@bitgo-beta/sdk-core 8.2.1-beta.209 → 8.2.1-beta.2091

package/dist/src/bitgo/safe/iSafe.d.ts

@@ -0,0 +1,124 @@
+/**
+ * @prettier
+ *
+ * @experimental The safe client surface is experimental and may change (including breaking
+ * changes) before the public release.
+ */
+import type { FreezeSafeBody, SafeData, SafePermission, SafeRootKeys, SafeShareData, SafeShareKeychain, SafeShareState, WebAuthnOtpDevice } from '@bitgo/public-types';
+import type { EncryptionVersion } from '../../api/types';
+import type { Wallet, WalletShare } from '../wallet';
+import type { WebAuthnProvider } from '../webauthn';
+/** @experimental */
+export interface InitializeSafeOptions {
+    label: string;
+}
+/** @experimental */
+export interface UpdateSafeOptions {
+    label: string;
+}
+/**
+ * Phase 3 — the client hands back the 12 key ids it created in Phase 2.
+ * @experimental
+ */
+export interface FinalizeSafeOptions {
+    rootKeys: SafeRootKeys;
+}
+/**
+ * Sharing ONE safe wallet with a non-member rides the existing wallet-share handshake,
+ * so the result is the existing WalletShare shape.
+ */
+export type WalletShareData = WalletShare;
+export interface CreateSafeWalletOptions {
+    coin: string;
+    label: string;
+    passphrase: string;
+    type?: 'hot';
+    /**
+     * Mint scheme: `onchain` (default) uses the independent multisig root slot for the coin's
+     * curve; `tss` uses the MPC root slot. Independent of the coin's default wallet multisig type.
+     */
+    multisigType?: 'onchain' | 'tss';
+}
+interface AddSafeMemberBase {
+    permissions: SafePermission[];
+    /** required when 'spend' is included — the 4 root user keys ECDH-re-encrypted to the invitee */
+    keychains?: SafeShareKeychain[];
+    message?: string;
+    /** when true, suppress the invitation email that would otherwise be sent to `email` */
+    disableEmail?: boolean;
+}
+/** Add a member by either `userId` or `email` — exactly one is required. */
+export type AddSafeMemberOptions = (AddSafeMemberBase & {
+    userId: string;
+    email?: never;
+}) | (AddSafeMemberBase & {
+    email: string;
+    userId?: never;
+});
+export interface AddSafeWalletMemberOptions {
+    walletId: string;
+    /** required — sharing re-encrypts the user key, which needs hardened derivation from the passphrase */
+    walletPassphrase: string;
+    email?: string;
+    permissions?: string[];
+    message?: string;
+}
+export type AcceptSafeShareAsSpenderOptions = {
+    safeShareId: string;
+    userPassword: string;
+    newWalletPassphrase?: string;
+};
+export type AcceptSafeShareAsNonSpenderOptions = {
+    safeShareId: string;
+};
+export type AcceptSafeShareOptions = AcceptSafeShareAsSpenderOptions | AcceptSafeShareAsNonSpenderOptions;
+/**
+ * Register a PRF passkey on every user root of the safe. The device must be PRF-capable
+ * and already enrolled on the caller's account.
+ * @experimental
+ */
+export interface RegisterSafePasskeyOptions {
+    device: WebAuthnOtpDevice;
+    safePassphrase: string;
+    provider: WebAuthnProvider;
+    /** Encryption version for the PRF-wrapped blobs; defaults to the SDK default (mirrors wallet attach). */
+    encryptionVersion?: EncryptionVersion;
+}
+/**
+ * Remove a PRF passkey from every user root. `safePassphrase` is verified client-side
+ * (decrypts a user root) before the server is called.
+ * @experimental
+ */
+export interface RemoveSafePasskeyOptions {
+    device: WebAuthnOtpDevice;
+    safePassphrase: string;
+}
+export interface RegisterSafePasskeyResponse {
+    otpDeviceId: string;
+    updatedKeys: string[];
+}
+/**
+ * @experimental
+ */
+export interface ISafe {
+    id(): string;
+    enterpriseId(): string;
+    label(): string;
+    status(): SafeData['status'];
+    url(extra?: string): string;
+    createWallet(params: CreateSafeWalletOptions): Promise<Wallet>;
+    update(params: UpdateSafeOptions): Promise<SafeData>;
+    addMember(params: AddSafeMemberOptions): Promise<SafeData>;
+    addMemberToWallet(params: AddSafeWalletMemberOptions): Promise<WalletShareData>;
+    listShares(params?: {
+        state?: SafeShareState;
+    }): Promise<SafeShareData[]>;
+    acceptShare(params: AcceptSafeShareOptions): Promise<SafeShareData>;
+    registerPasskey(params: RegisterSafePasskeyOptions): Promise<RegisterSafePasskeyResponse>;
+    removePasskey(params: RemoveSafePasskeyOptions): Promise<void>;
+    freeze(params?: FreezeSafeBody): Promise<SafeData>;
+    archive(): Promise<SafeData>;
+    toJSON(): SafeData;
+}
+export {};
+//# sourceMappingURL=iSafe.d.ts.map

package/dist/src/bitgo/safe/iSafe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iSafe.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/iSafe.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,oBAAoB;AACpB,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oBAAoB;AACpB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAI1C,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;CAClC;AAED,UAAU,iBAAiB;IACzB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,gGAAgG;IAChG,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,MAAM,oBAAoB,GAC5B,CAAC,iBAAiB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GACvD,CAAC,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE5D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,+BAA+B,GAAG,kCAAkC,CAAC;AAE1G;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yGAAyG;IACzG,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,EAAE,IAAI,MAAM,CAAC;IACb,YAAY,IAAI,MAAM,CAAC;IACvB,KAAK,IAAI,MAAM,CAAC;IAChB,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAGrD,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,iBAAiB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChF,UAAU,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpE,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1F,aAAa,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,MAAM,IAAI,QAAQ,CAAC;CACpB"}

