@bitgo-beta/sdk-api 1.10.1-beta.209 → 1.10.1-beta.2090

package/dist/src/encryptV2.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HKDF_SALT_LENGTH = exports.GCM_IV_LENGTH = exports.ARGON2_DEFAULTS = void 0;
+exports.argon2ToHkdfKey = argon2ToHkdfKey;
+exports.hkdfDeriveAesKey = hkdfDeriveAesKey;
+exports.aesGcmEncrypt = aesGcmEncrypt;
+exports.aesGcmDecrypt = aesGcmDecrypt;
+exports.parseV2Envelope = parseV2Envelope;
+exports.encryptV2 = encryptV2;
+exports.decryptV2 = decryptV2;
+const argon2_1 = require("@bitgo-beta/argon2");
+const sdk_core_1 = require("@bitgo-beta/sdk-core");
+const crypto_1 = require("crypto");
+const t = __importStar(require("io-ts"));
+/** Web Crypto subtle — browser global in DOM; Node/Electron main must use `webcrypto`. */
+const subtle = globalThis.crypto?.subtle ?? crypto_1.webcrypto.subtle;
+/** Default Argon2id parameters per RFC 9106 second recommendation
+ * @see https://www.rfc-editor.org/rfc/rfc9106#section-4
+ */
+exports.ARGON2_DEFAULTS = {
+    memorySize: 65536, // 64 MiB in KiB
+    iterations: 3,
+    parallelism: 4,
+    hashLength: 32, // 256-bit key
+    saltLength: 16, // 128-bit salt
+};
+/** Maximum allowed Argon2id parameters to prevent DoS via crafted envelopes.
+ * memorySize: 256 MiB (4x default) -- caps memory allocation on untrusted input.
+ * iterations: 16 -- caps CPU time.
+ * parallelism: 16 -- caps thread count.
+ */
+const ARGON2_MAX = {
+    memorySize: 262144,
+    iterations: 16,
+    parallelism: 16,
+};
+/** AES-256-GCM IV length in bytes */
+exports.GCM_IV_LENGTH = 12;
+/** HKDF per-call salt length in bytes */
+exports.HKDF_SALT_LENGTH = 32;
+/** Fixed HKDF info string for domain separation across BitGo v2 session keys */
+const HKDF_SESSION_INFO = new TextEncoder().encode('bitgo-v2-session');
+/** HKDF info for high-entropy IKM (ECDH secrets). Distinct from session info. */
+const HKDF_ONLY_INFO = new TextEncoder().encode('bitgo-v2-hkdf');
+// Envelope codec
+//
+// Two valid v2 shapes (presence rule enforced after decode):
+//   - Argon2 / session: m, t, p, salt required; hkdfSalt optional (session)
+//   - HKDF-only: hkdfSalt required; Argon2 params absent
+const V2EnvelopeCodec = t.intersection([
+    t.type({
+        v: t.literal(2),
+        iv: sdk_core_1.base64String,
+        ct: sdk_core_1.base64String,
+    }),
+    t.partial({
+        m: (0, sdk_core_1.boundedInt)(1, ARGON2_MAX.memorySize, 'memorySize'),
+        t: (0, sdk_core_1.boundedInt)(1, ARGON2_MAX.iterations, 'iterations'),
+        p: (0, sdk_core_1.boundedInt)(1, ARGON2_MAX.parallelism, 'parallelism'),
+        salt: sdk_core_1.base64String,
+        /** Base64-encoded HKDF salt -- session envelopes and HKDF-only envelopes */
+        hkdfSalt: sdk_core_1.base64String,
+        /** Additional authenticated data for context binding (e.g. transaction hash + derivation path) */
+        adata: t.string,
+    }),
+]);
+function hasArgon2Params(envelope) {
+    return (envelope.m !== undefined && envelope.t !== undefined && envelope.p !== undefined && envelope.salt !== undefined);
+}
+function isHkdfOnlyEnvelope(envelope) {
+    return (envelope.hkdfSalt !== undefined &&
+        envelope.m === undefined &&
+        envelope.t === undefined &&
+        envelope.p === undefined &&
+        envelope.salt === undefined);
+}
+// Crypto helpers
+async function argon2Hash(password, salt, params) {
+    return (0, argon2_1.argon2id)({
+        password,
+        salt,
+        memorySize: params.memorySize,
+        iterations: params.iterations,
+        parallelism: params.parallelism,
+        hashLength: exports.ARGON2_DEFAULTS.hashLength,
+        outputType: 'binary',
+    });
+}
+async function argon2ToAesKey(password, salt, params) {
+    const keyBytes = await argon2Hash(password, salt, params);
+    return subtle.importKey('raw', keyBytes, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+}
+async function argon2ToHkdfKey(password, salt, params) {
+    const keyBytes = await argon2Hash(password, salt, params);
+    return subtle.importKey('raw', keyBytes, 'HKDF', false, ['deriveKey']);
+}
+async function passwordToHkdfKey(password) {
+    const ikm = new TextEncoder().encode(password);
+    return subtle.importKey('raw', ikm, 'HKDF', false, ['deriveKey']);
+}
+function hkdfDeriveAesKey(hkdfKey, hkdfSalt, usage, info = HKDF_SESSION_INFO) {
+    return subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: hkdfSalt, info }, hkdfKey, { name: 'AES-GCM', length: 256 }, false, [usage]);
+}
+async function aesGcmEncrypt(key, iv, plaintext, additionalData) {
+    const params = { name: 'AES-GCM', iv, tagLength: 128 };
+    if (additionalData)
+        params.additionalData = additionalData;
+    const ct = await subtle.encrypt(params, key, new TextEncoder().encode(plaintext));
+    return new Uint8Array(ct);
+}
+async function aesGcmDecrypt(key, iv, ct, additionalData) {
+    const params = { name: 'AES-GCM', iv, tagLength: 128 };
+    if (additionalData)
+        params.additionalData = additionalData;
+    const plaintext = await subtle.decrypt(params, key, ct);
+    return new TextDecoder().decode(plaintext);
+}
+function parseV2Envelope(ciphertext) {
+    let parsed;
+    try {
+        parsed = JSON.parse(ciphertext);
+    }
+    catch {
+        throw new Error('v2 decrypt: invalid JSON envelope');
+    }
+    const envelope = (0, sdk_core_1.decodeWithCodec)(V2EnvelopeCodec, parsed, 'v2 decrypt: invalid envelope');
+    if (!hasArgon2Params(envelope) && !isHkdfOnlyEnvelope(envelope)) {
+        throw new Error('v2 decrypt: invalid envelope');
+    }
+    return envelope;
+}
+// Public API
+/**
+ * Encrypt plaintext using Argon2id KDF + AES-256-GCM.
+ *
+ * Returns a self-describing JSON v2 envelope containing all Argon2id parameters,
+ * salt, IV, and ciphertext -- fully standalone for decryption.
+ *
+ * For multi-call operations (MPC signing, wallet creation), prefer
+ * createEncryptionSession to run Argon2id once and derive per-call keys via HKDF.
+ */
+async function encryptV2(password, plaintext, options) {
+    const memorySize = options?.memorySize ?? exports.ARGON2_DEFAULTS.memorySize;
+    const iterations = options?.iterations ?? exports.ARGON2_DEFAULTS.iterations;
+    const parallelism = options?.parallelism ?? exports.ARGON2_DEFAULTS.parallelism;
+    const salt = options?.salt ?? new Uint8Array((0, crypto_1.randomBytes)(exports.ARGON2_DEFAULTS.saltLength));
+    if (salt.length !== exports.ARGON2_DEFAULTS.saltLength)
+        throw new Error(`salt must be ${exports.ARGON2_DEFAULTS.saltLength} bytes`);
+    const iv = options?.iv ?? new Uint8Array((0, crypto_1.randomBytes)(exports.GCM_IV_LENGTH));
+    if (iv.length !== exports.GCM_IV_LENGTH)
+        throw new Error(`iv must be ${exports.GCM_IV_LENGTH} bytes`);
+    const adataBytes = options?.adata ? new TextEncoder().encode(options.adata) : undefined;
+    const key = await argon2ToAesKey(password, salt, { memorySize, iterations, parallelism });
+    const ct = await aesGcmEncrypt(key, iv, plaintext, adataBytes);
+    const envelope = {
+        v: 2,
+        m: memorySize,
+        t: iterations,
+        p: parallelism,
+        salt: Buffer.from(salt).toString('base64'),
+        iv: Buffer.from(iv).toString('base64'),
+        ct: Buffer.from(ct).toString('base64'),
+    };
+    if (options?.adata)
+        envelope.adata = options.adata;
+    return JSON.stringify(envelope);
+}
+/**
+ * Decrypt a v2 envelope. Auto-detects shape:
+ *   - Standard  (Argon2 params, no hkdfSalt): Argon2id -> AES-GCM
+ *   - Session   (Argon2 params + hkdfSalt): Argon2id -> HKDF -> AES-GCM
+ *   - HKDF-only (hkdfSalt, no Argon2 params): HKDF(password) -> AES-GCM
+ *
+ * All parameters are stored in the envelope -- no session context required.
