@bitgo-beta/sdk-core 8.2.1-beta.202 → 8.2.1-beta.2021

package/dist/src/bitgo/safe/derivableEd25519Pub.d.ts

@@ -0,0 +1,88 @@
+/**
+ * @prettier
+ *
+ * @experimental Encode/decode helpers for the *derivable* form of a safe slot-④
+ * (`ed25519Multisig`) root public key.
+ *
+ * Wallet Safes v1 soft-derives the backup and BitGo co-signer keys of every minted wallet from the
+ * safe's root public keys, and soft derivation needs a chain code. The secp256k1 slot gets one for
+ * free (a BIP32 xpub is `point || chaincode`); a bare Stellar StrKey `G…` has nowhere to put one.
+ * Per TDD Part II-3 §1.3 we therefore concatenate the chain code onto `pub` rather than introduce a
+ * new field — the same shape BitGo already uses for the MPC slots, whose `commonKeychain` is
+ * `pub || chaincode`.
+ *
+ *   pub = <StrKey ed25519 public key> || <chainCode, 52 base32 chars>
+ *          exactly 56 chars, 'G…'         exactly 52 chars
+ *   total length exactly 108
+ *
+ * Both halves use the SAME encoding — RFC 4648 base32 over the alphabet StrKey itself uses — so the
+ * composite is one uniform string rather than a base32 pub with a hex tail bolted on.
+ *
+ * StrKey ed25519 public keys are always exactly 56 characters, so the split is a fixed offset. That
+ * offset is a CROSS-REPO contract shared with wallet-platform, `modules/key-card` and WRW; four
+ * independent implementations drifting produces unrecoverable wallets. Every call site — here and in
+ * the other repos — MUST go through these helpers rather than slicing inline.
+ */
+/**
+ * The fixed character offset at which a composite slot-④ pub splits into (StrKey pub, chain code).
+ * Stellar StrKey ed25519 public keys are a fixed 56 characters, so no length prefix or separator is
+ * needed.
+ *
+ * MUST stay identical to the corresponding constant in wallet-platform, `modules/key-card` and WRW:
+ * a divergent offset splits the pub in the wrong place and derives co-signer keys nobody else can
+ * reproduce, permanently bricking the wallets minted with it.
+ */
+export declare const DERIVABLE_ED25519_PUB_SPLIT_OFFSET = 56;
+/** Raw length of a chain code before encoding. */
+export declare const DERIVABLE_ED25519_CHAIN_CODE_BYTES = 32;
+/** Length of the base32-encoded chain code half: ceil(32 bytes * 8 / 5) = 52 characters. */
+export declare const DERIVABLE_ED25519_CHAIN_CODE_LENGTH = 52;
+/** Total length of a well-formed composite pub. */
+export declare const DERIVABLE_ED25519_PUB_LENGTH: number;
+/**
+ * Returns true iff `pub` is a valid Stellar StrKey ed25519 public key.
+ *
+ * Implemented here rather than pulled from `stellar-sdk` because `sdk-core` must not depend on a
+ * coin module. The pub half is validated by CHECKSUM, not merely by length and alphabet — a
+ * 56-character `G…` string with a corrupted body is rejected.
+ */
+export declare function isValidEd25519StrKeyPublicKey(pub: string): boolean;
+/**
+ * Returns true iff `chainCode` is the canonical base32 encoding of exactly 32 bytes.
+ *
+ * The length check alone is not sufficient. 52 base32 characters carry 260 bits but a chain code is
+ * only 256, so the final character has 4 unused low bits — 16 distinct strings decode to the same 32
+ * bytes. Only the one whose trailing bits are zero is accepted, which the re-encode enforces. Were
+ * non-canonical spellings allowed, one key could be persisted under several different composite pubs
+ * and equality against a stored pub would spuriously fail.
+ */
+export declare function isValidEd25519ChainCode(chainCode: string): boolean;
+/**
+ * Mint a fresh chain code for a derivable slot-④ root, base32-encoded.
+ *
+ * The chain code is independent randomness (TDD Part II-3 D1) — it is NOT derived from the seed, so
+ * it can be generated wherever the composite pub is assembled. Encoding 32 bytes always yields the
+ * canonical form, so the result satisfies {@link isValidEd25519ChainCode} by construction.
+ */
+export declare function generateEd25519ChainCodeBase32(): string;
+/**
+ * Compose a derivable slot-④ root pub from its two halves.
+ *
+ * Throws when either half is malformed: silently emitting a composite whose halves do not round-trip
+ * would persist a root pub from which no correct co-signer key can ever be derived.
+ */
+export declare function encodeDerivableEd25519Pub(pub: string, chainCode: string): string;
+/**
+ * Split a composite slot-④ root pub back into its two halves.
+ *
+ * Throws unless the input is EXACTLY the composite form. A lenient decode that accepted a bare
+ * 56-character pub would hand callers an empty chain code and derive every co-signer from the same
+ * (zero-length) entropy.
+ */
+export declare function decodeDerivableEd25519Pub(composite: string): {
+    pub: string;
+    chainCode: string;
+};
+/** Returns true iff `composite` is a well-formed derivable slot-④ root pub. */
+export declare function isDerivableEd25519Pub(composite: string): boolean;
+//# sourceMappingURL=derivableEd25519Pub.d.ts.map

package/dist/src/bitgo/safe/derivableEd25519Pub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivableEd25519Pub.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/derivableEd25519Pub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,kDAAkD;AAClD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,4FAA4F;AAC5F,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD,mDAAmD;AACnD,eAAO,MAAM,4BAA4B,QAA2E,CAAC;AAyErH;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAKlE;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQhF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAe/F;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOhE"}

