@bitgo-beta/sdk-core 8.2.1-beta.21 → 8.2.1-beta.2100

package/dist/src/bitgo/wallet/safeKeychain.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @prettier
+ */
+import { BitGoBase } from '../bitgoBase';
+import { IKeychains, Keychain, KeychainWithEncryptedPrv } from '../keychain';
+import type { DecryptedKeychainData } from './iWallet';
+export declare class InvalidRootKeychainSourceError extends Error {
+    constructor(id: string, source: string | undefined);
+}
+/** Thrown when hardened derivation does not match the registered child public key. */
+export declare class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId: string, expectedPub: string, derivedPub: string);
+}
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+export declare class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId: string, detail: string);
+}
+/** Thrown when wallet sharing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+export declare class SafeShareNotImplementedError extends Error {
+    constructor(walletId: string, detail: string);
+}
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+export declare function isSafeChildPublicOnlyKeychain(walletSafeId: string | undefined, keychain: Keychain | undefined): keychain is Keychain & {
+    parent: string;
+};
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+export declare function fetchRootKeychainForSafeChild(keychains: IKeychains, childKeychain: Keychain): Promise<KeychainWithEncryptedPrv>;
+/**
+ * Shared params for resolving safe-owner key material (owner signing and wallet sharing).
+ * Both resolvers extend this so the precondition/derivation path cannot diverge.
+ */
+export interface SafeKeyMaterialBaseParams {
+    bitgo: BitGoBase;
+    keychains: IKeychains;
+    walletId: string;
+    /** Onchain secp256k1: hardened-derive and verify pub. Other slots throw. */
+    multisigType: string | undefined;
+    coinFamily: string;
+    childKeychain: Keychain;
+    walletPassphrase: string;
+    /** When already fetched (passphrase preflight), skip a second GET. */
+    rootKeychain?: KeychainWithEncryptedPrv;
+}
+export type ResolveSafeOwnerSigningPrvParams = SafeKeyMaterialBaseParams;
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), and verify the registered pub.
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+export declare function resolveSafeOwnerSigningPrv(params: ResolveSafeOwnerSigningPrvParams): Promise<string>;
+export interface ResolveSafeChildPrvForSharingParams extends SafeKeyMaterialBaseParams {
+    mpcAlgorithm?: 'ecdsa' | 'eddsa';
+}
+/**
+ * Resolve sharing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), verify the registered pub, and return the CHILD `{prv, pub}` — never the root.
+ * TSS and ed25519 onchain: throw `SafeShareNotImplementedError` naming the slot + blocker.
+ *
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+export declare function resolveSafeChildPrvForSharing(params: ResolveSafeChildPrvForSharingParams): Promise<DecryptedKeychainData>;
+//# sourceMappingURL=safeKeychain.d.ts.map

package/dist/src/bitgo/wallet/safeKeychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeKeychain.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/wallet/safeKeychain.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAA6B,UAAU,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAGxG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEvD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAOnD;AAED,sFAAsF;AACtF,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAOtE;AAED,kGAAkG;AAClG,qBAAa,mCAAoC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAED,mGAAmG;AACnG,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAKD;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,QAAQ,IAAI,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAE3C;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,UAAU,EACrB,aAAa,EAAE,QAAQ,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAYnC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,QAAQ,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,MAAM,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;AAgEzE;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,gCAAgC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB1G;AAED,MAAM,WAAW,mCAAoC,SAAQ,yBAAyB;IACpF,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAClC;AAYD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAMhC"}

package/dist/src/bitgo/wallet/safeKeychain.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeShareNotImplementedError = exports.SafeOwnerSigningNotImplementedError = exports.SafeDerivedPublicKeyMismatchError = exports.InvalidRootKeychainSourceError = void 0;
+exports.isSafeChildPublicOnlyKeychain = isSafeChildPublicOnlyKeychain;
+exports.fetchRootKeychainForSafeChild = fetchRootKeychainForSafeChild;
+exports.resolveSafeOwnerSigningPrv = resolveSafeOwnerSigningPrv;
+exports.resolveSafeChildPrvForSharing = resolveSafeChildPrvForSharing;
+const keychain_1 = require("../keychain");
+const sdk_lib_safes_1 = require("@bitgo-beta/sdk-lib-safes");
+const errors_1 = require("../errors");
+class InvalidRootKeychainSourceError extends Error {
+    constructor(id, source) {
+        super(`Root keychain ${id} has source '${source ?? 'unknown'}'; expected 'user'. ` +
+            `Using a backup or BitGo root would fail at signing.`);
+        this.name = 'InvalidRootKeychainSourceError';
+    }
+}
+exports.InvalidRootKeychainSourceError = InvalidRootKeychainSourceError;
+/** Thrown when hardened derivation does not match the registered child public key. */
+class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId, expectedPub, derivedPub) {
+        super(`Safe wallet ${walletId}: derived child public key does not match the registered user key. ` +
+            `Expected ${expectedPub}, got ${derivedPub}.`);
+        this.name = 'SafeDerivedPublicKeyMismatchError';
+    }
+}
+exports.SafeDerivedPublicKeyMismatchError = SafeDerivedPublicKeyMismatchError;
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId, detail) {
+        super(`Safe wallet ${walletId}: ${detail}`);
+        this.name = 'SafeOwnerSigningNotImplementedError';
+    }
+}
+exports.SafeOwnerSigningNotImplementedError = SafeOwnerSigningNotImplementedError;
+/** Thrown when wallet sharing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+class SafeShareNotImplementedError extends Error {
+    constructor(walletId, detail) {
+        super(`Safe wallet ${walletId}: ${detail}`);
+        this.name = 'SafeShareNotImplementedError';
+    }
+}
+exports.SafeShareNotImplementedError = SafeShareNotImplementedError;
+/** ed25519 onchain multisig (slot ④). Needs SLIP-0010, not secp256k1 BIP32. */
+const ED25519_ONCHAIN_FAMILIES = new Set(['algo', 'xlm', 'hbar']);
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+function isSafeChildPublicOnlyKeychain(walletSafeId, keychain) {
+    return !!(walletSafeId && keychain?.parent && !keychain.encryptedPrv);
+}
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+async function fetchRootKeychainForSafeChild(keychains, childKeychain) {
+    if (!childKeychain.parent) {
+        throw new Error('childKeychain.parent is required to fetch the root keychain');
+    }
+    const root = await keychains.get({ id: childKeychain.parent });
+    if (root.source !== 'user') {
+        throw new InvalidRootKeychainSourceError(root.id, root.source);
+    }
+    if (!root.encryptedPrv) {
+        throw new Error(`root keychain ${root.id} does not have property encryptedPrv`);
+    }
+    return root;
+}
+/**
+ * Shared core that resolves safe key material for a pub-only safe child. Returns the CHILD
+ * `{prv, pub}` only — never the root — so the root can never leak into a share document.
