@bitgo-beta/sdk-api 1.10.1-beta.199 → 1.10.1-beta.1990

package/dist/src/encryptV2.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HKDF_SALT_LENGTH = exports.GCM_IV_LENGTH = exports.ARGON2_DEFAULTS = void 0;
+exports.argon2ToHkdfKey = argon2ToHkdfKey;
+exports.hkdfDeriveAesKey = hkdfDeriveAesKey;
+exports.aesGcmEncrypt = aesGcmEncrypt;
+exports.aesGcmDecrypt = aesGcmDecrypt;
+exports.parseV2Envelope = parseV2Envelope;
+exports.encryptV2 = encryptV2;
+exports.decryptV2 = decryptV2;
+const argon2_1 = require("@bitgo-beta/argon2");
+const sdk_core_1 = require("@bitgo-beta/sdk-core");
+const crypto_1 = require("crypto");
+const t = __importStar(require("io-ts"));
+/** Web Crypto subtle — browser global in DOM; Node/Electron main must use `webcrypto`. */
+const subtle = globalThis.crypto?.subtle ?? crypto_1.webcrypto.subtle;
+/** Default Argon2id parameters per RFC 9106 second recommendation
+ * @see https://www.rfc-editor.org/rfc/rfc9106#section-4
+ */
+exports.ARGON2_DEFAULTS = {
+    memorySize: 65536, // 64 MiB in KiB
+    iterations: 3,
+    parallelism: 4,
+    hashLength: 32, // 256-bit key
+    saltLength: 16, // 128-bit salt
+};
+/** Maximum allowed Argon2id parameters to prevent DoS via crafted envelopes.
+ * memorySize: 256 MiB (4x default) -- caps memory allocation on untrusted input.
+ * iterations: 16 -- caps CPU time.
+ * parallelism: 16 -- caps thread count.
+ */
+const ARGON2_MAX = {
+    memorySize: 262144,
+    iterations: 16,
+    parallelism: 16,
+};
+/** AES-256-GCM IV length in bytes */
+exports.GCM_IV_LENGTH = 12;
+/** HKDF per-call salt length in bytes */
+exports.HKDF_SALT_LENGTH = 32;
+/** Fixed HKDF info string for domain separation across BitGo v2 session keys */
+const HKDF_INFO = new TextEncoder().encode('bitgo-v2-session');
+// Envelope codec
+const V2EnvelopeCodec = t.intersection([
+    t.type({
+        v: t.literal(2),
+        m: (0, sdk_core_1.boundedInt)(1, ARGON2_MAX.memorySize, 'memorySize'),
+        t: (0, sdk_core_1.boundedInt)(1, ARGON2_MAX.iterations, 'iterations'),
+        p: (0, sdk_core_1.boundedInt)(1, ARGON2_MAX.parallelism, 'parallelism'),
+        salt: sdk_core_1.base64String,
+        iv: sdk_core_1.base64String,
+        ct: sdk_core_1.base64String,
+    }),
+    t.partial({
+        /** Base64-encoded per-call HKDF salt -- present only in session-produced envelopes */
+        hkdfSalt: sdk_core_1.base64String,
+        /** Additional authenticated data for context binding (e.g. transaction hash + derivation path) */
+        adata: t.string,
+    }),
+]);
+// Crypto helpers
+async function argon2Hash(password, salt, params) {
+    return (0, argon2_1.argon2id)({
+        password,
+        salt,
+        memorySize: params.memorySize,
+        iterations: params.iterations,
+        parallelism: params.parallelism,
+        hashLength: exports.ARGON2_DEFAULTS.hashLength,
+        outputType: 'binary',
+    });
+}
+async function argon2ToAesKey(password, salt, params) {
+    const keyBytes = await argon2Hash(password, salt, params);
+    return subtle.importKey('raw', keyBytes, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+}
+async function argon2ToHkdfKey(password, salt, params) {
+    const keyBytes = await argon2Hash(password, salt, params);
+    return subtle.importKey('raw', keyBytes, 'HKDF', false, ['deriveKey']);
+}
+function hkdfDeriveAesKey(hkdfKey, hkdfSalt, usage) {
+    return subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: hkdfSalt, info: HKDF_INFO }, hkdfKey, { name: 'AES-GCM', length: 256 }, false, [usage]);
+}
+async function aesGcmEncrypt(key, iv, plaintext, additionalData) {
+    const params = { name: 'AES-GCM', iv, tagLength: 128 };
+    if (additionalData)
+        params.additionalData = additionalData;
+    const ct = await subtle.encrypt(params, key, new TextEncoder().encode(plaintext));
+    return new Uint8Array(ct);
+}
+async function aesGcmDecrypt(key, iv, ct, additionalData) {
+    const params = { name: 'AES-GCM', iv, tagLength: 128 };
+    if (additionalData)
+        params.additionalData = additionalData;
+    const plaintext = await subtle.decrypt(params, key, ct);
+    return new TextDecoder().decode(plaintext);
+}
+function parseV2Envelope(ciphertext) {
+    let parsed;
+    try {
+        parsed = JSON.parse(ciphertext);
+    }
+    catch {
+        throw new Error('v2 decrypt: invalid JSON envelope');
+    }
+    return (0, sdk_core_1.decodeWithCodec)(V2EnvelopeCodec, parsed, 'v2 decrypt: invalid envelope');
+}
+// Public API
+/**
+ * Encrypt plaintext using Argon2id KDF + AES-256-GCM.
+ *
+ * Returns a self-describing JSON v2 envelope containing all Argon2id parameters,
+ * salt, IV, and ciphertext -- fully standalone for decryption.
+ *
+ * For multi-call operations (MPC signing, wallet creation), prefer
+ * createEncryptionSession to run Argon2id once and derive per-call keys via HKDF.
+ */
+async function encryptV2(password, plaintext, options) {
+    const memorySize = options?.memorySize ?? exports.ARGON2_DEFAULTS.memorySize;
+    const iterations = options?.iterations ?? exports.ARGON2_DEFAULTS.iterations;
+    const parallelism = options?.parallelism ?? exports.ARGON2_DEFAULTS.parallelism;
+    const salt = options?.salt ?? new Uint8Array((0, crypto_1.randomBytes)(exports.ARGON2_DEFAULTS.saltLength));
+    if (salt.length !== exports.ARGON2_DEFAULTS.saltLength)
+        throw new Error(`salt must be ${exports.ARGON2_DEFAULTS.saltLength} bytes`);
+    const iv = options?.iv ?? new Uint8Array((0, crypto_1.randomBytes)(exports.GCM_IV_LENGTH));
+    if (iv.length !== exports.GCM_IV_LENGTH)
+        throw new Error(`iv must be ${exports.GCM_IV_LENGTH} bytes`);
+    const adataBytes = options?.adata ? new TextEncoder().encode(options.adata) : undefined;
+    const key = await argon2ToAesKey(password, salt, { memorySize, iterations, parallelism });
+    const ct = await aesGcmEncrypt(key, iv, plaintext, adataBytes);
+    const envelope = {
+        v: 2,
+        m: memorySize,
+        t: iterations,
+        p: parallelism,
+        salt: Buffer.from(salt).toString('base64'),
+        iv: Buffer.from(iv).toString('base64'),
+        ct: Buffer.from(ct).toString('base64'),
+    };
+    if (options?.adata)
+        envelope.adata = options.adata;
+    return JSON.stringify(envelope);
+}
+/**
+ * Decrypt a v2 envelope (Argon2id + AES-256-GCM).
+ *
+ * Handles both envelope types automatically:
+ *   - Standard  (no hkdfSalt): Argon2id -> AES-GCM
+ *   - Session   (hkdfSalt present): Argon2id -> HKDF -> AES-GCM
+ *
+ * All parameters are stored in the envelope -- no session context required.
