closing...");
+    state.keepAlive.state = false;
+    if (myRemote) {
+      myRemote.end();
+      myRemote.on('end', respondAndClose);
+      // failsafe
+      setTimeout(function () {
+        console.info("[telebitd.js] closing too slowly, force quit");
+        respondAndClose();
+      }, 5 * 1000);
+    } else {
+      respondAndClose();
+    }
+
+    function respondAndClose() {
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ success: true }));
+      controlServer.close(function () {
+        console.info("[telebitd.js] server closed");
+        setTimeout(function () {
+          // system daemon will restart the process
+          process.exit(22); // use non-success exit code
+        }, 100);
+      });
+    }
+  }
+
+  function mustHaveValidConfig(req, res, next) {
+    //
+    // Check for proper config
+    //
+    if (state.config.relay && state.config.email && state.config.agreeTos) {
+      next();
+      return;
+    }
+
+    res.statusCode = 400;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+      error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
+    }));
+  }
+
+  function saveAndCommit(req, res) {
+    state.config.servernames = state.servernames;
+    state.config.ports = state.ports;
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        res.statusCode = 500;
         res.setHeader('Content-Type', 'application/json');
         res.end(JSON.stringify({
-          error: {
-            code: "E_INIT"
-          , message: "Missing important config file params"
-          , _params: JSON.stringify(conf)
-          , _config: JSON.stringify(state.config)
-          , _body: JSON.stringify(req.body)
-          }
+          "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
         }));
         return;
       }
+      listSuccess();
+    });
+  }
 
-      // init also means enable
-      delete state.config.disable;
-      safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
-    }
+  function handleError(err, req, res) {
+    res.statusCode = 500;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+      error: { message: err.message, code: err.code }
+    }));
+  }
 
-    function restart(req, res) {
-      console.info("[telebitd.js] server closing...");
-      state.keepAlive.state = false;
-      if (myRemote) {
-        myRemote.end();
-        myRemote.on('end', respondAndClose);
-        // failsafe
-        setTimeout(function () {
-          console.info("[telebitd.js] closing too slowly, force quit");
-          respondAndClose();
-        }, 5 * 1000);
-      } else {
-        respondAndClose();
-      }
+  function enable(req, res) {
+    delete state.config.disable;// = undefined;
+    state.keepAlive.state = true;
 
-      function respondAndClose() {
-        res.setHeader('Content-Type', 'application/json');
-        res.end(JSON.stringify({ success: true }));
-        controlServer.close(function () {
-          console.info("[telebitd.js] server closed");
-          setTimeout(function () {
-            // system daemon will restart the process
-            process.exit(22); // use non-success exit code
-          }, 100);
-        });
-      }
-    }
-
-    function mustHaveValidConfig(req, res, next) {
-      //
-      // Check for proper config
-      //
-      if (state.config.relay && state.config.email && state.config.agreeTos) {
-        next();
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
+      if (err) {
+        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+        handleError(err, req, res);
         return;
       }
+      // TODO XXX myRemote.active
+      if (myRemote) {
+        listSuccess(req, res);
+        return;
+      }
+      safeStartTelebitRemote(true).then(listSuccess).catch(function () {
+        handleError(err, req, res);
+      });
+    });
+  }
 
-      res.statusCode = 400;
+  function disable(req, res) {
+    state.config.disable = true;
+    state.keepAlive.state = false;
+
+    if (myRemote) { myRemote.end(); myRemote = null; }
+    fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
       res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
-        error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
-      }));
-    }
+      if (err) {
+        err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
+        handleError(err);
+        return;
+      }
+      res.end('{"success":true}');
+    });
+  }
 
-    function saveAndCommit(req, res) {
-      state.config.servernames = state.servernames;
-      state.config.ports = state.ports;
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          res.statusCode = 500;
-          res.setHeader('Content-Type', 'application/json');
-          res.end(JSON.stringify({
-            "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
-          }));
-          return;
+  function getStatus(req, res) {
+    var now = Date.now();
+    res.setHeader('Content-Type', 'application/json');
+    require('../lib/ssh.js').checkSecurity().then(function (ssh) {
+      res.end(JSON.stringify(
+        { module: 'status'
+        , version: pkg.version
+        , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
+        , enabled: !state.config.disable
+        , active: !!myRemote
+        , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
+        , connected: isConnected
+        //, proctime: Math.round(process.uptime() * 1000)
+        , uptime: now - startTime
+        , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
+        , reconnects: connectTimes.length
+        , servernames: state.servernames
+        , ssh: state.config.sshAuto
+        , ssh_permit_root_login: ssh.permit_root_login
+        , ssh_password_authentication: ssh.password_authentication
+        , ssh_requests_password: ssh.requests_password
         }
-        listSuccess();
-      });
-    }
-
-    function handleError(err, req, res) {
-      res.statusCode = 500;
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
-        error: { message: err.message, code: err.code }
-      }));
-    }
-
-    function enable(req, res) {
-      delete state.config.disable;// = undefined;
-      state.keepAlive.state = true;
-
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        if (err) {
-          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-          handleError(err, req, res);
-          return;
-        }
-        // TODO XXX myRemote.active
-        if (myRemote) {
-          listSuccess(req, res);
-          return;
-        }
-        safeStartTelebitRemote(true).then(listSuccess).catch(function () {
-          handleError(err, req, res);
-        });
-      });
-    }
-
-    function disable(req, res) {
-      state.config.disable = true;
-      state.keepAlive.state = false;
-
-      if (myRemote) { myRemote.end(); myRemote = null; }
-      fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-        res.setHeader('Content-Type', 'application/json');
-        if (err) {
-          err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
-          handleError(err);
-          return;
-        }
-        res.end('{"success":true}');
-      });
-    }
-
-    function getStatus(req, res) {
-      var now = Date.now();
-      res.setHeader('Content-Type', 'application/json');
-      require('../lib/ssh.js').checkSecurity().then(function (ssh) {
-        res.end(JSON.stringify(
-          { module: 'status'
-          , version: pkg.version
-          , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
-          , enabled: !state.config.disable
-          , active: !!myRemote
-          , initialized: (state.config.relay && state.config.token && state.config.agreeTos) ? true : false
-          , connected: isConnected
-          //, proctime: Math.round(process.uptime() * 1000)
-          , uptime: now - startTime
-          , runtime: isConnected && connectTimes.length && (now - connectTimes[0]) || 0
-          , reconnects: connectTimes.length
-          , servernames: state.servernames
-          , ssh: state.config.sshAuto
-          , ssh_permit_root_login: ssh.permit_root_login
-          , ssh_password_authentication: ssh.password_authentication
-          , ssh_requests_password: ssh.requests_password
-          }
-        ));
-      });
-    }
+      ));
+    });
+  }
 
   // TODO turn strings into regexes to match beginnings
   app.use(/\b(relay)\b/, controllers.relay);
-- 
2.38.5


From 7a9cc7cb777ccce1d2600e26c0106b41228b00fc Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 10 Mar 2019 03:13:26 -0600
Subject: [PATCH 50/68] WIP: account creation api

---
 bin/telebit-remote.js |  10 ----
 bin/telebitd.js       | 115 ++++++++++++++++++++++++++++++++++++++----
 2 files changed, 104 insertions(+), 21 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 66b3c65..75a5993 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -768,7 +768,6 @@ state.keystoreSecure = !keystore.insecure;
 keystore.all().then(function (list) {
   var keyext = '.key.jwk.json';
   var key;
-  var convert;
   // TODO create map by account and index into that map to get the master key
   // and sort keys in the process
   list.some(function (el) {
@@ -778,14 +777,6 @@ keystore.all().then(function (list) {
       return true;
     }
   });
-  if (!key) {
-    list.some(function (el) {
-      if (el.password.kty) {
-        convert = el.password;
-        return true;
-      }
-    });
-  }
 
   if (key) {
     state.key = key;
@@ -796,7 +787,6 @@ keystore.all().then(function (list) {
 
   return keypairs.generate().then(function (pair) {
     var jwk = pair.private;
-    if (convert) { jwk = convert; }
     return keypairs.thumbprint({ jwk: jwk }).then(function (kid) {
       jwk.kid = kid;
       return keystore.set(kid + keyext, jwk).then(function () {
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 190c955..d17a9ba 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -11,6 +11,7 @@ try {
 
 var pkg = require('../package.json');
 
+var crypto = require('crypto');
 //var url = require('url');
 var path = require('path');
 var os = require('os');
@@ -29,6 +30,7 @@ var startTime = Date.now();
 var connectTimes = [];
 var isConnected = false;
 var eggspress = require('../lib/eggspress.js');
+var keypairs = require('keypairs');
 
 var TelebitRemote = require('../lib/daemon/index.js').TelebitRemote;
 
@@ -370,6 +372,50 @@ controllers.relay = function (req, res) {
     res.end(JSON.stringify(resp));
   });
 };
+controllers._nonces = {};
+controllers._requireNonce = function (req, res, next) {
+	var nonce = req.jws && req.jws.protected && req.jws.protected.nonce;
+	var active = (Date.now() - controllers._nonces[nonce]) < (4 * 60 * 60 * 1000);
+	if (!active) {
+		// TODO proper headers and error message
+		res.end({ "error": "invalid or expired nonce", "error_code": "ENONCE" });
+		return;
+	}
+	delete controllers._nonces[nonce];
+	controllers._issueNonce(req, res);
+	next();
+};
+controllers._issueNonce = function (req, res) {
+  var nonce = toUrlSafe(crypto.randomBytes(16).toString('base64'));
+  // TODO associate with a TLS session
+  controllers._nonces[nonce] = Date.now();
+  res.headers.set("Replay-Nonce", nonce);
+	return nonce;
+};
+controllers.newNonce = function (req, res) {
+  res.statusCode = 200;
+	res.headers.set("Cache-Control", "max-age=0, no-cache, no-store");
+	// TODO
+	//res.headers.set("Date", "Sun, 10 Mar 2019 08:04:45 GMT");
+	// is this the expiration of the nonce itself? methinks maybe so
+	//res.headers.set("Expires", "Sun, 10 Mar 2019 08:04:45 GMT");
+	// TODO use one of the registered domains
+	//var indexUrl = "https://acme-staging-v02.api.letsencrypt.org/index"
+  var port = (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined);
+	var indexUrl = "http://localhost:" + port + "/index";
+	res.headers.set("Link", "Link: <" + indexUrl + ">;rel=\"index\"");
+	res.headers.set("Pragma", "no-cache");
+  //res.headers.set("Strict-Transport-Security", "max-age=604800");
+  res.headers.set("X-Frame-Options", "DENY");
+
+  res.end("");
+};
+controllers.newAccount = function (req, res) {
+	controllers._requireNonce(req, res, function () {
+		res.statusCode = 500;
+		res.end("not implemented yet");
+	});
+};
 
 function jsonEggspress(req, res, next) {
   /*
@@ -438,7 +484,7 @@ function jwtEggspress(req, res, next) {
 }
 
 function verifyJws(jwk, jws) {
-  return require('keypairs').export({ jwk: jwk }).then(function (pem) {
+  return keypairs.export({ jwk: jwk }).then(function (pem) {
     var alg = 'SHA' + jws.header.alg.replace(/[^\d]+/i, '');
     var sig = ecdsaAsn1SigToJwtSig(jws.header.alg, jws.signature);
     return require('crypto')
@@ -799,6 +845,16 @@ function handleApi() {
   }
 
   // TODO turn strings into regexes to match beginnings
+	app.use('/acme', function acmeCors(req, res, next) {
+		// Taken from New-Nonce
+		res.headers.set("Access-Control-Allow-Headers", "Content-Type");
+		res.headers.set("Access-Control-Allow-Origin", "*");
+		res.headers.set("Access-Control-Expose-Headers", "Link, Replay-Nonce, Location");
+		res.headers.set("Access-Control-Max-Age", "86400");
+		next();
+	});
+  app.use('/acme/new-nonce', controllers.newNonce);
+  app.use('/acme/new-acct', controllers.newAccount);
   app.use(/\b(relay)\b/, controllers.relay);
   app.get(/\b(config)\b/, getConfigOnly);
   app.use(/\b(init|config)\b/, initOrConfig);
@@ -1374,36 +1430,69 @@ state.net = state.net || {
   }
 };
 
+var jwks = [];
 var token;
 var tokenname = "access_token.jwt";
-// backwards-compatibility shim
 try {
+  // backwards-compatibility shim
   var tokenpath = path.join(path.dirname(state._confpath), 'access_token.txt');
   token = fs.readFileSync(tokenpath, 'ascii').trim();
   keystore.set(tokenname, token).then(onKeystore).catch(function (err) {
     console.error('keystore failure:');
     console.error(err);
   });
-} catch(e) {
-  onKeystore();
-}
-var jwks = [];
+} catch(e) { onKeystore(); }
 function onKeystore() {
   return keystore.all().then(function (list) {
+    var keyext = '.key.jwk.json';
+    var pubext = '.pub.jwk.json';
+    var key;
     list.forEach(function (el) {
+      // find key
+      if (keyext === el.account.slice(-keyext.length)
+        && el.password.kty && el.password.kid) {
+        key = el.password;
+        return;
+      }
+
+      // find token
       if (tokenname === el.account) {
         token = el.password;
         return;
       }
-      // these are secret because just adding the
-      // willy-nilly to the fs can allow arbitrary tokens
-      if (/\.pub\.jwk\.json$/.test(el.account)) {
+
+      // find trusted public keys
+      // (if we sign these we could probably just store them to the fs,
+      // but we do want some way to know that they weren't just willy-nilly
+      // added to the fs my any old program)
+      if (pubext === el.account.slice(-pubext.length)) {
         // pre-parsed
         jwks.push(el.password);
         return;
       }
+
+      console.log("unrecognized password: %s", el.account);
+    });
+
+    if (key) {
+      state.key = key;
+      state.pub = keypairs.neuter({ jwk: key });
+      fs.readFile(confpath, 'utf8', parseConfig);
+      return;
+    }
+
+    return keypairs.generate().then(function (pair) {
+      var jwk = pair.private;
+      return keypairs.thumbprint({ jwk: jwk }).then(function (kid) {
+        jwk.kid = kid;
+        return keystore.set(kid + keyext, jwk).then(function () {
+          var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
+          console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
+          state.key = jwk;
+          fs.readFile(confpath, 'utf8', parseConfig);
+        });
+      });
     });
-    fs.readFile(confpath, 'utf8', parseConfig);
   });
 }
 }());
@@ -1437,7 +1526,11 @@ function ecdsaAsn1SigToJwtSig(alg, b64sig) {
   , Buffer.from([0x02, s.byteLength]), s
   ]);
 
-  return buf.toString('base64')
+  return toUrlSafe(buf.toString('base64'));
+}
+
+function toUrlSafe(b64) {
+  return b64
     .replace(/-/g, '+')
     .replace(/_/g, '/')
     .replace(/=/g, '')
-- 
2.38.5


From ae452367c00aafdbc6205755f7616a298c21b7b4 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 20 Mar 2019 20:48:01 -0600
Subject: [PATCH 51/68] whitespace

---
 bin/telebitd.js | 66 ++++++++++++++++++++++++-------------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index d17a9ba..1d73f90 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -374,47 +374,47 @@ controllers.relay = function (req, res) {
 };
 controllers._nonces = {};
 controllers._requireNonce = function (req, res, next) {
-	var nonce = req.jws && req.jws.protected && req.jws.protected.nonce;
-	var active = (Date.now() - controllers._nonces[nonce]) < (4 * 60 * 60 * 1000);
-	if (!active) {
-		// TODO proper headers and error message
-		res.end({ "error": "invalid or expired nonce", "error_code": "ENONCE" });
-		return;
-	}
-	delete controllers._nonces[nonce];
-	controllers._issueNonce(req, res);
-	next();
+  var nonce = req.jws && req.jws.protected && req.jws.protected.nonce;
+  var active = (Date.now() - controllers._nonces[nonce]) < (4 * 60 * 60 * 1000);
+  if (!active) {
+    // TODO proper headers and error message
+    res.end({ "error": "invalid or expired nonce", "error_code": "ENONCE" });
+    return;
+  }
+  delete controllers._nonces[nonce];
+  controllers._issueNonce(req, res);
+  next();
 };
 controllers._issueNonce = function (req, res) {
   var nonce = toUrlSafe(crypto.randomBytes(16).toString('base64'));
   // TODO associate with a TLS session
   controllers._nonces[nonce] = Date.now();
   res.headers.set("Replay-Nonce", nonce);
-	return nonce;
+  return nonce;
 };
 controllers.newNonce = function (req, res) {
   res.statusCode = 200;
-	res.headers.set("Cache-Control", "max-age=0, no-cache, no-store");
-	// TODO
-	//res.headers.set("Date", "Sun, 10 Mar 2019 08:04:45 GMT");
-	// is this the expiration of the nonce itself? methinks maybe so
-	//res.headers.set("Expires", "Sun, 10 Mar 2019 08:04:45 GMT");
-	// TODO use one of the registered domains
-	//var indexUrl = "https://acme-staging-v02.api.letsencrypt.org/index"
+  res.headers.set("Cache-Control", "max-age=0, no-cache, no-store");
+  // TODO
+  //res.headers.set("Date", "Sun, 10 Mar 2019 08:04:45 GMT");
+  // is this the expiration of the nonce itself? methinks maybe so
+  //res.headers.set("Expires", "Sun, 10 Mar 2019 08:04:45 GMT");
+  // TODO use one of the registered domains
+  //var indexUrl = "https://acme-staging-v02.api.letsencrypt.org/index"
   var port = (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined);
-	var indexUrl = "http://localhost:" + port + "/index";
-	res.headers.set("Link", "Link: <" + indexUrl + ">;rel=\"index\"");
-	res.headers.set("Pragma", "no-cache");
+  var indexUrl = "http://localhost:" + port + "/index";
+  res.headers.set("Link", "Link: <" + indexUrl + ">;rel=\"index\"");
+  res.headers.set("Pragma", "no-cache");
   //res.headers.set("Strict-Transport-Security", "max-age=604800");
   res.headers.set("X-Frame-Options", "DENY");
 
   res.end("");
 };
 controllers.newAccount = function (req, res) {
-	controllers._requireNonce(req, res, function () {
-		res.statusCode = 500;
-		res.end("not implemented yet");
-	});
+  controllers._requireNonce(req, res, function () {
+    res.statusCode = 500;
+    res.end("not implemented yet");
+  });
 };
 
 function jsonEggspress(req, res, next) {
@@ -845,14 +845,14 @@ function handleApi() {
   }
 
   // TODO turn strings into regexes to match beginnings
-	app.use('/acme', function acmeCors(req, res, next) {
-		// Taken from New-Nonce
-		res.headers.set("Access-Control-Allow-Headers", "Content-Type");
-		res.headers.set("Access-Control-Allow-Origin", "*");
-		res.headers.set("Access-Control-Expose-Headers", "Link, Replay-Nonce, Location");
-		res.headers.set("Access-Control-Max-Age", "86400");
-		next();
-	});
+  app.use('/acme', function acmeCors(req, res, next) {
+    // Taken from New-Nonce
+    res.headers.set("Access-Control-Allow-Headers", "Content-Type");
+    res.headers.set("Access-Control-Allow-Origin", "*");
+    res.headers.set("Access-Control-Expose-Headers", "Link, Replay-Nonce, Location");
+    res.headers.set("Access-Control-Max-Age", "86400");
+    next();
+  });
   app.use('/acme/new-nonce', controllers.newNonce);
   app.use('/acme/new-acct', controllers.newAccount);
   app.use(/\b(relay)\b/, controllers.relay);
-- 
2.38.5


From a5c448902ed0b9c81f034da73b1e0e4897fdc579 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Wed, 20 Mar 2019 23:27:25 -0600
Subject: [PATCH 52/68] cleanup

---
 bin/telebitd.js  | 107 +++++++++++++++++++----------------------------
 lib/eggspress.js |  12 ++++++
 lib/rc/index.js  |   2 +-
 3 files changed, 57 insertions(+), 64 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 1d73f90..03874a6 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -31,6 +31,8 @@ var connectTimes = [];
 var isConnected = false;
 var eggspress = require('../lib/eggspress.js');
 var keypairs = require('keypairs');
+var KEYEXT = '.key.jwk.json';
+var PUBEXT = '.pub.jwk.json';
 
 var TelebitRemote = require('../lib/daemon/index.js').TelebitRemote;
 
@@ -140,8 +142,7 @@ controllers.http = function (req, res) {
 
   if (!req.body) {
     res.statusCode = 422;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"module \'http\' needs some arguments"}}));
+    res.send({"error":{"message":"module \'http\' needs some arguments"}});
     return;
   }
 
@@ -153,8 +154,7 @@ controllers.http = function (req, res) {
 
   if (!portOrPath) {
     res.statusCode = 422;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({ error: { message: "module 'http' needs port or path" } }));
+    res.send({ error: { message: "module 'http' needs port or path" } });
     return;
   }
 
@@ -249,22 +249,20 @@ controllers.http = function (req, res) {
   }
   state.config.servernames = state.servernames;
   saveConfig(function (err) {
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({
+    res.send({
       success: true
     , active: active
     , remote: remoteHost
     , local: portOrPath
     , saved: !err
     , module: 'http'
-    }));
+    });
   });
 };
 controllers.tcp = function (req, res) {
   if (!req.body) {
     res.statusCode = 422;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({ error: { message: "module 'tcp' needs more arguments" } }));
+    res.send({ error: { message: "module 'tcp' needs more arguments" } });
     return;
   }
 
@@ -298,22 +296,20 @@ controllers.tcp = function (req, res) {
   }
   state.config.ports = state.ports;
   saveConfig(function (err) {
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({
+    res.send({
       success: true
     , active: active
     , remote: remotePort
     , local: portOrPath
     , saved: !err
     , module: 'tcp'
-    }));
+    });
   });
 };
 controllers.ssh = function (req, res) {
   if (!req.body) {
     res.statusCode = 422;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"module 'ssh' needs more arguments"}}));
+    res.send({"error":{"message":"module 'ssh' needs more arguments"}});
     return;
   }
 
@@ -324,15 +320,14 @@ controllers.ssh = function (req, res) {
       if (false !== local && !local) {
         local = 22;
       }
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
+      res.send({
         success: true
       , active: true
       , remote: Object.keys(state.config.ports)[0]
       , local: local
       , saved: !err
       , module: 'ssh'
-      }));
+      });
     });
   }
 
@@ -351,8 +346,7 @@ controllers.ssh = function (req, res) {
   sshAuto = parseInt(sshAuto, 10);
   if (!sshAuto || sshAuto <= 0 || sshAuto > 65535) {
     res.statusCode = 400;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({ error: { message: "bad ssh_auto option '" + rawSshAuto + "'" } }));
+    res.send({ error: { message: "bad ssh_auto option '" + rawSshAuto + "'" } });
     return;
   }
   state.config.sshAuto = sshAuto;
@@ -361,15 +355,13 @@ controllers.ssh = function (req, res) {
 controllers.relay = function (req, res) {
   if (!req.body) {
     res.statusCode = 422;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"module \'relay\' needs more arguments"}}));
+    res.send({"error":{"message":"module \'relay\' needs more arguments"}});
     return;
   }
 
   return urequestAsync(req.body).then(function (resp) {
-    res.setHeader('Content-Type', 'application/json');
     resp = resp.toJSON();
-    res.end(JSON.stringify(resp));
+    res.send(resp);
   });
 };
 controllers._nonces = {};
@@ -378,7 +370,7 @@ controllers._requireNonce = function (req, res, next) {
   var active = (Date.now() - controllers._nonces[nonce]) < (4 * 60 * 60 * 1000);
   if (!active) {
     // TODO proper headers and error message
-    res.end({ "error": "invalid or expired nonce", "error_code": "ENONCE" });
+    res.send({ "error": "invalid or expired nonce", "error_code": "ENONCE" });
     return;
   }
   delete controllers._nonces[nonce];
@@ -451,7 +443,7 @@ function jsonEggspress(req, res, next) {
       req.body = JSON.parse(body);
     } catch(e) {
       res.statusCode = 400;
-      res.end('{"error":{"message":"POST body is not valid json"}}');
+      res.send({"error":{"message":"POST body is not valid json"}});
       return;
     }
     next();
@@ -508,12 +500,12 @@ function jwsEggspress(req, res, next) {
   }
 
   var vjwk;
-  jwks.some(function (jwk) {
+  DB.pubs.some(function (jwk) {
     if (jwk.kid === req.jws.header.kid) {
       vjwk = jwk;
     }
   });
-  if ((0 === jwks.length && req.jws.header.jwk)) {
+  if ((0 === DB.pubs.length && req.jws.header.jwk)) {
     vjwk = req.jws.header.jwk;
     if (!vjwk.kid) { throw Error("Impossible: no key id"); }
   }
@@ -524,7 +516,7 @@ function jwsEggspress(req, res, next) {
     }
     req.jws.verified = verified;
 
-    if (0 !== jwks.length) {
+    if (0 !== DB.pubs.length) {
       return;
     }
     return keystore.set(vjwk.kid + '.pub.jwk.json', vjwk);
@@ -565,15 +557,14 @@ function handleApi() {
       dumpy.message = "Please run 'telebit init' to authenticate.";
     }
 
-    res.end(JSON.stringify(dumpy));
+    res.send(dumpy);
   }
 
   function getConfigOnly(req, res) {
     var resp = JSON.parse(JSON.stringify(state.config));
     resp.version = pkg.version;
     resp._otp = state.otp;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify(resp));
+    res.send(resp);
   }
 
   //
@@ -585,9 +576,8 @@ function handleApi() {
     fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
       if (err) {
         res.statusCode = 500;
-        res.setHeader('Content-Type', 'application/json');
-        res.end('{"error":{"message":"Could not save config file after init: ' + err.message.replace(/"/g, "'")
-          + '.\nPerhaps check that the file exists and your user has permissions to write it?"}}');
+        res.send({"error":{"message":"Could not save config file after init: " + err.message.replace(/"/g, "'")
+          + ".\nPerhaps check that the file exists and your user has permissions to write it?"}});
         return;
       }
 
@@ -599,7 +589,7 @@ function handleApi() {
     var conf = {};
     if (!req.body) {
       res.statusCode = 422;
-      res.end('{"error":{"message":"module \'init\' needs more arguments"}}');
+      res.send({"error":{"message":"module 'init' needs more arguments"}});
       return;
     }
 
@@ -695,8 +685,7 @@ function handleApi() {
       console.warn('missing config');
       res.statusCode = 400;
 
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({
+      res.send({
         error: {
           code: "E_INIT"
         , message: "Missing important config file params"
@@ -704,7 +693,7 @@ function handleApi() {
         , _config: JSON.stringify(state.config)
         , _body: JSON.stringify(req.body)
         }
-      }));
+      });
       return;
     }
 
@@ -729,8 +718,7 @@ function handleApi() {
     }
 
     function respondAndClose() {
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({ success: true }));
+      res.send({ success: true });
       controlServer.close(function () {
         console.info("[telebitd.js] server closed");
         setTimeout(function () {
@@ -751,10 +739,9 @@ function handleApi() {
     }
 
     res.statusCode = 400;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({
+    res.send({
       error: { code: "E_CONFIG", message: "Invalid config file. Please run 'telebit init'" }
-    }));
+    });
   }
 
   function saveAndCommit(req, res) {
@@ -763,10 +750,9 @@ function handleApi() {
     fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
       if (err) {
         res.statusCode = 500;
-        res.setHeader('Content-Type', 'application/json');
-        res.end(JSON.stringify({
+        res.send({
           "error":{"message":"Could not save config file. Perhaps you're not running as root?"}
-        }));
+        });
         return;
       }
       listSuccess();
@@ -775,10 +761,9 @@ function handleApi() {
 
   function handleError(err, req, res) {
     res.statusCode = 500;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({
+    res.send({
       error: { message: err.message, code: err.code }
-    }));
+    });
   }
 
   function enable(req, res) {
@@ -808,21 +793,19 @@ function handleApi() {
 
     if (myRemote) { myRemote.end(); myRemote = null; }
     fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), function (err) {
-      res.setHeader('Content-Type', 'application/json');
       if (err) {
         err.message = "Could not save config file. Perhaps you're user doesn't have permission?";
         handleError(err);
         return;
       }
-      res.end('{"success":true}');
+      res.send({"success":true});
     });
   }
 
   function getStatus(req, res) {
     var now = Date.now();
-    res.setHeader('Content-Type', 'application/json');
     require('../lib/ssh.js').checkSecurity().then(function (ssh) {
-      res.end(JSON.stringify(
+      res.send(
         { module: 'status'
         , version: pkg.version
         , port: (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined)
@@ -840,7 +823,7 @@ function handleApi() {
         , ssh_password_authentication: ssh.password_authentication
         , ssh_requests_password: ssh.requests_password
         }
-      ));
+      );
     });
   }
 
@@ -876,8 +859,7 @@ function handleApi() {
   app.use(/\b(status)\b/, getStatus);
   app.use(/\b(list)\b/, listSuccess);
   app.use('/', function (req, res) {
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
+    res.send({"error":{"message":"unrecognized rpc"}});
   });
 
   return app;
@@ -1430,7 +1412,8 @@ state.net = state.net || {
   }
 };
 
-var jwks = [];
+var DB = {};
+DB.pubs = [];
 var token;
 var tokenname = "access_token.jwt";
 try {
@@ -1444,12 +1427,10 @@ try {
 } catch(e) { onKeystore(); }
 function onKeystore() {
   return keystore.all().then(function (list) {
-    var keyext = '.key.jwk.json';
-    var pubext = '.pub.jwk.json';
     var key;
     list.forEach(function (el) {
       // find key
-      if (keyext === el.account.slice(-keyext.length)
+      if (KEYEXT === el.account.slice(-KEYEXT.length)
         && el.password.kty && el.password.kid) {
         key = el.password;
         return;
@@ -1465,9 +1446,9 @@ function onKeystore() {
       // (if we sign these we could probably just store them to the fs,
       // but we do want some way to know that they weren't just willy-nilly
       // added to the fs my any old program)
-      if (pubext === el.account.slice(-pubext.length)) {
+      if (PUBEXT === el.account.slice(-PUBEXT.length)) {
         // pre-parsed
-        jwks.push(el.password);
+        DB.pubs.push(el.password);
         return;
       }
 
@@ -1485,7 +1466,7 @@ function onKeystore() {
       var jwk = pair.private;
       return keypairs.thumbprint({ jwk: jwk }).then(function (kid) {
         jwk.kid = kid;
-        return keystore.set(kid + keyext, jwk).then(function () {
+        return keystore.set(kid + KEYEXT, jwk).then(function () {
           var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
           console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
           state.key = jwk;
diff --git a/lib/eggspress.js b/lib/eggspress.js
index cc10f88..fdd6169 100644
--- a/lib/eggspress.js
+++ b/lib/eggspress.js
@@ -1,5 +1,14 @@
 'use strict';
 
+function eggSend(obj) {
+  /*jslint validthis: true*/
+  var me = this;
+  if (!me.getHeader('content-type')) {
+    me.setHeader('Content-Type', 'application/json');
+  }
+  me.end(JSON.stringify(obj));
+}
+
 module.exports = function eggspress() {
   //var patternsMap = {};
   var allPatterns = [];
@@ -52,6 +61,9 @@ module.exports = function eggspress() {
         return;
       }
     }
+
+    res.send = eggSend;
+
     next();
   };
 
diff --git a/lib/rc/index.js b/lib/rc/index.js
index d418da0..adc0000 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -154,7 +154,7 @@ module.exports.create = function (state) {
       }
     , payload: JSON.stringify(opts.data)
     }).then(function (jws) {
-      req.setHeader("content-type", 'application/json');
+      req.setHeader("Content-Type", 'application/jose+json');
       req.write(JSON.stringify(jws));
       req.end();
     });
-- 
2.38.5


From 38123793c4eccf886faa3d68903f401b767a0cf2 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Thu, 28 Mar 2019 03:23:53 -0600
Subject: [PATCH 53/68] local account registration from CLI! w00t!