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), and verify the registered pub. TSS and ed25519 onchain throw via
+ * `makeNotImplementedError` — the caller constructs its own error class + message, so the
+ * guard set stays shared while signing/sharing report their own errors.
+ */
+async function resolveSafeKeyMaterial(params) {
+    const { bitgo, keychains, walletId, multisigType, coinFamily, childKeychain, walletPassphrase, makeNotImplementedError, } = params;
+    if (multisigType !== 'onchain') {
+        throw makeNotImplementedError('tss', walletId);
+    }
+    if (ED25519_ONCHAIN_FAMILIES.has(coinFamily)) {
+        throw makeNotImplementedError('ed25519', walletId);
+    }
+    const rootKeychain = params.rootKeychain ?? (await fetchRootKeychainForSafeChild(keychains, childKeychain));
+    const rootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(bitgo, rootKeychain, walletPassphrase);
+    if (!rootPrv) {
+        throw new errors_1.IncorrectPasswordError();
+    }
+    if (!childKeychain.pub) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing pub for pre-sign verification`);
+    }
+    if (childKeychain.derivedFromParentWithPath === undefined) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing derivedFromParentWithPath`);
+    }
+    const derived = (0, sdk_lib_safes_1.deriveSafeChildHardenedFromXprv)(rootPrv, (0, sdk_lib_safes_1.parseDerivedFromParentWithHardenedPath)(childKeychain.derivedFromParentWithPath));
+    if (derived.pub !== childKeychain.pub) {
+        throw new SafeDerivedPublicKeyMismatchError(walletId, childKeychain.pub, derived.pub);
+    }
+    if (derived.pub === rootKeychain.pub) {
+        throw new Error(`Safe wallet ${walletId}: derived child pub unexpectedly equals the root pub`);
+    }
+    return { prv: derived.prv, pub: derived.pub };
+}
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), and verify the registered pub.
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+async function resolveSafeOwnerSigningPrv(params) {
+    const { prv } = await resolveSafeKeyMaterial({
+        ...params,
+        makeNotImplementedError: (slot, walletId) => slot === 'ed25519'
+            ? new SafeOwnerSigningNotImplementedError(walletId, `ed25519 multisig owner derivation (${params.coinFamily}) is not implemented; BIP32 would produce the wrong child key.`)
+            : new SafeOwnerSigningNotImplementedError(walletId, 'TSS owner signing from the root keyshare is not implemented. ' +
+                'Returning the root private key would expose material that can derive every child in this slot.'),
+    });
+    return prv;
+}
+/** Slot-named not-implemented detail for wallet sharing. */
+function safeShareSlotDetail(slot, params) {
+    if (slot === 'ed25519') {
+        return `ed25519 multisig safe sharing (${params.coinFamily}) is not implemented; BIP32 would derive the wrong child.`;
+    }
+    return params.mpcAlgorithm === 'eddsa'
+        ? 'eddsaMpc safe sharing is not implemented (needs the EdDSA derive ceremony).'
+        : 'ecdsaMpc safe sharing is not implemented (needs the DKLS derive ceremony).';
+}
+/**
+ * Resolve sharing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), verify the registered pub, and return the CHILD `{prv, pub}` — never the root.
+ * TSS and ed25519 onchain: throw `SafeShareNotImplementedError` naming the slot + blocker.
