@bitgo-beta/abstract-utxo 1.1.1-beta.222 → 1.1.1-beta.2221

package/dist/cjs/test/unit/signTransaction.js

@@ -0,0 +1,223 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const utxolib = __importStar(require("@bitgo-beta/utxo-lib"));
+const nock = require("nock");
+const utxo_lib_1 = require("@bitgo-beta/utxo-lib");
+const sdk_core_1 = require("@bitgo-beta/sdk-core");
+const src_1 = require("../../src");
+const util_1 = require("./util");
+describe('signTransaction', function () {
+    const bgUrl = sdk_core_1.common.Environments[util_1.defaultBitGo.getEnv()].uri;
+    const coin = (0, util_1.getUtxoCoin)('btc');
+    const wallet = (0, util_1.getUtxoWallet)(coin, { id: '5b34252f1bf349930e34020a00000000', coin: coin.getChain() });
+    const rootWalletKeys = (0, util_1.getDefaultWalletKeys)();
+    const userPrv = rootWalletKeys.user.toBase58();
+    const pubs = util_1.keychainsBase58.map((v) => v.pub);
+    function validatePsbt(txHex, targetSigCount, targetNonceCount) {
+        const psbt = utxolib.bitgo.createPsbtFromHex(txHex, (0, util_1.getNetworkForCoinName)(coin.name));
+        psbt.data.inputs.forEach((input, index) => {
+            const parsed = utxolib.bitgo.parsePsbtInput(input);
+            if (parsed.scriptType === 'taprootKeyPathSpend') {
+                assert.ok(targetNonceCount);
+                const nonce = psbt.getProprietaryKeyVals(index, {
+                    identifier: utxolib.bitgo.PSBT_PROPRIETARY_IDENTIFIER,
+                    subtype: utxolib.bitgo.ProprietaryKeySubtype.MUSIG2_PUB_NONCE,
+                });
+                assert.strictEqual(nonce.length, targetNonceCount);
+            }
+            const expectedSigCount = parsed.scriptType === 'p2shP2pk' || targetSigCount === 0 ? undefined : 1;
+            assert.strictEqual(parsed.signatures?.length, expectedSigCount);
+        });
+    }
+    function validateTx(txHex, unspents, targetSigCount) {
+        const tx = utxolib.bitgo.createTransactionFromHex(txHex, (0, util_1.getNetworkForCoinName)(coin.name));
+        unspents.forEach((u, i) => {
+            const sigCount = utxolib.bitgo.getStrictSignatureCount(tx.ins[i]);
+            const expectedSigCount = utxolib.bitgo.isWalletUnspent(u) && !!targetSigCount ? 1 : 0;
+            assert.strictEqual(sigCount, expectedSigCount);
+        });
+    }
+    async function signTransaction(tx, useSigningSteps, unspents) {
+        const isPsbt = tx instanceof utxolib.bitgo.UtxoPsbt;
+        const isTxWithTaprootKeyPathSpend = isPsbt && utxolib.bitgo.isTransactionWithKeyPathSpendInput(tx);
+        const txHex = tx.toHex();
+        function nockSignPsbt(psbtHex) {
+            const psbt = utxolib.bitgo.createPsbtFromHex(psbtHex, (0, util_1.getNetworkForCoinName)(coin.name));
+            return nock(bgUrl)
+                .post(`/api/v2/${wallet.coin()}/wallet/${wallet.id()}/tx/signpsbt`, (body) => body.psbt)
+                .reply(200, { psbt: psbt.setAllInputsMusig2NonceHD(rootWalletKeys.bitgo).toHex() });
+        }
+        if (!useSigningSteps) {
+            let scope;
+            if (tx instanceof utxolib.bitgo.UtxoPsbt && isTxWithTaprootKeyPathSpend) {
+                scope = nockSignPsbt(tx.clone().setAllInputsMusig2NonceHD(rootWalletKeys.bitgo).toHex());
+            }
+            const psbt = await coin.signTransaction({
+                txPrebuild: {
+                    txHex,
+                    txInfo: isPsbt ? undefined : { unspents },
+                    walletId: isTxWithTaprootKeyPathSpend ? wallet.id() : undefined,
+                },
+                prv: userPrv,
+                pubs,
+            });
+            assert.ok('txHex' in psbt);
+            if (isPsbt) {
+                validatePsbt(psbt.txHex, 1, 2);
+            }
+            else {
+                assert.ok(unspents);
+                validateTx(psbt.txHex, unspents, 1);
+            }
+            if (scope) {
+                assert.strictEqual(scope.isDone(), true);
+            }
+            return;
+        }
+        const signerNoncePsbt = await coin.signTransaction({
+            txPrebuild: { txHex },
+            prv: userPrv,
+            pubs,
+            signingStep: 'signerNonce',
+        });
+        assert.ok('txHex' in signerNoncePsbt);
+        if (isPsbt) {
+            validatePsbt(signerNoncePsbt.txHex, 0, isTxWithTaprootKeyPathSpend ? 1 : undefined);
+        }
+        else {
+            assert.ok(unspents);
+            validateTx(signerNoncePsbt.txHex, unspents, 0);
+        }
+        let scope;
+        if (isTxWithTaprootKeyPathSpend) {
+            scope = nockSignPsbt(signerNoncePsbt.txHex);
+        }
+        const cosignerNoncePsbt = await coin.signTransaction({
+            txPrebuild: { ...signerNoncePsbt, walletId: wallet.id() },
+            pubs,
+            signingStep: 'cosignerNonce',
+        });
+        assert.ok('txHex' in cosignerNoncePsbt);
+        if (isPsbt) {
+            validatePsbt(cosignerNoncePsbt.txHex, 0, isTxWithTaprootKeyPathSpend ? 2 : undefined);
+        }
+        else {
+            assert.ok(unspents);
+            validateTx(cosignerNoncePsbt.txHex, unspents, 0);
+        }
+        if (scope) {
+            assert.strictEqual(scope.isDone(), true);
+        }
+        const signerSigPsbt = await coin.signTransaction({
+            txPrebuild: { ...cosignerNoncePsbt, txInfo: isPsbt ? undefined : { unspents } },
+            prv: userPrv,
+            pubs,
+            signingStep: 'signerSignature',
+        });
+        assert.ok('txHex' in signerSigPsbt);
+        if (isPsbt) {
+            validatePsbt(signerSigPsbt.txHex, 1, isTxWithTaprootKeyPathSpend ? 2 : undefined);
+        }
+        else {
+            assert.ok(unspents);
+            validateTx(signerSigPsbt.txHex, unspents, 1);
+        }
+    }
+    it('customSigningFunction flow - PSBT with taprootKeyPathSpend inputs', async function () {
+        const replayProtectionKey = (0, src_1.getReplayProtectionPubkeys)(coin.name)[0];
+        const inputs = utxo_lib_1.testutil.inputScriptTypes
+            .filter((t) => t !== 'p2shP2pk' || replayProtectionKey !== undefined)
+            .map((scriptType) => ({ scriptType, value: BigInt(1000) }));
+        const unspentSum = inputs.reduce((prev, curr) => prev + curr.value, BigInt(0));
+        const outputs = [{ scriptType: 'p2sh', value: unspentSum - BigInt(1000) }];
+        const psbt = utxo_lib_1.testutil.constructPsbt(inputs, outputs, (0, util_1.getNetworkForCoinName)(coin.name), rootWalletKeys, 'unsigned', {