+ */
+async function decryptV2(password, ciphertext) {
+    const envelope = parseV2Envelope(ciphertext);
+    const salt = new Uint8Array(Buffer.from(envelope.salt, 'base64'));
+    const iv = new Uint8Array(Buffer.from(envelope.iv, 'base64'));
+    const ct = new Uint8Array(Buffer.from(envelope.ct, 'base64'));
+    const params = { memorySize: envelope.m, iterations: envelope.t, parallelism: envelope.p };
+    const adataBytes = envelope.adata ? new TextEncoder().encode(envelope.adata) : undefined;
+    if (envelope.hkdfSalt) {
+        const hkdfKey = await argon2ToHkdfKey(password, salt, params);
+        const hkdfSalt = new Uint8Array(Buffer.from(envelope.hkdfSalt, 'base64'));
+        const aesKey = await hkdfDeriveAesKey(hkdfKey, hkdfSalt, 'decrypt');
+        return aesGcmDecrypt(aesKey, iv, ct, adataBytes);
+    }
+    const key = await argon2ToAesKey(password, salt, params);
+    return aesGcmDecrypt(key, iv, ct, adataBytes);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdFYyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2VuY3J5cHRWMi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUF3RkEsMENBT0M7QUFFRCw0Q0FRQztBQUVELHNDQVVDO0FBRUQsc0NBVUM7QUFFRCwwQ0FRQztBQWFELDhCQXFDQztBQVdELDhCQWlCQztBQXpORCwrQ0FBOEM7QUFDOUMsbURBQWlGO0FBQ2pGLG1DQUFnRDtBQUNoRCx5Q0FBMkI7QUFFM0IsMEZBQTBGO0FBQzFGLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxJQUFJLGtCQUFTLENBQUMsTUFBTSxDQUFDO0FBRTdEOztHQUVHO0FBQ1UsUUFBQSxlQUFlLEdBQUc7SUFDN0IsVUFBVSxFQUFFLEtBQUssRUFBRSxnQkFBZ0I7SUFDbkMsVUFBVSxFQUFFLENBQUM7SUFDYixXQUFXLEVBQUUsQ0FBQztJQUNkLFVBQVUsRUFBRSxFQUFFLEVBQUUsY0FBYztJQUM5QixVQUFVLEVBQUUsRUFBRSxFQUFFLGVBQWU7Q0FDdkIsQ0FBQztBQUVYOzs7O0dBSUc7QUFDSCxNQUFNLFVBQVUsR0FBRztJQUNqQixVQUFVLEVBQUUsTUFBTTtJQUNsQixVQUFVLEVBQUUsRUFBRTtJQUNkLFdBQVcsRUFBRSxFQUFFO0NBQ1AsQ0FBQztBQUVYLHFDQUFxQztBQUN4QixRQUFBLGFBQWEsR0FBRyxFQUFFLENBQUM7QUFFaEMseUNBQXlDO0FBQzVCLFFBQUEsZ0JBQWdCLEdBQUcsRUFBRSxDQUFDO0FBRW5DLGdGQUFnRjtBQUNoRixNQUFNLFNBQVMsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBRS9ELGlCQUFpQjtBQUVqQixNQUFNLGVBQWUsR0FBRyxDQUFDLENBQUMsWUFBWSxDQUFDO0lBQ3JDLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDTCxDQUFDLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDZixDQUFDLEVBQUUsSUFBQSxxQkFBVSxFQUFDLENBQUMsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQztRQUNyRCxDQUFDLEVBQUUsSUFBQSxxQkFBVSxFQUFDLENBQUMsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQztRQUNyRCxDQUFDLEVBQUUsSUFBQSxxQkFBVSxFQUFDLENBQUMsRUFBRSxVQUFVLENBQUMsV0FBVyxFQUFFLGFBQWEsQ0FBQztRQUN2RCxJQUFJLEVBQUUsdUJBQVk7UUFDbEIsRUFBRSxFQUFFLHVCQUFZO1FBQ2hCLEVBQUUsRUFBRSx1QkFBWTtLQUNqQixDQUFDO0lBQ0YsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUNSLHNGQUFzRjtRQUN0RixRQUFRLEVBQUUsdUJBQVk7UUFDdEIsa0dBQWtHO1FBQ2xHLEtBQUssRUFBRSxDQUFDLENBQUMsTUFBTTtLQUNoQixDQUFDO0NBQ0gsQ0FBQyxDQUFDO0FBSUgsaUJBQWlCO0FBRWpCLEtBQUssVUFBVSxVQUFVLENBQ3ZCLFFBQWdCLEVBQ2hCLElBQWdCLEVBQ2hCLE1BQXVFO0lBRXZFLE9BQU8sSUFBQSxpQkFBUSxFQUFDO1FBQ2QsUUFBUTtRQUNSLElBQUk7UUFDSixVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1FBQzdCLFdBQVcsRUFBRSxNQUFNLENBQUMsV0FBVztRQUMvQixVQUFVLEVBQUUsdUJBQWUsQ0FBQyxVQUFVO1FBQ3RDLFVBQVUsRUFBRSxRQUFRO0tBQ3JCLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxLQUFLLFVBQVUsY0FBYyxDQUMzQixRQUFnQixFQUNoQixJQUFnQixFQUNoQixNQUF1RTtJQUV2RSxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFELE9BQU8sTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0FBQy9GLENBQUM7QUFFTSxLQUFLLFVBQVUsZUFBZSxDQUNuQyxRQUFnQixFQUNoQixJQUFnQixFQUNoQixNQUF1RTtJQUV2RSxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFELE9BQU8sTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBQ3pFLENBQUM7QUFFRCxTQUFnQixnQkFBZ0IsQ0FBQyxPQUFrQixFQUFFLFFBQW9CLEVBQUUsS0FBZTtJQUN4RixPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQ3JCLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUNsRSxPQUFPLEVBQ1AsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFDaEMsS0FBSyxFQUNMLENBQUMsS0FBSyxDQUFDLENBQ1IsQ0FBQztBQUNKLENBQUM7QUFFTSxLQUFLLFVBQVUsYUFBYSxDQUNqQyxHQUFjLEVBQ2QsRUFBYyxFQUNkLFNBQWlCLEVBQ2pCLGNBQTJCO0lBRTNCLE1BQU0sTUFBTSxHQUFpQixFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQztJQUNyRSxJQUFJLGNBQWM7UUFBRSxNQUFNLENBQUMsY0FBYyxHQUFHLGNBQWMsQ0FBQztJQUMzRCxNQUFNLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLE9BQU8sSUFBSSxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDNUIsQ0FBQztBQUVNLEtBQUssVUFBVSxhQUFhLENBQ2pDLEdBQWMsRUFDZCxFQUFjLEVBQ2QsRUFBYyxFQUNkLGNBQTJCO0lBRTNCLE1BQU0sTUFBTSxHQUFpQixFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQztJQUNyRSxJQUFJLGNBQWM7UUFBRSxNQUFNLENBQUMsY0FBYyxHQUFHLGNBQWMsQ0FBQztJQUMzRCxNQUFNLFNBQVMsR0FBRyxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUN4RCxPQUFPLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBQzdDLENBQUM7QUFFRCxTQUFnQixlQUFlLENBQUMsVUFBa0I7SUFDaEQsSUFBSSxNQUFlLENBQUM7SUFDcEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBQ0QsT0FBTyxJQUFBLDBCQUFlLEVBQUMsZUFBZSxFQUFFLE1BQU0sRUFBRSw4QkFBOEIsQ0FBQyxDQUFDO0FBQ2xGLENBQUM7QUFFRCxhQUFhO0FBRWI7Ozs7Ozs7O0dBUUc7QUFDSSxLQUFLLFVBQVUsU0FBUyxDQUM3QixRQUFnQixFQUNoQixTQUFpQixFQUNqQixPQU9DO0lBRUQsTUFBTSxVQUFVLEdBQUcsT0FBTyxFQUFFLFVBQVUsSUFBSSx1QkFBZSxDQUFDLFVBQVUsQ0FBQztJQUNyRSxNQUFNLFVBQVUsR0FBRyxPQUFPLEVBQUUsVUFBVSxJQUFJLHVCQUFlLENBQUMsVUFBVSxDQUFDO0lBQ3JFLE1BQU0sV0FBVyxHQUFHLE9BQU8sRUFBRSxXQUFXLElBQUksdUJBQWUsQ0FBQyxXQUFXLENBQUM7SUFFeEUsTUFBTSxJQUFJLEdBQUcsT0FBTyxFQUFFLElBQUksSUFBSSxJQUFJLFVBQVUsQ0FBQyxJQUFBLG9CQUFXLEVBQUMsdUJBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyx1QkFBZSxDQUFDLFVBQVU7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQix1QkFBZSxDQUFDLFVBQVUsUUFBUSxDQUFDLENBQUM7SUFFcEgsTUFBTSxFQUFFLEdBQUcsT0FBTyxFQUFFLEVBQUUsSUFBSSxJQUFJLFVBQVUsQ0FBQyxJQUFBLG9CQUFXLEVBQUMscUJBQWEsQ0FBQyxDQUFDLENBQUM7SUFDckUsSUFBSSxFQUFFLENBQUMsTUFBTSxLQUFLLHFCQUFhO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxjQUFjLHFCQUFhLFFBQVEsQ0FBQyxDQUFDO0lBRXRGLE1BQU0sVUFBVSxHQUFHLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3hGLE1BQU0sR0FBRyxHQUFHLE1BQU0sY0FBYyxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDMUYsTUFBTSxFQUFFLEdBQUcsTUFBTSxhQUFhLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFFL0QsTUFBTSxRQUFRLEdBQWU7UUFDM0IsQ0FBQyxFQUFFLENBQUM7UUFDSixDQUFDLEVBQUUsVUFBVTtRQUNiLENBQUMsRUFBRSxVQUFVO1FBQ2IsQ0FBQyxFQUFFLFdBQVc7UUFDZCxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQzFDLEVBQUUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFDdEMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztLQUN2QyxDQUFDO0lBQ0YsSUFBSSxPQUFPLEVBQUUsS0FBSztRQUFFLFFBQVEsQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQztJQUNuRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDbEMsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0ksS0FBSyxVQUFVLFNBQVMsQ0FBQyxRQUFnQixFQUFFLFVBQWtCO0lBQ2xFLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM3QyxNQUFNLElBQUksR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxNQUFNLEVBQUUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5RCxNQUFNLEVBQUUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5RCxNQUFNLE1BQU0sR0FBRyxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDM0YsTUFBTSxVQUFVLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFFekYsSUFBSSxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDdEIsTUFBTSxPQUFPLEdBQUcsTUFBTSxlQUFlLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM5RCxNQUFNLFFBQVEsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUMxRSxNQUFNLE1BQU0sR0FBRyxNQUFNLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDcEUsT0FBTyxhQUFhLENBQUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVELE1BQU0sR0FBRyxHQUFHLE1BQU0sY0FBYyxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekQsT0FBTyxhQUFhLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFDaEQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGFyZ29uMmlkIH0gZnJvbSAnQGJpdGdvLWJldGEvYXJnb24yJztcbmltcG9ydCB7IGJhc2U2NFN0cmluZywgYm91bmRlZEludCwgZGVjb2RlV2l0aENvZGVjIH0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWNvcmUnO1xuaW1wb3J0IHsgcmFuZG9tQnl0ZXMsIHdlYmNyeXB0byB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgKiBhcyB0IGZyb20gJ2lvLXRzJztcblxuLyoqIFdlYiBDcnlwdG8gc3VidGxlIOKAlCBicm93c2VyIGdsb2JhbCBpbiBET007IE5vZGUvRWxlY3Ryb24gbWFpbiBtdXN0IHVzZSBgd2ViY3J5cHRvYC4gKi9cbmNvbnN0IHN1YnRsZSA9IGdsb2JhbFRoaXMuY3J5cHRvPy5zdWJ0bGUgPz8gd2ViY3J5cHRvLnN1YnRsZTtcblxuLyoqIERlZmF1bHQgQXJnb24yaWQgcGFyYW1ldGVycyBwZXIgUkZDIDkxMDYgc2Vjb25kIHJlY29tbWVuZGF0aW9uXG4gKiBAc2VlIGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL3JmYy9yZmM5MTA2I3NlY3Rpb24tNFxuICovXG5leHBvcnQgY29uc3QgQVJHT04yX0RFRkFVTFRTID0ge1xuICBtZW1vcnlTaXplOiA2NTUzNiwgLy8gNjQgTWlCIGluIEtpQlxuICBpdGVyYXRpb25zOiAzLFxuICBwYXJhbGxlbGlzbTogNCxcbiAgaGFzaExlbmd0aDogMzIsIC8vIDI1Ni1iaXQga2V5XG4gIHNhbHRMZW5ndGg6IDE2LCAvLyAxMjgtYml0IHNhbHRcbn0gYXMgY29uc3Q7XG5cbi8qKiBNYXhpbXVtIGFsbG93ZWQgQXJnb24yaWQgcGFyYW1ldGVycyB0byBwcmV2ZW50IERvUyB2aWEgY3JhZnRlZCBlbnZlbG9wZXMuXG4gKiBtZW1vcnlTaXplOiAyNTYgTWlCICg0eCBkZWZhdWx0KSAtLSBjYXBzIG1lbW9yeSBhbGxvY2F0aW9uIG9uIHVudHJ1c3RlZCBpbnB1dC5cbiAqIGl0ZXJhdGlvbnM6IDE2IC0tIGNhcHMgQ1BVIHRpbWUuXG4gKiBwYXJhbGxlbGlzbTogMTYgLS0gY2FwcyB0aHJlYWQgY291bnQuXG4gKi9cbmNvbnN0IEFSR09OMl9NQVggPSB7XG4gIG1lbW9yeVNpemU6IDI2MjE0NCxcbiAgaXRlcmF0aW9uczogMTYsXG4gIHBhcmFsbGVsaXNtOiAxNixcbn0gYXMgY29uc3Q7XG5cbi8qKiBBRVMtMjU2LUdDTSBJViBsZW5ndGggaW4gYnl0ZXMgKi9cbmV4cG9ydCBjb25zdCBHQ01fSVZfTEVOR1RIID0gMTI7XG5cbi8qKiBIS0RGIHBlci1jYWxsIHNhbHQgbGVuZ3RoIGluIGJ5dGVzICovXG5leHBvcnQgY29uc3QgSEtERl9TQUxUX0xFTkdUSCA9IDMyO1xuXG4vKiogRml4ZWQgSEtERiBpbmZvIHN0cmluZyBmb3IgZG9tYWluIHNlcGFyYXRpb24gYWNyb3NzIEJpdEdvIHYyIHNlc3Npb24ga2V5cyAqL1xuY29uc3QgSEtERl9JTkZPID0gbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKCdiaXRnby12Mi1zZXNzaW9uJyk7XG5cbi8vIEVudmVsb3BlIGNvZGVjXG5cbmNvbnN0IFYyRW52ZWxvcGVDb2RlYyA9IHQuaW50ZXJzZWN0aW9uKFtcbiAgdC50eXBlKHtcbiAgICB2OiB0LmxpdGVyYWwoMiksXG4gICAgbTogYm91bmRlZEludCgxLCBBUkdPTjJfTUFYLm1lbW9yeVNpemUsICdtZW1vcnlTaXplJyksXG4gICAgdDogYm91bmRlZEludCgxLCBBUkdPTjJfTUFYLml0ZXJhdGlvbnMsICdpdGVyYXRpb25zJyksXG4gICAgcDogYm91bmRlZEludCgxLCBBUkdPTjJfTUFYLnBhcmFsbGVsaXNtLCAncGFyYWxsZWxpc20nKSxcbiAgICBzYWx0OiBiYXNlNjRTdHJpbmcsXG4gICAgaXY6IGJhc2U2NFN0cmluZyxcbiAgICBjdDogYmFzZTY0U3RyaW5nLFxuICB9KSxcbiAgdC5wYXJ0aWFsKHtcbiAgICAvKiogQmFzZTY0LWVuY29kZWQgcGVyLWNhbGwgSEtERiBzYWx0IC0tIHByZXNlbnQgb25seSBpbiBzZXNzaW9uLXByb2R1Y2VkIGVudmVsb3BlcyAqL1xuICAgIGhrZGZTYWx0OiBiYXNlNjRTdHJpbmcsXG4gICAgLyoqIEFkZGl0aW9uYWwgYXV0aGVudGljYXRlZCBkYXRhIGZvciBjb250ZXh0IGJpbmRpbmcgKGUuZy4gdHJhbnNhY3Rpb24gaGFzaCArIGRlcml2YXRpb24gcGF0aCkgKi9cbiAgICBhZGF0YTogdC5zdHJpbmcsXG4gIH0pLFxuXSk7XG5cbmV4cG9ydCB0eXBlIFYyRW52ZWxvcGUgPSB0LlR5cGVPZjx0eXBlb2YgVjJFbnZlbG9wZUNvZGVjPjtcblxuLy8gQ3J5cHRvIGhlbHBlcnNcblxuYXN5bmMgZnVuY3Rpb24gYXJnb24ySGFzaChcbiAgcGFzc3dvcmQ6IHN0cmluZyxcbiAgc2FsdDogVWludDhBcnJheSxcbiAgcGFyYW1zOiB7IG1lbW9yeVNpemU6IG51bWJlcjsgaXRlcmF0aW9uczogbnVtYmVyOyBwYXJhbGxlbGlzbTogbnVtYmVyIH1cbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICByZXR1cm4gYXJnb24yaWQoe1xuICAgIHBhc3N3b3JkLFxuICAgIHNhbHQsXG4gICAgbWVtb3J5U2l6ZTogcGFyYW1zLm1lbW9yeVNpemUsXG4gICAgaXRlcmF0aW9uczogcGFyYW1zLml0ZXJhdGlvbnMsXG4gICAgcGFyYWxsZWxpc206IHBhcmFtcy5wYXJhbGxlbGlzbSxcbiAgICBoYXNoTGVuZ3RoOiBBUkdPTjJfREVGQVVMVFMuaGFzaExlbmd0aCxcbiAgICBvdXRwdXRUeXBlOiAnYmluYXJ5JyxcbiAgfSk7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIGFyZ29uMlRvQWVzS2V5KFxuICBwYXNzd29yZDogc3RyaW5nLFxuICBzYWx0OiBVaW50OEFycmF5LFxuICBwYXJhbXM6IHsgbWVtb3J5U2l6ZTogbnVtYmVyOyBpdGVyYXRpb25zOiBudW1iZXI7IHBhcmFsbGVsaXNtOiBudW1iZXIgfVxuKTogUHJvbWlzZTxDcnlwdG9LZXk+IHtcbiAgY29uc3Qga2V5Qnl0ZXMgPSBhd2FpdCBhcmdvbjJIYXNoKHBhc3N3b3JkLCBzYWx0LCBwYXJhbXMpO1xuICByZXR1cm4gc3VidGxlLmltcG9ydEtleSgncmF3Jywga2V5Qnl0ZXMsIHsgbmFtZTogJ0FFUy1HQ00nIH0sIGZhbHNlLCBbJ2VuY3J5cHQnLCAnZGVjcnlwdCddKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGFyZ29uMlRvSGtkZktleShcbiAgcGFzc3dvcmQ6IHN0cmluZyxcbiAgc2FsdDogVWludDhBcnJheSxcbiAgcGFyYW1zOiB7IG1lbW9yeVNpemU6IG51bWJlcjsgaXRlcmF0aW9uczogbnVtYmVyOyBwYXJhbGxlbGlzbTogbnVtYmVyIH1cbik6IFByb21pc2U8Q3J5cHRvS2V5PiB7XG4gIGNvbnN0IGtleUJ5dGVzID0gYXdhaXQgYXJnb24ySGFzaChwYXNzd29yZCwgc2FsdCwgcGFyYW1zKTtcbiAgcmV0dXJuIHN1YnRsZS5pbXBvcnRLZXkoJ3JhdycsIGtleUJ5dGVzLCAnSEtERicsIGZhbHNlLCBbJ2Rlcml2ZUtleSddKTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGhrZGZEZXJpdmVBZXNLZXkoaGtkZktleTogQ3J5cHRvS2V5LCBoa2RmU2FsdDogVWludDhBcnJheSwgdXNhZ2U6IEtleVVzYWdlKTogUHJvbWlzZTxDcnlwdG9LZXk+IHtcbiAgcmV0dXJuIHN1YnRsZS5kZXJpdmVLZXkoXG4gICAgeyBuYW1lOiAnSEtERicsIGhhc2g6ICdTSEEtMjU2Jywgc2FsdDogaGtkZlNhbHQsIGluZm86IEhLREZfSU5GTyB9LFxuICAgIGhrZGZLZXksXG4gICAgeyBuYW1lOiAnQUVTLUdDTScsIGxlbmd0aDogMjU2IH0sXG4gICAgZmFsc2UsXG4gICAgW3VzYWdlXVxuICApO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gYWVzR2NtRW5jcnlwdChcbiAga2V5OiBDcnlwdG9LZXksXG4gIGl2OiBVaW50OEFycmF5LFxuICBwbGFpbnRleHQ6IHN0cmluZyxcbiAgYWRkaXRpb25hbERhdGE/OiBVaW50OEFycmF5XG4pOiBQcm9taXNlPFVpbnQ4QXJyYXk+IHtcbiAgY29uc3QgcGFyYW1zOiBBZXNHY21QYXJhbXMgPSB7IG5hbWU6ICdBRVMtR0NNJywgaXYsIHRhZ0xlbmd0aDogMTI4IH07XG4gIGlmIChhZGRpdGlvbmFsRGF0YSkgcGFyYW1zLmFkZGl0aW9uYWxEYXRhID0gYWRkaXRpb25hbERhdGE7XG4gIGNvbnN0IGN0ID0gYXdhaXQgc3VidGxlLmVuY3J5cHQocGFyYW1zLCBrZXksIG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShwbGFpbnRleHQpKTtcbiAgcmV0dXJuIG5ldyBVaW50OEFycmF5KGN0KTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGFlc0djbURlY3J5cHQoXG4gIGtleTogQ3J5cHRvS2V5LFxuICBpdjogVWludDhBcnJheSxcbiAgY3Q6IFVpbnQ4QXJyYXksXG4gIGFkZGl0aW9uYWxEYXRhPzogVWludDhBcnJheVxuKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgcGFyYW1zOiBBZXNHY21QYXJhbXMgPSB7IG5hbWU6ICdBRVMtR0NNJywgaXYsIHRhZ0xlbmd0aDogMTI4IH07XG4gIGlmIChhZGRpdGlvbmFsRGF0YSkgcGFyYW1zLmFkZGl0aW9uYWxEYXRhID0gYWRkaXRpb25hbERhdGE7XG4gIGNvbnN0IHBsYWludGV4dCA9IGF3YWl0IHN1YnRsZS5kZWNyeXB0KHBhcmFtcywga2V5LCBjdCk7XG4gIHJldHVybiBuZXcgVGV4dERlY29kZXIoKS5kZWNvZGUocGxhaW50ZXh0KTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHBhcnNlVjJFbnZlbG9wZShjaXBoZXJ0ZXh0OiBzdHJpbmcpOiBWMkVudmVsb3BlIHtcbiAgbGV0IHBhcnNlZDogdW5rbm93bjtcbiAgdHJ5IHtcbiAgICBwYXJzZWQgPSBKU09OLnBhcnNlKGNpcGhlcnRleHQpO1xuICB9IGNhdGNoIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ3YyIGRlY3J5cHQ6IGludmFsaWQgSlNPTiBlbnZlbG9wZScpO1xuICB9XG4gIHJldHVybiBkZWNvZGVXaXRoQ29kZWMoVjJFbnZlbG9wZUNvZGVjLCBwYXJzZWQsICd2MiBkZWNyeXB0OiBpbnZhbGlkIGVudmVsb3BlJyk7XG59XG5cbi8vIFB1YmxpYyBBUElcblxuLyoqXG4gKiBFbmNyeXB0IHBsYWludGV4dCB1c2luZyBBcmdvbjJpZCBLREYgKyBBRVMtMjU2LUdDTS5cbiAqXG4gKiBSZXR1cm5zIGEgc2VsZi1kZXNjcmliaW5nIEpTT04gdjIgZW52ZWxvcGUgY29udGFpbmluZyBhbGwgQXJnb24yaWQgcGFyYW1ldGVycyxcbiAqIHNhbHQsIElWLCBhbmQgY2lwaGVydGV4dCAtLSBmdWxseSBzdGFuZGFsb25lIGZvciBkZWNyeXB0aW9uLlxuICpcbiAqIEZvciBtdWx0aS1jYWxsIG9wZXJhdGlvbnMgKE1QQyBzaWduaW5nLCB3YWxsZXQgY3JlYXRpb24pLCBwcmVmZXJcbiAqIGNyZWF0ZUVuY3J5cHRpb25TZXNzaW9uIHRvIHJ1biBBcmdvbjJpZCBvbmNlIGFuZCBkZXJpdmUgcGVyLWNhbGwga2V5cyB2aWEgSEtERi5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGVuY3J5cHRWMihcbiAgcGFzc3dvcmQ6IHN0cmluZyxcbiAgcGxhaW50ZXh0OiBzdHJpbmcsXG4gIG9wdGlvbnM/OiB7XG4gICAgc2FsdD86IFVpbnQ4QXJyYXk7XG4gICAgaXY/OiBVaW50OEFycmF5O1xuICAgIG1lbW9yeVNpemU/OiBudW1iZXI7XG4gICAgaXRlcmF0aW9ucz86IG51bWJlcjtcbiAgICBwYXJhbGxlbGlzbT86IG51bWJlcjtcbiAgICBhZGF0YT86IHN0cmluZztcbiAgfVxuKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgbWVtb3J5U2l6ZSA9IG9wdGlvbnM/Lm1lbW9yeVNpemUgPz8gQVJHT04yX0RFRkFVTFRTLm1lbW9yeVNpemU7XG4gIGNvbnN0IGl0ZXJhdGlvbnMgPSBvcHRpb25zPy5pdGVyYXRpb25zID8/IEFSR09OMl9ERUZBVUxUUy5pdGVyYXRpb25zO1xuICBjb25zdCBwYXJhbGxlbGlzbSA9IG9wdGlvbnM/LnBhcmFsbGVsaXNtID8/IEFSR09OMl9ERUZBVUxUUy5wYXJhbGxlbGlzbTtcblxuICBjb25zdCBzYWx0ID0gb3B0aW9ucz8uc2FsdCA/PyBuZXcgVWludDhBcnJheShyYW5kb21CeXRlcyhBUkdPTjJfREVGQVVMVFMuc2FsdExlbmd0aCkpO1xuICBpZiAoc2FsdC5sZW5ndGggIT09IEFSR09OMl9ERUZBVUxUUy5zYWx0TGVuZ3RoKSB0aHJvdyBuZXcgRXJyb3IoYHNhbHQgbXVzdCBiZSAke0FSR09OMl9ERUZBVUxUUy5zYWx0TGVuZ3RofSBieXRlc2ApO1xuXG4gIGNvbnN0IGl2ID0gb3B0aW9ucz8uaXYgPz8gbmV3IFVpbnQ4QXJyYXkocmFuZG9tQnl0ZXMoR0NNX0lWX0xFTkdUSCkpO1xuICBpZiAoaXYubGVuZ3RoICE9PSBHQ01fSVZfTEVOR1RIKSB0aHJvdyBuZXcgRXJyb3IoYGl2IG11c3QgYmUgJHtHQ01fSVZfTEVOR1RIfSBieXRlc2ApO1xuXG4gIGNvbnN0IGFkYXRhQnl0ZXMgPSBvcHRpb25zPy5hZGF0YSA/IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShvcHRpb25zLmFkYXRhKSA6IHVuZGVmaW5lZDtcbiAgY29uc3Qga2V5ID0gYXdhaXQgYXJnb24yVG9BZXNLZXkocGFzc3dvcmQsIHNhbHQsIHsgbWVtb3J5U2l6ZSwgaXRlcmF0aW9ucywgcGFyYWxsZWxpc20gfSk7XG4gIGNvbnN0IGN0ID0gYXdhaXQgYWVzR2NtRW5jcnlwdChrZXksIGl2LCBwbGFpbnRleHQsIGFkYXRhQnl0ZXMpO1xuXG4gIGNvbnN0IGVudmVsb3BlOiBWMkVudmVsb3BlID0ge1xuICAgIHY6IDIsXG4gICAgbTogbWVtb3J5U2l6ZSxcbiAgICB0OiBpdGVyYXRpb25zLFxuICAgIHA6IHBhcmFsbGVsaXNtLFxuICAgIHNhbHQ6IEJ1ZmZlci5mcm9tKHNhbHQpLnRvU3RyaW5nKCdiYXNlNjQnKSxcbiAgICBpdjogQnVmZmVyLmZyb20oaXYpLnRvU3RyaW5nKCdiYXNlNjQnKSxcbiAgICBjdDogQnVmZmVyLmZyb20oY3QpLnRvU3RyaW5nKCdiYXNlNjQnKSxcbiAgfTtcbiAgaWYgKG9wdGlvbnM/LmFkYXRhKSBlbnZlbG9wZS5hZGF0YSA9IG9wdGlvbnMuYWRhdGE7XG4gIHJldHVybiBKU09OLnN0cmluZ2lmeShlbnZlbG9wZSk7XG59XG5cbi8qKlxuICogRGVjcnlwdCBhIHYyIGVudmVsb3BlIChBcmdvbjJpZCArIEFFUy0yNTYtR0NNKS5cbiAqXG4gKiBIYW5kbGVzIGJvdGggZW52ZWxvcGUgdHlwZXMgYXV0b21hdGljYWxseTpcbiAqICAgLSBTdGFuZGFyZCAgKG5vIGhrZGZTYWx0KTogQXJnb24yaWQgLT4gQUVTLUdDTVxuICogICAtIFNlc3Npb24gICAoaGtkZlNhbHQgcHJlc2VudCk6IEFyZ29uMmlkIC0+IEhLREYgLT4gQUVTLUdDTVxuICpcbiAqIEFsbCBwYXJhbWV0ZXJzIGFyZSBzdG9yZWQgaW4gdGhlIGVudmVsb3BlIC0tIG5vIHNlc3Npb24gY29udGV4dCByZXF1aXJlZC5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlY3J5cHRWMihwYXNzd29yZDogc3RyaW5nLCBjaXBoZXJ0ZXh0OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCBlbnZlbG9wZSA9IHBhcnNlVjJFbnZlbG9wZShjaXBoZXJ0ZXh0KTtcbiAgY29uc3Qgc2FsdCA9IG5ldyBVaW50OEFycmF5KEJ1ZmZlci5mcm9tKGVudmVsb3BlLnNhbHQsICdiYXNlNjQnKSk7XG4gIGNvbnN0IGl2ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuaXYsICdiYXNlNjQnKSk7XG4gIGNvbnN0IGN0ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuY3QsICdiYXNlNjQnKSk7XG4gIGNvbnN0IHBhcmFtcyA9IHsgbWVtb3J5U2l6ZTogZW52ZWxvcGUubSwgaXRlcmF0aW9uczogZW52ZWxvcGUudCwgcGFyYWxsZWxpc206IGVudmVsb3BlLnAgfTtcbiAgY29uc3QgYWRhdGFCeXRlcyA9IGVudmVsb3BlLmFkYXRhID8gbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKGVudmVsb3BlLmFkYXRhKSA6IHVuZGVmaW5lZDtcblxuICBpZiAoZW52ZWxvcGUuaGtkZlNhbHQpIHtcbiAgICBjb25zdCBoa2RmS2V5ID0gYXdhaXQgYXJnb24yVG9Ia2RmS2V5KHBhc3N3b3JkLCBzYWx0LCBwYXJhbXMpO1xuICAgIGNvbnN0IGhrZGZTYWx0ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuaGtkZlNhbHQsICdiYXNlNjQnKSk7XG4gICAgY29uc3QgYWVzS2V5ID0gYXdhaXQgaGtkZkRlcml2ZUFlc0tleShoa2RmS2V5LCBoa2RmU2FsdCwgJ2RlY3J5cHQnKTtcbiAgICByZXR1cm4gYWVzR2NtRGVjcnlwdChhZXNLZXksIGl2LCBjdCwgYWRhdGFCeXRlcyk7XG4gIH1cblxuICBjb25zdCBrZXkgPSBhd2FpdCBhcmdvbjJUb0Flc0tleShwYXNzd29yZCwgc2FsdCwgcGFyYW1zKTtcbiAgcmV0dXJuIGFlc0djbURlY3J5cHQoa2V5LCBpdiwgY3QsIGFkYXRhQnl0ZXMpO1xufVxuIl19

package/dist/src/encryptionSession.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Runs Argon2id once on creation, then derives per-call AES-256-GCM keys via HKDF.
+ * Use when encrypting or decrypting multiple values with the same password.
+ *
+ * Session envelopes are self-describing and can be decrypted standalone via decryptV2.
+ * Call destroy() when done to clear the cached key from memory.
+ */
+export declare class EncryptionSession {
+    private hkdfKey;
+    private argon2SaltB64;
+    private readonly memorySize;