+ *
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+async function resolveSafeChildPrvForSharing(params) {
+    return resolveSafeKeyMaterial({
+        ...params,
+        makeNotImplementedError: (slot, walletId) => new SafeShareNotImplementedError(walletId, safeShareSlotDetail(slot, params)),
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2FmZUtleWNoYWluLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3dhbGxldC9zYWZlS2V5Y2hhaW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBcURBLHNFQUtDO0FBTUQsc0VBZUM7QUE2RkQsZ0VBZ0JDO0FBeUJELHNFQVFDO0FBek5ELDBDQUF3RztBQUN4Ryw2REFBb0g7QUFDcEgsc0NBQW1EO0FBR25ELE1BQWEsOEJBQStCLFNBQVEsS0FBSztJQUN2RCxZQUFZLEVBQVUsRUFBRSxNQUEwQjtRQUNoRCxLQUFLLENBQ0gsaUJBQWlCLEVBQUUsZ0JBQWdCLE1BQU0sSUFBSSxTQUFTLHNCQUFzQjtZQUMxRSxxREFBcUQsQ0FDeEQsQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLEdBQUcsZ0NBQWdDLENBQUM7SUFDL0MsQ0FBQztDQUNGO0FBUkQsd0VBUUM7QUFFRCxzRkFBc0Y7QUFDdEYsTUFBYSxpQ0FBa0MsU0FBUSxLQUFLO0lBQzFELFlBQVksUUFBZ0IsRUFBRSxXQUFtQixFQUFFLFVBQWtCO1FBQ25FLEtBQUssQ0FDSCxlQUFlLFFBQVEscUVBQXFFO1lBQzFGLFlBQVksV0FBVyxTQUFTLFVBQVUsR0FBRyxDQUNoRCxDQUFDO1FBQ0YsSUFBSSxDQUFDLElBQUksR0FBRyxtQ0FBbUMsQ0FBQztJQUNsRCxDQUFDO0NBQ0Y7QUFSRCw4RUFRQztBQUVELGtHQUFrRztBQUNsRyxNQUFhLG1DQUFvQyxTQUFRLEtBQUs7SUFDNUQsWUFBWSxRQUFnQixFQUFFLE1BQWM7UUFDMUMsS0FBSyxDQUFDLGVBQWUsUUFBUSxLQUFLLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxxQ0FBcUMsQ0FBQztJQUNwRCxDQUFDO0NBQ0Y7QUFMRCxrRkFLQztBQUVELG1HQUFtRztBQUNuRyxNQUFhLDRCQUE2QixTQUFRLEtBQUs7SUFDckQsWUFBWSxRQUFnQixFQUFFLE1BQWM7UUFDMUMsS0FBSyxDQUFDLGVBQWUsUUFBUSxLQUFLLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyw4QkFBOEIsQ0FBQztJQUM3QyxDQUFDO0NBQ0Y7QUFMRCxvRUFLQztBQUVELCtFQUErRTtBQUMvRSxNQUFNLHdCQUF3QixHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRWxFOzs7R0FHRztBQUNILFNBQWdCLDZCQUE2QixDQUMzQyxZQUFnQyxFQUNoQyxRQUE4QjtJQUU5QixPQUFPLENBQUMsQ0FBQyxDQUFDLFlBQVksSUFBSSxRQUFRLEVBQUUsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3hFLENBQUM7QUFFRDs7O0dBR0c7QUFDSSxLQUFLLFVBQVUsNkJBQTZCLENBQ2pELFNBQXFCLEVBQ3JCLGFBQXVCO0lBRXZCLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEVBQUUsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDL0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSw4QkFBOEIsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlCQUFpQixJQUFJLENBQUMsRUFBRSxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLElBQWdDLENBQUM7QUFDMUMsQ0FBQztBQTRCRDs7Ozs7Ozs7R0FRRztBQUNILEtBQUssVUFBVSxzQkFBc0IsQ0FBQyxNQUFvQztJQUN4RSxNQUFNLEVBQ0osS0FBSyxFQUNMLFNBQVMsRUFDVCxRQUFRLEVBQ1IsWUFBWSxFQUNaLFVBQVUsRUFDVixhQUFhLEVBQ2IsZ0JBQWdCLEVBQ2hCLHVCQUF1QixHQUN4QixHQUFHLE1BQU0sQ0FBQztJQUVYLElBQUksWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9CLE1BQU0sdUJBQXVCLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxJQUFJLHdCQUF3QixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzdDLE1BQU0sdUJBQXVCLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFFRCxNQUFNLFlBQVksR0FBRyxNQUFNLENBQUMsWUFBWSxJQUFJLENBQUMsTUFBTSw2QkFBNkIsQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUM1RyxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEsb0NBQXlCLEVBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3ZGLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE1BQU0sSUFBSSwrQkFBc0IsRUFBRSxDQUFDO0lBQ3JDLENBQUM7SUFFRCxJQUFJLENBQUMsYUFBYSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsZUFBZSxRQUFRLDJEQUEyRCxDQUFDLENBQUM7SUFDdEcsQ0FBQztJQUNELElBQUksYUFBYSxDQUFDLHlCQUF5QixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzFELE1BQU0sSUFBSSxLQUFLLENBQUMsZUFBZSxRQUFRLHVEQUF1RCxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLElBQUEsK0NBQStCLEVBQzdDLE9BQU8sRUFDUCxJQUFBLHNEQUFzQyxFQUFDLGFBQWEsQ0FBQyx5QkFBeUIsQ0FBQyxDQUNoRixDQUFDO0lBQ0YsSUFBSSxPQUFPLENBQUMsR0FBRyxLQUFLLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksaUNBQWlDLENBQUMsUUFBUSxFQUFFLGFBQWEsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFFRCxJQUFJLE9BQU8sQ0FBQyxHQUFHLEtBQUssWUFBWSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsZUFBZSxRQUFRLHNEQUFzRCxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELE9BQU8sRUFBRSxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUcsRUFBRSxDQUFDO0FBQ2hELENBQUM7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSSxLQUFLLFVBQVUsMEJBQTBCLENBQUMsTUFBd0M7SUFDdkYsTUFBTSxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sc0JBQXNCLENBQUM7UUFDM0MsR0FBRyxNQUFNO1FBQ1QsdUJBQXVCLEVBQUUsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FDMUMsSUFBSSxLQUFLLFNBQVM7WUFDaEIsQ0FBQyxDQUFDLElBQUksbUNBQW1DLENBQ3JDLFFBQVEsRUFDUixzQ0FBc0MsTUFBTSxDQUFDLFVBQVUsZ0VBQWdFLENBQ3hIO1lBQ0gsQ0FBQyxDQUFDLElBQUksbUNBQW1DLENBQ3JDLFFBQVEsRUFDUiwrREFBK0Q7Z0JBQzdELGdHQUFnRyxDQUNuRztLQUNSLENBQUMsQ0FBQztJQUNILE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQU1ELDREQUE0RDtBQUM1RCxTQUFTLG1CQUFtQixDQUFDLElBQXlCLEVBQUUsTUFBMkM7SUFDakcsSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDdkIsT0FBTyxrQ0FBa0MsTUFBTSxDQUFDLFVBQVUsMkRBQTJELENBQUM7SUFDeEgsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLFlBQVksS0FBSyxPQUFPO1FBQ3BDLENBQUMsQ0FBQyw2RUFBNkU7UUFDL0UsQ0FBQyxDQUFDLDRFQUE0RSxDQUFDO0FBQ25GLENBQUM7QUFFRDs7Ozs7Ozs7R0FRRztBQUNJLEtBQUssVUFBVSw2QkFBNkIsQ0FDakQsTUFBMkM7SUFFM0MsT0FBTyxzQkFBc0IsQ0FBQztRQUM1QixHQUFHLE1BQU07UUFDVCx1QkFBdUIsRUFBRSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUMxQyxJQUFJLDRCQUE0QixDQUFDLFFBQVEsRUFBRSxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7S0FDaEYsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQHByZXR0aWVyXG4gKi9cbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5pbXBvcnQgeyBkZWNyeXB0S2V5Y2hhaW5Qcml2YXRlS2V5LCBJS2V5Y2hhaW5zLCBLZXljaGFpbiwgS2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2IH0gZnJvbSAnLi4va2V5Y2hhaW4nO1xuaW1wb3J0IHsgZGVyaXZlU2FmZUNoaWxkSGFyZGVuZWRGcm9tWHBydiwgcGFyc2VEZXJpdmVkRnJvbVBhcmVudFdpdGhIYXJkZW5lZFBhdGggfSBmcm9tICdAYml0Z28tYmV0YS9zZGstbGliLXNhZmVzJztcbmltcG9ydCB7IEluY29ycmVjdFBhc3N3b3JkRXJyb3IgfSBmcm9tICcuLi9lcnJvcnMnO1xuaW1wb3J0IHR5cGUgeyBEZWNyeXB0ZWRLZXljaGFpbkRhdGEgfSBmcm9tICcuL2lXYWxsZXQnO1xuXG5leHBvcnQgY2xhc3MgSW52YWxpZFJvb3RLZXljaGFpblNvdXJjZUVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihpZDogc3RyaW5nLCBzb3VyY2U6IHN0cmluZyB8IHVuZGVmaW5lZCkge1xuICAgIHN1cGVyKFxuICAgICAgYFJvb3Qga2V5Y2hhaW4gJHtpZH0gaGFzIHNvdXJjZSAnJHtzb3VyY2UgPz8gJ3Vua25vd24nfSc7IGV4cGVjdGVkICd1c2VyJy4gYCArXG4gICAgICAgIGBVc2luZyBhIGJhY2t1cCBvciBCaXRHbyByb290IHdvdWxkIGZhaWwgYXQgc2lnbmluZy5gXG4gICAgKTtcbiAgICB0aGlzLm5hbWUgPSAnSW52YWxpZFJvb3RLZXljaGFpblNvdXJjZUVycm9yJztcbiAgfVxufVxuXG4vKiogVGhyb3duIHdoZW4gaGFyZGVuZWQgZGVyaXZhdGlvbiBkb2VzIG5vdCBtYXRjaCB0aGUgcmVnaXN0ZXJlZCBjaGlsZCBwdWJsaWMga2V5LiAqL1xuZXhwb3J0IGNsYXNzIFNhZmVEZXJpdmVkUHVibGljS2V5TWlzbWF0Y2hFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgY29uc3RydWN0b3Iod2FsbGV0SWQ6IHN0cmluZywgZXhwZWN0ZWRQdWI6IHN0cmluZywgZGVyaXZlZFB1Yjogc3RyaW5nKSB7XG4gICAgc3VwZXIoXG4gICAgICBgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06IGRlcml2ZWQgY2hpbGQgcHVibGljIGtleSBkb2VzIG5vdCBtYXRjaCB0aGUgcmVnaXN0ZXJlZCB1c2VyIGtleS4gYCArXG4gICAgICAgIGBFeHBlY3RlZCAke2V4cGVjdGVkUHVifSwgZ290ICR7ZGVyaXZlZFB1Yn0uYFxuICAgICk7XG4gICAgdGhpcy5uYW1lID0gJ1NhZmVEZXJpdmVkUHVibGljS2V5TWlzbWF0Y2hFcnJvcic7XG4gIH1cbn1cblxuLyoqIFRocm93biB3aGVuIG93bmVyIHNpZ25pbmcgaXMgbm90IGltcGxlbWVudGVkIGZvciB0aGlzIHNhZmUgc2xvdCAoVFNTLCBlZDI1NTE5IG11bHRpc2lnLCDigKYpLiAqL1xuZXhwb3J0IGNsYXNzIFNhZmVPd25lclNpZ25pbmdOb3RJbXBsZW1lbnRlZEVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICBjb25zdHJ1Y3Rvcih3YWxsZXRJZDogc3RyaW5nLCBkZXRhaWw6IHN0cmluZykge1xuICAgIHN1cGVyKGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogJHtkZXRhaWx9YCk7XG4gICAgdGhpcy5uYW1lID0gJ1NhZmVPd25lclNpZ25pbmdOb3RJbXBsZW1lbnRlZEVycm9yJztcbiAgfVxufVxuXG4vKiogVGhyb3duIHdoZW4gd2FsbGV0IHNoYXJpbmcgaXMgbm90IGltcGxlbWVudGVkIGZvciB0aGlzIHNhZmUgc2xvdCAoVFNTLCBlZDI1NTE5IG11bHRpc2lnLCDigKYpLiAqL1xuZXhwb3J0IGNsYXNzIFNhZmVTaGFyZU5vdEltcGxlbWVudGVkRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKHdhbGxldElkOiBzdHJpbmcsIGRldGFpbDogc3RyaW5nKSB7XG4gICAgc3VwZXIoYFNhZmUgd2FsbGV0ICR7d2FsbGV0SWR9OiAke2RldGFpbH1gKTtcbiAgICB0aGlzLm5hbWUgPSAnU2FmZVNoYXJlTm90SW1wbGVtZW50ZWRFcnJvcic7XG4gIH1cbn1cblxuLyoqIGVkMjU1MTkgb25jaGFpbiBtdWx0aXNpZyAoc2xvdCDikaMpLiBOZWVkcyBTTElQLTAwMTAsIG5vdCBzZWNwMjU2azEgQklQMzIuICovXG5jb25zdCBFRDI1NTE5X09OQ0hBSU5fRkFNSUxJRVMgPSBuZXcgU2V0KFsnYWxnbycsICd4bG0nLCAnaGJhciddKTtcblxuLyoqXG4gKiBUcnVlIHdoZW4gdGhpcyBpcyB0aGUgc2FmZSBtaW50ZXIncyB1c2VyIGtleTogd2FsbGV0IGlzIGluIGEgc2FmZSwgdGhlIGtleVxuICogaGFzIGEgcGFyZW50IHJvb3QsIGFuZCB0aGVyZSBpcyBubyBjaGlsZC1sZXZlbCBlbmNyeXB0ZWRQcnYgKHNoYXJlZXMgaGF2ZSBvbmUpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNTYWZlQ2hpbGRQdWJsaWNPbmx5S2V5Y2hhaW4oXG4gIHdhbGxldFNhZmVJZDogc3RyaW5nIHwgdW5kZWZpbmVkLFxuICBrZXljaGFpbjogS2V5Y2hhaW4gfCB1bmRlZmluZWRcbik6IGtleWNoYWluIGlzIEtleWNoYWluICYgeyBwYXJlbnQ6IHN0cmluZyB9IHtcbiAgcmV0dXJuICEhKHdhbGxldFNhZmVJZCAmJiBrZXljaGFpbj8ucGFyZW50ICYmICFrZXljaGFpbi5lbmNyeXB0ZWRQcnYpO1xufVxuXG4vKipcbiAqIEZldGNoIHRoZSByb290IHVzZXIga2V5Y2hhaW4gZm9yIGEgc2FmZSBjaGlsZCBrZXkuXG4gKiBSZXF1aXJlcyBgc291cmNlID09PSAndXNlcidgIHNvIGEgbWlzY29uZmlndXJlZCBwYXJlbnQgZmFpbHMgZWFybHkuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBmZXRjaFJvb3RLZXljaGFpbkZvclNhZmVDaGlsZChcbiAga2V5Y2hhaW5zOiBJS2V5Y2hhaW5zLFxuICBjaGlsZEtleWNoYWluOiBLZXljaGFpblxuKTogUHJvbWlzZTxLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnY+IHtcbiAgaWYgKCFjaGlsZEtleWNoYWluLnBhcmVudCkge1xuICAgIHRocm93IG5ldyBFcnJvcignY2hpbGRLZXljaGFpbi5wYXJlbnQgaXMgcmVxdWlyZWQgdG8gZmV0Y2ggdGhlIHJvb3Qga2V5Y2hhaW4nKTtcbiAgfVxuICBjb25zdCByb290ID0gYXdhaXQga2V5Y2hhaW5zLmdldCh7IGlkOiBjaGlsZEtleWNoYWluLnBhcmVudCB9KTtcbiAgaWYgKHJvb3Quc291cmNlICE9PSAndXNlcicpIHtcbiAgICB0aHJvdyBuZXcgSW52YWxpZFJvb3RLZXljaGFpblNvdXJjZUVycm9yKHJvb3QuaWQsIHJvb3Quc291cmNlKTtcbiAgfVxuICBpZiAoIXJvb3QuZW5jcnlwdGVkUHJ2KSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGByb290IGtleWNoYWluICR7cm9vdC5pZH0gZG9lcyBub3QgaGF2ZSBwcm9wZXJ0eSBlbmNyeXB0ZWRQcnZgKTtcbiAgfVxuICByZXR1cm4gcm9vdCBhcyBLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnY7XG59XG5cbi8qKlxuICogU2hhcmVkIHBhcmFtcyBmb3IgcmVzb2x2aW5nIHNhZmUtb3duZXIga2V5IG1hdGVyaWFsIChvd25lciBzaWduaW5nIGFuZCB3YWxsZXQgc2hhcmluZykuXG4gKiBCb3RoIHJlc29sdmVycyBleHRlbmQgdGhpcyBzbyB0aGUgcHJlY29uZGl0aW9uL2Rlcml2YXRpb24gcGF0aCBjYW5ub3QgZGl2ZXJnZS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTYWZlS2V5TWF0ZXJpYWxCYXNlUGFyYW1zIHtcbiAgYml0Z286IEJpdEdvQmFzZTtcbiAga2V5Y2hhaW5zOiBJS2V5Y2hhaW5zO1xuICB3YWxsZXRJZDogc3RyaW5nO1xuICAvKiogT25jaGFpbiBzZWNwMjU2azE6IGhhcmRlbmVkLWRlcml2ZSBhbmQgdmVyaWZ5IHB1Yi4gT3RoZXIgc2xvdHMgdGhyb3cuICovXG4gIG11bHRpc2lnVHlwZTogc3RyaW5nIHwgdW5kZWZpbmVkO1xuICBjb2luRmFtaWx5OiBzdHJpbmc7XG4gIGNoaWxkS2V5Y2hhaW46IEtleWNoYWluO1xuICB3YWxsZXRQYXNzcGhyYXNlOiBzdHJpbmc7XG4gIC8qKiBXaGVuIGFscmVhZHkgZmV0Y2hlZCAocGFzc3BocmFzZSBwcmVmbGlnaHQpLCBza2lwIGEgc2Vjb25kIEdFVC4gKi9cbiAgcm9vdEtleWNoYWluPzogS2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2O1xufVxuXG5leHBvcnQgdHlwZSBSZXNvbHZlU2FmZU93bmVyU2lnbmluZ1BydlBhcmFtcyA9IFNhZmVLZXlNYXRlcmlhbEJhc2VQYXJhbXM7XG5cbnR5cGUgU2FmZUtleU1hdGVyaWFsU2xvdCA9ICd0c3MnIHwgJ2VkMjU1MTknO1xuXG50eXBlIFJlc29sdmVTYWZlS2V5TWF0ZXJpYWxQYXJhbXMgPSBTYWZlS2V5TWF0ZXJpYWxCYXNlUGFyYW1zICYge1xuICAvKiogQ29uc3RydWN0cyB0aGUgbm90LWltcGxlbWVudGVkIGVycm9yIGZvciB0aGUgY3VycmVudCByZXNvbHZlciAoc2lnbmluZyB2cyBzaGFyaW5nKS4gKi9cbiAgbWFrZU5vdEltcGxlbWVudGVkRXJyb3I6IChzbG90OiBTYWZlS2V5TWF0ZXJpYWxTbG90LCB3YWxsZXRJZDogc3RyaW5nKSA9PiBFcnJvcjtcbn07XG5cbi8qKlxuICogU2hhcmVkIGNvcmUgdGhhdCByZXNvbHZlcyBzYWZlIGtleSBtYXRlcmlhbCBmb3IgYSBwdWItb25seSBzYWZlIGNoaWxkLiBSZXR1cm5zIHRoZSBDSElMRFxuICogYHtwcnYsIHB1Yn1gIG9ubHkg4oCUIG5ldmVyIHRoZSByb290IOKAlCBzbyB0aGUgcm9vdCBjYW4gbmV2ZXIgbGVhayBpbnRvIGEgc2hhcmUgZG9jdW1lbnQuXG4gKlxuICogT25jaGFpbiBzZWNwMjU2azE6IGRlY3J5cHQgcm9vdCwgaGFyZGVuZWQtZGVyaXZlIGF0IGBkZXJpdmVkRnJvbVBhcmVudFdpdGhQYXRoYFxuICogKGBtLzxuPidgKSwgYW5kIHZlcmlmeSB0aGUgcmVnaXN0ZXJlZCBwdWIuIFRTUyBhbmQgZWQyNTUxOSBvbmNoYWluIHRocm93IHZpYVxuICogYG1ha2VOb3RJbXBsZW1lbnRlZEVycm9yYCDigJQgdGhlIGNhbGxlciBjb25zdHJ1Y3RzIGl0cyBvd24gZXJyb3IgY2xhc3MgKyBtZXNzYWdlLCBzbyB0aGVcbiAqIGd1YXJkIHNldCBzdGF5cyBzaGFyZWQgd2hpbGUgc2lnbmluZy9zaGFyaW5nIHJlcG9ydCB0aGVpciBvd24gZXJyb3JzLlxuICovXG5hc3luYyBmdW5jdGlvbiByZXNvbHZlU2FmZUtleU1hdGVyaWFsKHBhcmFtczogUmVzb2x2ZVNhZmVLZXlNYXRlcmlhbFBhcmFtcyk6IFByb21pc2U8eyBwcnY6IHN0cmluZzsgcHViOiBzdHJpbmcgfT4ge1xuICBjb25zdCB7XG4gICAgYml0Z28sXG4gICAga2V5Y2hhaW5zLFxuICAgIHdhbGxldElkLFxuICAgIG11bHRpc2lnVHlwZSxcbiAgICBjb2luRmFtaWx5LFxuICAgIGNoaWxkS2V5Y2hhaW4sXG4gICAgd2FsbGV0UGFzc3BocmFzZSxcbiAgICBtYWtlTm90SW1wbGVtZW50ZWRFcnJvcixcbiAgfSA9IHBhcmFtcztcblxuICBpZiAobXVsdGlzaWdUeXBlICE9PSAnb25jaGFpbicpIHtcbiAgICB0aHJvdyBtYWtlTm90SW1wbGVtZW50ZWRFcnJvcigndHNzJywgd2FsbGV0SWQpO1xuICB9XG4gIGlmIChFRDI1NTE5X09OQ0hBSU5fRkFNSUxJRVMuaGFzKGNvaW5GYW1pbHkpKSB7XG4gICAgdGhyb3cgbWFrZU5vdEltcGxlbWVudGVkRXJyb3IoJ2VkMjU1MTknLCB3YWxsZXRJZCk7XG4gIH1cblxuICBjb25zdCByb290S2V5Y2hhaW4gPSBwYXJhbXMucm9vdEtleWNoYWluID8/IChhd2FpdCBmZXRjaFJvb3RLZXljaGFpbkZvclNhZmVDaGlsZChrZXljaGFpbnMsIGNoaWxkS2V5Y2hhaW4pKTtcbiAgY29uc3Qgcm9vdFBydiA9IGF3YWl0IGRlY3J5cHRLZXljaGFpblByaXZhdGVLZXkoYml0Z28sIHJvb3RLZXljaGFpbiwgd2FsbGV0UGFzc3BocmFzZSk7XG4gIGlmICghcm9vdFBydikge1xuICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCk7XG4gIH1cblxuICBpZiAoIWNoaWxkS2V5Y2hhaW4ucHViKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogY2hpbGQga2V5Y2hhaW4gaXMgbWlzc2luZyBwdWIgZm9yIHByZS1zaWduIHZlcmlmaWNhdGlvbmApO1xuICB9XG4gIGlmIChjaGlsZEtleWNoYWluLmRlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGggPT09IHVuZGVmaW5lZCkge1xuICAgIHRocm93IG5ldyBFcnJvcihgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06IGNoaWxkIGtleWNoYWluIGlzIG1pc3NpbmcgZGVyaXZlZEZyb21QYXJlbnRXaXRoUGF0aGApO1xuICB9XG5cbiAgY29uc3QgZGVyaXZlZCA9IGRlcml2ZVNhZmVDaGlsZEhhcmRlbmVkRnJvbVhwcnYoXG4gICAgcm9vdFBydixcbiAgICBwYXJzZURlcml2ZWRGcm9tUGFyZW50V2l0aEhhcmRlbmVkUGF0aChjaGlsZEtleWNoYWluLmRlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGgpXG4gICk7XG4gIGlmIChkZXJpdmVkLnB1YiAhPT0gY2hpbGRLZXljaGFpbi5wdWIpIHtcbiAgICB0aHJvdyBuZXcgU2FmZURlcml2ZWRQdWJsaWNLZXlNaXNtYXRjaEVycm9yKHdhbGxldElkLCBjaGlsZEtleWNoYWluLnB1YiwgZGVyaXZlZC5wdWIpO1xuICB9XG5cbiAgaWYgKGRlcml2ZWQucHViID09PSByb290S2V5Y2hhaW4ucHViKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogZGVyaXZlZCBjaGlsZCBwdWIgdW5leHBlY3RlZGx5IGVxdWFscyB0aGUgcm9vdCBwdWJgKTtcbiAgfVxuICByZXR1cm4geyBwcnY6IGRlcml2ZWQucHJ2LCBwdWI6IGRlcml2ZWQucHViIH07XG59XG5cbi8qKlxuICogUmVzb2x2ZSBzaWduaW5nIG1hdGVyaWFsIGZvciBhIHNhZmUgb3duZXIgKGNoaWxkIGtleSBoYXMgbm8gZW5jcnlwdGVkUHJ2KS5cbiAqXG4gKiBPbmNoYWluIHNlY3AyNTZrMTogZGVjcnlwdCByb290LCBoYXJkZW5lZC1kZXJpdmUgYXQgYGRlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGhgXG4gKiAoYG0vPG4+J2ApLCBhbmQgdmVyaWZ5IHRoZSByZWdpc3RlcmVkIHB1Yi5cbiAqIFRTUyBhbmQgZWQyNTUxOSBvbmNoYWluOiB0aHJvdyDigJQgZG8gbm90IHJldHVybiByb290IG1hdGVyaWFsIG9yIEJJUDMyLWRlcml2ZSB0aGUgd3JvbmcgY3VydmUuXG4gKlxuICogRG8gbm90IHVzZSBmb3Igd2FsbGV0IHNoYXJpbmcg4oCUIHRoYXQgbXVzdCBub3QgcmVjZWl2ZSByb290IGtleSBtYXRlcmlhbC5cbiAqIENhbGwgb25seSB3aGVuIGBpc1NhZmVDaGlsZFB1YmxpY09ubHlLZXljaGFpbmAgaXMgdHJ1ZS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVTYWZlT3duZXJTaWduaW5nUHJ2KHBhcmFtczogUmVzb2x2ZVNhZmVPd25lclNpZ25pbmdQcnZQYXJhbXMpOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCB7IHBydiB9ID0gYXdhaXQgcmVzb2x2ZVNhZmVLZXlNYXRlcmlhbCh7XG4gICAgLi4ucGFyYW1zLFxuICAgIG1ha2VOb3RJbXBsZW1lbnRlZEVycm9yOiAoc2xvdCwgd2FsbGV0SWQpID0+XG4gICAgICBzbG90ID09PSAnZWQyNTUxOSdcbiAgICAgICAgPyBuZXcgU2FmZU93bmVyU2lnbmluZ05vdEltcGxlbWVudGVkRXJyb3IoXG4gICAgICAgICAgICB3YWxsZXRJZCxcbiAgICAgICAgICAgIGBlZDI1NTE5IG11bHRpc2lnIG93bmVyIGRlcml2YXRpb24gKCR7cGFyYW1zLmNvaW5GYW1pbHl9KSBpcyBub3QgaW1wbGVtZW50ZWQ7IEJJUDMyIHdvdWxkIHByb2R1Y2UgdGhlIHdyb25nIGNoaWxkIGtleS5gXG4gICAgICAgICAgKVxuICAgICAgICA6IG5ldyBTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvcihcbiAgICAgICAgICAgIHdhbGxldElkLFxuICAgICAgICAgICAgJ1RTUyBvd25lciBzaWduaW5nIGZyb20gdGhlIHJvb3Qga2V5c2hhcmUgaXMgbm90IGltcGxlbWVudGVkLiAnICtcbiAgICAgICAgICAgICAgJ1JldHVybmluZyB0aGUgcm9vdCBwcml2YXRlIGtleSB3b3VsZCBleHBvc2UgbWF0ZXJpYWwgdGhhdCBjYW4gZGVyaXZlIGV2ZXJ5IGNoaWxkIGluIHRoaXMgc2xvdC4nXG4gICAgICAgICAgKSxcbiAgfSk7XG4gIHJldHVybiBwcnY7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVzb2x2ZVNhZmVDaGlsZFBydkZvclNoYXJpbmdQYXJhbXMgZXh0ZW5kcyBTYWZlS2V5TWF0ZXJpYWxCYXNlUGFyYW1zIHtcbiAgbXBjQWxnb3JpdGhtPzogJ2VjZHNhJyB8ICdlZGRzYSc7XG59XG5cbi8qKiBTbG90LW5hbWVkIG5vdC1pbXBsZW1lbnRlZCBkZXRhaWwgZm9yIHdhbGxldCBzaGFyaW5nLiAqL1xuZnVuY3Rpb24gc2FmZVNoYXJlU2xvdERldGFpbChzbG90OiBTYWZlS2V5TWF0ZXJpYWxTbG90LCBwYXJhbXM6IFJlc29sdmVTYWZlQ2hpbGRQcnZGb3JTaGFyaW5nUGFyYW1zKTogc3RyaW5nIHtcbiAgaWYgKHNsb3QgPT09ICdlZDI1NTE5Jykge1xuICAgIHJldHVybiBgZWQyNTUxOSBtdWx0aXNpZyBzYWZlIHNoYXJpbmcgKCR7cGFyYW1zLmNvaW5GYW1pbHl9KSBpcyBub3QgaW1wbGVtZW50ZWQ7IEJJUDMyIHdvdWxkIGRlcml2ZSB0aGUgd3JvbmcgY2hpbGQuYDtcbiAgfVxuICByZXR1cm4gcGFyYW1zLm1wY0FsZ29yaXRobSA9PT0gJ2VkZHNhJ1xuICAgID8gJ2VkZHNhTXBjIHNhZmUgc2hhcmluZyBpcyBub3QgaW1wbGVtZW50ZWQgKG5lZWRzIHRoZSBFZERTQSBkZXJpdmUgY2VyZW1vbnkpLidcbiAgICA6ICdlY2RzYU1wYyBzYWZlIHNoYXJpbmcgaXMgbm90IGltcGxlbWVudGVkIChuZWVkcyB0aGUgREtMUyBkZXJpdmUgY2VyZW1vbnkpLic7XG59XG5cbi8qKlxuICogUmVzb2x2ZSBzaGFyaW5nIG1hdGVyaWFsIGZvciBhIHNhZmUgb3duZXIgKGNoaWxkIGtleSBoYXMgbm8gZW5jcnlwdGVkUHJ2KS5cbiAqXG4gKiBPbmNoYWluIHNlY3AyNTZrMTogZGVjcnlwdCByb290LCBoYXJkZW5lZC1kZXJpdmUgYXQgYGRlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGhgXG4gKiAoYG0vPG4+J2ApLCB2ZXJpZnkgdGhlIHJlZ2lzdGVyZWQgcHViLCBhbmQgcmV0dXJuIHRoZSBDSElMRCBge3BydiwgcHVifWAg4oCUIG5ldmVyIHRoZSByb290LlxuICogVFNTIGFuZCBlZDI1NTE5IG9uY2hhaW46IHRocm93IGBTYWZlU2hhcmVOb3RJbXBsZW1lbnRlZEVycm9yYCBuYW1pbmcgdGhlIHNsb3QgKyBibG9ja2VyLlxuICpcbiAqIENhbGwgb25seSB3aGVuIGBpc1NhZmVDaGlsZFB1YmxpY09ubHlLZXljaGFpbmAgaXMgdHJ1ZS5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVTYWZlQ2hpbGRQcnZGb3JTaGFyaW5nKFxuICBwYXJhbXM6IFJlc29sdmVTYWZlQ2hpbGRQcnZGb3JTaGFyaW5nUGFyYW1zXG4pOiBQcm9taXNlPERlY3J5cHRlZEtleWNoYWluRGF0YT4ge1xuICByZXR1cm4gcmVzb2x2ZVNhZmVLZXlNYXRlcmlhbCh7XG4gICAgLi4ucGFyYW1zLFxuICAgIG1ha2VOb3RJbXBsZW1lbnRlZEVycm9yOiAoc2xvdCwgd2FsbGV0SWQpID0+XG4gICAgICBuZXcgU2FmZVNoYXJlTm90SW1wbGVtZW50ZWRFcnJvcih3YWxsZXRJZCwgc2FmZVNoYXJlU2xvdERldGFpbChzbG90LCBwYXJhbXMpKSxcbiAgfSk7XG59XG4iXX0=