package/dist/src/bitgo/safe/iSafe.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaVNhZmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9pU2FmZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFRoZSBzYWZlIGNsaWVudCBzdXJmYWNlIGlzIGV4cGVyaW1lbnRhbCBhbmQgbWF5IGNoYW5nZSAoaW5jbHVkaW5nIGJyZWFraW5nXG4gKiBjaGFuZ2VzKSBiZWZvcmUgdGhlIHB1YmxpYyByZWxlYXNlLlxuICovXG4vLyBXaXJlL2RhdGEgc2hhcGVzIGFyZSBvd25lZCBieSBAYml0Z28vcHVibGljLXR5cGVzIOKAlCBpbXBvcnQgdGhlbSB3aGVyZSBuZWVkZWQgcmF0aGVyIHRoYW5cbi8vIHJlLWV4cG9ydGluZyBmcm9tIHNkay1jb3JlLlxuaW1wb3J0IHR5cGUge1xuICBGcmVlemVTYWZlQm9keSxcbiAgU2FmZURhdGEsXG4gIFNhZmVQZXJtaXNzaW9uLFxuICBTYWZlUm9vdEtleXMsXG4gIFNhZmVTaGFyZURhdGEsXG4gIFNhZmVTaGFyZUtleWNoYWluLFxuICBTYWZlU2hhcmVTdGF0ZSxcbiAgV2ViQXV0aG5PdHBEZXZpY2UsXG59IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHR5cGUgeyBFbmNyeXB0aW9uVmVyc2lvbiB9IGZyb20gJy4uLy4uL2FwaS90eXBlcyc7XG5pbXBvcnQgdHlwZSB7IFdhbGxldCwgV2FsbGV0U2hhcmUgfSBmcm9tICcuLi93YWxsZXQnO1xuaW1wb3J0IHR5cGUgeyBXZWJBdXRoblByb3ZpZGVyIH0gZnJvbSAnLi4vd2ViYXV0aG4nO1xuXG4vKiogQGV4cGVyaW1lbnRhbCAqL1xuZXhwb3J0IGludGVyZmFjZSBJbml0aWFsaXplU2FmZU9wdGlvbnMge1xuICBsYWJlbDogc3RyaW5nO1xufVxuXG4vKiogQGV4cGVyaW1lbnRhbCAqL1xuZXhwb3J0IGludGVyZmFjZSBVcGRhdGVTYWZlT3B0aW9ucyB7XG4gIGxhYmVsOiBzdHJpbmc7XG59XG5cbi8qKlxuICogUGhhc2UgMyDigJQgdGhlIGNsaWVudCBoYW5kcyBiYWNrIHRoZSAxMiBrZXkgaWRzIGl0IGNyZWF0ZWQgaW4gUGhhc2UgMi5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBGaW5hbGl6ZVNhZmVPcHRpb25zIHtcbiAgcm9vdEtleXM6IFNhZmVSb290S2V5cztcbn1cblxuLyoqXG4gKiBTaGFyaW5nIE9ORSBzYWZlIHdhbGxldCB3aXRoIGEgbm9uLW1lbWJlciByaWRlcyB0aGUgZXhpc3Rpbmcgd2FsbGV0LXNoYXJlIGhhbmRzaGFrZSxcbiAqIHNvIHRoZSByZXN1bHQgaXMgdGhlIGV4aXN0aW5nIFdhbGxldFNoYXJlIHNoYXBlLlxuICovXG5leHBvcnQgdHlwZSBXYWxsZXRTaGFyZURhdGEgPSBXYWxsZXRTaGFyZTtcblxuLy8gLS0tLSBwZXItc2FmZSBvcGVyYXRpb24gb3B0aW9ucyAtLS0tXG5cbmV4cG9ydCBpbnRlcmZhY2UgQ3JlYXRlU2FmZVdhbGxldE9wdGlvbnMge1xuICBjb2luOiBzdHJpbmc7XG4gIGxhYmVsOiBzdHJpbmc7XG4gIHBhc3NwaHJhc2U6IHN0cmluZztcbiAgdHlwZT86ICdob3QnO1xuICAvKipcbiAgICogTWludCBzY2hlbWU6IGBvbmNoYWluYCAoZGVmYXVsdCkgdXNlcyB0aGUgaW5kZXBlbmRlbnQgbXVsdGlzaWcgcm9vdCBzbG90IGZvciB0aGUgY29pbidzXG4gICAqIGN1cnZlOyBgdHNzYCB1c2VzIHRoZSBNUEMgcm9vdCBzbG90LiBJbmRlcGVuZGVudCBvZiB0aGUgY29pbidzIGRlZmF1bHQgd2FsbGV0IG11bHRpc2lnIHR5cGUuXG4gICAqL1xuICBtdWx0aXNpZ1R5cGU/OiAnb25jaGFpbicgfCAndHNzJztcbn1cblxuaW50ZXJmYWNlIEFkZFNhZmVNZW1iZXJCYXNlIHtcbiAgcGVybWlzc2lvbnM6IFNhZmVQZXJtaXNzaW9uW107XG4gIC8qKiByZXF1aXJlZCB3aGVuICdzcGVuZCcgaXMgaW5jbHVkZWQg4oCUIHRoZSA0IHJvb3QgdXNlciBrZXlzIEVDREgtcmUtZW5jcnlwdGVkIHRvIHRoZSBpbnZpdGVlICovXG4gIGtleWNoYWlucz86IFNhZmVTaGFyZUtleWNoYWluW107XG4gIG1lc3NhZ2U/OiBzdHJpbmc7XG4gIC8qKiB3aGVuIHRydWUsIHN1cHByZXNzIHRoZSBpbnZpdGF0aW9uIGVtYWlsIHRoYXQgd291bGQgb3RoZXJ3aXNlIGJlIHNlbnQgdG8gYGVtYWlsYCAqL1xuICBkaXNhYmxlRW1haWw/OiBib29sZWFuO1xufVxuXG4vKiogQWRkIGEgbWVtYmVyIGJ5IGVpdGhlciBgdXNlcklkYCBvciBgZW1haWxgIOKAlCBleGFjdGx5IG9uZSBpcyByZXF1aXJlZC4gKi9cbmV4cG9ydCB0eXBlIEFkZFNhZmVNZW1iZXJPcHRpb25zID1cbiAgfCAoQWRkU2FmZU1lbWJlckJhc2UgJiB7IHVzZXJJZDogc3RyaW5nOyBlbWFpbD86IG5ldmVyIH0pXG4gIHwgKEFkZFNhZmVNZW1iZXJCYXNlICYgeyBlbWFpbDogc3RyaW5nOyB1c2VySWQ/OiBuZXZlciB9KTtcblxuZXhwb3J0IGludGVyZmFjZSBBZGRTYWZlV2FsbGV0TWVtYmVyT3B0aW9ucyB7XG4gIHdhbGxldElkOiBzdHJpbmc7XG4gIC8qKiByZXF1aXJlZCDigJQgc2hhcmluZyByZS1lbmNyeXB0cyB0aGUgdXNlciBrZXksIHdoaWNoIG5lZWRzIGhhcmRlbmVkIGRlcml2YXRpb24gZnJvbSB0aGUgcGFzc3BocmFzZSAqL1xuICB3YWxsZXRQYXNzcGhyYXNlOiBzdHJpbmc7XG4gIGVtYWlsPzogc3RyaW5nO1xuICBwZXJtaXNzaW9ucz86IHN0cmluZ1tdO1xuICBtZXNzYWdlPzogc3RyaW5nO1xufVxuXG5leHBvcnQgdHlwZSBBY2NlcHRTYWZlU2hhcmVBc1NwZW5kZXJPcHRpb25zID0ge1xuICBzYWZlU2hhcmVJZDogc3RyaW5nO1xuICB1c2VyUGFzc3dvcmQ6IHN0cmluZztcbiAgbmV3V2FsbGV0UGFzc3BocmFzZT86IHN0cmluZztcbn07XG5leHBvcnQgdHlwZSBBY2NlcHRTYWZlU2hhcmVBc05vblNwZW5kZXJPcHRpb25zID0ge1xuICBzYWZlU2hhcmVJZDogc3RyaW5nO1xufTtcbmV4cG9ydCB0eXBlIEFjY2VwdFNhZmVTaGFyZU9wdGlvbnMgPSBBY2NlcHRTYWZlU2hhcmVBc1NwZW5kZXJPcHRpb25zIHwgQWNjZXB0U2FmZVNoYXJlQXNOb25TcGVuZGVyT3B0aW9ucztcblxuLyoqXG4gKiBSZWdpc3RlciBhIFBSRiBwYXNza2V5IG9uIGV2ZXJ5IHVzZXIgcm9vdCBvZiB0aGUgc2FmZS4gVGhlIGRldmljZSBtdXN0IGJlIFBSRi1jYXBhYmxlXG4gKiBhbmQgYWxyZWFkeSBlbnJvbGxlZCBvbiB0aGUgY2FsbGVyJ3MgYWNjb3VudC5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBSZWdpc3RlclNhZmVQYXNza2V5T3B0aW9ucyB7XG4gIGRldmljZTogV2ViQXV0aG5PdHBEZXZpY2U7XG4gIHNhZmVQYXNzcGhyYXNlOiBzdHJpbmc7XG4gIHByb3ZpZGVyOiBXZWJBdXRoblByb3ZpZGVyO1xuICAvKiogRW5jcnlwdGlvbiB2ZXJzaW9uIGZvciB0aGUgUFJGLXdyYXBwZWQgYmxvYnM7IGRlZmF1bHRzIHRvIHRoZSBTREsgZGVmYXVsdCAobWlycm9ycyB3YWxsZXQgYXR0YWNoKS4gKi9cbiAgZW5jcnlwdGlvblZlcnNpb24/OiBFbmNyeXB0aW9uVmVyc2lvbjtcbn1cblxuLyoqXG4gKiBSZW1vdmUgYSBQUkYgcGFzc2tleSBmcm9tIGV2ZXJ5IHVzZXIgcm9vdC4gYHNhZmVQYXNzcGhyYXNlYCBpcyB2ZXJpZmllZCBjbGllbnQtc2lkZVxuICogKGRlY3J5cHRzIGEgdXNlciByb290KSBiZWZvcmUgdGhlIHNlcnZlciBpcyBjYWxsZWQuXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVtb3ZlU2FmZVBhc3NrZXlPcHRpb25zIHtcbiAgZGV2aWNlOiBXZWJBdXRobk90cERldmljZTtcbiAgc2FmZVBhc3NwaHJhc2U6IHN0cmluZztcbn1cblxuZXhwb3J0IGludGVyZmFjZSBSZWdpc3RlclNhZmVQYXNza2V5UmVzcG9uc2Uge1xuICBvdHBEZXZpY2VJZDogc3RyaW5nO1xuICB1cGRhdGVkS2V5czogc3RyaW5nW107XG59XG5cbi8qKlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgaW50ZXJmYWNlIElTYWZlIHtcbiAgaWQoKTogc3RyaW5nO1xuICBlbnRlcnByaXNlSWQoKTogc3RyaW5nO1xuICBsYWJlbCgpOiBzdHJpbmc7XG4gIHN0YXR1cygpOiBTYWZlRGF0YVsnc3RhdHVzJ107XG4gIHVybChleHRyYT86IHN0cmluZyk6IHN0cmluZztcbiAgY3JlYXRlV2FsbGV0KHBhcmFtczogQ3JlYXRlU2FmZVdhbGxldE9wdGlvbnMpOiBQcm9taXNlPFdhbGxldD47XG4gIHVwZGF0ZShwYXJhbXM6IFVwZGF0ZVNhZmVPcHRpb25zKTogUHJvbWlzZTxTYWZlRGF0YT47XG4gIC8vIHdob2xlLXNhZmU6IHZpZXcvYWRtaW4vc3BlbmQvZGFwcDsgc3BlbmQgb3BlbnMgYSBrZXkgc2hhcmUgKGFsc28gaG93IGEgc3BlbmRlciBzZXJ2aWNlcyBhXG4gIC8vIHNhZmVTaGFyZVJlcXVlc3RzIGVudHJ5IGluIFVNUyBvcmdzKVxuICBhZGRNZW1iZXIocGFyYW1zOiBBZGRTYWZlTWVtYmVyT3B0aW9ucyk6IFByb21pc2U8U2FmZURhdGE+O1xuICAvLyBzaGFyZSBPTkUgc2FmZSB3YWxsZXQsIG5vdCB0aGUgd2hvbGUgc2FmZVxuICBhZGRNZW1iZXJUb1dhbGxldChwYXJhbXM6IEFkZFNhZmVXYWxsZXRNZW1iZXJPcHRpb25zKTogUHJvbWlzZTxXYWxsZXRTaGFyZURhdGE+O1xuICBsaXN0U2hhcmVzKHBhcmFtcz86IHsgc3RhdGU/OiBTYWZlU2hhcmVTdGF0ZSB9KTogUHJvbWlzZTxTYWZlU2hhcmVEYXRhW10+O1xuICBhY2NlcHRTaGFyZShwYXJhbXM6IEFjY2VwdFNhZmVTaGFyZU9wdGlvbnMpOiBQcm9taXNlPFNhZmVTaGFyZURhdGE+O1xuICByZWdpc3RlclBhc3NrZXkocGFyYW1zOiBSZWdpc3RlclNhZmVQYXNza2V5T3B0aW9ucyk6IFByb21pc2U8UmVnaXN0ZXJTYWZlUGFzc2tleVJlc3BvbnNlPjtcbiAgcmVtb3ZlUGFzc2tleShwYXJhbXM6IFJlbW92ZVNhZmVQYXNza2V5T3B0aW9ucyk6IFByb21pc2U8dm9pZD47XG4gIGZyZWV6ZShwYXJhbXM/OiBGcmVlemVTYWZlQm9keSk6IFByb21pc2U8U2FmZURhdGE+O1xuICBhcmNoaXZlKCk6IFByb21pc2U8U2FmZURhdGE+O1xuICB0b0pTT04oKTogU2FmZURhdGE7XG59XG4iXX0=

