@bitgo-beta/sdk-core 8.2.1-beta.212 → 8.2.1-beta.2121

package/dist/src/bitgo/safe/recovery.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptSafeKeycard = decryptSafeKeycard;
+exports.deriveSafeWalletKeys = deriveSafeWalletKeys;
+exports.buildSafeRecoverKeyParams = buildSafeRecoverKeyParams;
+const crypto_1 = require("crypto");
+const utxo_lib_1 = require("@bitgo-beta/utxo-lib");
+const statics_1 = require("@bitgo-beta/statics");
+const sdk_lib_safes_1 = require("@bitgo-beta/sdk-lib-safes");
+const derivableEd25519Pub_1 = require("./derivableEd25519Pub");
+const sdk_lib_mpc_1 = require("@bitgo-beta/sdk-lib-mpc");
+const errors_1 = require("../errors");
+const keyShareEnvelope_1 = require("../utils/tss/keyShareEnvelope");
+async function decryptSafeKeycard(params) {
+    const { bitgo, userKeyBox, backupKeyBox, bitgoKeyBox, password } = params;
+    const userRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(userKeyBox);
+    const backupRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(backupKeyBox);
+    const bitgoRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(bitgoKeyBox);
+    const decryptRoot = async (root) => {
+        try {
+            return await bitgo.decrypt({ input: root, password });
+        }
+        catch (e) {
+            throw new errors_1.IncorrectPasswordError('unable to decrypt the safe keycard with the provided password', e);
+        }
+    };
+    const unwrapMpcRoot = (decrypted) => {
+        try {
+            return (0, keyShareEnvelope_1.parseSafeMpcKeyEnvelopes)(decrypted);
+        }
+        catch (e) {
+            throw new errors_1.IncorrectPasswordError('unable to decrypt the safe keycard with the provided password', e);
+        }
+    };
+    // Only box B's ed25519Multisig slot may carry the derivable `{ prv, chainCode }` object; every
+    // other entry — all of boxes A and C, and every non-ed25519 slot in box B — is a bare string and
+    // fails closed if it carries the object instead.
+    const requireBareString = (entry) => {
+        if (sdk_lib_safes_1.Ed25519ChainCodeEntryCodec.is(entry)) {
+            throw new Error('unexpected ed25519 chain-code entry where a bare string was required');
+        }
+        return entry;
+    };
+    const decryptEd25519Backup = async (entry) => {
+        if (!sdk_lib_safes_1.Ed25519ChainCodeEntryCodec.is(entry)) {
+            throw new Error('ed25519 backup root must carry a chain code');
+        }
+        return { prv: await decryptRoot(entry.prv), chainCode: entry.chainCode };
+    };
+    return {
+        secp256k1Multisig: {
+            user: await decryptRoot(requireBareString(userRoots.secp256k1Multisig)),
+            backup: await decryptRoot(requireBareString(backupRoots.secp256k1Multisig)),
+            bitgo: requireBareString(bitgoRoots.secp256k1Multisig),
+        },
+        ed25519Multisig: {
+            user: await decryptRoot(requireBareString(userRoots.ed25519Multisig)),
+            backup: await decryptEd25519Backup(backupRoots.ed25519Multisig),
+            bitgo: requireBareString(bitgoRoots.ed25519Multisig),
+        },
+        ecdsaMpc: {
+            user: unwrapMpcRoot(await decryptRoot(requireBareString(userRoots.ecdsaMpc))),
+            backup: unwrapMpcRoot(await decryptRoot(requireBareString(backupRoots.ecdsaMpc))),
+            bitgo: requireBareString(bitgoRoots.ecdsaMpc),
+        },
+        eddsaMpc: {
+            user: unwrapMpcRoot(await decryptRoot(requireBareString(userRoots.eddsaMpc))),
+            backup: unwrapMpcRoot(await decryptRoot(requireBareString(backupRoots.eddsaMpc))),
+            bitgo: requireBareString(bitgoRoots.eddsaMpc),
+        },
+    };
+}
+/**
+ * Derives a Safe wallet's child keys at the BIP44 path for a given slot and account.
+ * Supports all four slots: `secp256k1Multisig`, `ed25519Multisig`, `ecdsaMpc`, and `eddsaMpc`.
