@bitgo-beta/sdk-core 8.2.1-beta.198 → 8.2.1-beta.1981

package/dist/src/bitgo/wallet/safeKeychain.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @prettier
+ */
+import { BitGoBase } from '../bitgoBase';
+import { IKeychains, Keychain, KeychainWithEncryptedPrv } from '../keychain';
+export declare class InvalidRootKeychainSourceError extends Error {
+    constructor(id: string, source: string | undefined);
+}
+/** Thrown when hardened derivation does not match the registered child public key. */
+export declare class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId: string, expectedPub: string, derivedPub: string);
+}
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+export declare class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId: string, detail: string);
+}
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+export declare function isSafeChildPublicOnlyKeychain(walletSafeId: string | undefined, keychain: Keychain | undefined): keychain is Keychain & {
+    parent: string;
+};
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+export declare function fetchRootKeychainForSafeChild(keychains: IKeychains, childKeychain: Keychain): Promise<KeychainWithEncryptedPrv>;
+export interface ResolveSafeOwnerSigningPrvParams {
+    bitgo: BitGoBase;
+    keychains: IKeychains;
+    walletId: string;
+    /** Onchain secp256k1: hardened-derive and verify pub. Other slots throw. */
+    multisigType: string | undefined;
+    coinFamily: string;
+    childKeychain: Keychain;
+    walletPassphrase: string;
+    /** When already fetched (passphrase preflight), skip a second GET. */
+    rootKeychain?: KeychainWithEncryptedPrv;
+}
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root → walk sequential `m/<n>'` children until the
+ * registered pub matches (the mint index is not stored on the child key).
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+export declare function resolveSafeOwnerSigningPrv(params: ResolveSafeOwnerSigningPrvParams): Promise<string>;
+//# sourceMappingURL=safeKeychain.d.ts.map

package/dist/src/bitgo/wallet/safeKeychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeKeychain.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/wallet/safeKeychain.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAA6B,UAAU,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAIxG,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAOnD;AAED,sFAAsF;AACtF,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAOtE;AAED,kGAAkG;AAClG,qBAAa,mCAAoC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAKD;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,QAAQ,IAAI,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAE3C;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,UAAU,EACrB,aAAa,EAAE,QAAQ,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAYnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,QAAQ,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,gCAAgC,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC1G"}

package/dist/src/bitgo/wallet/safeKeychain.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeOwnerSigningNotImplementedError = exports.SafeDerivedPublicKeyMismatchError = exports.InvalidRootKeychainSourceError = void 0;
+exports.isSafeChildPublicOnlyKeychain = isSafeChildPublicOnlyKeychain;
+exports.fetchRootKeychainForSafeChild = fetchRootKeychainForSafeChild;
+exports.resolveSafeOwnerSigningPrv = resolveSafeOwnerSigningPrv;
+const keychain_1 = require("../keychain");
+const safeDerivation_1 = require("../safe/safeDerivation");
+const errors_1 = require("../errors");
+class InvalidRootKeychainSourceError extends Error {
+    constructor(id, source) {
+        super(`Root keychain ${id} has source '${source ?? 'unknown'}'; expected 'user'. ` +
+            `Using a backup or BitGo root would fail at signing.`);
+        this.name = 'InvalidRootKeychainSourceError';
+    }
+}
+exports.InvalidRootKeychainSourceError = InvalidRootKeychainSourceError;
+/** Thrown when hardened derivation does not match the registered child public key. */
+class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId, expectedPub, derivedPub) {
+        super(`Safe wallet ${walletId}: derived child public key does not match the registered user key. ` +
+            `Expected ${expectedPub}, got ${derivedPub}.`);
+        this.name = 'SafeDerivedPublicKeyMismatchError';
+    }
+}
+exports.SafeDerivedPublicKeyMismatchError = SafeDerivedPublicKeyMismatchError;
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId, detail) {
+        super(`Safe wallet ${walletId}: ${detail}`);
+        this.name = 'SafeOwnerSigningNotImplementedError';
+    }
+}
+exports.SafeOwnerSigningNotImplementedError = SafeOwnerSigningNotImplementedError;
+/** ed25519 onchain multisig (slot ④). Needs SLIP-0010, not secp256k1 BIP32. */
+const ED25519_ONCHAIN_FAMILIES = new Set(['algo', 'xlm', 'hbar']);
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+function isSafeChildPublicOnlyKeychain(walletSafeId, keychain) {
+    return !!(walletSafeId && keychain?.parent && !keychain.encryptedPrv);
+}
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+async function fetchRootKeychainForSafeChild(keychains, childKeychain) {
+    if (!childKeychain.parent) {
+        throw new Error('childKeychain.parent is required to fetch the root keychain');
+    }
+    const root = await keychains.get({ id: childKeychain.parent });
+    if (root.source !== 'user') {
+        throw new InvalidRootKeychainSourceError(root.id, root.source);
+    }
+    if (!root.encryptedPrv) {
+        throw new Error(`root keychain ${root.id} does not have property encryptedPrv`);
+    }
+    return root;
+}
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root → walk sequential `m/<n>'` children until the
+ * registered pub matches (the mint index is not stored on the child key).
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+async function resolveSafeOwnerSigningPrv(params) {
+    const { bitgo, keychains, walletId, multisigType, coinFamily, childKeychain, walletPassphrase } = params;
+    if (multisigType !== 'onchain') {
+        throw new SafeOwnerSigningNotImplementedError(walletId, 'TSS owner signing from the root keyshare is not implemented. ' +
+            'Returning the root private key would expose material that can derive every child in this slot.');
+    }
+    if (ED25519_ONCHAIN_FAMILIES.has(coinFamily)) {
+        throw new SafeOwnerSigningNotImplementedError(walletId, `ed25519 multisig owner derivation (${coinFamily}) is not implemented; BIP32 would produce the wrong child key.`);
+    }
+    const rootKeychain = params.rootKeychain ?? (await fetchRootKeychainForSafeChild(keychains, childKeychain));
+    const rootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(bitgo, rootKeychain, walletPassphrase);
+    if (!rootPrv) {
+        throw new errors_1.IncorrectPasswordError();
+    }
+    if (!childKeychain.pub) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing pub for pre-sign verification`);
+    }
+    try {
+        const derived = (0, safeDerivation_1.deriveSafeChildHardenedMatchingPub)(rootPrv, childKeychain.pub);
+        return derived.prv;
+    }
+    catch (e) {
+        const detail = e instanceof Error ? e.message : String(e);
+        throw new SafeDerivedPublicKeyMismatchError(walletId, childKeychain.pub, detail);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2FmZUtleWNoYWluLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3dhbGxldC9zYWZlS2V5Y2hhaW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBNENBLHNFQUtDO0FBTUQsc0VBZUM7QUF5QkQsZ0VBa0NDO0FBN0hELDBDQUF3RztBQUN4RywyREFBNEU7QUFDNUUsc0NBQW1EO0FBRW5ELE1BQWEsOEJBQStCLFNBQVEsS0FBSztJQUN2RCxZQUFZLEVBQVUsRUFBRSxNQUEwQjtRQUNoRCxLQUFLLENBQ0gsaUJBQWlCLEVBQUUsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLHNCQUFzQjtZQUMxRSxxREFBcUQsQ0FDeEQsQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLEdBQUcsZ0NBQWdDLENBQUM7SUFDL0MsQ0FBQztDQUNGO0FBUkQsd0VBUUM7QUFFRCxzRkFBc0Y7QUFDdEYsTUFBYSxpQ0FBa0MsU0FBUSxLQUFLO0lBQzFELFlBQVksUUFBZ0IsRUFBRSxXQUFtQixFQUFFLFVBQWtCO1FBQ25FLEtBQUssQ0FDSCxlQUFlLFFBQVEscUVBQXFFO1lBQzFGLFlBQVksV0FBVyxTQUFTLFVBQVUsR0FBRyxDQUNoRCxDQUFDO1FBQ0YsSUFBSSxDQUFDLElBQUksR0FBRyxtQ0FBbUMsQ0FBQztJQUNsRCxDQUFDO0NBQ0Y7QUFSRCw4RUFRQztBQUVELGtHQUFrRztBQUNsRyxNQUFhLG1DQUFvQyxTQUFRLEtBQUs7SUFDNUQsWUFBWSxRQUFnQixFQUFFLE1BQWM7UUFDMUMsS0FBSyxDQUFDLGVBQWUsUUFBUSxLQUFLLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxxQ0FBcUMsQ0FBQztJQUNwRCxDQUFDO0NBQ0Y7QUFMRCxrRkFLQztBQUVELCtFQUErRTtBQUMvRSxNQUFNLHdCQUF3QixHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRWxFOzs7R0FHRztBQUNILFNBQWdCLDZCQUE2QixDQUMzQyxZQUFnQyxFQUNoQyxRQUE4QjtJQUU5QixPQUFPLENBQUMsQ0FBQyxDQUFDLFlBQVksSUFBSSxRQUFRLEVBQUUsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3hFLENBQUM7QUFFRDs7O0dBR0c7QUFDSSxLQUFLLFVBQVUsNkJBQTZCLENBQ2pELFNBQXFCLEVBQ3JCLGFBQXVCO0lBRXZCLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEVBQUUsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDL0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSw4QkFBOEIsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlCQUFpQixJQUFJLENBQUMsRUFBRSxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLElBQWdDLENBQUM7QUFDMUMsQ0FBQztBQWVEOzs7Ozs7Ozs7R0FTRztBQUNJLEtBQUssVUFBVSwwQkFBMEIsQ0FBQyxNQUF3QztJQUN2RixNQUFNLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFekcsSUFBSSxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDL0IsTUFBTSxJQUFJLG1DQUFtQyxDQUMzQyxRQUFRLEVBQ1IsK0RBQStEO1lBQzdELGdHQUFnRyxDQUNuRyxDQUFDO0lBQ0osQ0FBQztJQUNELElBQUksd0JBQXdCLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDN0MsTUFBTSxJQUFJLG1DQUFtQyxDQUMzQyxRQUFRLEVBQ1Isc0NBQXNDLFVBQVUsZ0VBQWdFLENBQ2pILENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLFlBQVksSUFBSSxDQUFDLE1BQU0sNkJBQTZCLENBQUMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDNUcsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFBLG9DQUF5QixFQUFDLEtBQUssRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztJQUN2RixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksK0JBQXNCLEVBQUUsQ0FBQztJQUNyQyxDQUFDO0lBRUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGVBQWUsUUFBUSwyREFBMkQsQ0FBQyxDQUFDO0lBQ3RHLENBQUM7SUFFRCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxJQUFBLG1EQUFrQyxFQUFDLE9BQU8sRUFBRSxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDL0UsT0FBTyxPQUFPLENBQUMsR0FBRyxDQUFDO0lBQ3JCLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsTUFBTSxNQUFNLEdBQUcsQ0FBQyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzFELE1BQU0sSUFBSSxpQ0FBaUMsQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNuRixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQHByZXR0aWVyXG4gKi9cbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5pbXBvcnQgeyBkZWNyeXB0S2V5Y2hhaW5Qcml2YXRlS2V5LCBJS2V5Y2hhaW5zLCBLZXljaGFpbiwgS2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2IH0gZnJvbSAnLi4va2V5Y2hhaW4nO1xuaW1wb3J0IHsgZGVyaXZlU2FmZUNoaWxkSGFyZGVuZWRNYXRjaGluZ1B1YiB9IGZyb20gJy4uL3NhZmUvc2FmZURlcml2YXRpb24nO1xuaW1wb3J0IHsgSW5jb3JyZWN0UGFzc3dvcmRFcnJvciB9IGZyb20gJy4uL2Vycm9ycyc7XG5cbmV4cG9ydCBjbGFzcyBJbnZhbGlkUm9vdEtleWNoYWluU291cmNlRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKGlkOiBzdHJpbmcsIHNvdXJjZTogc3RyaW5nIHwgdW5kZWZpbmVkKSB7XG4gICAgc3VwZXIoXG4gICAgICBgUm9vdCBrZXljaGFpbiAke2lkfSBoYXMgc291cmNlICcke3NvdXJjZSA/PyAndW5rbm93bid9JzsgZXhwZWN0ZWQgJ3VzZXInLiBgICtcbiAgICAgICAgYFVzaW5nIGEgYmFja3VwIG9yIEJpdEdvIHJvb3Qgd291bGQgZmFpbCBhdCBzaWduaW5nLmBcbiAgICApO1xuICAgIHRoaXMubmFtZSA9ICdJbnZhbGlkUm9vdEtleWNoYWluU291cmNlRXJyb3InO1xuICB9XG59XG5cbi8qKiBUaHJvd24gd2hlbiBoYXJkZW5lZCBkZXJpdmF0aW9uIGRvZXMgbm90IG1hdGNoIHRoZSByZWdpc3RlcmVkIGNoaWxkIHB1YmxpYyBrZXkuICovXG5leHBvcnQgY2xhc3MgU2FmZURlcml2ZWRQdWJsaWNLZXlNaXNtYXRjaEVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICBjb25zdHJ1Y3Rvcih3YWxsZXRJZDogc3RyaW5nLCBleHBlY3RlZFB1Yjogc3RyaW5nLCBkZXJpdmVkUHViOiBzdHJpbmcpIHtcbiAgICBzdXBlcihcbiAgICAgIGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogZGVyaXZlZCBjaGlsZCBwdWJsaWMga2V5IGRvZXMgbm90IG1hdGNoIHRoZSByZWdpc3RlcmVkIHVzZXIga2V5LiBgICtcbiAgICAgICAgYEV4cGVjdGVkICR7ZXhwZWN0ZWRQdWJ9LCBnb3QgJHtkZXJpdmVkUHVifS5gXG4gICAgKTtcbiAgICB0aGlzLm5hbWUgPSAnU2FmZURlcml2ZWRQdWJsaWNLZXlNaXNtYXRjaEVycm9yJztcbiAgfVxufVxuXG4vKiogVGhyb3duIHdoZW4gb3duZXIgc2lnbmluZyBpcyBub3QgaW1wbGVtZW50ZWQgZm9yIHRoaXMgc2FmZSBzbG90IChUU1MsIGVkMjU1MTkgbXVsdGlzaWcsIOKApikuICovXG5leHBvcnQgY2xhc3MgU2FmZU93bmVyU2lnbmluZ05vdEltcGxlbWVudGVkRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKHdhbGxldElkOiBzdHJpbmcsIGRldGFpbDogc3RyaW5nKSB7XG4gICAgc3VwZXIoYFNhZmUgd2FsbGV0ICR7d2FsbGV0SWR9OiAke2RldGFpbH1gKTtcbiAgICB0aGlzLm5hbWUgPSAnU2FmZU93bmVyU2lnbmluZ05vdEltcGxlbWVudGVkRXJyb3InO1xuICB9XG59XG5cbi8qKiBlZDI1NTE5IG9uY2hhaW4gbXVsdGlzaWcgKHNsb3Qg4pGjKS4gTmVlZHMgU0xJUC0wMDEwLCBub3Qgc2VjcDI1NmsxIEJJUDMyLiAqL1xuY29uc3QgRUQyNTUxOV9PTkNIQUlOX0ZBTUlMSUVTID0gbmV3IFNldChbJ2FsZ28nLCAneGxtJywgJ2hiYXInXSk7XG5cbi8qKlxuICogVHJ1ZSB3aGVuIHRoaXMgaXMgdGhlIHNhZmUgbWludGVyJ3MgdXNlciBrZXk6IHdhbGxldCBpcyBpbiBhIHNhZmUsIHRoZSBrZXlcbiAqIGhhcyBhIHBhcmVudCByb290LCBhbmQgdGhlcmUgaXMgbm8gY2hpbGQtbGV2ZWwgZW5jcnlwdGVkUHJ2