package/dist/src/bitgo/safe/iSafes.d.ts

@@ -0,0 +1,94 @@
+/**
+ * @prettier
+ *
+ * @experimental The safe client surface is experimental and may change (including breaking
+ * changes) before the public release.
+ */
+import type { InitializeSafeResponse } from '@bitgo/public-types';
+import { FinalizeSafeOptions, InitializeSafeOptions } from './iSafe';
+import { Safe } from './safe';
+/**
+ * Options for safe creation.
+ *
+ * v1 targets the HOT custody model only: the multisig root user/backup keys are generated locally
+ * by the SDK, encrypted with `passphrase`, and registered on BitGo; the MPC roots run the standard
+ * hot ceremonies with the same passphrase. Self-managed cold keys and custodial safes are out of
+ * scope for v1.
+ * @experimental
+ */
+export interface CreateSafeOptions {
+    label: string;
+    passphrase: string;
+}
+/**
+ * Handle returned by `initializeSafe`, threaded into the key ceremonies and finalize.
+ *
+ * `enabledRootSlots` is the server-decided (Flipt, evaluated once at initialize) set of root-key
+ * slots to generate; absent (older WP) falls back to all 4 slots.
+ * @experimental
+ */
+export interface SafeCreationHandle {
+    safeId: string;
+    enabledRootSlots?: InitializeSafeResponse['enabledRootSlots'];
+}
+/**
+ * The minted root key ids produced by `createSafeKeys`, as ordered [user, backup, bitgo]
+ * triplets for the enabled slots — exactly the payload `finalizeSafe` consumes.
+ * @experimental
+ */
+export type SafeKeys = FinalizeSafeOptions;
+/**
+ * @experimental
+ */
+export interface ListSafesOptions {
+    cursor?: string;
+    limit?: number;
+}
+/**
+ * @experimental
+ */
+export interface GetSafeOptions {
+    id: string;
+}
+/**
+ * @experimental
+ */
+export interface ISafes {
+    /**
+     * One-call convenience wrapper chaining the three creation phases:
+     * initialize → createSafeKeys (safeId-tagged ceremonies for the enabled root slots) → finalize.
+     * HOT custody only in v1.
+     * @experimental
+     */
+    generateSafe(params: CreateSafeOptions): Promise<Safe>;
+    /**
+     * Phase 1 — initialize a safe (metadata only, no key material). The server response is
+     * `{ id, status }` plus optional `enabledRootSlots` (no `label`/`enterpriseId`/`creator`/`users`/
+     * `createdAt` yet), so this returns that raw shape rather than a full `Safe`.
+     * @experimental
+     */
+    initializeSafe(params: InitializeSafeOptions): Promise<InitializeSafeResponse>;
+    /**
+     * Phase 2 — run the enabled root key ceremonies tagged with `safeId`; returns the minted key ids.
+     * @experimental
+     */
+    createSafeKeys(params: CreateSafeOptions & SafeCreationHandle): Promise<SafeKeys>;
+    /**
+     * Phase 3 — finalize a safe with the minted root key ids. Idempotent.
+     * @experimental
+     */
+    finalizeSafe(safeId: string, params: FinalizeSafeOptions): Promise<Safe>;
+    /**
+     * Archive a safe. Also the abandonment path for a stuck `initializing` safe.
+     * @experimental
+     */
+    archiveSafe(safeId: string): Promise<Safe>;
+    /** @experimental */
+    list(params?: ListSafesOptions): Promise<{
+        safes: Safe[];
+        nextCursor?: string;
+    }>;
+    /** @experimental */
+    get(params: GetSafeOptions): Promise<Safe>;
+}
+//# sourceMappingURL=iSafes.d.ts.map

package/dist/src/bitgo/safe/iSafes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iSafes.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/iSafes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAE3C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/E;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,oBAAoB;IACpB,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,oBAAoB;IACpB,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}

package/dist/src/bitgo/safe/iSafes.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaVNhZmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3NhZmUvaVNhZmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBwcmV0dGllclxuICpcbiAqIEBleHBlcmltZW50YWwgVGhlIHNhZmUgY2xpZW50IHN1cmZhY2UgaXMgZXhwZXJpbWVudGFsIGFuZCBtYXkgY2hhbmdlIChpbmNsdWRpbmcgYnJlYWtpbmdcbiAqIGNoYW5nZXMpIGJlZm9yZSB0aGUgcHVibGljIHJlbGVhc2UuXG4gKi9cbmltcG9ydCB0eXBlIHsgSW5pdGlhbGl6ZVNhZmVSZXNwb25zZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHsgRmluYWxpemVTYWZlT3B0aW9ucywgSW5pdGlhbGl6ZVNhZmVPcHRpb25zIH0gZnJvbSAnLi9pU2FmZSc7XG5pbXBvcnQgeyBTYWZlIH0gZnJvbSAnLi9zYWZlJztcblxuLyoqXG4gKiBPcHRpb25zIGZvciBzYWZlIGNyZWF0aW9uLlxuICpcbiAqIHYxIHRhcmdldHMgdGhlIEhPVCBjdXN0b2R5IG1vZGVsIG9ubHk6IHRoZSBtdWx0aXNpZyByb290IHVzZXIvYmFja3VwIGtleXMgYXJlIGdlbmVyYXRlZCBsb2NhbGx5XG4gKiBieSB0aGUgU0RLLCBlbmNyeXB0ZWQgd2l0aCBgcGFzc3BocmFzZWAsIGFuZCByZWdpc3RlcmVkIG9uIEJpdEdvOyB0aGUgTVBDIHJvb3RzIHJ1biB0aGUgc3RhbmRhcmRcbiAqIGhvdCBjZXJlbW9uaWVzIHdpdGggdGhlIHNhbWUgcGFzc3BocmFzZS4gU2VsZi1tYW5hZ2VkIGNvbGQga2V5cyBhbmQgY3VzdG9kaWFsIHNhZmVzIGFyZSBvdXQgb2ZcbiAqIHNjb3BlIGZvciB2MS5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBDcmVhdGVTYWZlT3B0aW9ucyB7XG4gIGxhYmVsOiBzdHJpbmc7XG4gIHBhc3NwaHJhc2U6IHN0cmluZzsgLy8gZW5jcnlwdHMgdGhlIGxvY2FsbHktZ2VuZXJhdGVkIG11bHRpc2lnIHVzZXIvYmFja3VwIHBydnM7IHNoYXJlZCB3aXRoIHRoZSBNUEMgY2VyZW1vbmllc1xufVxuXG4vKipcbiAqIEhhbmRsZSByZXR1cm5lZCBieSBgaW5pdGlhbGl6ZVNhZmVgLCB0aHJlYWRlZCBpbnRvIHRoZSBrZXkgY2VyZW1vbmllcyBhbmQgZmluYWxpemUuXG4gKlxuICogYGVuYWJsZWRSb290U2xvdHNgIGlzIHRoZSBzZXJ2ZXItZGVjaWRlZCAoRmxpcHQsIGV2YWx1YXRlZCBvbmNlIGF0IGluaXRpYWxpemUpIHNldCBvZiByb290LWtleVxuICogc2xvdHMgdG8gZ2VuZXJhdGU7IGFic2VudCAob2xkZXIgV1ApIGZhbGxzIGJhY2sgdG8gYWxsIDQgc2xvdHMuXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2FmZUNyZWF0aW9uSGFuZGxlIHtcbiAgc2FmZUlkOiBzdHJpbmc7XG4gIGVuYWJsZWRSb290U2xvdHM/OiBJbml0aWFsaXplU2FmZVJlc3BvbnNlWydlbmFibGVkUm9vdFNsb3RzJ107XG59XG5cbi8qKlxuICogVGhlIG1pbnRlZCByb290IGtleSBpZHMgcHJvZHVjZWQgYnkgYGNyZWF0ZVNhZmVLZXlzYCwgYXMgb3JkZXJlZCBbdXNlciwgYmFja3VwLCBiaXRnb11cbiAqIHRyaXBsZXRzIGZvciB0aGUgZW5hYmxlZCBzbG90cyDigJQgZXhhY3RseSB0aGUgcGF5bG9hZCBgZmluYWxpemVTYWZlYCBjb25zdW1lcy5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IHR5cGUgU2FmZUtleXMgPSBGaW5hbGl6ZVNhZmVPcHRpb25zO1xuXG4vKipcbiAqIEBleHBlcmltZW50YWxcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBMaXN0U2FmZXNPcHRpb25zIHtcbiAgY3Vyc29yPzogc3RyaW5nOyAvLyBvcGFxdWUgY3Vyc29yIGZyb20gYSBwcmV2aW91cyByZXNwb25zZSdzIG5leHRDdXJzb3JcbiAgbGltaXQ/OiBudW1iZXI7XG59XG5cbi8qKlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdldFNhZmVPcHRpb25zIHtcbiAgaWQ6IHN0cmluZztcbn1cblxuLyoqXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSVNhZmVzIHtcbiAgLyoqXG4gICAqIE9uZS1jYWxsIGNvbnZlbmllbmNlIHdyYXBwZXIgY2hhaW5pbmcgdGhlIHRocmVlIGNyZWF0aW9uIHBoYXNlczpcbiAgICogaW5pdGlhbGl6ZSDihpIgY3JlYXRlU2FmZUtleXMgKHNhZmVJZC10YWdnZWQgY2VyZW1vbmllcyBmb3IgdGhlIGVuYWJsZWQgcm9vdCBzbG90cykg4oaSIGZpbmFsaXplLlxuICAgKiBIT1QgY3VzdG9keSBvbmx5IGluIHYxLlxuICAgKiBAZXhwZXJpbWVudGFsXG4gICAqL1xuICBnZW5lcmF0ZVNhZmUocGFyYW1zOiBDcmVhdGVTYWZlT3B0aW9ucyk6IFByb21pc2U8U2FmZT47XG4gIC8qKlxuICAgKiBQaGFzZSAxIOKAlCBpbml0aWFsaXplIGEgc2FmZSAobWV0YWRhdGEgb25seSwgbm8ga2V5IG1hdGVyaWFsKS4gVGhlIHNlcnZlciByZXNwb25zZSBpc1xuICAgKiBgeyBpZCwgc3RhdHVzIH1gIHBsdXMgb3B0aW9uYWwgYGVuYWJsZWRSb290U2xvdHNgIChubyBgbGFiZWxgL2BlbnRlcnByaXNlSWRgL2BjcmVhdG9yYC9gdXNlcnNgL1xuICAgKiBgY3JlYXRlZEF0YCB5ZXQpLCBzbyB0aGlzIHJldHVybnMgdGhhdCByYXcgc2hhcGUgcmF0aGVyIHRoYW4gYSBmdWxsIGBTYWZlYC5cbiAgICogQGV4cGVyaW1lbnRhbFxuICAgKi9cbiAgaW5pdGlhbGl6ZVNhZmUocGFyYW1zOiBJbml0aWFsaXplU2FmZU9wdGlvbnMpOiBQcm9taXNlPEluaXRpYWxpemVTYWZlUmVzcG9uc2U+O1xuICAvKipcbiAgICogUGhhc2UgMiDigJQgcnVuIHRoZSBlbmFibGVkIHJvb3Qga2V5IGNlcmVtb25pZXMgdGFnZ2VkIHdpdGggYHNhZmVJZGA7IHJldHVybnMgdGhlIG1pbnRlZCBrZXkgaWRzLlxuICAgKiBAZXhwZXJpbWVudGFsXG4gICAqL1xuICBjcmVhdGVTYWZlS2V5cyhwYXJhbXM6IENyZWF0ZVNhZmVPcHRpb25zICYgU2FmZUNyZWF0aW9uSGFuZGxlKTogUHJvbWlzZTxTYWZlS2V5cz47XG4gIC8qKlxuICAgKiBQaGFzZSAzIOKAlCBmaW5hbGl6ZSBhIHNhZmUgd2l0aCB0aGUgbWludGVkIHJvb3Qga2V5IGlkcy4gSWRlbXBvdGVudC5cbiAgICogQGV4cGVyaW1lbnRhbFxuICAgKi9cbiAgZmluYWxpemVTYWZlKHNhZmVJZDogc3RyaW5nLCBwYXJhbXM6IEZpbmFsaXplU2FmZU9wdGlvbnMpOiBQcm9taXNlPFNhZmU+O1xuICAvKipcbiAgICogQXJjaGl2ZSBhIHNhZmUuIEFsc28gdGhlIGFiYW5kb25tZW50IHBhdGggZm9yIGEgc3R1Y2sgYGluaXRpYWxpemluZ2Agc2FmZS5cbiAgICogQGV4cGVyaW1lbnRhbFxuICAgKi9cbiAgYXJjaGl2ZVNhZmUoc2FmZUlkOiBzdHJpbmcpOiBQcm9taXNlPFNhZmU+O1xuICAvKiogQGV4cGVyaW1lbnRhbCAqL1xuICBsaXN0KHBhcmFtcz86IExpc3RTYWZlc09wdGlvbnMpOiBQcm9taXNlPHsgc2FmZXM6IFNhZmVbXTsgbmV4dEN1cnNvcj86IHN0cmluZyB9PjtcbiAgLyoqIEBleHBlcmltZW50YWwgKi9cbiAgZ2V0KHBhcmFtczogR2V0U2FmZU9wdGlvbnMpOiBQcm9taXNlPFNhZmU+O1xufVxuIl19

