@bitgo-beta/sdk-core 8.2.1-beta.202 → 8.2.1-beta.2021

package/dist/src/bitgo/wallet/safeKeychain.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @prettier
+ */
+import { BitGoBase } from '../bitgoBase';
+import { IKeychains, Keychain, KeychainWithEncryptedPrv } from '../keychain';
+export declare class InvalidRootKeychainSourceError extends Error {
+    constructor(id: string, source: string | undefined);
+}
+/** Thrown when hardened derivation does not match the registered child public key. */
+export declare class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId: string, expectedPub: string, derivedPub: string);
+}
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+export declare class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId: string, detail: string);
+}
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+export declare function isSafeChildPublicOnlyKeychain(walletSafeId: string | undefined, keychain: Keychain | undefined): keychain is Keychain & {
+    parent: string;
+};
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+export declare function fetchRootKeychainForSafeChild(keychains: IKeychains, childKeychain: Keychain): Promise<KeychainWithEncryptedPrv>;
+export interface ResolveSafeOwnerSigningPrvParams {
+    bitgo: BitGoBase;
+    keychains: IKeychains;
+    walletId: string;
+    /** Onchain secp256k1: hardened-derive and verify pub. Other slots throw. */
+    multisigType: string | undefined;
+    coinFamily: string;
+    childKeychain: Keychain;
+    walletPassphrase: string;
+    /** When already fetched (passphrase preflight), skip a second GET. */
+    rootKeychain?: KeychainWithEncryptedPrv;
+}
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithHardenedPath`
+ * (`m/<n>'`), and verify the registered pub.
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+export declare function resolveSafeOwnerSigningPrv(params: ResolveSafeOwnerSigningPrvParams): Promise<string>;
+//# sourceMappingURL=safeKeychain.d.ts.map

package/dist/src/bitgo/wallet/safeKeychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeKeychain.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/wallet/safeKeychain.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAA6B,UAAU,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAIxG,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAOnD;AAED,sFAAsF;AACtF,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAOtE;AAED,kGAAkG;AAClG,qBAAa,mCAAoC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAKD;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,QAAQ,IAAI,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAE3C;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,UAAU,EACrB,aAAa,EAAE,QAAQ,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAYnC;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,QAAQ,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,gCAAgC,GAAG,OAAO,CAAC,MAAM,CAAC,CAsC1G"}

package/dist/src/bitgo/wallet/safeKeychain.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeOwnerSigningNotImplementedError = exports.SafeDerivedPublicKeyMismatchError = exports.InvalidRootKeychainSourceError = void 0;
+exports.isSafeChildPublicOnlyKeychain = isSafeChildPublicOnlyKeychain;
+exports.fetchRootKeychainForSafeChild = fetchRootKeychainForSafeChild;
+exports.resolveSafeOwnerSigningPrv = resolveSafeOwnerSigningPrv;
+const keychain_1 = require("../keychain");
+const safeDerivation_1 = require("../safe/safeDerivation");
+const errors_1 = require("../errors");
+class InvalidRootKeychainSourceError extends Error {
+    constructor(id, source) {
+        super(`Root keychain ${id} has source '${source ?? 'unknown'}'; expected 'user'. ` +
+            `Using a backup or BitGo root would fail at signing.`);
+        this.name = 'InvalidRootKeychainSourceError';
+    }
+}
+exports.InvalidRootKeychainSourceError = InvalidRootKeychainSourceError;
+/** Thrown when hardened derivation does not match the registered child public key. */
+class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId, expectedPub, derivedPub) {
+        super(`Safe wallet ${walletId}: derived child public key does not match the registered user key. ` +
+            `Expected ${expectedPub}, got ${derivedPub}.`);
+        this.name = 'SafeDerivedPublicKeyMismatchError';
+    }
+}
+exports.SafeDerivedPublicKeyMismatchError = SafeDerivedPublicKeyMismatchError;
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId, detail) {
+        super(`Safe wallet ${walletId}: ${detail}`);
+        this.name = 'SafeOwnerSigningNotImplementedError';
+    }
+}
+exports.SafeOwnerSigningNotImplementedError = SafeOwnerSigningNotImplementedError;
+/** ed25519 onchain multisig (slot ④). Needs SLIP-0010, not secp256k1 BIP32. */
+const ED25519_ONCHAIN_FAMILIES = new Set(['algo', 'xlm', 'hbar']);
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+function isSafeChildPublicOnlyKeychain(walletSafeId, keychain) {
+    return !!(walletSafeId && keychain?.parent && !keychain.encryptedPrv);
+}
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+async function fetchRootKeychainForSafeChild(keychains, childKeychain) {
+    if (!childKeychain.parent) {
+        throw new Error('childKeychain.parent is required to fetch the root keychain');
+    }
+    const root = await keychains.get({ id: childKeychain.parent });
+    if (root.source !== 'user') {
+        throw new InvalidRootKeychainSourceError(root.id, root.source);
+    }
+    if (!root.encryptedPrv) {
+        throw new Error(`root keychain ${root.id} does not have property encryptedPrv`);
+    }
+    return root;
+}
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithHardenedPath`
+ * (`m/<n>'`), and verify the registered pub.