+ */
+async function decryptV2(password, ciphertext) {
+    const envelope = parseV2Envelope(ciphertext);
+    const iv = new Uint8Array(Buffer.from(envelope.iv, 'base64'));
+    const ct = new Uint8Array(Buffer.from(envelope.ct, 'base64'));
+    const adataBytes = envelope.adata ? new TextEncoder().encode(envelope.adata) : undefined;
+    if (isHkdfOnlyEnvelope(envelope)) {
+        const hkdfKey = await passwordToHkdfKey(password);
+        const hkdfSalt = new Uint8Array(Buffer.from(envelope.hkdfSalt, 'base64'));
+        const aesKey = await hkdfDeriveAesKey(hkdfKey, hkdfSalt, 'decrypt', HKDF_ONLY_INFO);
+        return aesGcmDecrypt(aesKey, iv, ct, adataBytes);
+    }
+    if (!hasArgon2Params(envelope)) {
+        throw new Error('v2 decrypt: invalid envelope');
+    }
+    const salt = new Uint8Array(Buffer.from(envelope.salt, 'base64'));
+    const params = { memorySize: envelope.m, iterations: envelope.t, parallelism: envelope.p };
+    if (envelope.hkdfSalt) {
+        const hkdfKey = await argon2ToHkdfKey(password, salt, params);
+        const hkdfSalt = new Uint8Array(Buffer.from(envelope.hkdfSalt, 'base64'));
+        const aesKey = await hkdfDeriveAesKey(hkdfKey, hkdfSalt, 'decrypt');
+        return aesGcmDecrypt(aesKey, iv, ct, adataBytes);
+    }
+    const key = await argon2ToAesKey(password, salt, params);
+    return aesGcmDecrypt(key, iv, ct, adataBytes);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdFYyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2VuY3J5cHRWMi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFrSEEsMENBT0M7QUFPRCw0Q0FhQztBQUVELHNDQVVDO0FBRUQsc0NBVUM7QUFFRCwwQ0FZQztBQWFELDhCQXFDQztBQVVELDhCQTZCQztBQTVRRCwrQ0FBOEM7QUFDOUMsbURBQWlGO0FBQ2pGLG1DQUFnRDtBQUNoRCx5Q0FBMkI7QUFFM0IsMEZBQTBGO0FBQzFGLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxJQUFJLGtCQUFTLENBQUMsTUFBTSxDQUFDO0FBRTdEOztHQUVHO0FBQ1UsUUFBQSxlQUFlLEdBQUc7SUFDN0IsVUFBVSxFQUFFLEtBQUssRUFBRSxnQkFBZ0I7SUFDbkMsVUFBVSxFQUFFLENBQUM7SUFDYixXQUFXLEVBQUUsQ0FBQztJQUNkLFVBQVUsRUFBRSxFQUFFLEVBQUUsY0FBYztJQUM5QixVQUFVLEVBQUUsRUFBRSxFQUFFLGVBQWU7Q0FDdkIsQ0FBQztBQUVYOzs7O0dBSUc7QUFDSCxNQUFNLFVBQVUsR0FBRztJQUNqQixVQUFVLEVBQUUsTUFBTTtJQUNsQixVQUFVLEVBQUUsRUFBRTtJQUNkLFdBQVcsRUFBRSxFQUFFO0NBQ1AsQ0FBQztBQUVYLHFDQUFxQztBQUN4QixRQUFBLGFBQWEsR0FBRyxFQUFFLENBQUM7QUFFaEMseUNBQXlDO0FBQzVCLFFBQUEsZ0JBQWdCLEdBQUcsRUFBRSxDQUFDO0FBRW5DLGdGQUFnRjtBQUNoRixNQUFNLGlCQUFpQixHQUFHLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLENBQUM7QUFFdkUsaUZBQWlGO0FBQ2pGLE1BQU0sY0FBYyxHQUFHLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0FBRWpFLGlCQUFpQjtBQUNqQixFQUFFO0FBQ0YsNkRBQTZEO0FBQzdELDRFQUE0RTtBQUM1RSx5REFBeUQ7QUFFekQsTUFBTSxlQUFlLEdBQUcsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUNyQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ0wsQ0FBQyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ2YsRUFBRSxFQUFFLHVCQUFZO1FBQ2hCLEVBQUUsRUFBRSx1QkFBWTtLQUNqQixDQUFDO0lBQ0YsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUNSLENBQUMsRUFBRSxJQUFBLHFCQUFVLEVBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDO1FBQ3JELENBQUMsRUFBRSxJQUFBLHFCQUFVLEVBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDO1FBQ3JELENBQUMsRUFBRSxJQUFBLHFCQUFVLEVBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxXQUFXLEVBQUUsYUFBYSxDQUFDO1FBQ3ZELElBQUksRUFBRSx1QkFBWTtRQUNsQiw0RUFBNEU7UUFDNUUsUUFBUSxFQUFFLHVCQUFZO1FBQ3RCLGtHQUFrRztRQUNsRyxLQUFLLEVBQUUsQ0FBQyxDQUFDLE1BQU07S0FDaEIsQ0FBQztDQUNILENBQUMsQ0FBQztBQU9ILFNBQVMsZUFBZSxDQUFDLFFBQW9CO0lBQzNDLE9BQU8sQ0FDTCxRQUFRLENBQUMsQ0FBQyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsQ0FBQyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsQ0FBQyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FDaEgsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGtCQUFrQixDQUFDLFFBQW9CO0lBQzlDLE9BQU8sQ0FDTCxRQUFRLENBQUMsUUFBUSxLQUFLLFNBQVM7UUFDL0IsUUFBUSxDQUFDLENBQUMsS0FBSyxTQUFTO1FBQ3hCLFFBQVEsQ0FBQyxDQUFDLEtBQUssU0FBUztRQUN4QixRQUFRLENBQUMsQ0FBQyxLQUFLLFNBQVM7UUFDeEIsUUFBUSxDQUFDLElBQUksS0FBSyxTQUFTLENBQzVCLENBQUM7QUFDSixDQUFDO0FBRUQsaUJBQWlCO0FBRWpCLEtBQUssVUFBVSxVQUFVLENBQ3ZCLFFBQWdCLEVBQ2hCLElBQWdCLEVBQ2hCLE1BQXVFO0lBRXZFLE9BQU8sSUFBQSxpQkFBUSxFQUFDO1FBQ2QsUUFBUTtRQUNSLElBQUk7UUFDSixVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7UUFDN0IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1FBQzdCLFdBQVcsRUFBRSxNQUFNLENBQUMsV0FBVztRQUMvQixVQUFVLEVBQUUsdUJBQWUsQ0FBQyxVQUFVO1FBQ3RDLFVBQVUsRUFBRSxRQUFRO0tBQ3JCLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxLQUFLLFVBQVUsY0FBYyxDQUMzQixRQUFnQixFQUNoQixJQUFnQixFQUNoQixNQUF1RTtJQUV2RSxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFELE9BQU8sTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0FBQy9GLENBQUM7QUFFTSxLQUFLLFVBQVUsZUFBZSxDQUNuQyxRQUFnQixFQUNoQixJQUFnQixFQUNoQixNQUF1RTtJQUV2RSxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFELE9BQU8sTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBQ3pFLENBQUM7QUFFRCxLQUFLLFVBQVUsaUJBQWlCLENBQUMsUUFBZ0I7SUFDL0MsTUFBTSxHQUFHLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDL0MsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUM7QUFDcEUsQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUM5QixPQUFrQixFQUNsQixRQUFvQixFQUNwQixLQUFlLEVBQ2YsT0FBbUIsaUJBQWlCO0lBRXBDLE9BQU8sTUFBTSxDQUFDLFNBQVMsQ0FDckIsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsRUFDdkQsT0FBTyxFQUNQLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEVBQ2hDLEtBQUssRUFDTCxDQUFDLEtBQUssQ0FBQyxDQUNSLENBQUM7QUFDSixDQUFDO0FBRU0sS0FBSyxVQUFVLGFBQWEsQ0FDakMsR0FBYyxFQUNkLEVBQWMsRUFDZCxTQUFpQixFQUNqQixjQUEyQjtJQUUzQixNQUFNLE1BQU0sR0FBaUIsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUM7SUFDckUsSUFBSSxjQUFjO1FBQUUsTUFBTSxDQUFDLGNBQWMsR0FBRyxjQUFjLENBQUM7SUFDM0QsTUFBTSxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNsRixPQUFPLElBQUksVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzVCLENBQUM7QUFFTSxLQUFLLFVBQVUsYUFBYSxDQUNqQyxHQUFjLEVBQ2QsRUFBYyxFQUNkLEVBQWMsRUFDZCxjQUEyQjtJQUUzQixNQUFNLE1BQU0sR0FBaUIsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUM7SUFDckUsSUFBSSxjQUFjO1FBQUUsTUFBTSxDQUFDLGNBQWMsR0FBRyxjQUFjLENBQUM7SUFDM0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDeEQsT0FBTyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUM3QyxDQUFDO0FBRUQsU0FBZ0IsZUFBZSxDQUFDLFVBQWtCO0lBQ2hELElBQUksTUFBZSxDQUFDO0lBQ3BCLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2xDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLElBQUEsMEJBQWUsRUFBQyxlQUFlLEVBQUUsTUFBTSxFQUFFLDhCQUE4QixDQUFDLENBQUM7SUFDMUYsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDaEUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDO0FBRUQsYUFBYTtBQUViOzs7Ozs7OztHQVFHO0FBQ0ksS0FBSyxVQUFVLFNBQVMsQ0FDN0IsUUFBZ0IsRUFDaEIsU0FBaUIsRUFDakIsT0FPQztJQUVELE1BQU0sVUFBVSxHQUFHLE9BQU8sRUFBRSxVQUFVLElBQUksdUJBQWUsQ0FBQyxVQUFVLENBQUM7SUFDckUsTUFBTSxVQUFVLEdBQUcsT0FBTyxFQUFFLFVBQVUsSUFBSSx1QkFBZSxDQUFDLFVBQVUsQ0FBQztJQUNyRSxNQUFNLFdBQVcsR0FBRyxPQUFPLEVBQUUsV0FBVyxJQUFJLHVCQUFlLENBQUMsV0FBVyxDQUFDO0lBRXhFLE1BQU0sSUFBSSxHQUFHLE9BQU8sRUFBRSxJQUFJLElBQUksSUFBSSxVQUFVLENBQUMsSUFBQSxvQkFBVyxFQUFDLHVCQUFlLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUN0RixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssdUJBQWUsQ0FBQyxVQUFVO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsdUJBQWUsQ0FBQyxVQUFVLFFBQVEsQ0FBQyxDQUFDO0lBRXBILE1BQU0sRUFBRSxHQUFHLE9BQU8sRUFBRSxFQUFFLElBQUksSUFBSSxVQUFVLENBQUMsSUFBQSxvQkFBVyxFQUFDLHFCQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLElBQUksRUFBRSxDQUFDLE1BQU0sS0FBSyxxQkFBYTtRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxxQkFBYSxRQUFRLENBQUMsQ0FBQztJQUV0RixNQUFNLFVBQVUsR0FBRyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUN4RixNQUFNLEdBQUcsR0FBRyxNQUFNLGNBQWMsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQzFGLE1BQU0sRUFBRSxHQUFHLE1BQU0sYUFBYSxDQUFDLEdBQUcsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBRS9ELE1BQU0sUUFBUSxHQUFlO1FBQzNCLENBQUMsRUFBRSxDQUFDO1FBQ0osQ0FBQyxFQUFFLFVBQVU7UUFDYixDQUFDLEVBQUUsVUFBVTtRQUNiLENBQUMsRUFBRSxXQUFXO1FBQ2QsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUMxQyxFQUFFLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQ3RDLEVBQUUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7S0FDdkMsQ0FBQztJQUNGLElBQUksT0FBTyxFQUFFLEtBQUs7UUFBRSxRQUFRLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7SUFDbkQsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFFRDs7Ozs7OztHQU9HO0FBQ0ksS0FBSyxVQUFVLFNBQVMsQ0FBQyxRQUFnQixFQUFFLFVBQWtCO0lBQ2xFLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM3QyxNQUFNLEVBQUUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5RCxNQUFNLEVBQUUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5RCxNQUFNLFVBQVUsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUV6RixJQUFJLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakMsTUFBTSxPQUFPLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNsRCxNQUFNLFFBQVEsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUMxRSxNQUFNLE1BQU0sR0FBRyxNQUFNLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQ3BGLE9BQU8sYUFBYSxDQUFDLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRCxJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFFRCxNQUFNLElBQUksR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxNQUFNLE1BQU0sR0FBRyxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFFM0YsSUFBSSxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDdEIsTUFBTSxPQUFPLEdBQUcsTUFBTSxlQUFlLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM5RCxNQUFNLFFBQVEsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUMxRSxNQUFNLE1BQU0sR0FBRyxNQUFNLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDcEUsT0FBTyxhQUFhLENBQUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVELE1BQU0sR0FBRyxHQUFHLE1BQU0sY0FBYyxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekQsT0FBTyxhQUFhLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFDaEQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGFyZ29uMmlkIH0gZnJvbSAnQGJpdGdvLWJldGEvYXJnb24yJztcbmltcG9ydCB7IGJhc2U2NFN0cmluZywgYm91bmRlZEludCwgZGVjb2RlV2l0aENvZGVjIH0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWNvcmUnO1xuaW1wb3J0IHsgcmFuZG9tQnl0ZXMsIHdlYmNyeXB0byB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgKiBhcyB0IGZyb20gJ2lvLXRzJztcblxuLyoqIFdlYiBDcnlwdG8gc3VidGxlIOKAlCBicm93c2VyIGdsb2JhbCBpbiBET007IE5vZGUvRWxlY3Ryb24gbWFpbiBtdXN0IHVzZSBgd2ViY3J5cHRvYC4gKi9cbmNvbnN0IHN1YnRsZSA9IGdsb2JhbFRoaXMuY3J5cHRvPy5zdWJ0bGUgPz8gd2ViY3J5cHRvLnN1YnRsZTtcblxuLyoqIERlZmF1bHQgQXJnb24yaWQgcGFyYW1ldGVycyBwZXIgUkZDIDkxMDYgc2Vjb25kIHJlY29tbWVuZGF0aW9uXG4gKiBAc2VlIGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL3JmYy9yZmM5MTA2I3NlY3Rpb24tNFxuICovXG5leHBvcnQgY29uc3QgQVJHT04yX0RFRkFVTFRTID0ge1xuICBtZW1vcnlTaXplOiA2NTUzNiwgLy8gNjQgTWlCIGluIEtpQlxuICBpdGVyYXRpb25zOiAzLFxuICBwYXJhbGxlbGlzbTogNCxcbiAgaGFzaExlbmd0aDogMzIsIC8vIDI1Ni1iaXQga2V5XG4gIHNhbHRMZW5ndGg6IDE2LCAvLyAxMjgtYml0IHNhbHRcbn0gYXMgY29uc3Q7XG5cbi8qKiBNYXhpbXVtIGFsbG93ZWQgQXJnb24yaWQgcGFyYW1ldGVycyB0byBwcmV2ZW50IERvUyB2aWEgY3JhZnRlZCBlbnZlbG9wZXMuXG4gKiBtZW1vcnlTaXplOiAyNTYgTWlCICg0eCBkZWZhdWx0KSAtLSBjYXBzIG1lbW9yeSBhbGxvY2F0aW9uIG9uIHVudHJ1c3RlZCBpbnB1dC5cbiAqIGl0ZXJhdGlvbnM6IDE2IC0tIGNhcHMgQ1BVIHRpbWUuXG4gKiBwYXJhbGxlbGlzbTogMTYgLS0gY2FwcyB0aHJlYWQgY291bnQuXG4gKi9cbmNvbnN0IEFSR09OMl9NQVggPSB7XG4gIG1lbW9yeVNpemU6IDI2MjE0NCxcbiAgaXRlcmF0aW9uczogMTYsXG4gIHBhcmFsbGVsaXNtOiAxNixcbn0gYXMgY29uc3Q7XG5cbi8qKiBBRVMtMjU2LUdDTSBJViBsZW5ndGggaW4gYnl0ZXMgKi9cbmV4cG9ydCBjb25zdCBHQ01fSVZfTEVOR1RIID0gMTI7XG5cbi8qKiBIS0RGIHBlci1jYWxsIHNhbHQgbGVuZ3RoIGluIGJ5dGVzICovXG5leHBvcnQgY29uc3QgSEtERl9TQUxUX0xFTkdUSCA9IDMyO1xuXG4vKiogRml4ZWQgSEtERiBpbmZvIHN0cmluZyBmb3IgZG9tYWluIHNlcGFyYXRpb24gYWNyb3NzIEJpdEdvIHYyIHNlc3Npb24ga2V5cyAqL1xuY29uc3QgSEtERl9TRVNTSU9OX0lORk8gPSBuZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUoJ2JpdGdvLXYyLXNlc3Npb24nKTtcblxuLyoqIEhLREYgaW5mbyBmb3IgaGlnaC1lbnRyb3B5IElLTSAoRUNESCBzZWNyZXRzKS4gRGlzdGluY3QgZnJvbSBzZXNzaW9uIGluZm8uICovXG5jb25zdCBIS0RGX09OTFlfSU5GTyA9IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZSgnYml0Z28tdjItaGtkZicpO1xuXG4vLyBFbnZlbG9wZSBjb2RlY1xuLy9cbi8vIFR3byB2YWxpZCB2MiBzaGFwZXMgKHByZXNlbmNlIHJ1bGUgZW5mb3JjZWQgYWZ0ZXIgZGVjb2RlKTpcbi8vICAgLSBBcmdvbjIgLyBzZXNzaW9uOiBtLCB0LCBwLCBzYWx0IHJlcXVpcmVkOyBoa2RmU2FsdCBvcHRpb25hbCAoc2Vzc2lvbilcbi8vICAgLSBIS0RGLW9ubHk6IGhrZGZTYWx0IHJlcXVpcmVkOyBBcmdvbjIgcGFyYW1zIGFic2VudFxuXG5jb25zdCBWMkVudmVsb3BlQ29kZWMgPSB0LmludGVyc2VjdGlvbihbXG4gIHQudHlwZSh7XG4gICAgdjogdC5saXRlcmFsKDIpLFxuICAgIGl2OiBiYXNlNjRTdHJpbmcsXG4gICAgY3Q6IGJhc2U2NFN0cmluZyxcbiAgfSksXG4gIHQucGFydGlhbCh7XG4gICAgbTogYm91bmRlZEludCgxLCBBUkdPTjJfTUFYLm1lbW9yeVNpemUsICdtZW1vcnlTaXplJyksXG4gICAgdDogYm91bmRlZEludCgxLCBBUkdPTjJfTUFYLml0ZXJhdGlvbnMsICdpdGVyYXRpb25zJyksXG4gICAgcDogYm91bmRlZEludCgxLCBBUkdPTjJfTUFYLnBhcmFsbGVsaXNtLCAncGFyYWxsZWxpc20nKSxcbiAgICBzYWx0OiBiYXNlNjRTdHJpbmcsXG4gICAgLyoqIEJhc2U2NC1lbmNvZGVkIEhLREYgc2FsdCAtLSBzZXNzaW9uIGVudmVsb3BlcyBhbmQgSEtERi1vbmx5IGVudmVsb3BlcyAqL1xuICAgIGhrZGZTYWx0OiBiYXNlNjRTdHJpbmcsXG4gICAgLyoqIEFkZGl0aW9uYWwgYXV0aGVudGljYXRlZCBkYXRhIGZvciBjb250ZXh0IGJpbmRpbmcgKGUuZy4gdHJhbnNhY3Rpb24gaGFzaCArIGRlcml2YXRpb24gcGF0aCkgKi9cbiAgICBhZGF0YTogdC5zdHJpbmcsXG4gIH0pLFxuXSk7XG5cbmV4cG9ydCB0eXBlIFYyRW52ZWxvcGUgPSB0LlR5cGVPZjx0eXBlb2YgVjJFbnZlbG9wZUNvZGVjPjtcblxudHlwZSBBcmdvbjJFbnZlbG9wZSA9IFYyRW52ZWxvcGUgJiB7IG06IG51bWJlcjsgdDogbnVtYmVyOyBwOiBudW1iZXI7IHNhbHQ6IHN0cmluZyB9O1xudHlwZSBIa2RmT25seUVudmVsb3BlID0gVjJFbnZlbG9wZSAmIHsgaGtkZlNhbHQ6IHN0cmluZyB9O1xuXG5mdW5jdGlvbiBoYXNBcmdvbjJQYXJhbXMoZW52ZWxvcGU6IFYyRW52ZWxvcGUpOiBlbnZlbG9wZSBpcyBBcmdvbjJFbnZlbG9wZSB7XG4gIHJldHVybiAoXG4gICAgZW52ZWxvcGUubSAhPT0gdW5kZWZpbmVkICYmIGVudmVsb3BlLnQgIT09IHVuZGVmaW5lZCAmJiBlbnZlbG9wZS5wICE9PSB1bmRlZmluZWQgJiYgZW52ZWxvcGUuc2FsdCAhPT0gdW5kZWZpbmVkXG4gICk7XG59XG5cbmZ1bmN0aW9uIGlzSGtkZk