---
 bin/telebit-remote.js |  78 ++++++++++++----
 bin/telebitd.js       | 204 ++++++++++++++++++++++++++++++++++++------
 lib/eggspress.js      |   7 +-
 lib/rc/index.js       |  82 +++++++++--------
 package-lock.json     |   6 +-
 package.json          |   2 +-
 6 files changed, 294 insertions(+), 85 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 75a5993..20945b8 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -25,6 +25,7 @@ var camelCopy = recase.camelCopy.bind(recase);
 //var snakeCopy = recase.snakeCopy.bind(recase);
 
 var urequest = require('@coolaj86/urequest');
+var urequestAsync = require('util').promisify(urequest);
 var common = require('../lib/cli-common.js');
 
 var defaultConfPath = path.join(os.homedir(), '.config/telebit');
@@ -335,9 +336,7 @@ function askForConfig(state, mainCb) {
 var RC;
 
 function parseConfig(err, text) {
-  function handleConfig(err, config) {
-    if (err) { throw err; }
-
+  function handleConfig(config) {
     state.config = config;
     var verstrd = [ pkg.name + ' daemon v' + state.config.version ];
     if (state.config.version && state.config.version !== pkg.version) {
@@ -346,20 +345,6 @@ function parseConfig(err, text) {
       console.info(verstr.join(' '));
     }
 
-    if (err) {
-      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-        console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
-        console.error(err);
-      } else if ('ENOTSOCK' === err.code) {
-        console.error(err);
-        return;
-      } else {
-        console.error(err);
-      }
-      process.exit(101);
-      return;
-    }
-
     //
     // check for init first, before anything else
     // because it has arguments that may help in
@@ -492,6 +477,7 @@ function parseConfig(err, text) {
 
   state._clientConfig = camelCopy(state._clientConfig || {}) || {};
   RC = require('../lib/rc/index.js').create(state);
+  RC.requestAsync = require('util').promisify(RC.request);
 
   if (!Object.keys(state._clientConfig).length) {
     console.info('(' + state._ipc.comment + ": " + state._ipc.path + ')');
@@ -682,7 +668,63 @@ function parseConfig(err, text) {
     });
   }
 
-  RC.request({ service: 'config', method: 'GET' }, handleConfig);
+  var bootState = {};
+  function bootstrap() {
+    // Create / retrieve account (sign-in, more or less)
+    // TODO hit directory resource /.well-known/openid-configuration -> acme_uri (?)
+    // Occassionally rotate the key just for the sake of testing the key rotation
+    return urequestAsync({ method: 'HEAD', url: RC.resolve('/acme/new-nonce') }).then(function (resp) {
+      var nonce = resp.headers['replay-nonce'];
+      var newAccountUrl = RC.resolve('/acme/new-acct');
+      return keypairs.signJws({
+        jwk: state.key
+      , protected: {
+          // alg will be filled out automatically
+          jwk: state.pub
+        , nonce: nonce
+        , url: newAccountUrl
+        }
+      , payload: JSON.stringify({
+          // We can auto-agree here because the client is the user agent of the primary user
+          termsOfServiceAgreed: true
+        , contact: [] // I don't think we have email yet...
+        //, externalAccountBinding: null
+        })
+      }).then(function (jws) {
+        return urequestAsync({
+          url: newAccountUrl
+        , method: 'POST'
+        , json: jws // TODO default to post when body is present
+        , headers: { "Content-Type": 'application/jose+json' }
+        }).then(function (resp) {
+          //nonce = resp.headers['replay-nonce'];
+          if (!resp.body || 'valid' !== resp.body.status) {
+            throw new Error("did not successfully create or restore account");
+          }
+          return RC.requestAsync({ service: 'config', method: 'GET' }).catch(function (err) {
+            if (err) {
+              if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+                console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
+                console.error(err);
+              } else if ('ENOTSOCK' === err.code) {
+                console.error(err);
+                return;
+              } else {
+                console.error(err);
+              }
+              process.exit(101);
+              return;
+            }
+          }).then(handleConfig);
+        });
+      });
+    }).catch(RC.createErrorHandler(bootstrap, bootState, function (err) {
+      console.error(err);
+      process.exit(17);
+    }));
+  }
+
+  bootstrap();
 }
 
 var parsers = {
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 03874a6..0ece4d0 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -16,6 +16,7 @@ var crypto = require('crypto');
 var path = require('path');
 var os = require('os');
 var fs = require('fs');
+var fsp = fs.promises;
 var urequest = require('@coolaj86/urequest');
 var urequestAsync = require('util').promisify(urequest);
 var common = require('../lib/cli-common.js');
@@ -110,8 +111,20 @@ function getServername(servernames, sub) {
   })[0];
 }
 
+/*global Promise*/
+var _savingConfig = Promise.resolve();
 function saveConfig(cb) {
-  fs.writeFile(confpath, YAML.safeDump(snakeCopy(state.config)), cb);
+  // simple sequencing chain so that write corruption is not possible
+  _savingConfig = _savingConfig.then(function () {
+    return fsp.writeFile(confpath, YAML.safeDump(snakeCopy(state.config))).then(function () {
+      try {
+        cb();
+      } catch(e) {
+        console.error(e.stack);
+        process.exit(47);
+      }
+    }).catch(cb);
+  });
 }
 var controllers = {};
 controllers.http = function (req, res) {
@@ -366,7 +379,7 @@ controllers.relay = function (req, res) {
 };
 controllers._nonces = {};
 controllers._requireNonce = function (req, res, next) {
-  var nonce = req.jws && req.jws.protected && req.jws.protected.nonce;
+  var nonce = req.jws && req.jws.header && req.jws.header.nonce;
   var active = (Date.now() - controllers._nonces[nonce]) < (4 * 60 * 60 * 1000);
   if (!active) {
     // TODO proper headers and error message
@@ -381,31 +394,133 @@ controllers._issueNonce = function (req, res) {
   var nonce = toUrlSafe(crypto.randomBytes(16).toString('base64'));
   // TODO associate with a TLS session
   controllers._nonces[nonce] = Date.now();
-  res.headers.set("Replay-Nonce", nonce);
+  res.setHeader("Replay-Nonce", nonce);
   return nonce;
 };
 controllers.newNonce = function (req, res) {
   res.statusCode = 200;
-  res.headers.set("Cache-Control", "max-age=0, no-cache, no-store");
+  res.setHeader("Cache-Control", "max-age=0, no-cache, no-store");
   // TODO
-  //res.headers.set("Date", "Sun, 10 Mar 2019 08:04:45 GMT");
+  //res.setHeader("Date", "Sun, 10 Mar 2019 08:04:45 GMT");
   // is this the expiration of the nonce itself? methinks maybe so
-  //res.headers.set("Expires", "Sun, 10 Mar 2019 08:04:45 GMT");
+  //res.setHeader("Expires", "Sun, 10 Mar 2019 08:04:45 GMT");
   // TODO use one of the registered domains
   //var indexUrl = "https://acme-staging-v02.api.letsencrypt.org/index"
   var port = (state.config.ipc && state.config.ipc.port || state._ipc.port || undefined);
   var indexUrl = "http://localhost:" + port + "/index";
-  res.headers.set("Link", "Link: <" + indexUrl + ">;rel=\"index\"");
-  res.headers.set("Pragma", "no-cache");
-  //res.headers.set("Strict-Transport-Security", "max-age=604800");
-  res.headers.set("X-Frame-Options", "DENY");
+  res.setHeader("Link", "<" + indexUrl + ">;rel=\"index\"");
+  res.setHeader("Cache-Control", "max-age=0, no-cache, no-store");
+  res.setHeader("Pragma", "no-cache");
+  //res.setHeader("Strict-Transport-Security", "max-age=604800");
+  res.setHeader("X-Frame-Options", "DENY");
 
+  controllers._issueNonce(req, res);
   res.end("");
 };
 controllers.newAccount = function (req, res) {
   controllers._requireNonce(req, res, function () {
-    res.statusCode = 500;
-    res.end("not implemented yet");
+    // TODO clean up error messages to be similar to ACME
+
+    // check if there's a public key
+    if (!req.jws || !req.jws.header.kid || !req.jws.header.jwk) {
+      res.statusCode = 422;
+      res.send({ error: { message: "jws body was not present or could not be validated" } });
+      return;
+    }
+
+    // TODO mx record email validation
+    if (!Array.isArray(req.body.contact) || !req.body.contact.length && '127.0.0.1' !== req.connection.remoteAddress) {
+      // req.body.contact: [ 'mailto:email' ]
+      res.statusCode = 422;
+      res.send({ error: { message: "jws signed payload should contain a valid mailto:email in the contact array" } });
+      return;
+    }
+    if (!req.body.termsOfServiceAgreed) {
+      // req.body.termsOfServiceAgreed: true
+      res.statusCode = 422;
+      res.send({ error: { message: "jws signed payload should have termsOfServiceAgreed: true" } });
+      return;
+    }
+
+    // We verify here regardless of whether or not it was verified before,
+    // because it needs to be signed by the presenter of the public key,
+    // not just a trusted key
+    return verifyJws(req.jws.header.jwk, req.jws).then(function (verified) {
+      if (!verified) {
+        res.statusCode = 422;
+        res.send({ error: { message: "jws body was not present or could not be validated" } });
+        return;
+      }
+
+      var jwk = req.jws.header.jwk;
+      return keypairs.thumbprint({ jwk: jwk }).then(function (thumb) {
+        // Note: we can get any number of account requests
+        // and these need to be stored for some space of time
+        // to await verification.
+        // we'll have to expire them somehow and prevent DoS
+
+        // check if this account already exists
+        var account;
+        DB.accounts.some(function (acc) {
+          // TODO calculate thumbprint from jwk
+          // find a key with matching jwk
+          if (acc.thumb === thumb) {
+            account = acc;
+            return true;
+          }
+          // TODO ACME requires kid to be the account URL (STUPID!!!)
+          // rather than the key id (as decided by the key issuer)
+          // not sure if it's necessary to handle it that way though
+        });
+
+        var myBaseUrl = (req.connection.encrypted ? 'https' : 'http') + '://' + req.headers.host;
+        if (!account) {
+          // fail if onlyReturnExisting is not false
+          if (req.body.onlyReturnExisting) {
+            res.statusCode = 422;
+            res.send({ error: { message: "onlyReturnExisting is set, so there's nothing to do" } });
+            return;
+          }
+          res.statusCode = 201;
+          account = {};
+          account._id = crypto.randomBytes(16).toString('base64');
+          // TODO be better about this
+          account.location = myBaseUrl + '/acme/accounts/' + account._id;
+          account.thumb = thumb;
+          account.pub = jwk;
+          account.contact = req.body.contact;
+          DB.accounts.push(account);
+          state.config.accounts = DB.accounts;
+          saveConfig(function () {});
+        }
+
+        var result = {
+          status: 'valid'
+        , contact: account.contact // [ "mailto:john.doe@gmail.com" ],
+        , orders: account.location + '/orders'
+          // optional / off-spec
+        , id: account._id
+        , jwk: account.pub
+        /*
+          // I'm not sure if we have the real IP through telebit's network wrapper at this point
+          // TODO we also need to set X-Forwarded-Addr as a proxy
+          "initialIp": req.connection.remoteAddress, //"128.187.116.28",
+          "createdAt": (new Date()).toISOString(), // "2018-04-17T21:29:10.833305103Z",
+        */
+        };
+        res.setHeader('Location', account.location);
+        res.send(result);
+        /*
+          Cache-Control: max-age=0, no-cache, no-store
+          Content-Type: application/json
+          Expires: Tue, 17 Apr 2018 21:29:10 GMT
+          Link: <https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf>;rel="terms-of-service"
+          Location: https://acme-staging-v02.api.letsencrypt.org/acme/acct/5937234
+          Pragma: no-cache
+          Replay-nonce: DKxX61imF38y_qkKvVcnWyo9oxQlHll0t9dMwGbkcxw
+         */
+      });
+    });
   });
 };
 
@@ -472,6 +587,7 @@ function jwtEggspress(req, res, next) {
   }
 
   // TODO verify if possible
+  console.warn("[warn] JWT is not verified yet");
   next();
 }
 
@@ -479,7 +595,7 @@ function verifyJws(jwk, jws) {
   return keypairs.export({ jwk: jwk }).then(function (pem) {
     var alg = 'SHA' + jws.header.alg.replace(/[^\d]+/i, '');
     var sig = ecdsaAsn1SigToJwtSig(jws.header.alg, jws.signature);
-    return require('crypto')
+    return crypto
       .createVerify(alg)
       .update(jws.protected + '.' + jws.payload)
       .verify(pem, sig, 'base64');
@@ -487,11 +603,14 @@ function verifyJws(jwk, jws) {
 }
 
 function jwsEggspress(req, res, next) {
+  // Check to see if this looks like a JWS
   // TODO check header application/jose+json ??
   if (!req.body || !(req.body.protected && req.body.payload && req.body.signature)) {
     next();
     return;
   }
+
+  // Decode it a bit
   req.jws = req.body;
   req.jws.header = JSON.parse(Buffer.from(req.jws.protected, 'base64'));
   req.body = Buffer.from(req.jws.payload, 'base64');
@@ -499,27 +618,40 @@ function jwsEggspress(req, res, next) {
     req.body = JSON.parse(req.body);
   }
 
+  // Check if this is a key we already trust
   var vjwk;
   DB.pubs.some(function (jwk) {
     if (jwk.kid === req.jws.header.kid) {
       vjwk = jwk;
     }
   });
+
+  // Check if there aren't any keys that we trust
+  // and this has signed itself, then make it a key we trust
+  // (TODO: move this all to the new account function)
   if ((0 === DB.pubs.length && req.jws.header.jwk)) {
     vjwk = req.jws.header.jwk;
     if (!vjwk.kid) { throw Error("Impossible: no key id"); }
   }
 
+  // Don't verify if it can't be verified
+  if (!vjwk) {
+    next();
+    return;
+  }
+
+  // Run the  verification
   return verifyJws(vjwk, req.jws).then(function (verified) {
     if (true !== verified) {
       return;
     }
+    // Mark as verified
     req.jws.verified = verified;
 
-    if (0 !== DB.pubs.length) {
-      return;
-    }
-    return keystore.set(vjwk.kid + '.pub.jwk.json', vjwk);
+    // (double check) DO NOT save if there are existing pubs
+    if (0 !== DB.pubs.length) { return; }
+
+    return keystore.set(vjwk.kid + PUBEXT, vjwk);
   }).then(function () {
     next();
   });
@@ -828,16 +960,35 @@ function handleApi() {
   }
 
   // TODO turn strings into regexes to match beginnings
+  app.get('/.well-known/openid-configuration', function (req, res) {
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Expose-Headers", "Link, Replay-Nonce, Location");
+    res.setHeader("Access-Control-Max-Age", "86400");
+    if ('OPTIONS' === req.method) { res.end(); return; }
+    res.send({
+      jwks_uri: 'http://localhost/.well-known/jwks.json'
+    , acme_uri: 'http://localhost/acme/directory'
+    });
+  });
   app.use('/acme', function acmeCors(req, res, next) {
     // Taken from New-Nonce
-    res.headers.set("Access-Control-Allow-Headers", "Content-Type");
-    res.headers.set("Access-Control-Allow-Origin", "*");
-    res.headers.set("Access-Control-Expose-Headers", "Link, Replay-Nonce, Location");
-    res.headers.set("Access-Control-Max-Age", "86400");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Expose-Headers", "Link, Replay-Nonce, Location");
+    res.setHeader("Access-Control-Max-Age", "86400");
+    if ('OPTIONS' === req.method) { res.end(); return; }
     next();
   });
-  app.use('/acme/new-nonce', controllers.newNonce);
-  app.use('/acme/new-acct', controllers.newAccount);
+  app.get('/acme/directory', function (req, res) {
+    res.send({
+      'new-nonce': '/acme/new-nonce'
+    , 'new-account': '/acme/new-acct'
+    });
+  });
+  app.head('/acme/new-nonce', controllers.newNonce);
+  app.get('/acme/new-nonce', controllers.newNonce);
+  app.post('/acme/new-acct', controllers.newAccount);
   app.use(/\b(relay)\b/, controllers.relay);
   app.get(/\b(config)\b/, getConfigOnly);
   app.use(/\b(init|config)\b/, initOrConfig);
@@ -872,6 +1023,7 @@ function serveControlsHelper() {
 
   app.use('/rpc/', apiHandler);
   app.use('/api/', apiHandler);
+  app.use('/acme/', apiHandler);
   app.use('/', serveStatic);
 
   controlServer = http.createServer(app);
@@ -1011,6 +1163,7 @@ function parseConfig(err, text) {
   }
 
   state.config = camelCopy(state.config || {}) || {};
+  DB.accounts = state.config.accounts || [];
 
   run();
 
@@ -1414,6 +1567,7 @@ state.net = state.net || {
 
 var DB = {};
 DB.pubs = [];
+DB.accounts = [];
 var token;
 var tokenname = "access_token.jwt";
 try {
@@ -1512,8 +1666,8 @@ function ecdsaAsn1SigToJwtSig(alg, b64sig) {
 
 function toUrlSafe(b64) {
   return b64
-    .replace(/-/g, '+')
-    .replace(/_/g, '/')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
     .replace(/=/g, '')
   ;
 }
diff --git a/lib/eggspress.js b/lib/eggspress.js
index fdd6169..d4b3d28 100644
--- a/lib/eggspress.js
+++ b/lib/eggspress.js
@@ -33,11 +33,12 @@ module.exports = function eggspress() {
         return;
       }
 
-      if (!req.url.match(todo[0])) {
+      var urlstr = (req.url.replace(/\/$/, '') + '/');
+      if (!urlstr.match(todo[0])) {
         //console.log("[eggspress] pattern doesn't match", todo[0], req.url);
         next();
         return;
-      } else if ('string' === typeof todo[0] && 0 !== req.url.match(todo[0]).index) {
+      } else if ('string' === typeof todo[0] && 0 !== urlstr.match(todo[0]).index) {
         //console.log("[eggspress] string pattern is not the start", todo[0], req.url);
         next();
         return;
@@ -70,7 +71,7 @@ module.exports = function eggspress() {
   app.use = function (pattern, fn) {
     return app._use('', pattern, fn);
   };
-  [ 'GET', 'POST', 'DELETE' ].forEach(function (method) {
+  [ 'HEAD', 'GET', 'POST', 'DELETE' ].forEach(function (method) {
     app[method.toLowerCase()] = function (pattern, fn) {
       return app._use(method, pattern, fn);
     };
diff --git a/lib/rc/index.js b/lib/rc/index.js
index adc0000..5df7c72 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -72,6 +72,49 @@ module.exports.create = function (state) {
   }
 
   var RC = {};
+  RC.resolve = function (pathstr) {
+    // TODO use real hostname and return reqOpts rather than string?
+    return 'http://localhost:' + (RC.port({}).port||'1').toString() + '/' + pathstr.replace(/^\//, '');
+  };
+  RC.port = function (reqOpts) {
+    var fs = require('fs');
+    var portFile = path.join(path.dirname(state._ipc.path), 'telebit.port');
+    if (fs.existsSync(portFile)) {
+      reqOpts.host = 'localhost';
+      reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
+      if (!state.ipc) {
+        state.ipc = {};
+      }
+      state.ipc.type = 'port';
+      state.ipc.path = path.dirname(state._ipc.path);
+      state.ipc.port = reqOpts.port;
+    } else {
+      reqOpts.socketPath = state._ipc.path;
+    }
+    return reqOpts;
+  };
+  RC.createErrorHandler = function (replay, opts, cb) {
+    return function (err) {
+      // ENOENT - never started, cleanly exited last start, or creating socket at a different path
+      // ECONNREFUSED - leftover socket just needs to be restarted
+      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+        if (opts._taketwo) {
+          cb(err);
+          return;
+        }
+        require('../../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
+          if (err) { cb(err); return; }
+          opts._taketwo = true;
+          setTimeout(function () {
+            replay(opts, cb);
+          }, 2500);
+        });
+        return;
+      }
+
+      cb(err);
+    };
+  };
   RC.request = function request(opts, fn) {
     if (!opts) { opts = {}; }
     var service = opts.service || 'config';
@@ -93,44 +136,12 @@ module.exports.create = function (state) {
       method: method
     , path: url
     };
-    var fs = require('fs');
-    var portFile = path.join(path.dirname(state._ipc.path), 'telebit.port');
-    if (fs.existsSync(portFile)) {
-      reqOpts.host = 'localhost';
-      reqOpts.port = parseInt(fs.readFileSync(portFile, 'utf8').trim(), 10);
-      if (!state.ipc) {
-        state.ipc = {};
-      }
-      state.ipc.type = 'port';
-      state.ipc.path = path.dirname(state._ipc.path);
-      state.ipc.port = reqOpts.port;
-    } else {
-      reqOpts.socketPath = state._ipc.path;
-    }
+    reqOpts = RC.port(reqOpts);
     var req = http.request(reqOpts, function (resp) {
       makeResponder(service, resp, fn);
     });
 
-    req.on('error', function (err) {
-      // ENOENT - never started, cleanly exited last start, or creating socket at a different path
-      // ECONNREFUSED - leftover socket just needs to be restarted
-      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-        if (opts._taketwo) {
-          fn(err);
-          return;
-        }
-        require('../../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
-          if (err) { fn(err); return; }
-          opts._taketwo = true;
-          setTimeout(function () {
-            RC.request(opts, fn);
-          }, 2500);
-        });
-        return;
-      }
-
-      fn(err);
-    });
+    req.on('error', RC.createErrorHandler(RC.request, opts, fn));
 
     // Simple GET
     if ('POST' !== method || !opts.data) {
@@ -150,7 +161,8 @@ module.exports.create = function (state) {
         // alg will be filled out automatically
         jwk: state.pub
       , nonce: require('crypto').randomBytes(16).toString('hex') // TODO get from server
-      , url: 'https://' + reqOpts.host + reqOpts.path
+        // TODO make localhost exceptional
+      , url: RC.resolve(reqOpts.path)
       }
     , payload: JSON.stringify(opts.data)
     }).then(function (jws) {
diff --git a/package-lock.json b/package-lock.json
index 076c11c..40acb1c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -435,9 +435,9 @@
       }
     },
     "keypairs": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.12.tgz",
-      "integrity": "sha512-zYjYdDvo7G4AIkkZVM3WEJBTRUIrFzYswYNqCxcCPHUsgbBBdewSHAH1CiaQ+VA6Yb7BLEPIv8gFrRz5wJrgsw==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/keypairs/-/keypairs-1.2.14.tgz",
+      "integrity": "sha512-ZoZfZMygyB0QcjSlz7Rh6wT2CJasYEHBPETtmHZEfxuJd7bnsOG5AdtPZqHZBT+hoHvuWCp/4y8VmvTvH0Y9uA==",
       "requires": {
         "eckles": "^1.4.1",
         "rasha": "^1.2.4"
diff --git a/package.json b/package.json
index 354dd8c..d67ed47 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "greenlock": "^2.6.7",
     "js-yaml": "^3.11.0",
     "keyfetch": "^1.1.8",
-    "keypairs": "^1.2.12",
+    "keypairs": "^1.2.14",
     "mkdirp": "^0.5.1",
     "proxy-packer": "^2.0.2",
     "ps-list": "^5.0.0",
-- 
2.38.5


From 0080cec081eb8eacae915d2565fed1faa6a28e80 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 01:50:18 -0600
Subject: [PATCH 54/68] switch to @root/request and some account updates

---
 bin/telebit-remote.js          |   13 +-
 bin/telebitd.js                |   34 +-
 lib/admin/index.html           |    1 +
 lib/admin/js/bluecrypt-acme.js | 2828 ++++++++++++++++++++++++++++++++
 lib/admin/js/telebit.js        |    4 +-
 lib/cli-common.js              |    2 +-
 package-lock.json              |   37 +-
 package.json                   |    4 +-
 tests/pair-request.js          |    2 +-
 tests/pair-state.js            |    2 +-
 10 files changed, 2899 insertions(+), 28 deletions(-)
 create mode 100644 lib/admin/js/bluecrypt-acme.js

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 20945b8..818bc7d 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -24,7 +24,7 @@ var recase = require('recase').create({});
 var camelCopy = recase.camelCopy.bind(recase);
 //var snakeCopy = recase.snakeCopy.bind(recase);
 
-var urequest = require('@coolaj86/urequest');
+var urequest = require('@root/request');
 var urequestAsync = require('util').promisify(urequest);
 var common = require('../lib/cli-common.js');
 
@@ -673,7 +673,11 @@ function parseConfig(err, text) {
     // Create / retrieve account (sign-in, more or less)
     // TODO hit directory resource /.well-known/openid-configuration -> acme_uri (?)
     // Occassionally rotate the key just for the sake of testing the key rotation
-    return urequestAsync({ method: 'HEAD', url: RC.resolve('/acme/new-nonce') }).then(function (resp) {
+    return urequestAsync({
+      method: 'HEAD'
+    , url: RC.resolve('/acme/new-nonce')
+    , headers: { "User-Agent": 'Telebit/' + pkg.version }
+    }).then(function (resp) {
       var nonce = resp.headers['replay-nonce'];
       var newAccountUrl = RC.resolve('/acme/new-acct');
       return keypairs.signJws({
@@ -695,7 +699,10 @@ function parseConfig(err, text) {
           url: newAccountUrl
         , method: 'POST'
         , json: jws // TODO default to post when body is present
-        , headers: { "Content-Type": 'application/jose+json' }
+        , headers: {
+            "Content-Type": 'application/jose+json'
+          , "User-Agent": 'Telebit/' + pkg.version
+          }
         }).then(function (resp) {
           //nonce = resp.headers['replay-nonce'];
           if (!resp.body || 'valid' !== resp.body.status) {
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 0ece4d0..145d9e0 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -17,7 +17,7 @@ var path = require('path');
 var os = require('os');
 var fs = require('fs');
 var fsp = fs.promises;
-var urequest = require('@coolaj86/urequest');
+var urequest = require('@root/request');
 var urequestAsync = require('util').promisify(urequest);
 var common = require('../lib/cli-common.js');
 var http = require('http');
@@ -489,6 +489,7 @@ controllers.newAccount = function (req, res) {
           account.thumb = thumb;
           account.pub = jwk;
           account.contact = req.body.contact;
+          account.useragent = req.headers["user-agent"];
           DB.accounts.push(account);
           state.config.accounts = DB.accounts;
           saveConfig(function () {});
@@ -618,18 +619,36 @@ function jwsEggspress(req, res, next) {
     req.body = JSON.parse(req.body);
   }
 
-  // Check if this is a key we already trust
+  var ua = req.headers['user-agent'];
   var vjwk;
+  var pubs;
+  // Check if this is a key we already trust
   DB.pubs.some(function (jwk) {
     if (jwk.kid === req.jws.header.kid) {
       vjwk = jwk;
     }
   });
 
+  // Check for CLI or Browser User-Agent
+  // (both should connect as part of setup)
+  if (/Telebit/i.test(ua) && !/Mozilla/i.test(ua)) {
+    pubs = DB.pubs.filter(function (jwk) {
+      if (/Telebit/i.test(jwk.useragent) && !/Mozilla/i.test(jwk.useragent)) {
+        return true;
+      }
+    });
+  } else {
+    pubs = DB.pubs.filter(function (jwk) {
+      if (!/Telebit/i.test(jwk.useragent) || /Mozilla/i.test(jwk.useragent)) {
+        return true;
+      }
+    });
+  }
+
   // Check if there aren't any keys that we trust
   // and this has signed itself, then make it a key we trust
   // (TODO: move this all to the new account function)
-  if ((0 === DB.pubs.length && req.jws.header.jwk)) {
+  if ((0 === pubs.length && req.jws.header.jwk)) {
     vjwk = req.jws.header.jwk;
     if (!vjwk.kid) { throw Error("Impossible: no key id"); }
   }
@@ -642,15 +661,16 @@ function jwsEggspress(req, res, next) {
 
   // Run the  verification
   return verifyJws(vjwk, req.jws).then(function (verified) {
-    if (true !== verified) {
-      return;
-    }
+    if (true !== verified) { return; }
+
     // Mark as verified
     req.jws.verified = verified;
+    vjwk.useragent = ua;
 
     // (double check) DO NOT save if there are existing pubs
-    if (0 !== DB.pubs.length) { return; }
+    if (0 !== pubs.length) { return; }
 
+    DB.pubs.push(vjwk);
     return keystore.set(vjwk.kid + PUBEXT, vjwk);
   }).then(function () {
     next();
diff --git a/lib/admin/index.html b/lib/admin/index.html
index 51a748a..0f91adf 100644
--- a/lib/admin/index.html
+++ b/lib/admin/index.html
@@ -227,6 +227,7 @@ ssh -o ProxyCommand="$proxy_cmd" hot-skunk-45.telebit.io</code></pre>
   </div>
 