+    private readonly iterations;
+    private readonly parallelism;
+    /** Use createEncryptionSession() instead of calling this directly. */
+    constructor(hkdfKey: CryptoKey, argon2SaltB64: string, params: {
+        memorySize: number;
+        iterations: number;
+        parallelism: number;
+    });
+    encrypt(plaintext: string, adata?: string): Promise<string>;
+    decrypt(ciphertext: string): Promise<string>;
+    destroy(): void;
+    private getKeyOrThrow;
+    private getSaltOrThrow;
+    private buildEnvelope;
+}
+/** Create an EncryptionSession. Runs Argon2id once; all subsequent calls derive keys via HKDF. */
+export declare function createEncryptionSession(password: string, options?: {
+    memorySize?: number;
+    iterations?: number;
+    parallelism?: number;
+    salt?: Uint8Array;
+}): Promise<EncryptionSession>;
+//# sourceMappingURL=encryptionSession.d.ts.map

package/dist/src/encryptionSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptionSession.d.ts","sourceRoot":"","sources":["../../src/encryptionSession.ts"],"names":[],"mappings":"AAcA;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,sEAAsE;gBAEpE,OAAO,EAAE,SAAS,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IASnE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAY3D,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBlD,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;CAYtB;AAED,kGAAkG;AAClG,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAA;CAAE,GAC9F,OAAO,CAAC,iBAAiB,CAAC,CAe5B"}

package/dist/src/encryptionSession.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionSession = void 0;
+exports.createEncryptionSession = createEncryptionSession;
+const crypto_1 = require("crypto");
+const encryptV2_1 = require("./encryptV2");
+/**
+ * Runs Argon2id once on creation, then derives per-call AES-256-GCM keys via HKDF.
+ * Use when encrypting or decrypting multiple values with the same password.
+ *
+ * Session envelopes are self-describing and can be decrypted standalone via decryptV2.
+ * Call destroy() when done to clear the cached key from memory.
+ */
+class EncryptionSession {
+    /** Use createEncryptionSession() instead of calling this directly. */
+    constructor(hkdfKey, argon2SaltB64, params) {
+        this.hkdfKey = hkdfKey;
+        this.argon2SaltB64 = argon2SaltB64;
+        this.memorySize = params.memorySize;
+        this.iterations = params.iterations;
+        this.parallelism = params.parallelism;
+    }
+    async encrypt(plaintext, adata) {
+        const key = this.getKeyOrThrow();
+        const hkdfSalt = new Uint8Array((0, crypto_1.randomBytes)(encryptV2_1.HKDF_SALT_LENGTH));
+        const iv = new Uint8Array((0, crypto_1.randomBytes)(encryptV2_1.GCM_IV_LENGTH));
+        const adataBytes = adata ? new TextEncoder().encode(adata) : undefined;
+        const aesKey = await (0, encryptV2_1.hkdfDeriveAesKey)(key, hkdfSalt, 'encrypt');
+        const ct = await (0, encryptV2_1.aesGcmEncrypt)(aesKey, iv, plaintext, adataBytes);
+        const envelope = this.buildEnvelope(hkdfSalt, iv, ct);
+        if (adata)
+            envelope.adata = adata;
+        return JSON.stringify(envelope);
+    }
+    async decrypt(ciphertext) {
+        const key = this.getKeyOrThrow();
+        const envelope = (0, encryptV2_1.parseV2Envelope)(ciphertext);
+        if (!envelope.hkdfSalt) {
+            throw new Error('envelope was not encrypted with a session; use decryptV2 instead');
+        }
+        if (envelope.salt !== this.getSaltOrThrow()) {
+            throw new Error('envelope was not encrypted with this session');
+        }
+        const iv = new Uint8Array(Buffer.from(envelope.iv, 'base64'));
+        const ct = new Uint8Array(Buffer.from(envelope.ct, 'base64'));
+        const hkdfSalt = new Uint8Array(Buffer.from(envelope.hkdfSalt, 'base64'));
+        const adataBytes = envelope.adata ? new TextEncoder().encode(envelope.adata) : undefined;
+        const aesKey = await (0, encryptV2_1.hkdfDeriveAesKey)(key, hkdfSalt, 'decrypt');
+        return (0, encryptV2_1.aesGcmDecrypt)(aesKey, iv, ct, adataBytes);
+    }
+    destroy() {
+        this.hkdfKey = null;
+        this.argon2SaltB64 = null;
+    }
+    getKeyOrThrow() {
+        if (this.hkdfKey === null || this.argon2SaltB64 === null) {
+            throw new Error('EncryptionSession has been destroyed');
+        }
+        return this.hkdfKey;
+    }
+    getSaltOrThrow() {
+        if (this.argon2SaltB64 === null) {
+            throw new Error('EncryptionSession has been destroyed');
+        }
+        return this.argon2SaltB64;
+    }
+    buildEnvelope(hkdfSalt, iv, ct) {
+        return {
+            v: 2,
+            m: this.memorySize,
+            t: this.iterations,
+            p: this.parallelism,
+            salt: this.getSaltOrThrow(),
+            hkdfSalt: Buffer.from(hkdfSalt).toString('base64'),
+            iv: Buffer.from(iv).toString('base64'),
+            ct: Buffer.from(ct).toString('base64'),
+        };
+    }
+}
+exports.EncryptionSession = EncryptionSession;
+/** Create an EncryptionSession. Runs Argon2id once; all subsequent calls derive keys via HKDF. */
+async function createEncryptionSession(password, options) {
+    const memorySize = options?.memorySize ?? encryptV2_1.ARGON2_DEFAULTS.memorySize;
+    const iterations = options?.iterations ?? encryptV2_1.ARGON2_DEFAULTS.iterations;
+    const parallelism = options?.parallelism ?? encryptV2_1.ARGON2_DEFAULTS.parallelism;
+    const params = { memorySize, iterations, parallelism };
+    const argon2Salt = options?.salt ?? new Uint8Array((0, crypto_1.randomBytes)(encryptV2_1.ARGON2_DEFAULTS.saltLength));
+    if (argon2Salt.length !== encryptV2_1.ARGON2_DEFAULTS.saltLength) {
+        throw new Error(`salt must be ${encryptV2_1.ARGON2_DEFAULTS.saltLength} bytes`);
+    }
+    const hkdfKey = await (0, encryptV2_1.argon2ToHkdfKey)(password, argon2Salt, params);
+    const argon2SaltB64 = Buffer.from(argon2Salt).toString('base64');