+ */
+async function deriveSafeWalletKeys(params) {
+    if (!Number.isInteger(params.account) || params.account < 0 || params.account > statics_1.MAX_BIP32_INDEX) {
+        throw new Error(`deriveSafeWalletKeys: invalid account '${params.account}'`);
+    }
+    const { account, roots } = params;
+    const path = (0, sdk_lib_safes_1.buildSafeBip44Path)((0, sdk_lib_safes_1.getSafeBip44CoinType)(params.coin), params.slot, account);
+    const { coinType, slotOrdinal } = (0, sdk_lib_safes_1.parseSafeBip44Path)(path);
+    if (params.slot === 'secp256k1Multisig') {
+        return { slot: 'secp256k1Multisig', path, keys: (0, sdk_lib_safes_1.deriveSafeChildTriplet)(roots.secp256k1Multisig, path) };
+    }
+    if (params.slot === 'ecdsaMpc') {
+        const { commonKeychain, userChild, backupChild } = await sdk_lib_mpc_1.DklsVrfUtils.deriveSafeEcdsaMpcChild({
+            userRoot: roots.ecdsaMpc.user,
+            backupRoot: roots.ecdsaMpc.backup,
+            account,
+            coinType,
+            safeSlotOrdinal: slotOrdinal,
+        });
+        return {
+            slot: 'ecdsaMpc',
+            path,
+            keys: { commonKeychain, user: userChild, backup: backupChild },
+        };
+    }
+    if (params.slot === 'eddsaMpc') {
+        const { commonKeychain, userChild, backupChild } = await sdk_lib_mpc_1.MpsVrfUtils.deriveSafeEddsaMpcChild({
+            userRoot: roots.eddsaMpc.user,
+            backupRoot: roots.eddsaMpc.backup,
+            account,
+            coinType,
+            safeSlotOrdinal: slotOrdinal,
+        });
+        return {
+            slot: 'eddsaMpc',
+            path,
+            keys: { commonKeychain, user: userChild, backup: backupChild },
+        };
+    }
+    if (params.slot === 'ed25519Multisig') {
+        const root = roots.ed25519Multisig;
+        const cosignerPath = (0, sdk_lib_safes_1.toSoftTwinPath)(path);
+        const user = (0, sdk_lib_safes_1.deriveSafeChildEd25519Hardened)(root.user, path);
+        const backup = await (0, derivableEd25519Pub_1.softDeriveChildPrvEd25519AtPath)({
+            seedStrKey: root.backup.prv,
+            chainCode: root.backup.chainCode,
+            path: cosignerPath,
+        });
+        const bitgo = await (0, derivableEd25519Pub_1.softDeriveChildPubEd25519AtPath)(root.bitgo, cosignerPath);
+        return {
+            slot: 'ed25519Multisig',
+            path,
+            keys: {
+                user: { kind: 'seed', seed: user.prv, pub: (0, sdk_lib_safes_1.decodeEd25519StrKeyPublicKey)(user.pub).toString('hex') },
+                backup: {
+                    kind: 'extended',
+                    kL: backup.kL.toString('hex'),
+                    kR: backup.kR.toString('hex'),
+                    pub: backup.pub.toString('hex'),
+                },
+                bitgo: { pub: bitgo.toString('hex') },
+            },
+        };
+    }
+    throw new Error(`deriveSafeWalletKeys: slot '${params.slot}' is not supported yet`);
+}
+/**
+ * Builds the key fields `coin.recover()` expects from derived Safe child keys.
+ * Only `secp256k1Multisig` (slot 1) is supported for now. Signed mode re-encrypts the
+ * child xprvs under a fresh ephemeral passphrase (v1/SJCL); unsigned mode returns pubs.
+ */
+async function buildSafeRecoverKeyParams(params) {
+    if (params.slot !== 'secp256k1Multisig') {