+            p2shP2pkKey: replayProtectionKey,
+        });
+        for (const v of [false, true]) {
+            await signTransaction(psbt, v);
+        }
+    });
+    it('customSigningFunction flow - PSBT without taprootKeyPathSpend inputs', async function () {
+        const replayProtectionKey = (0, src_1.getReplayProtectionPubkeys)(coin.name)[0];
+        const inputs = utxo_lib_1.testutil.inputScriptTypes
+            .filter((v) => v !== 'taprootKeyPathSpend' && (v !== 'p2shP2pk' || replayProtectionKey !== undefined))
+            .map((scriptType) => ({ scriptType, value: BigInt(1000) }));
+        const unspentSum = inputs.reduce((prev, cur) => prev + cur.value, BigInt(0));
+        const outputs = [{ scriptType: 'p2sh', value: unspentSum - BigInt(1000) }];
+        const psbt = utxo_lib_1.testutil.constructPsbt(inputs, outputs, (0, util_1.getNetworkForCoinName)(coin.name), rootWalletKeys, 'unsigned', {
+            p2shP2pkKey: replayProtectionKey,
+        });
+        for (const v of [false, true]) {
+            await signTransaction(psbt, v);
+        }
+    });
+    it('customSigningFunction flow - Network Tx should reject legacy format', async function () {
+        const inputs = utxo_lib_1.testutil.txnInputScriptTypes
+            .filter((v) => v !== 'p2shP2pk')
+            .map((scriptType) => ({
+            scriptType,
+            value: BigInt(1000),
+        }));
+        const unspentSum = inputs.reduce((prev, curr) => prev + curr.value, BigInt(0));
+        const outputs = [{ scriptType: 'p2sh', value: unspentSum - BigInt(1000) }];
+        const txBuilder = utxo_lib_1.testutil.constructTxnBuilder(inputs, outputs, (0, util_1.getNetworkForCoinName)(coin.name), rootWalletKeys, 'unsigned');
+        const unspents = inputs.map((v, i) => utxo_lib_1.testutil.toTxnUnspent(v, i, (0, util_1.getNetworkForCoinName)(coin.name), rootWalletKeys));
+        // Legacy format transactions are now deprecated and should throw ErrorDeprecatedTxFormat
+        await assert.rejects(async () => {
+            await signTransaction(txBuilder.buildIncomplete(), false, unspents);
+        }, src_1.ErrorDeprecatedTxFormat);
+    });
+    it('fails on PSBT cache miss', async function () {
+        const inputs = [{ scriptType: 'taprootKeyPathSpend', value: BigInt(1000) }];
+        const unspentSum = inputs.reduce((prev, curr) => prev + curr.value, BigInt(0));
+        const outputs = [{ scriptType: 'p2sh', value: unspentSum - BigInt(1000) }];
+        const psbt = utxo_lib_1.testutil.constructPsbt(inputs, outputs, (0, util_1.getNetworkForCoinName)(coin.name), rootWalletKeys, 'unsigned');
+        await assert.rejects(async () => {
+            await coin.signTransaction({
+                txPrebuild: { txHex: psbt.toHex() },
+                prv: userPrv,
+                pubs,
+                signingStep: 'signerSignature',
+            });
+        }, {
+            message: `Psbt is missing from txCache (cache size 0).
+            This may be due to the request being routed to a different BitGo-Express instance that for signing step 'signerNonce'.`,
+        });
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnblRyYW5zYWN0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vdGVzdC91bml0L3NpZ25UcmFuc2FjdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGlCQUFlO0FBQ2YsK0NBQWlDO0FBRWpDLDhEQUFnRDtBQUNoRCw2QkFBOEI7QUFDOUIsbURBQWdEO0FBQ2hELG1EQUFzRDtBQUV0RCxtQ0FBZ0Y7QUFHaEYsaUNBT2dCO0FBRWhCLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRTtJQUMxQixNQUFNLEtBQUssR0FBRyxpQkFBTSxDQUFDLFlBQVksQ0FBQyxtQkFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDO0lBRTdELE1BQU0sSUFBSSxHQUFHLElBQUEsa0JBQVcsRUFBQyxLQUFLLENBQUMsQ0FBQztJQUNoQyxNQUFNLE1BQU0sR0FBRyxJQUFBLG9CQUFhLEVBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRSxFQUFFLGtDQUFrQyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3RHLE1BQU0sY0FBYyxHQUFHLElBQUEsMkJBQW9CLEdBQUUsQ0FBQztJQUM5QyxNQUFNLE9BQU8sR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO0lBQy9DLE1BQU0sSUFBSSxHQUFHLHNCQUFlLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFtQixDQUFDO0lBRWpFLFNBQVMsWUFBWSxDQUFDLEtBQWEsRUFBRSxjQUFxQixFQUFFLGdCQUF3QjtRQUNsRixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxJQUFBLDRCQUFxQixFQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ3RGLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsRUFBRTtZQUN4QyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuRCxJQUFJLE1BQU0sQ0FBQyxVQUFVLEtBQUsscUJBQXFCLEVBQUUsQ0FBQztnQkFDaEQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO2dCQUM1QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMscUJBQXFCLENBQUMsS0FBSyxFQUFFO29CQUM5QyxVQUFVLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQywyQkFBMkI7b0JBQ3JELE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLHFCQUFxQixDQUFDLGdCQUFnQjtpQkFDOUQsQ0FBQyxDQUFDO2dCQUNILE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3JELENBQUM7WUFDRCxNQUFNLGdCQUFnQixHQUFHLE1BQU0sQ0FBQyxVQUFVLEtBQUssVUFBVSxJQUFJLGNBQWMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2xHLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUNsRSxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxTQUFTLFVBQVUsQ0FBQyxLQUFhLEVBQUUsUUFBMkIsRUFBRSxjQUFxQjtRQUNuRixNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxJQUFBLDRCQUFxQixFQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQzNGLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUU7WUFDeEIsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDbEUsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN0RixNQUFNLENBQUMsV0FBVyxDQUFDLFFBQVEsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELEtBQUssVUFBVSxlQUFlLENBQzVCLEVBQWtFLEVBQ2xFLGVBQXdCLEVBQ3hCLFFBQTRCO1FBRTVCLE1BQU0sTUFBTSxHQUFHLEVBQUUsWUFBWSxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUNwRCxNQUFNLDJCQUEyQixHQUFHLE1BQU0sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLGtDQUFrQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25HLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUV6QixTQUFTLFlBQVksQ0FBQyxPQUFlO1lBQ25DLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsT0FBTyxFQUFFLElBQUEsNEJBQXFCLEVBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDeEYsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDO2lCQUNmLElBQUksQ0FBQyxXQUFXLE1BQU0sQ0FBQyxJQUFJLEVBQUUsV0FBVyxNQUFNLENBQUMsRUFBRSxFQUFFLGNBQWMsRUFBRSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztpQkFDdkYsS0FBSyxDQUFDLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMseUJBQXlCLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN4RixDQUFDO1FBRUQsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQ3JCLElBQUksS0FBNkIsQ0FBQztZQUNsQyxJQUFJLEVBQUUsWUFBWSxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSwyQkFBMkIsRUFBRSxDQUFDO2dCQUN4RSxLQUFLLEdBQUcsWUFBWSxDQUFDLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQyx5QkFBeUIsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUMzRixDQUFDO1lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDO2dCQUN0QyxVQUFVLEVBQUU7b0JBQ1YsS0FBSztvQkFDTCxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsUUFBUSxFQUFFO29CQUN6QyxRQUFRLEVBQUUsMkJBQTJCLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUztpQkFDaEU7Z0JBQ0QsR0FBRyxFQUFFLE9BQU87Z0JBQ1osSUFBSTthQUNMLENBQUMsQ0FBQztZQUNILE1BQU0sQ0FBQyxFQUFFLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxDQUFDO1lBQzNCLElBQUksTUFBTSxFQUFFLENBQUM7Z0JBQ1gsWUFBWSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ2pDLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDO2dCQUNwQixVQUFVLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDdEMsQ0FBQztZQUNELElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ1YsTUFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDM0MsQ0FBQztZQUNELE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxlQUFlLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDO1lBQ2pELFVBQVUsRUFBRSxFQUFFLEtBQUssRUFBRTtZQUNyQixHQUFHLEVBQUUsT0FBTztZQUNaLElBQUk7WUFDSixXQUFXLEVBQUUsYUFBYTtTQUMzQixDQUFDLENBQUM7UUFDSCxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sSUFBSSxlQUFlLENBQUMsQ0FBQztRQUN0QyxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ1gsWUFBWSxDQUFDLGVBQWUsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxFQUFFLDJCQUEyQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3RGLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNwQixVQUFVLENBQUMsZUFBZSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDakQsQ0FBQztRQUVELElBQUksS0FBNkIsQ0FBQztRQUNsQyxJQUFJLDJCQUEyQixFQUFFLENBQUM7WUFDaEMsS0FBSyxHQUFHLFlBQVksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUVELE1BQU0saUJBQWlCLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDO1lBQ25ELFVBQVUsRUFBRSxFQUFFLEdBQUcsZUFBZSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUU7WUFDekQsSUFBSTtZQUNKLFdBQVcsRUFBRSxlQUFlO1NBQzdCLENBQUMsQ0FBQztRQUNILE1BQU0sQ0FBQyxFQUFFLENBQUMsT0FBTyxJQUFJLGlCQUFpQixDQUFDLENBQUM7UUFDeEMsSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUNYLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxFQUFFLDJCQUEyQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNwQixVQUFVLENBQUMsaUJBQWlCLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBRUQsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNWLE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzNDLENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUM7WUFDL0MsVUFBVSxFQUFFLEVBQUUsR0FBRyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUU7WUFDL0UsR0FBRyxFQUFFLE9BQU87WUFDWixJQUFJO1lBQ0osV0FBVyxFQUFFLGlCQUFpQjtTQUMvQixDQUFDLENBQUM7UUFDSCxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sSUFBSSxhQUFhLENBQUMsQ0FBQztRQUNwQyxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ1gsWUFBWSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxFQUFFLDJCQUEyQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNwQixVQUFVLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDL0MsQ0FBQztJQUNILENBQUM7SUFFRCxFQUFFLENBQUMsbUVBQW1FLEVBQUUsS0FBSztRQUMzRSxNQUFNLG1CQUFtQixHQUFHLElBQUEsZ0NBQTBCLEVBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sTUFBTSxHQUFxQixtQkFBUSxDQUFDLGdCQUFnQjthQUN2RCxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxVQUFVLElBQUksbUJBQW1CLEtBQUssU0FBUyxDQUFDO2FBQ3BFLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQzlELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFZLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN2RixNQUFNLE9BQU8sR0FBc0IsQ0FBQyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLE1BQU0sSUFBSSxHQUFHLG1CQUFRLENBQUMsYUFBYSxDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsSUFBQSw0QkFBcUIsRUFBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsY0FBYyxFQUFFLFVBQVUsRUFBRTtZQUNqSCxXQUFXLEVBQUUsbUJBQW1CO1NBQ2pDLENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDakMsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLHNFQUFzRSxFQUFFLEtBQUs7UUFDOUUsTUFBTSxtQkFBbUIsR0FBRyxJQUFBLGdDQUEwQixFQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRSxNQUFNLE1BQU0sR0FBcUIsbUJBQVEsQ0FBQyxnQkFBZ0I7YUFDdkQsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEtBQUsscUJBQXFCLElBQUksQ0FBQyxDQUFDLEtBQUssVUFBVSxJQUFJLG1CQUFtQixLQUFLLFNBQVMsQ0FBQyxDQUFDO2FBQ3JHLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQzlELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFZLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxJQUFJLEdBQUcsR0FBRyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRixNQUFNLE9BQU8sR0FBc0IsQ0FBQyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLE1BQU0sSUFBSSxHQUFHLG1CQUFRLENBQUMsYUFBYSxDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsSUFBQSw0QkFBcUIsRUFBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsY0FBYyxFQUFFLFVBQVUsRUFBRTtZQUNqSCxXQUFXLEVBQUUsbUJBQW1CO1NBQ2pDLENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDakMsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLHFFQUFxRSxFQUFFLEtBQUs7UUFDN0UsTUFBTSxNQUFNLEdBQWdDLG1CQUFRLENBQUMsbUJBQW1CO2FBQ3JFLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxLQUFLLFVBQVUsQ0FBQzthQUMvQixHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDcEIsVUFBVTtZQUNWLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDO1NBQ3BCLENBQUMsQ0FBQyxDQUFDO1FBQ04sTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQVksRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLE1BQU0sT0FBTyxHQUFpQyxDQUFDLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDekcsTUFBTSxTQUFTLEdBQUcsbUJBQVEsQ0FBQyxtQkFBbUIsQ0FDNUMsTUFBTSxFQUNOLE9BQU8sRUFDUCxJQUFBLDRCQUFxQixFQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFDaEMsY0FBYyxFQUNkLFVBQVUsQ0FDWCxDQUFDO1FBQ0YsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUNuQyxtQkFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLElBQUEsNEJBQXFCLEVBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLGNBQWMsQ0FBQyxDQUM5RSxDQUFDO1FBRUYseUZBQXlGO1FBQ3pGLE1BQU0sTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksRUFBRTtZQUM5QixNQUFNLGVBQWUsQ0FBQyxTQUFTLENBQUMsZUFBZSxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3RFLENBQUMsRUFBRSw2QkFBdUIsQ0FBQyxDQUFDO0lBQzlCLENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLDBCQUEwQixFQUFFLEtBQUs7UUFDbEMsTUFBTSxNQUFNLEdBQXFCLENBQUMsRUFBRSxVQUFVLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUYsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQVksRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZGLE1BQU0sT0FBTyxHQUFzQixDQUFDLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUYsTUFBTSxJQUFJLEdBQUcsbUJBQVEsQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLE9BQU8sRUFBRSxJQUFBLDRCQUFxQixFQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxjQUFjLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFbkgsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUNsQixLQUFLLElBQUksRUFBRTtZQUNULE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQztnQkFDekIsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRTtnQkFDbkMsR0FBRyxFQUFFLE9BQU87Z0JBQ1osSUFBSTtnQkFDSixXQUFXLEVBQUUsaUJBQWlCO2FBQy9CLENBQUMsQ0FBQztRQUNMLENBQUMsRUFDRDtZQUNFLE9BQU8sRUFBRTttSUFDa0g7U0FDNUgsQ0FDRixDQUFDO0lBQ0osQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAnbW9jaGEnO1xuaW1wb3J0ICogYXMgYXNzZXJ0IGZyb20gJ2Fzc2VydCc7XG5cbmltcG9ydCAqIGFzIHV0eG9saWIgZnJvbSAnQGJpdGdvLWJldGEvdXR4by1saWInO1xuaW1wb3J0IG5vY2sgPSByZXF1aXJlKCdub2NrJyk7XG5pbXBvcnQgeyB0ZXN0dXRpbCB9IGZyb20gJ0BiaXRnby1iZXRhL3V0eG8tbGliJztcbmltcG9ydCB7IGNvbW1vbiwgVHJpcGxlIH0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWNvcmUnO1xuXG5pbXBvcnQgeyBnZXRSZXBsYXlQcm90ZWN0aW9uUHVia2V5cywgRXJyb3JEZXByZWNhdGVkVHhGb3JtYXQgfSBmcm9tICcuLi8uLi9zcmMnO1xuaW1wb3J0IHR5cGUgeyBVbnNwZW50IH0gZnJvbSAnLi4vLi4vc3JjL3Vuc3BlbnQnO1xuXG5pbXBvcnQge1xuICBnZXRVdHhvV2FsbGV0LFxuICBnZXREZWZhdWx0V2FsbGV0S2V5cyxcbiAgZ2V0TmV0d29ya0ZvckNvaW5OYW1lLFxuICBnZXRVdHhvQ29pbixcbiAga2V5Y2hhaW5zQmFzZTU4LFxuICBkZWZhdWx0Qml0R28sXG59IGZyb20gJy4vdXRpbCc7XG5cbmRlc2NyaWJlKCdzaWduVHJhbnNhY3Rpb24nLCBmdW5jdGlvbiAoKSB7XG4gIGNvbnN0IGJnVXJsID0gY29tbW9uLkVudmlyb25tZW50c1tkZWZhdWx0Qml0R28uZ2V0RW52KCldLnVyaTtcblxuICBjb25zdCBjb2luID0gZ2V0VXR4b0NvaW4oJ2J0YycpO1xuICBjb25zdCB3YWxsZXQgPSBnZXRVdHhvV2FsbGV0KGNvaW4sIHsgaWQ6ICc1YjM0MjUyZjFiZjM0OTkzMGUzNDAyMGEwMDAwMDAwMCcsIGNvaW46IGNvaW4uZ2V0Q2hhaW4oKSB9KTtcbiAgY29uc3Qgcm9vdFdhbGxldEtleXMgPSBnZXREZWZhdWx0V2FsbGV0S2V5cygpO1xuICBjb25zdCB1c2VyUHJ2ID0gcm9vdFdhbGxldEtleXMudXNlci50b0Jhc2U1OCgpO1xuICBjb25zdCBwdWJzID0ga2V5Y2hhaW5zQmFzZTU4Lm1hcCgodikgPT4gdi5wdWIpIGFzIFRyaXBsZTxzdHJpbmc+O1xuXG4gIGZ1bmN0aW9uIHZhbGlkYXRlUHNidCh0eEhleDogc3RyaW5nLCB0YXJnZXRTaWdDb3VudDogMCB8IDEsIHRhcmdldE5vbmNlQ291bnQ/OiAxIHwgMikge1xuICAgIGNvbnN0IHBzYnQgPSB1dHhvbGliLmJpdGdvLmNyZWF0ZVBzYnRGcm9tSGV4KHR4SGV4LCBnZXROZXR3b3JrRm9yQ29pbk5hbWUoY29pbi5uYW1lKSk7XG4gICAgcHNidC5kYXRhLmlucHV0cy5mb3JFYWNoKChpbnB1dCwgaW5kZXgpID0+IHtcbiAgICAgIGNvbnN0IHBhcnNlZCA9IHV0eG9saWIuYml0Z28ucGFyc2VQc2J0SW5wdXQoaW5wdXQpO1xuICAgICAgaWYgKHBhcnNlZC5zY3JpcHRUeXBlID09PSAndGFwcm9vdEtleVBhdGhTcGVuZCcpIHtcbiAgICAgICAgYXNzZXJ0Lm9rKHRhcmdldE5vbmNlQ291bnQpO1xuICAgICAgICBjb25zdCBub25jZSA9IHBzYnQuZ2V0UHJvcHJpZXRhcnlLZXlWYWxzKGluZGV4LCB7XG4gICAgICAgICAgaWRlbnRpZmllcjogdXR4b2xpYi5iaXRnby5QU0JUX1BST1BSSUVUQVJZX0lERU5USUZJRVIsXG4gICAgICAgICAgc3VidHlwZTogdXR4b2xpYi5iaXRnby5Qcm9wcmlldGFyeUtleVN1YnR5cGUuTVVTSUcyX1BVQl9OT05DRSxcbiAgICAgICAgfSk7XG4gICAgICAgIGFzc2VydC5zdHJpY3RFcXVhbChub25jZS5sZW5ndGgsIHRhcmdldE5vbmNlQ291bnQpO1xuICAgICAgfVxuICAgICAgY29uc3QgZXhwZWN0ZWRTaWdDb3VudCA9IHBhcnNlZC5zY3JpcHRUeXBlID09PSAncDJzaFAycGsnIHx8IHRhcmdldFNpZ0NvdW50ID09PSAwID8gdW5kZWZpbmVkIDogMTtcbiAgICAgIGFzc2VydC5zdHJpY3RFcXVhbChwYXJzZWQuc2lnbmF0dXJlcz8ubGVuZ3RoLCBleHBlY3RlZFNpZ0NvdW50KTtcbiAgICB9KTtcbiAgfVxuXG4gIGZ1bmN0aW9uIHZhbGlkYXRlVHgodHhIZXg6IHN0cmluZywgdW5zcGVudHM6IFVuc3BlbnQ8YmlnaW50PltdLCB0YXJnZXRTaWdDb3VudDogMCB8IDEpIHtcbiAgICBjb25zdCB0eCA9IHV0eG9saWIuYml0Z28uY3JlYXRlVHJhbnNhY3Rpb25Gcm9tSGV4KHR4SGV4LCBnZXROZXR3b3JrRm9yQ29pbk5hbWUoY29pbi5uYW1lKSk7XG4gICAgdW5zcGVudHMuZm9yRWFjaCgodSwgaSkgPT4ge1xuICAgICAgY29uc3Qgc2lnQ291bnQgPSB1dHhvbGliLmJpdGdvLmdldFN0cmljdFNpZ25hdHVyZUNvdW50KHR4Lmluc1tpXSk7XG4gICAgICBjb25zdCBleHBlY3RlZFNpZ0NvdW50ID0gdXR4b2xpYi5iaXRnby5pc1dhbGxldFVuc3BlbnQodSkgJiYgISF0YXJnZXRTaWdDb3VudCA/IDEgOiAwO1xuICAgICAgYXNzZXJ0LnN0cmljdEVxdWFsKHNpZ0NvdW50LCBleHBlY3RlZFNpZ0NvdW50KTtcbiAgICB9KTtcbiAgfVxuXG4gIGFzeW5jIGZ1bmN0aW9uIHNpZ25UcmFuc2FjdGlvbihcbiAgICB0eDogdXR4b2xpYi5iaXRnby5VdHhvUHNidCB8IHV0eG9saWIuYml0Z28uVXR4b1RyYW5zYWN0aW9uPGJpZ2ludD4sXG4gICAgdXNlU2lnbmluZ1N0ZXBzOiBib29sZWFuLFxuICAgIHVuc3BlbnRzPzogVW5zcGVudDxiaWdpbnQ+W11cbiAgKSB7XG4gICAgY29uc3QgaXNQc2J0ID0gdHggaW5zdGFuY2VvZiB1dHhvbGliLmJpdGdvLlV0eG9Qc2J0O1xuICAgIGNvbnN0IGlzVHhXaXRoVGFwcm9vdEtleVBhdGhTcGVuZCA9IGlzUHNidCAmJiB1dHhvbGliLmJpdGdvLmlzVHJhbnNhY3Rpb25XaXRoS2V5UGF0aFNwZW5kSW5wdXQodHgpO1xuICAgIGNvbnN0IHR4SGV4ID0gdHgudG9IZXgoKTtcblxuICAgIGZ1bmN0aW9uIG5vY2tTaWduUHNidChwc2J0SGV4OiBzdHJpbmcpOiBub2NrLlNjb3BlIHtcbiAgICAgIGNvbnN0IHBzYnQgPSB1dHhvbGliLmJpdGdvLmNyZWF0ZVBzYnRGcm9tSGV4KHBzYnRIZXgsIGdldE5ldHdvcmtGb3JDb2luTmFtZShjb2luLm5hbWUpKTtcbiAgICAgIHJldHVybiBub2NrKGJnVXJsKVxuICAgICAgICAucG9zdChgL2FwaS92Mi8ke3dhbGxldC5jb2luKCl9L3dhbGxldC8ke3dhbGxldC5pZCgpfS90eC9zaWducHNidGAsIChib2R5KSA9PiBib2R5LnBzYnQpXG4gICAgICAgIC5yZXBseSgyMDAsIHsgcHNidDogcHNidC5zZXRBbGxJbnB1dHNNdXNpZzJOb25jZUhEKHJvb3RXYWxsZXRLZXlzLmJpdGdvKS50b0hleCgpIH0pO1xuICAgIH1cblxuICAgIGlmICghdXNlU2lnbmluZ1N0ZXBzKSB7XG4gICAgICBsZXQgc2NvcGU6IG5vY2suU2NvcGUgfCB1bmRlZmluZWQ7XG4gICAgICBpZiAodHggaW5zdGFuY2VvZiB1dHhvbGliLmJpdGdvLlV0eG9Qc2J0ICYmIGlzVHhXaXRoVGFwcm9vdEtleVBhdGhTcGVuZCkge1xuICAgICAgICBzY29wZSA9IG5vY2tTaWduUHNidCh0eC5jbG9uZSgpLnNldEFsbElucHV0c011c2lnMk5vbmNlSEQocm9vdFdhbGxldEtleXMuYml0Z28pLnRvSGV4KCkpO1xuICAgICAgfVxuICAgICAgY29uc3QgcHNidCA9IGF3YWl0IGNvaW4uc2lnblRyYW5zYWN0aW9uKHtcbiAgICAgICAgdHhQcmVidWlsZDoge1xuICAgICAgICAgIHR4SGV4LFxuICAgICAgICAgIHR4SW5mbzogaXNQc2J0ID8gdW5kZWZpbmVkIDogeyB1bnNwZW50cyB9LFxuICAgICAgICAgIHdhbGxldElkOiBpc1R4V2l0aFRhcHJvb3RLZXlQYXRoU3BlbmQgPyB3YWxsZXQuaWQoKSA6IHVuZGVmaW5lZCxcbiAgICAgICAgfSxcbiAgICAgICAgcHJ2OiB1c2VyUHJ2LFxuICAgICAgICBwdWJzLFxuICAgICAgfSk7XG4gICAgICBhc3NlcnQub2soJ3R4SGV4JyBpbiBwc2J0KTtcbiAgICAgIGlmIChpc1BzYnQpIHtcbiAgICAgICAgdmFsaWRhdGVQc2J0KHBzYnQudHhIZXgsIDEsIDIpO1xuICAgICAgfSBlbHNlIHtcbiAgICAgICAgYXNzZXJ0Lm9rKHVuc3BlbnRzKTtcbiAgICAgICAgdmFsaWRhdGVUeChwc2J0LnR4SGV4LCB1bnNwZW50cywgMSk7XG4gICAgICB9XG4gICAgICBpZiAoc2NvcGUpIHtcbiAgICAgICAgYXNzZXJ0LnN0cmljdEVxdWFsKHNjb3BlLmlzRG9uZSgpLCB0cnVlKTtcbiAgICAgIH1cbiAgICAgIHJldHVybjtcbiAgICB9XG5cbiAgICBjb25zdCBzaWduZXJOb25jZVBzYnQgPSBhd2FpdCBjb2luLnNpZ25UcmFuc2FjdGlvbih7XG4gICAgICB0eFByZWJ1aWxkOiB7IHR4SGV4IH0sXG4gICAgICBwcnY6IHVzZXJQcnYsXG4gICAgICBwdWJzLFxuICAgICAgc2lnbmluZ1N0ZXA6ICdzaWduZXJOb25jZScsXG4gICAgfSk7XG4gICAgYXNzZXJ0Lm9rKCd0eEhleCcgaW4gc2lnbmVyTm9uY2VQc2J0KTtcbiAgICBpZiAoaXNQc2J0KSB7XG4gICAgICB2YWxpZGF0ZVBzYnQoc2lnbmVyTm9uY2VQc2J0LnR4SGV4LCAwLCBpc1R4V2l0aFRhcHJvb3RLZXlQYXRoU3BlbmQgPyAxIDogdW5kZWZpbmVkKTtcbiAgICB9IGVsc2Uge1xuICAgICAgYXNzZXJ0Lm9rKHVuc3BlbnRzKTtcbiAgICAgIHZhbGlkYXRlVHgoc2lnbmVyTm9uY2VQc2J0LnR4SGV4LCB