   <script src="/js/vue.js"></script>
+  <script src="/js/bluecrypt-acme.js"></script>
   <script src="/js/telebit.js"></script>
   <script src="/js/telebit-token.js"></script>
   <script src="/js/app.js"></script>
diff --git a/lib/admin/js/bluecrypt-acme.js b/lib/admin/js/bluecrypt-acme.js
new file mode 100644
index 0000000..2b20d66
--- /dev/null
+++ b/lib/admin/js/bluecrypt-acme.js
@@ -0,0 +1,2828 @@
+// Copyright 2015-2019 AJ ONeal. All rights reserved
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+;
+(function (exports) {
+
+var Enc = exports.Enc = {};
+
+Enc.bufToBin = function (buf) {
+  var bin = '';
+  // cannot use .map() because Uint8Array would return only 0s
+  buf.forEach(function (ch) {
+    bin += String.fromCharCode(ch);
+  });
+  return bin;
+};
+
+Enc.bufToHex = function toHex(u8) {
+  var hex = [];
+  var i, h;
+  var len = (u8.byteLength || u8.length);
+
+  for (i = 0; i < len; i += 1) {
+    h = u8[i].toString(16);
+    if (h.length % 2) { h = '0' + h; }
+    hex.push(h);
+  }
+
+  return hex.join('').toLowerCase();
+};
+
+Enc.urlBase64ToBase64 = function urlsafeBase64ToBase64(str) {
+  var r = str % 4;
+  if (2 === r) {
+    str += '==';
+  } else if (3 === r) {
+    str += '=';
+  }
+  return str.replace(/-/g, '+').replace(/_/g, '/');
+};
+
+Enc.base64ToBuf = function (b64) {
+  return Enc.binToBuf(atob(b64));
+};
+Enc.binToBuf = function (bin) {
+  var arr = bin.split('').map(function (ch) {
+    return ch.charCodeAt(0);
+  });
+  return 'undefined' !== typeof Uint8Array ? new Uint8Array(arr) : arr;
+};
+Enc.bufToHex = function (u8) {
+  var hex = [];
+  var i, h;
+  var len = (u8.byteLength || u8.length);
+
+  for (i = 0; i < len; i += 1) {
+    h = u8[i].toString(16);
+    if (h.length % 2) { h = '0' + h; }
+    hex.push(h);
+  }
+
+  return hex.join('').toLowerCase();
+};
+Enc.numToHex = function (d) {
+  d = d.toString(16);
+  if (d.length % 2) {
+    return '0' + d;
+  }
+  return d;
+};
+
+Enc.bufToUrlBase64 = function (u8) {
+  return Enc.base64ToUrlBase64(Enc.bufToBase64(u8));
+};
+
+Enc.base64ToUrlBase64 = function (str) {
+  return str.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+
+Enc.bufToBase64 = function (u8) {
+  var bin = '';
+  u8.forEach(function (i) {
+    bin += String.fromCharCode(i);
+  });
+  return btoa(bin);
+};
+
+Enc.hexToBuf = function (hex) {
+  var arr = [];
+  hex.match(/.{2}/g).forEach(function (h) {
+    arr.push(parseInt(h, 16));
+  });
+  return 'undefined' !== typeof Uint8Array ? new Uint8Array(arr) : arr;
+};
+
+Enc.numToHex = function (d) {
+  d = d.toString(16);
+  if (d.length % 2) {
+    return '0' + d;
+  }
+  return d;
+};
+
+
+//
+// JWK to SSH (tested working)
+//
+Enc.base64ToHex = function (b64) {
+  var bin = atob(Enc.urlBase64ToBase64(b64));
+  return Enc.binToHex(bin);
+};
+
+Enc.binToHex = function (bin) {
+  return bin.split('').map(function (ch) {
+    var h = ch.charCodeAt(0).toString(16);
+    if (h.length % 2) { h = '0' + h; }
+    return h;
+  }).join('');
+};
+// TODO are there any nuance differences here?
+Enc.utf8ToHex = Enc.binToHex;
+
+Enc.hexToBase64 = function (hex) {
+  return btoa(Enc.hexToBin(hex));
+};
+
+Enc.hexToBin = function (hex) {
+  return hex.match(/.{2}/g).map(function (h) {
+    return String.fromCharCode(parseInt(h, 16));
+  }).join('');
+};
+
+Enc.urlBase64ToBase64 = function urlsafeBase64ToBase64(str) {
+  var r = str % 4;
+  if (2 === r) {
+    str += '==';
+  } else if (3 === r) {
+    str += '=';
+  }
+  return str.replace(/-/g, '+').replace(/_/g, '/');
+};
+
+
+}('undefined' !== typeof exports ? module.exports : window ));
+;(function (exports) {
+'use strict';
+
+if (!exports.ASN1) { exports.ASN1 = {}; }
+if (!exports.Enc) { exports.Enc = {}; }
+if (!exports.PEM) { exports.PEM = {}; }
+
+var ASN1 = exports.ASN1;
+var Enc = exports.Enc;
+var PEM = exports.PEM;
+
+//
+// Packer
+//
+
+// Almost every ASN.1 type that's important for CSR
+// can be represented generically with only a few rules.
+exports.ASN1 = function ASN1(/*type, hexstrings...*/) {
+  var args = Array.prototype.slice.call(arguments);
+  var typ = args.shift();
+  var str = args.join('').replace(/\s+/g, '').toLowerCase();
+  var len = (str.length/2);
+  var lenlen = 0;
+  var hex = typ;
+
+  // We can't have an odd number of hex chars
+  if (len !== Math.round(len)) {
+    throw new Error("invalid hex");
+  }
+
+  // The first byte of any ASN.1 sequence is the type (Sequence, Integer, etc)
+  // The second byte is either the size of the value, or the size of its size
+
+  // 1. If the second byte is < 0x80 (128) it is considered the size
+  // 2. If it is > 0x80 then it describes the number of bytes of the size
+  //    ex: 0x82 means the next 2 bytes describe the size of the value
+  // 3. The special case of exactly 0x80 is "indefinite" length (to end-of-file)
+
+  if (len > 127) {
+    lenlen += 1;
+    while (len > 255) {
+      lenlen += 1;
+      len = len >> 8;
+    }
+  }
+
+  if (lenlen) { hex += Enc.numToHex(0x80 + lenlen); }
+  return hex + Enc.numToHex(str.length/2) + str;
+};
+
+// The Integer type has some special rules
+ASN1.UInt = function UINT() {
+  var str = Array.prototype.slice.call(arguments).join('');
+  var first = parseInt(str.slice(0, 2), 16);
+
+  // If the first byte is 0x80 or greater, the number is considered negative
+  // Therefore we add a '00' prefix if the 0x80 bit is set
+  if (0x80 & first) { str = '00' + str; }
+
+  return ASN1('02', str);
+};
+
+// The Bit String type also has a special rule
+ASN1.BitStr = function BITSTR() {
+  var str = Array.prototype.slice.call(arguments).join('');
+  // '00' is a mask of how many bits of the next byte to ignore
+  return ASN1('03', '00' + str);
+};
+
+ASN1.pack = function (arr) {
+  var typ = Enc.numToHex(arr[0]);
+  var str = '';
+  if (Array.isArray(arr[1])) {
+    arr[1].forEach(function (a) {
+      str += ASN1.pack(a);
+    });
+  } else if ('string' === typeof arr[1]) {
+    str = arr[1];
+  } else {
+    throw new Error("unexpected array");
+  }
+  if ('03' === typ) {
+    return ASN1.BitStr(str);
+  } else if ('02' === typ) {
+    return ASN1.UInt(str);
+  } else {
+    return ASN1(typ, str);
+  }
+};
+Object.keys(ASN1).forEach(function (k) {
+  exports.ASN1[k] = ASN1[k];
+});
+ASN1 = exports.ASN1;
+
+PEM.packBlock = function (opts) {
+  // TODO allow for headers?
+  return '-----BEGIN ' + opts.type + '-----\n'
+    + Enc.bufToBase64(opts.bytes).match(/.{1,64}/g).join('\n') + '\n'
+    + '-----END ' + opts.type + '-----'
+  ;
+};
+
+Enc.bufToBase64 = function (u8) {
+  var bin = '';
+  u8.forEach(function (i) {
+    bin += String.fromCharCode(i);
+  });
+  return btoa(bin);
+};
+
+Enc.hexToBuf = function (hex) {
+  var arr = [];
+  hex.match(/.{2}/g).forEach(function (h) {
+    arr.push(parseInt(h, 16));
+  });
+  return 'undefined' !== typeof Uint8Array ? new Uint8Array(arr) : arr;
+};
+
+Enc.numToHex = function (d) {
+  d = d.toString(16);
+  if (d.length % 2) {
+    return '0' + d;
+  }
+  return d;
+};
+
+}('undefined' !== typeof window ? window : module.exports));
+(function (exports) {
+  'use strict';
+
+  var x509 = exports.x509 = {};
+  var ASN1 = exports.ASN1;
+  var Enc = exports.Enc;
+
+  // 1.2.840.10045.3.1.7
+  // prime256v1 (ANSI X9.62 named elliptic curve)
+  var OBJ_ID_EC = '06 08 2A8648CE3D030107'.replace(/\s+/g, '').toLowerCase();
+  // 1.3.132.0.34
+  // secp384r1 (SECG (Certicom) named elliptic curve)
+  var OBJ_ID_EC_384 = '06 05 2B81040022'.replace(/\s+/g, '').toLowerCase();
+  // 1.2.840.10045.2.1
+  // ecPublicKey (ANSI X9.62 public key type)
+  var OBJ_ID_EC_PUB = '06 07 2A8648CE3D0201'.replace(/\s+/g, '').toLowerCase();
+
+  x509.parseSec1 = function parseEcOnlyPrivkey(u8, jwk) {
+    var index = 7;
+    var len = 32;
+    var olen = OBJ_ID_EC.length / 2;
+
+    if ("P-384" === jwk.crv) {
+      olen = OBJ_ID_EC_384.length / 2;
+      index = 8;
+      len = 48;
+    }
+    if (len !== u8[index - 1]) {
+      throw new Error("Unexpected bitlength " + len);
+    }
+
+    // private part is d
+    var d = u8.slice(index, index + len);
+    // compression bit index
+    var ci = index + len + 2 + olen + 2 + 3;
+    var c = u8[ci];
+    var x, y;
+
+    if (0x04 === c) {
+      y = u8.slice(ci + 1 + len, ci + 1 + len + len);
+    } else if (0x02 !== c) {
+      throw new Error("not a supported EC private key");
+    }
+    x = u8.slice(ci + 1, ci + 1 + len);
+
+    return {
+      kty: jwk.kty
+      , crv: jwk.crv
+      , d: Enc.bufToUrlBase64(d)
+      //, dh: Enc.bufToHex(d)
+      , x: Enc.bufToUrlBase64(x)
+      //, xh: Enc.bufToHex(x)
+      , y: Enc.bufToUrlBase64(y)
+      //, yh: Enc.bufToHex(y)
+    };
+  };
+
+  x509.packPkcs1 = function (jwk) {
+    var n = ASN1.UInt(Enc.base64ToHex(jwk.n));
+    var e = ASN1.UInt(Enc.base64ToHex(jwk.e));
+
+    if (!jwk.d) {
+      return Enc.hexToBuf(ASN1('30', n, e));
+    }
+
+    return Enc.hexToBuf(ASN1('30'
+    , ASN1.UInt('00')
+    , n
+    , e
+    , ASN1.UInt(Enc.base64ToHex(jwk.d))
+    , ASN1.UInt(Enc.base64ToHex(jwk.p))
+    , ASN1.UInt(Enc.base64ToHex(jwk.q))
+    , ASN1.UInt(Enc.base64ToHex(jwk.dp))
+    , ASN1.UInt(Enc.base64ToHex(jwk.dq))
+    , ASN1.UInt(Enc.base64ToHex(jwk.qi))
+    ));
+  };
+
+  x509.parsePkcs8 = function parseEcPkcs8(u8, jwk) {
+    var index = 24 + (OBJ_ID_EC.length / 2);
+    var len = 32;
+    if ("P-384" === jwk.crv) {
+      index = 24 + (OBJ_ID_EC_384.length / 2) + 2;
+      len = 48;
+    }
+
+    //console.log(index, u8.slice(index));
+    if (0x04 !== u8[index]) {
+      //console.log(jwk);
+      throw new Error("privkey not found");
+    }
+    var d = u8.slice(index + 2, index + 2 + len);
+    var ci = index + 2 + len + 5;
+    var xi = ci + 1;
+    var x = u8.slice(xi, xi + len);
+    var yi = xi + len;
+    var y;
+    if (0x04 === u8[ci]) {
+      y = u8.slice(yi, yi + len);
+    } else if (0x02 !== u8[ci]) {
+      throw new Error("invalid compression bit (expected 0x04 or 0x02)");
+    }
+
+    return {
+      kty: jwk.kty
+      , crv: jwk.crv
+      , d: Enc.bufToUrlBase64(d)
+      //, dh: Enc.bufToHex(d)
+      , x: Enc.bufToUrlBase64(x)
+      //, xh: Enc.bufToHex(x)
+      , y: Enc.bufToUrlBase64(y)
+      //, yh: Enc.bufToHex(y)
+    };
+  };
+
+  x509.parseSpki = function parsePem(u8, jwk) {
+    var ci = 16 + OBJ_ID_EC.length / 2;
+    var len = 32;
+
+    if ("P-384" === jwk.crv) {
+      ci = 16 + OBJ_ID_EC_384.length / 2;
+      len = 48;
+    }
+
+    var c = u8[ci];
+    var xi = ci + 1;
+    var x = u8.slice(xi, xi + len);
+    var yi = xi + len;
+    var y;
+    if (0x04 === c) {
+      y = u8.slice(yi, yi + len);
+    } else if (0x02 !== c) {
+      throw new Error("not a supported EC private key");
+    }
+
+    return {
+      kty: jwk.kty
+      , crv: jwk.crv
+      , x: Enc.bufToUrlBase64(x)
+      //, xh: Enc.bufToHex(x)
+      , y: Enc.bufToUrlBase64(y)
+      //, yh: Enc.bufToHex(y)
+    };
+  };
+  x509.parsePkix = x509.parseSpki;
+
+  x509.packSec1 = function (jwk) {
+    var d = Enc.base64ToHex(jwk.d);
+    var x = Enc.base64ToHex(jwk.x);
+    var y = Enc.base64ToHex(jwk.y);
+    var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
+    return Enc.hexToBuf(
+      ASN1('30'
+        , ASN1.UInt('01')
+        , ASN1('04', d)
+        , ASN1('A0', objId)
+        , ASN1('A1', ASN1.BitStr('04' + x + y)))
+    );
+  };
+  /**
+   * take a private jwk and creates a der from it
+   * @param {*} jwk
+   */
+  x509.packPkcs8 = function (jwk) {
+    if ('RSA' === jwk.kty) {
+      if (!jwk.d) {
+        // Public RSA
+        return Enc.hexToBuf(ASN1('30'
+          , ASN1('30'
+            , ASN1('06', '2a864886f70d010101')
+            , ASN1('05')
+          )
+          , ASN1.BitStr(ASN1('30'
+            , ASN1.UInt(Enc.base64ToHex(jwk.n))
+            , ASN1.UInt(Enc.base64ToHex(jwk.e))
+          ))
+        ));
+      }
+
+      // Private RSA
+      return Enc.hexToBuf(ASN1('30'
+        , ASN1.UInt('00')
+        , ASN1('30'
+          , ASN1('06', '2a864886f70d010101')
+          , ASN1('05')
+        )
+        , ASN1('04'
+          , ASN1('30'
+            , ASN1.UInt('00')
+            , ASN1.UInt(Enc.base64ToHex(jwk.n))
+            , ASN1.UInt(Enc.base64ToHex(jwk.e))
+            , ASN1.UInt(Enc.base64ToHex(jwk.d))
+            , ASN1.UInt(Enc.base64ToHex(jwk.p))
+            , ASN1.UInt(Enc.base64ToHex(jwk.q))
+            , ASN1.UInt(Enc.base64ToHex(jwk.dp))
+            , ASN1.UInt(Enc.base64ToHex(jwk.dq))
+            , ASN1.UInt(Enc.base64ToHex(jwk.qi))
+          )
+        )
+      ));
+    }
+
+    var d = Enc.base64ToHex(jwk.d);
+    var x = Enc.base64ToHex(jwk.x);
+    var y = Enc.base64ToHex(jwk.y);
+    var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
+    return Enc.hexToBuf(
+      ASN1('30'
+        , ASN1.UInt('00')
+        , ASN1('30'
+          , OBJ_ID_EC_PUB
+          , objId
+        )
+        , ASN1('04'
+          , ASN1('30'
+            , ASN1.UInt('01')
+            , ASN1('04', d)
+            , ASN1('A1', ASN1.BitStr('04' + x + y)))))
+    );
+  };
+  x509.packSpki = function (jwk) {
+    if (/EC/i.test(jwk.kty)) {
+      return x509.packSpkiEc(jwk);
+    }
+    return x509.packSpkiRsa(jwk);
+  };
+  x509.packSpkiRsa = function (jwk) {
+  if (!jwk.d) {
+    // Public RSA
+    return Enc.hexToBuf(ASN1('30'
+      , ASN1('30'
+        , ASN1('06', '2a864886f70d010101')
+        , ASN1('05')
+      )
+      , ASN1.BitStr(ASN1('30'
+        , ASN1.UInt(Enc.base64ToHex(jwk.n))
+        , ASN1.UInt(Enc.base64ToHex(jwk.e))
+      ))
+    ));
+  }
+
+  // Private RSA
+  return Enc.hexToBuf(ASN1('30'
+    , ASN1.UInt('00')
+    , ASN1('30'
+      , ASN1('06', '2a864886f70d010101')
+      , ASN1('05')
+    )
+    , ASN1('04'
+      , ASN1('30'
+        , ASN1.UInt('00')
+        , ASN1.UInt(Enc.base64ToHex(jwk.n))
+        , ASN1.UInt(Enc.base64ToHex(jwk.e))
+        , ASN1.UInt(Enc.base64ToHex(jwk.d))
+        , ASN1.UInt(Enc.base64ToHex(jwk.p))
+        , ASN1.UInt(Enc.base64ToHex(jwk.q))
+        , ASN1.UInt(Enc.base64ToHex(jwk.dp))
+        , ASN1.UInt(Enc.base64ToHex(jwk.dq))
+        , ASN1.UInt(Enc.base64ToHex(jwk.qi))
+      )
+    )
+  ));
+};
+  x509.packSpkiEc = function (jwk) {
+    var x = Enc.base64ToHex(jwk.x);
+    var y = Enc.base64ToHex(jwk.y);
+    var objId = ('P-256' === jwk.crv) ? OBJ_ID_EC : OBJ_ID_EC_384;
+    return Enc.hexToBuf(
+      ASN1('30'
+        , ASN1('30'
+          , OBJ_ID_EC_PUB
+          , objId
+        )
+        , ASN1.BitStr('04' + x + y))
+    );
+  };
+  x509.packPkix = x509.packSpki;
+
+}('undefined' !== typeof module ? module.exports : window));
+/*global Promise*/
+(function (exports) {
+'use strict';
+
+var EC = exports.Eckles = {};
+var x509 = exports.x509;
+if ('undefined' !== typeof module) { module.exports = EC; }
+var PEM = exports.PEM;
+var SSH = exports.SSH;
+var Enc = {};
+var textEncoder = new TextEncoder();
+
+EC._stance = "We take the stance that if you're knowledgeable enough to"
+  + " properly and securely use non-standard crypto then you shouldn't need Bluecrypt anyway.";
+EC._universal = "Bluecrypt only supports crypto with standard cross-browser and cross-platform support.";
+EC.generate = function (opts) {
+  var wcOpts = {};
+  if (!opts) { opts = {}; }
+  if (!opts.kty) { opts.kty = 'EC'; }
+
+  // ECDSA has only the P curves and an associated bitlength
+  wcOpts.name = 'ECDSA';
+  if (!opts.namedCurve) {
+    opts.namedCurve = 'P-256';
+  }
+  wcOpts.namedCurve = opts.namedCurve; // true for supported curves
+  if (/256/.test(wcOpts.namedCurve)) {
+    wcOpts.namedCurve = 'P-256';
+    wcOpts.hash = { name: "SHA-256" };
+  } else if (/384/.test(wcOpts.namedCurve)) {
+    wcOpts.namedCurve = 'P-384';
+    wcOpts.hash = { name: "SHA-384" };
+  } else {
+    return Promise.Reject(new Error("'" + wcOpts.namedCurve + "' is not an NIST approved ECDSA namedCurve. "
+      + " Please choose either 'P-256' or 'P-384'. "
+      + EC._stance));
+  }
+
+  var extractable = true;
+  return window.crypto.subtle.generateKey(
+    wcOpts
+  , extractable
+  , [ 'sign', 'verify' ]
+  ).then(function (result) {
+    return window.crypto.subtle.exportKey(
+      "jwk"
+    , result.privateKey
+    ).then(function (privJwk) {
+      privJwk.key_ops = undefined;
+      privJwk.ext = undefined;
+      return {
+        private: privJwk
+      , public: EC.neuter({ jwk: privJwk })
+      };
+    });
+  });
+};
+
+EC.export = function (opts) {
+  return Promise.resolve().then(function () {
+    if (!opts || !opts.jwk || 'object' !== typeof opts.jwk) {
+      throw new Error("must pass { jwk: jwk } as a JSON object");
+    }
+    var jwk = JSON.parse(JSON.stringify(opts.jwk));
+    var format = opts.format;
+    if (opts.public || -1 !== [ 'spki', 'pkix', 'ssh', 'rfc4716' ].indexOf(format)) {
+      jwk.d = null;
+    }
+    if ('EC' !== jwk.kty) {
+      throw new Error("options.jwk.kty must be 'EC' for EC keys");
+    }
+    if (!jwk.d) {
+      if (!format || -1 !== [ 'spki', 'pkix' ].indexOf(format)) {
+        format = 'spki';
+      } else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
+        format = 'ssh';
+      } else {
+        throw new Error("options.format must be 'spki' or 'ssh' for public EC keys, not ("
+          + typeof format + ") " + format);
+      }
+    } else {
+      if (!format || 'sec1' === format) {
+        format = 'sec1';
+      } else if ('pkcs8' !== format) {
+        throw new Error("options.format must be 'sec1' or 'pkcs8' for private EC keys, not '" + format + "'");
+      }
+    }
+    if (-1 === [ 'P-256', 'P-384' ].indexOf(jwk.crv)) {
+      throw new Error("options.jwk.crv must be either P-256 or P-384 for EC keys, not '" + jwk.crv + "'");
+    }
+    if (!jwk.y) {
+      throw new Error("options.jwk.y must be a urlsafe base64-encoded either P-256 or P-384");
+    }
+
+    if ('sec1' === format) {
+      return PEM.packBlock({ type: "EC PRIVATE KEY", bytes: x509.packSec1(jwk) });
+    } else if ('pkcs8' === format) {
+      return PEM.packBlock({ type: "PRIVATE KEY", bytes: x509.packPkcs8(jwk) });
+    } else if (-1 !== [ 'spki', 'pkix' ].indexOf(format)) {
+      return PEM.packBlock({ type: "PUBLIC KEY", bytes: x509.packSpki(jwk) });
+    } else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
+      return SSH.packSsh(jwk);
+    } else {
+      throw new Error("Sanity Error: reached unreachable code block with format: " + format);
+    }
+  });
+};
+EC.pack = function (opts) {
+  return Promise.resolve().then(function () {
+    return EC.exportSync(opts);
+  });
+};
+
+// Chopping off the private parts is now part of the public API.
+// I thought it sounded a little too crude at first, but it really is the best name in every possible way.
+EC.neuter = function (opts) {
+  // trying to find the best balance of an immutable copy with custom attributes
+  var jwk = {};
+  Object.keys(opts.jwk).forEach(function (k) {
+    if ('undefined' === typeof opts.jwk[k]) { return; }
+    // ignore EC private parts
+    if ('d' === k) { return; }
+    jwk[k] = JSON.parse(JSON.stringify(opts.jwk[k]));
+  });
+  return jwk;
+};
+
+// https://stackoverflow.com/questions/42588786/how-to-fingerprint-a-jwk
+EC.__thumbprint = function (jwk) {
+  // Use the same entropy for SHA as for key
+  var alg = 'SHA-256';
+  if (/384/.test(jwk.crv)) {
+    alg = 'SHA-384';
+  }
+  return window.crypto.subtle.digest(
+    { name: alg }
+  , textEncoder.encode('{"crv":"' + jwk.crv + '","kty":"EC","x":"' + jwk.x + '","y":"' + jwk.y + '"}')
+  ).then(function (hash) {
+    return Enc.bufToUrlBase64(new Uint8Array(hash));
+  });
+};
+
+EC.thumbprint = function (opts) {
+  return Promise.resolve().then(function () {
+    var jwk;
+    if ('EC' === opts.kty) {
+      jwk = opts;
+    } else if (opts.jwk) {
+      jwk = opts.jwk;
+    } else {
+      return EC.import(opts).then(function (jwk) {
+        return EC.__thumbprint(jwk);
+      });
+    }
+    return EC.__thumbprint(jwk);
+  });
+};
+
+Enc.bufToUrlBase64 = function (u8) {
+  return Enc.bufToBase64(u8)
+    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+
+Enc.bufToBase64 = function (u8) {
+  var bin = '';
+  u8.forEach(function (i) {
+    bin += String.fromCharCode(i);
+  });
+  return btoa(bin);
+};
+
+}('undefined' !== typeof module ? module.exports : window));
+/*global Promise*/
+(function (exports) {
+'use strict';
+
+var RSA = exports.Rasha = {};
+var x509 = exports.x509;
+if ('undefined' !== typeof module) { module.exports = RSA; }
+var PEM = exports.PEM;
+var SSH = exports.SSH;
+var Enc = {};
+var textEncoder = new TextEncoder();
+
+RSA._stance = "We take the stance that if you're knowledgeable enough to"
+  + " properly and securely use non-standard crypto then you shouldn't need Bluecrypt anyway.";
+RSA._universal = "Bluecrypt only supports crypto with standard cross-browser and cross-platform support.";
+RSA.generate = function (opts) {
+  var wcOpts = {};
+  if (!opts) { opts = {}; }
+  if (!opts.kty) { opts.kty = 'RSA'; }
+
+  // Support PSS? I don't think it's used for Let's Encrypt
+  wcOpts.name = 'RSASSA-PKCS1-v1_5';
+  if (!opts.modulusLength) {
+    opts.modulusLength = 2048;
+  }
+  wcOpts.modulusLength = opts.modulusLength;
+  if (wcOpts.modulusLength >= 2048 && wcOpts.modulusLength < 3072) {
+    // erring on the small side... for no good reason
+    wcOpts.hash = { name: "SHA-256" };
+  } else if (wcOpts.modulusLength >= 3072 && wcOpts.modulusLength < 4096) {
+    wcOpts.hash = { name: "SHA-384" };
+  } else if (wcOpts.modulusLength < 4097) {
+    wcOpts.hash = { name: "SHA-512" };
+  } else {
+    // Public key thumbprints should be paired with a hash of similar length,
+    // so anything above SHA-512's keyspace would be left under-represented anyway.
+    return Promise.Reject(new Error("'" + wcOpts.modulusLength + "' is not within the safe and universally"
+      + " acceptable range of 2048-4096. Typically you should pick 2048, 3072, or 4096, though other values"
+      + " divisible by 8 are allowed. " + RSA._stance));
+  }
+  // TODO maybe allow this to be set to any of the standard values?
+  wcOpts.publicExponent = new Uint8Array([0x01, 0x00, 0x01]);
+
+  var extractable = true;
+  return window.crypto.subtle.generateKey(
+    wcOpts
+  , extractable
+  , [ 'sign', 'verify' ]
+  ).then(function (result) {
+    return window.crypto.subtle.exportKey(
+      "jwk"
+    , result.privateKey
+    ).then(function (privJwk) {
+      return {
+        private: privJwk
+      , public: RSA.neuter({ jwk: privJwk })
+      };
+    });
+  });
+};
+
+// Chopping off the private parts is now part of the public API.
+// I thought it sounded a little too crude at first, but it really is the best name in every possible way.
+RSA.neuter = function (opts) {
+  // trying to find the best balance of an immutable copy with custom attributes
+  var jwk = {};
+  Object.keys(opts.jwk).forEach(function (k) {
+    if ('undefined' === typeof opts.jwk[k]) { return; }
+    // ignore RSA private parts
+    if (-1 !== ['d', 'p', 'q', 'dp', 'dq', 'qi'].indexOf(k)) { return; }
+    jwk[k] = JSON.parse(JSON.stringify(opts.jwk[k]));
+  });
+  return jwk;
+};
+
+// https://stackoverflow.com/questions/42588786/how-to-fingerprint-a-jwk
+RSA.__thumbprint = function (jwk) {
+  // Use the same entropy for SHA as for key
+  var len = Math.floor(jwk.n.length * 0.75);
+  var alg = 'SHA-256';
+  // TODO this may be a bug
+  // need to confirm that the padding is no more or less than 1 byte
+  if (len >= 511) {
+    alg = 'SHA-512';
+  } else if (len >= 383) {
+    alg = 'SHA-384';
+  }
+  return window.crypto.subtle.digest(
+    { name: alg }
+  , textEncoder.encode('{"e":"' + jwk.e + '","kty":"RSA","n":"' + jwk.n + '"}')
+  ).then(function (hash) {
+    return Enc.bufToUrlBase64(new Uint8Array(hash));
+  });
+};
+
+RSA.thumbprint = function (opts) {
+  return Promise.resolve().then(function () {
+    var jwk;
+    if ('EC' === opts.kty) {
+      jwk = opts;
+    } else if (opts.jwk) {
+      jwk = opts.jwk;
+    } else {
+      return RSA.import(opts).then(function (jwk) {
+        return RSA.__thumbprint(jwk);
+      });
+    }
+    return RSA.__thumbprint(jwk);
+  });
+};
+
+RSA.export = function (opts) {
+  return Promise.resolve().then(function () {
+    if (!opts || !opts.jwk || 'object' !== typeof opts.jwk) {
+      throw new Error("must pass { jwk: jwk }");
+    }
+    var jwk = JSON.parse(JSON.stringify(opts.jwk));
+    var format = opts.format;
+    var pub = opts.public;
+    if (pub || -1 !== [ 'spki', 'pkix', 'ssh', 'rfc4716' ].indexOf(format)) {
+      jwk = RSA.neuter({ jwk: jwk });
+    }
+    if ('RSA' !== jwk.kty) {
+      throw new Error("options.jwk.kty must be 'RSA' for RSA keys");
+    }
+    if (!jwk.p) {
+      // TODO test for n and e
+      pub = true;
+      if (!format || 'pkcs1' === format) {
+        format = 'pkcs1';
+      } else if (-1 !== [ 'spki', 'pkix' ].indexOf(format)) {
+        format = 'spki';
+      } else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
+        format = 'ssh';
+      } else {
+        throw new Error("options.format must be 'spki', 'pkcs1', or 'ssh' for public RSA keys, not ("
+          + typeof format + ") " + format);
+      }
+    } else {
+      // TODO test for all necessary keys (d, p, q ...)
+      if (!format || 'pkcs1' === format) {
+        format = 'pkcs1';
+      } else if ('pkcs8' !== format) {
+        throw new Error("options.format must be 'pkcs1' or 'pkcs8' for private RSA keys");
+      }
+    }
+
+    if ('pkcs1' === format) {
+      if (jwk.d) {
+        return PEM.packBlock({ type: "RSA PRIVATE KEY", bytes: x509.packPkcs1(jwk) });
+      } else {
+        return PEM.packBlock({ type: "RSA PUBLIC KEY", bytes: x509.packPkcs1(jwk) });
+      }
+    } else if ('pkcs8' === format) {
+      return PEM.packBlock({ type: "PRIVATE KEY", bytes: x509.packPkcs8(jwk) });
+    } else if (-1 !== [ 'spki', 'pkix' ].indexOf(format)) {
+      return PEM.packBlock({ type: "PUBLIC KEY", bytes: x509.packSpki(jwk) });
+    } else if (-1 !== [ 'ssh', 'rfc4716' ].indexOf(format)) {
+      return SSH.pack({ jwk: jwk, comment: opts.comment });
+    } else {
+      throw new Error("Sanity Error: reached unreachable code block with format: " + format);
+    }
+  });
+};
+RSA.pack = function (opts) {
+  // wrapped in a promise for API compatibility
+  // with the forthcoming browser version
+  // (and potential future native node capability)
+  return Promise.resolve().then(function () {
+    return RSA.export(opts);
+  });
+};
+
+Enc.bufToUrlBase64 = function (u8) {
+  return Enc.bufToBase64(u8)
+    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+
+Enc.bufToBase64 = function (u8) {
+  var bin = '';
+  u8.forEach(function (i) {
+    bin += String.fromCharCode(i);
+  });
+  return btoa(bin);
+};
+
+}('undefined' !== typeof module ? module.exports : window));
+/*global Promise*/
+(function (exports) {
+'use strict';
+
+var Keypairs = exports.Keypairs = {};
+var Rasha = exports.Rasha;
+var Eckles = exports.Eckles;
+var Enc = exports.Enc || {};
+
+Keypairs._stance = "We take the stance that if you're knowledgeable enough to"
+  + " properly and securely use non-standard crypto then you shouldn't need Bluecrypt anyway.";
+Keypairs._universal = "Bluecrypt only supports crypto with standard cross-browser and cross-platform support.";
+Keypairs.generate = function (opts) {
+  opts = opts || {};
+  var p;
+  if (!opts.kty) { opts.kty = opts.type; }
+  if (!opts.kty) { opts.kty = 'EC'; }
+  if (/^EC/i.test(opts.kty)) {
+    p = Eckles.generate(opts);
+  } else if (/^RSA$/i.test(opts.kty)) {
+    p = Rasha.generate(opts);
+  } else {
+    return Promise.Reject(new Error("'" + opts.kty + "' is not a well-supported key type."
+      + Keypairs._universal
+      + " Please choose 'EC', or 'RSA' if you have good reason to."));
+  }
+  return p.then(function (pair) {
+    return Keypairs.thumbprint({ jwk: pair.public }).then(function (thumb) {
+      pair.private.kid = thumb; // maybe not the same id on the private key?
+      pair.public.kid = thumb;
+      return pair;
+    });
+  });
+};
+
+Keypairs.export = function (opts) {
+  return Eckles.export(opts).catch(function (err) {
+    return Rasha.export(opts).catch(function () {
+      return Promise.reject(err);
+    });
+  });
+};
+
+
+/**
+ * Chopping off the private parts is now part of the public API.
+ * I thought it sounded a little too crude at first, but it really is the best name in every possible way.
+ */
+Keypairs.neuter = function (opts) {
+  /** trying to find the best balance of an immutable copy with custom attributes */
+  var jwk = {};
+  Object.keys(opts.jwk).forEach(function (k) {
+    if ('undefined' === typeof opts.jwk[k]) { return; }
+    // ignore RSA and EC private parts
+    if (-1 !== ['d', 'p', 'q', 'dp', 'dq', 'qi'].indexOf(k)) { return; }
+    jwk[k] = JSON.parse(JSON.stringify(opts.jwk[k]));
+  });
+  return jwk;
+};
+
+Keypairs.thumbprint = function (opts) {
+  return Promise.resolve().then(function () {
+    if (/EC/i.test(opts.jwk.kty)) {
+      return Eckles.thumbprint(opts);
+    } else {
+      return Rasha.thumbprint(opts);
+    }
+  });
+};
+
+Keypairs.publish = function (opts) {
+  if ('object' !== typeof opts.jwk || !opts.jwk.kty) { throw new Error("invalid jwk: " + JSON.stringify(opts.jwk)); }
+
+  /** returns a copy */
+  var jwk = Keypairs.neuter(opts);
+
+  if (jwk.exp) {
+    jwk.exp = setTime(jwk.exp);
+  } else {
+    if (opts.exp) { jwk.exp = setTime(opts.exp); }
+    else if (opts.expiresIn) { jwk.exp = Math.round(Date.now()/1000) + opts.expiresIn; }
+    else if (opts.expiresAt) { jwk.exp = opts.expiresAt; }
+  }
+  if (!jwk.use && false !== jwk.use) { jwk.use = "sig"; }
+
+  if (jwk.kid) { return Promise.resolve(jwk); }
+  return Keypairs.thumbprint({ jwk: jwk }).then(function (thumb) { jwk.kid = thumb; return jwk; });
+};
+
+// JWT a.k.a. JWS with Claims using Compact Serialization
+Keypairs.signJwt = function (opts) {
+  return Keypairs.thumbprint({ jwk: opts.jwk }).then(function (thumb) {
+    var header = opts.header || {};
+    var claims = JSON.parse(JSON.stringify(opts.claims || {}));
+    header.typ = 'JWT';
+
+    if (!header.kid) { header.kid = thumb; }
+    if (!header.alg && opts.alg) { header.alg = opts.alg; }
+    if (!claims.iat && (false === claims.iat || false === opts.iat)) {
+      claims.iat = undefined;
+    } else if (!claims.iat) {
+      claims.iat = Math.round(Date.now()/1000);
+    }
+
+    if (opts.exp) {
+      claims.exp = setTime(opts.exp);
+    } else if (!claims.exp && (false === claims.exp || false === opts.exp)) {
+      claims.exp = undefined;
+    } else if (!claims.exp) {
+      throw new Error("opts.claims.exp should be the expiration date as seconds, human form (i.e. '1h' or '15m') or false");
+    }
+
+    if (opts.iss) { claims.iss = opts.iss; }
+    if (!claims.iss && (false === claims.iss || false === opts.iss)) {
+      claims.iss = undefined;
+    } else if (!claims.iss) {
+      throw new Error("opts.claims.iss should be in the form of https://example.com/, a secure OIDC base url");
+    }
+
+    return Keypairs.signJws({
+      jwk: opts.jwk
+    , pem: opts.pem
+    , protected: header
+    , header: undefined
+    , payload: claims
+    }).then(function (jws) {
+      return [ jws.protected, jws.payload, jws.signature ].join('.');
+    });
+  });
+};
+
+Keypairs.signJws = function (opts) {
+  return Keypairs.thumbprint(opts).then(function (thumb) {
+
+    function alg() {
+      if (!opts.jwk) {
+        throw new Error("opts.jwk must exist and must declare 'typ'");
+      }
+      if (opts.jwk.alg) { return opts.jwk.alg; }
+      var typ = ('RSA' === opts.jwk.kty) ? "RS" : "ES";
+      return typ + Keypairs._getBits(opts);
+    }
+
+    function sign() {
+      var protect = opts.protected;
+      var payload = opts.payload;
+
+      // Compute JWS signature
+      var protectedHeader = "";
+      // Because unprotected headers are allowed, regrettably...
+      // https://stackoverflow.com/a/46288694
+      if (false !== protect) {
+        if (!protect) { protect = {}; }
+        if (!protect.alg) { protect.alg = alg(); }
+        // There's a particular request where ACME / Let's Encrypt explicitly doesn't use a kid
+        if (false === protect.kid) { protect.kid = undefined; }
+        else if (!protect.kid) { protect.kid = thumb; }
+        protectedHeader = JSON.stringify(protect);
+      }
+
+      // Not sure how to handle the empty case since ACME POST-as-GET must be empty
+      //if (!payload) {
+      //  throw new Error("opts.payload should be JSON, string, or ArrayBuffer (it may be empty, but that must be explicit)");
+      //}
+      // Trying to detect if it's a plain object (not Buffer, ArrayBuffer, Array, Uint8Array, etc)
+      if (payload && ('string' !== typeof payload)
+        && ('undefined' === typeof payload.byteLength)
+        && ('undefined' === typeof payload.buffer)
+      ) {
+        payload = JSON.stringify(payload);
+      }
+      // Converting to a buffer, even if it was just converted to a string
+      if ('string' === typeof payload) {
+        payload = Enc.binToBuf(payload);
+      }
+
+      // node specifies RSA-SHAxxx even when it's actually ecdsa (it's all encoded x509 shasums anyway)
+      var protected64 = Enc.strToUrlBase64(protectedHeader);
+      var payload64 = Enc.bufToUrlBase64(payload);
+      var msg = protected64 + '.' + payload64;
+
+      return Keypairs._sign(opts, msg).then(function (buf) {
+        var signedMsg = {
+          protected: protected64
+        , payload: payload64
+        , signature: Enc.bufToUrlBase64(buf)
+        };
+
+        return signedMsg;
+      });
+    }
+
+    if (opts.jwk) {
+      return sign();
+    } else {
+      return Keypairs.import({ pem: opts.pem }).then(function (pair) {
+        opts.jwk = pair.private;
+        return sign();
+      });
+    }
+  });
+};
+
+Keypairs._sign = function (opts, payload) {
+  return Keypairs._import(opts).then(function (privkey) {
+    if ('string' === typeof payload) {
+      payload = (new TextEncoder()).encode(payload);
+    }
+    return window.crypto.subtle.sign(
+      { name: Keypairs._getName(opts)
+      , hash: { name: 'SHA-' + Keypairs._getBits(opts) }
+      }
+    , privkey
+    , payload
+    ).then(function (signature) {
+      signature = new Uint8Array(signature); // ArrayBuffer -> u8
+      // This will come back into play for CSRs, but not for JOSE
+      if ('EC' === opts.jwk.kty && /x509|asn1/i.test(opts.format)) {
+        return Keypairs._ecdsaJoseSigToAsn1Sig(signature);
+      } else {
+        // jose/jws/jwt
+        return signature;
+      }
+    });
+  });
+};
+Keypairs._getBits = function (opts) {
+  if (opts.alg) { return opts.alg.replace(/[a-z\-]/ig, ''); }
+  // base64 len to byte len
+  var len = Math.floor((opts.jwk.n||'').length * 0.75);
+
+  // TODO this may be a bug
+  // need to confirm that the padding is no more or less than 1 byte
+  if (/521/.test(opts.jwk.crv) || len >= 511) {
+    return '512';
+  } else if (/384/.test(opts.jwk.crv) || len >= 383) {
+    return '384';
+  }
+
+  return '256';
+};
+Keypairs._getName = function (opts) {
+  if (/EC/i.test(opts.jwk.kty)) {
+    return 'ECDSA';
+  } else {
+    return 'RSASSA-PKCS1-v1_5';
+  }
+};
+Keypairs._import = function (opts) {
+  return Promise.resolve().then(function () {
+    var ops;
+    // all private keys just happen to have a 'd'
+    if (opts.jwk.d) {
+      ops = [ 'sign' ];
+    } else {
+      ops = [ 'verify' ];
+    }
+    // gotta mark it as extractable, as if it matters
+    opts.jwk.ext = true;
+    opts.jwk.key_ops = ops;
+
+    return window.crypto.subtle.importKey(
+      "jwk"
+    , opts.jwk
+    , { name: Keypairs._getName(opts)
+      , namedCurve: opts.jwk.crv
+      , hash: { name: 'SHA-' + Keypairs._getBits(opts) } }
+    , true
+    , ops
+    ).then(function (privkey) {
+      delete opts.jwk.ext;
+      return privkey;
+    });
+  });
+};
+// ECDSA JOSE / JWS / JWT signatures differ from "normal" ASN1/X509 ECDSA signatures
+// https://tools.ietf.org/html/rfc7518#section-3.4
+Keypairs._ecdsaJoseSigToAsn1Sig = function (bufsig) {
+  // it's easier to do the manipulation in the browser with an array
+  bufsig = Array.from(bufsig);
+  var hlen = bufsig.length / 2; // should be even
+  var r = bufsig.slice(0, hlen);
+  var s = bufsig.slice(hlen);
+  // unpad positive ints less than 32 bytes wide
+  while (!r[0]) { r = r.slice(1); }
+  while (!s[0]) { s = s.slice(1); }
+  // pad (or re-pad) ambiguously non-negative BigInts, up to 33 bytes wide
+  if (0x80 & r[0]) { r.unshift(0); }
+  if (0x80 & s[0]) { s.unshift(0); }
+
+  var len = 2 + r.length + 2 + s.length;
+  var head = [0x30];
+  // hard code 0x80 + 1 because it won't be longer than
+  // two SHA512 plus two pad bytes (130 bytes <= 256)
+  if (len >= 0x80) { head.push(0x81); }
+  head.push(len);
+
+  return Uint8Array.from(head.concat([0x02, r.length], r, [0x02, s.length], s));
+};
+
+function setTime(time) {
+  if ('number' === typeof time) { return time; }
+
+  var t = time.match(/^(\-?\d+)([dhms])$/i);
+  if (!t || !t[0]) {
+    throw new Error("'" + time + "' should be datetime in seconds or human-readable format (i.e. 3d, 1h, 15m, 30s");
+  }
+
+  var now = Math.round(Date.now()/1000);
+  var num = parseInt(t[1], 10);
+  var unit = t[2];
+  var mult = 1;
+  switch(unit) {
+    // fancy fallthrough, what fun!
+    case 'd':
+      mult *= 24;
+      /*falls through*/
+    case 'h':
+      mult *= 60;
+      /*falls through*/
+    case 'm':
+      mult *= 60;
+      /*falls through*/
+    case 's':
+      mult *= 1;
+  }
+
+  return now + (mult * num);
+}
+
+Enc.hexToBuf = function (hex) {
+  var arr = [];
+  hex.match(/.{2}/g).forEach(function (h) {
+    arr.push(parseInt(h, 16));
+  });
+  return 'undefined' !== typeof Uint8Array ? new Uint8Array(arr) : arr;
+};
+Enc.strToUrlBase64 = function (str) {
+  return Enc.bufToUrlBase64(Enc.binToBuf(str));
+};
+Enc.binToBuf = function (bin) {
+  var arr = bin.split('').map(function (ch) {
+    return ch.charCodeAt(0);
+  });
+  return 'undefined' !== typeof Uint8Array ? new Uint8Array(arr) : arr;
+};
+
+}('undefined' !== typeof module ? module.exports : window));
+// Copyright 2018 AJ ONeal. All rights reserved
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+;(function (exports) {
+'use strict';
+
+if (!exports.ASN1) { exports.ASN1 = {}; }
+if (!exports.Enc) { exports.Enc = {}; }
+if (!exports.PEM) { exports.PEM = {}; }
+
+var ASN1 = exports.ASN1;
+var Enc = exports.Enc;
+var PEM = exports.PEM;
+
+//
+// Parser
+//
+
+// Although I've only seen 9 max in https certificates themselves,
+// but each domain list could have up to 100
+ASN1.ELOOPN = 102;
+ASN1.ELOOP = "uASN1.js Error: iterated over " + ASN1.ELOOPN + "+ elements (probably a malformed file)";
+// I've seen https certificates go 29 deep
+ASN1.EDEEPN = 60;
+ASN1.EDEEP = "uASN1.js Error: element nested " + ASN1.EDEEPN + "+ layers deep (probably a malformed file)";
+// Container Types are Sequence 0x30, Container Array? (0xA0, 0xA1)
+// Value Types are Boolean 0x01, Integer 0x02, Null 0x05, Object ID 0x06, String 0x0C, 0x16, 0x13, 0x1e Value Array? (0x82)
+// Bit String (0x03) and Octet String (0x04) may be values or containers
+// Sometimes Bit String is used as a container (RSA Pub Spki)
+ASN1.CTYPES = [ 0x30, 0x31, 0xa0, 0xa1 ];
+ASN1.VTYPES = [ 0x01, 0x02, 0x05, 0x06, 0x0c, 0x82 ];
+ASN1.parse = function parseAsn1Helper(buf) {
+  //var ws = '  ';
+  function parseAsn1(buf, depth, eager) {
+    if (depth.length >= ASN1.EDEEPN) { throw new Error(ASN1.EDEEP); }
+
+    var index = 2; // we know, at minimum, data starts after type (0) and lengthSize (1)
+    var asn1 = { type: buf[0], lengthSize: 0, length: buf[1] };
+    var child;
+    var iters = 0;
+    var adjust = 0;
+    var adjustedLen;
+
+    // Determine how many bytes the length uses, and what it is
+    if (0x80 & asn1.length) {
+      asn1.lengthSize = 0x7f & asn1.length;
+      // I think that buf->hex->int solves the problem of Endianness... not sure
+      asn1.length = parseInt(Enc.bufToHex(buf.slice(index, index + asn1.lengthSize)), 16);
+      index += asn1.lengthSize;
+    }
+
+    // High-order bit Integers have a leading 0x00 to signify that they are positive.
+    // Bit Streams use the first byte to signify padding, which x.509 doesn't use.
+    if (0x00 === buf[index] && (0x02 === asn1.type || 0x03 === asn1.type)) {
+      // However, 0x00 on its own is a valid number
+      if (asn1.length > 1) {
+        index += 1;
+        adjust = -1;
+      }
+    }
+    adjustedLen = asn1.length + adjust;
+
+    //console.warn(depth.join(ws) + '0x' + Enc.numToHex(asn1.type), index, 'len:', asn1.length, asn1);
+
+    function parseChildren(eager) {
+      asn1.children = [];
+      //console.warn('1 len:', (2 + asn1.lengthSize + asn1.length), 'idx:', index, 'clen:', 0);
+      while (iters < ASN1.ELOOPN && index < (2 + asn1.length + asn1.lengthSize)) {
+        iters += 1;
+        depth.length += 1;
+        child = parseAsn1(buf.slice(index, index + adjustedLen), depth, eager);
+        depth.length -= 1;
+        // The numbers don't match up exactly and I don't remember why...
+        // probably something with adjustedLen or some such, but the tests pass
+        index += (2 + child.lengthSize + child.length);
+        //console.warn('2 len:', (2 + asn1.lengthSize + asn1.length), 'idx:', index, 'clen:', (2 + child.lengthSize + child.length));
+        if (index > (2 + asn1.lengthSize + asn1.length)) {
+          if (!eager) { console.error(JSON.stringify(asn1, ASN1._replacer, 2)); }
+          throw new Error("Parse error: child value length (" + child.length
+            + ") is greater than remaining parent length (" + (asn1.length - index)
+            + " = " + asn1.length + " - " + index + ")");
+        }
+        asn1.children.push(child);
+        //console.warn(depth.join(ws) + '0x' + Enc.numToHex(asn1.type), index, 'len:', asn1.length, asn1);
+      }
+      if (index !== (2 + asn1.lengthSize + asn1.length)) {
+        //console.warn('index:', index, 'length:', (2 + asn1.lengthSize + asn1.length));
+        throw new Error("premature end-of-file");
+      }
+      if (iters >= ASN1.ELOOPN) { throw new Error(ASN1.ELOOP); }
+
+      delete asn1.value;
+      return asn1;
+    }
+
+    // Recurse into types that are _always_ containers
+    if (-1 !== ASN1.CTYPES.indexOf(asn1.type)) { return parseChildren(eager); }
+
+    // Return types that are _always_ values
+    asn1.value = buf.slice(index, index + adjustedLen);
+    if (-1 !== ASN1.VTYPES.indexOf(asn1.type)) { return asn1; }
+
+    // For ambigious / unknown types, recurse and return on failure
+    // (and return child array size to zero)
+    try { return parseChildren(true); }
+    catch(e) { asn1.children.length = 0; return asn1; }
+  }
+
+  var asn1 = parseAsn1(buf, []);
+  var len = buf.byteLength || buf.length;
+  if (len !== 2 + asn1.lengthSize + asn1.length) {
+    throw new Error("Length of buffer does not match length of ASN.1 sequence.");
+  }
+  return asn1;
+};
+ASN1._replacer = function (k, v) {
+  if ('type' === k) { return '0x' + Enc.numToHex(v); }
+  if (v && 'value' === k) { return '0x' + Enc.bufToHex(v.data || v); }
+  return v;
+};
+
+// don't replace the full parseBlock, if it exists
+PEM.parseBlock = PEM.parseBlock || function (str) {
+  var der = str.split(/\n/).filter(function (line) {
+    return !/-----/.test(line);
+  }).join('');
+  return { bytes: Enc.base64ToBuf(der) };
+};
+
+Enc.base64ToBuf = function (b64) {
+  return Enc.binToBuf(atob(b64));
+};
+Enc.binToBuf = function (bin) {
+  var arr = bin.split('').map(function (ch) {
+    return ch.charCodeAt(0);
+  });
+  return 'undefined' !== typeof Uint8Array ? new Uint8Array(arr) : arr;
+};
+Enc.bufToHex = function (u8) {
+  var hex = [];
+  var i, h;
+  var len = (u8.byteLength || u8.length);
+
+  for (i = 0; i < len; i += 1) {
+    h = u8[i].toString(16);
+    if (h.length % 2) { h = '0' + h; }
+    hex.push(h);
+  }
+
+  return hex.join('').toLowerCase();
+};
+Enc.numToHex = function (d) {
+  d = d.toString(16);
+  if (d.length % 2) {
+    return '0' + d;
+  }
+  return d;
+};
+
+}('undefined' !== typeof window ? window : module.exports));
+// Copyright 2018-present AJ ONeal. All rights reserved
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+(function (exports) {
+'use strict';
+/*global Promise*/
+
+var ASN1 = exports.ASN1;
+var Enc = exports.Enc;
+var PEM = exports.PEM;
+var X509 = exports.x509;
+var Keypairs = exports.Keypairs;
+
+// TODO find a way that the prior node-ish way of `module.exports = function () {}` isn't broken
+var CSR = exports.CSR = function (opts) {
+  // We're using a Promise here to be compatible with the browser version
+  // which will probably use the webcrypto API for some of the conversions
+  return CSR._prepare(opts).then(function (opts) {
+    return CSR.create(opts).then(function (bytes) {
+      return CSR._encode(opts, bytes);
+    });
+  });
+};
+
+CSR._prepare = function (opts) {
+  return Promise.resolve().then(function () {
+    var Keypairs;
+    opts = JSON.parse(JSON.stringify(opts));
+
+    // We do a bit of extra error checking for user convenience
+    if (!opts) { throw new Error("You must pass options with key and domains to rsacsr"); }
+    if (!Array.isArray(opts.domains) || 0 === opts.domains.length) {
+      new Error("You must pass options.domains as a non-empty array");
+    }
+
+    // I need to check that 例.中国 is a valid domain name
+    if (!opts.domains.every(function (d) {
+      // allow punycode? xn--
+      if ('string' === typeof d /*&& /\./.test(d) && !/--/.test(d)*/) {
+        return true;
+      }
+    })) {
+      throw new Error("You must pass options.domains as strings");
+    }
+
+    if (opts.jwk) { return opts; }
+    if (opts.key && opts.key.kty) {
+      opts.jwk = opts.key;
+      return opts;
+    }
+    if (!opts.pem && !opts.key) {
+      throw new Error("You must pass options.key as a JSON web key");
+    }
+
+    Keypairs = exports.Keypairs;
+    if (!exports.Keypairs) {
+      throw new Error("Keypairs.js is an optional dependency for PEM-to-JWK.\n"
+        + "Install it if you'd like to use it:\n"
+        + "\tnpm install --save rasha\n"
+        + "Otherwise supply a jwk as the private key."
+      );
+    }
+
+    return Keypairs.import({ pem: opts.pem || opts.key }).then(function (pair) {
+      opts.jwk = pair.private;
+      return opts;
+    });
+  });
+};
+
+CSR._encode = function (opts, bytes) {
+  if ('der' === (opts.encoding||'').toLowerCase()) {
+    return bytes;
+  }
+  return PEM.packBlock({
+    type: "CERTIFICATE REQUEST"
+  , bytes: bytes /* { jwk: jwk, domains: opts.domains } */
+  });
+};
+
+CSR.create = function createCsr(opts) {