+        throw new Error(`buildSafeRecoverKeyParams: slot '${params.slot}' is not supported yet`);
+    }
+    const { bitgo, keys, mode } = params;
+    if (mode === 'unsigned') {
+        return {
+            userKey: keys.user.pub,
+            backupKey: keys.backup.pub,
+            bitgoKey: keys.bitgo.pub,
+        };
+    }
+    const userPrv = utxo_lib_1.bip32.fromBase58(keys.user.prv);
+    const backupPrv = utxo_lib_1.bip32.fromBase58(keys.backup.prv);
+    if (!userPrv.privateKey || !backupPrv.privateKey) {
+        throw new Error('buildSafeRecoverKeyParams: keys.user.prv and keys.backup.prv must be private xprvs');
+    }
+    const walletPassphrase = (0, crypto_1.randomBytes)(32).toString('hex');
+    const [userKey, backupKey] = await Promise.all([
+        bitgo.encrypt({ input: keys.user.prv, password: walletPassphrase, encryptionVersion: 1 }),
+        bitgo.encrypt({ input: keys.backup.prv, password: walletPassphrase, encryptionVersion: 1 }),
+    ]);
+    return {
+        userKey,
+        backupKey,
+        bitgoKey: keys.bitgo.pub,
+        walletPassphrase,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3ZlcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9yZWNvdmVyeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQW1HQSxnREFvRUM7QUFNRCxvREE2RUM7QUFPRCw4REFzQ0M7QUFqU0QsbUNBQXFDO0FBQ3JDLG1EQUE2QztBQUM3QyxpREFBc0Q7QUFFdEQsNkRBV21DO0FBQ25DLCtEQUkrQjtBQUMvQix5REFBb0U7QUFFcEUsc0NBQW1EO0FBQ25ELG9FQUF5RTtBQXFFbEUsS0FBSyxVQUFVLGtCQUFrQixDQUFDLE1BTXhDO0lBQ0MsTUFBTSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFMUUsTUFBTSxTQUFTLEdBQUcsSUFBQSxtQ0FBbUIsRUFBQyxVQUFVLENBQUMsQ0FBQztJQUNsRCxNQUFNLFdBQVcsR0FBRyxJQUFBLG1DQUFtQixFQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3RELE1BQU0sVUFBVSxHQUFHLElBQUEsbUNBQW1CLEVBQUMsV0FBVyxDQUFDLENBQUM7SUFFcEQsTUFBTSxXQUFXLEdBQUcsS0FBSyxFQUFFLElBQVksRUFBbUIsRUFBRTtRQUMxRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSwrQkFBc0IsQ0FBQywrREFBK0QsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN2RyxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxTQUFpQixFQUF3QixFQUFFO1FBQ2hFLElBQUksQ0FBQztZQUNILE9BQU8sSUFBQSwyQ0FBd0IsRUFBQyxTQUFTLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSwrQkFBc0IsQ0FBQywrREFBK0QsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN2RyxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBRUYsK0ZBQStGO0lBQy9GLGlHQUFpRztJQUNqRyxpREFBaUQ7SUFDakQsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLEtBQTJCLEVBQVUsRUFBRTtRQUNoRSxJQUFJLDBDQUEwQixDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDLENBQUM7SUFFRixNQUFNLG9CQUFvQixHQUFHLEtBQUssRUFBRSxLQUEyQixFQUErQyxFQUFFO1FBQzlHLElBQUksQ0FBQywwQ0FBMEIsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMxQyxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxXQUFXLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDM0UsQ0FBQyxDQUFDO0lBRUYsT0FBTztRQUNMLGlCQUFpQixFQUFFO1lBQ2pCLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUN2RSxNQUFNLEVBQUUsTUFBTSxXQUFXLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLGlCQUFpQixDQUFDLENBQUM7WUFDM0UsS0FBSyxFQUFFLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQztTQUN2RDtRQUNELGVBQWUsRUFBRTtZQUNmLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDckUsTUFBTSxFQUFFLE1BQU0sb0JBQW9CLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQztZQUMvRCxLQUFLLEVBQUUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQztTQUNyRDtRQUNELFFBQVEsRUFBRTtZQUNSLElBQUksRUFBRSxhQUFhLENBQUMsTUFBTSxXQUFXLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDN0UsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNqRixLQUFLLEVBQUUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztTQUM5QztRQUNELFFBQVEsRUFBRTtZQUNSLElBQUksRUFBRSxhQUFhLENBQUMsTUFBTSxXQUFXLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDN0UsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNqRixLQUFLLEVBQUUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztTQUM5QztLQUNGLENBQUM7QUFDSixDQUFDO0FBRUQ7OztHQUdHO0FBQ0ksS0FBSyxVQUFVLG9CQUFvQixDQUFDLE1BSzFDO0lBQ0MsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEdBQUcseUJBQWUsRUFBRSxDQUFDO1FBQ2hHLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxJQUFBLGtDQUFrQixFQUFDLElBQUEsb0NBQW9CLEVBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDekYsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFBLGtDQUFrQixFQUFDLElBQUksQ0FBQyxDQUFDO0lBRTNELElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxtQkFBbUIsRUFBRSxDQUFDO1FBQ3hDLE9BQU8sRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFBLHNDQUFzQixFQUFDLEtBQUssQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQzFHLENBQUM7SUFFRCxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDL0IsTUFBTSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLEdBQUcsTUFBTSwwQkFBWSxDQUFDLHVCQUF1QixDQUFDO1lBQzVGLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUk7WUFDN0IsVUFBVSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTTtZQUNqQyxPQUFPO1lBQ1AsUUFBUTtZQUNSLGVBQWUsRUFBRSxXQUFXO1NBQzdCLENBQUMsQ0FBQztRQUNILE9BQU87WUFDTCxJQUFJLEVBQUUsVUFBVTtZQUNoQixJQUFJO1lBQ0osSUFBSSxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRTtTQUMvRCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUMvQixNQUFNLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsR0FBRyxNQUFNLHlCQUFXLENBQUMsdUJBQXVCLENBQUM7WUFDM0YsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSTtZQUM3QixVQUFVLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNO1lBQ2pDLE9BQU87WUFDUCxRQUFRO1lBQ1IsZUFBZSxFQUFFLFdBQVc7U0FDN0IsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNMLElBQUksRUFBRSxVQUFVO1lBQ2hCLElBQUk7WUFDSixJQUFJLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFO1NBQy9ELENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLGVBQWUsQ0FBQztRQUNuQyxNQUFNLFlBQVksR0FBRyxJQUFBLDhCQUFjLEVBQUMsSUFBSSxDQUFDLENBQUM7UUFFMUMsTUFBTSxJQUFJLEdBQUcsSUFBQSw4Q0FBOEIsRUFBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBQSxxREFBK0IsRUFBQztZQUNuRCxVQUFVLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHO1lBQzNCLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVM7WUFDaEMsSUFBSSxFQUFFLFlBQVk7U0FDbkIsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFBLHFEQUErQixFQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFFOUUsT0FBTztZQUNMLElBQUksRUFBRSxpQkFBaUI7WUFDdkIsSUFBSTtZQUNKLElBQUksRUFBRTtnQkFDSixJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFBLDRDQUE0QixFQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUU7Z0JBQ25HLE1BQU0sRUFBRTtvQkFDTixJQUFJLEVBQUUsVUFBVTtvQkFDaEIsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztvQkFDN0IsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztvQkFDN0IsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztpQkFDaEM7Z0JBQ0QsS0FBSyxFQUFFLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUU7YUFDdEM7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLE1BQU0sQ0FBQyxJQUFJLHdCQUF3QixDQUFDLENBQUM7QUFDdEYsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSSxLQUFLLFVBQVUseUJBQXlCLENBQUMsTUFNL0M7SUFDQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssbUJBQW1CLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxNQUFNLENBQUMsSUFBSSx3QkFBd0IsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFckMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEIsT0FBTztZQUNMLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7WUFDdEIsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRztZQUMxQixRQUFRLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHO1NBQ3pCLENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsZ0JBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNoRCxNQUFNLFNBQVMsR0FBRyxnQkFBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3BELElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2pELE1BQU0sSUFBSSxLQUFLLENBQUMsb0ZBQW9GLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBRUQsTUFBTSxnQkFBZ0IsR0FBRyxJQUFBLG9CQUFXLEVBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3pELE1BQU0sQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQzdDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLGlCQUFpQixFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3pGLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLGlCQUFpQixFQUFFLENBQUMsRUFBRSxDQUFDO0tBQzVGLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxPQUFPO1FBQ1AsU0FBUztRQUNULFFBQVEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7UUFDeEIsZ0JBQWdCO0tBQ2pCLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFdSVy1mYWNpbmcgc2FmZSByZWNvdmVyeSBlbnRyeSBwb2ludHMuXG4gKi9cbmltcG9ydCB7IEJ1ZmZlciB9IGZyb20gJ2J1ZmZlcic7XG5pbXBvcnQgeyByYW5kb21CeXRlcyB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgeyBiaXAzMiB9IGZyb20gJ0BiaXRnby1iZXRhL3V0eG8tbGliJztcbmltcG9ydCB7IE1BWF9CSVAzMl9JTkRFWCB9IGZyb20gJ0BiaXRnby1iZXRhL3N0YXRpY3MnO1xuaW1wb3J0IHR5cGUgeyBSb290S2V5VHlwZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHtcbiAgYnVpbGRTYWZlQmlwNDRQYXRoLFxuICBkZWNvZGVFZDI1NTE5U3RyS2V5UHVibGljS2V5LFxuICBkZXJpdmVTYWZlQ2hpbGRFZDI1NTE5SGFyZGVuZWQsXG4gIGRlcml2ZVNhZmVDaGlsZFRyaXBsZXQsXG4gIEVkMjU1MTlDaGFpbkNvZGVFbnRyeUNvZGVjLFxuICBnZXRTYWZlQmlwNDRDb2luVHlwZSxcbiAgcGFyc2VTYWZlQmlwNDRQYXRoLFxuICBwYXJzZVNhZmVLZXljYXJkQm94LFxuICB0b1NvZnRUd2luUGF0aCxcbiAgdHlwZSBTYWZlS2V5Y2FyZFJvb3RFbnRyeSxcbn0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWxpYi1zYWZlcyc7XG5pbXBvcnQge1xuICBzb2Z0RGVyaXZlQ2hpbGRQdWJFZDI1NTE5QXRQYXRoLFxuICBzb2Z0RGVyaXZlQ2hpbGRQcnZFZDI1NTE5QXRQYXRoLFxuICB0eXBlIEVkMjU1MTlFeHRlbmRlZEtleVBhcnRzLFxufSBmcm9tICcuL2Rlcml2YWJsZUVkMjU1MTlQdWInO1xuaW1wb3J0IHsgRGtsc1ZyZlV0aWxzLCBNcHNWcmZVdGlscyB9IGZyb20gJ0BiaXRnby1iZXRhL3Nkay1saWItbXBjJztcbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5pbXBvcnQgeyBJbmNvcnJlY3RQYXNzd29yZEVycm9yIH0gZnJvbSAnLi4vZXJyb3JzJztcbmltcG9ydCB7IHBhcnNlU2FmZU1wY0tleUVudmVsb3BlcyB9IGZyb20gJy4uL3V0aWxzL3Rzcy9rZXlTaGFyZUVudmVsb3BlJztcblxuZXhwb3J0IHR5cGUgRGVjcnlwdGVkTXBjU2FmZVJvb3QgPSB7IHNpZ25pbmc6IEJ1ZmZlcjsgdnJmOiBCdWZmZXIgfTtcblxuZXhwb3J0IHR5cGUgT25jaGFpblNhZmVSb290ID0geyB1c2VyOiBzdHJpbmc7IGJhY2t1cDogc3RyaW5nOyBiaXRnbzogc3RyaW5nIH07XG5leHBvcnQgdHlwZSBNcGNTYWZlUm9vdCA9IHsgdXNlcjogRGVjcnlwdGVkTXBjU2FmZVJvb3Q7IGJhY2t1cDogRGVjcnlwdGVkTXBjU2FmZVJvb3Q7IGJpdGdvOiBzdHJpbmcgfTtcbmV4cG9ydCB0eXBlIEVkMjU1MTlNdWx0aXNpZ1NhZmVSb290ID0ge1xuICB1c2VyOiBzdHJpbmc7XG4gIGJhY2t1cDogeyBwcnY6IHN0cmluZzsgY2hhaW5Db2RlOiBzdHJpbmcgfTtcbiAgYml0Z286IHN0cmluZztcbn07XG5cbmV4cG9ydCB0eXBlIFNlY3AyNTZrMU11bHRpc2lnQ2hpbGRLZXlzID0ge1xuICB1c2VyOiB7IHBydjogc3RyaW5nOyBwdWI6IHN0cmluZyB9O1xuICBiYWNrdXA6IHsgcHJ2OiBzdHJpbmc7IHB1Yjogc3RyaW5nIH07XG4gIGJpdGdvOiB7IHB1Yjogc3RyaW5nIH07XG59O1xuXG5leHBvcnQgdHlwZSBFY2RzYU1wY0NoaWxkS2V5cyA9IHtcbiAgY29tbW9uS2V5Y2hhaW46IHN0cmluZztcbiAgdXNlcjogc3RyaW5nO1xuICBiYWNrdXA6IHN0cmluZztcbn07XG5cbmV4cG9ydCB0eXBlIEVkZHNhTXBjQ2hpbGRLZXlzID0gRWNkc2FNcGNDaGlsZEtleXM7XG5cbi8qKlxuICogQSBoYXJkZW5lZCAoU0xJUC0wMDEwKSBlZDI1NTE5IGNoaWxkLiBUaGUgYGtpbmRgIGRpc2NyaW1pbmF0b3IgcHJldmVudHMgYSByYXcgc2VlZCBmcm9tIGJlaW5nXG4gKiBtaXN0YWtlbiBmb3IgYW4gZXh0ZW5kZWQga2V5IGRvd25zdHJlYW0g4oCUIGJvdGggYXJlIDMyLWJ5dGUgdmFsdWVzIHRoYXQgYGlzVmFsaWRQdWJgIHdvdWxkIGFjY2VwdC5cbiAqL1xuZXhwb3J0IHR5cGUgU2FmZUVkMjU1MTlTZWVkS2V5ID0ge1xuICByZWFkb25seSBraW5kOiAnc2VlZCc7XG4gIHJlYWRvbmx5IHNlZWQ6IHN0cmluZzsgLy8gMzItYnl0ZSBjaGlsZCBzZWVkIChoZXgpIOKAlCB0aGUgc2lnbmVyIGlucHV0XG4gIHJlYWRvbmx5IHB1Yjogc3RyaW5nOyAvLyAzMi1ieXRlIHB1YmxpYyBrZXkgKGhleClcbn07XG5cbi8qKlxuICogQSBzb2Z0IChCSVAzMi1FZDI1NTE5KSBlZDI1NTE5IGNoaWxkLiBObyAzMi1ieXRlIHNlZWQgbWFwcyBiYWNrIHRvIGEgc29mdC1kZXJpdmVkIGNoaWxkLCBzbyB0aGVcbiAqIHNpZ25lciBuZWVkcyBib3RoIGhhbHZlcyBkaXJlY3RseTogYGtMYCAodGhlIGNsYW1wZWQgc2NhbGFyKSBhbmQgYGtSYCAodGhlIG5vbmNlIHByZWZpeCkuXG4gKi9cbmV4cG9ydCB0eXBlIFNhZmVFZDI1NTE5RXh0ZW5kZWRLZXkgPSB7IHJlYWRvbmx5IGtpbmQ6ICdleHRlbmRlZCcgfSAmIEVkMjU1MTlFeHRlbmRlZEtleVBhcnRzPHN0cmluZz47IC8vIGhleFxuXG4vKiogVGhlIHRocmVlIGVkMjU1MTkgY28tc2lnbmVyIGNoaWxkcmVuLiBCaXRHbyBpcyBwdWItb25seTogaXRzIHByaXZhdGUga2V5IHN0YXlzIGluIHRoZSBIU00uICovXG5leHBvcnQgdHlwZSBFZDI1NTE5TXVsdGlzaWdDaGlsZEtleXMgPSB7XG4gIHVzZXI6IFNhZmVFZDI1NTE5U2VlZEtleTtcbiAgYmFja3VwOiBTYWZlRWQyNTUxOUV4dGVuZGVkS2V5O1xuICBiaXRnbzogeyByZWFkb25seSBwdWI6IHN0cmluZyB9O1xufTtcblxuZXhwb3J0IHR5cGUgRGVyaXZlZFNhZmVXYWxsZXRLZXlzID1cbiAgfCB7IHNsb3Q6ICdzZWNwMjU2azFNdWx0aXNpZyc7IHBhdGg6IHN0cmluZzsga2V5czogU2VjcDI1NmsxTXVsdGlzaWdDaGlsZEtleXMgfVxuICB8IHsgc2xvdDogJ2VjZHNhTXBjJzsgcGF0aDogc3RyaW5nOyBrZXlzOiBFY2RzYU1wY0NoaWxkS2V5cyB9XG4gIHwgeyBzbG90OiAnZWRkc2FNcGMnOyBwYXRoOiBzdHJpbmc7IGtleXM6IEVkZHNhTXBjQ2hpbGRLZXlzIH1cbiAgfCB7IHNsb3Q6ICdlZDI1NTE5TXVsdGlzaWcnOyBwYXRoOiBzdHJpbmc7IGtleXM6IEVkMjU1MTlNdWx0aXNpZ0NoaWxkS2V5cyB9O1xuXG5leHBvcnQgdHlwZSBTYWZlUmVjb3ZlcktleVBhcmFtcyA9IHtcbiAgdXNlcktleTogc3RyaW5nO1xuICBiYWNrdXBLZXk6IHN0cmluZztcbiAgYml0Z29LZXk6IHN0cmluZztcbiAgd2FsbGV0UGFzc3BocmFzZT86IHN0cmluZztcbn07XG5cbmV4cG9ydCB0eXBlIERlY3J5cHRlZFNhZmVSb290cyA9IHtcbiAgc2VjcDI1NmsxTXVsdGlzaWc6IE9uY2hhaW5TYWZlUm9vdDtcbiAgZWQyNTUxOU11bHRpc2lnOiBFZDI1NTE5TXVsdGlzaWdTYWZlUm9vdDtcbiAgZWNkc2FNcGM6IE1wY1NhZmVSb290O1xuICBlZGRzYU1wYzogTXBjU2FmZVJvb3Q7XG59O1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZGVjcnlwdFNhZmVLZXljYXJkKHBhcmFtczoge1xuICBiaXRnbzogQml0R29CYXNlO1xuICB1c2VyS2V5Qm94OiBzdHJpbmc7XG4gIGJhY2t1cEtleUJveDogc3RyaW5nO1xuICBiaXRnb0tleUJveDogc3RyaW5nO1xuICBwYXNzd29yZDogc3RyaW5nO1xufSk6IFByb21pc2U8RGVjcnlwdGVkU2FmZVJvb3RzPiB7XG4gIGNvbnN0IHsgYml0Z28sIHVzZXJLZXlCb3gsIGJhY2t1cEtleUJveCwgYml0Z29LZXlCb3gsIHBhc3N3b3JkIH0gPSBwYXJhbXM7XG5cbiAgY29uc3QgdXNlclJvb3RzID0gcGFyc2VTYWZlS2V5Y2FyZEJveCh1c2VyS2V5Qm94KTtcbiAgY29uc3QgYmFja3VwUm9vdHMgPSBwYXJzZVNhZmVLZXljYXJkQm94KGJhY2t1cEtleUJveCk7XG4gIGNvbnN0IGJpdGdvUm9vdHMgPSBwYXJzZVNhZmVLZXljYXJkQm94KGJpdGdvS2V5Qm94KTtcblxuICBjb25