IChzaGFyZWVzIGhhdmUgb25lKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzU2FmZUNoaWxkUHVibGljT25seUtleWNoYWluKFxuICB3YWxsZXRTYWZlSWQ6IHN0cmluZyB8IHVuZGVmaW5lZCxcbiAga2V5Y2hhaW46IEtleWNoYWluIHwgdW5kZWZpbmVkXG4pOiBrZXljaGFpbiBpcyBLZXljaGFpbiAmIHsgcGFyZW50OiBzdHJpbmcgfSB7XG4gIHJldHVybiAhISh3YWxsZXRTYWZlSWQgJiYga2V5Y2hhaW4/LnBhcmVudCAmJiAha2V5Y2hhaW4uZW5jcnlwdGVkUHJ2KTtcbn1cblxuLyoqXG4gKiBGZXRjaCB0aGUgcm9vdCB1c2VyIGtleWNoYWluIGZvciBhIHNhZmUgY2hpbGQga2V5LlxuICogUmVxdWlyZXMgYHNvdXJjZSA9PT0gJ3VzZXInYCBzbyBhIG1pc2NvbmZpZ3VyZWQgcGFyZW50IGZhaWxzIGVhcmx5LlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZmV0Y2hSb290S2V5Y2hhaW5Gb3JTYWZlQ2hpbGQoXG4gIGtleWNoYWluczogSUtleWNoYWlucyxcbiAgY2hpbGRLZXljaGFpbjogS2V5Y2hhaW5cbik6IFByb21pc2U8S2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2PiB7XG4gIGlmICghY2hpbGRLZXljaGFpbi5wYXJlbnQpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2NoaWxkS2V5Y2hhaW4ucGFyZW50IGlzIHJlcXVpcmVkIHRvIGZldGNoIHRoZSByb290IGtleWNoYWluJyk7XG4gIH1cbiAgY29uc3Qgcm9vdCA9IGF3YWl0IGtleWNoYWlucy5nZXQoeyBpZDogY2hpbGRLZXljaGFpbi5wYXJlbnQgfSk7XG4gIGlmIChyb290LnNvdXJjZSAhPT0gJ3VzZXInKSB7XG4gICAgdGhyb3cgbmV3IEludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvcihyb290LmlkLCByb290LnNvdXJjZSk7XG4gIH1cbiAgaWYgKCFyb290LmVuY3J5cHRlZFBydikge1xuICAgIHRocm93IG5ldyBFcnJvcihgcm9vdCBrZXljaGFpbiAke3Jvb3QuaWR9IGRvZXMgbm90IGhhdmUgcHJvcGVydHkgZW5jcnlwdGVkUHJ2YCk7XG4gIH1cbiAgcmV0dXJuIHJvb3QgYXMgS2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2O1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFJlc29sdmVTYWZlT3duZXJTaWduaW5nUHJ2UGFyYW1zIHtcbiAgYml0Z286IEJpdEdvQmFzZTtcbiAga2V5Y2hhaW5zOiBJS2V5Y2hhaW5zO1xuICB3YWxsZXRJZDogc3RyaW5nO1xuICAvKiogT25jaGFpbiBzZWNwMjU2azE6IGhhcmRlbmVkLWRlcml2ZSBhbmQgdmVyaWZ5IHB1Yi4gT3RoZXIgc2xvdHMgdGhyb3cuICovXG4gIG11bHRpc2lnVHlwZTogc3RyaW5nIHwgdW5kZWZpbmVkO1xuICBjb2luRmFtaWx5OiBzdHJpbmc7XG4gIGNoaWxkS2V5Y2hhaW46IEtleWNoYWluO1xuICB3YWxsZXRQYXNzcGhyYXNlOiBzdHJpbmc7XG4gIC8qKiBXaGVuIGFscmVhZHkgZmV0Y2hlZCAocGFzc3BocmFzZSBwcmVmbGlnaHQpLCBza2lwIGEgc2Vjb25kIEdFVC4gKi9cbiAgcm9vdEtleWNoYWluPzogS2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2O1xufVxuXG4vKipcbiAqIFJlc29sdmUgc2lnbmluZyBtYXRlcmlhbCBmb3IgYSBzYWZlIG93bmVyIChjaGlsZCBrZXkgaGFzIG5vIGVuY3J5cHRlZFBydikuXG4gKlxuICogT25jaGFpbiBzZWNwMjU2azE6IGRlY3J5cHQgcm9vdCDihpIgd2FsayBzZXF1ZW50aWFsIGBtLzxuPidgIGNoaWxkcmVuIHVudGlsIHRoZVxuICogcmVnaXN0ZXJlZCBwdWIgbWF0Y2hlcyAodGhlIG1pbnQgaW5kZXggaXMgbm90IHN0b3JlZCBvbiB0aGUgY2hpbGQga2V5KS5cbiAqIFRTUyBhbmQgZWQyNTUxOSBvbmNoYWluOiB0aHJvdyDigJQgZG8gbm90IHJldHVybiByb290IG1hdGVyaWFsIG9yIEJJUDMyLWRlcml2ZSB0aGUgd3JvbmcgY3VydmUuXG4gKlxuICogRG8gbm90IHVzZSBmb3Igd2FsbGV0IHNoYXJpbmcg4oCUIHRoYXQgbXVzdCBub3QgcmVjZWl2ZSByb290IGtleSBtYXRlcmlhbC5cbiAqIENhbGwgb25seSB3aGVuIGBpc1NhZmVDaGlsZFB1YmxpY09ubHlLZXljaGFpbmAgaXMgdHJ1ZS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVTYWZlT3duZXJTaWduaW5nUHJ2KHBhcmFtczogUmVzb2x2ZVNhZmVPd25lclNpZ25pbmdQcnZQYXJhbXMpOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCB7IGJpdGdvLCBrZXljaGFpbnMsIHdhbGxldElkLCBtdWx0aXNpZ1R5cGUsIGNvaW5GYW1pbHksIGNoaWxkS2V5Y2hhaW4sIHdhbGxldFBhc3NwaHJhc2UgfSA9IHBhcmFtcztcblxuICBpZiAobXVsdGlzaWdUeXBlICE9PSAnb25jaGFpbicpIHtcbiAgICB0aHJvdyBuZXcgU2FmZU93bmVyU2lnbmluZ05vdEltcGxlbWVudGVkRXJyb3IoXG4gICAgICB3YWxsZXRJZCxcbiAgICAgICdUU1Mgb3duZXIgc2lnbmluZyBmcm9tIHRoZSByb290IGtleXNoYXJlIGlzIG5vdCBpbXBsZW1lbnRlZC4gJyArXG4gICAgICAgICdSZXR1cm5pbmcgdGhlIHJvb3QgcHJpdmF0ZSBrZXkgd291bGQgZXhwb3NlIG1hdGVyaWFsIHRoYXQgY2FuIGRlcml2ZSBldmVyeSBjaGlsZCBpbiB0aGlzIHNsb3QuJ1xuICAgICk7XG4gIH1cbiAgaWYgKEVEMjU1MTlfT05DSEFJTl9GQU1JTElFUy5oYXMoY29pbkZhbWlseSkpIHtcbiAgICB0aHJvdyBuZXcgU2FmZU93bmVyU2lnbmluZ05vdEltcGxlbWVudGVkRXJyb3IoXG4gICAgICB3YWxsZXRJZCxcbiAgICAgIGBlZDI1NTE5IG11bHRpc2lnIG93bmVyIGRlcml2YXRpb24gKCR7Y29pbkZhbWlseX0pIGlzIG5vdCBpbXBsZW1lbnRlZDsgQklQMzIgd291bGQgcHJvZHVjZSB0aGUgd3JvbmcgY2hpbGQga2V5LmBcbiAgICApO1xuICB9XG5cbiAgY29uc3Qgcm9vdEtleWNoYWluID0gcGFyYW1zLnJvb3RLZXljaGFpbiA/PyAoYXdhaXQgZmV0Y2hSb290S2V5Y2hhaW5Gb3JTYWZlQ2hpbGQoa2V5Y2hhaW5zLCBjaGlsZEtleWNoYWluKSk7XG4gIGNvbnN0IHJvb3RQcnYgPSBhd2FpdCBkZWNyeXB0S2V5Y2hhaW5Qcml2YXRlS2V5KGJpdGdvLCByb290S2V5Y2hhaW4sIHdhbGxldFBhc3NwaHJhc2UpO1xuICBpZiAoIXJvb3RQcnYpIHtcbiAgICB0aHJvdyBuZXcgSW5jb3JyZWN0UGFzc3dvcmRFcnJvcigpO1xuICB9XG5cbiAgaWYgKCFjaGlsZEtleWNoYWluLnB1Yikge1xuICAgIHRocm93IG5ldyBFcnJvcihgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06IGNoaWxkIGtleWNoYWluIGlzIG1pc3NpbmcgcHViIGZvciBwcmUtc2lnbiB2ZXJpZmljYXRpb25gKTtcbiAgfVxuXG4gIHRyeSB7XG4gICAgY29uc3QgZGVyaXZlZCA9IGRlcml2ZVNhZmVDaGlsZEhhcmRlbmVkTWF0Y2hpbmdQdWIocm9vdFBydiwgY2hpbGRLZXljaGFpbi5wdWIpO1xuICAgIHJldHVybiBkZXJpdmVkLnBydjtcbiAgfSBjYXRjaCAoZSkge1xuICAgIGNvbnN0IGRldGFpbCA9IGUgaW5zdGFuY2VvZiBFcnJvciA/IGUubWVzc2FnZSA6IFN0cmluZyhlKTtcbiAgICB0aHJvdyBuZXcgU2FmZURlcml2ZWRQdWJsaWNLZXlNaXNtYXRjaEVycm9yKHdhbGxldElkLCBjaGlsZEtleWNoYWluLnB1YiwgZGV0YWlsKTtcbiAgfVxufVxuIl19