package/dist/src/bitgo/safe/index.d.ts

@@ -0,0 +1,8 @@
+export * from './derivableEd25519Pub';
+export * from './iSafe';
+export * from './iSafes';
+export * from './recovery';
+export * from './safe';
+export * from './safes';
+export * from '@bitgo-beta/sdk-lib-safes';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/bitgo/safe/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,2BAA2B,CAAC"}

package/dist/src/bitgo/safe/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./derivableEd25519Pub"), exports);
+__exportStar(require("./iSafe"), exports);
+__exportStar(require("./iSafes"), exports);
+__exportStar(require("./recovery"), exports);
+__exportStar(require("./safe"), exports);
+__exportStar(require("./safes"), exports);
+__exportStar(require("@bitgo-beta/sdk-lib-safes"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsd0RBQXNDO0FBQ3RDLDBDQUF3QjtBQUN4QiwyQ0FBeUI7QUFDekIsNkNBQTJCO0FBQzNCLHlDQUF1QjtBQUN2QiwwQ0FBd0I7QUFDeEIsNERBQTBDIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9kZXJpdmFibGVFZDI1NTE5UHViJztcbmV4cG9ydCAqIGZyb20gJy4vaVNhZmUnO1xuZXhwb3J0ICogZnJvbSAnLi9pU2FmZXMnO1xuZXhwb3J0ICogZnJvbSAnLi9yZWNvdmVyeSc7XG5leHBvcnQgKiBmcm9tICcuL3NhZmUnO1xuZXhwb3J0ICogZnJvbSAnLi9zYWZlcyc7XG5leHBvcnQgKiBmcm9tICdAYml0Z28tYmV0YS9zZGstbGliLXNhZmVzJztcbiJdfQ==

package/dist/src/bitgo/safe/recovery.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @prettier
+ *
+ * @experimental WRW-facing safe recovery entry points.
+ */
+import { Buffer } from 'buffer';
+import type { RootKeyType } from '@bitgo/public-types';
+import { BitGoBase } from '../bitgoBase';
+export type DecryptedMpcSafeRoot = {
+    signing: Buffer;
+    vrf: Buffer;
+};
+export type OnchainSafeRoot = {
+    user: string;
+    backup: string;
+    bitgo: string;
+};
+export type MpcSafeRoot = {
+    user: DecryptedMpcSafeRoot;
+    backup: DecryptedMpcSafeRoot;
+    bitgo: string;
+};
+export type Secp256k1MultisigChildKeys = {
+    user: {
+        prv: string;
+        pub: string;
+    };
+    backup: {
+        prv: string;
+        pub: string;
+    };
+    bitgo: {
+        pub: string;
+    };
+};
+export type DerivedSafeWalletKeys = {
+    path: string;
+    keys: Secp256k1MultisigChildKeys;
+};
+export type SafeRecoverKeyParams = {
+    userKey: string;
+    backupKey: string;
+    bitgoKey: string;
+    walletPassphrase?: string;
+};
+export type DecryptedSafeRoots = {
+    secp256k1Multisig: OnchainSafeRoot;
+    ed25519Multisig: OnchainSafeRoot;
+    ecdsaMpc: MpcSafeRoot;
+    eddsaMpc: MpcSafeRoot;
+};
+export declare function decryptSafeKeycard(params: {
+    bitgo: BitGoBase;
+    userKeyBox: string;
+    backupKeyBox: string;
+    bitgoKeyBox: string;
+    password: string;
+}): Promise<DecryptedSafeRoots>;
+/**
+ * Derives a Safe wallet's child keys at the BIP44 path for a given slot and account.
+ * Only `secp256k1Multisig` (slot 1) is supported for now; the remaining slots throw
+ * until their derivation arms land (WCN-2736/WCN-2737/WCN-2894).
+ */
+export declare function deriveSafeWalletKeys(params: {
+    coin: string;
+    slot: RootKeyType;
+    account: number;
+    roots: DecryptedSafeRoots;
+}): Promise<DerivedSafeWalletKeys>;
+/**
+ * Builds the key fields `coin.recover()` expects from derived Safe child keys.
+ * Only `secp256k1Multisig` (slot 1) is supported for now. Signed mode re-encrypts the
+ * child xprvs under a fresh ephemeral passphrase (v1/SJCL); unsigned mode returns pubs.
+ */
+export declare function buildSafeRecoverKeyParams(params: {
+    bitgo: BitGoBase;
+    coin: string;
+    slot: RootKeyType;
+    keys: Secp256k1MultisigChildKeys;
+    mode: 'signed' | 'unsigned';
+}): Promise<SafeRecoverKeyParams>;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/src/bitgo/safe/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/recovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtG,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,0BAA0B,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,iBAAiB,EAAE,eAAe,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6C9B;AAUD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,kBAAkB,CAAC;CAC3B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAmCjC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,0BAA0B,CAAC;IACjC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgChC"}