+  var hex = CSR.request(opts.jwk, opts.domains);
+  return CSR._sign(opts.jwk, hex).then(function (csr) {
+    return Enc.hexToBuf(csr);
+  });
+};
+
+//
+// EC / RSA
+//
+CSR.request = function createCsrBodyEc(jwk, domains) {
+  var asn1pub;
+  if (/^EC/i.test(jwk.kty)) {
+    asn1pub = X509.packCsrEcPublicKey(jwk);
+  } else {
+    asn1pub = X509.packCsrRsaPublicKey(jwk);
+  }
+  return X509.packCsr(asn1pub, domains);
+};
+
+CSR._sign = function csrEcSig(jwk, request) {
+  // Took some tips from https://gist.github.com/codermapuche/da4f96cdb6d5ff53b7ebc156ec46a10a
+  // TODO will have to convert web ECDSA signatures to PEM ECDSA signatures (but RSA should be the same)
+  // TODO have a consistent non-private way to sign
+  return Keypairs._sign({ jwk: jwk, format: 'x509' }, Enc.hexToBuf(request)).then(function (sig) {
+    return CSR._toDer({ request: request, signature: sig, kty: jwk.kty });
+  });
+};
+
+CSR._toDer = function encode(opts) {
+  var sty;
+  if (/^EC/i.test(opts.kty)) {
+    // 1.2.840.10045.4.3.2 ecdsaWithSHA256 (ANSI X9.62 ECDSA algorithm with SHA256)
+    sty = ASN1('30', ASN1('06', '2a8648ce3d040302'));
+  } else {
+    // 1.2.840.113549.1.1.11 sha256WithRSAEncryption (PKCS #1)
+    sty = ASN1('30', ASN1('06', '2a864886f70d01010b'), ASN1('05'));
+  }
+  return ASN1('30'
+    // The Full CSR Request Body
+  , opts.request
+    // The Signature Type
+  , sty
+    // The Signature
+  , ASN1.BitStr(Enc.bufToHex(opts.signature))
+  );
+};
+
+X509.packCsr = function (asn1pubkey, domains) {
+  return ASN1('30'
+    // Version (0)
+  , ASN1.UInt('00')
+
+    // 2.5.4.3 commonName (X.520 DN component)
+  , ASN1('30', ASN1('31', ASN1('30', ASN1('06', '550403'), ASN1('0c', Enc.utf8ToHex(domains[0])))))
+
+    // Public Key (RSA or EC)
+  , asn1pubkey
+
+    // Request Body
+  , ASN1('a0'
+    , ASN1('30'
+        // 1.2.840.113549.1.9.14 extensionRequest (PKCS #9 via CRMF)
+      , ASN1('06', '2a864886f70d01090e')
+      , ASN1('31'
+        , ASN1('30'
+          , ASN1('30'
+              // 2.5.29.17 subjectAltName (X.509 extension)
+            , ASN1('06', '551d11')
+            , ASN1('04'
+              , ASN1('30', domains.map(function (d) {
+                  return ASN1('82', Enc.utf8ToHex(d));
+                }).join(''))))))))
+  );
+};
+
+// TODO finish this later
+// we want to parse the domains, the public key, and verify the signature
+CSR._info = function (der) {
+  // standard base64 PEM
+  if ('string' === typeof der && '-' === der[0]) {
+    der = PEM.parseBlock(der).bytes;
+  }
+  // jose urlBase64 not-PEM
+  if ('string' === typeof der) {
+    der = Enc.base64ToBuf(der);
+  }
+  // not supporting binary-encoded bas64
+  var c = ASN1.parse(der);
+  var kty;
+  // A cert has 3 parts: cert, signature meta, signature
+  if (c.children.length !== 3) {
+    throw new Error("doesn't look like a certificate request: expected 3 parts of header");
+  }
+  var sig = c.children[2];
+  if (sig.children.length) {
+    // ASN1/X509 EC
+    sig = sig.children[0];
+    sig = ASN1('30', ASN1.UInt(Enc.bufToHex(sig.children[0].value)), ASN1.UInt(Enc.bufToHex(sig.children[1].value)));
+    sig = Enc.hexToBuf(sig);
+    kty = 'EC';
+  } else {
+    // Raw RSA Sig
+    sig = sig.value;
+    kty = 'RSA';
+  }
+  //c.children[1]; // signature type
+  var req = c.children[0];
+  // TODO utf8
+  if (4 !== req.children.length) {
+    throw new Error("doesn't look like a certificate request: expected 4 parts to request");
+  }
+  // 0 null
+  // 1 commonName / subject
+  var sub = Enc.bufToBin(req.children[1].children[0].children[0].children[1].value);
+  // 3 public key (type, key)
+  //console.log('oid', Enc.bufToHex(req.children[2].children[0].children[0].value));
+  var pub;
+  // TODO reuse ASN1 parser for these?
+  if ('EC' === kty) {
+    // throw away compression byte
+    pub = req.children[2].children[1].value.slice(1);
+    pub = { kty: kty, x: pub.slice(0, 32), y: pub.slice(32) };
+    while (0 === pub.x[0]) { pub.x = pub.x.slice(1); }
+    while (0 === pub.y[0]) { pub.y = pub.y.slice(1); }
+    if ((pub.x.length || pub.x.byteLength) > 48) {
+      pub.crv = 'P-521';
+    } else if ((pub.x.length || pub.x.byteLength) > 32) {
+      pub.crv = 'P-384';
+    } else {
+      pub.crv = 'P-256';
+    }
+    pub.x = Enc.bufToUrlBase64(pub.x);
+    pub.y = Enc.bufToUrlBase64(pub.y);
+  } else {
+    pub = req.children[2].children[1].children[0];
+    pub = { kty: kty, n: pub.children[0].value, e: pub.children[1].value };
+    while (0 === pub.n[0]) { pub.n = pub.n.slice(1); }
+    while (0 === pub.e[0]) { pub.e = pub.e.slice(1); }
+    pub.n = Enc.bufToUrlBase64(pub.n);
+    pub.e = Enc.bufToUrlBase64(pub.e);
+  }
+  // 4 extensions
+  var domains = req.children[3].children.filter(function (seq) {
+    //  1.2.840.113549.1.9.14 extensionRequest (PKCS #9 via CRMF)
+    if ('2a864886f70d01090e' === Enc.bufToHex(seq.children[0].value)) {
+      return true;
+    }
+  }).map(function (seq) {
+    return seq.children[1].children[0].children.filter(function (seq2) {
+      // subjectAltName (X.509 extension)
+      if ('551d11' === Enc.bufToHex(seq2.children[0].value)) {
+        return true;
+      }
+    }).map(function (seq2) {
+      return seq2.children[1].children[0].children.map(function (name) {
+        // TODO utf8
+        return Enc.bufToBin(name.value);
+      });
+    })[0];
+  })[0];
+
+  return {
+    subject: sub
+  , altnames: domains
+  , jwk: pub
+  , signature: sig
+  };
+};
+
+X509.packCsrRsaPublicKey = function (jwk) {
+  // Sequence the key
+  var n = ASN1.UInt(Enc.base64ToHex(jwk.n));
+  var e = ASN1.UInt(Enc.base64ToHex(jwk.e));
+  var asn1pub = ASN1('30', n, e);
+
+  // Add the CSR pub key header
+  return ASN1('30', ASN1('30', ASN1('06', '2a864886f70d010101'), ASN1('05')), ASN1.BitStr(asn1pub));
+};
+
+X509.packCsrEcPublicKey = function (jwk) {
+  var ecOid = X509._oids[jwk.crv];
+  if (!ecOid) {
+    throw new Error("Unsupported namedCurve '" + jwk.crv + "'. Supported types are " + Object.keys(X509._oids));
+  }
+  var cmp = '04'; // 04 == x+y, 02 == x-only
+  var hxy = '';
+  // Placeholder. I'm not even sure if compression should be supported.
+  if (!jwk.y) { cmp = '02'; }
+  hxy += Enc.base64ToHex(jwk.x);
+  if (jwk.y) { hxy += Enc.base64ToHex(jwk.y); }
+
+  // 1.2.840.10045.2.1 ecPublicKey
+  return ASN1('30', ASN1('30', ASN1('06', '2a8648ce3d0201'), ASN1('06', ecOid)), ASN1.BitStr(cmp + hxy));
+};
+X509._oids = {
+  // 1.2.840.10045.3.1.7 prime256v1
+  // (ANSI X9.62 named elliptic curve) (06 08 - 2A 86 48 CE 3D 03 01 07)
+  'P-256': '2a8648ce3d030107'
+  // 1.3.132.0.34 P-384 (06 05 - 2B 81 04 00 22)
+  // (SEC 2 recommended EC domain secp256r1)
+, 'P-384': '2b81040022'
+  // requires more logic and isn't a recommended standard
+  // 1.3.132.0.35 P-521 (06 05 - 2B 81 04 00 23)
+  // (SEC 2 alternate P-521)
+//, 'P-521': '2B 81 04 00 23'
+};
+
+// don't replace the full parseBlock, if it exists
+PEM.parseBlock = PEM.parseBlock || function (str) {
+  var der = str.split(/\n/).filter(function (line) {
+    return !/-----/.test(line);
+  }).join('');
+  return { bytes: Enc.base64ToBuf(der) };
+};
+
+}('undefined' === typeof window ? module.exports : window));
+// Copyright 2018-present AJ ONeal. All rights reserved
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+(function (exports) {
+'use strict';
+/* globals Promise */
+
+var ACME = exports.ACME = {};
+//var Keypairs = exports.Keypairs || {};
+//var CSR = exports.CSR;
+var Enc = exports.Enc || {};
+var Crypto = exports.Crypto || {};
+
+ACME.formatPemChain = function formatPemChain(str) {
+  return str.trim().replace(/[\r\n]+/g, '\n').replace(/\-\n\-/g, '-\n\n-') + '\n';
+};
+ACME.splitPemChain = function splitPemChain(str) {
+  return str.trim().split(/[\r\n]{2,}/g).map(function (str) {
+    return str + '\n';
+  });
+};
+
+
+// http-01: GET https://example.org/.well-known/acme-challenge/{{token}} => {{keyAuth}}
+// dns-01: TXT _acme-challenge.example.org. => "{{urlSafeBase64(sha256(keyAuth))}}"
+ACME.challengePrefixes = {
+  'http-01': '/.well-known/acme-challenge'
+, 'dns-01': '_acme-challenge'
+};
+ACME.challengeTests = {
+  'http-01': function (me, auth) {
+    return me.http01(auth).then(function (keyAuth) {
+      var err;
+
+      // TODO limit the number of bytes that are allowed to be downloaded
+      if (auth.keyAuthorization === (keyAuth||'').trim()) {
+        return true;
+      }
+
+      err = new Error(
+        "Error: Failed HTTP-01 Pre-Flight / Dry Run.\n"
+      + "curl '" + auth.challengeUrl + "'\n"
+      + "Expected: '" + auth.keyAuthorization + "'\n"
+      + "Got: '" + keyAuth + "'\n"
+      + "See https://git.coolaj86.com/coolaj86/acme-v2.js/issues/4"
+      );
+      err.code = 'E_FAIL_DRY_CHALLENGE';
+      return Promise.reject(err);
+    });
+  }
+, 'dns-01': function (me, auth) {
+    // remove leading *. on wildcard domains
+    return me.dns01(auth).then(function (ans) {
+      var err;
+
+      if (ans.answer.some(function (txt) {
+        return auth.dnsAuthorization === txt.data[0];
+      })) {
+        return true;
+      }
+
+      err = new Error(
+        "Error: Failed DNS-01 Pre-Flight Dry Run.\n"
+      + "dig TXT '" + auth.dnsHost + "' does not return '" + auth.dnsAuthorization + "'\n"
+      + "See https://git.coolaj86.com/coolaj86/acme-v2.js/issues/4"
+      );
+      err.code = 'E_FAIL_DRY_CHALLENGE';
+      return Promise.reject(err);
+    });
+  }
+};
+
+ACME._directory = function (me) {
+  // GET-as-GET ok
+  return me.request({ method: 'GET', url: me.directoryUrl, json: true });
+};
+ACME._getNonce = function (me) {
+  // GET-as-GET, HEAD-as-HEAD ok
+  var nonce;
+  while (true) {
+    nonce = me._nonces.shift();
+    if (!nonce) { break; }
+    if (Date.now() - nonce.createdAt > (15 * 60 * 1000)) {
+      nonce = null;
+    } else {
+      break;
+    }
+  }
+  if (nonce) { return Promise.resolve(nonce.nonce); }
+  return me.request({ method: 'HEAD', url: me._directoryUrls.newNonce }).then(function (resp) {
+    return resp.headers['replay-nonce'];
+  });
+};
+ACME._setNonce = function (me, nonce) {
+  me._nonces.unshift({ nonce: nonce, createdAt: Date.now() });
+};
+// ACME RFC Section 7.3 Account Creation
+/*
+ {
+   "protected": base64url({
+     "alg": "ES256",
+     "jwk": {...},
+     "nonce": "6S8IqOGY7eL2lsGoTZYifg",
+     "url": "https://example.com/acme/new-account"
+   }),
+   "payload": base64url({
+     "termsOfServiceAgreed": true,
+     "onlyReturnExisting": false,
+     "contact": [
+       "mailto:cert-admin@example.com",
+       "mailto:admin@example.com"
+     ]
+   }),
+   "signature": "RZPOnYoPs1PhjszF...-nh6X1qtOFPB519I"
+ }
+*/
+ACME._registerAccount = function (me, options) {
+  if (me.debug) { console.debug('[acme-v2] accounts.create'); }
+
+  return new Promise(function (resolve, reject) {
+
+    function agree(tosUrl) {
+      var err;
+      if (me._tos !== tosUrl) {
+        err = new Error("You must agree to the ToS at '" + me._tos + "'");
+        err.code = "E_AGREE_TOS";
+        reject(err);
+        return;
+      }
+
+      return ACME._importKeypair(me, options.accountKeypair).then(function (pair) {
+        var contact;
+        if (options.contact) {
+          contact = options.contact.slice(0);
+        } else if (options.email) {
+          contact = [ 'mailto:' + options.email ];
+        }
+        var body = {
+          termsOfServiceAgreed: tosUrl === me._tos
+        , onlyReturnExisting: false
+        , contact: contact
+        };
+        var pExt;
+        if (options.externalAccount) {
+          pExt = me.Keypairs.signJws({
+            // TODO is HMAC the standard, or is this arbitrary?
+            secret: options.externalAccount.secret
+          , protected: {
+              alg: options.externalAccount.alg || "HS256"
+            , kid: options.externalAccount.id
+            , url: me._directoryUrls.newAccount
+            }
+          , payload: Enc.binToBuf(JSON.stringify(pair.public))
+          }).then(function (jws) {
+            body.externalAccountBinding = jws;
+            return body;
+          });
+        } else {
+          pExt = Promise.resolve(body);
+        }
+        return pExt.then(function (body) {
+          var payload = JSON.stringify(body);
+          return ACME._jwsRequest(me, {
+            options: options
+          , url: me._directoryUrls.newAccount
+          , protected: { kid: false, jwk: pair.public }
+          , payload: Enc.binToBuf(payload)
+          }).then(function (resp) {
+            var account = resp.body;
+
+            if (2 !== Math.floor(resp.statusCode / 100)) {
+              throw new Error('account error: ' + JSON.stringify(resp.body));
+            }
+
+            var location = resp.headers.location;
+            // the account id url
+            options._kid = location;
+            if (me.debug) { console.debug('[DEBUG] new account location:'); }
+            if (me.debug) { console.debug(location); }
+            if (me.debug) { console.debug(resp); }
+
+            /*
+            {
+              contact: ["mailto:jon@example.com"],
+              orders: "https://some-url",
+              status: 'valid'
+            }
+            */
+            if (!account) { account = { _emptyResponse: true }; }
+            // https://git.coolaj86.com/coolaj86/acme-v2.js/issues/8
+            if (!account.key) { account.key = {}; }
+            account.key.kid = options._kid;
+            return account;
+          }).then(resolve, reject);
+        });
+      });
+    }
+
+    if (me.debug) { console.debug('[acme-v2] agreeToTerms'); }
+    if (1 === options.agreeToTerms.length) {
+      // newer promise API
+      return Promise.resolve(options.agreeToTerms(me._tos)).then(agree, reject);
+    }
+    else if (2 === options.agreeToTerms.length) {
+      // backwards compat cb API
+      return options.agreeToTerms(me._tos, function (err, tosUrl) {
+        if (!err) { agree(tosUrl); return; }
+        reject(err);
+      });
+    }
+    else {
+      reject(new Error('agreeToTerms has incorrect function signature.'
+        + ' Should be fn(tos) { return Promise<tos>; }'));
+    }
+  });
+};
+/*
+ POST /acme/new-order HTTP/1.1
+ Host: example.com
+ Content-Type: application/jose+json
+
+ {
+   "protected": base64url({
+     "alg": "ES256",
+     "kid": "https://example.com/acme/acct/1",
+     "nonce": "5XJ1L3lEkMG7tR6pA00clA",
+     "url": "https://example.com/acme/new-order"
+   }),
+   "payload": base64url({
+     "identifiers": [{"type:"dns","value":"example.com"}],
+     "notBefore": "2016-01-01T00:00:00Z",
+     "notAfter": "2016-01-08T00:00:00Z"
+   }),
+   "signature": "H6ZXtGjTZyUnPeKn...wEA4TklBdh3e454g"
+ }
+*/
+ACME._getChallenges = function (me, options, authUrl) {
+  if (me.debug) { console.debug('\n[DEBUG] getChallenges\n'); }
+  // TODO POST-as-GET
+
+  return ACME._jwsRequest(me, {
+    options: options
+  , protected: {}
+  , payload: ''
+  , url: authUrl
+  }).then(function (resp) {
+    return resp.body;
+  });
+};
+ACME._wait = function wait(ms) {
+  return new Promise(function (resolve) {
+    setTimeout(resolve, (ms || 1100));
+  });
+};
+
+ACME._testChallengeOptions = function () {
+  var chToken = ACME._prnd(16);
+  return [
+    {
+      "type": "http-01",
+      "status": "pending",
+      "url": "https://acme-staging-v02.example.com/0",
+      "token": "test-" + chToken + "-0"
+    }
+  , {
+      "type": "dns-01",
+      "status": "pending",
+      "url": "https://acme-staging-v02.example.com/1",
+      "token": "test-" + chToken + "-1",
+      "_wildcard": true
+    }
+  , {
+      "type": "tls-sni-01",
+      "status": "pending",
+      "url": "https://acme-staging-v02.example.com/2",
+      "token": "test-" + chToken + "-2"
+    }
+  , {
+      "type": "tls-alpn-01",
+      "status": "pending",
+      "url": "https://acme-staging-v02.example.com/3",
+      "token": "test-" + chToken + "-3"
+    }
+  ];
+};
+ACME._testChallenges = function (me, options) {
+  var CHECK_DELAY = 0;
+  return Promise.all(options.domains.map(function (identifierValue) {
+    // TODO we really only need one to pass, not all to pass
+    var challenges = ACME._testChallengeOptions();
+    if (identifierValue.includes("*")) {
+      challenges = challenges.filter(function (ch) { return ch._wildcard; });
+    }
+
+    var challenge = ACME._chooseChallenge(options, { challenges: challenges });
+    if (!challenge) {
+      // For example, wildcards require dns-01 and, if we don't have that, we have to bail
+      var enabled = options.challengeTypes.join(', ') || 'none';
+      var suitable = challenges.map(function (r) { return r.type; }).join(', ') || 'none';
+      return Promise.reject(new Error(
+        "None of the challenge types that you've enabled ( " + enabled + " )"
+          + " are suitable for validating the domain you've selected (" + identifierValue + ")."
+          + " You must enable one of ( " + suitable + " )."
+      ));
+    }
+
+    // TODO remove skipChallengeTest
+    if (me.skipDryRun || me.skipChallengeTest) {
+      return null;
+    }
+
+    if ('dns-01' === challenge.type) {
+      // Give the nameservers a moment to propagate
+      CHECK_DELAY = 1.5 * 1000;
+    }
+
+    return Promise.resolve().then(function () {
+      var results = {
+        identifier: {
+          type: "dns"
+        , value: identifierValue.replace(/^\*\./, '')
+        }
+      , challenges: [ challenge ]
+      , expires: new Date(Date.now() + (60 * 1000)).toISOString()
+      , wildcard: identifierValue.includes('*.') || undefined
+      };
+
+      // The dry-run comes first in the spirit of "fail fast"
+      // (and protecting against challenge failure rate limits)
+      var dryrun = true;
+      return ACME._challengeToAuth(me, options, results, challenge, dryrun).then(function (auth) {
+        if (!me._canUse[auth.type]) { return; }
+        return ACME._setChallenge(me, options, auth).then(function () {
+          return auth;
+        });
+      });
+    });
+  })).then(function (auths) {
+    auths = auths.filter(Boolean);
+    if (!auths.length) { /*skip actual test*/ return; }
+    return ACME._wait(CHECK_DELAY).then(function () {
+      return Promise.all(auths.map(function (auth) {
+        return ACME.challengeTests[auth.type](me, auth).then(function (result) {
+          // not a blocker
+          ACME._removeChallenge(me, options, auth);
+          return result;
+        });
+      }));
+    });
+  });
+};
+ACME._chooseChallenge = function(options, results) {
+  // For each of the challenge types that we support
+  var challenge;
+  options.challengeTypes.some(function (chType) {
+    // And for each of the challenge types that are allowed
+    return results.challenges.some(function (ch) {
+      // Check to see if there are any matches
+      if (ch.type === chType) {
+        challenge = ch;
+        return true;
+      }
+    });
+  });
+
+  return challenge;
+};
+ACME._challengeToAuth = function (me, options, request, challenge, dryrun) {
+  // we don't poison the dns cache with our dummy request
+  var dnsPrefix = ACME.challengePrefixes['dns-01'];
+  if (dryrun) {
+    dnsPrefix = dnsPrefix.replace('acme-challenge', 'greenlock-dryrun-' + ACME._prnd(4));
+  }
+
+  var auth = {};
+
+  // straight copy from the new order response
+  // { identifier, status, expires, challenges, wildcard }
+  Object.keys(request).forEach(function (key) {
+    auth[key] = request[key];
+  });
+
+  // copy from the challenge we've chosen
+  // { type, status, url, token }
+  // (note the duplicate status overwrites the one above, but they should be the same)
+  Object.keys(challenge).forEach(function (key) {
+    // don't confused devs with the id url
+    auth[key] = challenge[key];
+  });
+
+  // batteries-included helpers
+  auth.hostname = auth.identifier.value;
+  // because I'm not 100% clear if the wildcard identifier does or doesn't have the leading *. in all cases
+  auth.altname = ACME._untame(auth.identifier.value, auth.wildcard);
+  return ACME._importKeypair(me, options.accountKeypair).then(function (pair) {
+    return me.Keypairs.thumbprint({ jwk: pair.public }).then(function (thumb) {
+      auth.thumbprint = thumb;
+      //   keyAuthorization = token || '.' || base64url(JWK_Thumbprint(accountKey))
+      auth.keyAuthorization = challenge.token + '.' + auth.thumbprint;
+      // conflicts with ACME challenge id url is already in use, so we call this challengeUrl instead
+      // TODO auth.http01Url ?
+      auth.challengeUrl = 'http://' + auth.identifier.value + ACME.challengePrefixes['http-01'] + '/' + auth.token;
+      auth.dnsHost = dnsPrefix + '.' + auth.hostname.replace('*.', '');
+
+      return Crypto._sha('sha256', auth.keyAuthorization).then(function (hash) {
+        auth.dnsAuthorization = hash;
+        return auth;
+      });
+    });
+  });
+};
+
+ACME._untame = function (name, wild) {
+  if (wild) { name = '*.' + name.replace('*.', ''); }
+  return name;
+};
+
+// https://tools.ietf.org/html/draft-ietf-acme-acme-10#section-7.5.1
+ACME._postChallenge = function (me, options, auth) {
+  var RETRY_INTERVAL = me.retryInterval || 1000;
+  var DEAUTH_INTERVAL = me.deauthWait || 10 * 1000;
+  var MAX_POLL = me.retryPoll || 8;
+  var MAX_PEND = me.retryPending || 4;
+  var count = 0;
+
+  var altname = ACME._untame(auth.identifier.value, auth.wildcard);
+
+  /*
+   POST /acme/authz/1234 HTTP/1.1
+   Host: example.com
+   Content-Type: application/jose+json
+
+   {
+     "protected": base64url({
+       "alg": "ES256",
+       "kid": "https://example.com/acme/acct/1",
+       "nonce": "xWCM9lGbIyCgue8di6ueWQ",
+       "url": "https://example.com/acme/authz/1234"
+     }),
+     "payload": base64url({
+       "status": "deactivated"
+     }),
+     "signature": "srX9Ji7Le9bjszhu...WTFdtujObzMtZcx4"
+   }
+   */
+  function deactivate() {
+    if (me.debug) { console.debug('[acme-v2.js] deactivate:'); }
+    return ACME._jwsRequest(me, {
+      options: options
+    , url: auth.url
+    , protected: { kid: options._kid }
+    , payload: Enc.binToBuf(JSON.stringify({ "status": "deactivated" }))
+    }).then(function (resp) {
+      if (me.debug) { console.debug('deactivate challenge: resp.body:'); }
+      if (me.debug) { console.debug(resp.body); }
+      return ACME._wait(DEAUTH_INTERVAL);
+    });
+  }
+
+  function pollStatus() {
+    if (count >= MAX_POLL) {
+      return Promise.reject(new Error(
+        "[acme-v2] stuck in bad pending/processing state for '" + altname + "'"
+      ));
+    }
+
+    count += 1;
+
+    if (me.debug) { console.debug('\n[DEBUG] statusChallenge\n'); }
+    // TODO POST-as-GET
+    return me.request({ method: 'GET', url: auth.url, json: true }).then(function (resp) {
+      if ('processing' === resp.body.status) {
+        if (me.debug) { console.debug('poll: again'); }
+        return ACME._wait(RETRY_INTERVAL).then(pollStatus);
+      }
+
+      // This state should never occur
+      if ('pending' === resp.body.status) {
+        if (count >= MAX_PEND) {
+          return ACME._wait(RETRY_INTERVAL).then(deactivate).then(respondToChallenge);
+        }
+        if (me.debug) { console.debug('poll: again'); }
+        return ACME._wait(RETRY_INTERVAL).then(respondToChallenge);
+      }
+
+      if ('valid' === resp.body.status) {
+        if (me.debug) { console.debug('poll: valid'); }
+
+        try {
+          ACME._removeChallenge(me, options, auth);
+        } catch(e) {}
+        return resp.body;
+      }
+
+      var errmsg;
+      if (!resp.body.status) {
+        errmsg = "[acme-v2] (E_STATE_EMPTY) empty challenge state for '" + altname + "':";
+      }
+      else if ('invalid' === resp.body.status) {
+        errmsg = "[acme-v2] (E_STATE_INVALID) challenge state for '" + altname + "': '" + resp.body.status + "'";
+      }
+      else {
+        errmsg = "[acme-v2] (E_STATE_UKN) challenge state for '" + altname + "': '" + resp.body.status + "'";
+      }
+
+      return Promise.reject(new Error(errmsg));
+    });
+  }
+
+  function respondToChallenge() {
+    if (me.debug) { console.debug('[acme-v2.js] responding to accept challenge:'); }
+    return ACME._jwsRequest(me, {
+      options: options
+    , url: auth.url
+    , protected: { kid: options._kid }
+    , payload: Enc.binToBuf(JSON.stringify({}))
+    }).then(function (resp) {
+      if (me.debug) { console.debug('respond to challenge: resp.body:'); }
+      if (me.debug) { console.debug(resp.body); }
+      return ACME._wait(RETRY_INTERVAL).then(pollStatus);
+    });
+  }
+
+  return respondToChallenge();
+};
+ACME._setChallenge = function (me, options, auth) {
+  return new Promise(function (resolve, reject) {
+    var challengers = options.challenges || {};
+    var challenger = (challengers[auth.type] && challengers[auth.type].set) || options.setChallenge;
+    try {
+      if (1 === challenger.length) {
+        challenger(auth).then(resolve).catch(reject);
+      } else if (2 === challenger.length) {
+        challenger(auth, function (err) {
+          if(err) { reject(err); } else { resolve(); }
+        });
+      } else {
+        // TODO remove this old backwards-compat
+        var challengeCb = function(err) {
+          if(err) { reject(err); } else { resolve(); }
+        };
+        // for backwards compat adding extra keys without changing params length
+        Object.keys(auth).forEach(function (key) {
+          challengeCb[key] = auth[key];
+        });
+        if (!ACME._setChallengeWarn) {
+          console.warn("Please update to acme-v2 setChallenge(options) <Promise> or setChallenge(options, cb).");
+          console.warn("The API has been changed for compatibility with all ACME / Let's Encrypt challenge types.");
+          ACME._setChallengeWarn = true;
+        }
+        challenger(auth.identifier.value, auth.token, auth.keyAuthorization, challengeCb);
+      }
+    } catch(e) {
+      reject(e);
+    }
+  }).then(function () {
+    // TODO: Do we still need this delay? Or shall we leave it to plugins to account for themselves?
+    var DELAY = me.setChallengeWait || 500;
+    if (me.debug) { console.debug('\n[DEBUG] waitChallengeDelay %s\n', DELAY); }
+    return ACME._wait(DELAY);
+  });
+};
+ACME._finalizeOrder = function (me, options, validatedDomains) {
+  if (me.debug) { console.debug('finalizeOrder:'); }
+  return ACME._generateCsrWeb64(me, options, validatedDomains).then(function (csr) {
+    var body = { csr: csr };
+    var payload = JSON.stringify(body);
+
+    function pollCert() {
+      if (me.debug) { console.debug('[acme-v2.js] pollCert:'); }
+      return ACME._jwsRequest(me, {
+        options: options
+      , url: options._finalize
+      , protected: { kid: options._kid }
+      , payload: Enc.binToBuf(payload)
+      }).then(function (resp) {
+        if (me.debug) { console.debug('order finalized: resp.body:'); }
+        if (me.debug) { console.debug(resp.body); }
+
+        // https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.1.3
+        // Possible values are: "pending" => ("invalid" || "ready") => "processing" => "valid"
+        if ('valid' === resp.body.status) {
+          options._expires = resp.body.expires;
+          options._certificate = resp.body.certificate;
+
+          return resp.body; // return order
+        }
+
+        if ('processing' === resp.body.status) {
+          return ACME._wait().then(pollCert);
+        }
+
+        if (me.debug) { console.debug("Error: bad status:\n" + JSON.stringify(resp.body, null, 2)); }
+
+        if ('pending' === resp.body.status) {
+          return Promise.reject(new Error(
+            "Did not finalize order: status 'pending'."
+          + " Best guess: You have not accepted at least one challenge for each domain:\n"
+          + "Requested: '" + options.domains.join(', ') + "'\n"
+          + "Validated: '" + validatedDomains.join(', ') + "'\n"
+          + JSON.stringify(resp.body, null, 2)
+          ));
+        }
+
+        if ('invalid' === resp.body.status) {
+          return Promise.reject(new Error(
+            "Did not finalize order: status 'invalid'."
+          + " Best guess: One or more of the domain challenges could not be verified"
+          + " (or the order was canceled).\n"
+          + "Requested: '" + options.domains.join(', ') + "'\n"
+          + "Validated: '" + validatedDomains.join(', ') + "'\n"
+          + JSON.stringify(resp.body, null, 2)
+          ));
+        }
+
+        if ('ready' === resp.body.status) {
+          return Promise.reject(new Error(
+            "Did not finalize order: status 'ready'."
+          + " Hmmm... this state shouldn't be possible here. That was the last state."
+          + " This one should at least be 'processing'.\n"
+          + "Requested: '" + options.domains.join(', ') + "'\n"
+          + "Validated: '" + validatedDomains.join(', ') + "'\n"
+          + JSON.stringify(resp.body, null, 2) + "\n\n"
+          + "Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js"
+          ));
+        }
+
+        return Promise.reject(new Error(
+          "Didn't finalize order: Unhandled status '" + resp.body.status + "'."
+        + " This is not one of the known statuses...\n"
+        + "Requested: '" + options.domains.join(', ') + "'\n"
+        + "Validated: '" + validatedDomains.join(', ') + "'\n"
+        + JSON.stringify(resp.body, null, 2) + "\n\n"
+        + "Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js"
+        ));
+      });
+    }
+
+    return pollCert();
+  });
+};
+// _kid
+// registerAccount
+// postChallenge
+// finalizeOrder
+// getCertificate
+ACME._getCertificate = function (me, options) {
+  if (me.debug) { console.debug('[acme-v2] DEBUG get cert 1'); }
+
+  // Lot's of error checking to inform the user of mistakes
+  if (!(options.challengeTypes||[]).length) {
+    options.challengeTypes = Object.keys(options.challenges||{});
+  }
+  if (!options.challengeTypes.length) {
+    options.challengeTypes = [ options.challengeType ].filter(Boolean);
+  }
+  if (options.challengeType) {
+    options.challengeTypes.sort(function (a, b) {
+      if (a === options.challengeType) { return -1; }
+      if (b === options.challengeType) { return 1; }
+      return 0;
+    });
+    if (options.challengeType !== options.challengeTypes[0]) {
+      return Promise.reject(new Error("options.challengeType is '" + options.challengeType + "',"
+        + " which does not exist in the supplied types '" + options.challengeTypes.join(',') + "'"));
+    }
+  }
+  // TODO check that all challengeTypes are represented in challenges
+  if (!options.challengeTypes.length) {
+    return Promise.reject(new Error("options.challengeTypes (string array) must be specified"
+      + " (and in order of preferential priority)."));
+  }
+  if (options.csr) {
+    // TODO validate csr signature
+    options._csr = me.CSR._info(options.csr);
+    options.domains = options._csr.altnames;
+    if (options._csr.subject !== options.domains[0]) {
+      return Promise.reject(new Error("certificate subject (commonName) does not match first altname (SAN)"));
+    }
+  }
+  if (!(options.domains && options.domains.length)) {
+    return Promise.reject(new Error("options.domains must be a list of string domain names,"
+    + " with the first being the subject of the certificate (or options.subject must specified)."));
+  }
+
+  // It's just fine if there's no account, we'll go get the key id we need via the existing key
+  options._kid = options._kid || options.accountKid
+    || (options.account && (options.account.kid
+      || (options.account.key && options.account.key.kid)));
+  if (!options._kid) {
+    //return Promise.reject(new Error("must include KeyID"));
+    // This is an idempotent request. It'll return the same account for the same public key.
+    return ACME._registerAccount(me, options).then(function (account) {
+      options._kid = account.key.kid;
+      // start back from the top
+      return ACME._getCertificate(me, options);
+    });
+  }
+
+  // Do a little dry-run / self-test
+  return ACME._testChallenges(me, options).then(function () {
+    if (me.debug) { console.debug('[acme-v2] certificates.create'); }
+    var body = {
+      // raw wildcard syntax MUST be used here
+      identifiers: options.domains.sort(function (a, b) {
+        // the first in the list will be the subject of the certificate, I believe (and hope)
+        if (!options.subject) { return 0; }
+        if (options.subject === a) { return -1; }
+        if (options.subject === b) { return 1; }
+        return 0;
+      }).map(function (hostname) {
+        return { type: "dns", value: hostname };
+      })
+      //, "notBefore": "2016-01-01T00:00:00Z"
+      //, "notAfter": "2016-01-08T00:00:00Z"
+    };
+
+    var payload = JSON.stringify(body);
+    if (me.debug) { console.debug('\n[DEBUG] newOrder\n'); }
+    return ACME._jwsRequest(me, {
+      options: options
+    , url: me._directoryUrls.newOrder
+    , protected: { kid: options._kid }
+    , payload: Enc.binToBuf(payload)
+    }).then(function (resp) {
+      var location = resp.headers.location;
+      var setAuths;
+      var validAuths = [];
+      var auths = [];
+      if (me.debug) { console.debug('[ordered]', location); } // the account id url
+      if (me.debug) { console.debug(resp); }
+      options._authorizations = resp.body.authorizations;
+      options._order = location;
+      options._finalize = resp.body.finalize;
+      //if (me.debug) console.debug('[DEBUG] finalize:', options._finalize); return;
+
+      if (!options._authorizations) {
+        return Promise.reject(new Error(
+          "[acme-v2.js] authorizations were not fetched for '" + options.domains.join() + "':\n"
+          + JSON.stringify(resp.body)
+        ));
+      }
+      if (me.debug) { console.debug("[acme-v2] POST newOrder has authorizations"); }
+      setAuths = options._authorizations.slice(0);
+
+      function setNext() {
+        var authUrl = setAuths.shift();
+        if (!authUrl) { return; }
+
+        return ACME._getChallenges(me, options, authUrl).then(function (results) {
+          // var domain = options.domains[i]; // results.identifier.value
+
+          // If it's already valid, we're golden it regardless
+          if (results.challenges.some(function (ch) { return 'valid' === ch.status; })) {
+            return setNext();
+          }
+
+          var challenge = ACME._chooseChallenge(options, results);
+          if (!challenge) {
+            // For example, wildcards require dns-01 and, if we don't have that, we have to bail
+            return Promise.reject(new Error(
+              "Server didn't offer any challenge we can handle for '" + options.domains.join() + "'."
+            ));
+          }
+
+          return ACME._challengeToAuth(me, options, results, challenge, false).then(function (auth) {
+            auths.push(auth);
+            return ACME._setChallenge(me, options, auth).then(setNext);
+          });
+        });
+      }
+
+      function checkNext() {
+        var auth = auths.shift();
+        if (!auth) { return; }
+
+        if (!me._canUse[auth.type] || me.skipChallengeTest) {
+          // not so much "valid" as "not invalid"
+          // but in this case we can't confirm either way
+          validAuths.push(auth);
+          return Promise.resolve();
+        }
+
+        return ACME.challengeTests[auth.type](me, auth).then(function () {
+          validAuths.push(auth);
+        }).then(checkNext);
+      }
+
+      function challengeNext() {
+        var auth = validAuths.shift();
+        if (!auth) { return; }
+        return ACME._postChallenge(me, options, auth).then(challengeNext);
+      }
+
+      // First we set every challenge
+      // Then we ask for each challenge to be checked
+      // Doing otherwise would potentially cause us to poison our own DNS cache with misses
+      return setNext().then(checkNext).then(challengeNext).then(function () {
+        if (me.debug) { console.debug("[getCertificate] next.then"); }
+        var validatedDomains = body.identifiers.map(function (ident) {
+          return ident.value;
+        });
+
+        return ACME._finalizeOrder(me, options, validatedDomains);
+      }).then(function (order) {
+        if (me.debug) { console.debug('acme-v2: order was finalized'); }
+        // TODO POST-as-GET
+        return me.request({ method: 'GET', url: options._certificate, json: true }).then(function (resp) {
+          if (me.debug) { console.debug('acme-v2: csr submitted and cert received:'); }
+          // https://github.com/certbot/certbot/issues/5721
+          var certsarr = ACME.splitPemChain(ACME.formatPemChain((resp.body||'')));
+          //  cert, chain, fullchain, privkey, /*TODO, subject, altnames, issuedAt, expiresAt */
+          var certs = {
+            expires: order.expires
+          , identifiers: order.identifiers
+          //, authorizations: order.authorizations
+          , cert: certsarr.shift()
+          //, privkey: privkeyPem
+          , chain: certsarr.join('\n')
+          };
+          if (me.debug) { console.debug(certs); }
+          return certs;
+        });
+      });
+    });
+  });
+};
+ACME._generateCsrWeb64 = function (me, options, validatedDomains) {
+  var csr;
+  if (options.csr) {
+    csr = options.csr;
+    // if der, convert to base64
+    if ('string' !== typeof csr) { csr = Enc.bufToUrlBase64(csr); }
+    // nix PEM headers, if any
+    if ('-' === csr[0]) { csr = csr.split(/\n+/).slice(1, -1).join(''); }
+    csr = Enc.base64ToUrlBase64(csr.trim().replace(/\s+/g, ''));
+    return Promise.resolve(csr);
+  }
+
+  return ACME._importKeypair(me, options.serverKeypair || options.domainKeypair).then(function (pair) {
+    return me.CSR({ jwk: pair.private, domains: validatedDomains, encoding: 'der' }).then(function (der) {
+      return Enc.bufToUrlBase64(der);
+    });
+  });
+};
+
+ACME.create = function create(me) {
+  if (!me) { me = {}; }
+  // me.debug = true;
+  me.challengePrefixes = ACME.challengePrefixes;
+  me.Keypairs = me.Keypairs || exports.Keypairs || require('keypairs').Keypairs;
+  me.CSR = me.CSR || exports.cSR || require('CSR').CSR;
+  me._nonces = [];
+  me._canUse = {};
+  if (!me._baseUrl) {
+    me._baseUrl = "";
+  }
+  //me.Keypairs = me.Keypairs || require('keypairs');
+  //me.request = me.request || require('@root/request');
+  if (!me.dns01) {
+    me.dns01 = function (auth) {
+      return ACME._dns01(me, auth);
+    };
+  }
+  // backwards compat
+  if (!me.dig) { me.dig = me.dns01; }
+  if (!me.http01) {
+    me.http01 = function (auth) {
+      return ACME._http01(me, auth);
+    };
+  }
+
+  if ('function' !== typeof me.request) {
+    me.request = ACME._defaultRequest;
+  }
+
+  me.init = function (opts) {
+    function fin(dir) {
+      me._directoryUrls = dir;
+      me._tos = dir.meta.termsOfService;
+      return dir;
+    }
+    if (opts && opts.meta && opts.termsOfService) {
+      return Promise.resolve(fin(opts));
+    }
+    if (!me.directoryUrl) { me.directoryUrl = opts; }
+    if ('string' !== typeof me.directoryUrl) {
+      throw new Error("you must supply either the ACME directory url as a string or an object of the ACME urls");
+    }
+    var p = Promise.resolve();
+    if (!me.skipChallengeTest) {
+      p = me.request({ url: me._baseUrl + "/api/_acme_api_/" }).then(function (resp) {
+        if (resp.body.success) {
+          me._canCheck['http-01'] = true;
+          me._canCheck['dns-01'] = true;
+        }
+      }).catch(function () {
+        // ignore
+      });
+    }
+    return p.then(function () {
+      return ACME._directory(me).then(function (resp) {
+        return fin(resp.body);
+      });
+    });
+  };
+  me.accounts = {
+    create: function (options) {
+      return ACME._registerAccount(me, options);
+    }
+  };
+  me.certificates = {
+    create: function (options) {
+      return ACME._getCertificate(me, options);
+    }
+  };
+  return me;
+};
+
+// Handle nonce, signing, and request altogether
+ACME._jwsRequest = function (me, bigopts) {
+  return ACME._getNonce(me).then(function (nonce) {
+    bigopts.protected.nonce = nonce;
+    bigopts.protected.url = bigopts.url;
+    // protected.alg: added by Keypairs.signJws
+    if (!bigopts.protected.jwk) {
+      // protected.kid must be overwritten due to ACME's interpretation of the spec
+      if (!bigopts.protected.kid) { bigopts.protected.kid = bigopts.options._kid; }
+    }
+    return me.Keypairs.signJws(
+      { jwk: bigopts.options.accountKeypair.privateKeyJwk
+      , protected: bigopts.protected
+      , payload: bigopts.payload
+      }
+    ).then(function (jws) {
+      if (me.debug) { console.debug('[acme-v2] ' + bigopts.url + ':'); }
+      if (me.debug) { console.debug(jws); }
+      return ACME._request(me, { url: bigopts.url, json: jws });
+    });
+  });
+};
+// Handle some ACME-specific defaults
+ACME._request = function (me, opts) {
+  if (!opts.headers) { opts.headers = {}; }
+  if (opts.json && true !== opts.json) {
+    opts.headers['Content-Type'] = 'application/jose+json';
+    opts.body = JSON.stringify(opts.json);
+    if (!opts.method) { opts.method = 'POST'; }
+  }
+  return me.request(opts).then(function (resp) {
+    resp = resp.toJSON();
+    if (resp.headers['replay-nonce']) {
+      ACME._setNonce(me, resp.headers['replay-nonce']);
+    }
+    return resp;
+  });
+};
+// A very generic, swappable request lib
+ACME._defaultRequest = function (opts) {
+  // Note: normally we'd have to supply a User-Agent string, but not here in a browser
+  if (!opts.headers) { opts.headers = {}; }
+  if (opts.json) {
+    opts.headers.Accept = 'application/json';
+    if (true !== opts.json) { opts.body = JSON.stringify(opts.json); }
+  }
+  if (!opts.method) {
+    opts.method = 'GET';
+    if (opts.body) { opts.method = 'POST'; }
+  }
+  opts.cors = true;
+  return window.fetch(opts.url, opts).then(function (resp) {
+    var headers = {};
+    var result = { statusCode: resp.status, headers: headers, toJSON: function () { return this; } };
+    Array.from(resp.headers.entries()).forEach(function (h) { headers[h[0]] = h[1]; });
+    if (!headers['content-type']) {
+      return result;
+    }
+    if (/json/.test(headers['content-type'])) {
+      return resp.json().then(function (json) {
+        result.body = json;
+        return result;
+      });
+    }
+    return resp.text().then(function (txt) {
+      result.body = txt;
+      return result;
+    });
+  });
+};
+
+ACME._importKeypair = function (me, kp) {
+  var jwk = kp.privateKeyJwk;
+  var p;
+  if (jwk) {
+    // nix the browser jwk extras
+    jwk.key_ops = undefined;
+    jwk.ext = undefined;
+    p = Promise.resolve({ private: jwk, public: me.Keypairs.neuter({ jwk: jwk }) });
+  } else {
+    p = me.Keypairs.import({ pem: kp.privateKeyPem });
+  }
+  return p.then(function (pair) {
+    kp.privateKeyJwk = pair.private;
+    kp.publicKeyJwk = pair.public;
+    if (pair.public.kid) {
+      pair = JSON.parse(JSON.stringify(pair));
+      delete pair.public.kid;
+      delete pair.private.kid;
+    }
+    return pair;
+  });
+};
+
+/*
+TODO
+Per-Order State Params
+      _kty
+      _alg
+      _finalize
+      _expires
+      _certificate
+      _order
+      _authorizations
+*/
+
+ACME._toWebsafeBase64 = function (b64) {
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g,"");
+};
+
+// In v8 this is crypto random, but we're just using it for pseudorandom
+ACME._prnd = function (n) {
+  var rnd = '';
+  while (rnd.length / 2 < n) {
+    var num = Math.random().toString().substr(2);
+    if (num.length % 2) {
+      num = '0' + num;
+    }
+    var pairs = num.match(/(..?)/g);
+    rnd += pairs.map(ACME._toHex).join('');
+  }
+  return rnd.substr(0, n*2);
+};
+ACME._toHex = function (pair) {
+  return parseInt(pair, 10).toString(16);
+};
+ACME._dns01 = function (me, auth) {
+  return new me.request({ url: me._baseUrl + "/api/dns/" + auth.dnsHost + "?type=TXT" }).then(function (resp) {
+    var err;
+    if (!resp.body || !Array.isArray(resp.body.answer)) {
+      err = new Error("failed to get DNS response");
+      console.error(err);
+      throw err;
+    }
+    if (!resp.body.answer.length) {
+      err = new Error("failed to get DNS answer record in response");
+      console.error(err);
+      throw err;
+    }
+    return {
+      answer: resp.body.answer.map(function (ans) {
+        return { data: ans.data, ttl: ans.ttl };
+      })
+    };
+  });
+};
+ACME._http01 = function (me, auth) {
+  var url = encodeURIComponent(auth.challengeUrl);
+  return new me.request({ url: me._baseUrl + "/api/http?url=" + url }).then(function (resp) {
+    return resp.body;
+  });
+};
+ACME._removeChallenge = function (me, options, auth) {
+  var challengers = options.challenges || {};
+  var removeChallenge = (challengers[auth.type] && challengers[auth.type].remove) || options.removeChallenge;
+  if (1 === removeChallenge.length) {
+    removeChallenge(auth).then(function () {}, function () {});
+  } else if (2 === removeChallenge.length) {
+    removeChallenge(auth, function (err) { return err; });
+  } else {
+    if (!ACME._removeChallengeWarn) {
+      console.warn("Please update to acme-v2 removeChallenge(options) <Promise> or removeChallenge(options, cb).");
+      console.warn("The API has been changed for compatibility with all ACME / Let's Encrypt challenge types.");
+      ACME._removeChallengeWarn = true;
+    }
+    removeChallenge(auth.request.identifier, auth.token, function () {});
+  }
+};
+
+Enc.bufToUrlBase64 = function (u8) {
+  return Enc.bufToBase64(u8)
+    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+Enc.bufToBase64 = function (u8) {
+  var bin = '';
+  u8.forEach(function (i) {
+    bin += String.fromCharCode(i);
+  });
+  return btoa(bin);
+};
+
+Crypto._sha = function (sha, str) {
+  var encoder = new TextEncoder();
+  var data = encoder.encode(str);
+  sha = 'SHA-' + sha.replace(/^sha-?/i, '');
+  return window.crypto.subtle.digest(sha, data).then(function (hash) {
+    return Enc.bufToUrlBase64(new Uint8Array(hash));
+  });
+};
+
+}('undefined' === typeof window ? module.exports : window));
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index 7ab35c7..f4379df 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -78,8 +78,8 @@ if ('undefined' !== typeof fetch) {
     });
   };
 } else {
-  common.requestAsync = require('util').promisify(require('@coolaj86/urequest'));
-  common.reqLocalAsync = require('util').promisify(require('@coolaj86/urequest'));
+  common.requestAsync = require('util').promisify(require('@root/request'));
+  common.reqLocalAsync = require('util').promisify(require('@root/request'));
 }
 