package/dist/src/bitgo/safe/derivableEd25519Pub.js

@@ -0,0 +1,204 @@
+"use strict";
+/**
+ * @prettier
+ *
+ * @experimental Encode/decode helpers for the *derivable* form of a safe slot-④
+ * (`ed25519Multisig`) root public key.
+ *
+ * Wallet Safes v1 soft-derives the backup and BitGo co-signer keys of every minted wallet from the
+ * safe's root public keys, and soft derivation needs a chain code. The secp256k1 slot gets one for
+ * free (a BIP32 xpub is `point || chaincode`); a bare Stellar StrKey `G…` has nowhere to put one.
+ * Per TDD Part II-3 §1.3 we therefore concatenate the chain code onto `pub` rather than introduce a
+ * new field — the same shape BitGo already uses for the MPC slots, whose `commonKeychain` is
+ * `pub || chaincode`.
+ *
+ *   pub = <StrKey ed25519 public key> || <chainCode, 52 base32 chars>
+ *          exactly 56 chars, 'G…'         exactly 52 chars
+ *   total length exactly 108
+ *
+ * Both halves use the SAME encoding — RFC 4648 base32 over the alphabet StrKey itself uses — so the
+ * composite is one uniform string rather than a base32 pub with a hex tail bolted on.
+ *
+ * StrKey ed25519 public keys are always exactly 56 characters, so the split is a fixed offset. That
+ * offset is a CROSS-REPO contract shared with wallet-platform, `modules/key-card` and WRW; four
+ * independent implementations drifting produces unrecoverable wallets. Every call site — here and in
+ * the other repos — MUST go through these helpers rather than slicing inline.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DERIVABLE_ED25519_PUB_LENGTH = exports.DERIVABLE_ED25519_CHAIN_CODE_LENGTH = exports.DERIVABLE_ED25519_CHAIN_CODE_BYTES = exports.DERIVABLE_ED25519_PUB_SPLIT_OFFSET = void 0;
+exports.isValidEd25519StrKeyPublicKey = isValidEd25519StrKeyPublicKey;
+exports.isValidEd25519ChainCode = isValidEd25519ChainCode;
+exports.generateEd25519ChainCodeBase32 = generateEd25519ChainCodeBase32;
+exports.encodeDerivableEd25519Pub = encodeDerivableEd25519Pub;
+exports.decodeDerivableEd25519Pub = decodeDerivableEd25519Pub;
+exports.isDerivableEd25519Pub = isDerivableEd25519Pub;
+const crypto_1 = require("crypto");
+/**
+ * The fixed character offset at which a composite slot-④ pub splits into (StrKey pub, chain code).
+ * Stellar StrKey ed25519 public keys are a fixed 56 characters, so no length prefix or separator is
+ * needed.
+ *
+ * MUST stay identical to the corresponding constant in wallet-platform, `modules/key-card` and WRW:
+ * a divergent offset splits the pub in the wrong place and derives co-signer keys nobody else can
+ * reproduce, permanently bricking the wallets minted with it.
+ */
+exports.DERIVABLE_ED25519_PUB_SPLIT_OFFSET = 56;
+/** Raw length of a chain code before encoding. */
+exports.DERIVABLE_ED25519_CHAIN_CODE_BYTES = 32;
+/** Length of the base32-encoded chain code half: ceil(32 bytes * 8 / 5) = 52 characters. */
+exports.DERIVABLE_ED25519_CHAIN_CODE_LENGTH = 52;
+/** Total length of a well-formed composite pub. */
+exports.DERIVABLE_ED25519_PUB_LENGTH = exports.DERIVABLE_ED25519_PUB_SPLIT_OFFSET + exports.DERIVABLE_ED25519_CHAIN_CODE_LENGTH;
+/**
+ * Chain codes are serialized as unpadded RFC 4648 base32, the same encoding and alphabet StrKey
+ * uses, so the composite pub is base32 end to end.
+ *
+ * The alphabet is uppercase-only and lowercase is rejected rather than normalized: accepting both
+ * casings would make the composite non-canonical, so the same key could be stored under two
+ * distinct strings and equality against a previously-persisted pub would spuriously fail.
+ */
+const CHAIN_CODE_REGEX = /^[A-Z2-7]{52}$/;
+/** StrKey version byte for an ed25519 public key (`G…`). */
+const STRKEY_VERSION_BYTE_ED25519_PUBLIC_KEY = 6 << 3;
+/** Decoded StrKey payload: 1 version byte + 32-byte key + 2-byte checksum. */
+const STRKEY_DECODED_LENGTH = 35;
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const STRKEY_ED25519_PUBLIC_KEY_REGEX = /^G[A-Z2-7]{55}$/;
+/**
+ * Decode an unpadded RFC 4648 base32 string. Callers guarantee the input already matched one of the
+ * alphabet regexes below. Any bits left over past the last whole byte are dropped, so a decode alone
+ * does NOT prove the input was canonical — see {@link isValidEd25519ChainCode}, which re-encodes.
+ */
+function base32Decode(input) {
+    const out = Buffer.alloc(Math.floor((input.length * 5) / 8));
+    let bits = 0;
+    let value = 0;
+    let index = 0;
+    for (const char of input) {
+        value = (value << 5) | BASE32_ALPHABET.indexOf(char);
+        bits += 5;
+        if (bits >= 8) {
+            bits -= 8;
+            out[index++] = (value >>> bits) & 0xff;
+        }
+    }
+    return out;
+}
+/** Encode to unpadded RFC 4648 base32. Trailing bits of the final character are zero-filled. */
+function base32Encode(data) {
+    let bits = 0;
+    let value = 0;
+    let out = '';
+    for (const byte of data) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            out += BASE32_ALPHABET[(value >>> bits) & 0x1f];
+        }
+    }
+    if (bits > 0) {
+        out += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f];
+    }
+    return out;
+}
+/** CRC16-XModem, the checksum Stellar StrKey appends (little-endian) to the versioned payload. */
+function crc16Xmodem(data) {
+    let crc = 0x0000;
+    for (const byte of data) {
+        let code = (crc >>> 8) & 0xff;
+        code ^= byte;
+        code ^= code >>> 4;
+        crc = ((crc << 8) & 0xffff) ^ ((code << 12) & 0xffff) ^ ((code << 5) & 0xffff) ^ code;
+    }
+    return crc & 0xffff;
+}
+/**
+ * Returns true iff `pub` is a valid Stellar StrKey ed25519 public key.
+ *
+ * Implemented here rather than pulled from `stellar-sdk` because `sdk-core` must not depend on a
+ * coin module. The pub half is validated by CHECKSUM, not merely by length and alphabet — a
+ * 56-character `G…` string with a corrupted body is rejected.
+ */
+function isValidEd25519StrKeyPublicKey(pub) {
+    if (!STRKEY_ED25519_PUBLIC_KEY_REGEX.test(pub)) {
+        return false;
+    }
+    const decoded = base32Decode(pub);
+    if (decoded.length !== STRKEY_DECODED_LENGTH || decoded[0] !== STRKEY_VERSION_BYTE_ED25519_PUBLIC_KEY) {
+        return false;
+    }
+    return (crc16Xmodem(decoded.subarray(0, STRKEY_DECODED_LENGTH - 2)) === decoded.readUInt16LE(STRKEY_DECODED_LENGTH - 2));
+}
+/**
+ * Returns true iff `chainCode` is the canonical base32 encoding of exactly 32 bytes.
+ *
+ * The length check alone is not sufficient. 52 base32 characters carry 260 bits but a chain code is
+ * only 256, so the final character has 4 unused low bits — 16 distinct strings decode to the same 32
+ * bytes. Only the one whose trailing bits are zero is accepted, which the re-encode enforces. Were