zdCBkZWNyeXB0Um9vdCA9IGFzeW5jIChyb290OiBzdHJpbmcpOiBQcm9taXNlPHN0cmluZz4gPT4ge1xuICAgIHRyeSB7XG4gICAgICByZXR1cm4gYXdhaXQgYml0Z28uZGVjcnlwdCh7IGlucHV0OiByb290LCBwYXNzd29yZCB9KTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICB0aHJvdyBuZXcgSW5jb3JyZWN0UGFzc3dvcmRFcnJvcigndW5hYmxlIHRvIGRlY3J5cHQgdGhlIHNhZmUga2V5Y2FyZCB3aXRoIHRoZSBwcm92aWRlZCBwYXNzd29yZCcsIGUpO1xuICAgIH1cbiAgfTtcblxuICBjb25zdCB1bndyYXBNcGNSb290ID0gKGRlY3J5cHRlZDogc3RyaW5nKTogRGVjcnlwdGVkTXBjU2FmZVJvb3QgPT4ge1xuICAgIHRyeSB7XG4gICAgICByZXR1cm4gcGFyc2VTYWZlTXBjS2V5RW52ZWxvcGVzKGRlY3J5cHRlZCk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgdGhyb3cgbmV3IEluY29ycmVjdFBhc3N3b3JkRXJyb3IoJ3VuYWJsZSB0byBkZWNyeXB0IHRoZSBzYWZlIGtleWNhcmQgd2l0aCB0aGUgcHJvdmlkZWQgcGFzc3dvcmQnLCBlKTtcbiAgICB9XG4gIH07XG5cbiAgLy8gT25seSBib3ggQidzIGVkMjU1MTlNdWx0aXNpZyBzbG90IG1heSBjYXJyeSB0aGUgZGVyaXZhYmxlIGB7IHBydiwgY2hhaW5Db2RlIH1gIG9iamVjdDsgZXZlcnlcbiAgLy8gb3RoZXIgZW50cnkg4oCUIGFsbCBvZiBib3hlcyBBIGFuZCBDLCBhbmQgZXZlcnkgbm9uLWVkMjU1MTkgc2xvdCBpbiBib3ggQiDigJQgaXMgYSBiYXJlIHN0cmluZyBhbmRcbiAgLy8gZmFpbHMgY2xvc2VkIGlmIGl0IGNhcnJpZXMgdGhlIG9iamVjdCBpbnN0ZWFkLlxuICBjb25zdCByZXF1aXJlQmFyZVN0cmluZyA9IChlbnRyeTogU2FmZUtleWNhcmRSb290RW50cnkpOiBzdHJpbmcgPT4ge1xuICAgIGlmIChFZDI1NTE5Q2hhaW5Db2RlRW50cnlDb2RlYy5pcyhlbnRyeSkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcigndW5leHBlY3RlZCBlZDI1NTE5IGNoYWluLWNvZGUgZW50cnkgd2hlcmUgYSBiYXJlIHN0cmluZyB3YXMgcmVxdWlyZWQnKTtcbiAgICB9XG4gICAgcmV0dXJuIGVudHJ5O1xuICB9O1xuXG4gIGNvbnN0IGRlY3J5cHRFZDI1NTE5QmFja3VwID0gYXN5bmMgKGVudHJ5OiBTYWZlS2V5Y2FyZFJvb3RFbnRyeSk6IFByb21pc2U8eyBwcnY6IHN0cmluZzsgY2hhaW5Db2RlOiBzdHJpbmcgfT4gPT4ge1xuICAgIGlmICghRWQyNTUxOUNoYWluQ29kZUVudHJ5Q29kZWMuaXMoZW50cnkpKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2VkMjU1MTkgYmFja3VwIHJvb3QgbXVzdCBjYXJyeSBhIGNoYWluIGNvZGUnKTtcbiAgICB9XG4gICAgcmV0dXJuIHsgcHJ2OiBhd2FpdCBkZWNyeXB0Um9vdChlbnRyeS5wcnYpLCBjaGFpbkNvZGU6IGVudHJ5LmNoYWluQ29kZSB9O1xuICB9O1xuXG4gIHJldHVybiB7XG4gICAgc2VjcDI1NmsxTXVsdGlzaWc6IHtcbiAgICAgIHVzZXI6IGF3YWl0IGRlY3J5cHRSb290KHJlcXVpcmVCYXJlU3RyaW5nKHVzZXJSb290cy5zZWNwMjU2azFNdWx0aXNpZykpLFxuICAgICAgYmFja3VwOiBhd2FpdCBkZWNyeXB0Um9vdChyZXF1aXJlQmFyZVN0cmluZyhiYWNrdXBSb290cy5zZWNwMjU2azFNdWx0aXNpZykpLFxuICAgICAgYml0Z286IHJlcXVpcmVCYXJlU3RyaW5nKGJpdGdvUm9vdHMuc2VjcDI1NmsxTXVsdGlzaWcpLFxuICAgIH0sXG4gICAgZWQyNTUxOU11bHRpc2lnOiB7XG4gICAgICB1c2VyOiBhd2FpdCBkZWNyeXB0Um9vdChyZXF1aXJlQmFyZVN0cmluZyh1c2VyUm9vdHMuZWQyNTUxOU11bHRpc2lnKSksXG4gICAgICBiYWNrdXA6IGF3YWl0IGRlY3J5cHRFZDI1NTE5QmFja3VwKGJhY2t1cFJvb3RzLmVkMjU1MTlNdWx0aXNpZyksXG4gICAgICBiaXRnbzogcmVxdWlyZUJhcmVTdHJpbmcoYml0Z29Sb290cy5lZDI1NTE5TXVsdGlzaWcpLFxuICAgIH0sXG4gICAgZWNkc2FNcGM6IHtcbiAgICAgIHVzZXI6IHVud3JhcE1wY1Jvb3QoYXdhaXQgZGVjcnlwdFJvb3QocmVxdWlyZUJhcmVTdHJpbmcodXNlclJvb3RzLmVjZHNhTXBjKSkpLFxuICAgICAgYmFja3VwOiB1bndyYXBNcGNSb290KGF3YWl0IGRlY3J5cHRSb290KHJlcXVpcmVCYXJlU3RyaW5nKGJhY2t1cFJvb3RzLmVjZHNhTXBjKSkpLFxuICAgICAgYml0Z286IHJlcXVpcmVCYXJlU3RyaW5nKGJpdGdvUm9vdHMuZWNkc2FNcGMpLFxuICAgIH0sXG4gICAgZWRkc2FNcGM6IHtcbiAgICAgIHVzZXI6IHVud3JhcE1wY1Jvb3QoYXdhaXQgZGVjcnlwdFJvb3QocmVxdWlyZUJhcmVTdHJpbmcodXNlclJvb3RzLmVkZHNhTXBjKSkpLFxuICAgICAgYmFja3VwOiB1bndyYXBNcGNSb290KGF3YWl0IGRlY3J5cHRSb290KHJlcXVpcmVCYXJlU3RyaW5nKGJhY2t1cFJvb3RzLmVkZHNhTXBjKSkpLFxuICAgICAgYml0Z286IHJlcXVpcmVCYXJlU3RyaW5nKGJpdGdvUm9vdHMuZWRkc2FNcGMpLFxuICAgIH0sXG4gIH07XG59XG5cbi8qKlxuICogRGVyaXZlcyBhIFNhZmUgd2FsbGV0J3