 common.parseUrl = function (hostname) {
diff --git a/lib/cli-common.js b/lib/cli-common.js
index e432a1b..a746882 100644
--- a/lib/cli-common.js
+++ b/lib/cli-common.js
@@ -9,7 +9,7 @@ var fs = require('fs');
 var mkdirp = require('mkdirp');
 var os = require('os');
 var homedir = os.homedir();
-var urequest = require('@coolaj86/urequest');
+var urequest = require('@root/request');
 
 common._NOTIFICATIONS = {
   'newsletter': [ 'newsletter', 'communityMember' ]
diff --git a/package-lock.json b/package-lock.json
index 40acb1c..4fa8db7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,11 @@
       "resolved": "https://registry.npmjs.org/@coolaj86/urequest/-/urequest-1.3.6.tgz",
       "integrity": "sha512-9rBXLFSb5D19opGeXdD/WuiFJsA4Pk2r8VUGEAeUZUxB1a2zB47K85BKAx3Gy9i4nZwg22ejlJA+q9DVrpQlbA=="
     },
+    "@root/request": {
+      "version": "1.3.10",
+      "resolved": "https://registry.npmjs.org/@root/request/-/request-1.3.10.tgz",
+      "integrity": "sha512-GSn8dfsGp0juJyXS9k7B/DjYm7Axe85wiCHfPs30eQ+/V6p2aqey45e1czb3ZwP+iPmzWCKXahhWnZhSDIil6w=="
+    },
     "accepts": {
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.5.tgz",
@@ -38,7 +43,8 @@
     "ansi-regex": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-2.1.1.tgz",
-      "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8="
+      "integrity": "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
+      "optional": true
     },
     "aproba": {
       "version": "1.2.0",
@@ -136,12 +142,14 @@
     "code-point-at": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/code-point-at/-/code-point-at-1.1.0.tgz",
-      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c="
+      "integrity": "sha1-DQcLTQQ6W+ozovGkDi7bPZpMz3c=",
+      "optional": true
     },
     "console-control-strings": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
-      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4="
+      "integrity": "sha1-PXz0Rk22RG6mRL9LOVB/mFEAjo4=",
+      "optional": true
     },
     "core-util-is": {
       "version": "1.0.2",
@@ -233,6 +241,7 @@
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.1.tgz",
       "integrity": "sha512-1MkrZNvWTKCaigbn+W15elq2BB/L22nqrSY5DKlo3X6+vclJm8Bb5djXJBmEX6fS3+zCh/F4VBK5Z2KxJt4s2Q==",
+      "optional": true,
       "requires": {
         "once": "^1.4.0"
       }
@@ -243,9 +252,9 @@
       "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
     },
     "esprima": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.0.tgz",
-      "integrity": "sha512-oftTcaMu/EGrEIu904mWteKIv8vMuOgGYo7EhVJJN00R/EED9DCua/xxHRdYnKtcECzVg7xOWhflvJMnqcFZjw=="
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="
     },
     "etag": {
       "version": "1.8.1",
@@ -396,6 +405,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-1.0.0.tgz",
       "integrity": "sha1-754xOG8DGn8NZDr4L95QxFfvAMs=",
+      "optional": true,
       "requires": {
         "number-is-nan": "^1.0.0"
       }
@@ -411,9 +421,9 @@
       "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE="
     },
     "js-yaml": {
-      "version": "3.12.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz",
-      "integrity": "sha512-PIt2cnwmPfL4hKNwqeiuz4bKfnzHTBv6HyVgjahA6mPLwPDzjDWrplJBMjHUFxku/N3FlmrbyPclad+I+4mJ3A==",
+      "version": "3.13.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.13.1.tgz",
+      "integrity": "sha512-YfbcO7jXDdyj0DGxYVSlSeQNHbD7XPWvrVWeVUujrQEoZzWJIRrCPoyk6kL6IAjAG2IolMK4T0hNUe0HOUs5Jw==",
       "requires": {
         "argparse": "^1.0.7",
         "esprima": "^4.0.0"
@@ -602,7 +612,8 @@
     "number-is-nan": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/number-is-nan/-/number-is-nan-1.0.1.tgz",
-      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0="
+      "integrity": "sha1-CXtgK1NCKlIsGvuHkDGDNpQaAR0=",
+      "optional": true
     },
     "object-assign": {
       "version": "4.1.1",
@@ -621,6 +632,7 @@
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "optional": true,
       "requires": {
         "wrappy": "1"
       }
@@ -954,6 +966,7 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/string-width/-/string-width-1.0.2.tgz",
       "integrity": "sha1-EYvfW4zcUaKn5w0hHgfisLmxB9M=",
+      "optional": true,
       "requires": {
         "code-point-at": "^1.0.0",
         "is-fullwidth-code-point": "^1.0.0",
@@ -972,6 +985,7 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
       "integrity": "sha1-ajhfuIU9lS1f8F0Oiq+UJ43GPc8=",
+      "optional": true,
       "requires": {
         "ansi-regex": "^2.0.0"
       }
@@ -1105,7 +1119,8 @@
     "wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "optional": true
     },
     "ws": {
       "version": "6.0.0",
diff --git a/package.json b/package.json
index d67ed47..9a300ce 100644
--- a/package.json
+++ b/package.json
@@ -53,10 +53,10 @@
   },
   "homepage": "https://git.coolaj86.com/coolaj86/telebit.js#readme",
   "dependencies": {
-    "@coolaj86/urequest": "^1.3.5",
+    "@root/request": "^1.3.10",
     "finalhandler": "^1.1.1",
     "greenlock": "^2.6.7",
-    "js-yaml": "^3.11.0",
+    "js-yaml": "^3.13.1",
     "keyfetch": "^1.1.8",
     "keypairs": "^1.2.14",
     "mkdirp": "^0.5.1",
diff --git a/tests/pair-request.js b/tests/pair-request.js
index 4f1dba6..61cd87e 100644
--- a/tests/pair-request.js
+++ b/tests/pair-request.js
@@ -5,7 +5,7 @@ var pin = Math.round(Math.random() * 999999).toString().padStart(6, '0'); // '32
 
 console.log('Pair Code:', pin);
 