+ * non-canonical spellings allowed, one key could be persisted under several different composite pubs
+ * and equality against a stored pub would spuriously fail.
+ */
+function isValidEd25519ChainCode(chainCode) {
+    if (!CHAIN_CODE_REGEX.test(chainCode)) {
+        return false;
+    }
+    return base32Encode(base32Decode(chainCode)) === chainCode;
+}
+/**
+ * Mint a fresh chain code for a derivable slot-④ root, base32-encoded.
+ *
+ * The chain code is independent randomness (TDD Part II-3 D1) — it is NOT derived from the seed, so
+ * it can be generated wherever the composite pub is assembled. Encoding 32 bytes always yields the
+ * canonical form, so the result satisfies {@link isValidEd25519ChainCode} by construction.
+ */
+function generateEd25519ChainCodeBase32() {
+    return base32Encode((0, crypto_1.randomBytes)(exports.DERIVABLE_ED25519_CHAIN_CODE_BYTES));
+}
+/**
+ * Compose a derivable slot-④ root pub from its two halves.
+ *
+ * Throws when either half is malformed: silently emitting a composite whose halves do not round-trip
+ * would persist a root pub from which no correct co-signer key can ever be derived.
+ */
+function encodeDerivableEd25519Pub(pub, chainCode) {
+    if (!isValidEd25519StrKeyPublicKey(pub)) {
+        throw new Error('Invalid derivable ed25519 pub: pub half is not a valid ed25519 public key');
+    }
+    if (!isValidEd25519ChainCode(chainCode)) {
+        throw new Error('Invalid derivable ed25519 pub: chainCode must be 52 canonical base32 characters');
+    }
+    return `${pub}${chainCode}`;
+}
+/**
+ * Split a composite slot-④ root pub back into its two halves.
+ *
+ * Throws unless the input is EXACTLY the composite form. A lenient decode that accepted a bare
+ * 56-character pub would hand callers an empty chain code and derive every co-signer from the same
+ * (zero-length) entropy.
+ */
+function decodeDerivableEd25519Pub(composite) {
+    if (composite.length !== exports.DERIVABLE_ED25519_PUB_LENGTH) {
+        throw new Error(`Invalid derivable ed25519 pub: expected ${exports.DERIVABLE_ED25519_PUB_LENGTH} characters, got ${composite.length}`);
+    }
+    const pub = composite.slice(0, exports.DERIVABLE_ED25519_PUB_SPLIT_OFFSET);
+    const chainCode = composite.slice(exports.DERIVABLE_ED25519_PUB_SPLIT_OFFSET);
+    if (!isValidEd25519StrKeyPublicKey(pub)) {
+        throw new Error('Invalid derivable ed25519 pub: pub half is not a valid ed25519 public key');
+    }
+    if (!isValidEd25519ChainCode(chainCode)) {
+        throw new Error('Invalid derivable ed25519 pub: chainCode must be 52 canonical base32 characters');
+    }
+    return { pub, chainCode };
+}
+/** Returns true iff `composite` is a well-formed derivable slot-④ root pub. */
+function isDerivableEd25519Pub(composite) {
+    try {
+        decodeDerivableEd25519Pub(composite);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVyaXZhYmxlRWQyNTUxOVB1Yi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9iaXRnby9zYWZlL2Rlcml2YWJsZUVkMjU1MTlQdWIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0F3Qkc7OztBQXNHSCxzRUFXQztBQVdELDBEQUtDO0FBU0Qsd0VBRUM7QUFRRCw4REFRQztBQVNELDhEQWVDO0FBR0Qsc0RBT0M7QUE1TEQsbUNBQXFDO0FBRXJDOzs7Ozs7OztHQVFHO0FBQ1UsUUFBQSxrQ0FBa0MsR0FBRyxFQUFFLENBQUM7QUFFckQsa0RBQWtEO0FBQ3JDLFFBQUEsa0NBQWtDLEdBQUcsRUFBRSxDQUFDO0FBRXJELDRGQUE0RjtBQUMvRSxRQUFBLG1DQUFtQyxHQUFHLEVBQUUsQ0FBQztBQUV0RCxtREFBbUQ7QUFDdEMsUUFBQSw0QkFBNEIsR0FBRywwQ0FBa0MsR0FBRywyQ0FBbUMsQ0FBQztBQUVySDs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxnQkFBZ0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUUxQyw0REFBNEQ7QUFDNUQsTUFBTSxzQ0FBc0MsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO0FBRXRELDhFQUE4RTtBQUM5RSxNQUFNLHFCQUFxQixHQUFHLEVBQUUsQ0FBQztBQUVqQyxNQUFNLGVBQWUsR0FBRyxrQ0FBa0MsQ0FBQztBQUMzRCxNQUFNLCtCQUErQixHQUFHLGlCQUFpQixDQUFDO0FBRTFEOzs7O0dBSUc7QUFDSCxTQUFTLFlBQVksQ0FBQyxLQUFhO0lBQ2pDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM3RCxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7SUFDYixJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7SUFDZCxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7SUFDZCxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ3pCLEtBQUssR0FBRyxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUMsR0FBRyxlQUFlLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3JELElBQUksSUFBSSxDQUFDLENBQUM7UUFDVixJQUFJLElBQUksSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNkLElBQUksSUFBSSxDQUFDLENBQUM7WUFDVixHQUFHLENBQUMsS0FBSyxFQUFFLENBQUMsR0FBRyxDQUFDLEtBQUssS0FBSyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRCxnR0FBZ0c7QUFDaEcsU0FBUyxZQUFZLENBQUMsSUFBWTtJQUNoQyxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7SUFDYixJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7SUFDZCxJQUFJLEdBQUcsR0FBRyxFQUFFLENBQUM7SUFDYixLQUFLLE1BQU0sSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ3hCLEtBQUssR0FBRyxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDNUIsSUFBSSxJQUFJLENBQUMsQ0FBQztRQUNWLE9BQU8sSUFBSSxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2pCLElBQUksSUFBSSxDQUFDLENBQUM7WUFDVixHQUFHLElBQUksZUFBZSxDQUFDLENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDO1FBQ2xELENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDYixHQUFHLElBQUksZUFBZSxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQUVELGtHQUFrRztBQUNsRyxTQUFTLFdBQVcsQ0FBQyxJQUFZO0lBQy9CLElBQUksR0FBRyxHQUFHLE1BQU0sQ0FBQztJQUNqQixLQUFLLE1BQU0sSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ3hCLElBQUksSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQztRQUM5QixJQUFJLElBQUksSUFBSSxDQUFDO1FBQ2IsSUFBSSxJQUFJLElBQUksS0FBSyxDQUFDLENBQUM7UUFDbkIsR0FBRyxHQUFHLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxHQUFHLElBQUksQ0FBQztJQUN4RixDQUFDO0lBQ0QsT0FBTyxHQUFHLEdBQUcsTUFBTSxDQUFDO0FBQ3RCLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxTQUFnQiw2QkFBNkIsQ0FBQyxHQUFXO0lBQ3ZELElBQUksQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMvQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbEMsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLHFCQUFxQixJQUFJLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxzQ0FBc0MsRUFBRSxDQUFDO1FBQ3RHLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE9BQU8sQ0FDTCxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLEdBQUcsQ0FBQyxDQUFDLENBQUMsS0FBSyxPQUFPLENBQUMsWUFBWSxDQUFDLHFCQUFxQixHQUFHLENBQUMsQ0FBQyxDQUNoSCxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBZ0IsdUJBQXVCLENBQUMsU0FBaUI7SUFDdkQsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE9BQU8sWUFBWSxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLFNBQVMsQ0FBQztBQUM3RCxDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsU0FBZ0IsOEJBQThCO0lBQzVDLE9BQU8sWUFBWSxDQUFDLElBQUEsb0JBQVcsRUFBQywwQ0FBa0MsQ0FBQyxDQUFDLENBQUM7QUFDdkUsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsU0FBZ0IseUJBQXlCLENBQUMsR0FBVyxFQUFFLFNBQWlCO0lBQ3RFLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hDLE1BQU0sSUFBSSxLQUFLLENBQUMsMkVBQTJFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxpRkFBaUYsQ0FBQyxDQUFDO0lBQ3JHLENBQUM7SUFDRCxPQUFPLEdBQUcsR0FBRyxHQUFHLFNBQVMsRUFBRSxDQUFDO0FBQzlCLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxTQUFnQix5QkFBeUIsQ0FBQyxTQUFpQjtJQUN6RCxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssb0NBQTRCLEVBQUUsQ0FBQztRQUN0RCxNQUFNLElBQUksS0FBSyxDQUNiLDJDQUEyQyxvQ0FBNEIsb0JBQW9CLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FDOUcsQ0FBQztJQUNKLENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSwwQ0FBa0MsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsMENBQWtDLENBQUMsQ0FBQztJQUN0RSxJQUFJLENBQUMsNkJBQTZCLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUksS0FBSyxDQUFDLDJFQUEyRSxDQUFDLENBQUM7SUFDL0YsQ0FBQztJQUNELElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3hDLE1BQU0sSUFBSSxLQUFLLENBQUMsaUZBQWlGLENBQUMsQ0FBQztJQUNyRyxDQUFDO0lBQ0QsT0FBTyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsQ0FBQztBQUM1QixDQUFDO0FBRUQsK0VBQStFO0FBQy9FLFNBQWdCLHFCQUFxQixDQUFDLFNBQWlCO0lBQ3JELElBQUksQ0FBQztRQUNILHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3JDLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBwcmV0dGllclxuICpcbiAqIEBleHBlcmltZW50YWwgRW5jb2RlL2RlY29kZSBoZWxwZXJzIGZvciB0aGUgKmRlcml2YWJsZSogZm9ybSBvZiBhIHNhZmUgc2xvdC3ikaNcbiAqIChgZWQyNTUxOU11bHRpc2lnYCkgcm9vdCBwdWJsaWMga2V5LlxuICpcbiAqIFdhbGxldCBTYWZlcyB2MSBzb2Z0LWRlcml2ZXMgdGhlIGJhY2t1cCBhbmQgQml0R28gY28tc2lnbmVyIGtleXMgb2YgZXZlcnkgbWludGVkIHdhbGxldCBmcm9tIHRoZVxuICogc2FmZSdzIHJvb3QgcHVibGljIGtleXMsIGFuZCBzb2Z0IGRlcml2YXRpb24gbmVlZHMgYSBjaGFpbiBjb2RlLiBUaGUgc2VjcDI1NmsxIHNsb3QgZ2V0cyBvbmUgZm9yXG4gKiBmcmVlIChhIEJJUDMyIHhwdWIgaXMgYHBvaW50IHx8IGNoYWluY29kZWApOyBhIGJhcmUgU3RlbGxhciBTdHJLZXkgYEfigKZgIGhhcyBub3doZXJlIHRvIHB1dCBvbmUuXG4gKiBQZXIgVEREIFBhcnQgSUktMyDCpzEuMyB3ZSB0aGVyZWZvcmUgY29uY2F0ZW5hdGUgdGhlIGNoYWluIGNvZGUgb250byBgcHViYCByYXRoZXIgdGhhbiBpbnRyb2R1Y2UgYVxuICogbmV3IGZpZWxkIOKAlCB0aGUgc2FtZSBzaGFwZSBCaXRHbyBhbHJlYWR5IHVzZXMgZm9yIHRoZSBNUEMgc2xvdHMsIHdob3NlIGBjb21tb25LZXljaGFpbmAgaXNcbiAqIGBwdWIgfHwgY2hhaW5jb2RlYC5cbiAqXG4gKiAgIHB1YiA9IDxTdHJLZXkgZWQyNTUxOSBwdWJsaWMga2V5PiB8fCA8Y2hhaW5Db2RlLCA1MiBiYXNlMzIgY2hhcnM+XG4gKiAgICAgICAgICBleGFjdGx5IDU2IGNoYXJzLCAnR+KApicgICAgICAgICBleGFjdGx5IDUyIGNoYXJzXG4gKiAgIHRvdGFsIGxlbmd0aCBleGFjdGx5IDEwOFxuICpcbiAqIEJvdGggaGFsdmVzIHVzZSB0aGUgU0FNRSBlbmNvZGluZyDigJQgUkZDIDQ2NDggYmFzZTMyIG92ZXIgdGhlIGFscGhhYmV0IFN0cktleSBpdHNlbGYgdXNlcyDigJQgc28gdGhlXG4gKiBjb21wb3NpdGUgaXMgb25lIHVuaWZvcm0gc3RyaW5nIHJhdGhlciB0aGFuIGEgYmFzZTMyIHB1YiB3aXRoIGEgaGV4IHRhaWwgYm9sdGVkIG9uLlxuICpcbiAqIFN0cktleSBlZDI1NTE5IHB1YmxpYyBrZXlzIGFyZSBhbHdheXMgZXhhY3RseSA1NiBjaGFyYWN0ZXJzLCBzbyB0aGUgc3BsaXQgaXMgYSBmaXhlZCBvZmZzZXQuIFRoYXRcbiAqIG9mZnNldCBpcyBhIENST1NTLVJFUE8gY29udHJhY3Qgc2hhcmVkIHdpdGggd2FsbGV0LXBsYXRmb3JtLCBgbW9kdWxlcy9rZXktY2FyZGAgYW5kIFdSVzsgZm91clxuICogaW5kZXBlbmRlbnQgaW1wbGVtZW50YXRpb25zIGRyaWZ0aW5nIHByb2R1Y2VzIHVucmVjb3ZlcmFibGUgd2FsbGV0cy4gRXZlcnkgY2FsbCBzaXRlIOKAlCBoZXJlIGFuZCBpblxuICogdGhlIG90aGVyIHJlcG9zIOKAlCBNVVNUIGdvIHRocm91Z2ggdGhlc2UgaGVscGVycyByYXRoZXIgdGhhbiBzbGljaW5nIGlubGluZS5cbiAqL1xuXG5pbXBvcnQgeyByYW5kb21CeXRlcyB9IGZyb20gJ2NyeXB0byc7XG5cbi8qKlxuICogVGhlIGZpeGVkIGNoYXJhY3RlciBvZmZzZXQgYXQgd2hpY2ggYSBjb21wb3NpdGUgc2xvdC3ikaMgcHViIHNwbGl0cyBpbnRvIChTdHJLZXkgcHViLCBjaGFpbiBjb2RlKS5cbiAqIFN0ZWxsYXIgU3RyS2V5IGVkMjU1MTkgcHVibGljIGtleXMgYXJlIGEgZml4ZWQgNTYgY2hhcmFjdGVycywgc28gbm8gbGVuZ3RoIHByZWZpeCBvciBzZXBhcmF0b3IgaXNcbiAqIG5lZWRlZC5cbiAqXG4gKiBNVVNUIHN0YXkgaWRlbnRpY2FsIHRvIHRoZSBjb3JyZXNwb25kaW5nIGNvbnN0YW50IGluIHdhbGxldC1wbGF0Zm9ybSwgYG1vZHVsZXMva2V5LWNhcmRgIGFuZCBXUlc6XG4gKiBhIGRpdmVyZ2VudCBvZmZzZXQgc3BsaXRzIHRoZSBwdWIgaW4gdGhlIHdyb25nIHBsYWNlIGFuZCBkZXJpdmVzIGNvLXNpZ25lciBrZXlzIG5vYm9keSBlbHNlIGNhblxuICogcmVwcm9kdWNlLCBwZXJtYW5lbnRseSBicmlja2luZyB0aGUgd2FsbGV0cyBtaW50ZWQgd2l0aCBpdC5cbiAqL1xuZXhwb3J0IGNvbnN0IERFUklWQUJMRV9FRDI1NTE5X1BVQl9TUExJVF9PRkZTRVQgPSA1NjtcblxuLyoqIFJhdyBsZW5ndGggb2YgYSBjaGFpbiBjb2RlIGJlZm9yZSBlbmNvZGluZy4gKi9cbmV4cG9ydCBjb25zdCBERVJJVkFCTEVfRUQyNTUxOV9DSEFJTl9DT0RFX0JZVEVTID0gMzI7XG5cbi8qKiBMZW5ndGggb2YgdGhlIGJhc2UzMi1lbmNvZGVkIGNoYWluIGNvZGUgaGFsZjogY2VpbCgzMiBieXRlcyAqIDggLyA1KSA9IDUyIGNoYXJhY3RlcnMuICovXG5leHBvcnQgY29uc3QgREVSSVZBQkxFX0VEMjU1MTlfQ0hBSU5fQ09ERV9MRU5HVEggPSA1MjtcblxuLyoqIFRvdGFsIGxlbmd0aCBvZiBhIHdlbGwtZm9ybWVkIGNvbXBvc2l0ZSBwdWIuICovXG5leHBvcnQgY29uc3QgREVSSVZBQkxFX0VEMjU1MTlfUFVCX0xFTkdUSCA9IERFUklWQUJMRV9FRDI1NTE5X1BVQl9TUExJVF9PRkZTRVQgKyBERVJJVkFCTEVfRUQyNTUxOV9DSEFJTl9DT0RFX0xFTkdUSDtcblxuLyoqXG4gKiBDaGFpbiBjb2RlcyBhcmUgc2VyaWFsaXplZCBhcyB1bnBhZGRlZCBSRkMgNDY0OCBiYXNlMzIsIHRoZSBzYW1lIGVuY29kaW5nIGFuZCBhbHBoYWJldCBTdHJLZXlcbiAqIHVzZXMsIHNvIHRoZSBjb21wb3NpdGUgcHViIGlzIGJhc2UzMiBlbmQgdG8gZW5kLlxuICpcbiAqIFRoZSBhbHBoYWJldCBpcyB1cHBlcmNhc2Utb25seSBhbmQgbG93ZXJjYXNlIGlzIHJlamVjdGVkIHJhdGhlciB0aGFuIG5vcm1hbGl6ZWQ6IGFjY2VwdGluZyBib3RoXG4gKiBjYXNpbmdzIHdvdWxkIG1ha2UgdGhlIGNvbXBvc2l0ZSBub24tY2Fub25pY2FsLCBzbyB0aGUgc2FtZSBrZXkgY291bGQgYmUgc3RvcmVkIHVuZGVyIHR3b1xuICogZGlzdGluY3Qgc3RyaW5ncyBhbmQgZXF1YWxpdHkgYWdhaW5zdCBhIHByZXZpb3VzbHktcGVyc2lzdGVkIHB1YiB3b3VsZCBzcHVyaW91c2x5IGZhaWwuXG4gKi9cbmNvbnN0IENIQUlOX0NPREVfUkVHRVggPSAvXltBLVoyLTddezUyfSQvO1xuXG4vKiogU3RyS2V5IHZlcnNpb24gYnl0ZSBmb3IgYW4gZWQyNTUxOSBwdWJsaWMga2V5IChgR+KApmApLiAqL1xuY29uc3QgU1RSS0VZX1ZFUlNJT05fQllURV9FRDI1NTE5X1BVQkxJQ19LRVkgPSA2IDw8IDM7XG5cbi8qKiBEZWNvZGVkIFN0cktleSBwYXlsb2FkOiAxIHZlcnNpb24gYnl0ZSArIDMyLWJ5dGUga2V5ICsgMi1ieXRlIGNoZWNrc3VtLiAqL1xuY29uc3QgU1RSS0VZX0RFQ09ERURfTEVOR1RIID0gMzU7XG5cbmNvbnN0IEJBU0UzMl9BTFBIQUJFVCA9ICdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWjIzNDU2Nyc7XG5jb25zdCBTVFJLRVlfRUQyNTUxOV9QVUJMSUNfS0VZX1JFR0VYID0gL15HW0EtWjItN117NTV9JC87XG5cbi8qKlxuICogRGVjb2RlIGFuIHVucGFkZGVkIFJGQyA0NjQ4IGJhc2UzMiBzdHJpbmcuIENhbGxlcnMgZ3VhcmFudGVlIHRoZSBpbnB1dCBhbHJlYWR5IG1hdGNoZWQgb25lIG9mIHRoZVxuICogYWxwaGFiZXQgcmVnZXhlcyBiZWxvdy4gQW55IGJpdHMgbGVmdCBvdmVyIHBhc3QgdGhlIGxhc3Qgd2hvbGUgYnl0ZSBhcmUgZHJvcHBlZCwgc28gYSBkZWNvZGUgYWxvbmVcbiAqIGRvZXMgTk9UIHByb3ZlIHRoZSBpbnB1dCB3YXMgY2Fub25pY2FsIOKAlCBzZWUge0BsaW5rIGlzVmFsaWRFZDI1NTE5Q2hhaW5Db2RlfSwgd2hpY2ggcmUtZW5jb2Rlcy5cbiAqL1xuZnVuY3Rpb24gYmFzZTMyRGVjb2RlKGlucHV0OiBzdHJpbmcpOiBCdWZmZXIge1xuICBjb25zdCBvdXQgPSBCdWZmZXIuYWxsb2MoTWF0aC5mbG9vcigoaW5wdXQubGVuZ3RoICogNSkgLyA4KSk7XG4gIGxldCBiaXRzID0gMDtcbiAgbGV0IHZhbHVlID0gMDtcbiAgbGV0IGluZGV4ID0gMDtcbiAgZm9yIChjb25zdCBjaGFyIG9mIGlucHV0KSB7XG4gICAgdmFsdWUgPSAodmFsdWUgPDwgNSkgfCBCQVNFMzJfQUxQSEFCRVQuaW5kZXhPZihjaGFyKTtcbiAgICBiaXRzICs9IDU7XG4gICAgaWYgKGJpdHMgPj0gOCkge1xuICAgICAgYml0cyAtPSA4O1xuICAgICAgb3V0W2luZGV4KytdID0gKHZhbHVlID4+PiBiaXRzKSAmIDB4ZmY7XG4gICAgfVxuICB9XG4gIHJldHVybiBvdXQ7XG59XG5cbi8qKiBFbmNvZGUgdG8gdW5wYWRkZWQgUkZDIDQ2NDggYmFzZTMyLiBUcmFpbGluZyBiaXRzIG9mIHRoZSBmaW5hbCBjaGFyYWN0ZXIgYXJlIHplcm8tZmlsbGVkLiAqL1xuZnVuY3Rpb24gYmFzZTMyRW5jb2RlKGRhdGE6IEJ1ZmZlcik6IHN0cmluZyB7XG4gIGxldCBiaXRzID0gMDtcbiAgbGV0IHZhbHVlID0gMDtcbiAgbGV0IG91dCA9ICcnO1xuICBmb3IgKGNvbnN0IGJ5dGUgb2YgZGF0YSkge1xuICAgIHZhbHVlID0gKHZhbHVlIDw8IDgpIHwgYnl0ZTtcbiAgICBiaXRzICs9IDg7XG4gICAgd2hpbGUgKGJpdHMgPj0gNSkge1xuICAgICAgYml0cyAtPSA1O1xuICAgICAgb3V0ICs9IEJBU0UzMl9BTFBIQUJFVFsodmFsdWUgPj4+IGJpdHMpICYgMHgxZl07XG4gICAgfVxuICB9XG4gIGlmIChiaXRzID4gMCkge1xuICAgIG91dCArPSBCQVNFMzJfQUxQSEFCRVRbKHZhbHVlIDw8ICg1IC0gYml0cykpICYgMHgxZl07XG4gIH1cbiAgcmV0dXJuIG91dDtcbn1cblxuLyoqIENSQzE2LVhNb2RlbSwgdGhlIGNoZWNrc3VtIFN0ZWxsYXIgU3RyS2V5IGFwcGVuZHMgKGxpdHRsZS1lbmRpYW4pIHRvIHRoZSB2ZXJzaW9uZWQgcGF5bG9hZC4gKi9cbmZ1bmN0aW9uIGNyYzE2WG1vZGVtKGRhdGE6IEJ1ZmZlcik6IG51bWJlciB7XG4gIGxldCBjcmMgPSAweDAwMDA7XG4gIGZvciAoY29uc3QgYnl0ZSBvZiBkYXRhKSB7XG4gICAgbGV0IGNvZGUgPSAoY3JjID4+PiA4KSAmIDB4ZmY7XG4gICAgY29kZSBePSBieXRlO1xuICAgIGNvZGUgXj0gY29kZSA+Pj4gNDtcbiAgICBjcmMgPSAoKGNyYyA8PCA4KSAmIDB4ZmZmZikgXiAoKGNvZGUgPDwgMTIpICYgMHhmZmZmKSBeICgoY29kZSA8PCA1KSAmIDB4ZmZmZikgXiBjb2RlO1xuICB9XG4gIHJldHVybiBjcmMgJiAweGZmZmY7XG59XG5cbi8qKlxuICogUmV0dXJucyB0cnVlIGlmZiBgcHViYCBpcyBhIHZhbGlkIFN0ZWxsYXIgU3RyS2V5IGVkMjU1MTkgcHVibGljIGtleS5cbiAqXG4gKiBJbXBsZW1lbnRlZCBoZXJlIHJhdGhlciB0aGFuIHB1bGxlZCBmcm9tIGBzdGVsbGFyLXNka2AgYmVjYXVzZSBgc2RrLWNvcmVgIG11c3Qgbm90IGRlcGVuZCBvbiBhXG4gKiBjb2luIG1vZHVsZS4gVGhlIHB1YiBoYWxmIGlzIHZhbGlkYXRlZCBieSBDSEVDS1NVTSwgbm90IG1lcmVseSBieSBsZW5ndGggYW5kIGFscGhhYmV0IOKAlCBhXG4gKiA1Ni1jaGFyYWN0ZXIgYEfigKZgIHN0cmluZyB3aXRoIGEgY29ycnVwdGVkIGJvZHkgaXMgcmVqZWN0ZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc1ZhbGlkRWQyNTUxOVN0cktleVB1YmxpY0tleShwdWI6IHN0cmluZyk6IGJvb2xlYW4ge1xuICBpZiAoIVNUUktFWV9FRDI1NTE5X1BVQkxJQ19LRVlfUkVHRVgudGVzdChwdWIpKSB7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG4gIGNvbnN0IGRlY29kZWQgPSBiYXNlMzJEZWNvZGUocHViKTtcbiAgaWYgKGRlY29kZWQubGVuZ3RoICE9PSBTVFJLRVlfREVDT0RFRF9MRU5HVEggfHwgZGVjb2RlZFswXSAhPT0gU1RSS0VZX1ZFUlNJT05fQllURV9FRDI1NTE5X1BVQkxJQ19LRVkpIHtcbiAgICByZXR1cm4gZmFsc2U7XG4gIH1cbiAgcmV0dXJuIChcbiAgICBjcmMxNlhtb2RlbShkZWNvZGVkLnN1YmFycmF5KDAsIFNUUktFWV9ERUNPREVEX0xFTkdUSCAtIDIpKSA9PT0gZGVjb2RlZC5yZWFkVUludDE2TEUoU1RSS0VZX0RFQ09ERURfTEVOR1RIIC0gMilcbiAgKTtcbn1cblxuLyoqXG4gKiBSZXR1cm5zIHRydWUgaWZmIGBjaGFpbkNvZGVgIGlzIHRoZSBjYW5vbmljYWwgYmFzZTMyIGVuY29kaW5nIG9mIGV4YWN0bHkgMzIgYnl0ZXMuXG4gKlxuICogVGhlIGxlbmd0aCBjaGVjayBhbG9uZSBpcyBub3Qgc3VmZmljaWVudC4gNTIgYmFzZTMyIGNoYXJhY3RlcnMgY2FycnkgMjYwIGJpdHMgYnV0IGEgY2hhaW4gY29kZSBpc1xuICogb25seSAyNTYsIHNvIHRoZSBmaW5hbCBjaGFyYWN0ZXIgaGFzIDQgdW51c2VkIGxvdyBiaXRzIOKAlCAxNiBkaXN0aW5jdCBzdHJpbmdzIGRlY29kZSB0byB0aGUgc2FtZSAzMlxuICogYnl0ZXMuIE9ubHkgdGhlIG9uZSB3aG9zZSB0cmFpbGluZyBiaXRzIGFyZSB6ZXJvIGlzIGFjY2VwdGVkLCB3aGljaCB0aGUgcmUtZW5jb2RlIGVuZm9yY2VzLiBXZXJlXG4gKiBub24tY2Fub25pY2FsIHNwZWxsaW5ncyBhbGxvd2VkLCBvbmUga2V5IGNvdWxkIGJlIHBlcnNpc3RlZCB1bmRlciBzZXZlcmFsIGRpZmZlcmVudCBjb21wb3NpdGUgcHVic1xuICogYW5kIGVxdWFsaXR5IGFnYWluc3QgYSBzdG9yZWQgcHViIHdvdWxkIHNwdXJpb3VzbHkgZmFpbC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzVmFsaWRFZDI1NTE5Q2hhaW5Db2RlKGNoYWluQ29kZTogc3RyaW5nKTogYm9vbGVhbiB7XG4gIGlmICghQ0hBSU5fQ09ERV9SRUdFWC50ZXN0KGNoYWluQ29kZSkpIHtcbiAgICByZXR1cm4gZmFsc2U7XG4gIH1cbiAgcmV0dXJuIGJhc2UzMkVuY29kZShiYXNlMzJEZWNvZGUoY2hhaW5Db2RlKSkgPT09IGNoYWluQ29kZTtcbn1cblxuLyoqXG4gKiBNaW50IGEgZnJlc2ggY2hhaW4gY29kZSBmb3IgYSBkZXJpdmFibGUgc2xvdC3ikaMgcm9vdCwgYmFzZTMyLWVuY29kZWQuXG4gKlxuICogVGhlIGNoYWluIGNvZGUgaXMgaW5kZXBlbmRlbnQgcmFuZG9tbmVzcyAoVEREIFBhcnQgSUktMyBEMSkg4oCUIGl0IGlzIE5PVCBkZXJpdmVkIGZyb20gdGhlIHNlZWQsIHNvXG4gKiBpdCBjYW4gYmUgZ2VuZXJhdGVkIHdoZXJldmVyIHRoZSBjb21wb3NpdGUgcHViIGlzIGFzc2VtYmxlZC4gRW5jb2RpbmcgMzIgYnl0ZXMgYWx3YXlzIHlpZWxkcyB0aGVcbiAqIGNhbm9uaWNhbCBmb3JtLCBzbyB0aGUgcmVzdWx0IHNhdGlzZmllcyB7QGxpbmsgaXNWYWxpZEVkMjU1MTlDaGFpbkNvZGV9IGJ5IGNvbnN0cnVjdGlvbi5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdlbmVyYXRlRWQyNTUxOUNoYWluQ29kZUJhc2UzMigpOiBzdHJpbmcge1xuICByZXR1cm4gYmFzZTMyRW5jb2RlKHJhbmRvbUJ5dGVzKERFUklWQUJMRV9FRDI1NTE5X0NIQUlOX0NPREVfQllURVMpKTtcbn1cblxuLyoqXG4gKiBDb21wb3NlIGEgZGVyaXZhYmxlIHNsb3Qt4pGjIHJvb3QgcHViIGZyb20gaXRzIHR3byBoYWx2ZXMuXG4gKlxuICogVGhyb3dzIHdoZW4gZWl0aGVyIGhhbGYgaXMgbWFsZm9ybWVkOiBzaWxlbnRseSBlbWl0dGluZyBhIGNvbXBvc2l0ZSB3aG9zZSBoYWx2ZXMgZG8gbm90IHJvdW5kLXRyaXBcbiAqIHdvdWxkIHBlcnNpc3QgYSByb290IHB1YiBmcm9tIHdoaWNoIG5vIGNvcnJlY3QgY28tc2lnbmVyIGtleSBjYW4gZXZlciBiZSBkZXJpdmVkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZW5jb2RlRGVyaXZhYmxlRWQyNTUxOVB1YihwdWI6IHN0cmluZywgY2hhaW5Db2RlOiBzdHJpbmcpOiBzdHJpbmcge1xuICBpZiAoIWlzVmFsaWRFZDI1NTE5U3RyS2V5UHVibGljS2V5KHB1YikpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ0ludmFsaWQgZGVyaXZhYmxlIGVkMjU1MTkgcHViOiBwdWIgaGFsZiBpcyBub3QgYSB2YWxpZCBlZDI1NTE5IHB1YmxpYyBrZXknKTtcbiAgfVxuICBpZiAoIWlzVmFsaWRFZDI1NTE5Q2hhaW5Db2RlKGNoYWluQ29kZSkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ0ludmFsaWQgZGVyaXZhYmxlIGVkMjU1MTkgcHViOiBjaGFpbkNvZGUgbXVzdCBiZSA1MiBjYW5vbmljYWwgYmFzZTMyIGNoYXJhY3RlcnMnKTtcbiAgfVxuICByZXR1cm4gYCR7cHVifSR7Y2hhaW5Db2RlfWA7XG59XG5cbi8qKlxuICogU3BsaXQgYSBjb21wb3NpdGUgc2xvdC3ikaMgcm9vdCBwdWIgYmFjayBpbnRvIGl0cyB0d28gaGFsdmVzLlxuICpcbiAqIFRocm93cyB1bmxlc3MgdGhlIGlucHV0IGlzIEVYQUNUTFkgdGhlIGNvbXBvc2l0ZSBmb3JtLiBBIGxlbmllbnQgZGVjb2RlIHRoYXQgYWNjZXB0ZWQgYSBiYXJlXG4gKiA1Ni1jaGFyYWN0ZXIgcHViIHdvdWxkIGhhbmQgY2FsbGVycyBhbiBlbXB0eSBjaGFpbiBjb2RlIGFuZCBkZXJpdmUgZXZlcnkgY28tc2lnbmVyIGZyb20gdGhlIHNhbWVcbiAqICh6ZXJvLWxlbmd0aCkgZW50cm9weS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGRlY29kZURlcml2YWJsZUVkMjU1MTlQdWIoY29tcG9zaXRlOiBzdHJpbmcpOiB7IHB1Yjogc3RyaW5nOyBjaGFpbkNvZGU6IHN0cmluZyB9IHtcbiAgaWYgKGNvbXBvc2l0ZS5sZW5ndGggIT09IERFUklWQUJMRV9FRDI1NTE5X1BVQl9MRU5HVEgpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICBgSW52YWxpZCBkZXJpdmFibGUgZWQyNTUxOSBwdWI6IGV4cGVjdGVkICR7REVSSVZBQkxFX0VEMjU1MTlfUFVCX0xFTkdUSH0gY2hhcmFjdGVycywgZ290ICR7Y29tcG9zaXRlLmxlbmd0aH1gXG4gICAgKTtcbiAgfVxuICBjb25zdCBwdWIgPSBjb21wb3NpdGUuc2xpY2UoMCwgREVSSVZBQkxFX0VEMjU1MTlfUFVCX1NQTElUX09GRlNFVCk7XG4gIGNvbnN0IGNoYWluQ29kZSA9IGNvbXBvc2l0ZS5zbGljZShERVJJVkFCTEVfRUQyNTUxOV9QVUJfU1BMSVRfT0ZGU0VUKTtcbiAgaWYgKCFpc1ZhbGlkRWQyNTUxOVN0cktleVB1YmxpY0tleShwdWIpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdJbnZhbGlkIGRlcml2YWJsZSBlZDI1NTE5IHB1YjogcHViIGhhbGYgaXMgbm90IGEgdmFsaWQgZWQyNTUxOSBwdWJsaWMga2V5Jyk7XG4gIH1cbiAgaWYgKCFpc1ZhbGlkRWQyNTUxOUNoYWluQ29kZShjaGFpbkNvZGUpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdJbnZhbGlkIGRlcml2YWJsZSBlZDI1NTE5IHB1YjogY2hhaW5Db2RlIG11c3QgYmUgNTIgY2Fub25pY2FsIGJhc2UzMiBjaGFyYWN0ZXJzJyk7XG4gIH1cbiAgcmV0dXJuIHsgcHViLCBjaGFpbkNvZGUgfTtcbn1cblxuLyoqIFJldHVybnMgdHJ1ZSBpZmYgYGNvbXBvc2l0ZWAgaXMgYSB3ZWxsLWZvcm1lZCBkZXJpdmFibGUgc2xvdC3ikaMgcm9vdCBwdWIuICovXG5leHBvcnQgZnVuY3Rpb24gaXNEZXJpdmFibGVFZDI1NTE5UHViKGNvbXBvc2l0ZTogc3RyaW5nKTogYm9vbGVhbiB7XG4gIHRyeSB7XG4gICAgZGVjb2RlRGVyaXZhYmxlRWQyNTUxOVB1Yihjb21wb3NpdGUpO1xuICAgIHJldHVybiB0cnVlO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gZmFsc2U7XG4gIH1cbn1cbiJdfQ==