1bnNwZW50cywgMCk7XG4gICAgfVxuXG4gICAgbGV0IHNjb3BlOiBub2NrLlNjb3BlIHwgdW5kZWZpbmVkO1xuICAgIGlmIChpc1R4V2l0aFRhcHJvb3RLZXlQYXRoU3BlbmQpIHtcbiAgICAgIHNjb3BlID0gbm9ja1NpZ25Qc2J0KHNpZ25lck5vbmNlUHNidC50eEhleCk7XG4gICAgfVxuXG4gICAgY29uc3QgY29zaWduZXJOb25jZVBzYnQgPSBhd2FpdCBjb2luLnNpZ25UcmFuc2FjdGlvbih7XG4gICAgICB0eFByZWJ1aWxkOiB7IC4uLnNpZ25lck5vbmNlUHNidCwgd2FsbGV0SWQ6IHdhbGxldC5pZCgpIH0sXG4gICAgICBwdWJzLFxuICAgICAgc2lnbmluZ1N0ZXA6ICdjb3NpZ25lck5vbmNlJyxcbiAgICB9KTtcbiAgICBhc3NlcnQub2soJ3R4SGV4JyBpbiBjb3NpZ25lck5vbmNlUHNidCk7XG4gICAgaWYgKGlzUHNidCkge1xuICAgICAgdmFsaWRhdGVQc2J0KGNvc2lnbmVyTm9uY2VQc2J0LnR4SGV4LCAwLCBpc1R4V2l0aFRhcHJvb3RLZXlQYXRoU3BlbmQgPyAyIDogdW5kZWZpbmVkKTtcbiAgICB9IGVsc2Uge1xuICAgICAgYXNzZXJ0Lm9rKHVuc3BlbnRzKTtcbiAgICAgIHZhbGlkYXRlVHgoY29zaWduZXJOb25jZVBzYnQudHhIZXgsIHVuc3BlbnRzLCAwKTtcbiAgICB9XG5cbiAgICBpZiAoc2NvcGUpIHtcbiAgICAgIGFzc2VydC5zdHJpY3RFcXVhbChzY29wZS5pc0RvbmUoKSwgdHJ1ZSk7XG4gICAgfVxuXG4gICAgY29uc3Qgc2lnbmVyU2lnUHNidCA9IGF3YWl0IGNvaW4uc2lnblRyYW5zYWN0aW9uKHtcbiAgICAgIHR4UHJlYnVpbGQ6IHsgLi4uY29zaWduZXJOb25jZVBzYnQsIHR4SW5mbzogaXNQc2J0ID8gdW5kZWZpbmVkIDogeyB1bnNwZW50cyB9IH0sXG4gICAgICBwcnY6IHVzZXJQcnYsXG4gICAgICBwdWJzLFxuICAgICAgc2lnbmluZ1N0ZXA6ICdzaWduZXJTaWduYXR1cmUnLFxuICAgIH0pO1xuICAgIGFzc2VydC5vaygndHhIZXgnIGluIHNpZ25lclNpZ1BzYnQpO1xuICAgIGlmIChpc1BzYnQpIHtcbiAgICAgIHZhbGlkYXRlUHNidChzaWduZXJTaWdQc2J0LnR4SGV4LCAxLCBpc1R4V2l0aFRhcHJvb3RLZXlQYXRoU3BlbmQgPyAyIDogdW5kZWZpbmVkKTtcbiAgICB9IGVsc2Uge1xuICAgICAgYXNzZXJ0Lm9rKHVuc3BlbnRzKTtcbiAgICAgIHZhbGlkYXRlVHgoc2lnbmVyU2lnUHNidC50eEhleCwgdW5zcGVudHMsIDEpO1xuICAgIH1cbiAgfVxuXG4gIGl0KCdjdXN0b21TaWduaW5nRnVuY3Rpb24gZmxvdyAtIFBTQlQgd2l0aCB0YXByb290S2V5UGF0aFNwZW5kIGlucHV0cycsIGFzeW5jIGZ1bmN0aW9uICgpIHtcbiAgICBjb25zdCByZXBsYXlQcm90ZWN0aW9uS2V5ID0gZ2V0UmVwbGF5UHJvdGVjdGlvblB1YmtleXMoY29pbi5uYW1lKVswXTtcbiAgICBjb25zdCBpbnB1dHM6IHRlc3R1dGlsLklucHV0W10gPSB0ZXN0dXRpbC5pbnB1dFNjcmlwdFR5cGVzXG4gICAgICAuZmlsdGVyKCh0KSA9PiB0ICE9PSAncDJzaFAycGsnIHx8IHJlcGxheVByb3RlY3Rpb25LZXkgIT09IHVuZGVmaW5lZClcbiAgICAgIC5tYXAoKHNjcmlwdFR5cGUpID0+ICh7IHNjcmlwdFR5cGUsIHZhbHVlOiBCaWdJbnQoMTAwMCkgfSkpO1xuICAgIGNvbnN0IHVuc3BlbnRTdW0gPSBpbnB1dHMucmVkdWNlKChwcmV2OiBiaWdpbnQsIGN1cnIpID0+IHByZXYgKyBjdXJyLnZhbHVlLCBCaWdJbnQoMCkpO1xuICAgIGNvbnN0IG91dHB1dHM6IHRlc3R1dGlsLk91dHB1dFtdID0gW3sgc2NyaXB0VHlwZTogJ3Ayc2gnLCB2YWx1ZTogdW5zcGVudFN1bSAtIEJpZ0ludCgxMDAwKSB9XTtcbiAgICBjb25zdCBwc2J0ID0gdGVzdHV0aWwuY29uc3RydWN0UHNidChpbnB1dHMsIG91dHB1dHMsIGdldE5ldHdvcmtGb3JDb2luTmFtZShjb2luLm5hbWUpLCByb290V2FsbGV0S2V5cywgJ3Vuc2lnbmVkJywge1xuICAgICAgcDJzaFAycGtLZXk6IHJlcGxheVByb3RlY3Rpb25LZXksXG4gICAgfSk7XG5cbiAgICBmb3IgKGNvbnN0IHYgb2YgW2ZhbHNlLCB0cnVlXSkge1xuICAgICAgYXdhaXQgc2lnblRyYW5zYWN0aW9uKHBzYnQsIHYpO1xuICAgIH1cbiAgfSk7XG5cbiAgaXQoJ2N1c3RvbVNpZ25pbmdGdW5jdGlvbiBmbG93IC0gUFNCVCB3aXRob3V0IHRhcHJvb3RLZXlQYXRoU3BlbmQgaW5wdXRzJywgYXN5bmMgZnVuY3Rpb24gKCkge1xuICAgIGNvbnN0IHJlcGxheVByb3RlY3Rpb25LZXkgPSBnZXRSZXBsYXlQcm90ZWN0aW9uUHVia2V5cyhjb2luLm5hbWUpWzBdO1xuICAgIGNvbnN0IGlucHV0czogdGVzdHV0aWwuSW5wdXRbXSA9IHRlc3R1dGlsLmlucHV0U2NyaXB0VHlwZXNcbiAgICAgIC5maWx0ZXIoKHYpID0+IHYgIT09ICd0YXByb290S2V5UGF0aFNwZW5kJyAmJiAodiAhPT0gJ3Ayc2hQMnBrJyB8fCByZXBsYXlQcm90ZWN0aW9uS2V5ICE9PSB1bmRlZmluZWQpKVxuICAgICAgLm1hcCgoc2NyaXB0VHlwZSkgPT4gKHsgc2NyaXB0VHlwZSwgdmFsdWU6IEJpZ0ludCgxMDAwKSB9KSk7XG4gICAgY29uc3QgdW5zcGVudFN1bSA9IGlucHV0cy5yZWR1Y2UoKHByZXY6IGJpZ2ludCwgY3VyKSA9PiBwcmV2ICsgY3VyLnZhbHVlLCBCaWdJbnQoMCkpO1xuICAgIGNvbnN0IG91dHB1dHM6IHRlc3R1dGlsLk91dHB1dFtdID0gW3sgc2NyaXB0VHlwZTogJ3Ayc2gnLCB2YWx1ZTogdW5zcGVudFN1bSAtIEJpZ0ludCgxMDAwKSB9XTtcbiAgICBjb25zdCBwc2J0ID0gdGVzdHV0aWwuY29uc3RydWN0UHNidChpbnB1dHMsIG91dHB1dHMsIGdldE5ldHdvcmtGb3JDb2luTmFtZShjb2luLm5hbWUpLCByb290V2FsbGV0S2V5cywgJ3Vuc2lnbmVkJywge1xuICAgICAgcDJzaFAycGtLZXk6IHJlcGxheVByb3RlY3Rpb25LZXksXG4gICAgfSk7XG5cbiAgICBmb3IgKGNvbnN0IHYgb2YgW2ZhbHNlLCB0cnVlXSkge1xuICAgICAgYXdhaXQgc2lnblRyYW5zYWN0aW9uKHBzYnQsIHYpO1xuICAgIH1cbiAgfSk7XG5cbiAgaXQoJ2N1c3RvbVNpZ25pbmdGdW5jdGlvbiBmbG93IC0gTmV0d29yayBUeCBzaG91bGQgcmVqZWN0IGxlZ2FjeSBmb3JtYXQnLCBhc3luYyBmdW5jdGlvbiAoKSB7XG4gICAgY29uc3QgaW5wdXRzOiB0ZXN0dXRpbC5UeG5JbnB1dDxiaWdpbnQ+W10gPSB0ZXN0dXRpbC50eG5JbnB1dFNjcmlwdFR5cGVzXG4gICAgICAuZmlsdGVyKCh2KSA9PiB2ICE9PSAncDJzaFAycGsnKVxuICAgICAgLm1hcCgoc2NyaXB0VHlwZSkgPT4gKHtcbiAgICAgICAgc2NyaXB0VHlwZSxcbiAgICAgICAgdmFsdWU6IEJpZ0ludCgxMDAwKSxcbiAgICAgIH0pKTtcbiAgICBjb25zdCB1bnNwZW50U3VtID0gaW5wdXRzLnJlZHVjZSgocHJldjogYmlnaW50LCBjdXJyKSA9PiBwcmV2ICsgY3Vyci52YWx1ZSwgQmlnSW50KDApKTtcbiAgICBjb25zdCBvdXRwdXRzOiB0ZXN0dXRpbC5UeG5PdXRwdXQ8YmlnaW50PltdID0gW3sgc2NyaXB0VHlwZTogJ3Ayc2gnLCB2YWx1ZTogdW5zcGVudFN1bSAtIEJpZ0ludCgxMDAwKSB9XTtcbiAgICBjb25zdCB0eEJ1aWxkZXIgPSB0ZXN0dXRpbC5jb25zdHJ1Y3RUeG5CdWlsZGVyKFxuICAgICAgaW5wdXRzLFxuICAgICAgb3V0cHV0cyxcbiAgICAgIGdldE5ldHdvcmtGb3JDb2luTmFtZShjb2luLm5hbWUpLFxuICAgICAgcm9vdFdhbGxldEtleXMsXG4gICAgICAndW5zaWduZWQnXG4gICAgKTtcbiAgICBjb25zdCB1bnNwZW50cyA9IGlucHV0cy5tYXAoKHYsIGkpID0+XG4gICAgICB0ZXN0dXRpbC50b1R4blVuc3BlbnQodiwgaSwgZ2V0TmV0d29ya0ZvckNvaW5OYW1lKGNvaW4ubmFtZSksIHJvb3RXYWxsZXRLZXlzKVxuICAgICk7XG5cbiAgICAvLyBMZWdhY3kgZm9ybWF0IHRyYW5zYWN0aW9ucyBhcmUgbm93IGRlcHJlY2F0ZWQgYW5kIHNob3VsZCB0aHJvdyBFcnJvckRlcHJlY2F0ZWRUeEZvcm1hdFxuICAgIGF3YWl0IGFzc2VydC5yZWplY3RzKGFzeW5jICgpID0+IHtcbiAgICAgIGF3YWl0IHNpZ25UcmFuc2FjdGlvbih0eEJ1aWxkZXIuYnVpbGRJbmNvbXBsZXRlKCksIGZhbHNlLCB1bnNwZW50cyk7XG4gICAgfSwgRXJyb3JEZXByZWNhdGVkVHhGb3JtYXQpO1xuICB9KTtcblxuICBpdCgnZmFpbHMgb24gUFNCVCBjYWNoZSBtaXNzJywgYXN5bmMgZnVuY3Rpb24gKCkge1xuICAgIGNvbnN0IGlucHV0czogdGVzdHV0aWwuSW5wdXRbXSA9IFt7IHNjcmlwdFR5cGU6ICd0YXByb290S2V5UGF0aFNwZW5kJywgdmFsdWU6IEJpZ0ludCgxMDAwKSB9XTtcbiAgICBjb25zdCB1bnNwZW50U3VtID0gaW5wdXRzLnJlZHVjZSgocHJldjogYmlnaW50LCBjdXJyKSA9PiBwcmV2ICsgY3Vyci52YWx1ZSwgQmlnSW50KDApKTtcbiAgICBjb25zdCBvdXRwdXRzOiB0ZXN0dXRpbC5PdXRwdXRbXSA9IFt7IHNjcmlwdFR5cGU6ICdwMnNoJywgdmFsdWU6IHVuc3BlbnRTdW0gLSBCaWdJbnQoMTAwMCkgfV07XG4gICAgY29uc3QgcHNidCA9IHRlc3R1dGlsLmNvbnN0cnVjdFBzYnQoaW5wdXRzLCBvdXRwdXRzLCBnZXROZXR3b3JrRm9yQ29pbk5hbWUoY29pbi5uYW1lKSwgcm9vdFdhbGxldEtleXMsICd1bnNpZ25lZCcpO1xuXG4gICAgYXdhaXQgYXNzZXJ0LnJlamVjdHMoXG4gICAgICBhc3luYyAoKSA9PiB7XG4gICAgICAgIGF3YWl0IGNvaW4uc2lnblRyYW5zYWN0aW9uKHtcbiAgICAgICAgICB0eFByZWJ1aWxkOiB7IHR4SGV4OiBwc2J0LnRvSGV4KCkgfSxcbiAgICAgICAgICBwcnY6IHVzZXJQcnYsXG4gICAgICAgICAgcHVicyxcbiAgICAgICAgICBzaWduaW5nU3RlcDogJ3NpZ25lclNpZ25hdHVyZScsXG4gICAgICAgIH0pO1xuICAgICAgfSxcbiAgICAgIHtcbiAgICAgICAgbWVzc2FnZTogYFBzYnQgaXMgbWlzc2luZyBmcm9tIHR4Q2FjaGUgKGNhY2hlIHNpemUgMCkuXG4gICAgICAgICAgICBUaGlzIG1heSBiZSBkdWUgdG8gdGhlIHJlcXVlc3QgYmVpbmcgcm91dGVkIHRvIGEgZGlmZmVyZW50IEJpdEdvLUV4cHJlc3MgaW5zdGFuY2UgdGhhdCBmb3Igc2lnbmluZyBzdGVwICdzaWduZXJOb25jZScuYCxcbiAgICAgIH1cbiAgICApO1xuICB9KTtcbn0pO1xuIl19