-var urequest = require('@coolaj86/urequest');
+var urequest = require('@root/request');
 var req =  {
   url: 'https://api.telebit.ppl.family/api/telebit.cloud/pair_request'
 , method: 'POST'
diff --git a/tests/pair-state.js b/tests/pair-state.js
index 53752c1..5dde7d4 100644
--- a/tests/pair-state.js
+++ b/tests/pair-state.js
@@ -2,7 +2,7 @@
 
 var stateUrl = 'https://api.telebit.ppl.family/api/telebit.cloud/pair_state/bca27428719e9c67805359f1';
 
-var urequest = require('@coolaj86/urequest');
+var urequest = require('@root/request');
 var req =  {
   url: stateUrl
 , method: 'GET'
-- 
2.38.5


From b81ff7550b9f82b481fb216cd23857e59f1cbe58 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 02:17:12 -0600
Subject: [PATCH 55/68] prep for ACME-style account for Telebit

---
 lib/admin/js/app.js | 112 ++++++++++++++++++++++++++++----------------
 1 file changed, 71 insertions(+), 41 deletions(-)

diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 9b3b772..9d71672 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -3,6 +3,7 @@
 
 var Vue = window.Vue;
 var Telebit = window.TELEBIT;
+var Keypairs = window.Keypairs;
 var api = {};
 
 /*
@@ -462,52 +463,81 @@ new Vue({
 , methods: appMethods
 });
 
+function run(key) {
+  // 1. Get ACME directory
+  // 2. Fetch ACME account
+  // 3. Test if account has access
+  // 4. Show command line auth instructions to auth
+  // 5. Sign requests / use JWT
+  // 6. Enforce token required for config, status, etc
+  // 7. Move admin interface to standard ports (admin.foo-bar-123.telebit.xyz)
+  api.config().then(function (config) {
+    telebitState.config = config;
+    if (config.greenlock) {
+      appData.init.acmeServer = config.greenlock.server;
+    }
+    if (config.relay) {
+      appData.init.relay = config.relay;
+    }
+    if (config.email) {
+      appData.init.email = config.email;
+    }
+    if (config.agreeTos) {
+      appData.init.letos = config.agreeTos;
+      appData.init.teletos = config.agreeTos;
+    }
+    if (config._otp) {
+      appData.init.otp = config._otp;
+    }
 
-api.config().then(function (config) {
-  telebitState.config = config;
-  if (config.greenlock) {
-    appData.init.acmeServer = config.greenlock.server;
-  }
-  if (config.relay) {
-    appData.init.relay = config.relay;
-  }
-  if (config.email) {
-    appData.init.email = config.email;
-  }
-  if (config.agreeTos) {
-    appData.init.letos = config.agreeTos;
-    appData.init.teletos = config.agreeTos;
-  }
-  if (config._otp) {
-    appData.init.otp = config._otp;
-  }
+    telebitState.pollUrl = config._pollUrl || localStorage.getItem('poll_url');
 
-  telebitState.pollUrl = config._pollUrl || localStorage.getItem('poll_url');
+    if ((!config.token && !config._otp) || !config.relay || !config.email || !config.agreeTos) {
+      changeState('setup');
+      setState();
+      return;
+    }
+    if (!config.token && config._otp) {
+      changeState('otp');
+      setState();
+      // this will skip ahead as necessary
+      return Telebit.authorize(telebitState, showOtp).then(function () {
+        return changeState('status');
+      });
+    }
 
-  if ((!config.token && !config._otp) || !config.relay || !config.email || !config.agreeTos) {
-    changeState('setup');
-    setState();
-    return;
-  }
-  if (!config.token && config._otp) {
-    changeState('otp');
-    setState();
-    // this will skip ahead as necessary
-    return Telebit.authorize(telebitState, showOtp).then(function () {
-      return changeState('status');
-    });
-  }
+    // TODO handle default state
+    changeState('status');
+  }).catch(function (err) {
+    appData.views.flash.error = err.message || JSON.stringify(err, null, 2);
+  });
+}
 
-  // TODO handle default state
-  changeState('status');
-}).catch(function (err) {
-  appData.views.flash.error = err.message || JSON.stringify(err, null, 2);
-});
+
+// TODO protect key with passphrase (or QR code?)
+function getKey() {
+  var key;
+  try {
+    key = JSON.parse(localStorage.getItem('key'));
+  } catch(e) {
+    // ignore
+  }
+  if (key && key.kid && key.d) {
+    return Promise.resolve(key);
+  }
+  return Keypairs.generate().then(function (pair) {
+    key = pair.private;
+    localStorage.setItem('key', JSON.stringify(key));
+    return key;
+  });
+}
 
 window.api = api;
-
-setTimeout(function () {
-  document.body.hidden = false;
-}, 50);
+getKey().then(function (key) {
+  run(key);
+  setTimeout(function () {
+    document.body.hidden = false;
+  }, 50);
+});
 
 }());
-- 
2.38.5


From 8b2e6e69d01cabf0f243b01a3eb65d3cc4bb65a8 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 14:00:17 -0600
Subject: [PATCH 56/68] use ACME to create account

---
 bin/telebitd.js                | 87 ++++++++++++++++++++++------------
 lib/admin/js/app.js            | 53 +++++++++++++++++----
 lib/admin/js/bluecrypt-acme.js |  2 +-
 3 files changed, 103 insertions(+), 39 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 145d9e0..e98f403 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -10,6 +10,7 @@ try {
 }
 
 var pkg = require('../package.json');
+var Keypairs = require('keypairs');
 
 var crypto = require('crypto');
 //var url = require('url');
@@ -422,7 +423,7 @@ controllers.newAccount = function (req, res) {
     // TODO clean up error messages to be similar to ACME
 
     // check if there's a public key
-    if (!req.jws || !req.jws.header.kid || !req.jws.header.jwk) {
+    if (!req.jws || !req.jws.header.jwk) {
       res.statusCode = 422;
       res.send({ error: { message: "jws body was not present or could not be validated" } });
       return;
@@ -448,7 +449,7 @@ controllers.newAccount = function (req, res) {
     return verifyJws(req.jws.header.jwk, req.jws).then(function (verified) {
       if (!verified) {
         res.statusCode = 422;
-        res.send({ error: { message: "jws body was not present or could not be validated" } });
+        res.send({ error: { message: "jws body failed verification" } });
         return;
       }
 
@@ -483,7 +484,7 @@ controllers.newAccount = function (req, res) {
           }
           res.statusCode = 201;
           account = {};
-          account._id = crypto.randomBytes(16).toString('base64');
+          account._id = toUrlSafe(crypto.randomBytes(16).toString('base64'));
           // TODO be better about this
           account.location = myBaseUrl + '/acme/accounts/' + account._id;
           account.thumb = thumb;
@@ -620,12 +621,38 @@ function jwsEggspress(req, res, next) {
   }
 
   var ua = req.headers['user-agent'];
+  var trusted = false;
   var vjwk;
   var pubs;
+  var kid = req.jws.header.kid;
+  var p = Promise.resolve();
+  if (!kid && !req.jws.header.jwk) {
+    res.send({ error: { message: "jws protected header must include either 'kid' or 'jwk'" } });
+    return;
+  }
+  if (req.jws.header.jwk) {
+    if (kid) {
+      // TODO kid and jwk are mutually exclusive
+      //res.send({ error: { message: "jws protected header must not include both 'kid' and 'jwk'" } });
+      //return;
+    }
+    kid = req.jws.header.jwk.kid;
+    p = Keypairs.thumbprint({ jwk: req.jws.header.jwk }).then(function (thumb) {
+      if (kid && kid !== thumb) {
+        res.send({ error: { message: "jwk included 'kid' for key id, but it did not match the key's thumbprint" } });
+        return;
+      }
+      kid = thumb;
+      req.jws.header.jwk.kid = thumb;
+    });
+  }
+
   // Check if this is a key we already trust
   DB.pubs.some(function (jwk) {
-    if (jwk.kid === req.jws.header.kid) {
+    if (jwk.kid === kid) {
+      trusted = true;
       vjwk = jwk;
+      return true;
     }
   });
 
@@ -645,33 +672,32 @@ function jwsEggspress(req, res, next) {
     });
   }
 
-  // Check if there aren't any keys that we trust
-  // and this has signed itself, then make it a key we trust
-  // (TODO: move this all to the new account function)
-  if ((0 === pubs.length && req.jws.header.jwk)) {
-    vjwk = req.jws.header.jwk;
-    if (!vjwk.kid) { throw Error("Impossible: no key id"); }
-  }
+  p.then(function () {
+    // Check if there aren't any keys that we trust
+    // and this has signed itself, then make it a key we trust
+    // (TODO: move this all to the new account function)
+    if (0 === pubs.length) { trusted = true; }
+    if (!vjwk) { vjwk = req.jws.header.jwk; }
+    // Don't verify if it can't be verified
+    if (!vjwk) { return null; }
 
-  // Don't verify if it can't be verified
-  if (!vjwk) {
-    next();
-    return;
-  }
+    // Run the  verification
+    return p.then(function () {
+      return verifyJws(vjwk, req.jws).then(function (verified) {
+        if (true !== verified) { return null; }
 
-  // Run the  verification
-  return verifyJws(vjwk, req.jws).then(function (verified) {
-    if (true !== verified) { return; }
+        // Mark as verified
+        req.jws.verified = verified;
+        req.jws.trusted = trusted;
+        vjwk.useragent = ua;
 
-    // Mark as verified
-    req.jws.verified = verified;
-    vjwk.useragent = ua;
+        // (double check) DO NOT save if there are existing pubs
+        if (0 !== pubs.length) { return null; }
 
-    // (double check) DO NOT save if there are existing pubs
-    if (0 !== pubs.length) { return; }
-
-    DB.pubs.push(vjwk);
-    return keystore.set(vjwk.kid + PUBEXT, vjwk);
+        DB.pubs.push(vjwk);
+        return keystore.set(vjwk.kid + PUBEXT, vjwk);
+      });
+    });
   }).then(function () {
     next();
   });
@@ -1001,9 +1027,12 @@ function handleApi() {
     next();
   });
   app.get('/acme/directory', function (req, res) {
+    var myBaseUrl = (req.connection.encrypted ? 'https' : 'http') + '://' + req.headers.host;
     res.send({
-      'new-nonce': '/acme/new-nonce'
-    , 'new-account': '/acme/new-acct'
+      'newNonce': '/acme/new-nonce'
+    , 'newAccount': '/acme/new-acct'
+      // TODO link to the terms that the user selects
+    , 'meta': { 'termsOfService': myBaseUrl + '/acme/terms.html' }
     });
   });
   app.head('/acme/new-nonce', controllers.newNonce);
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 9d71672..1a06d3e 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -4,6 +4,7 @@
 var Vue = window.Vue;
 var Telebit = window.TELEBIT;
 var Keypairs = window.Keypairs;
+var ACME = window.ACME;
 var api = {};
 
 /*
@@ -516,25 +517,59 @@ function run(key) {
 
 // TODO protect key with passphrase (or QR code?)
 function getKey() {
-  var key;
+  var jwk;
   try {
-    key = JSON.parse(localStorage.getItem('key'));
+    jwk = JSON.parse(localStorage.getItem('key'));
   } catch(e) {
     // ignore
   }
-  if (key && key.kid && key.d) {
-    return Promise.resolve(key);
+  if (jwk && jwk.kid && jwk.d) {
+    return Promise.resolve(jwk);
   }
   return Keypairs.generate().then(function (pair) {
-    key = pair.private;
-    localStorage.setItem('key', JSON.stringify(key));
-    return key;
+    jwk = pair.private;
+    localStorage.setItem('key', JSON.stringify(jwk));
+    return jwk;
+  });
+}
+
+function getEmail() {
+  return Promise.resolve().then(function () {
+    var email = localStorage.getItem('email');
+    if (email) { return email; }
+    while (!email) {
+      email = window.prompt("Email address (device owner)?");
+    }
+    return email;
+  });
+}
+function requestAccount() {
+  return getKey().then(function (jwk) {
+    return getEmail().then(function(email) {
+      // creates new or returns existing
+      var acme = ACME.create({});
+      var url = window.location.protocol + '//' + window.location.host + '/acme/directory';
+      return acme.init(url).then(function () {
+        return acme.accounts.create({
+          agreeToTerms: function (tos) { return tos; }
+        , accountKeypair: { privateKeyJwk: jwk }
+        , email: email
+        }).then(function (account) {
+          console.log('account:');
+          console.log(account);
+          if (account.id) {
+            localStorage.setItem('email', email);
+          }
+          return jwk;
+        });
+      });
+    });
   });
 }
 
 window.api = api;
-getKey().then(function (key) {
-  run(key);
+requestAccount().then(function (jwk) {
+  run(jwk);
   setTimeout(function () {
     document.body.hidden = false;
   }, 50);
diff --git a/lib/admin/js/bluecrypt-acme.js b/lib/admin/js/bluecrypt-acme.js
index 2b20d66..e4a5996 100644
--- a/lib/admin/js/bluecrypt-acme.js
+++ b/lib/admin/js/bluecrypt-acme.js
@@ -2567,7 +2567,7 @@ ACME.create = function create(me) {
   // me.debug = true;
   me.challengePrefixes = ACME.challengePrefixes;
   me.Keypairs = me.Keypairs || exports.Keypairs || require('keypairs').Keypairs;
-  me.CSR = me.CSR || exports.cSR || require('CSR').CSR;
+  me.CSR = me.CSR || exports.CSR || require('CSR').CSR;
   me._nonces = [];
   me._canUse = {};
   if (!me._baseUrl) {
-- 
2.38.5


From 1826ec8497a7b4c4eabf37141c4c1fab9e707442 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 14:34:55 -0600
Subject: [PATCH 57/68] WIP: switch to authenticated requests

---
 bin/telebit-remote.js |  1 +
 bin/telebitd.js       | 47 +++++++++++++++++++++++++++++--------------
 lib/rc/index.js       |  1 +
 3 files changed, 34 insertions(+), 15 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 818bc7d..2fe7c71 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -685,6 +685,7 @@ function parseConfig(err, text) {
       , protected: {
           // alg will be filled out automatically
           jwk: state.pub
+        , kid: false
         , nonce: nonce
         , url: newAccountUrl
         }
diff --git a/bin/telebitd.js b/bin/telebitd.js
index e98f403..9d6bf2d 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -590,9 +590,14 @@ function jwtEggspress(req, res, next) {
 
   // TODO verify if possible
   console.warn("[warn] JWT is not verified yet");
+  // A failed JWS should cause a failed JWT
+  if (false !== req.trusted) {
+    req.trusted = true;
+  }
   next();
 }
 
+// TODO switch to Keypairs.js / Keyfetch.js
 function verifyJws(jwk, jws) {
   return keypairs.export({ jwk: jwk }).then(function (pem) {
     var alg = 'SHA' + jws.header.alg.replace(/[^\d]+/i, '');
@@ -632,9 +637,8 @@ function jwsEggspress(req, res, next) {
   }
   if (req.jws.header.jwk) {
     if (kid) {
-      // TODO kid and jwk are mutually exclusive
-      //res.send({ error: { message: "jws protected header must not include both 'kid' and 'jwk'" } });
-      //return;
+      res.send({ error: { message: "jws protected header must not include both 'kid' and 'jwk'" } });
+      return;
     }
     kid = req.jws.header.jwk.kid;
     p = Keypairs.thumbprint({ jwk: req.jws.header.jwk }).then(function (thumb) {
@@ -699,6 +703,10 @@ function jwsEggspress(req, res, next) {
       });
     });
   }).then(function () {
+    // a failed JWT should cause a failed JWS
+    if (false !== req.trusted) {
+      req.trusted = req.jws.trusted;
+    }
     next();
   });
 }
@@ -1038,10 +1046,19 @@ function handleApi() {
   app.head('/acme/new-nonce', controllers.newNonce);
   app.get('/acme/new-nonce', controllers.newNonce);
   app.post('/acme/new-acct', controllers.newAccount);
-  app.use(/\b(relay)\b/, controllers.relay);
-  app.get(/\b(config)\b/, getConfigOnly);
-  app.use(/\b(init|config)\b/, initOrConfig);
-  app.use(/\b(restart)\b/, restart);
+  function mustTrust(req, res, next) {
+    // TODO public routes should be explicitly marked
+    // trusted should be the default
+    if (req.trusted) { next(); }
+    res.statusCode = 400;
+    res.send({"error":{"message": "this type of requests must be encoded as a jws payload"
+      + " and signed by a trusted account holder"}});
+    return;
+  }
+  app.use(/\b(relay)\b/, mustTrust, controllers.relay);
+  app.get(/\b(config)\b/, mustTrust, getConfigOnly);
+  app.use(/\b(init|config)\b/, mustTrust, initOrConfig);
+  app.use(/\b(restart)\b/, mustTrust, restart);
 
   // Position is important with eggspress
   // This should stay here, right before the other methods
@@ -1050,14 +1067,14 @@ function handleApi() {
   //
   // With proper config
   //
-  app.use(/\b(http)\b/, controllers.http);
-  app.use(/\b(tcp)\b/, controllers.tcp);
-  app.use(/\b(save|commit)\b/, saveAndCommit);
-  app.use(/\b(ssh)\b/, controllers.ssh);
-  app.use(/\b(enable)\b/, enable);
-  app.use(/\b(disable)\b/, disable);
-  app.use(/\b(status)\b/, getStatus);
-  app.use(/\b(list)\b/, listSuccess);
+  app.use(/\b(http)\b/, mustTrust, controllers.http);
+  app.use(/\b(tcp)\b/, mustTrust, controllers.tcp);
+  app.use(/\b(save|commit)\b/, mustTrust, saveAndCommit);
+  app.use(/\b(ssh)\b/, mustTrust, controllers.ssh);
+  app.use(/\b(enable)\b/, mustTrust, enable);
+  app.use(/\b(disable)\b/, mustTrust, disable);
+  app.use(/\b(status)\b/, mustTrust, getStatus);
+  app.use(/\b(list)\b/, mustTrust, listSuccess);
   app.use('/', function (req, res) {
     res.send({"error":{"message":"unrecognized rpc"}});
   });
diff --git a/lib/rc/index.js b/lib/rc/index.js
index 5df7c72..66579f2 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -160,6 +160,7 @@ module.exports.create = function (state) {
     , protected: {
         // alg will be filled out automatically
         jwk: state.pub
+      , kid: false
       , nonce: require('crypto').randomBytes(16).toString('hex') // TODO get from server
         // TODO make localhost exceptional
       , url: RC.resolve(reqOpts.path)
-- 
2.38.5


From 33b00ee330b945633580d73852cfb14f0a28cc3d Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 16:53:24 -0600
Subject: [PATCH 58/68] WIP: authenticate all requests

---
 bin/telebit-remote.js |  4 ++++
 bin/telebitd.js       | 18 ++++++++++------
 lib/eggspress.js      | 50 ++++++++++++++++++++++++++++---------------
 3 files changed, 49 insertions(+), 23 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 2fe7c71..933893c 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -707,6 +707,10 @@ function parseConfig(err, text) {
         }).then(function (resp) {
           //nonce = resp.headers['replay-nonce'];
           if (!resp.body || 'valid' !== resp.body.status) {
+            console.error('request jws:', jws);
+            console.error('response:');
+            console.error(resp.headers);
+            console.error(resp.body);
             throw new Error("did not successfully create or restore account");
           }
           return RC.requestAsync({ service: 'config', method: 'GET' }).catch(function (err) {
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 9d6bf2d..6bbbdfd 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -1049,11 +1049,14 @@ function handleApi() {
   function mustTrust(req, res, next) {
     // TODO public routes should be explicitly marked
     // trusted should be the default
-    if (req.trusted) { next(); }
-    res.statusCode = 400;
-    res.send({"error":{"message": "this type of requests must be encoded as a jws payload"
-      + " and signed by a trusted account holder"}});
-    return;
+    if (!req.trusted) {
+      res.statusCode = 400;
+      res.send({"error":{"message": "this type of requests must be encoded as a jws payload"
+        + " and signed by a trusted account holder"}});
+      return;
+    }
+
+    next();
   }
   app.use(/\b(relay)\b/, mustTrust, controllers.relay);
   app.get(/\b(config)\b/, mustTrust, getConfigOnly);
@@ -1076,7 +1079,10 @@ function handleApi() {
   app.use(/\b(status)\b/, mustTrust, getStatus);
   app.use(/\b(list)\b/, mustTrust, listSuccess);
   app.use('/', function (req, res) {
-    res.send({"error":{"message":"unrecognized rpc"}});
+    res.send({"error":{"message":"unrecognized rpc: [" + req.method + "] " + req.url + "\n"
+      + JSON.stringify(req.headers) + "\n"
+      + JSON.stringify(req.body) + "\n"
+    }});
   });
 
   return app;
diff --git a/lib/eggspress.js b/lib/eggspress.js
index d4b3d28..82249fe 100644
--- a/lib/eggspress.js
+++ b/lib/eggspress.js
@@ -51,16 +51,29 @@ module.exports = function eggspress() {
         res.end(e.message);
       }
 
-      try {
-        console.log("[eggspress] matched pattern", todo[0], req.url);
-        var p = todo[1](req, res, next);
-        if (p && p.catch) {
-          p.catch(fail);
-        }
-      } catch(e) {
-        fail(e);
-        return;
+      console.log("[eggspress] matched pattern", todo[0], req.url);
+      if ('function' === typeof todo[1]) {
+        // TODO this is prep-work
+        todo[1] = [todo[1]];
       }
+
+      var fns = todo[1].slice(0);
+
+      function nextTodo(err) {
+        if (err) { fail(err); return; }
+        var fn = fns.shift();
+        if (!fn) { next(err); return; }
+        try {
+          var p = fn(req, res, nextTodo);
+          if (p && p.catch) {
+            p.catch(fail);
+          }
+        } catch(e) {
+          fail(e);
+          return;
+        }
+      }
+      nextTodo();
     }
 
     res.send = eggSend;
@@ -68,19 +81,22 @@ module.exports = function eggspress() {
     next();
   };
 
-  app.use = function (pattern, fn) {
-    return app._use('', pattern, fn);
+  app.use = function (pattern) {
+    var fns = Array.prototype.slice.call(arguments, 1);
+    return app._use('', pattern, fns);
   };
   [ 'HEAD', 'GET', 'POST', 'DELETE' ].forEach(function (method) {
-    app[method.toLowerCase()] = function (pattern, fn) {
-      return app._use(method, pattern, fn);
+    app[method.toLowerCase()] = function (pattern) {
+      var fns = Array.prototype.slice.call(arguments, 1);
+      return app._use(method, pattern, fns);
     };
   });
 
-  app.post = function (pattern, fn) {
-    return app._use('POST', pattern, fn);
+  app.post = function (pattern) {
+    var fns = Array.prototype.slice.call(arguments, 1);
+    return app._use('POST', pattern, fns);
   };
-  app._use = function (method, pattern, fn) {
+  app._use = function (method, pattern, fns) {
     // always end in a slash, for now
     if ('string' === typeof pattern) {
       pattern = pattern.replace(/\/$/, '')  + '/';
@@ -94,7 +110,7 @@ module.exports = function eggspress() {
       return b.length - a.length;
     });
     */
-    allPatterns.push([pattern, fn, method.toLowerCase()]);
+    allPatterns.push([pattern, fns, method.toLowerCase()]);
     return app;
   };
 
-- 
2.38.5


From 2a03e767f296fc966d4fc448dd70968a2cea31cc Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 18:22:20 -0600
Subject: [PATCH 59/68] update node version to v10.13

---
 usr/share/install_helper.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/usr/share/install_helper.sh b/usr/share/install_helper.sh
index e92f8ed..3a9bc68 100644
--- a/usr/share/install_helper.sh
+++ b/usr/share/install_helper.sh
@@ -133,8 +133,11 @@ my_tmp="$(mktemp -d -t telebit.XXXXXXXX)"
 #TELEBIT_TMP="$my_tmp/telebit"
 
 echo "Installing $my_name to '$TELEBIT_REAL_PATH'"
-# v10.2+ has much needed networking fixes, but breaks ursa. v9.x has severe networking bugs. v8.x has working ursa, but requires tls workarounds"
-NODEJS_VER="${NODEJS_VER:-v10.6}"
+# v10.2+ has much needed networking fixes, but breaks ursa.
+# v9.x has severe networking bugs.
+# v8.x has working ursa, but requires tls workarounds"
+# v10.13 seems to work for me locally (new greenlock)
+NODEJS_VER="${NODEJS_VER:-v10.13}"
 export NODEJS_VER
 export NODE_PATH="$TELEBIT_TMP/lib/node_modules"
 export NPM_CONFIG_PREFIX="$TELEBIT_TMP"
-- 
2.38.5


From 69a28faccf46339e9e56b807a1c3b172a78363e9 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 22:03:02 -0600
Subject: [PATCH 60/68] use jwt or jws for all requests

---
 bin/telebitd.js         |  4 ++++
 lib/admin/js/app.js     | 36 +++++++++++++++++++++++-------------
 lib/admin/js/telebit.js | 35 +++++++++++++++++++++++++++++++----
 3 files changed, 58 insertions(+), 17 deletions(-)

diff --git a/bin/telebitd.js b/bin/telebitd.js
index 6bbbdfd..fe5c70e 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -587,6 +587,10 @@ function jwtEggspress(req, res, next) {
   } catch(e) {
     // ignore
   }
+  if (!req.jwk.kid) {
+    res.send({ error: { message: "JWT must include a SHA thumbprint as the 'kid' (key id)" } });
+    return;
+  }
 
   // TODO verify if possible
   console.warn("[warn] JWT is not verified yet");
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 1a06d3e..82705d4 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -25,8 +25,9 @@ function safeFetch(url, opts) {
 
 api.config = function apiConfig() {
   return Telebit.reqLocalAsync({
-    url: "/api/config"
-  , method: "GET"
+    method: "GET"
+  , url: "/api/config"
+  , key: api._key
   }).then(function (resp) {
     var json = resp.body;
     appData.config = json;
@@ -34,17 +35,22 @@ api.config = function apiConfig() {
   });
 };
 api.status = function apiStatus() {
-  return Telebit.reqLocalAsync({ url: "/api/status", method: "GET" }).then(function (resp) {
+  return Telebit.reqLocalAsync({
+    method: "GET"
+  , url: "/api/status"
+  , key: api._key
+  }).then(function (resp) {
     var json = resp.body;
     return json;
   });
 };
 api.http = function apiHttp(o) {
   var opts = {
-    url: "/api/http"
-  , method: "POST"
+    method: "POST"
+  , url: "/api/http"
   , headers: { 'Content-Type': 'application/json' }
   , json: { name: o.name, handler: o.handler, indexes: o.indexes }
+  , key: api._key
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -56,10 +62,11 @@ api.http = function apiHttp(o) {
 };
 api.ssh = function apiSsh(port) {
   var opts = {
-    url: "/api/ssh"
-  , method: "POST"
+    method: "POST"
+  , url: "/api/ssh"
   , headers: { 'Content-Type': 'application/json' }
   , json: { port: port }
+  , key: api._key
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -71,9 +78,10 @@ api.ssh = function apiSsh(port) {
 };
 api.enable = function apiEnable() {
   var opts = {
-    url: "/api/enable"
-  , method: "POST"
+    method: "POST"
+  , url: "/api/enable"
   //, headers: { 'Content-Type': 'application/json' }
+  , key: api._key
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -85,9 +93,10 @@ api.enable = function apiEnable() {
 };
 api.disable = function apiDisable() {
   var opts = {
-    url: "/api/disable"
-  , method: "POST"
+    method: "POST"
+  , url: "/api/disable"
   //, headers: { 'Content-Type': 'application/json' }
+  , key: api._key
   };
   return Telebit.reqLocalAsync(opts).then(function (resp) {
     var json = resp.body;
@@ -465,8 +474,9 @@ new Vue({
 });
 
 function run(key) {
-  // 1. Get ACME directory
-  // 2. Fetch ACME account
+  api._key = key;
+  // 😁 1. Get ACME directory
+  // 😁 2. Fetch ACME account
   // 3. Test if account has access
   // 4. Show command line auth instructions to auth
   // 5. Sign requests / use JWT
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index f4379df..4908f46 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -1,6 +1,7 @@
 ;(function (exports) {
 'use strict';
 
+var Keypairs = window.Keypairs;
 var common = exports.TELEBIT = {};
 common.debug = true;
 
@@ -14,7 +15,7 @@ if ('undefined' !== typeof Promise) {
 
 /*globals AbortController*/
 if ('undefined' !== typeof fetch) {
-  common.requestAsync = function (opts) {
+  common._requestAsync = function (opts) {
     // funnel requests through the local server
     // (avoid CORS, for now)
     var relayOpts = {
@@ -44,7 +45,7 @@ if ('undefined' !== typeof fetch) {
       });
     });
   };
-  common.reqLocalAsync = function (opts) {
+  common._reqLocalAsync = function (opts) {
     if (!opts) { opts = {}; }
     if (opts.json && true !== opts.json) {
       opts.body = opts.json;
@@ -78,9 +79,35 @@ if ('undefined' !== typeof fetch) {
     });
   };
 } else {
-  common.requestAsync = require('util').promisify(require('@root/request'));
-  common.reqLocalAsync = require('util').promisify(require('@root/request'));
+  common._requestAsync = require('util').promisify(require('@root/request'));
+  common._reqLocalAsync = require('util').promisify(require('@root/request'));
 }
+common._sign = function (opts) {
+  var p;
+  if ('POST' === opts.method || opts.json) {
+    p = Keypairs.signJws({ jwk: opts.key, payload: opts.json || {} }).then(function (jws) {
+      opts.json = jws;
+    });
+  } else {
+    p = Keypairs.signJwt({ jwk: opts.key , claims: { iss: false, exp: '60s' } }).then(function (jwt) {
+      if (!opts.headers) { opts.headers = {}; }
+      opts.headers.Authorization = 'Bearer ' + jwt;
+    });
+  }
+  return p.then(function () {
+    return opts;
+  });
+};
+common.requestAsync = function (opts) {
+  return common._sign(opts).then(function (opts) {
+    return common._requestAsync(opts);
+  });
+};
+common.reqLocalAsync = function (opts) {
+  return common._sign(opts).then(function (opts) {
+    return common._reqLocalAsync(opts);
+  });
+};
 
 common.parseUrl = function (hostname) {
   // add scheme, if missing
-- 
2.38.5


From 0489d20fd33dcad3b755deb43f889cfaa3693611 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 11 May 2019 23:40:22 -0600
Subject: [PATCH 61/68] typo fixes

---
 bin/telebit-remote.js    |  7 ++++++-
 bin/telebitd.js          |  4 +++-
 lib/keystore-fallback.js |  2 +-
 lib/rc/index.js          |  2 +-
 package-lock.json        | 36 ++++++++++++++++++++++--------------
 package.json             |  2 +-
 6 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 933893c..99023ed 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -369,7 +369,12 @@ function parseConfig(err, text) {
 
     if (!state.config.relay || !state.config.token) {
       if (!state.config.relay) {
-        state.config.relay = 'telebit.cloud';
+        try {
+          state.config.relay = 'telebit.cloud';
+        } catch(e) {
+          console.error(state.config);
+          throw e;
+        }
       }
 