+    return new EncryptionSession(hkdfKey, argon2SaltB64, params);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvblNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZW5jcnlwdGlvblNlc3Npb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBdUdBLDBEQWtCQztBQXpIRCxtQ0FBcUM7QUFFckMsMkNBVXFCO0FBRXJCOzs7Ozs7R0FNRztBQUNILE1BQWEsaUJBQWlCO0lBTTVCLHNFQUFzRTtJQUN0RSxZQUNFLE9BQWtCLEVBQ2xCLGFBQXFCLEVBQ3JCLE1BQXVFO1FBRXZFLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxhQUFhLEdBQUcsYUFBYSxDQUFDO1FBQ25DLElBQUksQ0FBQyxVQUFVLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQztRQUNwQyxJQUFJLENBQUMsVUFBVSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7UUFDcEMsSUFBSSxDQUFDLFdBQVcsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDO0lBQ3hDLENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQWlCLEVBQUUsS0FBYztRQUM3QyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDakMsTUFBTSxRQUFRLEdBQUcsSUFBSSxVQUFVLENBQUMsSUFBQSxvQkFBVyxFQUFDLDRCQUFnQixDQUFDLENBQUMsQ0FBQztRQUMvRCxNQUFNLEVBQUUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxJQUFBLG9CQUFXLEVBQUMseUJBQWEsQ0FBQyxDQUFDLENBQUM7UUFDdEQsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBQSw0QkFBZ0IsRUFBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2hFLE1BQU0sRUFBRSxHQUFHLE1BQU0sSUFBQSx5QkFBYSxFQUFDLE1BQU0sRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN0RCxJQUFJLEtBQUs7WUFBRSxRQUFRLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNsQyxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUVELEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBa0I7UUFDOUIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sUUFBUSxHQUFHLElBQUEsMkJBQWUsRUFBQyxVQUFVLENBQUMsQ0FBQztRQUM3QyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0VBQWtFLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxjQUFjLEVBQUUsRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsTUFBTSxFQUFFLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDOUQsTUFBTSxFQUFFLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDOUQsTUFBTSxRQUFRLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDMUUsTUFBTSxVQUFVLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDekYsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFBLDRCQUFnQixFQUFDLEdBQUcsRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDaEUsT0FBTyxJQUFBLHlCQUFhLEVBQUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVELE9BQU87UUFDTCxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztRQUNwQixJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztJQUM1QixDQUFDO0lBRU8sYUFBYTtRQUNuQixJQUFJLElBQUksQ0FBQyxPQUFPLEtBQUssSUFBSSxJQUFJLElBQUksQ0FBQyxhQUFhLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDekQsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUM7SUFDdEIsQ0FBQztJQUVPLGNBQWM7UUFDcEIsSUFBSSxJQUFJLENBQUMsYUFBYSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsYUFBYSxDQUFDO0lBQzVCLENBQUM7SUFFTyxhQUFhLENBQUMsUUFBb0IsRUFBRSxFQUFjLEVBQUUsRUFBYztRQUN4RSxPQUFPO1lBQ0wsQ0FBQyxFQUFFLENBQUM7WUFDSixDQUFDLEVBQUUsSUFBSSxDQUFDLFVBQVU7WUFDbEIsQ0FBQyxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQ2xCLENBQUMsRUFBRSxJQUFJLENBQUMsV0FBVztZQUNuQixJQUFJLEVBQUUsSUFBSSxDQUFDLGNBQWMsRUFBRTtZQUMzQixRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQ2xELEVBQUUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7WUFDdEMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztTQUN2QyxDQUFDO0lBQ0osQ0FBQztDQUNGO0FBL0VELDhDQStFQztBQUVELGtHQUFrRztBQUMzRixLQUFLLFVBQVUsdUJBQXVCLENBQzNDLFFBQWdCLEVBQ2hCLE9BQStGO0lBRS9GLE1BQU0sVUFBVSxHQUFHLE9BQU8sRUFBRSxVQUFVLElBQUksMkJBQWUsQ0FBQyxVQUFVLENBQUM7SUFDckUsTUFBTSxVQUFVLEdBQUcsT0FBTyxFQUFFLFVBQVUsSUFBSSwyQkFBZSxDQUFDLFVBQVUsQ0FBQztJQUNyRSxNQUFNLFdBQVcsR0FBRyxPQUFPLEVBQUUsV0FBVyxJQUFJLDJCQUFlLENBQUMsV0FBVyxDQUFDO0lBQ3hFLE1BQU0sTUFBTSxHQUFHLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsQ0FBQztJQUV2RCxNQUFNLFVBQVUsR0FBRyxPQUFPLEVBQUUsSUFBSSxJQUFJLElBQUksVUFBVSxDQUFDLElBQUEsb0JBQVcsRUFBQywyQkFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDNUYsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLDJCQUFlLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDckQsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsMkJBQWUsQ0FBQyxVQUFVLFFBQVEsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEsMkJBQWUsRUFBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3BFLE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRWpFLE9BQU8sSUFBSSxpQkFBaUIsQ0FBQyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0FBQy9ELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByYW5kb21CeXRlcyB9IGZyb20gJ2NyeXB0byc7XG5cbmltcG9ydCB7XG4gIGFlc0djbURlY3J5cHQsXG4gIGFlc0djbUVuY3J5cHQsXG4gIEFSR09OMl9ERUZBVUxUUyxcbiAgYXJnb24yVG9Ia2RmS2V5LFxuICBHQ01fSVZfTEVOR1RILFxuICBoa2RmRGVyaXZlQWVzS2V5LFxuICBIS0RGX1NBTFRfTEVOR1RILFxuICBwYXJzZVYyRW52ZWxvcGUsXG4gIFYyRW52ZWxvcGUsXG59IGZyb20gJy4vZW5jcnlwdFYyJztcblxuLyoqXG4gKiBSdW5zIEFyZ29uMmlkIG9uY2Ugb24gY3JlYXRpb24sIHRoZW4gZGVyaXZlcyBwZXItY2FsbCBBRVMtMjU2LUdDTSBrZXlzIHZpYSBIS0RGLlxuICogVXNlIHdoZW4gZW5jcnlwdGluZyBvciBkZWNyeXB0aW5nIG11bHRpcGxlIHZhbHVlcyB3aXRoIHRoZSBzYW1lIHBhc3N3b3JkLlxuICpcbiAqIFNlc3Npb24gZW52ZWxvcGVzIGFyZSBzZWxmLWRlc2NyaWJpbmcgYW5kIGNhbiBiZSBkZWNyeXB0ZWQgc3RhbmRhbG9uZSB2aWEgZGVjcnlwdFYyLlxuICogQ2FsbCBkZXN0cm95KCkgd2hlbiBkb25lIHRvIGNsZWFyIHRoZSBjYWNoZWQga2V5IGZyb20gbWVtb3J5LlxuICovXG5leHBvcnQgY2xhc3MgRW5jcnlwdGlvblNlc3Npb24ge1xuICBwcml2YXRlIGhrZGZLZXk6IENyeXB0b0tleSB8IG51bGw7XG4gIHByaXZhdGUgYXJnb24yU2FsdEI2NDogc3RyaW5nIHwgbnVsbDtcbiAgcHJpdmF0ZSByZWFkb25seSBtZW1vcnlTaXplOiBudW1iZXI7XG4gIHByaXZhdGUgcmVhZG9ubHkgaXRlcmF0aW9uczogbnVtYmVyO1xuICBwcml2YXRlIHJlYWRvbmx5IHBhcmFsbGVsaXNtOiBudW1iZXI7XG4gIC8qKiBVc2UgY3JlYXRlRW5jcnlwdGlvblNlc3Npb24oKSBpbnN0ZWFkIG9mIGNhbGxpbmcgdGhpcyBkaXJlY3RseS4gKi9cbiAgY29uc3RydWN0b3IoXG4gICAgaGtkZktleTogQ3J5cHRvS2V5LFxuICAgIGFyZ29uMlNhbHRCNjQ6IHN0cmluZyxcbiAgICBwYXJhbXM6IHsgbWVtb3J5U2l6ZTogbnVtYmVyOyBpdGVyYXRpb25zOiBudW1iZXI7IHBhcmFsbGVsaXNtOiBudW1iZXIgfVxuICApIHtcbiAgICB0aGlzLmhrZGZLZXkgPSBoa2RmS2V5O1xuICAgIHRoaXMuYXJnb24yU2FsdEI2NCA9IGFyZ29uMlNhbHRCNjQ7XG4gICAgdGhpcy5tZW1vcnlTaXplID0gcGFyYW1zLm1lbW9yeVNpemU7XG4gICAgdGhpcy5pdGVyYXRpb25zID0gcGFyYW1zLml0ZXJhdGlvbnM7XG4gICAgdGhpcy5wYXJhbGxlbGlzbSA9IHBhcmFtcy5wYXJhbGxlbGlzbTtcbiAgfVxuXG4gIGFzeW5jIGVuY3J5cHQocGxhaW50ZXh0OiBzdHJpbmcsIGFkYXRhPzogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgICBjb25zdCBrZXkgPSB0aGlzLmdldEtleU9yVGhyb3coKTtcbiAgICBjb25zdCBoa2RmU2FsdCA9IG5ldyBVaW50OEFycmF5KHJhbmRvbUJ5dGVzKEhLREZfU0FMVF9MRU5HVEgpKTtcbiAgICBjb25zdCBpdiA9IG5ldyBVaW50OEFycmF5KHJhbmRvbUJ5dGVzKEdDTV9JVl9MRU5HVEgpKTtcbiAgICBjb25zdCBhZGF0YUJ5dGVzID0gYWRhdGEgPyBuZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUoYWRhdGEpIDogdW5kZWZpbmVkO1xuICAgIGNvbnN0IGFlc0tleSA9IGF3YWl0IGhrZGZEZXJpdmVBZXNLZXkoa2V5LCBoa2RmU2FsdCwgJ2VuY3J5cHQnKTtcbiAgICBjb25zdCBjdCA9IGF3YWl0IGFlc0djbUVuY3J5cHQoYWVzS2V5LCBpdiwgcGxhaW50ZXh0LCBhZGF0YUJ5dGVzKTtcbiAgICBjb25zdCBlbnZlbG9wZSA9IHRoaXMuYnVpbGRFbnZlbG9wZShoa2RmU2FsdCwgaXYsIGN0KTtcbiAgICBpZiAoYWRhdGEpIGVudmVsb3BlLmFkYXRhID0gYWRhdGE7XG4gICAgcmV0dXJuIEpTT04uc3RyaW5naWZ5KGVudmVsb3BlKTtcbiAgfVxuXG4gIGFzeW5jIGRlY3J5cHQoY2lwaGVydGV4dDogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgICBjb25zdCBrZXkgPSB0aGlzLmdldEtleU9yVGhyb3coKTtcbiAgICBjb25zdCBlbnZlbG9wZSA9IHBhcnNlVjJFbnZlbG9wZShjaXBoZXJ0ZXh0KTtcbiAgICBpZiAoIWVudmVsb3BlLmhrZGZTYWx0KSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2VudmVsb3BlIHdhcyBub3QgZW5jcnlwdGVkIHdpdGggYSBzZXNzaW9uOyB1c2UgZGVjcnlwdFYyIGluc3RlYWQnKTtcbiAgICB9XG4gICAgaWYgKGVudmVsb3BlLnNhbHQgIT09IHRoaXMuZ2V0U2FsdE9yVGhyb3coKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdlbnZlbG9wZSB3YXMgbm90IGVuY3J5cHRlZCB3aXRoIHRoaXMgc2Vzc2lvbicpO1xuICAgIH1cbiAgICBjb25zdCBpdiA9IG5ldyBVaW50OEFycmF5KEJ1ZmZlci5mcm9tKGVudmVsb3BlLml2LCAnYmFzZTY0JykpO1xuICAgIGNvbnN0IGN0ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuY3QsICdiYXNlNjQnKSk7XG4gICAgY29uc3QgaGtkZlNhbHQgPSBuZXcgVWludDhBcnJheShCdWZmZXIuZnJvbShlbnZlbG9wZS5oa2RmU2FsdCwgJ2Jhc2U2NCcpKTtcbiAgICBjb25zdCBhZGF0YUJ5dGVzID0gZW52ZWxvcGUuYWRhdGEgPyBuZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUoZW52ZWxvcGUuYWRhdGEpIDogdW5kZWZpbmVkO1xuICAgIGNvbnN0IGFlc0tleSA9IGF3YWl0IGhrZGZEZXJpdmVBZXNLZXkoa2V5LCBoa2RmU2FsdCwgJ2RlY3J5cHQnKTtcbiAgICByZXR1cm4gYWVzR2NtRGVjcnlwdChhZXNLZXksIGl2LCBjdCwgYWRhdGFCeXRlcyk7XG4gIH1cblxuICBkZXN0cm95KCk6IHZvaWQge1xuICAgIHRoaXMuaGtkZktleSA9IG51bGw7XG4gICAgdGhpcy5hcmdvbjJTYWx0QjY0ID0gbnVsbDtcbiAgfVxuXG4gIHByaXZhdGUgZ2V0S2V5T3JUaHJvdygpOiBDcnlwdG9LZXkge1xuICAgIGlmICh0aGlzLmhrZGZLZXkgPT09IG51bGwgfHwgdGhpcy5hcmdvbjJTYWx0QjY0ID09PSBudWxsKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0VuY3J5cHRpb25TZXNzaW9uIGhhcyBiZWVuIGRlc3Ryb3llZCcpO1xuICAgIH1cbiAgICByZXR1cm4gdGhpcy5oa2RmS2V5O1xuICB9XG5cbiAgcHJpdmF0ZSBnZXRTYWx0T3JUaHJvdygpOiBzdHJpbmcge1xuICAgIGlmICh0aGlzLmFyZ29uMlNhbHRCNjQgPT09IG51bGwpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignRW5jcnlwdGlvblNlc3Npb24gaGFzIGJlZW4gZGVzdHJveWVkJyk7XG4gICAgfVxuICAgIHJldHVybiB0aGlzLmFyZ29uMlNhbHRCNjQ7XG4gIH1cblxuICBwcml2YXRlIGJ1aWxkRW52ZWxvcGUoaGtkZlNhbHQ6IFVpbnQ4QXJyYXksIGl2OiBVaW50OEFycmF5LCBjdDogVWludDhBcnJheSk6IFYyRW52ZWxvcGUge1xuICAgIHJldHVybiB7XG4gICAgICB2OiAyLFxuICAgICAgbTogdGhpcy5tZW1vcnlTaXplLFxuICAgICAgdDogdGhpcy5pdGVyYXRpb25zLFxuICAgICAgcDogdGhpcy5wYXJhbGxlbGlzbSxcbiAgICAgIHNhbHQ6IHRoaXMuZ2V0U2FsdE9yVGhyb3coKSxcbiAgICAgIGhrZGZTYWx0OiBCdWZmZXIuZnJvbShoa2RmU2FsdCkudG9TdHJpbmcoJ2Jhc2U2NCcpLFxuICAgICAgaXY6IEJ1ZmZlci5mcm9tKGl2KS50b1N0cmluZygnYmFzZTY0JyksXG4gICAgICBjdDogQnVmZmVyLmZyb20oY3QpLnRvU3RyaW5nKCdiYXNlNjQnKSxcbiAgICB9O1xuICB9XG59XG5cbi8qKiBDcmVhdGUgYW4gRW5jcnlwdGlvblNlc3Npb24uIFJ1bnMgQXJnb24yaWQgb25jZTsgYWxsIHN1YnNlcXVlbnQgY2FsbHMgZGVyaXZlIGtleXMgdmlhIEhLREYuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY3JlYXRlRW5jcnlwdGlvblNlc3Npb24oXG4gIHBhc3N3b3JkOiBzdHJpbmcsXG4gIG9wdGlvbnM/OiB7IG1lbW9yeVNpemU/OiBudW1iZXI7IGl0ZXJhdGlvbnM/OiBudW1iZXI7IHBhcmFsbGVsaXNtPzogbnVtYmVyOyBzYWx0PzogVWludDhBcnJheSB9XG4pOiBQcm9taXNlPEVuY3J5cHRpb25TZXNzaW9uPiB7XG4gIGNvbnN0IG1lbW9yeVNpemUgPSBvcHRpb25zPy5tZW1vcnlTaXplID8/IEFSR09OMl9ERUZBVUxUUy5tZW1vcnlTaXplO1xuICBjb25zdCBpdGVyYXRpb25zID0gb3B0aW9ucz8uaXRlcmF0aW9ucyA/PyBBUkdPTjJfREVGQVVMVFMuaXRlcmF0aW9ucztcbiAgY29uc3QgcGFyYWxsZWxpc20gPSBvcHRpb25zPy5wYXJhbGxlbGlzbSA/PyBBUkdPTjJfREVGQVVMVFMucGFyYWxsZWxpc207XG4gIGNvbnN0IHBhcmFtcyA9IHsgbWVtb3J5U2l6ZSwgaXRlcmF0aW9ucywgcGFyYWxsZWxpc20gfTtcblxuICBjb25zdCBhcmdvbjJTYWx0ID0gb3B0aW9ucz8uc2FsdCA/PyBuZXcgVWludDhBcnJheShyYW5kb21CeXRlcyhBUkdPTjJfREVGQVVMVFMuc2FsdExlbmd0aCkpO1xuICBpZiAoYXJnb24yU2FsdC5sZW5ndGggIT09IEFSR09OMl9ERUZBVUxUUy5zYWx0TGVuZ3RoKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBzYWx0IG11c3QgYmUgJHtBUkdPTjJfREVGQVVMVFMuc2FsdExlbmd0aH0gYnl0ZXNgKTtcbiAgfVxuXG4gIGNvbnN0IGhrZGZLZXkgPSBhd2FpdCBhcmdvbjJUb0hrZGZLZXkocGFzc3dvcmQsIGFyZ29uMlNhbHQsIHBhcmFtcyk7XG4gIGNvbnN0IGFyZ29uMlNhbHRCNjQgPSBCdWZmZXIuZnJvbShhcmdvbjJTYWx0KS50b1N0cmluZygnYmFzZTY0Jyk7XG5cbiAgcmV0dXJuIG5ldyBFbmNyeXB0aW9uU2Vzc2lvbihoa2RmS2V5LCBhcmdvbjJTYWx0QjY0LCBwYXJhbXMpO1xufVxuIl19

package/dist/src/index.d.ts

@@ -1,6 +1,9 @@
 export * from './api';
 export * from './bitgoAPI';
+export * from './decryptV1';
 export * from './encrypt';
+export * from './encryptionSession';
+export * from './encryptV2';
 export * from './util';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC"}

package/dist/src/index.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
@@ -12,7 +16,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./api"), exports);
 __exportStar(require("./bitgoAPI"), exports);
+__exportStar(require("./decryptV1"), exports);
 __exportStar(require("./encrypt"), exports);
+__exportStar(require("./encryptionSession"), exports);
+__exportStar(require("./encryptV2"), exports);
 __exportStar(require("./util"), exports);
 __exportStar(require("./types"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7O0FBQUEsd0NBQXNCO0FBQ3RCLDZDQUEyQjtBQUMzQiw0Q0FBMEI7QUFDMUIseUNBQXVCO0FBQ3ZCLDBDQUF3QiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXBpJztcbmV4cG9ydCAqIGZyb20gJy4vYml0Z29BUEknO1xuZXhwb3J0ICogZnJvbSAnLi9lbmNyeXB0JztcbmV4cG9ydCAqIGZyb20gJy4vdXRpbCc7XG5leHBvcnQgKiBmcm9tICcuL3R5cGVzJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHdDQUFzQjtBQUN0Qiw2Q0FBMkI7QUFDM0IsOENBQTRCO0FBQzVCLDRDQUEwQjtBQUMxQixzREFBb0M7QUFDcEMsOENBQTRCO0FBQzVCLHlDQUF1QjtBQUN2QiwwQ0FBd0IiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2FwaSc7XG5leHBvcnQgKiBmcm9tICcuL2JpdGdvQVBJJztcbmV4cG9ydCAqIGZyb20gJy4vZGVjcnlwdFYxJztcbmV4cG9ydCAqIGZyb20gJy4vZW5jcnlwdCc7XG5leHBvcnQgKiBmcm9tICcuL2VuY3J5cHRpb25TZXNzaW9uJztcbmV4cG9ydCAqIGZyb20gJy4vZW5jcnlwdFYyJztcbmV4cG9ydCAqIGZyb20gJy4vdXRpbCc7XG5leHBvcnQgKiBmcm9tICcuL3R5cGVzJztcbiJdfQ==

package/dist/src/types.d.ts

@@ -1,8 +1,23 @@
-import { EnvironmentName, IRequestTracer, V1Network } from '@bitgo-beta/sdk-core';
+import { EncryptionVersion, EnvironmentName, IRequestTracer, V1Network } from '@bitgo-beta/sdk-core';
 import { ECPairInterface } from '@bitgo-beta/utxo-lib';
+import { type Agent } from 'http';
+export type Constants = Record<string, any>;