package/dist/src/bitgo/safe/iSafe.d.ts

@@ -0,0 +1,87 @@
+/**
+ * @prettier
+ *
+ * @experimental The safe client surface is experimental and may change (including breaking
+ * changes) before the public release.
+ */
+import type { FreezeSafeBody, SafeData, SafePermission, SafeRootKeys, SafeShareData, SafeShareKeychain, SafeShareState } from '@bitgo/public-types';
+import type { Wallet, WalletShare } from '../wallet';
+/** @experimental */
+export interface InitializeSafeOptions {
+    label: string;
+}
+/**
+ * Phase 3 — the client hands back the 12 key ids it created in Phase 2.
+ * @experimental
+ */
+export interface FinalizeSafeOptions {
+    rootKeys: SafeRootKeys;
+}
+/**
+ * Sharing ONE safe wallet with a non-member rides the existing wallet-share handshake (FR-13),
+ * so the result is the existing WalletShare shape.
+ */
+export type WalletShareData = WalletShare;
+export interface CreateSafeWalletOptions {
+    coin: string;
+    label: string;
+    passphrase: string;
+    type?: 'hot';
+    /** `tss` throws until MPC mint lands. Defaults to `onchain`. */
+    multisigType?: 'onchain' | 'tss';
+}
+interface AddSafeMemberBase {
+    permissions: SafePermission[];
+    /** required when 'spend' is included — the 4 root user keys ECDH-re-encrypted to the invitee */
+    keychains?: SafeShareKeychain[];
+    message?: string;
+    /** when true, suppress the invitation email that would otherwise be sent to `email` */
+    disableEmail?: boolean;
+}
+/** Add a member by either `userId` or `email` — exactly one is required. */
+export type AddSafeMemberOptions = (AddSafeMemberBase & {
+    userId: string;
+    email?: never;
+}) | (AddSafeMemberBase & {
+    email: string;
+    userId?: never;
+});
+export interface AddSafeWalletMemberOptions {
+    walletId: string;
+    /** required — sharing re-encrypts the user key, which needs hardened derivation from the passphrase */
+    walletPassphrase: string;
+    email?: string;
+    permissions?: string[];
+    message?: string;
+}
+export type AcceptSafeShareAsSpenderOptions = {
+    safeShareId: string;
+    userPassword: string;
+    newWalletPassphrase?: string;
+};
+export type AcceptSafeShareAsNonSpenderOptions = {
+    safeShareId: string;
+};
+export type AcceptSafeShareOptions = AcceptSafeShareAsSpenderOptions | AcceptSafeShareAsNonSpenderOptions;
+/**
+ * @experimental
+ */
+export interface ISafe {
+    id(): string;
+    enterpriseId(): string;
+    label(): string;
+    status(): SafeData['status'];
+    url(extra?: string): string;
+    createWallet(params: CreateSafeWalletOptions): Promise<Wallet>;
+    addMember(params: AddSafeMemberOptions): Promise<SafeData>;
+    addMemberToWallet(params: AddSafeWalletMemberOptions): Promise<WalletShareData>;
+    listShares(params?: {
+        state?: SafeShareState;
+    }): Promise<SafeShareData[]>;
+    acceptShare(params: AcceptSafeShareOptions): Promise<SafeShareData>;
+    freeze(params?: FreezeSafeBody): Promise<SafeData>;
+    archive(): Promise<SafeData>;
+    toJSON(): SafeData;
+}
+export {};
+//# sourceMappingURL=iSafe.d.ts.map

package/dist/src/bitgo/safe/iSafe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iSafe.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/iSafe.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,cAAc,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAErD,oBAAoB;AACpB,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAI1C,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,gEAAgE;IAChE,YAAY,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;CAClC;AAED,UAAU,iBAAiB;IACzB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,gGAAgG;IAChG,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,MAAM,oBAAoB,GAC5B,CAAC,iBAAiB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GACvD,CAAC,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE5D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,+BAA+B,GAAG,kCAAkC,CAAC;AAE1G;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,IAAI,MAAM,CAAC;IACb,YAAY,IAAI,MAAM,CAAC;IACvB,KAAK,IAAI,MAAM,CAAC;IAChB,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG/D,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,iBAAiB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChF,UAAU,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,IAAI,QAAQ,CAAC;CACpB"}

package/dist/src/bitgo/safe/iSafe.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaVNhZmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9pU2FmZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFRoZSBzYWZlIGNsaWVudCBzdXJmYWNlIGlzIGV4cGVyaW1lbnRhbCBhbmQgbWF5IGNoYW5nZSAoaW5jbHVkaW5nIGJyZWFraW5nXG4gKiBjaGFuZ2VzKSBiZWZvcmUgdGhlIHB1YmxpYyByZWxlYXNlLlxuICovXG4vLyBXaXJlL2RhdGEgc2hhcGVzIGFyZSBvd25lZCBieSBAYml0Z28vcHVibGljLXR5cGVzIOKAlCBpbXBvcnQgdGhlbSB3aGVyZSBuZWVkZWQgcmF0aGVyIHRoYW5cbi8vIHJlLWV4cG9ydGluZyBmcm9tIHNkay1jb3JlLlxuaW1wb3J0IHR5cGUge1xuICBGcmVlemVTYWZlQm9keSxcbiAgU2FmZURhdGEsXG4gIFNhZmVQZXJtaXNzaW9uLFxuICBTYWZlUm9vdEtleXMsXG4gIFNhZmVTaGFyZURhdGEsXG4gIFNhZmVTaGFyZUtleWNoYWluLFxuICBTYWZlU2hhcmVTdGF0ZSxcbn0gZnJvbSAnQGJpdGdvL3B1YmxpYy10eXBlcyc7XG5pbXBvcnQgdHlwZSB7IFdhbGxldCwgV2FsbGV0U2hhcmUgfSBmcm9tICcuLi93YWxsZXQnO1xuXG4vKiogQGV4cGVyaW1lbnRhbCAqL1xuZXhwb3J0IGludGVyZmFjZSBJbml0aWFsaXplU2FmZU9wdGlvbnMge1xuICBsYWJlbDogc3RyaW5nO1xufVxuXG4vKipcbiAqIFBoYXNlIDMg4oCUIHRoZSBjbGllbnQgaGFuZHMgYmFjayB0aGUgMTIga2V5IGlkcyBpdCBjcmVhdGVkIGluIFBoYXNlIDIuXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgRmluYWxpemVTYWZlT3B0aW9ucyB7XG4gIHJvb3RLZXlzOiBTYWZlUm9vdEtleXM7XG59XG5cbi8qKlxuICogU2hhcmluZyBPTkUgc2FmZSB3YWxsZXQgd2l0aCBhIG5vbi1tZW1iZXIgcmlkZXMgdGhlIGV4aXN0aW5nIHdhbGxldC1zaGFyZSBoYW5kc2hha2UgKEZSLTEzKSxcbiAqIHNvIHRoZSByZXN1bHQgaXMgdGhlIGV4aXN0aW5nIFdhbGxldFNoYXJlIHNoYXBlLlxuICovXG5leHBvcnQgdHlwZSBXYWxsZXRTaGFyZURhdGEgPSBXYWxsZXRTaGFyZTtcblxuLy8gLS0tLSBwZXItc2FmZSBvcGVyYXRpb24gb3B0aW9ucyAtLS0tXG5cbmV4cG9ydCBpbnRlcmZhY2UgQ3JlYXRlU2FmZVdhbGxldE9wdGlvbnMge1xuICBjb2luOiBzdHJpbmc7XG4gIGxhYmVsOiBzdHJpbmc7XG4gIHBhc3NwaHJhc2U6IHN0cmluZztcbiAgdHlwZT86ICdob3QnO1xuICAvKiogYHRzc2AgdGhyb3dzIHVudGlsIE1QQyBtaW50IGxhbmRzLiBEZWZhdWx0cyB0byBgb25jaGFpbmAuICovXG4gIG11bHRpc2lnVHlwZT86ICdvbmNoYWluJyB8ICd0c3MnO1xufVxuXG5pbnRlcmZhY2UgQWRkU2FmZU1lbWJlckJhc2Uge1xuICBwZXJtaXNzaW9uczogU2FmZVBlcm1pc3Npb25bXTtcbiAgLyoqIHJlcXVpcmVkIHdoZW4gJ3NwZW5kJyBpcyBpbmNsdWRlZCDigJQgdGhlIDQgcm9vdCB1c2VyIGtleXMgRUNESC1yZS1lbmNyeXB0ZWQgdG8gdGhlIGludml0ZWUgKi9cbiAga2V5Y2hhaW5zPzogU2FmZVNoYXJlS2V5Y2hhaW5bXTtcbiAgbWVzc2FnZT86IHN0cmluZztcbiAgLyoqIHdoZW4gdHJ1ZSwgc3VwcHJlc3MgdGhlIGludml0YXRpb24gZW1haWwgdGhhdCB3b3VsZCBvdGhlcndpc2UgYmUgc2VudCB0byBgZW1haWxgICovXG4gIGRpc2FibGVFbWFpbD86IGJvb2xlYW47XG59XG5cbi8qKiBBZGQgYSBtZW1iZXIgYnkgZWl0aGVyIGB1c2VySWRgIG9yIGBlbWFpbGAg4oCUIGV4YWN0bHkgb25lIGlzIHJlcXVpcmVkLiAqL1xuZXhwb3J0IHR5cGUgQWRkU2FmZU1lbWJlck9wdGlvbnMgPVxuICB8IChBZGRTYWZlTWVtYmVyQmFzZSAmIHsgdXNlcklkOiBzdHJpbmc7IGVtYWlsPzogbmV2ZXIgfSlcbiAgfCAoQWRkU2FmZU1lbWJlckJhc2UgJiB7IGVtYWlsOiBzdHJpbmc7IHVzZXJJZD86IG5ldmVyIH0pO1xuXG5leHBvcnQgaW50ZXJmYWNlIEFkZFNhZmVXYWxsZXRNZW1iZXJPcHRpb25zIHtcbiAgd2FsbGV0SWQ6IHN0cmluZztcbiAgLyoqIHJlcXVpcmVkIOKAlCBzaGFyaW5nIHJlLWVuY3J5cHRzIHRoZSB1c2VyIGtleSwgd2hpY2ggbmVlZHMgaGFyZGVuZWQgZGVyaXZhdGlvbiBmcm9tIHRoZSBwYXNzcGhyYXNlICovXG4gIHdhbGxldFBhc3NwaHJhc2U6IHN0cmluZztcbiAgZW1haWw/OiBzdHJpbmc7XG4gIHBlcm1pc3Npb25zPzogc3RyaW5nW107XG4gIG1lc3NhZ2U/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCB0eXBlIEFjY2VwdFNhZmVTaGFyZUFzU3BlbmRlck9wdGlvbnMgPSB7XG4gIHNhZmVTaGFyZUlkOiBzdHJpbmc7XG4gIHVzZXJQYXNzd29yZDogc3RyaW5nO1xuICBuZXdXYWxsZXRQYXNzcGhyYXNlPzogc3RyaW5nO1xufTtcbmV4cG9ydCB0eXBlIEFjY2VwdFNhZmVTaGFyZUFzTm9uU3BlbmRlck9wdGlvbnMgPSB7XG4gIHNhZmVTaGFyZUlkOiBzdHJpbmc7XG59O1xuZXhwb3J0IHR5cGUgQWNjZXB0U2FmZVNoYXJlT3B0aW9ucyA9IEFjY2VwdFNhZmVTaGFyZUFzU3BlbmRlck9wdGlvbnMgfCBBY2NlcHRTYWZlU2hhcmVBc05vblNwZW5kZXJPcHRpb25zO1xuXG4vKipcbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJU2FmZSB7XG4gIGlkKCk6IHN0cmluZztcbiAgZW50ZXJwcmlzZUlkKCk6IHN0cmluZztcbiAgbGFiZWwoKTogc3RyaW5nO1xuICBzdGF0dXMoKTogU2FmZURhdGFbJ3N0YXR1cyddO1xuICB1cmwoZXh0cmE/OiBzdHJpbmcpOiBzdHJpbmc7XG4gIGNyZWF0ZVdhbGxldChwYXJhbXM6IENyZWF0ZVNhZmVXYWxsZXRPcHRpb25zKTogUHJvbWlzZTxXYWxsZXQ+O1xuICAvLyB3aG9sZS1zYWZlOiB2aWV3L2FkbWluL3NwZW5kL2RhcHA7IHNwZW5kIG9wZW5zIGEga2V5IHNoYXJlIChhbHNvIGhvdyBhIHNwZW5kZXIgc2VydmljZXMgYVxuICAvLyBzYWZlU2hhcmVSZXF1ZXN0cyBlbnRyeSBpbiBVTVMgb3JncylcbiAgYWRkTWVtYmVyKHBhcmFtczogQWRkU2FmZU1lbWJlck9wdGlvbnMpOiBQcm9taXNlPFNhZmVEYXRhPjtcbiAgLy8gc2hhcmUgT05FIHNhZmUgd2FsbGV0LCBub3QgdGhlIHdob2xlIHNhZmVcbiAgYWRkTWVtYmVyVG9XYWxsZXQocGFyYW1zOiBBZGRTYWZlV2FsbGV0TWVtYmVyT3B0aW9ucyk6IFByb21pc2U8V2FsbGV0U2hhcmVEYXRhPjtcbiAgbGlzdFNoYXJlcyhwYXJhbXM/OiB7IHN0YXRlPzogU2FmZVNoYXJlU3RhdGUgfSk6IFByb21pc2U8U2FmZVNoYXJlRGF0YVtdPjtcbiAgYWNjZXB0U2hhcmUocGFyYW1zOiBBY2NlcHRTYWZlU2hhcmVPcHRpb25zKTogUHJvbWlzZTxTYWZlU2hhcmVEYXRhPjtcbiAgZnJlZXplKHBhcmFtcz86IEZyZWV6ZVNhZmVCb2R5KTogUHJvbWlzZTxTYWZlRGF0YT47XG4gIGFyY2hpdmUoKTogUHJvbWlzZTxTYWZlRGF0YT47XG4gIHRvSlNPTigpOiBTYWZlRGF0YTtcbn1cbiJdfQ==