       //console.log("question the user?", Date.now());
diff --git a/bin/telebitd.js b/bin/telebitd.js
index fe5c70e..0c22280 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -586,8 +586,10 @@ function jwtEggspress(req, res, next) {
     req.jwt = decodeJwt(jwt);
   } catch(e) {
     // ignore
+    next();
+    return;
   }
-  if (!req.jwk.kid) {
+  if (!req.jwt.header.kid) {
     res.send({ error: { message: "JWT must include a SHA thumbprint as the 'kid' (key id)" } });
     return;
   }
diff --git a/lib/keystore-fallback.js b/lib/keystore-fallback.js
index f0a91e2..227d49c 100644
--- a/lib/keystore-fallback.js
+++ b/lib/keystore-fallback.js
@@ -24,7 +24,7 @@ module.exports.create = function (opts) {
       return fs.unlink(f);
     }
   , findCredentials: function (/*service*/) {
-      return fs.readDir(opts.configDir).then(function (nodes) {
+      return fs.readdir(opts.configDir).then(function (nodes) {
         return Promise.all(nodes.filter(function (node) {
           return keyext === node.slice(-4);
         }).map(function (node) {
diff --git a/lib/rc/index.js b/lib/rc/index.js
index 66579f2..9ef2df6 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -150,7 +150,7 @@ module.exports.create = function (state) {
       , claims: { iss: false, exp: Math.round(Date.now()/1000) + (15 * 60) }
       //TODO , exp: '15m'
       }).then(function (jwt) {
-        req.setHeader("authorization", 'bearer ' + jwt);
+        req.setHeader("Authorization", 'Bearer ' + jwt);
         req.end();
       });
     }
diff --git a/package-lock.json b/package-lock.json
index 4fa8db7..4d43f49 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -454,13 +454,21 @@
       }
     },
     "keytar": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/keytar/-/keytar-4.4.1.tgz",
-      "integrity": "sha512-6xEe7ybXSR5EZC+z0GI2yqLYZjV1tyPQY2xSZ8rGsBxrrLEh8VR/Lfqv59uGX+I+W+OZxH0jCXN1dU1++ify4g==",
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/keytar/-/keytar-4.6.0.tgz",
+      "integrity": "sha512-8wWWTC62QHvUvgW/QYyJv7X0GFZfp2Ykr5n3PuXKADro0Sv2RKvuYxbkzoZvsw33EDNAKnUTSA0/KLGN/MbwDw==",
       "optional": true,
       "requires": {
-        "nan": "2.12.1",
-        "prebuild-install": "5.2.4"
+        "nan": "2.13.2",
+        "prebuild-install": "5.3.0"
+      },
+      "dependencies": {
+        "nan": {
+          "version": "2.13.2",
+          "resolved": "https://registry.npmjs.org/nan/-/nan-2.13.2.tgz",
+          "integrity": "sha512-TghvYc72wlMGMVMluVo9WRJc0mB8KxxF/gZ4YYFy7V2ZQX9l7rgbPg7vjS9mt6U5HXODVFVI2bOduCzwOMv/lw==",
+          "optional": true
+        }
       }
     },
     "le-challenge-fs": {
@@ -577,9 +585,9 @@
       "integrity": "sha1-KzJxhOiZIQEXeyhWP7XnECrNDKk="
     },
     "node-abi": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-2.7.1.tgz",
-      "integrity": "sha512-OV8Bq1OrPh6z+Y4dqwo05HqrRL9YNF7QVMRfq1/pguwKLG+q9UB/Lk0x5qXjO23JjJg+/jqCHSTaG1P3tfKfuw==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-2.8.0.tgz",
+      "integrity": "sha512-1/aa2clS0pue0HjckL62CsbhWWU35HARvBDXcJtYKbYR7LnIutmpxmXbuDMV9kEviD2lP/wACOgWmmwljghHyQ==",
       "optional": true,
       "requires": {
         "semver": "^5.4.1"
@@ -667,9 +675,9 @@
       }
     },
     "prebuild-install": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-5.2.4.tgz",
-      "integrity": "sha512-CG3JnpTZXdmr92GW4zbcba4jkDha6uHraJ7hW4Fn8j0mExxwOKK20hqho8ZuBDCKYCHYIkFM1P2jhtG+KpP4fg==",
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-5.3.0.tgz",
+      "integrity": "sha512-aaLVANlj4HgZweKttFNUVNRxDukytuIuxeK2boIMHjagNJCiVKWFsKF4tCE3ql3GbrD2tExPQ7/pwtEJcHNZeg==",
       "optional": true,
       "requires": {
         "detect-libc": "^1.0.3",
@@ -822,9 +830,9 @@
       "integrity": "sha1-Az1go60g7PLgCUDRT5eCNGV3QzU="
     },
     "semver": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.6.0.tgz",
-      "integrity": "sha512-RS9R6R35NYgQn++fkDWaOmqGoj4Ek9gGs+DPxNUZKuwE183xjJroKvyo1IzVFeXvUrvmALy6FWD5xrdJT25gMg==",
+      "version": "5.7.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.0.tgz",
+      "integrity": "sha512-Ya52jSX2u7QKghxeoFGpLwCtGlt7j0oY9DYb5apt9nPlJ42ID+ulTXESnt/qAQcoSERyZ5sl3LDIOw0nAn/5DA==",
       "optional": true
     },
     "send": {
diff --git a/package.json b/package.json
index 9a300ce..b0d7402 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "ws": "^6.0.0"
   },
   "optionalDependencies": {
-    "keytar": "^4.4.1"
+    "keytar": "^4.6.0"
   },
   "trulyOptionalDependencies": {
     "bluebird": "^3.5.1"
-- 
2.38.5


From 6c6f9133e90795099eaecb4e0ae1df903c7685ff Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 12 May 2019 00:10:58 -0600
Subject: [PATCH 62/68] fix keystore fallback and tests

---
 lib/keystore-fallback.js |  5 ++++-
 lib/keystore-test.js     | 13 ++++++++++---
 lib/keystore.js          |  3 +++
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/lib/keystore-fallback.js b/lib/keystore-fallback.js
index 227d49c..7c663aa 100644
--- a/lib/keystore-fallback.js
+++ b/lib/keystore-fallback.js
@@ -17,6 +17,7 @@ module.exports.create = function (opts) {
     }
   , setPassword: function (service, name, key) {
       var f = path.join(opts.configDir, name + keyext);
+    console.log('[DEBUG] set', f);
       return fs.writeFile(f, key, 'utf8');
     }
   , deletePassword: function (service, name) {
@@ -28,7 +29,9 @@ module.exports.create = function (opts) {
         return Promise.all(nodes.filter(function (node) {
           return keyext === node.slice(-4);
         }).map(function (node) {
-          return fs.readFile(path.join(opts.configDir, node + keyext));
+          return fs.readFile(path.join(opts.configDir, node), 'utf8').then(function (data) {
+            return { password: data };
+          });
         }));
       });
     }
diff --git a/lib/keystore-test.js b/lib/keystore-test.js
index 859203c..3a288cc 100644
--- a/lib/keystore-test.js
+++ b/lib/keystore-test.js
@@ -1,8 +1,11 @@
+(function () {
 'use strict';
 
 var keystore = require('./keystore.js').create({
-  configDir: require('path').join(require('os').homedir(), '.local/telebit/')
+  configDir: require('path').join(require('os').homedir(), '.config/telebit/')
+, fallback: true
 });
+
 var name = "testy-mctestface-1";
 return keystore.get(name).then(function (jwk) {
   console.log("get1", typeof jwk, jwk);
@@ -10,8 +13,11 @@ return keystore.get(name).then(function (jwk) {
     return require('keypairs').generate().then(function (jwk) {
       var json = JSON.stringify(jwk.private);
       return keystore.set(name, json).then(function () {
-        return keystore.get(name).then(function (val2) {
-          console.log("get2", val2);
+        return keystore.all().then(function (vals) {
+          console.log("All", vals);
+          return keystore.get(name).then(function (val2) {
+            console.log("get2", val2);
+          });
         });
       }).catch(function (err) {
         console.log('badness', err);
@@ -20,3 +26,4 @@ return keystore.get(name).then(function (jwk) {
   }
   return jwk;
 });
+}());
diff --git a/lib/keystore.js b/lib/keystore.js
index 876e151..b142ac2 100644
--- a/lib/keystore.js
+++ b/lib/keystore.js
@@ -4,6 +4,9 @@ module.exports.create = function (opts) {
   var service = opts.name || "Telebit";
   var keytar;
   try {
+    if (opts.fallback) {
+      throw new Error("forced fallback");
+    }
     keytar = require('keytar');
     // TODO test that long "passwords" (JWTs and JWKs) can be stored in all OSes
   } catch(e) {
-- 
2.38.5


From 4ae6942486b99ef42295fa57d0793baf23982645 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 12 May 2019 00:25:21 -0600
Subject: [PATCH 63/68] chimney

---
 lib/keystore-fallback.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/keystore-fallback.js b/lib/keystore-fallback.js
index 7c663aa..46e541e 100644
--- a/lib/keystore-fallback.js
+++ b/lib/keystore-fallback.js
@@ -17,7 +17,6 @@ module.exports.create = function (opts) {
     }
   , setPassword: function (service, name, key) {
       var f = path.join(opts.configDir, name + keyext);
-    console.log('[DEBUG] set', f);
       return fs.writeFile(f, key, 'utf8');
     }
   , deletePassword: function (service, name) {
-- 
2.38.5


From 2a28dca2573f9b447944858c674e5aef7c417252 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sun, 12 May 2019 00:26:07 -0600
Subject: [PATCH 64/68] interim fix: fallback to module-level key

---
 lib/admin/js/telebit.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index 4908f46..fcb46be 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -85,11 +85,11 @@ if ('undefined' !== typeof fetch) {
 common._sign = function (opts) {
   var p;
   if ('POST' === opts.method || opts.json) {
-    p = Keypairs.signJws({ jwk: opts.key, payload: opts.json || {} }).then(function (jws) {
+    p = Keypairs.signJws({ jwk: opts.key || common._key, payload: opts.json || {} }).then(function (jws) {
       opts.json = jws;
     });
   } else {
-    p = Keypairs.signJwt({ jwk: opts.key , claims: { iss: false, exp: '60s' } }).then(function (jwt) {
+    p = Keypairs.signJwt({ jwk: opts.key || common._key, claims: { iss: false, exp: '60s' } }).then(function (jwt) {
       if (!opts.headers) { opts.headers = {}; }
       opts.headers.Authorization = 'Bearer ' + jwt;
     });
-- 
2.38.5


From 2301966f9fa5f644618bda3a2017c0631e721e48 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 14 May 2019 02:16:45 -0600
Subject: [PATCH 65/68] WIP de-nest and restructure

---
 bin/telebit-remote.js | 915 +++++++++++++++++++++++-------------------
 bin/telebitd.js       |  25 ++
 lib/admin/js/app.js   | 218 +++++-----
 lib/eggspress.js      |   6 +-
 lib/rc/index.js       |  42 +-
 5 files changed, 671 insertions(+), 535 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index 99023ed..dbcd12e 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 (function () {
 'use strict';
+/*global Promise*/
 
 var pkg = require('../package.json');
 var os = require('os');
 
 //var url = require('url');
 var fs = require('fs');
+var util = require('util');
 var path = require('path');
 //var https = require('https');
 var YAML = require('js-yaml');
@@ -104,7 +106,9 @@ if (!confpath || /^--/.test(confpath)) {
   process.exit(1);
 }
 
-function askForConfig(state, mainCb) {
+var Console = {};
+Console.setup = function (state) {
+  if (Console.rl) { return; }
   var fs = require('fs');
   var ttyname = '/dev/tty';
   var stdin = useTty ? fs.createReadStream(ttyname, {
@@ -119,6 +123,34 @@ function askForConfig(state, mainCb) {
   , terminal: !/^win/i.test(os.platform()) && !useTty
   });
   state._useTty = useTty;
+  Console.rl = rl;
+};
+Console.teardown = function () {
+  // https://github.com/nodejs/node/issues/21319
+  if (useTty) { try { Console.stdin.push(null); } catch(e) { /*ignore*/ } }
+  Console.rl.close();
+  if (useTty) { try { Console.stdin.close(); } catch(e) { /*ignore*/ } }
+  Console.rl = null;
+};
+
+function askEmail(cb) {
+  Console.setup();
+  if (state.config.email) { cb(); return; }
+  console.info(TPLS.remote.setup.email);
+  // TODO attempt to read email from npmrc or the like?
+  Console.rl.question('email: ', function (email) {
+    // TODO validate email domain
+    email = /@/.test(email) && email.trim();
+    if (!email) { askEmail(cb); return; }
+    state.config.email = email.trim();
+    state.config.agreeTos = true;
+    console.info("");
+    setTimeout(cb, 250);
+  });
+}
+
+function askForConfig(state, mainCb) {
+  Console.setup(state);
 
   // NOTE: Use of setTimeout
   // We're using setTimeout just to make the user experience a little
@@ -128,19 +160,7 @@ function askForConfig(state, mainCb) {
   // <= 100ms is shorter than normal human reaction time (ability to place events chronologically, which happened first)
   // ~ 150-250ms is the sweet spot for most humans (long enough to notice change and not be jarred, but stay on task)
   var firstSet = [
-    function askEmail(cb) {
-      if (state.config.email) { cb(); return; }
-      console.info(TPLS.remote.setup.email);
-      // TODO attempt to read email from npmrc or the like?
-      rl.question('email: ', function (email) {
-        email = /@/.test(email) && email.trim();
-        if (!email) { askEmail(cb); return; }
-        state.config.email = email.trim();
-        state.config.agreeTos = true;
-        console.info("");
-        setTimeout(cb, 250);
-      });
-    }
+    askEmail
   , function askRelay(cb) {
       function checkRelay(relay) {
         // TODO parse and check https://{{relay}}/.well-known/telebit.cloud/directives.json
@@ -173,7 +193,7 @@ function askForConfig(state, mainCb) {
       console.info("");
       console.info("What relay will you be using? (press enter for default)");
       console.info("");
-      rl.question('relay [default: telebit.cloud]: ', checkRelay);
+      Console.rl.question('relay [default: telebit.cloud]: ', checkRelay);
     }
   , function checkRelay(cb) {
       nextSet = [];
@@ -201,7 +221,7 @@ function askForConfig(state, mainCb) {
       console.info("");
       console.info("Type 'y' or 'yes' to accept these Terms of Service.");
       console.info("");
-      rl.question('agree to all? [y/N]: ', function (resp) {
+      Console.rl.question('agree to all? [y/N]: ', function (resp) {
         resp = resp.trim();
         if (!/^y(es)?$/i.test(resp) && 'true' !== resp) {
           throw new Error("You didn't accept the Terms of Service... not sure what to do...");
@@ -219,7 +239,7 @@ function askForConfig(state, mainCb) {
       console.info("");
       console.info("What updates would you like to receive? (" + options.join(',') + ")");
       console.info("");
-      rl.question('messages (default: important): ', function (updates) {
+      Console.rl.question('messages (default: important): ', function (updates) {
         state._updates = (updates || '').trim().toLowerCase();
         if (!state._updates) { state._updates = 'important'; }
         if (-1 === options.indexOf(state._updates)) { askUpdates(cb); return; }
@@ -240,7 +260,7 @@ function askForConfig(state, mainCb) {
       console.info("");
       console.info("Contribute project telemetry data? (press enter for default [yes])");
       console.info("");
-      rl.question('telemetry [Y/n]: ', function (telemetry) {
+      Console.rl.question('telemetry [Y/n]: ', function (telemetry) {
         if (!telemetry || /^y(es)?$/i.test(telemetry)) {
           state.config.telemetry = true;
         }
@@ -263,7 +283,7 @@ function askForConfig(state, mainCb) {
       console.info("\tShared Secret (HMAC hex)");
       //console.info("\tPrivate key (hex)");
       console.info("");
-      rl.question('auth: ', function (resp) {
+      Console.rl.question('auth: ', function (resp) {
         resp = (resp || '').trim();
         try {
           JWT.decode(resp);
@@ -291,7 +311,7 @@ function askForConfig(state, mainCb) {
       console.info("What servername(s) will you be relaying here?");
       console.info("(use a comma-separated list such as example.com,example.net)");
       console.info("");
-      rl.question('domain(s): ', function (resp) {
+      Console.rl.question('domain(s): ', function (resp) {
         resp = (resp || '').trim().split(/,/g);
         if (!resp.length) { askServernames(); return; }
         // TODO validate the domains
@@ -306,7 +326,7 @@ function askForConfig(state, mainCb) {
       console.info("What tcp port(s) will you be relaying here?");
       console.info("(use a comma-separated list such as 2222,5050)");
       console.info("");
-      rl.question('port(s) [default:none]: ', function (resp) {
+      Console.rl.question('port(s) [default:none]: ', function (resp) {
         resp = (resp || '').trim().split(/,/g);
         if (!resp.length) { askPorts(); return; }
         // TODO validate the domains
@@ -320,10 +340,7 @@ function askForConfig(state, mainCb) {
   function next() {
     var q = nextSet.shift();
     if (!q) {
-      // https://github.com/nodejs/node/issues/21319
-      if (useTty) { try { stdin.push(null); } catch(e) { /*ignore*/ } }
-      rl.close();
-      if (useTty) { try { stdin.close(); } catch(e) { /*ignore*/ } }
+      Console.teardown();
       mainCb(null, state);
       return;
     }
@@ -335,23 +352,131 @@ function askForConfig(state, mainCb) {
 
 var RC;
 
-function parseConfig(err, text) {
-  function handleConfig(config) {
-    state.config = config;
-    var verstrd = [ pkg.name + ' daemon v' + state.config.version ];
-    if (state.config.version && state.config.version !== pkg.version) {
-      console.info(verstr.join(' '), verstrd.join(' '));
-    } else {
-      console.info(verstr.join(' '));
+function bootstrap(opts) {
+  state.key = opts.key;
+  // Create / retrieve account (sign-in, more or less)
+  // TODO hit directory resource /.well-known/openid-configuration -> acme_uri (?)
+  // Occassionally rotate the key just for the sake of testing the key rotation
+  return urequestAsync({
+    method: 'HEAD'
+  , url: RC.resolve('/acme/new-nonce')
+  , headers: { "User-Agent": 'Telebit/' + pkg.version }
+  }).then(function (resp) {
+    var nonce = resp.headers['replay-nonce'];
+    var newAccountUrl = RC.resolve('/acme/new-acct');
+    var contact = [];
+    if (opts.email) {
+      contact.push("mailto:" + opts.email);
+    }
+    return keypairs.signJws({
+      jwk: state.key
+    , protected: {
+        // alg will be filled out automatically
+        jwk: state.pub
+      , kid: false
+      , nonce: nonce
+      , url: newAccountUrl
+      }
+    , payload: JSON.stringify({
+        // We can auto-agree here because the client is the user agent of the primary user
+        termsOfServiceAgreed: true
+      , contact: contact // I don't think we have email yet...
+      , onlyReturnExisting: opts.onlyReturnExisting || !opts.email
+      //, externalAccountBinding: null
+      })
+    }).then(function (jws) {
+      return urequestAsync({
+        url: newAccountUrl
+      , method: 'POST'
+      , json: jws // TODO default to post when body is present
+      , headers: {
+          "Content-Type": 'application/jose+json'
+        , "User-Agent": 'Telebit/' + pkg.version
+        }
+      }).then(function (resp) {
+        //nonce = resp.headers['replay-nonce'];
+        if (!resp.body || 'valid' !== resp.body.status) {
+          console.error('request jws:', jws);
+          console.error('response:');
+          console.error(resp.headers);
+          console.error(resp.body);
+          throw new Error("did not successfully create or restore account");
+        }
+        return resp;
+      });
+    });
+  }).catch(RC.createRelauncher(bootstrap._replay(opts), bootstrap._bootstate)).catch(function (err) {
+    console.error(err);
+    process.exit(17);
+  });
+}
+bootstrap._bootstate = {};
+bootstrap._replay = function (_opts) {
+  return function (opts) {
+    // supply opts to match reverse signature (.length checking)
+    opts = _opts;
+    return bootstrap(opts);
+  };
+};
+
+function handleConfig(config) {
+  var _config = state.config || {};
+
+  state.config = config;
+  var verstrd = [ pkg.name + ' daemon v' + state.config.version ];
+  if (state.config.version && state.config.version !== pkg.version) {
+    console.info(verstr.join(' '), verstrd.join(' '));
+  } else {
+    console.info(verstr.join(' '));
+  }
+
+  if (!state.config.email && _config) {
+    state.config.email = _config.email;
+  }
+
+  //
+  // check for init first, before anything else
+  // because it has arguments that may help in
+  // the next steps
+  //
+  if (-1 !== argv.indexOf('init')) {
+    parsers.init(argv, function (err) {
+      if (err) {
+        console.error("Error while initializing config [init]:");
+        throw err;
+      }
+      getToken(function (err) {
+        if (err) {
+          console.error("Error while getting token [init]:");
+          throw err;
+        }
+        parseCli(state);
+      });
+    });
+    return;
+  }
+
+  if (!state.config.relay || !state.config.token) {
+    if (!state.config.relay) {
+      try {
+        state.config.relay = 'telebit.cloud';
+      } catch(e) {
+        console.error(state.config);
+        throw e;
+      }
     }
 
-    //
-    // check for init first, before anything else
-    // because it has arguments that may help in
-    // the next steps
-    //
-    if (-1 !== argv.indexOf('init')) {
-      parsers.init(argv, function (err) {
+    //console.log("question the user?", Date.now());
+    askForConfig(state, function (err, state) {
+      // no errors actually get passed, so this is just future-proofing
+      if (err) { throw err; }
+
+      if (!state.config.token && state._can_pair) {
+        state.config._otp = common.otp();
+      }
+
+      //console.log("done questioning:", Date.now());
+      if (!state.token && !state.config.token) {
         if (err) {
           console.error("Error while initializing config [init]:");
           throw err;
@@ -363,114 +488,257 @@ function parseConfig(err, text) {
           }
           parseCli(state);
         });
-      });
-      return;
-    }
-
-    if (!state.config.relay || !state.config.token) {
-      if (!state.config.relay) {
-        try {
-          state.config.relay = 'telebit.cloud';
-        } catch(e) {
-          console.error(state.config);
-          throw e;
-        }
+      } else {
+        parseCli(state);
       }
-
-      //console.log("question the user?", Date.now());
-      askForConfig(state, function (err, state) {
-        // no errors actually get passed, so this is just future-proofing
-        if (err) { throw err; }
-
-        if (!state.config.token && state._can_pair) {
-          state.config._otp = common.otp();
-        }
-
-        //console.log("done questioning:", Date.now());
-        if (!state.token && !state.config.token) {
-          if (err) {
-            console.error("Error while initializing config [init]:");
-            throw err;
-          }
-          getToken(function (err) {
-            if (err) {
-              console.error("Error while getting token [init]:");
-              throw err;
-            }
-            parseCli(state);
-          });
-        } else {
-          parseCli(state);
-        }
-      });
-      return;
-    }
-
-    //console.log("no questioning:");
-    parseCli(state);
+    });
+    return;
   }
 
-  function parseCli(/*state*/) {
-    var special = [
-      'false', 'none', 'off', 'disable'
-    , 'true', 'auto', 'on', 'enable'
-    ];
-    if (-1 !== argv.indexOf('init')) {
-      RC.request({ service: 'list', method: 'POST', data: [] }, handleRemoteRequest('list'));
-      return;
-    }
+  //console.log("no questioning:");
+  parseCli(state);
+}
 
-    if ([ 'ssh', 'http', 'tcp' ].some(function (key) {
-      if (key !== argv[0]) {
-        return false;
-      }
-      if (argv[1]) {
-        if (String(argv[1]) === String(parseInt(argv[1], 10))) {
-          // looks like a port
-          argv[1] = parseInt(argv[1], 10);
-        } else if (/\/|\\/.test(argv[1])) {
-          // looks like a path
-          argv[1] = path.resolve(argv[1]);
-          // TODO make a default assignment here
-        } else if (-1 === special.indexOf(argv[1])) {
-          console.error("Not sure what you meant by '" + argv[1] + "'.");
-          console.error("Remember: paths should begin with ." + path.sep + ", like '." + path.sep + argv[1] + "'");
-          return true;
-        }
-        RC.request({ service: argv[0], method: 'POST', data: argv.slice(1) }, handleRemoteRequest(argv[0]));
+function parseCli(/*state*/) {
+  var special = [
+    'false', 'none', 'off', 'disable'
+  , 'true', 'auto', 'on', 'enable'
+  ];
+  if (-1 !== argv.indexOf('init')) {
+    RC.request({ service: 'list', method: 'POST', data: [] }, handleRemoteRequest('list'));
+    return;
+  }
+
+  if ([ 'ssh', 'http', 'tcp' ].some(function (key) {
+    if (key !== argv[0]) {
+      return false;
+    }
+    if (argv[1]) {
+      if (String(argv[1]) === String(parseInt(argv[1], 10))) {
+        // looks like a port
+        argv[1] = parseInt(argv[1], 10);
+      } else if (/\/|\\/.test(argv[1])) {
+        // looks like a path
+        argv[1] = path.resolve(argv[1]);
+        // TODO make a default assignment here
+      } else if (-1 === special.indexOf(argv[1])) {
+        console.error("Not sure what you meant by '" + argv[1] + "'.");
+        console.error("Remember: paths should begin with ." + path.sep + ", like '." + path.sep + argv[1] + "'");
         return true;
       }
-      help();
-      return true;
-    })) {
-      return;
-    }
-
-    // Two styles:
-    //     http 3000
-    //     http modulename
-    function makeRpc(key) {
-      if (key !== argv[0]) {
-        return false;
-      }
       RC.request({ service: argv[0], method: 'POST', data: argv.slice(1) }, handleRemoteRequest(argv[0]));
       return true;
     }
-    if ([ 'status', 'enable', 'disable', 'restart', 'list', 'save' ].some(makeRpc)) {
+    help();
+    return true;
+  })) {
+    return;
+  }
+
+  // Two styles:
+  //     http 3000
+  //     http modulename
+  function makeRpc(key) {
+    if (key !== argv[0]) {
+      return false;
+    }
+    RC.request({ service: argv[0], method: 'POST', data: argv.slice(1) }, handleRemoteRequest(argv[0]));
+    return true;
+  }
+  if ([ 'status', 'enable', 'disable', 'restart', 'list', 'save' ].some(makeRpc)) {
+    return;
+  }
+
+  help();
+  process.exit(11);
+}
+
+function handleRemoteRequest(service, fn) {
+  return function (err, body) {
+    if ('function' === typeof fn) {
+      fn(err, body); // XXX was resp
+      return;
+    }
+    console.info("");
+    if (err) {
+      console.warn("'" + service + "' may have failed."
+       + " Consider peaking at the logs either with 'journalctl -xeu telebit' or /opt/telebit/var/log/error.log");
+      console.warn(err.statusCode, err.message);
+      //cb(new Error("not okay"), body);
       return;
     }
 
-    help();
-    process.exit(11);
-  }
+    if (!body) {
+      console.info("👌");
+      return;
+    }
+
+    try {
+      body = JSON.parse(body);
+    } catch(e) {
+      // ignore
+
+    }
+
+    if ("AWAIT_AUTH" === body.code) {
+      console.info(body.message);
+    } else if ("CONFIG" === body.code) {
+      delete body.code;
+      //console.info(TOML.stringify(body));
+      console.info(YAML.safeDump(body));
+    } else {
+      if ('http' === body.module) {
+        // TODO we'll support slingshot-ing in the future
+        if (body.local) {
+          if (String(body.local) === String(parseInt(body.local, 10))) {
+            console.info('> Forwarding https://' + body.remote + ' => localhost:' + body.local);
+          } else {
+            console.info('> Serving ' + body.local + ' as https://' + body.remote);
+          }
+        } else {
+          console.info('> Rejecting End-to-End Encrypted HTTPS for now');
+        }
+      } else if ('tcp' === body.module) {
+        if (body.local) {
+          console.info('> Forwarding ' + state.config.relay + ':' + body.remote + ' => localhost:' + body.local);
+        } else {
+          console.info('> Rejecting Legacy TCP');
+        }
+      } else if ('ssh' === body.module) {
+        //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
+        if (body.local) {
+          console.info('> Forwarding ssh+https (openssl proxy) => localhost:' + body.local);
+        } else {
+          console.info('> Rejecting SSH-over-HTTPS for now');
+        }
+      } else if ('status' === body.module) {
+        // TODO funny one this one
+        if (body.port) {
+          console.info('http://localhost:' + (body.port));
+        }
+        console.info(JSON.stringify(body, null, 2));
+      } else {
+        console.info(JSON.stringify(body, null, 2));
+      }
+      console.info();
+    }
+  };
+}
+
+function getToken(fn) {
+  state.relay = state.config.relay;
+
+  // { _otp, config: {} }
+  common.api.token(state, {
+    error: function (err/*, next*/) {
+      console.error("[Error] common.api.token:");
+      console.error(err);
+      return;
+    }
+  , directory: function (dir, next) {
+      //console.log('[directory] Telebit Relay Discovered:');
+      //console.log(dir);
+      state._apiDirectory = dir;
+      next();
+    }
+  , tunnelUrl: function (tunnelUrl, next) {
+      //console.log('[tunnelUrl] Telebit Relay Tunnel Socket:', tunnelUrl);
+      state.wss = tunnelUrl;
+      next();
+    }
+  , requested: function (authReq, next) {
+      //console.log("[requested] Pairing Requested");
+      state.config._otp = state.config._otp = authReq.otp;
+
+      if (!state.config.token && state._can_pair) {
+        console.info(TPLS.remote.code.replace(/0000/g, state.config._otp));
+      }
+
+      next();
+    }
+  , connect: function (pretoken, next) {
+      //console.log("[connect] Enabling Pairing Locally...");
+      state.config.pretoken = pretoken;
+      state._connecting = true;
+
+      // TODO use php-style object querification
+      RC.request({ service: 'config', method: 'POST', data: state.config }, handleRemoteRequest('config', function (err/*, body*/) {
+        if (err) {
+          state._error = err;
+          console.error("Error while initializing config [connect]:");
+          console.error(err);
+          return;
+        }
+        console.info("waiting...");
+        next();
+      }));
+    }
+  , offer: function (token, next) {
+      //console.log("[offer] Pairing Enabled by Relay");
+      state.config.token = token;
+      if (state._error) {
+        return;
+      }
+      state._connecting = true;
+      try {
+        JWT.decode(token);
+        //console.log(JWT.decode(token));
+      } catch(e) {
+        console.warn("[warning] could not decode token");
+      }
+      RC.request({ service: 'config', method: 'POST', data: state.config }, handleRemoteRequest('config', function (err/*, body*/) {
+        if (err) {
+          state._error = err;
+          console.error("Error while initializing config [offer]:");
+          console.error(err);
+          return;
+        }
+        //console.log("Pairing Enabled Locally");
+        next();
+      }));
+    }
+  , granted: function (_, next) {
+      //console.log("[grant] Pairing complete!");
+      next();
+    }
+  , end: function () {
+      RC.request({ service: 'enable', method: 'POST', data: [] }, handleRemoteRequest('enable', function (err) {
+        if (err) { console.error(err); return; }
+        console.info("Success");
+
+        // workaround for https://github.com/nodejs/node/issues/21319
+        if (state._useTty) {
+          setTimeout(function () {
+            console.info("Some fun things to try first:\n");
+            console.info("    ~/telebit http ~/public");
+            console.info("    ~/telebit tcp 5050");
+            console.info("    ~/telebit ssh auto");
+            console.info();
+            console.info("Press any key to continue...");
+            console.info();
+            process.exit(0);
+          }, 0.5 * 1000);
+          return;
+        }
+        // end workaround
+
+        //parseCli(state);
+        fn();
+      }));
+    }
+  });
+}
+
+function parseConfig(text) {
+  var _clientConfig;
   try {
-    state._clientConfig = JSON.parse(text || '{}');
+    _clientConfig = JSON.parse(text || '{}');
   } catch(e1) {
     try {
-      state._clientConfig = YAML.safeLoad(text || '{}');
+      _clientConfig = YAML.safeLoad(text || '{}');
     } catch(e2) {
       try {
-        state._clientConfig = TOML.parse(text || '');
+        _clientConfig = TOML.parse(text || '');
       } catch(e3) {
         console.error(e1.message);
         console.error(e2.message);
@@ -480,268 +748,7 @@ function parseConfig(err, text) {
     }
   }
 
-  state._clientConfig = camelCopy(state._clientConfig || {}) || {};
-  RC = require('../lib/rc/index.js').create(state);
-  RC.requestAsync = require('util').promisify(RC.request);
-
-  if (!Object.keys(state._clientConfig).length) {
-    console.info('(' + state._ipc.comment + ": " + state._ipc.path + ')');
-    console.info("");
-  }
-
-  if ((err && 'ENOENT' === err.code) || !Object.keys(state._clientConfig).length) {
-    if (!err || 'ENOENT' === err.code) {
-      //console.warn("Empty config file. Run 'telebit init' to configure.\n");
-    } else {
-      console.warn("Couldn't load config:\n\n\t" + err.message + "\n");
-    }
-  }
-
-  function handleRemoteRequest(service, fn) {
-    return function (err, body) {
-      if ('function' === typeof fn) {
-        fn(err, body); // XXX was resp
-        return;
-      }
-      console.info("");
-      if (err) {
-        console.warn("'" + service + "' may have failed."
-         + " Consider peaking at the logs either with 'journalctl -xeu telebit' or /opt/telebit/var/log/error.log");
-        console.warn(err.statusCode, err.message);
-        //cb(new Error("not okay"), body);
-        return;
-      }
-
-      if (!body) {
-        console.info("👌");
-        return;
-      }
-
-      try {
-        body = JSON.parse(body);
-      } catch(e) {
-        // ignore
-
-      }
-
-      if ("AWAIT_AUTH" === body.code) {
-        console.info(body.message);
-      } else if ("CONFIG" === body.code) {
-        delete body.code;
-        //console.info(TOML.stringify(body));
-        console.info(YAML.safeDump(body));
-      } else {
-        if ('http' === body.module) {
-          // TODO we'll support slingshot-ing in the future
-          if (body.local) {
-            if (String(body.local) === String(parseInt(body.local, 10))) {
-              console.info('> Forwarding https://' + body.remote + ' => localhost:' + body.local);
-            } else {
-              console.info('> Serving ' + body.local + ' as https://' + body.remote);
-            }
-          } else {
-            console.info('> Rejecting End-to-End Encrypted HTTPS for now');
-          }
-        } else if ('tcp' === body.module) {
-          if (body.local) {
-            console.info('> Forwarding ' + state.config.relay + ':' + body.remote + ' => localhost:' + body.local);
-          } else {
-            console.info('> Rejecting Legacy TCP');
-          }
-        } else if ('ssh' === body.module) {
-          //console.info('> Forwarding ' + state.config.relay + ' -p ' + JSON.stringify(body) + ' => localhost:' + body.local);
-          if (body.local) {
-            console.info('> Forwarding ssh+https (openssl proxy) => localhost:' + body.local);
-          } else {
-            console.info('> Rejecting SSH-over-HTTPS for now');
-          }
-        } else if ('status' === body.module) {
-          // TODO funny one this one
-          if (body.port) {
-            console.info('http://localhost:' + (body.port));
-          }
-          console.info(JSON.stringify(body, null, 2));
-        } else {
-          console.info(JSON.stringify(body, null, 2));
-        }
-        console.info();
-      }
-    };
-  }
-
-  function getToken(fn) {
-    state.relay = state.config.relay;
-
-    // { _otp, config: {} }
-    common.api.token(state, {
-      error: function (err/*, next*/) {
-        console.error("[Error] common.api.token:");
-        console.error(err);
-        return;
-      }
-    , directory: function (dir, next) {
-        //console.log('[directory] Telebit Relay Discovered:');
-        //console.log(dir);
-        state._apiDirectory = dir;
-        next();
-      }
-    , tunnelUrl: function (tunnelUrl, next) {
-        //console.log('[tunnelUrl] Telebit Relay Tunnel Socket:', tunnelUrl);
-        state.wss = tunnelUrl;
-        next();
-      }
-    , requested: function (authReq, next) {
-        //console.log("[requested] Pairing Requested");
-        state.config._otp = state.config._otp = authReq.otp;
-
-        if (!state.config.token && state._can_pair) {
-          console.info(TPLS.remote.code.replace(/0000/g, state.config._otp));
-        }
-
-        next();
-      }
-    , connect: function (pretoken, next) {
-        //console.log("[connect] Enabling Pairing Locally...");
-        state.config.pretoken = pretoken;
-        state._connecting = true;
-
-        // TODO use php-style object querification
-        RC.request({ service: 'config', method: 'POST', data: state.config }, handleRemoteRequest('config', function (err/*, body*/) {
-          if (err) {
-            state._error = err;
-            console.error("Error while initializing config [connect]:");
-            console.error(err);
-            return;
-          }
-          console.info("waiting...");
-          next();
-        }));
-      }
-    , offer: function (token, next) {
-        //console.log("[offer] Pairing Enabled by Relay");
-        state.config.token = token;
-        if (state._error) {
-          return;
-        }
-        state._connecting = true;
-        try {
-          JWT.decode(token);
-          //console.log(JWT.decode(token));
-        } catch(e) {
-          console.warn("[warning] could not decode token");
-        }
-        RC.request({ service: 'config', method: 'POST', data: state.config }, handleRemoteRequest('config', function (err/*, body*/) {
-          if (err) {
-            state._error = err;
-            console.error("Error while initializing config [offer]:");
-            console.error(err);
-            return;
-          }
-          //console.log("Pairing Enabled Locally");
-          next();
-        }));
-      }
-    , granted: function (_, next) {
-        //console.log("[grant] Pairing complete!");
-        next();
-      }
-    , end: function () {
-        RC.request({ service: 'enable', method: 'POST', data: [] }, handleRemoteRequest('enable', function (err) {
-          if (err) { console.error(err); return; }
-          console.info("Success");
-
-          // workaround for https://github.com/nodejs/node/issues/21319
-          if (state._useTty) {
-            setTimeout(function () {
-              console.info("Some fun things to try first:\n");
-              console.info("    ~/telebit http ~/public");
-              console.info("    ~/telebit tcp 5050");
-              console.info("    ~/telebit ssh auto");
-              console.info();
-              console.info("Press any key to continue...");
-              console.info();
-              process.exit(0);
-            }, 0.5 * 1000);
-            return;
-          }
-          // end workaround
-
-          //parseCli(state);
-          fn();
-        }));
-      }
-    });
-  }
-
-  var bootState = {};
-  function bootstrap() {
-    // Create / retrieve account (sign-in, more or less)
-    // TODO hit directory resource /.well-known/openid-configuration -> acme_uri (?)
-    // Occassionally rotate the key just for the sake of testing the key rotation
-    return urequestAsync({
-      method: 'HEAD'
-    , url: RC.resolve('/acme/new-nonce')
-    , headers: { "User-Agent": 'Telebit/' + pkg.version }
-    }).then(function (resp) {
-      var nonce = resp.headers['replay-nonce'];
-      var newAccountUrl = RC.resolve('/acme/new-acct');
-      return keypairs.signJws({
-        jwk: state.key
-      , protected: {
-          // alg will be filled out automatically
-          jwk: state.pub
-        , kid: false
-        , nonce: nonce
-        , url: newAccountUrl
-        }
-      , payload: JSON.stringify({
-          // We can auto-agree here because the client is the user agent of the primary user
-          termsOfServiceAgreed: true
-        , contact: [] // I don't think we have email yet...
-        //, externalAccountBinding: null
-        })
-      }).then(function (jws) {
-        return urequestAsync({
-          url: newAccountUrl
-        , method: 'POST'
-        , json: jws // TODO default to post when body is present
-        , headers: {
-            "Content-Type": 'application/jose+json'
-          , "User-Agent": 'Telebit/' + pkg.version
-          }
-        }).then(function (resp) {
-          //nonce = resp.headers['replay-nonce'];
-          if (!resp.body || 'valid' !== resp.body.status) {
-            console.error('request jws:', jws);
-            console.error('response:');
-            console.error(resp.headers);
-            console.error(resp.body);
-            throw new Error("did not successfully create or restore account");
-          }
-          return RC.requestAsync({ service: 'config', method: 'GET' }).catch(function (err) {
-            if (err) {
-              if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-                console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
-                console.error(err);
-              } else if ('ENOTSOCK' === err.code) {
-                console.error(err);
-                return;
-              } else {
-                console.error(err);
-              }
-              process.exit(101);
-              return;
-            }
-          }).then(handleConfig);
-        });
-      });
-    }).catch(RC.createErrorHandler(bootstrap, bootState, function (err) {
-      console.error(err);
-      process.exit(17);
-    }));
-  }
-
-  bootstrap();
+  return camelCopy(_clientConfig || {}) || {};
 }
 
 var parsers = {
@@ -821,38 +828,100 @@ var parsers = {
   }
 };
 