+declare const patchedRequestMethods: readonly ["get", "post", "put", "del", "patch", "options"];
+export type RequestMethods = (typeof patchedRequestMethods)[number];
+export type AdditionalHeadersCallback = (method: RequestMethods, url: string, data?: string) => Array<{
+    key: string;
+    value: string;
+}>;
+export { AuthVersion, CalculateHmacSubjectOptions, CalculateRequestHeadersOptions, CalculateRequestHmacOptions, IHmacAuthStrategy, RequestHeaders, supportedRequestMethods, VerifyResponseInfo, VerifyResponseOptions, } from '@bitgo-beta/sdk-hmac';
+import type { IHmacAuthStrategy } from '@bitgo-beta/sdk-hmac';
 export interface BitGoAPIOptions {
     accessToken?: string;
     authVersion?: 2 | 3;
+    hmacAuthStrategy?: IHmacAuthStrategy;
+    clientConstants?: Record<string, any> | {
+        constants: Record<string, any>;
+        ttl?: number;
+    };
     customBitcoinNetwork?: V1Network;
     customRootURI?: string;
     customSigningAddress?: string;
@@ -11,10 +26,23 @@ export interface BitGoAPIOptions {
     env?: EnvironmentName;
     etherscanApiToken?: string;
     polygonscanApiToken?: string;
+    baseethApiToken?: string;
     arbiscanApiToken?: string;
     optimisticEtherscanApiToken?: string;
+    zksyncExplorerApiToken?: string;
+    bscscanApiToken?: string;
+    coredaoExplorerApiToken?: string;
+    oasExplorerApiToken?: string;
+    sgbExplorerApiToken?: string;
+    flrExplorerApiToken?: string;
+    xdcExplorerApiToken?: string;
+    wemixExplorerApiToken?: string;
+    monExplorerApiToken?: string;
+    worldExplorerApiToken?: string;
+    somniaExplorerApiToken?: string;
+    soneiumExplorerApiToken?: string;
     hmacVerification?: boolean;
-    proxy?: string;
+    customProxyAgent?: Agent;
     refreshToken?: string;
     serverXpub?: string;
     stellarFederationServerUrl?: string;
@@ -22,6 +50,14 @@ export interface BitGoAPIOptions {
     userAgent?: string;
     validate?: boolean;
     cookiesPropagationEnabled?: boolean;
+    getAdditionalHeadersCb?: AdditionalHeadersCallback;
+    requestIdPrefix?: string;
+    evm?: {
+        [key: string]: {
+            baseUrl?: string;
+            apiToken?: string;
+        };
+    };
 }
 export interface AccessTokenOptions {
     accessToken: string;
@@ -29,47 +65,6 @@ export interface AccessTokenOptions {
 export interface PingOptions {
     reqId?: IRequestTracer;
 }
-export declare const supportedRequestMethods: readonly ["get", "post", "put", "del", "patch"];
-export interface CalculateHmacSubjectOptions {
-    urlPath: string;
-    text: string;
-    timestamp: number;
-    method: (typeof supportedRequestMethods)[number];
-    statusCode?: number;
-}
-export interface CalculateRequestHmacOptions {
-    url: string;
-    text: string;
-    timestamp: number;
-    token: string;
-    method: (typeof supportedRequestMethods)[number];
-}
-export interface RequestHeaders {
-    hmac: string;
-    timestamp: number;
-    tokenHash: string;
-}
-export interface CalculateRequestHeadersOptions {
-    url: string;
-    text: string;
-    token: string;
-    method: (typeof supportedRequestMethods)[number];
-}
-export interface VerifyResponseOptions extends CalculateRequestHeadersOptions {
-    hmac: string;
-    url: string;
-    text: string;
-    timestamp: number;
-    method: (typeof supportedRequestMethods)[number];
-    statusCode?: number;
-}
-export interface VerifyResponseInfo {
-    isValid: boolean;
-    expectedHmac: string;
-    signatureSubject: string;
-    isInResponseValidityWindow: boolean;
-    verificationTime: number;
-}
 export interface AuthenticateOptions {
     username: string;
     password: string;
@@ -88,6 +83,26 @@ export interface AuthenticateOptions {
      * It is highly recommended that this is always set to avoid any issues when using a BitGo wallet
      */
     ensureEcdhKeychain?: boolean;
+    /**
+     * Encryption version to use when creating the ECDH keychain if it does not already exist.
+     * Only applies when `ensureEcdhKeychain` is true and no ECDH keychain exists for the user yet.
+     */
+    encryptionVersion?: EncryptionVersion;
+    forReset2FA?: boolean;
+    /**
+     * The initial stage fingerprint hash used for device identification and verification.
+     * @type {string}
+     * @default undefined
+     * @description An SHA-256 hash string generated from device-specific attributes
+     */
+    initialHash?: string;
+    /**
+     * The final stage fingerprint hash used for trusted device verification.
+     * @type {string}
+     * @default undefined
+     * @description An SHA-256 hash string derived from the initialHash and verification code
+     */
+    fingerprintHash?: string;
 }
 export interface ProcessedAuthenticationOptions {
     email: string;
@@ -98,6 +113,9 @@ export interface ProcessedAuthenticationOptions {
     extensible?: boolean;
     extensionAddress?: string;
     forceV1Auth?: boolean;
+    forReset2FA?: boolean;
+    initialHash?: string;
+    fingerprintHash?: string;
 }
 export interface User {
     username: string;
@@ -125,6 +143,7 @@ export interface AccessTokenSpendingLimit {
     txCount?: number;
     txValue?: string;
     txValueLimit?: string;
+    maxLimit?: boolean;
 }
 export interface AddAccessTokenOptions {
     label: string;
@@ -134,6 +153,7 @@ export interface AddAccessTokenOptions {
     txValueLimit?: number;
     scope: string[];
     spendingLimits?: AccessTokenSpendingLimit[];
+    enterprise?: string;
 }
 export interface AddAccessTokenResponse {
     id: string;
@@ -177,6 +197,7 @@ export interface SplitSecretOptions {
     seed: string;
     passwords: string[];
     m: number;
+    encryptionVersion?: EncryptionVersion;
 }
 export interface SplitSecret {
     xpub: string;
@@ -206,6 +227,12 @@ export interface GetEcdhSecretOptions {
 export interface ChangePasswordOptions {
     oldPassword: string;
     newPassword: string;
+    /**
+     * Envelope version to emit for the re-encrypted keychains. Defaults to preserving each
+     * keychain's existing envelope version (no forced migration). Pass `2` to opt in to the
+     * Argon2id upgrade for v1 (SJCL) keychains once the caller is ready.
+     */
+    encryptionVersion?: EncryptionVersion;
 }
 /**
  * @deprecated