9ubHlFbnZlbG9wZShlbnZlbG9wZTogVjJFbnZlbG9wZSk6IGVudmVsb3BlIGlzIEhrZGZPbmx5RW52ZWxvcGUge1xuICByZXR1cm4gKFxuICAgIGVudmVsb3BlLmhrZGZTYWx0ICE9PSB1bmRlZmluZWQgJiZcbiAgICBlbnZlbG9wZS5tID09PSB1bmRlZmluZWQgJiZcbiAgICBlbnZlbG9wZS50ID09PSB1bmRlZmluZWQgJiZcbiAgICBlbnZlbG9wZS5wID09PSB1bmRlZmluZWQgJiZcbiAgICBlbnZlbG9wZS5zYWx0ID09PSB1bmRlZmluZWRcbiAgKTtcbn1cblxuLy8gQ3J5cHRvIGhlbHBlcnNcblxuYXN5bmMgZnVuY3Rpb24gYXJnb24ySGFzaChcbiAgcGFzc3dvcmQ6IHN0cmluZyxcbiAgc2FsdDogVWludDhBcnJheSxcbiAgcGFyYW1zOiB7IG1lbW9yeVNpemU6IG51bWJlcjsgaXRlcmF0aW9uczogbnVtYmVyOyBwYXJhbGxlbGlzbTogbnVtYmVyIH1cbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICByZXR1cm4gYXJnb24yaWQoe1xuICAgIHBhc3N3b3JkLFxuICAgIHNhbHQsXG4gICAgbWVtb3J5U2l6ZTogcGFyYW1zLm1lbW9yeVNpemUsXG4gICAgaXRlcmF0aW9uczogcGFyYW1zLml0ZXJhdGlvbnMsXG4gICAgcGFyYWxsZWxpc206IHBhcmFtcy5wYXJhbGxlbGlzbSxcbiAgICBoYXNoTGVuZ3RoOiBBUkdPTjJfREVGQVVMVFMuaGFzaExlbmd0aCxcbiAgICBvdXRwdXRUeXBlOiAnYmluYXJ5JyxcbiAgfSk7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIGFyZ29uMlRvQWVzS2V5KFxuICBwYXNzd29yZDogc3RyaW5nLFxuICBzYWx0OiBVaW50OEFycmF5LFxuICBwYXJhbXM6IHsgbWVtb3J5U2l6ZTogbnVtYmVyOyBpdGVyYXRpb25zOiBudW1iZXI7IHBhcmFsbGVsaXNtOiBudW1iZXIgfVxuKTogUHJvbWlzZTxDcnlwdG9LZXk+IHtcbiAgY29uc3Qga2V5Qnl0ZXMgPSBhd2FpdCBhcmdvbjJIYXNoKHBhc3N3b3JkLCBzYWx0LCBwYXJhbXMpO1xuICByZXR1cm4gc3VidGxlLmltcG9ydEtleSgncmF3Jywga2V5Qnl0ZXMsIHsgbmFtZTogJ0FFUy1HQ00nIH0sIGZhbHNlLCBbJ2VuY3J5cHQnLCAnZGVjcnlwdCddKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGFyZ29uMlRvSGtkZktleShcbiAgcGFzc3dvcmQ6IHN0cmluZyxcbiAgc2FsdDogVWludDhBcnJheSxcbiAgcGFyYW1zOiB7IG1lbW9yeVNpemU6IG51bWJlcjsgaXRlcmF0aW9uczogbnVtYmVyOyBwYXJhbGxlbGlzbTogbnVtYmVyIH1cbik6IFByb21pc2U8Q3J5cHRvS2V5PiB7XG4gIGNvbnN0IGtleUJ5dGVzID0gYXdhaXQgYXJnb24ySGFzaChwYXNzd29yZCwgc2FsdCwgcGFyYW1zKTtcbiAgcmV0dXJuIHN1YnRsZS5pbXBvcnRLZXkoJ3JhdycsIGtleUJ5dGVzLCAnSEtERicsIGZhbHNlLCBbJ2Rlcml2ZUtleSddKTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gcGFzc3dvcmRUb0hrZGZLZXkocGFzc3dvcmQ6IHN0cmluZyk6IFByb21pc2U8Q3J5cHRvS2V5PiB7XG4gIGNvbnN0IGlrbSA9IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShwYXNzd29yZCk7XG4gIHJldHVybiBzdWJ0bGUuaW1wb3J0S2V5KCdyYXcnLCBpa20sICdIS0RGJywgZmFsc2UsIFsnZGVyaXZlS2V5J10pO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gaGtkZkRlcml2ZUFlc0tleShcbiAgaGtkZktleTogQ3J5cHRvS2V5LFxuICBoa2RmU2FsdDogVWludDhBcnJheSxcbiAgdXNhZ2U6IEtleVVzYWdlLFxuICBpbmZvOiBVaW50OEFycmF5ID0gSEtERl9TRVNTSU9OX0lORk9cbik6IFByb21pc2U8Q3J5cHRvS2V5PiB7XG4gIHJldHVybiBzdWJ0bGUuZGVyaXZlS2V5KFxuICAgIHsgbmFtZTogJ0hLREYnLCBoYXNoOiAnU0hBLTI1NicsIHNhbHQ6IGhrZGZTYWx0LCBpbmZvIH0sXG4gICAgaGtkZktleSxcbiAgICB7IG5hbWU6ICdBRVMtR0NNJywgbGVuZ3RoOiAyNTYgfSxcbiAgICBmYWxzZSxcbiAgICBbdXNhZ2VdXG4gICk7XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBhZXNHY21FbmNyeXB0KFxuICBrZXk6IENyeXB0b0tleSxcbiAgaXY6IFVpbnQ4QXJyYXksXG4gIHBsYWludGV4dDogc3RyaW5nLFxuICBhZGRpdGlvbmFsRGF0YT86IFVpbnQ4QXJyYXlcbik6IFByb21pc2U8VWludDhBcnJheT4ge1xuICBjb25zdCBwYXJhbXM6IEFlc0djbVBhcmFtcyA9IHsgbmFtZTogJ0FFUy1HQ00nLCBpdiwgdGFnTGVuZ3RoOiAxMjggfTtcbiAgaWYgKGFkZGl0aW9uYWxEYXRhKSBwYXJhbXMuYWRkaXRpb25hbERhdGEgPSBhZGRpdGlvbmFsRGF0YTtcbiAgY29uc3QgY3QgPSBhd2FpdCBzdWJ0bGUuZW5jcnlwdChwYXJhbXMsIGtleSwgbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKHBsYWludGV4dCkpO1xuICByZXR1cm4gbmV3IFVpbnQ4QXJyYXkoY3QpO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gYWVzR2NtRGVjcnlwdChcbiAga2V5OiBDcnlwdG9LZXksXG4gIGl2OiBVaW50OEFycmF5LFxuICBjdDogVWludDhBcnJheSxcbiAgYWRkaXRpb25hbERhdGE/OiBVaW50OEFycmF5XG4pOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCBwYXJhbXM6IEFlc0djbVBhcmFtcyA9IHsgbmFtZTogJ0FFUy1HQ00nLCBpdiwgdGFnTGVuZ3RoOiAxMjggfTtcbiAgaWYgKGFkZGl0aW9uYWxEYXRhKSBwYXJhbXMuYWRkaXRpb25hbERhdGEgPSBhZGRpdGlvbmFsRGF0YTtcbiAgY29uc3QgcGxhaW50ZXh0ID0gYXdhaXQgc3VidGxlLmRlY3J5cHQocGFyYW1zLCBrZXksIGN0KTtcbiAgcmV0dXJuIG5ldyBUZXh0RGVjb2RlcigpLmRlY29kZShwbGFpbnRleHQpO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcGFyc2VWMkVudmVsb3BlKGNpcGhlcnRleHQ6IHN0cmluZyk6IFYyRW52ZWxvcGUge1xuICBsZXQgcGFyc2VkOiB1bmtub3duO1xuICB0cnkge1xuICAgIHBhcnNlZCA9IEpTT04ucGFyc2UoY2lwaGVydGV4dCk7XG4gIH0gY2F0Y2gge1xuICAgIHRocm93IG5ldyBFcnJvcigndjIgZGVjcnlwdDogaW52YWxpZCBKU09OIGVudmVsb3BlJyk7XG4gIH1cbiAgY29uc3QgZW52ZWxvcGUgPSBkZWNvZGVXaXRoQ29kZWMoVjJFbnZlbG9wZUNvZGVjLCBwYXJzZWQsICd2MiBkZWNyeXB0OiBpbnZhbGlkIGVudmVsb3BlJyk7XG4gIGlmICghaGFzQXJnb24yUGFyYW1zKGVudmVsb3BlKSAmJiAhaXNIa2RmT25seUVudmVsb3BlKGVudmVsb3BlKSkge1xuICAgIHRocm93IG5ldyBFcnJvcigndjIgZGVjcnlwdDogaW52YWxpZCBlbnZlbG9wZScpO1xuICB9XG4gIHJldHVybiBlbnZlbG9wZTtcbn1cblxuLy8gUHVibGljIEFQSVxuXG4vKipcbiAqIEVuY3J5cHQgcGxhaW50ZXh0IHVzaW5nIEFyZ29uMmlkIEtERiArIEFFUy0yNTYtR0NNLlxuICpcbiAqIFJldHVybnMgYSBzZWxmLWRlc2NyaWJpbmcgSlNPTiB2MiBlbnZlbG9wZSBjb250YWluaW5nIGFsbCBBcmdvbjJpZCBwYXJhbWV0ZXJzLFxuICogc2FsdCwgSVYsIGFuZCBjaXBoZXJ0ZXh0IC0tIGZ1bGx5IHN0YW5kYWxvbmUgZm9yIGRlY3J5cHRpb24uXG4gKlxuICogRm9yIG11bHRpLWNhbGwgb3BlcmF0aW9ucyAoTVBDIHNpZ25pbmcsIHdhbGxldCBjcmVhdGlvbiksIHByZWZlclxuICogY3JlYXRlRW5jcnlwdGlvblNlc3Npb24gdG8gcnVuIEFyZ29uMmlkIG9uY2UgYW5kIGRlcml2ZSBwZXItY2FsbCBrZXlzIHZpYSBIS0RGLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZW5jcnlwdFYyKFxuICBwYXNzd29yZDogc3RyaW5nLFxuICBwbGFpbnRleHQ6IHN0cmluZyxcbiAgb3B0aW9ucz86IHtcbiAgICBzYWx0PzogVWludDhBcnJheTtcbiAgICBpdj86IFVpbnQ4QXJyYXk7XG4gICAgbWVtb3J5U2l6ZT86IG51bWJlcjtcbiAgICBpdGVyYXRpb25zPzogbnVtYmVyO1xuICAgIHBhcmFsbGVsaXNtPzogbnVtYmVyO1xuICAgIGFkYXRhPzogc3RyaW5nO1xuICB9XG4pOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCBtZW1vcnlTaXplID0gb3B0aW9ucz8ubWVtb3J5U2l6ZSA/PyBBUkdPTjJfREVGQVVMVFMubWVtb3J5U2l6ZTtcbiAgY29uc3QgaXRlcmF0aW9ucyA9IG9wdGlvbnM/Lml0ZXJhdGlvbnMgPz8gQVJHT04yX0RFRkFVTFRTLml0ZXJhdGlvbnM7XG4gIGNvbnN0IHBhcmFsbGVsaXNtID0gb3B0aW9ucz8ucGFyYWxsZWxpc20gPz8gQVJHT04yX0RFRkFVTFRTLnBhcmFsbGVsaXNtO1xuXG4gIGNvbnN0IHNhbHQgPSBvcHRpb25zPy5zYWx0ID8/IG5ldyBVaW50OEFycmF5KHJhbmRvbUJ5dGVzKEFSR09OMl9ERUZBVUxUUy5zYWx0TGVuZ3RoKSk7XG4gIGlmIChzYWx0Lmxlbmd0aCAhPT0gQVJHT04yX0RFRkFVTFRTLnNhbHRMZW5ndGgpIHRocm93IG5ldyBFcnJvcihgc2FsdCBtdXN0IGJlICR7QVJHT04yX0RFRkFVTFRTLnNhbHRMZW5ndGh9IGJ5dGVzYCk7XG5cbiAgY29uc3QgaXYgPSBvcHRpb25zPy5pdiA/PyBuZXcgVWludDhBcnJheShyYW5kb21CeXRlcyhHQ01fSVZfTEVOR1RIKSk7XG4gIGlmIChpdi5sZW5ndGggIT09IEdDTV9JVl9MRU5HVEgpIHRocm93IG5ldyBFcnJvcihgaXYgbXVzdCBiZSAke0dDTV9JVl9MRU5HVEh9IGJ5dGVzYCk7XG5cbiAgY29uc3QgYWRhdGFCeXRlcyA9IG9wdGlvbnM/LmFkYXRhID8gbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKG9wdGlvbnMuYWRhdGEpIDogdW5kZWZpbmVkO1xuICBjb25zdCBrZXkgPSBhd2FpdCBhcmdvbjJUb0Flc0tleShwYXNzd29yZCwgc2FsdCwgeyBtZW1vcnlTaXplLCBpdGVyYXRpb25zLCBwYXJhbGxlbGlzbSB9KTtcbiAgY29uc3QgY3QgPSBhd2FpdCBhZXNHY21FbmNyeXB0KGtleSwgaXYsIHBsYWludGV4dCwgYWRhdGFCeXRlcyk7XG5cbiAgY29uc3QgZW52ZWxvcGU6IFYyRW52ZWxvcGUgPSB7XG4gICAgdjogMixcbiAgICBtOiBtZW1vcnlTaXplLFxuICAgIHQ6IGl0ZXJhdGlvbnMsXG4gICAgcDogcGFyYWxsZWxpc20sXG4gICAgc2FsdDogQnVmZmVyLmZyb20oc2FsdCkudG9TdHJpbmcoJ2Jhc2U2NCcpLFxuICAgIGl2OiBCdWZmZXIuZnJvbShpdikudG9TdHJpbmcoJ2Jhc2U2NCcpLFxuICAgIGN0OiBCdWZmZXIuZnJvbShjdCkudG9TdHJpbmcoJ2Jhc2U2NCcpLFxuICB9O1xuICBpZiAob3B0aW9ucz8uYWRhdGEpIGVudmVsb3BlLmFkYXRhID0gb3B0aW9ucy5hZGF0YTtcbiAgcmV0dXJuIEpTT04uc3RyaW5naWZ5KGVudmVsb3BlKTtcbn1cblxuLyoqXG4gKiBEZWNyeXB0IGEgdjIgZW52ZWxvcGUuIEF1dG8tZGV0ZWN0cyBzaGFwZTpcbiAqICAgLSBTdGFuZGFyZCAgKEFyZ29uMiBwYXJhbXMsIG5vIGhrZGZTYWx0KTogQXJnb24yaWQgLT4gQUVTLUdDTVxuICogICAtIFNlc3Npb24gICAoQXJnb24yIHBhcmFtcyArIGhrZGZTYWx0KTogQXJnb24yaWQgLT4gSEtERiAtPiBBRVMtR0NNXG4gKiAgIC0gSEtERi1vbmx5IChoa2RmU2FsdCwgbm8gQXJnb24yIHBhcmFtcyk6IEhLREYocGFzc3dvcmQpIC0+IEFFUy1HQ01cbiAqXG4gKiBBbGwgcGFyYW1ldGVycyBhcmUgc3RvcmVkIGluIHRoZSBlbnZlbG9wZSAtLSBubyBzZXNzaW9uIGNvbnRleHQgcmVxdWlyZWQuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBkZWNyeXB0VjIocGFzc3dvcmQ6IHN0cmluZywgY2lwaGVydGV4dDogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgZW52ZWxvcGUgPSBwYXJzZVYyRW52ZWxvcGUoY2lwaGVydGV4dCk7XG4gIGNvbnN0IGl2ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuaXYsICdiYXNlNjQnKSk7XG4gIGNvbnN0IGN0ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuY3QsICdiYXNlNjQnKSk7XG4gIGNvbnN0IGFkYXRhQnl0ZXMgPSBlbnZlbG9wZS5hZGF0YSA/IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShlbnZlbG9wZS5hZGF0YSkgOiB1bmRlZmluZWQ7XG5cbiAgaWYgKGlzSGtkZk9ubHlFbnZlbG9wZShlbnZlbG9wZSkpIHtcbiAgICBjb25zdCBoa2RmS2V5ID0gYXdhaXQgcGFzc3dvcmRUb0hrZGZLZXkocGFzc3dvcmQpO1xuICAgIGNvbnN0IGhrZGZTYWx0ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuaGtkZlNhbHQsICdiYXNlNjQnKSk7XG4gICAgY29uc3QgYWVzS2V5ID0gYXdhaXQgaGtkZkRlcml2ZUFlc0tleShoa2RmS2V5LCBoa2RmU2FsdCwgJ2RlY3J5cHQnLCBIS0RGX09OTFlfSU5GTyk7XG4gICAgcmV0dXJuIGFlc0djbURlY3J5cHQoYWVzS2V5LCBpdiwgY3QsIGFkYXRhQnl0ZXMpO1xuICB9XG5cbiAgaWYgKCFoYXNBcmdvbjJQYXJhbXMoZW52ZWxvcGUpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCd2MiBkZWNyeXB0OiBpbnZhbGlkIGVudmVsb3BlJyk7XG4gIH1cblxuICBjb25zdCBzYWx0ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuc2FsdCwgJ2Jhc2U2NCcpKTtcbiAgY29uc3QgcGFyYW1zID0geyBtZW1vcnlTaXplOiBlbnZlbG9wZS5tLCBpdGVyYXRpb25zOiBlbnZlbG9wZS50LCBwYXJhbGxlbGlzbTogZW52ZWxvcGUucCB9O1xuXG4gIGlmIChlbnZlbG9wZS5oa2RmU2FsdCkge1xuICAgIGNvbnN0IGhrZGZLZXkgPSBhd2FpdCBhcmdvbjJUb0hrZGZLZXkocGFzc3dvcmQsIHNhbHQsIHBhcmFtcyk7XG4gICAgY29uc3QgaGtkZlNhbHQgPSBuZXcgVWludDhBcnJheShCdWZmZXIuZnJvbShlbnZlbG9wZS5oa2RmU2FsdCwgJ2Jhc2U2NCcpKTtcbiAgICBjb25zdCBhZXNLZXkgPSBhd2FpdCBoa2RmRGVyaXZlQWVzS2V5KGhrZGZLZXksIGhrZGZTYWx0LCAnZGVjcnlwdCcpO1xuICAgIHJldHVybiBhZXNHY21EZWNyeXB0KGFlc0tleSwgaXYsIGN0LCBhZGF0YUJ5dGVzKTtcbiAgfVxuXG4gIGNvbnN0IGtleSA9IGF3YWl0IGFyZ29uMlRvQWVzS2V5KHBhc3N3b3JkLCBzYWx0LCBwYXJhbXMpO1xuICByZXR1cm4gYWVzR2NtRGVjcnlwdChrZXksIGl2LCBjdCwgYWRhdGFCeXRlcyk7XG59XG4iXX0=

package/dist/src/encryptionSession.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Runs Argon2id once on creation, then derives per-call AES-256-GCM keys via HKDF.
+ * Use when encrypting or decrypting multiple values with the same password.
+ *
+ * Session envelopes are self-describing and can be decrypted standalone via decryptV2.
+ * Call destroy() when done to clear the cached key from memory.
+ */
+export declare class EncryptionSession {
+    private hkdfKey;
+    private argon2SaltB64;
+    private readonly memorySize;
+    private readonly iterations;
+    private readonly parallelism;
+    /** Use createEncryptionSession() instead of calling this directly. */
+    constructor(hkdfKey: CryptoKey, argon2SaltB64: string, params: {
+        memorySize: number;
+        iterations: number;
+        parallelism: number;
+    });
+    encrypt(plaintext: string, adata?: string): Promise<string>;
+    decrypt(ciphertext: string): Promise<string>;
+    destroy(): void;
+    private getKeyOrThrow;
+    private getSaltOrThrow;
+    private buildEnvelope;
+}
+/**
+ * v1 (SJCL) shim that satisfies the same contract as EncryptionSession but does not open a
+ * real session. Every encrypt/decrypt call runs its own SJCL PBKDF2 derivation via encrypt() /
+ * decrypt(). Exists so callers that pin `encryptionVersion: 1` can use the same
+ * `createEncryptionSession(pw, ver)` factory as v2 callers — no per-site useV2 branching.
+ * Once the sjcl-replacement rollout removes v1 encrypt, this collapses to nothing.
+ */
+export declare class V1EncryptionSession {
+    private password;
+    constructor(password: string);
+    encrypt(input: string, adata?: string): Promise<string>;
+    decrypt(ciphertext: string): Promise<string>;
+    destroy(): void;
+    private getPasswordOrThrow;
+}
+/**
+ * Create an EncryptionSession.
+ *
+ * When encryptionVersion is undefined or 2 (the default), runs Argon2id once so every
+ * subsequent encrypt/decrypt derives a per-call AES key via HKDF (<1ms, native WebCrypto).
+ *
+ * When encryptionVersion is 1, returns a V1EncryptionSession shim that runs SJCL PBKDF2 on
+ * every call. The shim satisfies the same interface so callers that must produce v1 (SJCL)
+ * envelopes for legacy consumers use one factory regardless of version. No useV2 branching
+ * needed at the call site.
+ *
+ * Callers MUST call destroy() to clear the HKDF root (or retained password in v1 mode) from
+ * memory. Use-after-destroy throws.
+ */
+export declare function createEncryptionSession(password: string, options?: {
+    memorySize?: number;
+    iterations?: number;
+    parallelism?: number;
+    salt?: Uint8Array;
+    encryptionVersion?: 1 | 2;
+}): Promise<EncryptionSession | V1EncryptionSession>;
+//# sourceMappingURL=encryptionSession.d.ts.map

package/dist/src/encryptionSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptionSession.d.ts","sourceRoot":"","sources":["../../src/encryptionSession.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,sEAAsE;gBAEpE,OAAO,EAAE,SAAS,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IASnE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAY3D,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBlD,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;CAYtB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAgB;gBAEpB,QAAQ,EAAE,MAAM;IAItB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIvD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD,OAAO,IAAI,IAAI;IAIf,OAAO,CAAC,kBAAkB;CAM3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CAC3B,GACA,OAAO,CAAC,iBAAiB,GAAG,mBAAmB,CAAC,CAmBlD"}

package/dist/src/encryptionSession.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.V1EncryptionSession = exports.EncryptionSession = void 0;
+exports.createEncryptionSession = createEncryptionSession;
+const crypto_1 = require("crypto");
+const encrypt_1 = require("./encrypt");
+const encryptV2_1 = require("./encryptV2");
+/**
+ * Runs Argon2id once on creation, then derives per-call AES-256-GCM keys via HKDF.
+ * Use when encrypting or decrypting multiple values with the same password.
+ *
+ * Session envelopes are self-describing and can be decrypted standalone via decryptV2.
+ * Call destroy() when done to clear the cached key from memory.