package/dist/src/bitgo/safe/recovery.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptSafeKeycard = decryptSafeKeycard;
+exports.deriveSafeWalletKeys = deriveSafeWalletKeys;
+exports.buildSafeRecoverKeyParams = buildSafeRecoverKeyParams;
+const crypto_1 = require("crypto");
+const utxo_lib_1 = require("@bitgo-beta/utxo-lib");
+const statics_1 = require("@bitgo-beta/statics");
+const sdk_lib_safes_1 = require("@bitgo-beta/sdk-lib-safes");
+const errors_1 = require("../errors");
+const keyShareEnvelope_1 = require("../utils/tss/keyShareEnvelope");
+async function decryptSafeKeycard(params) {
+    const { bitgo, userKeyBox, backupKeyBox, bitgoKeyBox, password } = params;
+    const userRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(userKeyBox);
+    const backupRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(backupKeyBox);
+    const bitgoRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(bitgoKeyBox);
+    const decryptRoot = async (root) => {
+        try {
+            return await bitgo.decrypt({ input: root, password });
+        }
+        catch (e) {
+            throw new errors_1.IncorrectPasswordError('unable to decrypt the safe keycard with the provided password', e);
+        }
+    };
+    const unwrapMpcRoot = (decrypted) => {
+        try {
+            return (0, keyShareEnvelope_1.parseSafeMpcKeyEnvelopes)(decrypted);
+        }
+        catch (e) {
+            throw new errors_1.IncorrectPasswordError('unable to decrypt the safe keycard with the provided password', e);
+        }
+    };
+    return {
+        secp256k1Multisig: {
+            user: await decryptRoot(userRoots.secp256k1Multisig),
+            backup: await decryptRoot(backupRoots.secp256k1Multisig),
+            bitgo: bitgoRoots.secp256k1Multisig,
+        },
+        ed25519Multisig: {
+            user: await decryptRoot(userRoots.ed25519Multisig),
+            backup: await decryptRoot(backupRoots.ed25519Multisig),
+            bitgo: bitgoRoots.ed25519Multisig,
+        },
+        ecdsaMpc: {
+            user: unwrapMpcRoot(await decryptRoot(userRoots.ecdsaMpc)),
+            backup: unwrapMpcRoot(await decryptRoot(backupRoots.ecdsaMpc)),
+            bitgo: bitgoRoots.ecdsaMpc,
+        },
+        eddsaMpc: {
+            user: unwrapMpcRoot(await decryptRoot(userRoots.eddsaMpc)),
+            backup: unwrapMpcRoot(await decryptRoot(backupRoots.eddsaMpc)),
+            bitgo: bitgoRoots.eddsaMpc,
+        },
+    };
+}
+function buildSafeUserPath(coinType, slotOrdinal, account) {
+    return `m/44'/${coinType}'/${slotOrdinal}'/${account}'`;
+}
+function buildSafeCosignerPath(coinType, slotOrdinal, account) {
+    return `m/44/${coinType}/${slotOrdinal}/${account}`;
+}
+/**
+ * Derives a Safe wallet's child keys at the BIP44 path for a given slot and account.
+ * Only `secp256k1Multisig` (slot 1) is supported for now; the remaining slots throw
+ * until their derivation arms land (WCN-2736/WCN-2737/WCN-2894).
+ */
+async function deriveSafeWalletKeys(params) {
+    if (params.slot !== 'secp256k1Multisig') {
+        throw new Error(`deriveSafeWalletKeys: slot '${params.slot}' is not supported yet`);
+    }
+    if (!Number.isInteger(params.account) || params.account < 0 || params.account > statics_1.MAX_BIP32_INDEX) {
+        throw new Error(`deriveSafeWalletKeys: invalid account '${params.account}'`);
+    }
+    const coinType = statics_1.coins.get(params.coin).bip44CoinType;
+    if (coinType === undefined) {
+        throw new Error(`Coin '${params.coin}' has no BIP44 coin type and cannot derive a safe child`);
+    }
+    const slotOrdinal = statics_1.SAFE_ROOT_SLOT_ORDINALS[params.slot];
+    const { account, roots } = params;
+    const root = roots.secp256k1Multisig;
+    const user = utxo_lib_1.bip32.fromBase58(root.user).derivePath(buildSafeUserPath(coinType, slotOrdinal, account));
+    const backup = utxo_lib_1.bip32.fromBase58(root.backup).derivePath(buildSafeCosignerPath(coinType, slotOrdinal, account));
+    const bitgo = utxo_lib_1.bip32.fromBase58(root.bitgo).derivePath(buildSafeCosignerPath(coinType, slotOrdinal, account));
+    if (!user.privateKey || !backup.privateKey) {
+        throw new Error('deriveSafeWalletKeys: user and backup roots must be private (xprv)');
+    }
+    if (bitgo.privateKey) {
+        throw new Error('deriveSafeWalletKeys: bitgo root must be public (xpub)');
+    }
+    return {
+        path: buildSafeUserPath(coinType, slotOrdinal, account),
+        keys: {
+            user: { prv: user.toBase58(), pub: user.neutered().toBase58() },
+            backup: { prv: backup.toBase58(), pub: backup.neutered().toBase58() },
+            bitgo: { pub: bitgo.neutered().toBase58() },
+        },
+    };
+}
+/**
+ * Builds the key fields `coin.recover()` expects from derived Safe child keys.
+ * Only `secp256k1Multisig` (slot 1) is supported for now. Signed mode re-encrypts the
+ * child xprvs under a fresh ephemeral passphrase (v1/SJCL); unsigned mode returns pubs.
+ */
+async function buildSafeRecoverKeyParams(params) {
+    if (params.slot !== 'secp256k1Multisig') {
+        throw new Error(`buildSafeRecoverKeyParams: slot '${params.slot}' is not supported yet`);
+    }
+    const { bitgo, keys, mode } = params;
+    if (mode === 'unsigned') {
+        return {
+            userKey: keys.user.pub,
+            backupKey: keys.backup.pub,
+            bitgoKey: keys.bitgo.pub,
+        };
+    }
+    const userPrv = utxo_lib_1.bip32.fromBase58(keys.user.prv);
+    const backupPrv = utxo_lib_1.bip32.fromBase58(keys.backup.prv);
+    if (!userPrv.privateKey || !backupPrv.privateKey) {
+        throw new Error('buildSafeRecoverKeyParams: keys.user.prv and keys.backup.prv must be private xprvs');
+    }
+    const walletPassphrase = (0, crypto_1.randomBytes)(32).toString('hex');
+    const [userKey, backupKey] = await Promise.all([
+        bitgo.encrypt({ input: keys.user.prv, password: walletPassphrase, encryptionVersion: 1 }),
+        bitgo.encrypt({ input: keys.backup.prv, password: walletPassphrase, encryptionVersion: 1 }),
+    ]);
+    return {
+        userKey,
+        backupKey,
+        bitgoKey: keys.bitgo.pub,
+        walletPassphrase,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3ZlcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9yZWNvdmVyeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQTZDQSxnREFtREM7QUFlRCxvREF3Q0M7QUFPRCw4REFzQ0M7QUE5TEQsbUNBQXFDO0FBQ3JDLG1EQUE2QztBQUM3QyxpREFBc0Y7QUFFdEYsNkRBQWdFO0FBRWhFLHNDQUFtRDtBQUNuRCxvRUFBeUU7QUFnQ2xFLEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxNQU14QztJQUNDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRTFFLE1BQU0sU0FBUyxHQUFHLElBQUEsbUNBQW1CLEVBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEQsTUFBTSxXQUFXLEdBQUcsSUFBQSxtQ0FBbUIsRUFBQyxZQUFZLENBQUMsQ0FBQztJQUN0RCxNQUFNLFVBQVUsR0FBRyxJQUFBLG1DQUFtQixFQUFDLFdBQVcsQ0FBQyxDQUFDO0lBRXBELE1BQU0sV0FBVyxHQUFHLEtBQUssRUFBRSxJQUFZLEVBQW1CLEVBQUU7UUFDMUQsSUFBSSxDQUFDO1lBQ0gsT0FBTyxNQUFNLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksK0JBQXNCLENBQUMsK0RBQStELEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDdkcsQ0FBQztJQUNILENBQUMsQ0FBQztJQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsU0FBaUIsRUFBd0IsRUFBRTtRQUNoRSxJQUFJLENBQUM7WUFDSCxPQUFPLElBQUEsMkNBQXdCLEVBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0MsQ0FBQztRQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksK0JBQXNCLENBQUMsK0RBQStELEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDdkcsQ0FBQztJQUNILENBQUMsQ0FBQztJQUVGLE9BQU87UUFDTCxpQkFBaUIsRUFBRTtZQUNqQixJQUFJLEVBQUUsTUFBTSxXQUFXLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDO1lBQ3BELE1BQU0sRUFBRSxNQUFNLFdBQVcsQ0FBQyxXQUFXLENBQUMsaUJBQWlCLENBQUM7WUFDeEQsS0FBSyxFQUFFLFVBQVUsQ0FBQyxpQkFBaUI7U0FDcEM7UUFDRCxlQUFlLEVBQUU7WUFDZixJQUFJLEVBQUUsTUFBTSxXQUFXLENBQUMsU0FBUyxDQUFDLGVBQWUsQ0FBQztZQUNsRCxNQUFNLEVBQUUsTUFBTSxXQUFXLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQztZQUN0RCxLQUFLLEVBQUUsVUFBVSxDQUFDLGVBQWU7U0FDbEM7UUFDRCxRQUFRLEVBQUU7WUFDUixJQUFJLEVBQUUsYUFBYSxDQUFDLE1BQU0sV0FBVyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUMxRCxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU0sV0FBVyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUM5RCxLQUFLLEVBQUUsVUFBVSxDQUFDLFFBQVE7U0FDM0I7UUFDRCxRQUFRLEVBQUU7WUFDUixJQUFJLEVBQUUsYUFBYSxDQUFDLE1BQU0sV0FBVyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUMxRCxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU0sV0FBVyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUM5RCxLQUFLLEVBQUUsVUFBVSxDQUFDLFFBQVE7U0FDM0I7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsaUJBQWlCLENBQUMsUUFBZ0IsRUFBRSxXQUFtQixFQUFFLE9BQWU7SUFDL0UsT0FBTyxTQUFTLFFBQVEsS0FBSyxXQUFXLEtBQUssT0FBTyxHQUFHLENBQUM7QUFDMUQsQ0FBQztBQUVELFNBQVMscUJBQXFCLENBQUMsUUFBZ0IsRUFBRSxXQUFtQixFQUFFLE9BQWU7SUFDbkYsT0FBTyxRQUFRLFFBQVEsSUFBSSxXQUFXLElBQUksT0FBTyxFQUFFLENBQUM7QUFDdEQsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSSxLQUFLLFVBQVUsb0JBQW9CLENBQUMsTUFLMUM7SUFDQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssbUJBQW1CLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixNQUFNLENBQUMsSUFBSSx3QkFBd0IsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sR0FBRyx5QkFBZSxFQUFFLENBQUM7UUFDaEcsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsTUFBTSxDQUFDLE9BQU8sR0FBRyxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLGVBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLGFBQWEsQ0FBQztJQUN0RCxJQUFJLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFNBQVMsTUFBTSxDQUFDLElBQUkseURBQXlELENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsaUNBQXVCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3pELE1BQU0sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2xDLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQztJQUVyQyxNQUFNLElBQUksR0FBRyxnQkFBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsVUFBVSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN2RyxNQUFNLE1BQU0sR0FBRyxnQkFBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsVUFBVSxDQUFDLHFCQUFxQixDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUMvRyxNQUFNLEtBQUssR0FBRyxnQkFBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDLHFCQUFxQixDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUU3RyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUMzQyxNQUFNLElBQUksS0FBSyxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0RBQXdELENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRUQsT0FBTztRQUNMLElBQUksRUFBRSxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQztRQUN2RCxJQUFJLEVBQUU7WUFDSixJQUFJLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUU7WUFDL0QsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxRQUFRLEVBQUUsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFO1lBQ3JFLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUU7U0FDNUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVEOzs7O0dBSUc7QUFDSSxLQUFLLFVBQVUseUJBQXlCLENBQUMsTUFNL0M7SUFDQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssbUJBQW1CLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxNQUFNLENBQUMsSUFBSSx3QkFBd0IsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFckMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEIsT0FBTztZQUNMLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7WUFDdEIsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRztZQUMxQixRQUFRLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHO1NBQ3pCLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsZ0JBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNoRCxNQUFNLFNBQVMsR0FBRyxnQkFBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BELElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2pELE1BQU0sSUFBSSxLQUFLLENBQUMsb0ZBQW9GLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBRUQsTUFBTSxnQkFBZ0IsR0FBRyxJQUFBLG9CQUFXLEVBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3pELE1BQU0sQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQzdDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLGlCQUFpQixFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3pGLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLGlCQUFpQixFQUFFLENBQUMsRUFBRSxDQUFDO0tBQzVGLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxPQUFPO1FBQ1AsU0FBUztRQUNULFFBQVEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7UUFDeEIsZ0JBQWdCO0tBQ2pCLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFdSVy1mYWNpbmcgc2FmZSByZWNvdmVyeSBlbnRyeSBwb2ludHMuXG4gKi9cbmltcG9ydCB7IEJ1ZmZlciB9IGZyb20gJ2J1ZmZlcic7XG5pbXBvcnQgeyByYW5kb21CeXRlcyB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgeyBiaXAzMiB9IGZyb20gJ0BiaXRnby1iZXRhL3V0eG8tbGliJztcbmltcG9ydCB7IGNvaW5zLCBNQVhfQklQMzJfSU5ERVgsIFNBRkVfUk9PVF9TTE9UX09SRElOQUxTIH0gZnJvbSAnQGJpdGdvLWJldGEvc3RhdGljcyc7XG5pbXBvcnQgdHlwZSB7IFJvb3RLZXlUeXBlIH0gZnJvbSAnQGJpdGdvL3B1YmxpYy10eXBlcyc7XG5pbXBvcnQgeyBwYXJzZVNhZmVLZXljYXJkQm94IH0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWxpYi1zYWZlcyc7XG5pbXBvcnQgeyBCaXRHb0Jhc2UgfSBmcm9tICcuLi9iaXRnb0Jhc2UnO1xuaW1wb3J0IHsgSW5jb3JyZWN0UGFzc3dvcmRFcnJvciB9IGZyb20gJy4uL2Vycm9ycyc7XG5pbXBvcnQgeyBwYXJzZVNhZmVNcGNLZXlFbnZlbG9wZXMgfSBmcm9tICcuLi91dGlscy90c3Mva2V5U2hhcmVFbnZlbG9wZSc7XG5cbmV4cG9ydCB0eXBlIERlY3J5cHRlZE1wY1NhZmVSb290ID0geyBzaWduaW5nOiBCdWZmZXI7IHZyZjogQnVmZmVyIH07XG5cbmV4cG9ydCB0eXBlIE9uY2hhaW5TYWZlUm9vdCA9IHsgdXNlcjogc3RyaW5nOyBiYWNrdXA6IHN0cmluZzsgYml0Z286IHN0cmluZyB9O1xuZXhwb3J0IHR5cGUgTXBjU2FmZVJvb3QgPSB7IHVzZXI6IERlY3J5cHRlZE1wY1NhZmVSb290OyBiYWNrdXA6IERlY3J5cHRlZE1wY1NhZmVSb290OyBiaXRnbzogc3RyaW5nIH07XG5cbmV4cG9ydCB0eXBlIFNlY3AyNTZrMU11bHRpc2lnQ2hpbGRLZXlzID0ge1xuICB1c2VyOiB7IHBydjogc3RyaW5nOyBwdWI6IHN0cmluZyB9O1xuICBiYWNrdXA6IHsgcHJ2OiBzdHJpbmc7IHB1Yjogc3RyaW5nIH07XG4gIGJpdGdvOiB7IHB1Yjogc3RyaW5nIH07XG59O1xuXG5leHBvcnQgdHlwZSBEZXJpdmVkU2FmZVdhbGxldEtleXMgPSB7XG4gIHBhdGg6IHN0cmluZztcbiAga2V5czogU2VjcDI1NmsxTXVsdGlzaWdDaGlsZEtleXM7XG59O1xuXG5leHBvcnQgdHlwZSBTYWZlUmVjb3ZlcktleVBhcmFtcyA9IHtcbiAgdXNlcktleTogc3RyaW5nO1xuICBiYWNrdXBLZXk6IHN0cmluZztcbiAgYml0Z29LZXk6IHN0cmluZztcbiAgd2FsbGV0UGFzc3BocmFzZT86IHN0cmluZztcbn07XG5cbmV4cG9ydCB0eXBlIERlY3J5cHRlZFNhZmVSb290cyA9IHtcbiAgc2VjcDI1NmsxTXVsdGlzaWc6IE9uY2hhaW5TYWZlUm9vdDtcbiAgZWQyNTUxOU11bHRpc2lnOiBPbmNoYWluU2FmZVJvb3Q7XG4gIGVjZHNhTXBjOiBNcGNTYWZlUm9vdDtcbiAgZWRkc2FNcGM6IE1wY1NhZmVSb290O1xufTtcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlY3J5cHRTYWZlS2V5Y2FyZChwYXJhbXM6IHtcbiAgYml0Z286IEJpdEdvQmFzZTtcbiAgdXNlcktleUJveDogc3RyaW5nO1xuICBiYWNrdXBLZXlCb3g6IHN0cmluZztcbiAgYml0Z29LZXlCb3g6IHN0cmluZztcbiAgcGFzc3dvcmQ6IHN0cmluZztcbn0pOiBQcm9taXNlPERlY3J5cHRlZFNhZmVSb290cz4ge1xuICBjb25zdCB7IGJpdGdvLCB1c2VyS2V5Qm94LCBiYWNrdXBLZXlCb3gsIGJpdGdvS2V5Qm94LCBwYXNzd29yZCB9ID0gcGFyYW1zO1xuXG4gIGNvbnN0IHVzZXJSb290cyA9IHBhcnNlU2FmZUtleWNhcmRCb3godXNlcktleUJveCk7XG4gIGNvbnN0IGJhY2t1cFJvb3RzID0gcGFyc2VTYWZlS2V5Y2FyZEJveChiYWNrdXBLZXlCb3gpO1xuICBjb25zdCBiaXRnb1Jvb3RzID0gcGFyc2VTYWZlS2V5Y2FyZEJveChiaXRnb0tleUJveCk7XG5cbiAgY29uc3QgZGVjcnlwdFJvb3QgPSBhc3luYyAocm9vdDogc3RyaW5nKTogUHJvbWlzZTxzdHJpbmc+ID0+IHtcbiAgICB0cnkge1xuICAgICAgcmV0dXJuIGF3YWl0IGJpdGdvLmRlY3J5cHQoeyBpbnB1dDogcm9vdCwgcGFzc3dvcmQgfSk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgdGhyb3cgbmV3IEluY29ycmVjdFBhc3N3b3JkRXJyb3IoJ3VuYWJsZSB0byBkZWNyeXB0IHRoZSBzYWZlIGtleWNhcmQgd2l0aCB0aGUgcHJvdmlkZWQgcGFzc3dvcmQnLCBlKTtcbiAgICB9XG4gIH07XG5cbiAgY29uc3QgdW53cmFwTXBjUm9vdCA9IChkZWNyeXB0ZWQ6IHN0cmluZyk6IERlY3J5cHRlZE1wY1NhZmVSb290ID0+IHtcbiAgICB0cnkge1xuICAgICAgcmV0dXJuIHBhcnNlU2FmZU1wY0tleUVudmVsb3BlcyhkZWNyeXB0ZWQpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCd1bmFibGUgdG8gZGVjcnlwdCB0aGUgc2FmZSBrZXljYXJkIHdpdGggdGhlIHByb3ZpZGVkIHBhc3N3b3JkJywgZSk7XG4gICAgfVxuICB9O1xuXG4gIHJldHVybiB7XG4gICAgc2VjcDI1NmsxTXVsdGlzaWc6IHtcbiAgICAgIHVzZXI6IGF3YWl0IGRlY3J5cHRSb290KHVzZXJSb290cy5zZWNwMjU2azFNdWx0aXNpZyksXG4gICAgICBiYWNrdXA6IGF3YWl0IGRlY3J5cHRSb290KGJhY2t1cFJvb3RzLnNlY3AyNTZrMU11bHRpc2lnKSxcbiAgICAgIGJpdGdvOiBiaXRnb1Jvb3RzLnNlY3AyNTZrMU11bHRpc2lnLFxuICAgIH0sXG4gICAgZWQyNTUxOU11bHRpc2lnOiB7XG4gICAgICB1c2VyOiBhd2FpdCBkZWNyeXB0Um9vdCh1c2VyUm9vdHMuZWQyNTUxOU11bHRpc2lnKSxcbiAgICAgIGJhY2t1cDogYXdhaXQgZGVjcnlwdFJvb3QoYmFja3VwUm9vdHMuZWQyNTUxOU11bHRpc2lnKSxcbiAgICAgIGJpdGdvOiBiaXRnb1Jvb3RzLmVkMjU1MTlNdWx0aXNpZyxcbiAgICB9LFxuICAgIGVjZHNhTXBjOiB7XG4gICAgICB1c2VyOiB1bndyYXBNcGNSb290KGF3YWl0IGRlY3J5cHRSb290KHVzZXJSb290cy5lY2RzYU1wYykpLFxuICAgICAgYmFja3VwOiB1bndyYXBNcGNSb290KGF3YWl0IGRlY3J5cHRSb290KGJhY2t1cFJvb3RzLmVjZHNhTXBjKSksXG4gICAgICBiaXRnbzogYml0Z29Sb290cy5lY2RzYU1wYyxcbiAgICB9LFxuICAgIGVkZHNhTXBjOiB7XG4gICAgICB1c2VyOiB1bndyYXBNcGNSb290KGF3YWl0IGRlY3J5cHRSb290KHVzZXJSb290cy5lZGRzYU1wYykpLFxuICAgICAgYmFja3VwOiB1bndyYXBNcGNSb290KGF3YWl0IGRlY3J5cHRSb290KGJhY2t1cFJvb3RzLmVkZHNhTXBjKSksXG4gICAgICBiaXRnbzogYml0Z29Sb290cy5lZGRzYU1wYyxcbiAgICB9LFxuICB9O1xufVxuXG5mdW5jdGlvbiBidWlsZFNhZmVVc2VyUGF0aChjb2luVHlwZTogbnVtYmVyLCBzbG90T3JkaW5hbDogbnVtYmVyLCBhY2NvdW50OiBudW1iZXIpOiBzdHJpbmcge1xuICByZXR1cm4gYG0vNDQnLyR7Y29pblR5cGV9Jy8ke3Nsb3RPcmRpbmFsfScvJHthY2NvdW50fSdgO1xufVxuXG5mdW5jdGlvbiBidWlsZFNhZmVDb3NpZ25lclBhdGgoY29pblR5cGU6IG51bWJlciwgc2xvdE9yZGluYWw6IG51bWJlciwgYWNjb3VudDogbnVtYmVyKTogc3RyaW5nIHtcbiAgcmV0dXJuIGBtLzQ0LyR7Y29pblR5cGV9LyR7c2xvdE9yZGluYWx9LyR7YWNjb3VudH1gO1xufVxuXG4vKipcbiAqIERlcml2ZXMgYSBTYWZlIHdhbGxldCdzIGNoaWxkIGtleXMgYXQgdGhlIEJJUDQ0IHBhdGggZm9yIGEgZ2l2ZW4gc2xvdCBhbmQgYWNjb3VudC5cbiAqIE9ubHkgYHNlY3AyNTZrMU11bHRpc2lnYCAoc2xvdCAxKSBpcyBzdXBwb3J0ZWQgZm9yIG5vdzsgdGhlIHJlbWFpbmluZyBzbG90cyB0aHJvd1xuICogdW50aWwgdGhlaXIgZGVyaXZhdGlvbiBhcm1zIGxhbmQgKFdDTi0yNzM2L1dDTi0yNzM3L1dDTi0yODk0KS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlcml2ZVNhZmVXYWxsZXRLZXlzKHBhcmFtczoge1xuICBjb2luOiBzdHJpbmc7XG4gIHNsb3Q6IFJvb3RLZXlUeXBlO1xuICBhY2NvdW50OiBudW1iZXI7XG4gIHJvb3RzOiBEZWNyeXB0ZWRTYWZlUm9vdHM7XG59KTogUHJvbWlzZTxEZXJpdmVkU2FmZVdhbGxldEtleXM+IHtcbiAgaWYgKHBhcmFtcy5zbG90ICE9PSAnc2VjcDI1NmsxTXVsdGlzaWcnKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBkZXJpdmVTYWZlV2FsbGV0S2V5czogc2xvdCAnJHtwYXJhbXMuc2xvdH0nIGlzIG5vdCBzdXBwb3J0ZWQgeWV0YCk7XG4gIH1cbiAgaWYgKCFOdW1iZXIuaXNJbnRlZ2VyKHBhcmFtcy5hY2NvdW50KSB8fCBwYXJhbXMuYWNjb3VudCA8IDAgfHwgcGFyYW1zLmFjY291bnQgPiBNQVhfQklQMzJfSU5ERVgpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYGRlcml2ZVNhZmVXYWxsZXRLZXlzOiBpbnZhbGlkIGFjY291bnQgJyR7cGFyYW1zLmFjY291bnR9J2ApO1xuICB9XG5cbiAgY29uc3QgY29pblR5cGUgPSBjb2lucy5nZXQocGFyYW1zLmNvaW4pLmJpcDQ0Q29pblR5cGU7XG4gIGlmIChjb2luVHlwZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBDb2luICcke3BhcmFtcy5jb2lufScgaGFzIG5vIEJJUDQ0IGNvaW4gdHlwZSBhbmQgY2Fubm90IGRlcml2ZSBhIHNhZmUgY2hpbGRgKTtcbiAgfVxuICBjb25zdCBzbG90T3JkaW5hbCA9IFNBRkVfUk9PVF9TTE9UX09SRElOQUxTW3BhcmFtcy5zbG90XTtcbiAgY29uc3QgeyBhY2NvdW50LCByb290cyB9ID0gcGFyYW1zO1xuICBjb25zdCByb290ID0gcm9vdHMuc2VjcDI1NmsxTXVsdGlzaWc7XG5cbiAgY29uc3QgdXNlciA9IGJpcDMyLmZyb21CYXNlNTgocm9vdC51c2VyKS5kZXJpdmVQYXRoKGJ1aWxkU2FmZVVzZXJQYXRoKGNvaW5UeXBlLCBzbG90T3JkaW5hbCwgYWNjb3VudCkpO1xuICBjb25zdCBiYWNrdXAgPSBiaXAzMi5mcm9tQmFzZTU4KHJvb3QuYmFja3VwKS5kZXJpdmVQYXRoKGJ1aWxkU2FmZUNvc2lnbmVyUGF0aChjb2luVHlwZSwgc2xvdE9yZGluYWwsIGFjY291bnQpKTtcbiAgY29uc3QgYml0Z28gPSBiaXAzMi5mcm9tQmFzZTU4KHJvb3QuYml0Z28pLmRlcml2ZVBhdGgoYnVpbGRTYWZlQ29zaWduZXJQYXRoKGNvaW5UeXBlLCBzbG90T3JkaW5hbCwgYWNjb3VudCkpO1xuXG4gIGlmICghdXNlci5wcml2YXRlS2V5IHx8ICFiYWNrdXAucHJpdmF0ZUtleSkge1xuICAgIHRocm93IG5ldyBFcnJvcignZGVyaXZlU2FmZVdhbGxldEtleXM6IHVzZXIgYW5kIGJhY2t1cCByb290cyBtdXN0IGJlIHByaXZhdGUgKHhwcnYpJyk7XG4gIH1cbiAgaWYgKGJpdGdvLnByaXZhdGVLZXkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2Rlcml2ZVNhZmVXYWxsZXRLZXlzOiBiaXRnbyByb290IG11c3QgYmUgcHVibGljICh4cHViKScpO1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBwYXRoOiBidWlsZFNhZmVVc2VyUGF0aChjb2luVHlwZSwgc2xvdE9yZGluYWwsIGFjY291bnQpLFxuICAgIGtleXM6IHtcbiAgICAgIHVzZXI6IHsgcHJ2OiB1c2VyLnRvQmFzZTU4KCksIHB1YjogdXNlci5uZXV0ZXJlZCgpLnRvQmFzZTU4KCkgfSxcbiAgICAgIGJhY2t1cDogeyBwcnY6IGJhY2t1cC50b0Jhc2U1OCgpLCBwdWI6IGJhY2t1cC5uZXV0ZXJlZCgpLnRvQmFzZTU4KCkgfSxcbiAgICAgIGJpdGdvOiB7IHB1YjogYml0Z28ubmV1dGVyZWQoKS50b0Jhc2U1OCgpIH0sXG4gICAgfSxcbiAgfTtcbn1cblxuLyoqXG4gKiBCdWlsZHMgdGhlIGtleSBmaWVsZHMgYGNvaW4ucmVjb3ZlcigpYCBleHBlY3RzIGZyb20gZGVyaXZlZCBTYWZlIGNoaWxkIGtleXMuXG4gKiBPbmx5IGBzZWNwMjU2azFNdWx0aXNpZ2AgKHNsb3QgMSkgaXMgc3VwcG9ydGVkIGZvciBub3cuIFNpZ25lZCBtb2RlIHJlLWVuY3J5cHRzIHRoZVxuICogY2hpbGQgeHBydnMgdW5kZXIgYSBmcmVzaCBlcGhlbWVyYWwgcGFzc3BocmFzZSAodjEvU0pDTCk7IHVuc2lnbmVkIG1vZGUgcmV0dXJucyBwdWJzLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gYnVpbGRTYWZlUmVjb3ZlcktleVBhcmFtcyhwYXJhbXM6IHtcbiAgYml0Z286IEJpdEdvQmFzZTtcbiAgY29pbjogc3RyaW5nO1xuICBzbG90OiBSb290S2V5VHlwZTtcbiAga2V5czogU2VjcDI1NmsxTXVsdGlzaWdDaGlsZEtleXM7XG4gIG1vZGU6ICdzaWduZWQnIHwgJ3Vuc2lnbmVkJztcbn0pOiBQcm9taXNlPFNhZmVSZWNvdmVyS2V5UGFyYW1zPiB7XG4gIGlmIChwYXJhbXMuc2xvdCAhPT0gJ3NlY3AyNTZrMU11bHRpc2lnJykge1xuICAgIHRocm93IG5ldyBFcnJvcihgYnVpbGRTYWZlUmVjb3ZlcktleVBhcmFtczogc2xvdCAnJHtwYXJhbXMuc2xvdH0nIGlzIG5vdCBzdXBwb3J0ZWQgeWV0YCk7XG4gIH1cbiAgY29uc3QgeyBiaXRnbywga2V5cywgbW9kZSB9ID0gcGFyYW1zO1xuXG4gIGlmIChtb2RlID09PSAndW5zaWduZWQnKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIHVzZXJLZXk6IGtleXMudXNlci5wdWIsXG4gICAgICBiYWNrdXBLZXk6IGtleXMuYmFja3VwLnB1YixcbiAgICAgIGJpdGdvS2V5OiBrZXlzLmJpdGdvLnB1YixcbiAgICB9O1xuICB9XG5cbiAgY29uc3QgdXNlclBydiA9IGJpcDMyLmZyb21CYXNlNTgoa2V5cy51c2VyLnBydik7XG4gIGNvbnN0IGJhY2t1cFBydiA9IGJpcDMyLmZyb21CYXNlNTgoa2V5cy5iYWNrdXAucHJ2KTtcbiAgaWYgKCF1c2VyUHJ2LnByaXZhdGVLZXkgfHwgIWJhY2t1cFBydi5wcml2YXRlS2V5KSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zOiBrZXlzLnVzZXIucHJ2IGFuZCBrZXlzLmJhY2t1cC5wcnYgbXVzdCBiZSBwcml2YXRlIHhwcnZzJyk7XG4gIH1cblxuICBjb25zdCB3YWxsZXRQYXNzcGhyYXNlID0gcmFuZG9tQnl0ZXMoMzIpLnRvU3RyaW5nKCdoZXgnKTtcbiAgY29uc3QgW3VzZXJLZXksIGJhY2t1cEtleV0gPSBhd2FpdCBQcm9taXNlLmFsbChbXG4gICAgYml0Z28uZW5jcnlwdCh7IGlucHV0OiBrZXlzLnVzZXIucHJ2LCBwYXNzd29yZDogd2FsbGV0UGFzc3BocmFzZSwgZW5jcnlwdGlvblZlcnNpb246IDEgfSksXG4gICAgYml0Z28uZW5jcnlwdCh7IGlucHV0OiBrZXlzLmJhY2t1cC5wcnYsIHBhc3N3b3JkOiB3YWxsZXRQYXNzcGhyYXNlLCBlbmNyeXB0aW9uVmVyc2lvbjogMSB9KSxcbiAgXSk7XG5cbiAgcmV0dXJuIHtcbiAgICB1c2VyS2V5LFxuICAgIGJhY2t1cEtleSxcbiAgICBiaXRnb0tleToga2V5cy5iaXRnby5wdWIsXG4gICAgd2FsbGV0UGFzc3BocmFzZSxcbiAgfTtcbn1cbiJdfQ==