package/dist/cjs/test/unit/testSpoofTransaction.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=testSpoofTransaction.d.ts.map

package/dist/cjs/test/unit/testSpoofTransaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testSpoofTransaction.d.ts","sourceRoot":"","sources":["../../../../test/unit/testSpoofTransaction.ts"],"names":[],"mappings":""}

package/dist/cjs/test/unit/testSpoofTransaction.js

@@ -0,0 +1,114 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert_1 = __importDefault(require("assert"));
+const testutils = __importStar(require("@bitgo/wasm-utxo/testutils"));
+const sdk_core_1 = require("@bitgo-beta/sdk-core");
+const util_1 = require("./util");
+describe('Transaction Spoofability Tests', function () {
+    const coin = (0, util_1.getUtxoCoin)('tbtc');
+    describe('Unspent management spoofability - Consolidation (BUILD_SIGN_SEND)', function () {
+        it('should detect spoofed consolidation to attacker address', async function () {
+            const keyTriple = testutils.getKeyTriple('default');
+            const walletKeys = testutils.getDefaultWalletKeys();
+            const attackerKeys = testutils.getWalletKeysForSeed('attacker');
+            const wallet = new sdk_core_1.Wallet(util_1.defaultBitGo, coin, {
+                id: '5b34252f1bf349930e34020a',
+                coin: 'tbtc',
+                keys: ['user', 'backup', 'bitgo'],
+            });
+            // The attacker replaces the legitimate wallet address with their own
+            const attackerAddress = (0, util_1.getWalletAddress)('tbtc', attackerKeys);
+            const spoofedPsbt = (0, util_1.constructPsbt)([{ scriptType: 'p2wsh', value: BigInt(10000) }], [{ address: attackerAddress, value: BigInt(9000) }], 'tbtc', walletKeys // Input uses wallet keys (the funds being stolen)
+            );
+            const spoofedHex = Buffer.from(spoofedPsbt.serialize()).toString('hex');
+            (0, util_1.nockBitGo)()
+                .post(`/api/v2/${wallet.coin()}/wallet/${wallet.id()}/consolidateUnspents`)
+                .reply(200, { txHex: spoofedHex, consolidateId: 'test' });
+            (0, util_1.nockBitGo)()
+                .post(`/api/v2/${wallet.coin()}/wallet/${wallet.id()}/tx/send`)
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                .reply((requestBody) => {
+                if (requestBody?.txHex === spoofedHex) {
+                    throw new Error('Spoofed transaction was sent: spoofing protection failed');
+                }
+                return [200, { txid: 'test-txid-123', status: 'signed' }];
+            });
+            await (0, util_1.nockWalletKeys)(wallet, keyTriple, 'pass');
+            await assert_1.default.rejects(wallet.consolidateUnspents({ walletPassphrase: 'pass' }), 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (e) => typeof e?.message === 'string' &&
+                e.message.includes('prebuild attempts to spend to unintended external recipients'));
+        });
+    });
+    describe('Unspent management spoofability - Fanout (BUILD_SIGN_SEND)', function () {
+        it('should detect spoofed fanout to attacker address', async function () {
+            const keyTriple = testutils.getKeyTriple('default');
+            const walletKeys = testutils.getDefaultWalletKeys();
+            const attackerKeys = testutils.getWalletKeysForSeed('attacker');
+            const wallet = new sdk_core_1.Wallet(util_1.defaultBitGo, coin, {
+                id: '5b34252f1bf349930e34020a',
+                coin: 'tbtc',
+                keys: ['user', 'backup', 'bitgo'],
+            });
+            // The attacker replaces the legitimate wallet address with their own
+            const attackerAddress = (0, util_1.getWalletAddress)('tbtc', attackerKeys);
+            const spoofedPsbt = (0, util_1.constructPsbt)([{ scriptType: 'p2wsh', value: BigInt(10000) }], [{ address: attackerAddress, value: BigInt(9000) }], 'tbtc', walletKeys // Input uses wallet keys (the funds being stolen)
+            );
+            const spoofedHex = Buffer.from(spoofedPsbt.serialize()).toString('hex');
+            (0, util_1.nockBitGo)()
+                .post(`/api/v2/${wallet.coin()}/wallet/${wallet.id()}/fanoutUnspents`)
+                .reply(200, { txHex: spoofedHex, fanoutId: 'test' });
+            (0, util_1.nockBitGo)()
+                .post(`/api/v2/${wallet.coin()}/wallet/${wallet.id()}/tx/send`)
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                .reply((requestBody) => {
+                if (requestBody?.txHex === spoofedHex) {
+                    throw new Error('Spoofed transaction was sent: spoofing protection failed');
+                }
+                return [200, { txid: 'test-txid-123', status: 'signed' }];
+            });
+            await (0, util_1.nockWalletKeys)(wallet, keyTriple, 'pass');
+            await assert_1.default.rejects(wallet.fanoutUnspents({ walletPassphrase: 'pass' }), 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (e) => typeof e?.message === 'string' &&
+                e.message.includes('prebuild attempts to spend to unintended external recipients'));
+        });
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdFNwb29mVHJhbnNhY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90ZXN0L3VuaXQvdGVzdFNwb29mVHJhbnNhY3Rpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxvREFBNEI7QUFFNUIsc0VBQXdEO0FBQ3hELG1EQUE4QztBQUU5QyxpQ0FBK0c7QUFFL0csUUFBUSxDQUFDLGdDQUFnQyxFQUFFO0lBQ3pDLE1BQU0sSUFBSSxHQUFHLElBQUEsa0JBQVcsRUFBQyxNQUFNLENBQUMsQ0FBQztJQUVqQyxRQUFRLENBQUMsbUVBQW1FLEVBQUU7UUFDNUUsRUFBRSxDQUFDLHlEQUF5RCxFQUFFLEtBQUs7WUFDakUsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNwRCxNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztZQUNwRCxNQUFNLFlBQVksR0FBRyxTQUFTLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7WUFFaEUsTUFBTSxNQUFNLEdBQUcsSUFBSSxpQkFBTSxDQUFDLG1CQUFZLEVBQUUsSUFBSSxFQUFFO2dCQUM1QyxFQUFFLEVBQUUsMEJBQTBCO2dCQUM5QixJQUFJLEVBQUUsTUFBTTtnQkFDWixJQUFJLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQzthQUNsQyxDQUFDLENBQUM7WUFFSCxxRUFBcUU7WUFDckUsTUFBTSxlQUFlLEdBQUcsSUFBQSx1QkFBZ0IsRUFBQyxNQUFNLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDL0QsTUFBTSxXQUFXLEdBQUcsSUFBQSxvQkFBYSxFQUMvQixDQUFDLEVBQUUsVUFBVSxFQUFFLE9BQWdCLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQ3hELENBQUMsRUFBRSxPQUFPLEVBQUUsZUFBZSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUNuRCxNQUFNLEVBQ04sVUFBVSxDQUFDLGtEQUFrRDthQUM5RCxDQUFDO1lBQ0YsTUFBTSxVQUFVLEdBQVcsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7WUFFaEYsSUFBQSxnQkFBUyxHQUFFO2lCQUNSLElBQUksQ0FBQyxXQUFXLE1BQU0sQ0FBQyxJQUFJLEVBQUUsV0FBVyxNQUFNLENBQUMsRUFBRSxFQUFFLHNCQUFzQixDQUFDO2lCQUMxRSxLQUFLLENBQUMsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztZQUU1RCxJQUFBLGdCQUFTLEdBQUU7aUJBQ1IsSUFBSSxDQUFDLFdBQVcsTUFBTSxDQUFDLElBQUksRUFBRSxXQUFXLE1BQU0sQ0FBQyxFQUFFLEVBQUUsVUFBVSxDQUFDO2dCQUMvRCw4REFBOEQ7aUJBQzdELEtBQUssQ0FBQyxDQUFDLFdBQWdCLEVBQUUsRUFBRTtnQkFDMUIsSUFBSSxXQUFXLEVBQUUsS0FBSyxLQUFLLFVBQVUsRUFBRSxDQUFDO29CQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7Z0JBQzlFLENBQUM7Z0JBQ0QsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxlQUFlLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7WUFDNUQsQ0FBQyxDQUFDLENBQUM7WUFFTCxNQUFNLElBQUEscUJBQWMsRUFBQyxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBRWhELE1BQU0sZ0JBQU0sQ0FBQyxPQUFPLENBQ2xCLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ3hELDhEQUE4RDtZQUM5RCxDQUFDLENBQU0sRUFBRSxFQUFFLENBQ1QsT0FBTyxDQUFDLEVBQUUsT0FBTyxLQUFLLFFBQVE7Z0JBQzlCLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLDhEQUE4RCxDQUFDLENBQ3JGLENBQUM7UUFDSixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0lBRUgsUUFBUSxDQUFDLDREQUE0RCxFQUFFO1FBQ3JFLEVBQUUsQ0FBQyxrREFBa0QsRUFBRSxLQUFLO1lBQzFELE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDcEQsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLG9CQUFvQixFQUFFLENBQUM7WUFDcEQsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBRWhFLE1BQU0sTUFBTSxHQUFHLElBQUksaUJBQU0sQ0FBQyxtQkFBWSxFQUFFLElBQUksRUFBRTtnQkFDNUMsRUFBRSxFQUFFLDBCQUEwQjtnQkFDOUIsSUFBSSxFQUFFLE1BQU07Z0JBQ1osSUFBSSxFQUFFLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUM7YUFDbEMsQ0FBQyxDQUFDO1lBRUgscUVBQXFFO1lBQ3JFLE1BQU0sZUFBZSxHQUFHLElBQUEsdUJBQWdCLEVBQUMsTUFBTSxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQy9ELE1BQU0sV0FBVyxHQUFHLElBQUEsb0JBQWEsRUFDL0IsQ0FBQyxFQUFFLFVBQVUsRUFBRSxPQUFnQixFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUN4RCxDQUFDLEVBQUUsT0FBTyxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFDbkQsTUFBTSxFQUNOLFVBQVUsQ0FBQyxrREFBa0Q7YUFDOUQsQ0FBQztZQUNGLE1BQU0sVUFBVSxHQUFXLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBRWhGLElBQUEsZ0JBQVMsR0FBRTtpQkFDUixJQUFJLENBQUMsV0FBVyxNQUFNLENBQUMsSUFBSSxFQUFFLFdBQVcsTUFBTSxDQUFDLEVBQUUsRUFBRSxpQkFBaUIsQ0FBQztpQkFDckUsS0FBSyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFFdkQsSUFBQSxnQkFBUyxHQUFFO2lCQUNSLElBQUksQ0FBQyxXQUFXLE1BQU0sQ0FBQyxJQUFJLEVBQUUsV0FBVyxNQUFNLENBQUMsRUFBRSxFQUFFLFVBQVUsQ0FBQztnQkFDL0QsOERBQThEO2lCQUM3RCxLQUFLLENBQUMsQ0FBQyxXQUFnQixFQUFFLEVBQUU7Z0JBQzFCLElBQUksV0FBVyxFQUFFLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztvQkFDdEMsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO2dCQUM5RSxDQUFDO2dCQUNELE9BQU8sQ0FBQyxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQzVELENBQUMsQ0FBQyxDQUFDO1lBRUwsTUFBTSxJQUFBLHFCQUFjLEVBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUVoRCxNQUFNLGdCQUFNLENBQUMsT0FBTyxDQUNsQixNQUFNLENBQUMsY0FBYyxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDbkQsOERBQThEO1lBQzlELENBQUMsQ0FBTSxFQUFFLEVBQUUsQ0FDVCxPQUFPLENBQUMsRUFBRSxPQUFPLEtBQUssUUFBUTtnQkFDOUIsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsOERBQThELENBQUMsQ0FDckYsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBhc3NlcnQgZnJvbSAnYXNzZXJ0JztcblxuaW1wb3J0ICogYXMgdGVzdHV0aWxzIGZyb20gJ0BiaXRnby93YXNtLXV0eG8vdGVzdHV0aWxzJztcbmltcG9ydCB7IFdhbGxldCB9IGZyb20gJ0BiaXRnby1iZXRhL3Nkay1jb3JlJztcblxuaW1wb3J0IHsgY29uc3RydWN0UHNidCwgZ2V0V2FsbGV0QWRkcmVzcywgZ2V0VXR4b0NvaW4sIGRlZmF1bHRCaXRHbywgbm9ja0JpdEdvLCBub2NrV2FsbGV0S2V5cyB9IGZyb20gJy4vdXRpbCc7XG5cbmRlc2NyaWJlKCdUcmFuc2FjdGlvbiBTcG9vZmFiaWxpdHkgVGVzdHMnLCBmdW5jdGlvbiAoKSB7XG4gIGNvbnN0IGNvaW4gPSBnZXRVdHhvQ29pbigndGJ0YycpO1xuXG4gIGRlc2NyaWJlKCdVbnNwZW50IG1hbmFnZW1lbnQgc3Bvb2ZhYmlsaXR5IC0gQ29uc29saWRhdGlvbiAoQlVJTERfU0lHTl9TRU5EKScsIGZ1bmN0aW9uICgpIHtcbiAgICBpdCgnc2hvdWxkIGRldGVjdCBzcG9vZmVkIGNvbnNvbGlkYXRpb24gdG8gYXR0YWNrZXIgYWRkcmVzcycsIGFzeW5jIGZ1bmN0aW9uICgpOiBQcm9taXNlPHZvaWQ+IHtcbiAgICAgIGNvbnN0IGtleVRyaXBsZSA9IHRlc3R1dGlscy5nZXRLZXlUcmlwbGUoJ2RlZmF1bHQnKTtcbiAgICAgIGNvbnN0IHdhbGxldEtleXMgPSB0ZXN0dXRpbHMuZ2V0RGVmYXVsdFdhbGxldEtleXMoKTtcbiAgICAgIGNvbnN0IGF0dGFja2VyS2V5cyA9IHRlc3R1dGlscy5nZXRXYWxsZXRLZXlzRm9yU2VlZCgnYXR0YWNrZXInKTtcblxuICAgICAgY29uc3Qgd2FsbGV0ID0gbmV3IFdhbGxldChkZWZhdWx0Qml0R28sIGNvaW4sIHtcbiAgICAgICAgaWQ6ICc1YjM0MjUyZjFiZjM0OTkzMGUzNDAyMGEnLFxuICAgICAgICBjb2luOiAndGJ0YycsXG4gICAgICAgIGtleXM6IFsndXNlcicsICdiYWNrdXAnLCAnYml0Z28nXSxcbiAgICAgIH0pO1xuXG4gICAgICAvLyBUaGUgYXR0YWNrZXIgcmVwbGFjZXMgdGhlIGxlZ2l0aW1hdGUgd2FsbGV0IGFkZHJlc3Mgd2l0aCB0aGVpciBvd25cbiAgICAgIGNvbnN0IGF0dGFja2VyQWRkcmVzcyA9IGdldFdhbGxldEFkZHJlc3MoJ3RidGMnLCBhdHRhY2tlcktleXMpO1xuICAgICAgY29uc3Qgc3Bvb2ZlZFBzYnQgPSBjb25zdHJ1Y3RQc2J0KFxuICAgICAgICBbeyBzY3JpcHRUeXBlOiAncDJ3c2gnIGFzIGNvbnN0LCB2YWx1ZTogQmlnSW50KDEwMDAwKSB9XSxcbiAgICAgICAgW3sgYWRkcmVzczogYXR0YWNrZXJBZGRyZXNzLCB2YWx1ZTogQmlnSW50KDkwMDApIH1dLFxuICAgICAgICAndGJ0YycsXG4gICAgICAgIHdhbGxldEtleXMgLy8gSW5wdXQgdXNlcyB3YWxsZXQga2V5cyAodGhlIGZ1bmRzIGJlaW5nIHN0b2xlbilcbiAgICAgICk7XG4gICAgICBjb25zdCBzcG9vZmVkSGV4OiBzdHJpbmcgPSBCdWZmZXIuZnJvbShzcG9vZmVkUHNidC5zZXJpYWxpemUoKSkudG9TdHJpbmcoJ2hleCcpO1xuXG4gICAgICBub2NrQml0R28oKVxuICAgICAgICAucG9zdChgL2FwaS92Mi8ke3dhbGxldC5jb2luKCl9L3dhbGxldC8ke3dhbGxldC5pZCgpfS9jb25zb2xpZGF0ZVVuc3BlbnRzYClcbiAgICAgICAgLnJlcGx5KDIwMCwgeyB0eEhleDogc3Bvb2ZlZEhleCwgY29uc29saWRhdGVJZDogJ3Rlc3QnIH0pO1xuXG4gICAgICBub2NrQml0R28oKVxuICAgICAgICAucG9zdChgL2FwaS92Mi8ke3dhbGxldC5jb2luKCl9L3dhbGxldC8ke3dhbGxldC5pZCgpfS90eC9zZW5kYClcbiAgICAgICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIEB0eXBlc2NyaXB0LWVzbGludC9uby1leHBsaWNpdC1hbnlcbiAgICAgICAgLnJlcGx5KChyZXF1ZXN0Qm9keTogYW55KSA9PiB7XG4gICAgICAgICAgaWYgKHJlcXVlc3RCb2R5Py50eEhleCA9PT0gc3Bvb2ZlZEhleCkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKCdTcG9vZmVkIHRyYW5zYWN0aW9uIHdhcyBzZW50OiBzcG9vZmluZyBwcm90ZWN0aW9uIGZhaWxlZCcpO1xuICAgICAgICAgIH1cbiAgICAgICAgICByZXR1cm4gWzIwMCwgeyB0eGlkOiAndGVzdC10eGlkLTEyMycsIHN0YXR1czogJ3NpZ25lZCcgfV07XG4gICAgICAgIH0pO1xuXG4gICAgICBhd2FpdCBub2NrV2FsbGV0S2V5cyh3YWxsZXQsIGtleVRyaXBsZSwgJ3Bhc3MnKTtcblxuICAgICAgYXdhaXQgYXNzZXJ0LnJlamVjdHMoXG4gICAgICAgIHdhbGxldC5jb25zb2xpZGF0ZVVuc3BlbnRzKHsgd2FsbGV0UGFzc3BocmFzZTogJ3Bhc3MnIH0pLFxuICAgICAgICAvLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgQHR5cGVzY3JpcHQtZXNsaW50L25vLWV4cGxpY2l0LWFueVxuICAgICAgICAoZTogYW55KSA9PlxuICAgICAgICAgIHR5cGVvZiBlPy5tZXNzYWdlID09PSAnc3RyaW5nJyAmJlxuICAgICAgICAgIGUubWVzc2FnZS5pbmNsdWRlcygncHJlYnVpbGQgYXR0ZW1wdHMgdG8gc3BlbmQgdG8gdW5pbnRlbmRlZCBleHRlcm5hbCByZWNpcGllbnRzJylcbiAgICAgICk7XG4gICAgfSk7XG4gIH0pO1xuXG4gIGRlc2NyaWJlKCdVbnNwZW50IG1hbmFnZW1lbnQgc3Bvb2ZhYmlsaXR5IC0gRmFub3V0IChCVUlMRF9TSUdOX1NFTkQpJywgZnVuY3Rpb24gKCkge1xuICAgIGl0KCdzaG91bGQgZGV0ZWN0IHNwb29mZWQgZmFub3V0IHRvIGF0dGFja2VyIGFkZHJlc3MnLCBhc3luYyBmdW5jdGlvbiAoKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgICBjb25zdCBrZXlUcmlwbGUgPSB0ZXN0dXRpbHMuZ2V0S2V5VHJpcGxlKCdkZWZhdWx0Jyk7XG4gICAgICBjb25zdCB3YWxsZXRLZXlzID0gdGVzdHV0aWxzLmdldERlZmF1bHRXYWxsZXRLZXlzKCk7XG4gICAgICBjb25zdCBhdHRhY2tlcktleXMgPSB0ZXN0dXRpbHMuZ2V0V2FsbGV0S2V5c0ZvclNlZWQoJ2F0dGFja2VyJyk7XG5cbiAgICAgIGNvbnN0IHdhbGxldCA9IG5ldyBXYWxsZXQoZGVmYXVsdEJpdEdvLCBjb2luLCB7XG4gICAgICAgIGlkOiAnNWIzNDI1MmYxYmYzNDk5MzBlMzQwMjBhJyxcbiAgICAgICAgY29pbjogJ3RidGMnLFxuICAgICAgICBrZXlzOiBbJ3VzZXInLCAnYmFja3VwJywgJ2JpdGdvJ10sXG4gICAgICB9KTtcblxuICAgICAgLy8gVGhlIGF0dGFja2VyIHJlcGxhY2VzIHRoZSBsZWdpdGltYXRlIHdhbGxldCBhZGRyZXNzIHdpdGggdGhlaXIgb3duXG4gICAgICBjb25zdCBhdHRhY2tlckFkZHJlc3MgPSBnZXRXYWxsZXRBZGRyZXNzKCd0YnRjJywgYXR0YWNrZXJLZXlzKTtcbiAgICAgIGNvbnN0IHNwb29mZWRQc2J0ID0gY29uc3RydWN0UHNidChcbiAgICAgICAgW3sgc2NyaXB0VHlwZTogJ3Ayd3NoJyBhcyBjb25zdCwgdmFsdWU6IEJpZ0ludCgxMDAwMCkgfV0sXG4gICAgICAgIFt7IGFkZHJlc3M6IGF0dGFja2VyQWRkcmVzcywgdmFsdWU6IEJpZ0ludCg5MDAwKSB9XSxcbiAgICAgICAgJ3RidGMnLFxuICAgICAgICB3YWxsZXRLZXlzIC8vIElucHV0IHVzZXMgd2FsbGV0IGtleXMgKHRoZSBmdW5kcyBiZWluZyBzdG9sZW4pXG4gICAgICApO1xuICAgICAgY29uc3Qgc3Bvb2ZlZEhleDogc3RyaW5nID0gQnVmZmVyLmZyb20oc3Bvb2ZlZFBzYnQuc2VyaWFsaXplKCkpLnRvU3RyaW5nKCdoZXgnKTtcblxuICAgICAgbm9ja0JpdEdvKClcbiAgICAgICAgLnBvc3QoYC9hcGkvdjIvJHt3YWxsZXQuY29pbigpfS93YWxsZXQvJHt3YWxsZXQuaWQoKX0vZmFub3V0VW5zcGVudHNgKVxuICAgICAgICAucmVwbHkoMjAwLCB7IHR4SGV4OiBzcG9vZmVkSGV4LCBmYW5vdXRJZDogJ3Rlc3QnIH0pO1xuXG4gICAgICBub2NrQml0R28oKVxuICAgICAgICAucG9zdChgL2FwaS92Mi8ke3dhbGxldC5jb2luKCl9L3dhbGxldC8ke3dhbGxldC5pZCgpfS90eC9zZW5kYClcbiAgICAgICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIEB0eXBlc2NyaXB0LWVzbGludC9uby1leHBsaWNpdC1hbnlcbiAgICAgICAgLnJlcGx5KChyZXF1ZXN0Qm9keTogYW55KSA9PiB7XG4gICAgICAgICAgaWYgKHJlcXVlc3RCb2R5Py50eEhleCA9PT0gc3Bvb2ZlZEhleCkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKCdTcG9vZmVkIHRyYW5zYWN0aW9uIHdhcyBzZW50OiBzcG9vZmluZyBwcm90ZWN0aW9uIGZhaWxlZCcpO1xuICAgICAgICAgIH1cbiAgICAgICAgICByZXR1cm4gWzIwMCwgeyB0eGlkOiAndGVzdC10eGlkLTEyMycsIHN0YXR1czogJ3NpZ25lZCcgfV07XG4gICAgICAgIH0pO1xuXG4gICAgICBhd2FpdCBub2NrV2FsbGV0S2V5cyh3YWxsZXQsIGtleVRyaXBsZSwgJ3Bhc3MnKTtcblxuICAgICAgYXdhaXQgYXNzZXJ0LnJlamVjdHMoXG4gICAgICAgIHdhbGxldC5mYW5vdXRVbnNwZW50cyh7IHdhbGxldFBhc3NwaHJhc2U6ICdwYXNzJyB9KSxcbiAgICAgICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIEB0eXBlc2NyaXB0LWVzbGludC9uby1leHBsaWNpdC1hbnlcbiAgICAgICAgKGU6IGFueSkgPT5cbiAgICAgICAgICB0eXBlb2YgZT8ubWVzc2FnZSA9PT0gJ3N0cmluZycgJiZcbiAgICAgICAgICBlLm1lc3NhZ2UuaW5jbHVkZXMoJ3ByZWJ1aWxkIGF0dGVtcHRzIHRvIHNwZW5kIHRvIHVuaW50ZW5kZWQgZXh0ZXJuYWwgcmVjaXBpZW50cycpXG4gICAgICApO1xuICAgIH0pO1xuICB9KTtcbn0pO1xuIl19