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+async function resolveSafeOwnerSigningPrv(params) {
+    const { bitgo, keychains, walletId, multisigType, coinFamily, childKeychain, walletPassphrase } = params;
+    if (multisigType !== 'onchain') {
+        throw new SafeOwnerSigningNotImplementedError(walletId, 'TSS owner signing from the root keyshare is not implemented. ' +
+            'Returning the root private key would expose material that can derive every child in this slot.');
+    }
+    if (ED25519_ONCHAIN_FAMILIES.has(coinFamily)) {
+        throw new SafeOwnerSigningNotImplementedError(walletId, `ed25519 multisig owner derivation (${coinFamily}) is not implemented; BIP32 would produce the wrong child key.`);
+    }
+    const rootKeychain = params.rootKeychain ?? (await fetchRootKeychainForSafeChild(keychains, childKeychain));
+    const rootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(bitgo, rootKeychain, walletPassphrase);
+    if (!rootPrv) {
+        throw new errors_1.IncorrectPasswordError();
+    }
+    if (!childKeychain.pub) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing pub for pre-sign verification`);
+    }
+    if (childKeychain.derivedFromParentWithHardenedPath === undefined) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing derivedFromParentWithHardenedPath`);
+    }
+    const derived = (0, safeDerivation_1.deriveSafeChildHardenedFromXprv)(rootPrv, (0, safeDerivation_1.parseDerivedFromParentWithHardenedPath)(childKeychain.derivedFromParentWithHardenedPath));
+    if (derived.pub !== childKeychain.pub) {
+        throw new SafeDerivedPublicKeyMismatchError(walletId, childKeychain.pub, derived.pub);
+    }
+    return derived.prv;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2FmZUtleWNoYWluLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3dhbGxldC9zYWZlS2V5Y2hhaW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBNENBLHNFQUtDO0FBTUQsc0VBZUM7QUF5QkQsZ0VBc0NDO0FBaklELDBDQUF3RztBQUN4RywyREFBaUg7QUFDakgsc0NBQW1EO0FBRW5ELE1BQWEsOEJBQStCLFNBQVEsS0FBSztJQUN2RCxZQUFZLEVBQVUsRUFBRSxNQUEwQjtRQUNoRCxLQUFLLENBQ0gsaUJBQWlCLEVBQUUsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLHNCQUFzQjtZQUMxRSxxREFBcUQsQ0FDeEQsQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLEdBQUcsZ0NBQWdDLENBQUM7SUFDL0MsQ0FBQztDQUNGO0FBUkQsd0VBUUM7QUFFRCxzRkFBc0Y7QUFDdEYsTUFBYSxpQ0FBa0MsU0FBUSxLQUFLO0lBQzFELFlBQVksUUFBZ0IsRUFBRSxXQUFtQixFQUFFLFVBQWtCO1FBQ25FLEtBQUssQ0FDSCxlQUFlLFFBQVEscUVBQXFFO1lBQzFGLFlBQVksV0FBVyxTQUFTLFVBQVUsR0FBRyxDQUNoRCxDQUFDO1FBQ0YsSUFBSSxDQUFDLElBQUksR0FBRyxtQ0FBbUMsQ0FBQztJQUNsRCxDQUFDO0NBQ0Y7QUFSRCw4RUFRQztBQUVELGtHQUFrRztBQUNsRyxNQUFhLG1DQUFvQyxTQUFRLEtBQUs7SUFDNUQsWUFBWSxRQUFnQixFQUFFLE1BQWM7UUFDMUMsS0FBSyxDQUFDLGVBQWUsUUFBUSxLQUFLLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxxQ0FBcUMsQ0FBQztJQUNwRCxDQUFDO0NBQ0Y7QUFMRCxrRkFLQztBQUVELCtFQUErRTtBQUMvRSxNQUFNLHdCQUF3QixHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRWxFOzs7R0FHRztBQUNILFNBQWdCLDZCQUE2QixDQUMzQyxZQUFnQyxFQUNoQyxRQUE4QjtJQUU5QixPQUFPLENBQUMsQ0FBQyxDQUFDLFlBQVksSUFBSSxRQUFRLEVBQUUsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3hFLENBQUM7QUFFRDs7O0dBR0c7QUFDSSxLQUFLLFVBQVUsNkJBQTZCLENBQ2pELFNBQXFCLEVBQ3JCLGFBQXVCO0lBRXZCLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEVBQUUsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDL0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSw4QkFBOEIsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlCQUFpQixJQUFJLENBQUMsRUFBRSxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLElBQWdDLENBQUM7QUFDMUMsQ0FBQztBQWVEOzs7Ozs7Ozs7R0FTRztBQUNJLEtBQUssVUFBVSwwQkFBMEIsQ0FBQyxNQUF3QztJQUN2RixNQUFNLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFekcsSUFBSSxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDL0IsTUFBTSxJQUFJLG1DQUFtQyxDQUMzQyxRQUFRLEVBQ1IsK0RBQStEO1lBQzdELGdHQUFnRyxDQUNuRyxDQUFDO0lBQ0osQ0FBQztJQUNELElBQUksd0JBQXdCLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDN0MsTUFBTSxJQUFJLG1DQUFtQyxDQUMzQyxRQUFRLEVBQ1Isc0NBQXNDLFVBQVUsZ0VBQWdFLENBQ2pILENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLFlBQVksSUFBSSxDQUFDLE1BQU0sNkJBQTZCLENBQUMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDNUcsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFBLG9DQUF5QixFQUFDLEtBQUssRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztJQUN2RixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksK0JBQXNCLEVBQUUsQ0FBQztJQUNyQyxDQUFDO0lBRUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGVBQWUsUUFBUSwyREFBMkQsQ0FBQyxDQUFDO0lBQ3RHLENBQUM7SUFDRCxJQUFJLGFBQWEsQ0FBQyxpQ0FBaUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNsRSxNQUFNLElBQUksS0FBSyxDQUFDLGVBQWUsUUFBUSwrREFBK0QsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxJQUFBLGdEQUErQixFQUM3QyxPQUFPLEVBQ1AsSUFBQSx1REFBc0MsRUFBQyxhQUFhLENBQUMsaUNBQWlDLENBQUMsQ0FDeEYsQ0FBQztJQUNGLElBQUksT0FBTyxDQUFDLEdBQUcsS0FBSyxhQUFhLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLGlDQUFpQyxDQUFDLFFBQVEsRUFBRSxhQUFhLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUMsR0FBRyxDQUFDO0FBQ3JCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBwcmV0dGllclxuICovXG5pbXBvcnQgeyBCaXRHb0Jhc2UgfSBmcm9tICcuLi9iaXRnb0Jhc2UnO1xuaW1wb3J0IHsgZGVjcnlwdEtleWNoYWluUHJpdmF0ZUtleSwgSUtleWNoYWlucywgS2V5Y2hhaW4sIEtleWNoYWluV2l0aEVuY3J5cHRlZFBydiB9IGZyb20gJy4uL2tleWNoYWluJztcbmltcG9ydCB7IGRlcml2ZVNhZmVDaGlsZEhhcmRlbmVkRnJvbVhwcnYsIHBhcnNlRGVyaXZlZEZyb21QYXJlbnRXaXRoSGFyZGVuZWRQYXRoIH0gZnJvbSAnLi4vc2FmZS9zYWZlRGVyaXZhdGlvbic7XG5pbXBvcnQgeyBJbmNvcnJlY3RQYXNzd29yZEVycm9yIH0gZnJvbSAnLi4vZXJyb3JzJztcblxuZXhwb3J0IGNsYXNzIEludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgY29uc3RydWN0b3IoaWQ6IHN0cmluZywgc291cmNlOiBzdHJpbmcgfCB1bmRlZmluZWQpIHtcbiAgICBzdXBlcihcbiAgICAgIGBSb290IGtleWNoYWluICR7aWR9IGhhcyBzb3VyY2UgJyR7c291cmNlID8/ICd1bmtub3duJ30nOyBleHBlY3RlZCAndXNlcicuIGAgK1xuICAgICAgICBgVXNpbmcgYSBiYWNrdXAgb3IgQml0R28gcm9vdCB3b3VsZCBmYWlsIGF0IHNpZ25pbmcuYFxuICAgICk7XG4gICAgdGhpcy5uYW1lID0gJ0ludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvcic7XG4gIH1cbn1cblxuLyoqIFRocm93biB3aGVuIGhhcmRlbmVkIGRlcml2YXRpb24gZG9lcyBub3QgbWF0Y2ggdGhlIHJlZ2lzdGVyZWQgY2hpbGQgcHVibGljIGtleS4gKi9cbmV4cG9ydCBjbGFzcyBTYWZlRGVyaXZlZFB1YmxpY0tleU1pc21hdGNoRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKHdhbGxldElkOiBzdHJpbmcsIGV4cGVjdGVkUHViOiBzdHJpbmcsIGRlcml2ZWRQdWI6IHN0cmluZykge1xuICAgIHN1cGVyKFxuICAgICAgYFNhZmUgd2FsbGV0ICR7d2FsbGV0SWR9OiBkZXJpdmVkIGNoaWxkIHB1YmxpYyBrZXkgZG9lcyBub3QgbWF0Y2ggdGhlIHJlZ2lzdGVyZWQgdXNlciBrZXkuIGAgK1xuICAgICAgICBgRXhwZWN0ZWQgJHtleHBlY3RlZFB1Yn0sIGdvdCAke2Rlcml2ZWRQdWJ9LmBcbiAgICApO1xuICAgIHRoaXMubmFtZSA9ICdTYWZlRGVyaXZlZFB1YmxpY0tleU1pc21hdGNoRXJyb3InO1xuICB9XG59XG5cbi8qKiBUaHJvd24gd2hlbiBvd25lciBzaWduaW5nIGlzIG5vdCBpbXBsZW1lbnRlZCBmb3IgdGhpcyBzYWZlIHNsb3QgKFRTUywgZWQyNTUxOSBtdWx0aXNpZywg4oCmKS4gKi9cbmV4cG9ydCBjbGFzcyBTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgY29uc3RydWN0b3Iod2FsbGV0SWQ6IHN0cmluZywgZGV0YWlsOiBzdHJpbmcpIHtcbiAgICBzdXBlcihgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06ICR7ZGV0YWlsfWApO1xuICAgIHRoaXMubmFtZSA9ICdTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvcic7XG4gIH1cbn1cblxuLyoqIGVkMjU1MTkgb25jaGFpbiBtdWx0aXNpZyAoc2xvdCDikaMpLiBOZWVkcyBTTElQLTAwMTAsIG5vdCBzZWNwMjU2azEgQklQMzIuICovXG5jb25zdCBFRDI1NTE5X09OQ0hBSU5fRkFNSUxJRVMgPSBuZXcgU2V0KFsnYWxnbycsICd4bG0nLCAnaGJhciddKTtcblxuLyoqXG4gKiBUcnVlIHdoZW4gdGhpcyBpcyB0aGUgc2FmZSBtaW50ZXIncyB1c2VyIGtleTogd2FsbGV0IGlzIGluIGEgc2FmZSwgdGhlIGtleVxuICogaGFzIGEgcGFyZW50IHJvb3QsIGFuZCB0aGVyZSBpcyBubyBjaGlsZC1sZXZlbCBlbmNyeXB0ZWRQcnYgKHNoYXJlZXMgaGF2ZSBvbmUpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNTYWZlQ2hpbGRQdWJsaWNPbmx5S2V5Y2hhaW4oXG4gIHdhbGxldFNhZmVJZDogc3RyaW5nIHwgdW5kZWZpbmVkLFxuICBrZXljaGFpbjogS2V5Y2hhaW4gfCB1bmRlZmluZWRcbik6IGtleWNoYWluIGlzIEtleWNoYWluICYgeyBwYXJlbnQ6IHN0cmluZyB9IHtcbiAgcmV0dXJuICEhKHdhbGxldFNhZmVJZCAmJiBrZXljaGFpbj8ucGFyZW50ICYmICFrZXljaGFpbi5lbmNyeXB0ZWRQcnYpO1xufVxuXG4vKipcbiAqIEZldGNoIHRoZSByb290IHVzZXIga2V5Y2hhaW4gZm9yIGEgc2FmZSBjaGlsZCBrZXkuXG4gKiBSZXF1aXJlcyBgc291cmNlID09PSAndXNlcidgIHNvIGEgbWlzY29uZmlndXJlZCBwYXJlbnQgZmFpbHMgZWFybHkuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBmZXRjaFJvb3RLZXljaGFpbkZvclNhZmVDaGlsZChcbiAga2V5Y2hhaW5zOiBJS2V5Y2hhaW5zLFxuICBjaGlsZEtleWNoYWluOiBLZXljaGFpblxuKTogUHJvbWlzZTxLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnY+IHtcbiAgaWYgKCFjaGlsZEtleWNoYWluLnBhcmVudCkge1xuICAgIHRocm93IG5ldyBFcnJvcignY2hpbGRLZXljaGFpbi5wYXJlbnQgaXMgcmVxdWlyZWQgdG8gZmV0Y2ggdGhlIHJvb3Qga2V5Y2hhaW4nKTtcbiAgfVxuICBjb25zdCByb290ID0gYXdhaXQga2V5Y2hhaW5zLmdldCh7IGlkOiBjaGlsZEtleWNoYWluLnBhcmVudCB9KTtcbiAgaWYgKHJvb3Quc291cmNlICE9PSAndXNlcicpIHtcbiAgICB0aHJvdyBuZXcgSW52YWxpZFJvb3RLZXljaGFpblNvdXJjZUVycm9yKHJvb3QuaWQsIHJvb3Quc291cmNlKTtcbiAgfVxuICBpZiAoIXJvb3QuZW5jcnlwdGVkUHJ2KSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGByb290IGtleWNoYWluICR7cm9vdC5pZH0gZG9lcyBub3QgaGF2ZSBwcm9wZXJ0eSBlbmNyeXB0ZWRQcnZgKTtcbiAgfVxuICByZXR1cm4gcm9vdCBhcyBLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnY7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVzb2x2ZVNhZmVPd25lclNpZ25pbmdQcnZQYXJhbXMge1xuICBiaXRnbzogQml0R29CYXNlO1xuICBrZXljaGFpbnM6IElLZXljaGFpbnM7XG4gIHdhbGxldElkOiBzdHJpbmc7XG4gIC8qKiBPbmNoYWluIHNlY3AyNTZrMTogaGFyZGVuZWQtZGVyaXZlIGFuZCB2ZXJpZnkgcHViLiBPdGhlciBzbG90cyB0aHJvdy4gKi9cbiAgbXVsdGlzaWdUeXBlOiBzdHJpbmcgfCB1bmRlZmluZWQ7XG4gIGNvaW5GYW1pbHk6IHN0cmluZztcbiAgY2hpbGRLZXljaGFpbjogS2V5Y2hhaW47XG4gIHdhbGxldFBhc3NwaHJhc2U6IHN0cmluZztcbiAgLyoqIFdoZW4gYWxyZWFkeSBmZXRjaGVkIChwYXNzcGhyYXNlIHByZWZsaWdodCksIHNraXAgYSBzZWNvbmQgR0VULiAqL1xuICByb290S2V5Y2hhaW4/OiBLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnY7XG59XG5cbi8qKlxuICogUmVzb2x2ZSBzaWduaW5nIG1hdGVyaWFsIGZvciBhIHNhZmUgb3duZXIgKGNoaWxkIGtleSBoYXMgbm8gZW5jcnlwdGVkUHJ2KS5cbiAqXG4gKiBPbmNoYWluIHNlY3AyNTZrMTogZGVjcnlwdCByb290LCBoYXJkZW5lZC1kZXJpdmUgYXQgYGRlcml2ZWRGcm9tUGFyZW50V2l0aEhhcmRlbmVkUGF0aGBcbiAqIChgbS88bj4nYCksIGFuZCB2ZXJpZnkgdGhlIHJlZ2lzdGVyZWQgcHViLlxuICogVFNTIGFuZCBlZDI1NTE5IG9uY2hhaW46IHRocm93IOKAlCBkbyBub3QgcmV0dXJuIHJvb3QgbWF0ZXJpYWwgb3IgQklQMzItZGVyaXZlIHRoZSB3cm9uZyBjdXJ2ZS5cbiAqXG4gKiBEbyBub3QgdXNlIGZvciB3YWxsZXQgc2hhcmluZyDigJQgdGhhdCBtdXN0IG5vdCByZWNlaXZlIHJvb3Qga2V5IG1hdGVyaWFsLlxuICogQ2FsbCBvbmx5IHdoZW4gYGlzU2FmZUNoaWxkUHVibGljT25seUtleWNoYWluYCBpcyB0cnVlLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZVNhZmVPd25lclNpZ25pbmdQcnYocGFyYW1zOiBSZXNvbHZlU2FmZU93bmVyU2lnbmluZ1BydlBhcmFtcyk6IFByb21pc2U8c3RyaW5nPiB7XG4gIGNvbnN0IHsgYml0Z28sIGtleWNoYWlucywgd2FsbGV0SWQsIG11bHRpc2lnVHlwZSwgY29pbkZhbWlseSwgY2hpbGRLZXljaGFpbiwgd2FsbGV0UGFzc3BocmFzZSB9ID0gcGFyYW1zO1xuXG4gIGlmIChtdWx0aXNpZ1R5cGUgIT09ICdvbmNoYWluJykge1xuICAgIHRocm93IG5ldyBTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvcihcbiAgICAgIHdhbGxldElkLFxuICAgICAgJ1RTUyBvd25lciBzaWduaW5nIGZyb20gdGhlIHJvb3Qga2V5c2hhcmUgaXMgbm90IGltcGxlbWVudGVkLiAnICtcbiAgICAgICAgJ1JldHVybmluZyB0aGUgcm9vdCBwcml2YXRlIGtleSB3b3VsZCBleHBvc2UgbWF0ZXJpYWwgdGhhdCBjYW4gZGVyaXZlIGV2ZXJ5IGNoaWxkIGluIHRoaXMgc2xvdC4nXG4gICAgKTtcbiAgfVxuICBpZiAoRUQyNTUxOV9PTkNIQUlOX0ZBTUlMSUVTLmhhcyhjb2luRmFtaWx5KSkge1xuICAgIHRocm93IG5ldyBTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvcihcbiAgICAgIHdhbGxldElkLFxuICAgICAgYGVkMjU1MTkgbXVsdGlzaWcgb3duZXIgZGVyaXZhdGlvbiAoJHtjb2luRmFtaWx5fSkgaXMgbm90IGltcGxlbWVudGVkOyBCSVAzMiB3b3VsZCBwcm9kdWNlIHRoZSB3cm9uZyBjaGlsZCBrZXkuYFxuICAgICk7XG4gIH1cblxuICBjb25zdCByb290S2V5Y2hhaW4gPSBwYXJhbXMucm9vdEtleWNoYWluID8/IChhd2FpdCBmZXRjaFJvb3RLZXljaGFpbkZvclNhZmVDaGlsZChrZXljaGFpbnMsIGNoaWxkS2V5Y2hhaW4pKTtcbiAgY29uc3Qgcm9vdFBydiA9IGF3YWl0IGRlY3J5cHRLZXljaGFpblByaXZhdGVLZXkoYml0Z28sIHJvb3RLZXljaGFpbiwgd2FsbGV0UGFzc3BocmFzZSk7XG4gIGlmICghcm9vdFBydikge1xuICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCk7XG4gIH1cblxuICBpZiAoIWNoaWxkS2V5Y2hhaW4ucHViKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogY2hpbGQga2V5Y2hhaW4gaXMgbWlzc2luZyBwdWIgZm9yIHByZS1zaWduIHZlcmlmaWNhdGlvbmApO1xuICB9XG4gIGlmIChjaGlsZEtleWNoYWluLmRlcml2ZWRGcm9tUGFyZW50V2l0aEhhcmRlbmVkUGF0aCA9PT0gdW5kZWZpbmVkKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogY2hpbGQga2V5Y2hhaW4gaXMgbWlzc2luZyBkZXJpdmVkRnJvbVBhcmVudFdpdGhIYXJkZW5lZFBhdGhgKTtcbiAgfVxuXG4gIGNvbnN0IGRlcml2ZWQgPSBkZXJpdmVTYWZlQ2hpbGRIYXJkZW5lZEZyb21YcHJ2KFxuICAgIHJvb3RQcnYsXG4gICAgcGFyc2VEZXJpdmVkRnJvbVBhcmVudFdpdGhIYXJkZW5lZFBhdGgoY2hpbGRLZXljaGFpbi5kZXJpdmVkRnJvbVBhcmVudFdpdGhIYXJkZW5lZFBhdGgpXG4gICk7XG4gIGlmIChkZXJpdmVkLnB1YiAhPT0gY2hpbGRLZXljaGFpbi5wdWIpIHtcbiAgICB0aHJvdyBuZXcgU2FmZURlcml2ZWRQdWJsaWNLZXlNaXNtYXRjaEVycm9yKHdhbGxldElkLCBjaGlsZEtleWNoYWluLnB1YiwgZGVyaXZlZC5wdWIpO1xuICB9XG4gIHJldHVybiBkZXJpdmVkLnBydjtcbn1cbiJdfQ==