package/dist/src/bitgo/safe/iSafes.d.ts

@@ -0,0 +1,94 @@
+/**
+ * @prettier
+ *
+ * @experimental The safe client surface is experimental and may change (including breaking
+ * changes) before the public release.
+ */
+import type { InitializeSafeResponse } from '@bitgo/public-types';
+import { FinalizeSafeOptions, InitializeSafeOptions } from './iSafe';
+import { Safe } from './safe';
+/**
+ * Options for safe creation.
+ *
+ * v1 targets the HOT custody model only: the multisig root user/backup keys are generated locally
+ * by the SDK, encrypted with `passphrase`, and registered on BitGo; the MPC roots run the standard
+ * hot ceremonies with the same passphrase. Self-managed cold keys and custodial safes are out of
+ * scope for v1.
+ * @experimental
+ */
+export interface CreateSafeOptions {
+    label: string;
+    passphrase: string;
+}
+/**
+ * Handle returned by `initializeSafe`, threaded into the key ceremonies and finalize.
+ *
+ * `enabledRootSlots` is the server-decided (Flipt, evaluated once at initialize) set of root-key
+ * slots to generate; absent (older WP) falls back to all 4 slots.
+ * @experimental
+ */
+export interface SafeCreationHandle {
+    safeId: string;
+    enabledRootSlots?: InitializeSafeResponse['enabledRootSlots'];
+}
+/**
+ * The minted root key ids produced by `createSafeKeys`, as ordered [user, backup, bitgo]
+ * triplets for the enabled slots — exactly the payload `finalizeSafe` consumes.
+ * @experimental
+ */
+export type SafeKeys = FinalizeSafeOptions;
+/**
+ * @experimental
+ */
+export interface ListSafesOptions {
+    cursor?: string;
+    limit?: number;
+}
+/**
+ * @experimental
+ */
+export interface GetSafeOptions {
+    id: string;
+}
+/**
+ * @experimental
+ */
+export interface ISafes {
+    /**
+     * One-call convenience wrapper chaining the three creation phases:
+     * initialize → createSafeKeys (safeId-tagged ceremonies for the enabled root slots) → finalize.
+     * HOT custody only in v1.
+     * @experimental
+     */
+    generateSafe(params: CreateSafeOptions): Promise<Safe>;
+    /**
+     * Phase 1 — initialize a safe (metadata only, no key material). The server response is
+     * `{ id, status }` plus optional `enabledRootSlots` (no `label`/`enterpriseId`/`creator`/`users`/
+     * `createdAt` yet), so this returns that raw shape rather than a full `Safe`.
+     * @experimental
+     */
+    initializeSafe(params: InitializeSafeOptions): Promise<InitializeSafeResponse>;
+    /**
+     * Phase 2 — run the enabled root key ceremonies tagged with `safeId`; returns the minted key ids.
+     * @experimental
+     */
+    createSafeKeys(params: CreateSafeOptions & SafeCreationHandle): Promise<SafeKeys>;
+    /**
+     * Phase 3 — finalize a safe with the minted root key ids. Idempotent.
+     * @experimental
+     */
+    finalizeSafe(safeId: string, params: FinalizeSafeOptions): Promise<Safe>;
+    /**
+     * Archive a safe. Also the abandonment path for a stuck `initializing` safe.
+     * @experimental
+     */
+    archiveSafe(safeId: string): Promise<Safe>;
+    /** @experimental */
+    list(params?: ListSafesOptions): Promise<{
+        safes: Safe[];
+        nextCursor?: string;
+    }>;
+    /** @experimental */
+    get(params: GetSafeOptions): Promise<Safe>;
+}
+//# sourceMappingURL=iSafes.d.ts.map

package/dist/src/bitgo/safe/iSafes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iSafes.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/iSafes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAE3C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/E;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,oBAAoB;IACpB,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,oBAAoB;IACpB,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}