package/dist/cjs/test/unit/transaction/descriptor/explainPsbt.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=explainPsbt.d.ts.map

package/dist/cjs/test/unit/transaction/descriptor/explainPsbt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"explainPsbt.d.ts","sourceRoot":"","sources":["../../../../../../test/unit/transaction/descriptor/explainPsbt.ts"],"names":[],"mappings":""}

package/dist/cjs/test/unit/transaction/descriptor/explainPsbt.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert_1 = __importDefault(require("assert"));
+const wasm_utxo_1 = require("@bitgo/wasm-utxo");
+const testutils = __importStar(require("@bitgo/wasm-utxo/testutils"));
+const descriptor_1 = require("../../../../src/transaction/descriptor");
+const fixtures_utils_1 = require("./fixtures.utils");
+const { getDescriptorMap, mockPsbtDefaultWithDescriptorTemplate } = testutils.descriptor;
+const { assertEqualFixture } = (0, fixtures_utils_1.getFixtureRoot)(__dirname + '/fixtures');
+function assertSignatureCount(expl, signatures, inputSignatures) {
+    assert_1.default.ok('signatures' in expl);
+    assert_1.default.ok('inputSignatures' in expl);
+    assert_1.default.deepStrictEqual(expl.signatures, signatures);
+    assert_1.default.deepStrictEqual(expl.inputSignatures, inputSignatures);
+}
+describe('explainPsbt', function () {
+    it('has expected values', async function () {
+        const psbt = mockPsbtDefaultWithDescriptorTemplate('Wsh2Of3');
+        const keys = testutils.getKeyTriple('a');
+        const descriptorMap = getDescriptorMap('Wsh2Of3', keys);
+        await assertEqualFixture('explainPsbt.a.json', (0, descriptor_1.explainPsbt)(psbt, descriptorMap, 'btc'));
+        wasm_utxo_1.descriptorWallet.signWithKey(psbt, keys[0]);
+        assertSignatureCount((0, descriptor_1.explainPsbt)(psbt, descriptorMap, 'btc'), 1, [1, 1]);
+        wasm_utxo_1.descriptorWallet.signWithKey(psbt, keys[1]);
+        assertSignatureCount((0, descriptor_1.explainPsbt)(psbt, descriptorMap, 'btc'), 2, [2, 2]);
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhwbGFpblBzYnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi90ZXN0L3VuaXQvdHJhbnNhY3Rpb24vZGVzY3JpcHRvci9leHBsYWluUHNidC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLG9EQUE0QjtBQUU1QixnREFBb0Q7QUFDcEQsc0VBQXdEO0FBR3hELHVFQUFxRTtBQUVyRSxxREFBa0Q7QUFFbEQsTUFBTSxFQUFFLGdCQUFnQixFQUFFLHFDQUFxQyxFQUFFLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQztBQUN6RixNQUFNLEVBQUUsa0JBQWtCLEVBQUUsR0FBRyxJQUFBLCtCQUFjLEVBQUMsU0FBUyxHQUFHLFdBQVcsQ0FBQyxDQUFDO0FBRXZFLFNBQVMsb0JBQW9CLENBQUMsSUFBNEIsRUFBRSxVQUFrQixFQUFFLGVBQXlCO0lBQ3ZHLGdCQUFNLENBQUMsRUFBRSxDQUFDLFlBQVksSUFBSSxJQUFJLENBQUMsQ0FBQztJQUNoQyxnQkFBTSxDQUFDLEVBQUUsQ0FBQyxpQkFBaUIsSUFBSSxJQUFJLENBQUMsQ0FBQztJQUNyQyxnQkFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3BELGdCQUFNLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsZUFBZSxDQUFDLENBQUM7QUFDaEUsQ0FBQztBQUVELFFBQVEsQ0FBQyxhQUFhLEVBQUU7SUFDdEIsRUFBRSxDQUFDLHFCQUFxQixFQUFFLEtBQUs7UUFDN0IsTUFBTSxJQUFJLEdBQUcscUNBQXFDLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDOUQsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN6QyxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDeEQsTUFBTSxrQkFBa0IsQ0FBQyxvQkFBb0IsRUFBRSxJQUFBLHdCQUFXLEVBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3hGLDRCQUFnQixDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDNUMsb0JBQW9CLENBQUMsSUFBQSx3QkFBVyxFQUFDLElBQUksRUFBRSxhQUFhLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDekUsNEJBQWdCLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM1QyxvQkFBb0IsQ0FBQyxJQUFBLHdCQUFXLEVBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRSxDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGFzc2VydCBmcm9tICdhc3NlcnQnO1xuXG5pbXBvcnQgeyBkZXNjcmlwdG9yV2FsbGV0IH0gZnJvbSAnQGJpdGdvL3dhc20tdXR4byc7XG5pbXBvcnQgKiBhcyB0ZXN0dXRpbHMgZnJvbSAnQGJpdGdvL3dhc20tdXR4by90ZXN0dXRpbHMnO1xuXG5pbXBvcnQgdHlwZSB7IFRyYW5zYWN0aW9uRXhwbGFuYXRpb24gfSBmcm9tICcuLi8uLi8uLi8uLi9zcmMvdHJhbnNhY3Rpb24vZml4ZWRTY3JpcHQvZXhwbGFpblRyYW5zYWN0aW9uJztcbmltcG9ydCB7IGV4cGxhaW5Qc2J0IH0gZnJvbSAnLi4vLi4vLi4vLi4vc3JjL3RyYW5zYWN0aW9uL2Rlc2NyaXB0b3InO1xuXG5pbXBvcnQgeyBnZXRGaXh0dXJlUm9vdCB9IGZyb20gJy4vZml4dHVyZXMudXRpbHMnO1xuXG5jb25zdCB7IGdldERlc2NyaXB0b3JNYXAsIG1vY2tQc2J0RGVmYXVsdFdpdGhEZXNjcmlwdG9yVGVtcGxhdGUgfSA9IHRlc3R1dGlscy5kZXNjcmlwdG9yO1xuY29uc3QgeyBhc3NlcnRFcXVhbEZpeHR1cmUgfSA9IGdldEZpeHR1cmVSb290KF9fZGlybmFtZSArICcvZml4dHVyZXMnKTtcblxuZnVuY3Rpb24gYXNzZXJ0U2lnbmF0dXJlQ291bnQoZXhwbDogVHJhbnNhY3Rpb25FeHBsYW5hdGlvbiwgc2lnbmF0dXJlczogbnVtYmVyLCBpbnB1dFNpZ25hdHVyZXM6IG51bWJlcltdKSB7XG4gIGFzc2VydC5vaygnc2lnbmF0dXJlcycgaW4gZXhwbCk7XG4gIGFzc2VydC5vaygnaW5wdXRTaWduYXR1cmVzJyBpbiBleHBsKTtcbiAgYXNzZXJ0LmRlZXBTdHJpY3RFcXVhbChleHBsLnNpZ25hdHVyZXMsIHNpZ25hdHVyZXMpO1xuICBhc3NlcnQuZGVlcFN0cmljdEVxdWFsKGV4cGwuaW5wdXRTaWduYXR1cmVzLCBpbnB1dFNpZ25hdHVyZXMpO1xufVxuXG5kZXNjcmliZSgnZXhwbGFpblBzYnQnLCBmdW5jdGlvbiAoKSB7XG4gIGl0KCdoYXMgZXhwZWN0ZWQgdmFsdWVzJywgYXN5bmMgZnVuY3Rpb24gKCkge1xuICAgIGNvbnN0IHBzYnQgPSBtb2NrUHNidERlZmF1bHRXaXRoRGVzY3JpcHRvclRlbXBsYXRlKCdXc2gyT2YzJyk7XG4gICAgY29uc3Qga2V5cyA9IHRlc3R1dGlscy5nZXRLZXlUcmlwbGUoJ2EnKTtcbiAgICBjb25zdCBkZXNjcmlwdG9yTWFwID0gZ2V0RGVzY3JpcHRvck1hcCgnV3NoMk9mMycsIGtleXMpO1xuICAgIGF3YWl0IGFzc2VydEVxdWFsRml4dHVyZSgnZXhwbGFpblBzYnQuYS5qc29uJywgZXhwbGFpblBzYnQocHNidCwgZGVzY3JpcHRvck1hcCwgJ2J0YycpKTtcbiAgICBkZXNjcmlwdG9yV2FsbGV0LnNpZ25XaXRoS2V5KHBzYnQsIGtleXNbMF0pO1xuICAgIGFzc2VydFNpZ25hdHVyZUNvdW50KGV4cGxhaW5Qc2J0KHBzYnQsIGRlc2NyaXB0b3JNYXAsICdidGMnKSwgMSwgWzEsIDFdKTtcbiAgICBkZXNjcmlwdG9yV2FsbGV0LnNpZ25XaXRoS2V5KHBzYnQsIGtleXNbMV0pO1xuICAgIGFzc2VydFNpZ25hdHVyZUNvdW50KGV4cGxhaW5Qc2J0KHBzYnQsIGRlc2NyaXB0b3JNYXAsICdidGMnKSwgMiwgWzIsIDJdKTtcbiAgfSk7XG59KTtcbiJdfQ==

package/dist/cjs/test/unit/transaction/descriptor/fixtures.utils.d.ts

@@ -0,0 +1,6 @@
+interface FixtureRoot {
+    assertEqualFixture(name: string, v: unknown): Promise<void>;
+}
+export declare function getFixtureRoot(root: string): FixtureRoot;
+export {};
+//# sourceMappingURL=fixtures.utils.d.ts.map

package/dist/cjs/test/unit/transaction/descriptor/fixtures.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.utils.d.ts","sourceRoot":"","sources":["../../../../../../test/unit/transaction/descriptor/fixtures.utils.ts"],"names":[],"mappings":"AAOA,UAAU,WAAW;IACnB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAID,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAMxD"}

package/dist/cjs/test/unit/transaction/descriptor/fixtures.utils.js

@@ -0,0 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFixtureRoot = getFixtureRoot;
+const assert_1 = __importDefault(require("assert"));
+const path_1 = __importDefault(require("path"));
+const testutils = __importStar(require("@bitgo/wasm-utxo/testutils"));
+const { getFixture, jsonNormalize } = testutils;
+function getFixtureRoot(root) {
+    return {
+        async assertEqualFixture(name, v, normalize = jsonNormalize) {
+            assert_1.default.deepStrictEqual(normalize(v), await getFixture(path_1.default.join(root, name), normalize(v)));
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZml4dHVyZXMudXRpbHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi90ZXN0L3VuaXQvdHJhbnNhY3Rpb24vZGVzY3JpcHRvci9maXh0dXJlcy51dGlscy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQWFBLHdDQU1DO0FBbkJELG9EQUE0QjtBQUM1QixnREFBd0I7QUFFeEIsc0VBQXdEO0FBRXhELE1BQU0sRUFBRSxVQUFVLEVBQUUsYUFBYSxFQUFFLEdBQUcsU0FBUyxDQUFDO0FBUWhELFNBQWdCLGNBQWMsQ0FBQyxJQUFZO0lBQ3pDLE9BQU87UUFDTCxLQUFLLENBQUMsa0JBQWtCLENBQUMsSUFBWSxFQUFFLENBQVUsRUFBRSxZQUF1QixhQUFhO1lBQ3JGLGdCQUFNLENBQUMsZUFBZSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLFVBQVUsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzlGLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBhc3NlcnQgZnJvbSAnYXNzZXJ0JztcbmltcG9ydCBwYXRoIGZyb20gJ3BhdGgnO1xuXG5pbXBvcnQgKiBhcyB0ZXN0dXRpbHMgZnJvbSAnQGJpdGdvL3dhc20tdXR4by90ZXN0dXRpbHMnO1xuXG5jb25zdCB7IGdldEZpeHR1cmUsIGpzb25Ob3JtYWxpemUgfSA9IHRlc3R1dGlscztcblxuaW50ZXJmYWNlIEZpeHR1cmVSb290IHtcbiAgYXNzZXJ0RXF1YWxGaXh0dXJlKG5hbWU6IHN0cmluZywgdjogdW5rbm93bik6IFByb21pc2U8dm9pZD47XG59XG5cbnR5cGUgTm9ybWFsaXplID0gKHY6IHVua25vd24pID0+IHVua25vd247XG5cbmV4cG9ydCBmdW5jdGlvbiBnZXRGaXh0dXJlUm9vdChyb290OiBzdHJpbmcpOiBGaXh0dXJlUm9vdCB7XG4gIHJldHVybiB7XG4gICAgYXN5bmMgYXNzZXJ0RXF1YWxGaXh0dXJlKG5hbWU6IHN0cmluZywgdjogdW5rbm93biwgbm9ybWFsaXplOiBOb3JtYWxpemUgPSBqc29uTm9ybWFsaXplKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgICBhc3NlcnQuZGVlcFN0cmljdEVxdWFsKG5vcm1hbGl6ZSh2KSwgYXdhaXQgZ2V0Rml4dHVyZShwYXRoLmpvaW4ocm9vdCwgbmFtZSksIG5vcm1hbGl6ZSh2KSkpO1xuICAgIH0sXG4gIH07XG59XG4iXX0=

package/dist/cjs/test/unit/transaction/descriptor/parse.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parse.d.ts.map

package/dist/cjs/test/unit/transaction/descriptor/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../../../../test/unit/transaction/descriptor/parse.ts"],"names":[],"mappings":""}