+ */
+class EncryptionSession {
+    /** Use createEncryptionSession() instead of calling this directly. */
+    constructor(hkdfKey, argon2SaltB64, params) {
+        this.hkdfKey = hkdfKey;
+        this.argon2SaltB64 = argon2SaltB64;
+        this.memorySize = params.memorySize;
+        this.iterations = params.iterations;
+        this.parallelism = params.parallelism;
+    }
+    async encrypt(plaintext, adata) {
+        const key = this.getKeyOrThrow();
+        const hkdfSalt = new Uint8Array((0, crypto_1.randomBytes)(encryptV2_1.HKDF_SALT_LENGTH));
+        const iv = new Uint8Array((0, crypto_1.randomBytes)(encryptV2_1.GCM_IV_LENGTH));
+        const adataBytes = adata ? new TextEncoder().encode(adata) : undefined;
+        const aesKey = await (0, encryptV2_1.hkdfDeriveAesKey)(key, hkdfSalt, 'encrypt');
+        const ct = await (0, encryptV2_1.aesGcmEncrypt)(aesKey, iv, plaintext, adataBytes);
+        const envelope = this.buildEnvelope(hkdfSalt, iv, ct);
+        if (adata)
+            envelope.adata = adata;
+        return JSON.stringify(envelope);
+    }
+    async decrypt(ciphertext) {
+        const key = this.getKeyOrThrow();
+        const envelope = (0, encryptV2_1.parseV2Envelope)(ciphertext);
+        if (!envelope.hkdfSalt) {
+            throw new Error('envelope was not encrypted with a session; use decryptV2 instead');
+        }
+        if (envelope.salt !== this.getSaltOrThrow()) {
+            throw new Error('envelope was not encrypted with this session');
+        }
+        const iv = new Uint8Array(Buffer.from(envelope.iv, 'base64'));
+        const ct = new Uint8Array(Buffer.from(envelope.ct, 'base64'));
+        const hkdfSalt = new Uint8Array(Buffer.from(envelope.hkdfSalt, 'base64'));
+        const adataBytes = envelope.adata ? new TextEncoder().encode(envelope.adata) : undefined;
+        const aesKey = await (0, encryptV2_1.hkdfDeriveAesKey)(key, hkdfSalt, 'decrypt');
+        return (0, encryptV2_1.aesGcmDecrypt)(aesKey, iv, ct, adataBytes);
+    }
+    destroy() {
+        this.hkdfKey = null;
+        this.argon2SaltB64 = null;
+    }
+    getKeyOrThrow() {
+        if (this.hkdfKey === null || this.argon2SaltB64 === null) {
+            throw new Error('EncryptionSession has been destroyed');
+        }
+        return this.hkdfKey;
+    }
+    getSaltOrThrow() {
+        if (this.argon2SaltB64 === null) {
+            throw new Error('EncryptionSession has been destroyed');
+        }
+        return this.argon2SaltB64;
+    }
+    buildEnvelope(hkdfSalt, iv, ct) {
+        return {
+            v: 2,
+            m: this.memorySize,
+            t: this.iterations,
+            p: this.parallelism,
+            salt: this.getSaltOrThrow(),
+            hkdfSalt: Buffer.from(hkdfSalt).toString('base64'),
+            iv: Buffer.from(iv).toString('base64'),
+            ct: Buffer.from(ct).toString('base64'),
+        };
+    }
+}
+exports.EncryptionSession = EncryptionSession;
+/**
+ * v1 (SJCL) shim that satisfies the same contract as EncryptionSession but does not open a
+ * real session. Every encrypt/decrypt call runs its own SJCL PBKDF2 derivation via encrypt() /
+ * decrypt(). Exists so callers that pin `encryptionVersion: 1` can use the same
+ * `createEncryptionSession(pw, ver)` factory as v2 callers — no per-site useV2 branching.
+ * Once the sjcl-replacement rollout removes v1 encrypt, this collapses to nothing.
+ */
+class V1EncryptionSession {
+    constructor(password) {
+        this.password = password;
+    }
+    async encrypt(input, adata) {
+        return (0, encrypt_1.encrypt)(this.getPasswordOrThrow(), input, { adata, encryptionVersion: 1 });
+    }
+    async decrypt(ciphertext) {
+        return (0, encrypt_1.decrypt)(this.getPasswordOrThrow(), ciphertext);
+    }
+    destroy() {
+        this.password = null;
+    }
+    getPasswordOrThrow() {
+        if (this.password === null) {
+            throw new Error('V1EncryptionSession has been destroyed');
+        }
+        return this.password;
+    }
+}
+exports.V1EncryptionSession = V1EncryptionSession;
+/**
+ * Create an EncryptionSession.
+ *
+ * When encryptionVersion is undefined or 2 (the default), runs Argon2id once so every
+ * subsequent encrypt/decrypt derives a per-call AES key via HKDF (<1ms, native WebCrypto).
+ *
+ * When encryptionVersion is 1, returns a V1EncryptionSession shim that runs SJCL PBKDF2 on
+ * every call. The shim satisfies the same interface so callers that must produce v1 (SJCL)
+ * envelopes for legacy consumers use one factory regardless of version. No useV2 branching
+ * needed at the call site.
+ *
+ * Callers MUST call destroy() to clear the HKDF root (or retained password in v1 mode) from
+ * memory. Use-after-destroy throws.
+ */
+async function createEncryptionSession(password, options) {
+    if (options?.encryptionVersion === 1) {
+        return new V1EncryptionSession(password);
+    }
+    const memorySize = options?.memorySize ?? encryptV2_1.ARGON2_DEFAULTS.memorySize;
+    const iterations = options?.iterations ?? encryptV2_1.ARGON2_DEFAULTS.iterations;
+    const parallelism = options?.parallelism ?? encryptV2_1.ARGON2_DEFAULTS.parallelism;
+    const params = { memorySize, iterations, parallelism };
+    const argon2Salt = options?.salt ?? new Uint8Array((0, crypto_1.randomBytes)(encryptV2_1.ARGON2_DEFAULTS.saltLength));
+    if (argon2Salt.length !== encryptV2_1.ARGON2_DEFAULTS.saltLength) {
+        throw new Error(`salt must be ${encryptV2_1.ARGON2_DEFAULTS.saltLength} bytes`);
+    }
+    const hkdfKey = await (0, encryptV2_1.argon2ToHkdfKey)(password, argon2Salt, params);
+    const argon2SaltB64 = Buffer.from(argon2Salt).toString('base64');
+    return new EncryptionSession(hkdfKey, argon2SaltB64, params);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvblNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZW5jcnlwdGlvblNlc3Npb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBdUpBLDBEQTRCQztBQW5MRCxtQ0FBcUM7QUFFckMsdUNBQTZDO0FBQzdDLDJDQVVxQjtBQUVyQjs7Ozs7O0dBTUc7QUFDSCxNQUFhLGlCQUFpQjtJQU01QixzRUFBc0U7SUFDdEUsWUFDRSxPQUFrQixFQUNsQixhQUFxQixFQUNyQixNQUF1RTtRQUV2RSxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsYUFBYSxHQUFHLGFBQWEsQ0FBQztRQUNuQyxJQUFJLENBQUMsVUFBVSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7UUFDcEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxNQUFNLENBQUMsVUFBVSxDQUFDO1FBQ3BDLElBQUksQ0FBQyxXQUFXLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQztJQUN4QyxDQUFDO0lBRUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFpQixFQUFFLEtBQWM7UUFDN0MsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sUUFBUSxHQUFHLElBQUksVUFBVSxDQUFDLElBQUEsb0JBQVcsRUFBQyw0QkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDL0QsTUFBTSxFQUFFLEdBQUcsSUFBSSxVQUFVLENBQUMsSUFBQSxvQkFBVyxFQUFDLHlCQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3RELE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUN2RSxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUEsNEJBQWdCLEVBQUMsR0FBRyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQztRQUNoRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEseUJBQWEsRUFBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNsRSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdEQsSUFBSSxLQUFLO1lBQUUsUUFBUSxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDbEMsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xDLENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQWtCO1FBQzlCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNqQyxNQUFNLFFBQVEsR0FBRyxJQUFBLDJCQUFlLEVBQUMsVUFBVSxDQUFDLENBQUM7UUFDN0MsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGtFQUFrRSxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQztZQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELE1BQU0sRUFBRSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQzlELE1BQU0sRUFBRSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQzlELE1BQU0sUUFBUSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQzFFLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3pGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBQSw0QkFBZ0IsRUFBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2hFLE9BQU8sSUFBQSx5QkFBYSxFQUFDLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRCxPQUFPO1FBQ0wsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDcEIsSUFBSSxDQUFDLGFBQWEsR0FBRyxJQUFJLENBQUM7SUFDNUIsQ0FBQztJQUVPLGFBQWE7UUFDbkIsSUFBSSxJQUFJLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxJQUFJLENBQUMsYUFBYSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3pELE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDO0lBQ3RCLENBQUM7SUFFTyxjQUFjO1FBQ3BCLElBQUksSUFBSSxDQUFDLGFBQWEsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNoQyxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGFBQWEsQ0FBQztJQUM1QixDQUFDO0lBRU8sYUFBYSxDQUFDLFFBQW9CLEVBQUUsRUFBYyxFQUFFLEVBQWM7UUFDeEUsT0FBTztZQUNMLENBQUMsRUFBRSxDQUFDO1lBQ0osQ0FBQyxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQ2xCLENBQUMsRUFBRSxJQUFJLENBQUMsVUFBVTtZQUNsQixDQUFDLEVBQUUsSUFBSSxDQUFDLFdBQVc7WUFDbkIsSUFBSSxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUU7WUFDM0IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUNsRCxFQUFFLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQ3RDLEVBQUUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7U0FDdkMsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQS9FRCw4Q0ErRUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFhLG1CQUFtQjtJQUc5QixZQUFZLFFBQWdCO1FBQzFCLElBQUksQ0FBQyxRQUFRLEdBQUcsUUFBUSxDQUFDO0lBQzNCLENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQWEsRUFBRSxLQUFjO1FBQ3pDLE9BQU8sSUFBQSxpQkFBTyxFQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFFRCxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQWtCO1FBQzlCLE9BQU8sSUFBQSxpQkFBTyxFQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFRCxPQUFPO1FBQ0wsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7SUFDdkIsQ0FBQztJQUVPLGtCQUFrQjtRQUN4QixJQUFJLElBQUksQ0FBQyxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUM7SUFDdkIsQ0FBQztDQUNGO0FBekJELGtEQXlCQztBQUVEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSSxLQUFLLFVBQVUsdUJBQXVCLENBQzNDLFFBQWdCLEVBQ2hCLE9BTUM7SUFFRCxJQUFJLE9BQU8sRUFBRSxpQkFBaUIsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxPQUFPLElBQUksbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLE9BQU8sRUFBRSxVQUFVLElBQUksMkJBQWUsQ0FBQyxVQUFVLENBQUM7SUFDckUsTUFBTSxVQUFVLEdBQUcsT0FBTyxFQUFFLFVBQVUsSUFBSSwyQkFBZSxDQUFDLFVBQVUsQ0FBQztJQUNyRSxNQUFNLFdBQVcsR0FBRyxPQUFPLEVBQUUsV0FBVyxJQUFJLDJCQUFlLENBQUMsV0FBVyxDQUFDO0lBQ3hFLE1BQU0sTUFBTSxHQUFHLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsQ0FBQztJQUV2RCxNQUFNLFVBQVUsR0FBRyxPQUFPLEVBQUUsSUFBSSxJQUFJLElBQUksVUFBVSxDQUFDLElBQUEsb0JBQVcsRUFBQywyQkFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDNUYsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLDJCQUFlLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDckQsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsMkJBQWUsQ0FBQyxVQUFVLFFBQVEsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEsMkJBQWUsRUFBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3BFLE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRWpFLE9BQU8sSUFBSSxpQkFBaUIsQ0FBQyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0FBQy9ELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByYW5kb21CeXRlcyB9IGZyb20gJ2NyeXB0byc7XG5cbmltcG9ydCB7IGRlY3J5cHQsIGVuY3J5cHQgfSBmcm9tICcuL2VuY3J5cHQnO1xuaW1wb3J0IHtcbiAgYWVzR2NtRGVjcnlwdCxcbiAgYWVzR2NtRW5jcnlwdCxcbiAgQVJHT04yX0RFRkFVTFRTLFxuICBhcmdvbjJUb0hrZGZLZXksXG4gIEdDTV9JVl9MRU5HVEgsXG4gIGhrZGZEZXJpdmVBZXNLZXksXG4gIEhLREZfU0FMVF9MRU5HVEgsXG4gIHBhcnNlVjJFbnZlbG9wZSxcbiAgVjJFbnZlbG9wZSxcbn0gZnJvbSAnLi9lbmNyeXB0VjInO1xuXG4vKipcbiAqIFJ1bnMgQXJnb24yaWQgb25jZSBvbiBjcmVhdGlvbiwgdGhlbiBkZXJpdmVzIHBlci1jYWxsIEFFUy0yNTYtR0NNIGtleXMgdmlhIEhLREYuXG4gKiBVc2Ugd2hlbiBlbmNyeXB0aW5nIG9yIGRlY3J5cHRpbmcgbXVsdGlwbGUgdmFsdWVzIHdpdGggdGhlIHNhbWUgcGFzc3dvcmQuXG4gKlxuICogU2Vzc2lvbiBlbnZlbG9wZXMgYXJlIHNlbGYtZGVzY3JpYmluZyBhbmQgY2FuIGJlIGRlY3J5cHRlZCBzdGFuZGFsb25lIHZpYSBkZWNyeXB0VjIuXG4gKiBDYWxsIGRlc3Ryb3koKSB3aGVuIGRvbmUgdG8gY2xlYXIgdGhlIGNhY2hlZCBrZXkgZnJvbSBtZW1vcnkuXG4gKi9cbmV4cG9ydCBjbGFzcyBFbmNyeXB0aW9uU2Vzc2lvbiB7XG4gIHByaXZhdGUgaGtkZktleTogQ3J5cHRvS2V5IHwgbnVsbDtcbiAgcHJpdmF0ZSBhcmdvbjJTYWx0QjY0OiBzdHJpbmcgfCBudWxsO1xuICBwcml2YXRlIHJlYWRvbmx5IG1lbW9yeVNpemU6IG51bWJlcjtcbiAgcHJpdmF0ZSByZWFkb25seSBpdGVyYXRpb25zOiBudW1iZXI7XG4gIHByaXZhdGUgcmVhZG9ubHkgcGFyYWxsZWxpc206IG51bWJlcjtcbiAgLyoqIFVzZSBjcmVhdGVFbmNyeXB0aW9uU2Vzc2lvbigpIGluc3RlYWQgb2YgY2FsbGluZyB0aGlzIGRpcmVjdGx5LiAqL1xuICBjb25zdHJ1Y3RvcihcbiAgICBoa2RmS2V5OiBDcnlwdG9LZXksXG4gICAgYXJnb24yU2FsdEI2NDogc3RyaW5nLFxuICAgIHBhcmFtczogeyBtZW1vcnlTaXplOiBudW1iZXI7IGl0ZXJhdGlvbnM6IG51bWJlcjsgcGFyYWxsZWxpc206IG51bWJlciB9XG4gICkge1xuICAgIHRoaXMuaGtkZktleSA9IGhrZGZLZXk7XG4gICAgdGhpcy5hcmdvbjJTYWx0QjY0ID0gYXJnb24yU2FsdEI2NDtcbiAgICB0aGlzLm1lbW9yeVNpemUgPSBwYXJhbXMubWVtb3J5U2l6ZTtcbiAgICB0aGlzLml0ZXJhdGlvbnMgPSBwYXJhbXMuaXRlcmF0aW9ucztcbiAgICB0aGlzLnBhcmFsbGVsaXNtID0gcGFyYW1zLnBhcmFsbGVsaXNtO1xuICB9XG5cbiAgYXN5bmMgZW5jcnlwdChwbGFpbnRleHQ6IHN0cmluZywgYWRhdGE/OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4ge1xuICAgIGNvbnN0IGtleSA9IHRoaXMuZ2V0S2V5T3JUaHJvdygpO1xuICAgIGNvbnN0IGhrZGZTYWx0ID0gbmV3IFVpbnQ4QXJyYXkocmFuZG9tQnl0ZXMoSEtERl9TQUxUX0xFTkdUSCkpO1xuICAgIGNvbnN0IGl2ID0gbmV3IFVpbnQ4QXJyYXkocmFuZG9tQnl0ZXMoR0NNX0lWX0xFTkdUSCkpO1xuICAgIGNvbnN0IGFkYXRhQnl0ZXMgPSBhZGF0YSA/IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShhZGF0YSkgOiB1bmRlZmluZWQ7XG4gICAgY29uc3QgYWVzS2V5ID0gYXdhaXQgaGtkZkRlcml2ZUFlc0tleShrZXksIGhrZGZTYWx0LCAnZW5jcnlwdCcpO1xuICAgIGNvbnN0IGN0ID0gYXdhaXQgYWVzR2NtRW5jcnlwdChhZXNLZXksIGl2LCBwbGFpbnRleHQsIGFkYXRhQnl0ZXMpO1xuICAgIGNvbnN0IGVudmVsb3BlID0gdGhpcy5idWlsZEVudmVsb3BlKGhrZGZTYWx0LCBpdiwgY3QpO1xuICAgIGlmIChhZGF0YSkgZW52ZWxvcGUuYWRhdGEgPSBhZGF0YTtcbiAgICByZXR1cm4gSlNPTi5zdHJpbmdpZnkoZW52ZWxvcGUpO1xuICB9XG5cbiAgYXN5bmMgZGVjcnlwdChjaXBoZXJ0ZXh0OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4ge1xuICAgIGNvbnN0IGtleSA9IHRoaXMuZ2V0S2V5T3JUaHJvdygpO1xuICAgIGNvbnN0IGVudmVsb3BlID0gcGFyc2VWMkVudmVsb3BlKGNpcGhlcnRleHQpO1xuICAgIGlmICghZW52ZWxvcGUuaGtkZlNhbHQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignZW52ZWxvcGUgd2FzIG5vdCBlbmNyeXB0ZWQgd2l0aCBhIHNlc3Npb247IHVzZSBkZWNyeXB0VjIgaW5zdGVhZCcpO1xuICAgIH1cbiAgICBpZiAoZW52ZWxvcGUuc2FsdCAhPT0gdGhpcy5nZXRTYWx0T3JUaHJvdygpKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2VudmVsb3BlIHdhcyBub3QgZW5jcnlwdGVkIHdpdGggdGhpcyBzZXNzaW9uJyk7XG4gICAgfVxuICAgIGNvbnN0IGl2ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20oZW52ZWxvcGUuaXYsICdiYXNlNjQnKSk7XG4gICAgY29uc3QgY3QgPSBuZXcgVWludDhBcnJheShCdWZmZXIuZnJvbShlbnZlbG9wZS5jdCwgJ2Jhc2U2NCcpKTtcbiAgICBjb25zdCBoa2RmU2FsdCA9IG5ldyBVaW50OEFycmF5KEJ1ZmZlci5mcm9tKGVudmVsb3BlLmhrZGZTYWx0LCAnYmFzZTY0JykpO1xuICAgIGNvbnN0IGFkYXRhQnl0ZXMgPSBlbnZlbG9wZS5hZGF0YSA/IG5ldyBUZXh0RW5jb2RlcigpLmVuY29kZShlbnZlbG9wZS5hZGF0YSkgOiB1bmRlZmluZWQ7XG4gICAgY29uc3QgYWVzS2V5ID0gYXdhaXQgaGtkZkRlcml2ZUFlc0tleShrZXksIGhrZGZTYWx0LCAnZGVjcnlwdCcpO1xuICAgIHJldHVybiBhZXNHY21EZWNyeXB0KGFlc0tleSwgaXYsIGN0LCBhZGF0YUJ5dGVzKTtcbiAgfVxuXG4gIGRlc3Ryb3koKTogdm9pZCB7XG4gICAgdGhpcy5oa2RmS2V5ID0gbnVsbDtcbiAgICB0aGlzLmFyZ29uMlNhbHRCNjQgPSBudWxsO1xuICB9XG5cbiAgcHJpdmF0ZSBnZXRLZXlPclRocm93KCk6IENyeXB0b0tleSB7XG4gICAgaWYgKHRoaXMuaGtkZktleSA9PT0gbnVsbCB8fCB0aGlzLmFyZ29uMlNhbHRCNjQgPT09IG51bGwpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignRW5jcnlwdGlvblNlc3Npb24gaGFzIGJlZW4gZGVzdHJveWVkJyk7XG4gICAgfVxuICAgIHJldHVybiB0aGlzLmhrZGZLZXk7XG4gIH1cblxuICBwcml2YXRlIGdldFNhbHRPclRocm93KCk6IHN0cmluZyB7XG4gICAgaWYgKHRoaXMuYXJnb24yU2FsdEI2NCA9PT0gbnVsbCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdFbmNyeXB0aW9uU2Vzc2lvbiBoYXMgYmVlbiBkZXN0cm95ZWQnKTtcbiAgICB9XG4gICAgcmV0dXJuIHRoaXMuYXJnb24yU2FsdEI2NDtcbiAgfVxuXG4gIHByaXZhdGUgYnVpbGRFbnZlbG9wZShoa2RmU2FsdDogVWludDhBcnJheSwgaXY6IFVpbnQ4QXJyYXksIGN0OiBVaW50OEFycmF5KTogVjJFbnZlbG9wZSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIHY6IDIsXG4gICAgICBtOiB0aGlzLm1lbW9yeVNpemUsXG4gICAgICB0OiB0aGlzLml0ZXJhdGlvbnMsXG4gICAgICBwOiB0aGlzLnBhcmFsbGVsaXNtLFxuICAgICAgc2FsdDogdGhpcy5nZXRTYWx0T3JUaHJvdygpLFxuICAgICAgaGtkZlNhbHQ6IEJ1ZmZlci5mcm9tKGhrZGZTYWx0KS50b1N0cmluZygnYmFzZTY0JyksXG4gICAgICBpdjogQnVmZmVyLmZyb20oaXYpLnRvU3RyaW5nKCdiYXNlNjQnKSxcbiAgICAgIGN0OiBCdWZmZXIuZnJvbShjdCkudG9TdHJpbmcoJ2Jhc2U2NCcpLFxuICAgIH07XG4gIH1cbn1cblxuLyoqXG4gKiB2MSAoU0pDTCkgc2hpbSB0aGF0IHNhdGlzZmllcyB0aGUgc2FtZSBjb250cmFjdCBhcyBFbmNyeXB0aW9uU2Vzc2lvbiBidXQgZG9lcyBub3Qgb3BlbiBhXG4gKiByZWFsIHNlc3Npb24uIEV2ZXJ5IGVuY3J5cHQvZGVjcnlwdCBjYWxsIHJ1bnMgaXRzIG93biBTSkNMIFBCS0RGMiBkZXJpdmF0aW9uIHZpYSBlbmNyeXB0KCkgL1xuICogZGVjcnlwdCgpLiBFeGlzdHMgc28gY2FsbGVycyB0aGF0IHBpbiBgZW5jcnlwdGlvblZlcnNpb246IDFgIGNhbiB1c2UgdGhlIHNhbWVcbiAqIGBjcmVhdGVFbmNyeXB0aW9uU2Vzc2lvbihwdywgdmVyKWAgZmFjdG9yeSBhcyB2MiBjYWxsZXJzIOKAlCBubyBwZXItc2l0ZSB1c2VWMiBicmFuY2hpbmcuXG4gKiBPbmNlIHRoZSBzamNsLXJlcGxhY2VtZW50IHJvbGxvdXQgcmVtb3ZlcyB2MSBlbmNyeXB0LCB0aGlzIGNvbGxhcHNlcyB0byBub3RoaW5nLlxuICovXG5leHBvcnQgY2xhc3MgVjFFbmNyeXB0aW9uU2Vzc2lvbiB7XG4gIHByaXZhdGUgcGFzc3dvcmQ6IHN0cmluZyB8IG51bGw7XG5cbiAgY29uc3RydWN0b3IocGFzc3dvcmQ6IHN0cmluZykge1xuICAgIHRoaXMucGFzc3dvcmQgPSBwYXNzd29yZDtcbiAgfVxuXG4gIGFzeW5jIGVuY3J5cHQoaW5wdXQ6IHN0cmluZywgYWRhdGE/OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4ge1xuICAgIHJldHVybiBlbmNyeXB0KHRoaXMuZ2V0UGFzc3dvcmRPclRocm93KCksIGlucHV0LCB7IGFkYXRhLCBlbmNyeXB0aW9uVmVyc2lvbjogMSB9KTtcbiAgfVxuXG4gIGFzeW5jIGRlY3J5cHQoY2lwaGVydGV4dDogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgICByZXR1cm4gZGVjcnlwdCh0aGlzLmdldFBhc3N3b3JkT3JUaHJvdygpLCBjaXBoZXJ0ZXh0KTtcbiAgfVxuXG4gIGRlc3Ryb3koKTogdm9pZCB7XG4gICAgdGhpcy5wYXNzd29yZCA9IG51bGw7XG4gIH1cblxuICBwcml2YXRlIGdldFBhc3N3b3JkT3JUaHJvdygpOiBzdHJpbmcge1xuICAgIGlmICh0aGlzLnBhc3N3b3JkID09PSBudWxsKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ1YxRW5jcnlwdGlvblNlc3Npb24gaGFzIGJlZW4gZGVzdHJveWVkJyk7XG4gICAgfVxuICAgIHJldHVybiB0aGlzLnBhc3N3b3JkO1xuICB9XG59XG5cbi8qKlxuICogQ3JlYXRlIGFuIEVuY3J5cHRpb25TZXNzaW9uLlxuICpcbiAqIFdoZW4gZW5jcnlwdGlvblZlcnNpb24gaXMgdW5kZWZpbmVkIG9yIDIgKHRoZSBkZWZhdWx0KSwgcnVucyBBcmdvbjJpZCBvbmNlIHNvIGV2ZXJ5XG4gKiBzdWJzZXF1ZW50IGVuY3J5cHQvZGVjcnlwdCBkZXJpdmVzIGEgcGVyLWNhbGwgQUVTIGtleSB2aWEgSEtERiAoPDFtcywgbmF0aXZlIFdlYkNyeXB0bykuXG4gKlxuICogV2hlbiBlbmNyeXB0aW9uVmVyc2lvbiBpcyAxLCByZXR1cm5zIGEgVjFFbmNyeXB0aW9uU2Vzc2lvbiBzaGltIHRoYXQgcnVucyBTSkNMIFBCS0RGMiBvblxuICogZXZlcnkgY2FsbC4gVGhlIHNoaW0gc2F0aXNmaWVzIHRoZSBzYW1lIGludGVyZmFjZSBzbyBjYWxsZXJzIHRoYXQgbXVzdCBwcm9kdWNlIHYxIChTSkNMKVxuICogZW52ZWxvcGVzIGZvciBsZWdhY3kgY29uc3VtZXJzIHVzZSBvbmUgZmFjdG9yeSByZWdhcmRsZXNzIG9mIHZlcnNpb24uIE5vIHVzZVYyIGJyYW5jaGluZ1xuICogbmVlZGVkIGF0IHRoZSBjYWxsIHNpdGUuXG4gKlxuICogQ2FsbGVycyBNVVNUIGNhbGwgZGVzdHJveSgpIHRvIGNsZWFyIHRoZSBIS0RGIHJvb3QgKG9yIHJldGFpbmVkIHBhc3N3b3JkIGluIHYxIG1vZGUpIGZyb21cbiAqIG1lbW9yeS4gVXNlLWFmdGVyLWRlc3Ryb3kgdGhyb3dzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY3JlYXRlRW5jcnlwdGlvblNlc3Npb24oXG4gIHBhc3N3b3JkOiBzdHJpbmcsXG4gIG9wdGlvbnM/OiB7XG4gICAgbWVtb3J5U2l6ZT86IG51bWJlcjtcbiAgICBpdGVyYXRpb25zPzogbnVtYmVyO1xuICAgIHBhcmFsbGVsaXNtPzogbnVtYmVyO1xuICAgIHNhbHQ/OiBVaW50OEFycmF5O1xuICAgIGVuY3J5cHRpb25WZXJzaW9uPzogMSB8IDI7XG4gIH1cbik6IFByb21pc2U8RW5jcnlwdGlvblNlc3Npb24gfCBWMUVuY3J5cHRpb25TZXNzaW9uPiB7XG4gIGlmIChvcHRpb25zPy5lbmNyeXB0aW9uVmVyc2lvbiA9PT0gMSkge1xuICAgIHJldHVybiBuZXcgVjFFbmNyeXB0aW9uU2Vzc2lvbihwYXNzd29yZCk7XG4gIH1cblxuICBjb25zdCBtZW1vcnlTaXplID0gb3B0aW9ucz8ubWVtb3J5U2l6ZSA/PyBBUkdPTjJfREVGQVVMVFMubWVtb3J5U2l6ZTtcbiAgY29uc3QgaXRlcmF0aW9ucyA9IG9wdGlvbnM/Lml0ZXJhdGlvbnMgPz8gQVJHT04yX0RFRkFVTFRTLml0ZXJhdGlvbnM7XG4gIGNvbnN0IHBhcmFsbGVsaXNtID0gb3B0aW9ucz8ucGFyYWxsZWxpc20gPz8gQVJHT04yX0RFRkFVTFRTLnBhcmFsbGVsaXNtO1xuICBjb25zdCBwYXJhbXMgPSB7IG1lbW9yeVNpemUsIGl0ZXJhdGlvbnMsIHBhcmFsbGVsaXNtIH07XG5cbiAgY29uc3QgYXJnb24yU2FsdCA9IG9wdGlvbnM/LnNhbHQgPz8gbmV3IFVpbnQ4QXJyYXkocmFuZG9tQnl0ZXMoQVJHT04yX0RFRkFVTFRTLnNhbHRMZW5ndGgpKTtcbiAgaWYgKGFyZ29uMlNhbHQubGVuZ3RoICE9PSBBUkdPTjJfREVGQVVMVFMuc2FsdExlbmd0aCkge1xuICAgIHRocm93IG5ldyBFcnJvcihgc2FsdCBtdXN0IGJlICR7QVJHT04yX0RFRkFVTFRTLnNhbHRMZW5ndGh9IGJ5dGVzYCk7XG4gIH1cblxuICBjb25zdCBoa2RmS2V5ID0gYXdhaXQgYXJnb24yVG9Ia2RmS2V5KHBhc3N3b3JkLCBhcmdvbjJTYWx0LCBwYXJhbXMpO1xuICBjb25zdCBhcmdvbjJTYWx0QjY0ID0gQnVmZmVyLmZyb20oYXJnb24yU2FsdCkudG9TdHJpbmcoJ2Jhc2U2NCcpO1xuXG4gIHJldHVybiBuZXcgRW5jcnlwdGlvblNlc3Npb24oaGtkZktleSwgYXJnb24yU2FsdEI2NCwgcGFyYW1zKTtcbn1cbiJdfQ==

package/dist/src/index.d.ts

@@ -1,6 +1,9 @@
 export * from './api';
 export * from './bitgoAPI';
+export * from './decryptV1';
 export * from './encrypt';
+export * from './encryptionSession';
+export * from './encryptV2';
 export * from './util';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC"}

package/dist/src/index.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
@@ -12,7 +16,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./api"), exports);
 __exportStar(require("./bitgoAPI"), exports);
+__exportStar(require("./decryptV1"), exports);
 __exportStar(require("./encrypt"), exports);
+__exportStar(require("./encryptionSession"), exports);
+__exportStar(require("./encryptV2"), exports);
 __exportStar(require("./util"), exports);
 __exportStar(require("./types"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7O0FBQUEsd0NBQXNCO0FBQ3RCLDZDQUEyQjtBQUMzQiw0Q0FBMEI7QUFDMUIseUNBQXVCO0FBQ3ZCLDBDQUF3QiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXBpJztcbmV4cG9ydCAqIGZyb20gJy4vYml0Z29BUEknO1xuZXhwb3J0ICogZnJvbSAnLi9lbmNyeXB0JztcbmV4cG9ydCAqIGZyb20gJy4vdXRpbCc7XG5leHBvcnQgKiBmcm9tICcuL3R5cGVzJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHdDQUFzQjtBQUN0Qiw2Q0FBMkI7QUFDM0IsOENBQTRCO0FBQzVCLDRDQUEwQjtBQUMxQixzREFBb0M7QUFDcEMsOENBQTRCO0FBQzVCLHlDQUF1QjtBQUN2QiwwQ0FBd0IiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2FwaSc7XG5leHBvcnQgKiBmcm9tICcuL2JpdGdvQVBJJztcbmV4cG9ydCAqIGZyb20gJy4vZGVjcnlwdFYxJztcbmV4cG9ydCAqIGZyb20gJy4vZW5jcnlwdCc7XG5leHBvcnQgKiBmcm9tICcuL2VuY3J5cHRpb25TZXNzaW9uJztcbmV4cG9ydCAqIGZyb20gJy4vZW5jcnlwdFYyJztcbmV4cG9ydCAqIGZyb20gJy4vdXRpbCc7XG5leHBvcnQgKiBmcm9tICcuL3R5cGVzJztcbiJdfQ==