package/dist/src/bitgo/safe/iSafes.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaVNhZmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3NhZmUvaVNhZmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBwcmV0dGllclxuICpcbiAqIEBleHBlcmltZW50YWwgVGhlIHNhZmUgY2xpZW50IHN1cmZhY2UgaXMgZXhwZXJpbWVudGFsIGFuZCBtYXkgY2hhbmdlIChpbmNsdWRpbmcgYnJlYWtpbmdcbiAqIGNoYW5nZXMpIGJlZm9yZSB0aGUgcHVibGljIHJlbGVhc2UuXG4gKi9cbmltcG9ydCB0eXBlIHsgSW5pdGlhbGl6ZVNhZmVSZXNwb25zZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHsgRmluYWxpemVTYWZlT3B0aW9ucywgSW5pdGlhbGl6ZVNhZmVPcHRpb25zIH0gZnJvbSAnLi9pU2FmZSc7XG5pbXBvcnQgeyBTYWZlIH0gZnJvbSAnLi9zYWZlJztcblxuLyoqXG4gKiBPcHRpb25zIGZvciBzYWZlIGNyZWF0aW9uLlxuICpcbiAqIHYxIHRhcmdldHMgdGhlIEhPVCBjdXN0b2R5IG1vZGVsIG9ubHk6IHRoZSBtdWx0aXNpZyByb290IHVzZXIvYmFja3VwIGtleXMgYXJlIGdlbmVyYXRlZCBsb2NhbGx5XG4gKiBieSB0aGUgU0RLLCBlbmNyeXB0ZWQgd2l0aCBgcGFzc3BocmFzZWAsIGFuZCByZWdpc3RlcmVkIG9uIEJpdEdvOyB0aGUgTVBDIHJvb3RzIHJ1biB0aGUgc3RhbmRhcmRcbiAqIGhvdCBjZXJlbW9uaWVzIHdpdGggdGhlIHNhbWUgcGFzc3BocmFzZS4gU2VsZi1tYW5hZ2VkIGNvbGQga2V5cyBhbmQgY3VzdG9kaWFsIHNhZmVzIGFyZSBvdXQgb2ZcbiAqIHNjb3BlIGZvciB2MS5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDcmVhdGVTYWZlT3B0aW9ucyB7XG4gIGxhYmVsOiBzdHJpbmc7XG4gIHBhc3NwaHJhc2U6IHN0cmluZzsgLy8gZW5jcnlwdHMgdGhlIGxvY2FsbHktZ2VuZXJhdGVkIG11bHRpc2lnIHVzZXIvYmFja3VwIHBydnM7IHNoYXJlZCB3aXRoIHRoZSBNUEMgY2VyZW1vbmllc1xufVxuXG4vKipcbiAqIEhhbmRsZSByZXR1cm5lZCBieSBgaW5pdGlhbGl6ZVNhZmVgLCB0aHJlYWRlZCBpbnRvIHRoZSBrZXkgY2VyZW1vbmllcyBhbmQgZmluYWxpemUuXG4gKlxuICogYGVuYWJsZWRSb290U2xvdHNgIGlzIHRoZSBzZXJ2ZXItZGVjaWRlZCAoRmxpcHQsIGV2YWx1YXRlZCBvbmNlIGF0IGluaXRpYWxpemUpIHNldCBvZiByb290LWtleVxuICogc2xvdHMgdG8gZ2VuZXJhdGU7IGFic2VudCAob2xkZXIgV1ApIGZhbGxzIGJhY2sgdG8gYWxsIDQgc2xvdHMuXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2FmZUNyZWF0aW9uSGFuZGxlIHtcbiAgc2FmZUlkOiBzdHJpbmc7XG4gIGVuYWJsZWRSb290U2xvdHM/OiBJbml0aWFsaXplU2FmZVJlc3BvbnNlWydlbmFibGVkUm9vdFNsb3RzJ107XG59XG5cbi8qKlxuICogVGhlIG1pbnRlZCByb290IGtleSBpZHMgcHJvZHVjZWQgYnkgYGNyZWF0ZVNhZmVLZXlzYCwgYXMgb3JkZXJlZCBbdXNlciwgYmFja3VwLCBiaXRnb11cbiAqIHRyaXBsZXRzIGZvciB0aGUgZW5hYmxlZCBzbG90cyDigJQgZXhhY3RseSB0aGUgcGF5bG9hZCBgZmluYWxpemVTYWZlYCBjb25zdW1lcy5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IHR5cGUgU2FmZUtleXMgPSBGaW5hbGl6ZVNhZmVPcHRpb25zO1xuXG4vKipcbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBMaXN0U2FmZXNPcHRpb25zIHtcbiAgY3Vyc29yPzogc3RyaW5nOyAvLyBvcGFxdWUgY3Vyc29yIGZyb20gYSBwcmV2aW91cyByZXNwb25zZSdzIG5leHRDdXJzb3JcbiAgbGltaXQ/OiBudW1iZXI7XG59XG5cbi8qKlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdldFNhZmVPcHRpb25zIHtcbiAgaWQ6IHN0cmluZztcbn1cblxuLyoqXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSVNhZmVzIHtcbiAgLyoqXG4gICAqIE9uZS1jYWxsIGNvbnZlbmllbmNlIHdyYXBwZXIgY2hhaW5pbmcgdGhlIHRocmVlIGNyZWF0aW9uIHBoYXNlczpcbiAgICogaW5pdGlhbGl6ZSDihpIgY3JlYXRlU2FmZUtleXMgKHNhZmVJZC10YWdnZWQgY2VyZW1vbmllcyBmb3IgdGhlIGVuYWJsZWQgcm9vdCBzbG90cykg4oaSIGZpbmFsaXplLlxuICAgKiBIT1QgY3VzdG9keSBvbmx5IGluIHYxLlxuICAgKiBAZXhwZXJpbWVudGFsXG4gICAqL1xuICBnZW5lcmF0ZVNhZmUocGFyYW1zOiBDcmVhdGVTYWZlT3B0aW9ucyk6IFByb21pc2U8U2FmZT47XG4gIC8qKlxuICAgKiBQaGFzZSAxIOKAlCBpbml0aWFsaXplIGEgc2FmZSAobWV0YWRhdGEgb25seSwgbm8ga2V5IG1hdGVyaWFsKS4gVGhlIHNlcnZlciByZXNwb25zZSBpc1xuICAgKiBgeyBpZCwgc3RhdHVzIH1gIHBsdXMgb3B0aW9uYWwgYGVuYWJsZWRSb290U2xvdHNgIChubyBgbGFiZWxgL2BlbnRlcnByaXNlSWRgL2BjcmVhdG9yYC9gdXNlcnNgL1xuICAgKiBgY3JlYXRlZEF0YCB5ZXQpLCBzbyB0aGlzIHJldHVybnMgdGhhdCByYXcgc2hhcGUgcmF0aGVyIHRoYW4gYSBmdWxsIGBTYWZlYC5cbiAgICogQGV4cGVyaW1lbnRhbFxuICAgKi9cbiAgaW5pdGlhbGl6ZVNhZmUocGFyYW1zOiBJbml0aWFsaXplU2FmZU9wdGlvbnMpOiBQcm9taXNlPEluaXRpYWxpemVTYWZlUmVzcG9uc2U+O1xuICAvKipcbiAgICogUGhhc2UgMiDigJQgcnVuIHRoZSBlbmFibGVkIHJvb3Qga2V5IGNlcmVtb25pZXMgdGFnZ2VkIHdpdGggYHNhZmVJZGA7IHJldHVybnMgdGhlIG1pbnRlZCBrZXkgaWRzLlxuICAgKiBAZXhwZXJpbWVudGFsXG4gICAqL1xuICBjcmVhdGVTYWZlS2V5cyhwYXJhbXM6IENyZWF0ZVNhZmVPcHRpb25zICYgU2FmZUNyZWF0aW9uSGFuZGxlKTogUHJvbWlzZTxTYWZlS2V5cz47XG4gIC8qKlxuICAgKiBQaGFzZSAzIOKAlCBmaW5hbGl6ZSBhIHNhZmUgd2l0aCB0aGUgbWludGVkIHJvb3Qga2V5IGlkcy4gSWRlbXBvdGVudC5cbiAgICogQGV4cGVyaW1lbnRhbFxuICAgKi9cbiAgZmluYWxpemVTYWZlKHNhZmVJZDogc3RyaW5nLCBwYXJhbXM6IEZpbmFsaXplU2FmZU9wdGlvbnMpOiBQcm9taXNlPFNhZmU+O1xuICAvKipcbiAgICogQXJjaGl2ZSBhIHNhZmUuIEFsc28gdGhlIGFiYW5kb25tZW50IHBhdGggZm9yIGEgc3R1Y2sgYGluaXRpYWxpemluZ2Agc2FmZS5cbiAgICogQGV4cGVyaW1lbnRhbFxuICAgKi9cbiAgYXJjaGl2ZVNhZmUoc2FmZUlkOiBzdHJpbmcpOiBQcm9taXNlPFNhZmU+O1xuICAvKiogQGV4cGVyaW1lbnRhbCAqL1xuICBsaXN0KHBhcmFtcz86IExpc3RTYWZlc09wdGlvbnMpOiBQcm9taXNlPHsgc2FmZXM6IFNhZmVbXTsgbmV4dEN1cnNvcj86IHN0cmluZyB9PjtcbiAgLyoqIEBleHBlcmltZW50YWwgKi9cbiAgZ2V0KHBhcmFtczogR2V0U2FmZU9wdGlvbnMpOiBQcm9taXNlPFNhZmU+O1xufVxuIl19

package/dist/src/bitgo/safe/index.d.ts

@@ -0,0 +1,7 @@
+export * from './derivableEd25519Pub';
+export * from './iSafe';
+export * from './iSafes';
+export * from './safe';
+export * from './safeDerivation';
+export * from './safes';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/bitgo/safe/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC"}

package/dist/src/bitgo/safe/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./derivableEd25519Pub"), exports);
+__exportStar(require("./iSafe"), exports);
+__exportStar(require("./iSafes"), exports);
+__exportStar(require("./safe"), exports);
+__exportStar(require("./safeDerivation"), exports);
+__exportStar(require("./safes"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsd0RBQXNDO0FBQ3RDLDBDQUF3QjtBQUN4QiwyQ0FBeUI7QUFDekIseUNBQXVCO0FBQ3ZCLG1EQUFpQztBQUNqQywwQ0FBd0IiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2Rlcml2YWJsZUVkMjU1MTlQdWInO1xuZXhwb3J0ICogZnJvbSAnLi9pU2FmZSc7XG5leHBvcnQgKiBmcm9tICcuL2lTYWZlcyc7XG5leHBvcnQgKiBmcm9tICcuL3NhZmUnO1xuZXhwb3J0ICogZnJvbSAnLi9zYWZlRGVyaXZhdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL3NhZmVzJztcbiJdfQ==

package/dist/src/bitgo/safe/safe.d.ts

@@ -0,0 +1,61 @@
+import { FreezeSafeBody, SafeData, SafeShareData, SafeShareState } from '@bitgo/public-types';
+import { BitGoBase } from '../bitgoBase';
+import { Wallet } from '../wallet';
+import { AcceptSafeShareOptions, AddSafeMemberOptions, AddSafeWalletMemberOptions, CreateSafeWalletOptions, ISafe, WalletShareData } from './iSafe';
+/**
+ * @experimental
+ */
+export declare class Safe implements ISafe {
+    private readonly bitgo;
+    readonly _safe: SafeData;
+    constructor(bitgo: BitGoBase, safeData: SafeData);
+    id(): string;
+    enterpriseId(): string;
+    label(): string;
+    status(): SafeData['status'];
+    /**
+     * Enterprise-scoped v2 URL for this safe, e.g. /api/v2/enterprise/:eId/safes/:safeId
+     * @param extra
+     */
+    url(extra?: string): string;
+    /**
+     * Mint a child wallet: peek the sequential index, hardened-derive the user child,
+     * register it public-only, then mint. Backup and BitGo children are soft-derived on the server.
+     */
+    createWallet(params: CreateSafeWalletOptions): Promise<Wallet>;
+    private fetchSafeData;
+    /**
+     * Add a member to the whole safe (view/admin/spend). Spend opens a key share.
+     * Body lands in WCN-1204.
+     */
+    addMember(params: AddSafeMemberOptions): Promise<SafeData>;
+    /**
+     * Share ONE safe wallet with a non-member via the existing wallet-share handshake (FR-13).
+     * Body lands in WCN-1204.
+     */
+    addMemberToWallet(params: AddSafeWalletMemberOptions): Promise<WalletShareData>;
+    /**
+     * List the safe key shares visible to the caller.
+     * Body lands in WCN-1204.
+     */
+    listShares(params?: {
+        state?: SafeShareState;
+    }): Promise<SafeShareData[]>;
+    /**
+     * Accept a safe key share addressed to the caller.
+     * Body lands in WCN-1204.
+     */
+    acceptShare(params: AcceptSafeShareOptions): Promise<SafeShareData>;
+    /**
+     * Freeze the safe — blocks withdrawals on all safe wallets. Safe stays 'active'.
+     * @param params
+     */
+    freeze(params?: FreezeSafeBody): Promise<SafeData>;
+    /**
+     * Archive the safe. Requires every safe wallet to already be archived; also the abandonment
+     * path for a stuck 'initializing' safe.
+     */
+    archive(): Promise<SafeData>;
+    toJSON(): SafeData;
+}
+//# sourceMappingURL=safe.d.ts.map