-var keystore = require('../lib/keystore.js').create(state);
-state.keystore = keystore;
-state.keystoreSecure = !keystore.insecure;
-keystore.all().then(function (list) {
-  var keyext = '.key.jwk.json';
-  var key;
-  // TODO create map by account and index into that map to get the master key
-  // and sort keys in the process
-  list.some(function (el) {
-    if (keyext === el.account.slice(-keyext.length)
-      && el.password.kty && el.password.kid) {
-      key = el.password;
-      return true;
-    }
-  });
-
-  if (key) {
-    state.key = key;
-    state.pub = keypairs.neuter({ jwk: key });
-    fs.readFile(confpath, 'utf8', parseConfig);
-    return;
+//
+// Start by reading the config file, before all else
+//
+util.promisify(fs.readFile)(confpath, 'utf8').catch(function (err) {
+  if (err && 'ENOENT' !== err.code) {
+    console.warn("Couldn't load config:\n\n\t" + err.message + "\n");
   }
+}).then(function (text) {
+  state._clientConfig = parseConfig(text);
+  RC = require('../lib/rc/index.js').create(state); // adds state._ipc
+  if (!Object.keys(state._clientConfig).length) {
+    console.info('(' + state._ipc.comment + ": " + state._ipc.path + ')');
+    console.info("");
+  }
+  RC.requestAsync = require('util').promisify(RC.request);
+}).then(function () {
+  var keystore = require('../lib/keystore.js').create(state);
+  state.keystore = keystore;
+  state.keystoreSecure = !keystore.insecure;
+  keystore.all().then(function (list) {
+    var keyext = '.key.jwk.json';
+    var key;
+    var p;
 
-  return keypairs.generate().then(function (pair) {
-    var jwk = pair.private;
-    return keypairs.thumbprint({ jwk: jwk }).then(function (kid) {
-      jwk.kid = kid;
-      return keystore.set(kid + keyext, jwk).then(function () {
-        var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
-        console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
-        state.key = jwk;
-        fs.readFile(confpath, 'utf8', parseConfig);
+    // TODO create map by account and index into that map to get the master key
+    // and sort keys in the process
+    list.some(function (el) {
+      if (keyext === el.account.slice(-keyext.length)
+        && el.password.kty && el.password.kid) {
+        key = el.password;
+        return true;
+      }
+    });
+
+    if (key) {
+      p = Promise.resolve(key);
+    } else {
+      p = keypairs.generate().then(function (pair) {
+        var jwk = pair.private;
+        return keypairs.thumbprint({ jwk: jwk }).then(function (kid) {
+          var size = (jwk.crv || Buffer.from(jwk.n, 'base64').byteLength * 8);
+          jwk.kid = kid;
+          console.info("Generated new %s %s private key with thumbprint %s", jwk.kty, size, kid);
+          return keystore.set(kid + keyext, jwk).then(function () {
+            return jwk;
+          });
+        });
+      });
+    }
+
+    return p.then(function (key) {
+      state.key = key;
+      state.pub = keypairs.neuter({ jwk: key });
+      // we don't have config yet
+      state.config = {};
+      return bootstrap({ key: state.key, onlyReturnExisting: true }).catch(function (err) {
+        console.error("[DEBUG] local account not created?");
+        console.error(err);
+        // Ask for email address. The prior email may have been bad
+        return require('util').promisify(askEmail).then(function (email) {
+          return bootstrap({ key: state.key, email: email });
+        });
+      }).catch(function (err) {
+        console.error(err);
+        console.error("You may need to go into the web interface and allow Telebit Client by ID '" + key.kid + "'");
+        process.exit(10);
+      }).then(function (result) {
+        //#console.log("Telebit Account Bootstrap result:");
+        //#console.log(result.body);
+        state.config.email = (result.body.contact[0]||'').replace(/mailto:/, '');
+        var p2;
+        if (state.key.sub === state.config.email) {
+          p2 = Promise.resolve(state.key);
+        } else {
+          state.key.sub = state.config.email;
+          p2 = keystore.set(state.key.kid + keyext, state.key);
+        }
+        return p2.then(function () {
+          return RC.requestAsync({ service: 'config', method: 'GET' }).catch(function (err) {
+            if (err) {
+              if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+                console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
+                console.error(err);
+              } else if ('ENOTSOCK' === err.code) {
+                console.error(err);
+                return;
+              } else {
+                console.error(err);
+              }
+              process.exit(101);
+              return;
+            }
+          }).then(handleConfig);
+        });
       });
     });
   });
diff --git a/bin/telebitd.js b/bin/telebitd.js
index 0c22280..b683533 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -525,6 +525,27 @@ controllers.newAccount = function (req, res) {
     });
   });
 };
+controllers.acmeAccounts = function (req, res) {
+  if (!req.jws || !req.jws.verified) {
+    res.statusCode = 400;
+    res.send({"error":{"message": "this type of requests must be encoded as a jws payload"
+      + " and signed by a known account holder"}});
+    return;
+  }
+  var account;
+  var accountId = req.params[0];
+  DB.accounts.some(function (acc) {
+    // TODO calculate thumbprint from jwk
+    // find a key with matching jwk
+    if (acc._id === accountId) {
+      account = acc;
+      return true;
+    }
+  });
+  // TODO check that the JWS matches the accountI
+  console.warn("[warn] account ID still acts as secret, should use JWS kid for verification");
+  res.send(account);
+};
 
 function jsonEggspress(req, res, next) {
   /*
@@ -1064,6 +1085,10 @@ function handleApi() {
 
     next();
   }
+  // TODO convert /acme/accounts/:account_id into a regex
+  app.get(/^\/acme\/accounts\/([\w]+)/, controllers.acmeAccounts);
+  // POST-as-GET
+  app.post(/^\/acme\/accounts\/([\w]+)/, controllers.acmeAccounts);
   app.use(/\b(relay)\b/, mustTrust, controllers.relay);
   app.get(/\b(config)\b/, mustTrust, getConfigOnly);
   app.use(/\b(init|config)\b/, mustTrust, initOrConfig);
diff --git a/lib/admin/js/app.js b/lib/admin/js/app.js
index 82705d4..be507a1 100644
--- a/lib/admin/js/app.js
+++ b/lib/admin/js/app.js
@@ -186,29 +186,31 @@ var telebitState = {};
 var appMethods = {
   initialize: function () {
     console.log("call initialize");
-    if (!appData.init.relay) {
-      appData.init.relay = DEFAULT_RELAY;
-    }
-    appData.init.relay = appData.init.relay.toLowerCase();
-    telebitState = { relay: appData.init.relay };
-
-    return Telebit.api.directory(telebitState).then(function (dir) {
-      if (!dir.api_host) {
-        window.alert("Error: '" + telebitState.relay + "' does not appear to be a valid telebit service");
-        return;
+    return requestAccountHelper().then(function (/*key*/) {
+      if (!appData.init.relay) {
+        appData.init.relay = DEFAULT_RELAY;
       }
+      appData.init.relay = appData.init.relay.toLowerCase();
+      telebitState = { relay: appData.init.relay };
 
-      telebitState.dir = dir;
+      return Telebit.api.directory(telebitState).then(function (dir) {
+        if (!dir.api_host) {
+          window.alert("Error: '" + telebitState.relay + "' does not appear to be a valid telebit service");
+          return;
+        }
 
-      // If it's one of the well-known relays
-      if (-1 !== TELEBIT_RELAYS.indexOf(appData.init.relay)) {
-        return doConfigure();
-      } else {
-        changeState('advanced');
-      }
-    }).catch(function (err) {
-      console.error(err);
-      window.alert("Error: [initialize] " + (err.message || JSON.stringify(err, null, 2)));
+        telebitState.dir = dir;
+
+        // If it's one of the well-known relays
+        if (-1 !== TELEBIT_RELAYS.indexOf(appData.init.relay)) {
+          return doConfigure();
+        } else {
+          changeState('advanced');
+        }
+      }).catch(function (err) {
+        console.error(err);
+        window.alert("Error: [initialize] " + (err.message || JSON.stringify(err, null, 2)));
+      });
     });
   }
 , advance: function () {
@@ -473,54 +475,84 @@ new Vue({
 , methods: appMethods
 });
 
-function run(key) {
-  api._key = key;
-  // 😁 1. Get ACME directory
-  // 😁 2. Fetch ACME account
-  // 3. Test if account has access
-  // 4. Show command line auth instructions to auth
-  // 5. Sign requests / use JWT
-  // 6. Enforce token required for config, status, etc
-  // 7. Move admin interface to standard ports (admin.foo-bar-123.telebit.xyz)
-  api.config().then(function (config) {
-    telebitState.config = config;
-    if (config.greenlock) {
-      appData.init.acmeServer = config.greenlock.server;
-    }
-    if (config.relay) {
-      appData.init.relay = config.relay;
-    }
-    if (config.email) {
-      appData.init.email = config.email;
-    }
-    if (config.agreeTos) {
-      appData.init.letos = config.agreeTos;
-      appData.init.teletos = config.agreeTos;
-    }
-    if (config._otp) {
-      appData.init.otp = config._otp;
-    }
-
-    telebitState.pollUrl = config._pollUrl || localStorage.getItem('poll_url');
-
-    if ((!config.token && !config._otp) || !config.relay || !config.email || !config.agreeTos) {
-      changeState('setup');
-      setState();
+function requestAccountHelper() {
+  function reset() {
+    changeState('setup');
+    setState();
+  }
+  return new Promise(function (resolve) {
+    appData.init.email = localStorage.getItem('email');
+    if (!appData.init.email) {
+      // don't resolve
+      reset();
       return;
     }
-    if (!config.token && config._otp) {
-      changeState('otp');
-      setState();
-      // this will skip ahead as necessary
-      return Telebit.authorize(telebitState, showOtp).then(function () {
-        return changeState('status');
-      });
-    }
+    return requestAccount(appData.init.email).then(function (key) {
+      if (!key) { throw new Error("[SANITY] Error: completed without key"); }
+      resolve(key);
+    }).catch(function (err) {
+      appData.init.email = "";
+      localStorage.removeItem('email');
+      console.error(err);
+      window.alert("something went wrong");
+      // don't resolve
+      reset();
+    });
+  });
+}
 
-    // TODO handle default state
-    changeState('status');
-  }).catch(function (err) {
-    appData.views.flash.error = err.message || JSON.stringify(err, null, 2);
+function run() {
+  return requestAccountHelper().then(function (key) {
+    api._key = key;
+    // TODO create session instance of Telebit
+    Telebit._key = key;
+    // 😁 1. Get ACME directory
+    // 😁 2. Fetch ACME account
+    // 3. Test if account has access
+    // 4. Show command line auth instructions to auth
+    // 😁 5. Sign requests / use JWT
+    // 😁 6. Enforce token required for config, status, etc
+    // 7. Move admin interface to standard ports (admin.foo-bar-123.telebit.xyz)
+    api.config().then(function (config) {
+      telebitState.config = config;
+      if (config.greenlock) {
+        appData.init.acmeServer = config.greenlock.server;
+      }
+      if (config.relay) {
+        appData.init.relay = config.relay;
+      }
+      if (config.email) {
+        appData.init.email = config.email;
+      }
+      if (config.agreeTos) {
+        appData.init.letos = config.agreeTos;
+        appData.init.teletos = config.agreeTos;
+      }
+      if (config._otp) {
+        appData.init.otp = config._otp;
+      }
+
+      telebitState.pollUrl = config._pollUrl || localStorage.getItem('poll_url');
+
+      if ((!config.token && !config._otp) || !config.relay || !config.email || !config.agreeTos) {
+        changeState('setup');
+        setState();
+        return;
+      }
+      if (!config.token && config._otp) {
+        changeState('otp');
+        setState();
+        // this will skip ahead as necessary
+        return Telebit.authorize(telebitState, showOtp).then(function () {
+          return changeState('status');
+        });
+      }
+
+      // TODO handle default state
+      changeState('status');
+    }).catch(function (err) {
+      appData.views.flash.error = err.message || JSON.stringify(err, null, 2);
+    });
   });
 }
 
@@ -543,46 +575,34 @@ function getKey() {
   });
 }
 
-function getEmail() {
-  return Promise.resolve().then(function () {
-    var email = localStorage.getItem('email');
-    if (email) { return email; }
-    while (!email) {
-      email = window.prompt("Email address (device owner)?");
-    }
-    return email;
-  });
-}
-function requestAccount() {
+function requestAccount(email) {
   return getKey().then(function (jwk) {
-    return getEmail().then(function(email) {
-      // creates new or returns existing
-      var acme = ACME.create({});
-      var url = window.location.protocol + '//' + window.location.host + '/acme/directory';
-      return acme.init(url).then(function () {
-        return acme.accounts.create({
-          agreeToTerms: function (tos) { return tos; }
-        , accountKeypair: { privateKeyJwk: jwk }
-        , email: email
-        }).then(function (account) {
-          console.log('account:');
-          console.log(account);
-          if (account.id) {
-            localStorage.setItem('email', email);
-          }
-          return jwk;
-        });
+    // creates new or returns existing
+    var acme = ACME.create({});
+    var url = window.location.protocol + '//' + window.location.host + '/acme/directory';
+    return acme.init(url).then(function () {
+      return acme.accounts.create({
+        agreeToTerms: function (tos) { return tos; }
+      , accountKeypair: { privateKeyJwk: jwk }
+      , email: email
+      }).then(function (account) {
+        console.log('account:');
+        console.log(account);
+        if (account.id) {
+          localStorage.setItem('email', email);
+        }
+        return jwk;
       });
     });
   });
 }
 
 window.api = api;
-requestAccount().then(function (jwk) {
-  run(jwk);
-  setTimeout(function () {
-    document.body.hidden = false;
-  }, 50);
-});
+run();
+setTimeout(function () {
+  document.body.hidden = false;
+}, 50);
 
+// Debug
+window.changeState = changeState;
 }());
diff --git a/lib/eggspress.js b/lib/eggspress.js
index 82249fe..e0e29aa 100644
--- a/lib/eggspress.js
+++ b/lib/eggspress.js
@@ -34,11 +34,12 @@ module.exports = function eggspress() {
       }
 
       var urlstr = (req.url.replace(/\/$/, '') + '/');
-      if (!urlstr.match(todo[0])) {
+      var match = urlstr.match(todo[0]);
+      if (!match) {
         //console.log("[eggspress] pattern doesn't match", todo[0], req.url);
         next();
         return;
-      } else if ('string' === typeof todo[0] && 0 !== urlstr.match(todo[0]).index) {
+      } else if ('string' === typeof todo[0] && 0 !== match.index) {
         //console.log("[eggspress] string pattern is not the start", todo[0], req.url);
         next();
         return;
@@ -58,6 +59,7 @@ module.exports = function eggspress() {
       }
 
       var fns = todo[1].slice(0);
+      req.params = match.slice(1);
 
       function nextTodo(err) {
         if (err) { fail(err); return; }
diff --git a/lib/rc/index.js b/lib/rc/index.js
index 9ef2df6..f3c8d88 100644
--- a/lib/rc/index.js
+++ b/lib/rc/index.js
@@ -93,26 +93,45 @@ module.exports.create = function (state) {
     }
     return reqOpts;
   };
-  RC.createErrorHandler = function (replay, opts, cb) {
+  RC.createRelauncher = function (replay, opts, cb) {
     return function (err) {
-      // ENOENT - never started, cleanly exited last start, or creating socket at a different path
-      // ECONNREFUSED - leftover socket just needs to be restarted
-      if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-        if (opts._taketwo) {
-          cb(err);
+      /*global Promise*/
+      var p = new Promise(function (resolve, reject) {
+        // ENOENT - never started, cleanly exited last start, or creating socket at a different path
+        // ECONNREFUSED - leftover socket just needs to be restarted
+        if ('ENOENT' !== err.code && 'ECONNREFUSED' !== err.code) {
+          reject(err);
           return;
         }
+
+        // retried and failed again: quit
+        if (opts._taketwo) {
+          reject(err);
+          return;
+        }
+
         require('../../usr/share/install-launcher.js').install({ env: process.env }, function (err) {
-          if (err) { cb(err); return; }
+          if (err) { reject(err); return; }
           opts._taketwo = true;
           setTimeout(function () {
-            replay(opts, cb);
+            if (replay.length <= 1) {
+              replay(opts).then(resolve).catch(reject);
+              return;
+            } else {
+              replay(opts, function (err, res) {
+                if (err) { reject(err); }
+                else { resolve(res); }
+              });
+              return;
+            }
           }, 2500);
         });
         return;
+      });
+      if (cb) {
+        p.then(function () { cb(null); }).catch(function (err) { cb(err); });
       }
-
-      cb(err);
+      return p;
     };
   };
   RC.request = function request(opts, fn) {
@@ -141,7 +160,8 @@ module.exports.create = function (state) {
       makeResponder(service, resp, fn);
     });
 
-    req.on('error', RC.createErrorHandler(RC.request, opts, fn));
+    var errHandler = RC.createRelauncher(RC.request, opts, fn);
+    req.on('error', errHandler);
 
     // Simple GET
     if ('POST' !== method || !opts.data) {
-- 
2.38.5


From 5db75f1aa49106fb95decedccb8d4871ef4ae2d1 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 14 May 2019 02:27:08 -0600
Subject: [PATCH 66/68] WIP restructure local client boot and config

---
 bin/telebit-remote.js | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index dbcd12e..a131561 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -402,10 +402,22 @@ function bootstrap(opts) {
           console.error(resp.body);
           throw new Error("did not successfully create or restore account");
         }
-        return resp;
+        return resp.body;
       });
     });
   }).catch(RC.createRelauncher(bootstrap._replay(opts), bootstrap._bootstate)).catch(function (err) {
+    if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+      console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
+      console.error(err);
+    } else if ('ENOTSOCK' === err.code) {
+      console.error("Strange socket error:");
+      console.error(err);
+      // Is this ignorable?
+      //return;
+    } else {
+      console.error("Unknown error:");
+      console.error(err);
+    }
     console.error(err);
     process.exit(17);
   });
@@ -896,8 +908,8 @@ util.promisify(fs.readFile)(confpath, 'utf8').catch(function (err) {
         process.exit(10);
       }).then(function (result) {
         //#console.log("Telebit Account Bootstrap result:");
-        //#console.log(result.body);
-        state.config.email = (result.body.contact[0]||'').replace(/mailto:/, '');
+        //#console.log(result);
+        state.config.email = (result.contact[0]||'').replace(/mailto:/, '');
         var p2;
         if (state.key.sub === state.config.email) {
           p2 = Promise.resolve(state.key);
@@ -906,25 +918,15 @@ util.promisify(fs.readFile)(confpath, 'utf8').catch(function (err) {
           p2 = keystore.set(state.key.kid + keyext, state.key);
         }
         return p2.then(function () {
-          return RC.requestAsync({ service: 'config', method: 'GET' }).catch(function (err) {
-            if (err) {
-              if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-                console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
-                console.error(err);
-              } else if ('ENOTSOCK' === err.code) {
-                console.error(err);
-                return;
-              } else {
-                console.error(err);
-              }
-              process.exit(101);
-              return;
-            }
-          }).then(handleConfig);
+          return RC.requestAsync({ service: 'config', method: 'GET' }).then(handleConfig);
         });
       });
     });
   });
+}).catch(function (err) {
+  console.error("Telebit failed to stay running:");
+  console.error(err);
+  process.exit(101);
 });
 
 }());
-- 
2.38.5


From 202a7333543487a44830afc6b1f96a1b4bfdfdbb Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Tue, 14 May 2019 19:50:41 -0600
Subject: [PATCH 67/68] generate account on CLI first use

---
 bin/telebit-remote.js | 60 ++++++++++++++++++++++++-------------------
 1 file changed, 33 insertions(+), 27 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index a131561..e17a99f 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -126,6 +126,7 @@ Console.setup = function (state) {
   Console.rl = rl;
 };
 Console.teardown = function () {
+  if (!Console.rl) { return; }
   // https://github.com/nodejs/node/issues/21319
   if (useTty) { try { Console.stdin.push(null); } catch(e) { /*ignore*/ } }
   Console.rl.close();
@@ -134,7 +135,7 @@ Console.teardown = function () {
 };
 
 function askEmail(cb) {
-  Console.setup();
+  Console.setup(state);
   if (state.config.email) { cb(); return; }
   console.info(TPLS.remote.setup.email);
   // TODO attempt to read email from npmrc or the like?
@@ -361,6 +362,21 @@ function bootstrap(opts) {
     method: 'HEAD'
   , url: RC.resolve('/acme/new-nonce')
   , headers: { "User-Agent": 'Telebit/' + pkg.version }
+  }).catch(RC.createRelauncher(bootstrap._replay(opts), bootstrap._state)).catch(function (err) {
+    if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
+      console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
+      console.error(err);
+    } else if ('ENOTSOCK' === err.code) {
+      console.error("Strange socket error:");
+      console.error(err);
+      // Is this ignorable?
+      //return;
+    } else {
+      console.error("Unknown error:");
+      console.error(err);
+    }
+    console.error(err);
+    process.exit(17);
   }).then(function (resp) {
     var nonce = resp.headers['replay-nonce'];
     var newAccountUrl = RC.resolve('/acme/new-acct');
@@ -396,33 +412,20 @@ function bootstrap(opts) {
       }).then(function (resp) {
         //nonce = resp.headers['replay-nonce'];
         if (!resp.body || 'valid' !== resp.body.status) {
-          console.error('request jws:', jws);
-          console.error('response:');
-          console.error(resp.headers);
-          console.error(resp.body);
-          throw new Error("did not successfully create or restore account");
+          throw new Error("Did not successfully create or restore account:\n"
+            + "Email: " + opts.email + "\n"
+            + "Request JWS:\n" + JSON.stringify(jws, null, 2) + "\n"
+            + "Response:\n"
+            + "Headers:\n" + JSON.stringify(resp.headers, null, 2) + "\n"
+            + "Body:\n" + resp.body + "\n"
+          );
         }
         return resp.body;
       });
     });
-  }).catch(RC.createRelauncher(bootstrap._replay(opts), bootstrap._bootstate)).catch(function (err) {
-    if ('ENOENT' === err.code || 'ECONNREFUSED' === err.code) {
-      console.error("Either the telebit service was not already (and could not be started) or its socket could not be written to.");
-      console.error(err);
-    } else if ('ENOTSOCK' === err.code) {
-      console.error("Strange socket error:");
-      console.error(err);
-      // Is this ignorable?
-      //return;
-    } else {
-      console.error("Unknown error:");
-      console.error(err);
-    }
-    console.error(err);
-    process.exit(17);
   });
 }
-bootstrap._bootstate = {};
+bootstrap._state = {};
 bootstrap._replay = function (_opts) {
   return function (opts) {
     // supply opts to match reverse signature (.length checking)
@@ -465,6 +468,7 @@ function handleConfig(config) {
         parseCli(state);
       });
     });
+    // TODO XXXXXXX
     return;
   }
 
@@ -505,6 +509,8 @@ function handleConfig(config) {
       }
     });
     return;
+  } else {
+    Console.teardown();
   }
 
   //console.log("no questioning:");
@@ -895,12 +901,12 @@ util.promisify(fs.readFile)(confpath, 'utf8').catch(function (err) {
       state.pub = keypairs.neuter({ jwk: key });
       // we don't have config yet
       state.config = {};
-      return bootstrap({ key: state.key, onlyReturnExisting: true }).catch(function (err) {
-        console.error("[DEBUG] local account not created?");
-        console.error(err);
+      return bootstrap({ key: state.key, onlyReturnExisting: true }).catch(function (/*#err*/) {
+        //#console.warn("[DEBUG] local account not created?");
+        //#console.warn(err);
         // Ask for email address. The prior email may have been bad
-        return require('util').promisify(askEmail).then(function (email) {
-          return bootstrap({ key: state.key, email: email });
+        return require('util').promisify(askEmail)().then(function () {
+          return bootstrap({ key: state.key, email: state.config.email });
         });
       }).catch(function (err) {
         console.error(err);
-- 
2.38.5


From 8ff85ff621c731e2f89f7108545317e79a28ffb5 Mon Sep 17 00:00:00 2001
From: AJ ONeal <coolaj86@gmail.com>
Date: Sat, 18 May 2019 14:03:36 -0600
Subject: [PATCH 68/68] re-org and update

---
 bin/telebit-remote.js | 66 +++++++++++++++++++++++++------------------
 bin/telebitd.js       | 12 +++++---
 2 files changed, 46 insertions(+), 32 deletions(-)

diff --git a/bin/telebit-remote.js b/bin/telebit-remote.js
index e17a99f..4bae802 100755
--- a/bin/telebit-remote.js
+++ b/bin/telebit-remote.js
@@ -160,6 +160,30 @@ function askForConfig(state, mainCb) {
   // >= 300ms is long enough to become distracted and change focus (a full blink, time for an idea to form as a thought)
   // <= 100ms is shorter than normal human reaction time (ability to place events chronologically, which happened first)
   // ~ 150-250ms is the sweet spot for most humans (long enough to notice change and not be jarred, but stay on task)
+
+  function askAgree(cb) {
+    if (state.config.agreeTos) { cb(); return; }
+    console.info("");
+    console.info("");
+    console.info("Do you accept the terms of service for each and all of the following?");
+    console.info("");
+    console.info("\tTelebit - End-to-End Encrypted Relay");
+    console.info("\tGreenlock - Automated HTTPS");
+    console.info("\tLet's Encrypt - TLS Certificates");
+    console.info("");
+    console.info("Type 'y' or 'yes' to accept these Terms of Service.");
+    console.info("");
+    Console.rl.question('agree to all? [y/N]: ', function (resp) {
+      resp = resp.trim();
+      if (!/^y(es)?$/i.test(resp) && 'true' !== resp) {
+        throw new Error("You didn't accept the Terms of Service... not sure what to do...");
+      }
+      state.config.agreeTos = true;
+      console.info("");
+      setTimeout(cb, 250);
+    });
+  }
+
   var firstSet = [
     askEmail
   , function askRelay(cb) {
@@ -210,28 +234,7 @@ function askForConfig(state, mainCb) {
   var standardSet = [
     // There are questions that we need to ask in the CLI
     // if we can't guarantee that they are being asked in the web interface
-    function askAgree(cb) {
-      if (state.config.agreeTos) { cb(); return; }
-      console.info("");
-      console.info("");
-      console.info("Do you accept the terms of service for each and all of the following?");
-      console.info("");
-      console.info("\tTelebit - End-to-End Encrypted Relay");
-      console.info("\tGreenlock - Automated HTTPS");
-      console.info("\tLet's Encrypt - TLS Certificates");
-      console.info("");
-      console.info("Type 'y' or 'yes' to accept these Terms of Service.");
-      console.info("");
-      Console.rl.question('agree to all? [y/N]: ', function (resp) {
-        resp = resp.trim();
-        if (!/^y(es)?$/i.test(resp) && 'true' !== resp) {
-          throw new Error("You didn't accept the Terms of Service... not sure what to do...");
-        }
-        state.config.agreeTos = true;
-        console.info("");
-        setTimeout(cb, 250);
-      });
-    }
+    askAgree
   , function askUpdates(cb) {
       // required means transactional, security alerts, mandatory updates
       var options = [ 'newsletter', 'important', 'required' ];
@@ -270,7 +273,8 @@ function askForConfig(state, mainCb) {
     }
   ];
   var fossSet = [
-    function askTokenOrSecret(cb) {
+    askAgree
+  , function askTokenOrSecret(cb) {
       if (state._can_pair || state.token || state.config.token
         || state.secret || state.config.secret) { cb(); return; }
       console.info("");
@@ -445,10 +449,6 @@ function handleConfig(config) {
     console.info(verstr.join(' '));
   }
 
-  if (!state.config.email && _config) {
-    state.config.email = _config.email;
-  }
-
   //
   // check for init first, before anything else
   // because it has arguments that may help in
@@ -669,6 +669,7 @@ function getToken(fn) {
       state.config._otp = state.config._otp = authReq.otp;
 
       if (!state.config.token && state._can_pair) {
+        // Hey, Listen
         console.info(TPLS.remote.code.replace(/0000/g, state.config._otp));
       }
 
@@ -916,6 +917,7 @@ util.promisify(fs.readFile)(confpath, 'utf8').catch(function (err) {
         //#console.log("Telebit Account Bootstrap result:");
         //#console.log(result);
         state.config.email = (result.contact[0]||'').replace(/mailto:/, '');
+        state.config.agreeTos = true;
         var p2;
         if (state.key.sub === state.config.email) {
           p2 = Promise.resolve(state.key);
@@ -924,7 +926,15 @@ util.promisify(fs.readFile)(confpath, 'utf8').catch(function (err) {
           p2 = keystore.set(state.key.kid + keyext, state.key);
         }
         return p2.then(function () {
-          return RC.requestAsync({ service: 'config', method: 'GET' }).then(handleConfig);
+          return RC.requestAsync({ service: 'config', method: 'GET' }).then(function (config) {
+            if (!config.email) {
+              config.email = state.config.email;
+            }
+            if (!config.agreeTos) {
+              config.agreeTos = state.config.agreeTos;
+            }
+            handleConfig(config);
+          });
         });
       });
     });
diff --git a/bin/telebitd.js b/bin/telebitd.js
index b683533..4db9fcd 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -794,7 +794,7 @@ function handleApi() {
         return;
       }
 
-      listSuccess();
+      listSuccess(req, res);
     });
   }
 
@@ -912,7 +912,9 @@ function handleApi() {
 
     // init also means enable
     delete state.config.disable;
-    safeStartTelebitRemote(true).then(saveAndReport).catch(handleError);
+    safeStartTelebitRemote(true).then(function () {
+      saveAndReport(req, res);
+    }).catch(handleError);
   }
 
   function restart(req, res) {
@@ -968,7 +970,7 @@ function handleApi() {
         });
         return;
       }
-      listSuccess();
+      listSuccess(req, res);
     });
   }
 
@@ -994,7 +996,9 @@ function handleApi() {
         listSuccess(req, res);
         return;
       }
-      safeStartTelebitRemote(true).then(listSuccess).catch(function () {
+      safeStartTelebitRemote(true).then(function () {
+        listSuccess(req, res);
+      }).catch(function () {
         handleError(err, req, res);
       });
     });
-- 
2.38.5