package/dist/src/bitgo/safe/rootCoin.d.ts

@@ -0,0 +1,15 @@
+import { RootKeyType } from '@bitgo/public-types';
+import { IBaseCoin } from '../baseCoin';
+import { BitGoBase } from '../bitgoBase';
+/**
+ * Canonical order of the safe root slots. Shared by safe minting (Safes.createSafeKeys) and
+ * passkey register/remove (Safe) so both iterate the slots identically.
+ * @experimental
+ */
+export declare const SAFE_ROOT_SLOTS: RootKeyType[];
+/**
+ * Coin used to route a given root's key operations (see ROOT_COIN_BY_NETWORK).
+ * @experimental
+ */
+export declare function coinForRoot(bitgo: BitGoBase, slot: RootKeyType): IBaseCoin;
+//# sourceMappingURL=rootCoin.d.ts.map

package/dist/src/bitgo/safe/rootCoin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootCoin.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/rootCoin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,EAAqE,CAAC;AA4B/G;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,CAK1E"}

package/dist/src/bitgo/safe/rootCoin.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_ROOT_SLOTS = void 0;
+exports.coinForRoot = coinForRoot;
+const common_1 = require("../../common");
+/**
+ * Canonical order of the safe root slots. Shared by safe minting (Safes.createSafeKeys) and
+ * passkey register/remove (Safe) so both iterate the slots identically.
+ * @experimental
+ */
+exports.SAFE_ROOT_SLOTS = ['secp256k1Multisig', 'ed25519Multisig', 'ecdsaMpc', 'eddsaMpc'];
+/**
+ * Representative coin per root slot, by network. Safe roots are curve/scheme-scoped, not
+ * coin-scoped — WP stamps `curve` server-side from the coin's key curve, so any coin of the
+ * right (curve, scheme) works. These are stable, always-available choices used only to route
+ * the key ceremony; the resulting root is interchangeable across coins of the slot.
+ * @experimental
+ */
+const ROOT_COIN_BY_NETWORK = {
+    mainnet: {
+        // multisig roots
+        secp256k1Multisig: 'btc',
+        ed25519Multisig: 'xlm',
+        // MPC roots
+        ecdsaMpc: 'eth',
+        eddsaMpc: 'sol',
+    },
+    testnet: {
+        // multisig roots
+        secp256k1Multisig: 'tbtc',
+        ed25519Multisig: 'txlm',
+        // MPC roots
+        ecdsaMpc: 'hteth',
+        eddsaMpc: 'tsol',
+    },
+};
+/**
+ * Coin used to route a given root's key operations (see ROOT_COIN_BY_NETWORK).
+ * @experimental
+ */
+function coinForRoot(bitgo, slot) {
+    // V1Network is exactly 'bitcoin' | 'testnet', so this branch is exhaustive over every
+    // environment: 'bitcoin' is mainnet and every other value is a testnet.
+    const network = common_1.Environments[bitgo.getEnv()].network === 'bitcoin' ? 'mainnet' : 'testnet';
+    return bitgo.coin(ROOT_COIN_BY_NETWORK[network][slot]);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9vdENvaW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9yb290Q29pbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUEwQ0Esa0NBS0M7QUE5Q0QseUNBQTRDO0FBSTVDOzs7O0dBSUc7QUFDVSxRQUFBLGVBQWUsR0FBa0IsQ0FBQyxtQkFBbUIsRUFBRSxpQkFBaUIsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFFL0c7Ozs7OztHQU1HO0FBQ0gsTUFBTSxvQkFBb0IsR0FBK0Q7SUFDdkYsT0FBTyxFQUFFO1FBQ1AsaUJBQWlCO1FBQ2pCLGlCQUFpQixFQUFFLEtBQUs7UUFDeEIsZUFBZSxFQUFFLEtBQUs7UUFDdEIsWUFBWTtRQUNaLFFBQVEsRUFBRSxLQUFLO1FBQ2YsUUFBUSxFQUFFLEtBQUs7S0FDaEI7SUFDRCxPQUFPLEVBQUU7UUFDUCxpQkFBaUI7UUFDakIsaUJBQWlCLEVBQUUsTUFBTTtRQUN6QixlQUFlLEVBQUUsTUFBTTtRQUN2QixZQUFZO1FBQ1osUUFBUSxFQUFFLE9BQU87UUFDakIsUUFBUSxFQUFFLE1BQU07S0FDakI7Q0FDRixDQUFDO0FBRUY7OztHQUdHO0FBQ0gsU0FBZ0IsV0FBVyxDQUFDLEtBQWdCLEVBQUUsSUFBaUI7SUFDN0Qsc0ZBQXNGO0lBQ3RGLHdFQUF3RTtJQUN4RSxNQUFNLE9BQU8sR0FBRyxxQkFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzNGLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBSb290S2V5VHlwZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHsgRW52aXJvbm1lbnRzIH0gZnJvbSAnLi4vLi4vY29tbW9uJztcbmltcG9ydCB7IElCYXNlQ29pbiB9IGZyb20gJy4uL2Jhc2VDb2luJztcbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5cbi8qKlxuICogQ2Fub25pY2FsIG9yZGVyIG9mIHRoZSBzYWZlIHJvb3Qgc2xvdHMuIFNoYXJlZCBieSBzYWZlIG1pbnRpbmcgKFNhZmVzLmNyZWF0ZVNhZmVLZXlzKSBhbmRcbiAqIHBhc3NrZXkgcmVnaXN0ZXIvcmVtb3ZlIChTYWZlKSBzbyBib3RoIGl0ZXJhdGUgdGhlIHNsb3RzIGlkZW50aWNhbGx5LlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgY29uc3QgU0FGRV9ST09UX1NMT1RTOiBSb290S2V5VHlwZVtdID0gWydzZWNwMjU2azFNdWx0aXNpZycsICdlZDI1NTE5TXVsdGlzaWcnLCAnZWNkc2FNcGMnLCAnZWRkc2FNcGMnXTtcblxuLyoqXG4gKiBSZXByZXNlbnRhdGl2ZSBjb2luIHBlciByb290IHNsb3QsIGJ5IG5ldHdvcmsuIFNhZmUgcm9vdHMgYXJlIGN1cnZlL3NjaGVtZS1zY29wZWQsIG5vdFxuICogY29pbi1zY29wZWQg4oCUIFdQIHN0YW1wcyBgY3VydmVgIHNlcnZlci1zaWRlIGZyb20gdGhlIGNvaW4ncyBrZXkgY3VydmUsIHNvIGFueSBjb2luIG9mIHRoZVxuICogcmlnaHQgKGN1cnZlLCBzY2hlbWUpIHdvcmtzLiBUaGVzZSBhcmUgc3RhYmxlLCBhbHdheXMtYXZhaWxhYmxlIGNob2ljZXMgdXNlZCBvbmx5IHRvIHJvdXRlXG4gKiB0aGUga2V5IGNlcmVtb255OyB0aGUgcmVzdWx0aW5nIHJvb3QgaXMgaW50ZXJjaGFuZ2VhYmxlIGFjcm9zcyBjb2lucyBvZiB0aGUgc2xvdC5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuY29uc3QgUk9PVF9DT0lOX0JZX05FVFdPUks6IFJlY29yZDwnbWFpbm5ldCcgfCAndGVzdG5ldCcsIFJlY29yZDxSb290S2V5VHlwZSwgc3RyaW5nPj4gPSB7XG4gIG1haW5uZXQ6IHtcbiAgICAvLyBtdWx0aXNpZyByb290c1xuICAgIHNlY3AyNTZrMU11bHRpc2lnOiAnYnRjJyxcbiAgICBlZDI1NTE5TXVsdGlzaWc6ICd4bG0nLFxuICAgIC8vIE1QQyByb290c1xuICAgIGVjZHNhTXBjOiAnZXRoJyxcbiAgICBlZGRzYU1wYzogJ3NvbCcsXG4gIH0sXG4gIHRlc3RuZXQ6IHtcbiAgICAvLyBtdWx0aXNpZyByb290c1xuICAgIHNlY3AyNTZrMU11bHRpc2lnOiAndGJ0YycsXG4gICAgZWQyNTUxOU11bHRpc2lnOiAndHhsbScsXG4gICAgLy8gTVBDIHJvb3RzXG4gICAgZWNkc2FNcGM6ICdodGV0aCcsXG4gICAgZWRkc2FNcGM6ICd0c29sJyxcbiAgfSxcbn07XG5cbi8qKlxuICogQ29pbiB1c2VkIHRvIHJvdXRlIGEgZ2l2ZW4gcm9vdCdzIGtleSBvcGVyYXRpb25zIChzZWUgUk9PVF9DT0lOX0JZX05FVFdPUkspLlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgZnVuY3Rpb24gY29pbkZvclJvb3QoYml0Z286IEJpdEdvQmFzZSwgc2xvdDogUm9vdEtleVR5cGUpOiBJQmFzZUNvaW4ge1xuICAvLyBWMU5ldHdvcmsgaXMgZXhhY3RseSAnYml0Y29pbicgfCAndGVzdG5ldCcsIHNvIHRoaXMgYnJhbmNoIGlzIGV4aGF1c3RpdmUgb3ZlciBldmVyeVxuICAvLyBlbnZpcm9ubWVudDogJ2JpdGNvaW4nIGlzIG1haW5uZXQgYW5kIGV2ZXJ5IG90aGVyIHZhbHVlIGlzIGEgdGVzdG5ldC5cbiAgY29uc3QgbmV0d29yayA9IEVudmlyb25tZW50c1tiaXRnby5nZXRFbnYoKV0ubmV0d29yayA9PT0gJ2JpdGNvaW4nID8gJ21haW5uZXQnIDogJ3Rlc3RuZXQnO1xuICByZXR1cm4gYml0Z28uY29pbihST09UX0NPSU5fQllfTkVUV09SS1tuZXR3b3JrXVtzbG90XSk7XG59XG4iXX0=