MgY2hpbGQga2V5cyBhdCB0aGUgQklQNDQgcGF0aCBmb3IgYSBnaXZlbiBzbG90IGFuZCBhY2NvdW50LlxuICogU3VwcG9ydHMgYWxsIGZvdXIgc2xvdHM6IGBzZWNwMjU2azFNdWx0aXNpZ2AsIGBlZDI1NTE5TXVsdGlzaWdgLCBgZWNkc2FNcGNgLCBhbmQgYGVkZHNhTXBjYC5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGRlcml2ZVNhZmVXYWxsZXRLZXlzKHBhcmFtczoge1xuICBjb2luOiBzdHJpbmc7XG4gIHNsb3Q6IFJvb3RLZXlUeXBlO1xuICBhY2NvdW50OiBudW1iZXI7XG4gIHJvb3RzOiBEZWNyeXB0ZWRTYWZlUm9vdHM7XG59KTogUHJvbWlzZTxEZXJpdmVkU2FmZVdhbGxldEtleXM+IHtcbiAgaWYgKCFOdW1iZXIuaXNJbnRlZ2VyKHBhcmFtcy5hY2NvdW50KSB8fCBwYXJhbXMuYWNjb3VudCA8IDAgfHwgcGFyYW1zLmFjY291bnQgPiBNQVhfQklQMzJfSU5ERVgpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYGRlcml2ZVNhZmVXYWxsZXRLZXlzOiBpbnZhbGlkIGFjY291bnQgJyR7cGFyYW1zLmFjY291bnR9J2ApO1xuICB9XG5cbiAgY29uc3QgeyBhY2NvdW50LCByb290cyB9ID0gcGFyYW1zO1xuICBjb25zdCBwYXRoID0gYnVpbGRTYWZlQmlwNDRQYXRoKGdldFNhZmVCaXA0NENvaW5UeXBlKHBhcmFtcy5jb2luKSwgcGFyYW1zLnNsb3QsIGFjY291bnQpO1xuICBjb25zdCB7IGNvaW5UeXBlLCBzbG90T3JkaW5hbCB9ID0gcGFyc2VTYWZlQmlwNDRQYXRoKHBhdGgpO1xuXG4gIGlmIChwYXJhbXMuc2xvdCA9PT0gJ3NlY3AyNTZrMU11bHRpc2lnJykge1xuICAgIHJldHVybiB7IHNsb3Q6ICdzZWNwMjU2azFNdWx0aXNpZycsIHBhdGgsIGtleXM6IGRlcml2ZVNhZmVDaGlsZFRyaXBsZXQocm9vdHMuc2VjcDI1NmsxTXVsdGlzaWcsIHBhdGgpIH07XG4gIH1cblxuICBpZiAocGFyYW1zLnNsb3QgPT09ICdlY2RzYU1wYycpIHtcbiAgICBjb25zdCB7IGNvbW1vbktleWNoYWluLCB1c2VyQ2hpbGQsIGJhY2t1cENoaWxkIH0gPSBhd2FpdCBEa2xzVnJmVXRpbHMuZGVyaXZlU2FmZUVjZHNhTXBjQ2hpbGQoe1xuICAgICAgdXNlclJvb3Q6IHJvb3RzLmVjZHNhTXBjLnVzZXIsXG4gICAgICBiYWNrdXBSb290OiByb290cy5lY2RzYU1wYy5iYWNrdXAsXG4gICAgICBhY2NvdW50LFxuICAgICAgY29pblR5cGUsXG4gICAgICBzYWZlU2xvdE9yZGluYWw6IHNsb3RPcmRpbmFsLFxuICAgIH0pO1xuICAgIHJldHVybiB7XG4gICAgICBzbG90OiAnZWNkc2FNcGMnLFxuICAgICAgcGF0aCxcbiAgICAgIGtleXM6IHsgY29tbW9uS2V5Y2hhaW4sIHVzZXI6IHVzZXJDaGlsZCwgYmFja3VwOiBiYWNrdXBDaGlsZCB9LFxuICAgIH07XG4gIH1cblxuICBpZiAocGFyYW1zLnNsb3QgPT09ICdlZGRzYU1wYycpIHtcbiAgICBjb25zdCB7IGNvbW1vbktleWNoYWluLCB1c2VyQ2hpbGQsIGJhY2t1cENoaWxkIH0gPSBhd2FpdCBNcHNWcmZVdGlscy5kZXJpdmVTYWZlRWRkc2FNcGNDaGlsZCh7XG4gICAgICB1c2VyUm9vdDogcm9vdHMuZWRkc2FNcGMudXNlcixcbiAgICAgIGJhY2t1cFJvb3Q6IHJvb3RzLmVkZHNhTXBjLmJhY2t1cCxcbiAgICAgIGFjY291bnQsXG4gICAgICBjb2luVHlwZSxcbiAgICAgIHNhZmVTbG90T3JkaW5hbDogc2xvdE9yZGluYWwsXG4gICAgfSk7XG4gICAgcmV0dXJuIHtcbiAgICAgIHNsb3Q6ICdlZGRzYU1wYycsXG4gICAgICBwYXRoLFxuICAgICAga2V5czogeyBjb21tb25LZXljaGFpbiwgdXNlcjogdXNlckNoaWxkLCBiYWNrdXA6IGJhY2t1cENoaWxkIH0sXG4gICAgfTtcbiAgfVxuXG4gIGlmIChwYXJhbXMuc2xvdCA9PT0gJ2VkMjU1MTlNdWx0aXNpZycpIHtcbiAgICBjb25zdCByb290ID0gcm9vdHMuZWQyNTUxOU11bHRpc2lnO1xuICAgIGNvbnN0IGNvc2lnbmVyUGF0aCA9IHRvU29mdFR3aW5QYXRoKHBhdGgpO1xuXG4gICAgY29uc3QgdXNlciA9IGRlcml2ZVNhZmVDaGlsZEVkMjU1MTlIYXJkZW5lZChyb290LnVzZXIsIHBhdGgpO1xuICAgIGNvbnN0IGJhY2t1cCA9IGF3YWl0IHNvZnREZXJpdmVDaGlsZFBydkVkMjU1MTlBdFBhdGgoe1xuICAgICAgc2VlZFN0cktleTogcm9vdC5iYWNrdXAucHJ2LFxuICAgICAgY2hhaW5Db2RlOiByb290LmJhY2t1cC5jaGFpbkNvZGUsXG4gICAgICBwYXRoOiBjb3NpZ25lclBhdGgsXG4gICAgfSk7XG4gICAgY29uc3QgYml0Z28gPSBhd2FpdCBzb2Z0RGVyaXZlQ2hpbGRQdWJFZDI1NTE5QXRQYXRoKHJvb3QuYml0Z28sIGNvc2lnbmVyUGF0aCk7XG5cbiAgICByZXR1cm4ge1xuICAgICAgc2xvdDogJ2VkMjU1MTlNdWx0aXNpZycsXG4gICAgICBwYXRoLFxuICAgICAga2V5czoge1xuICAgICAgICB1c2VyOiB7IGtpbmQ6ICdzZWVkJywgc2VlZDogdXNlci5wcnYsIHB1YjogZGVjb2RlRWQyNTUxOVN0cktleVB1YmxpY0tleSh1c2VyLnB1YikudG9TdHJpbmcoJ2hleCcpIH0sXG4gICAgICAgIGJhY2t1cDoge1xuICAgICAgICAgIGtpbmQ6ICdleHRlbmRlZCcsXG4gICAgICAgICAga0w6IGJhY2t1cC5rTC50b1N0cmluZygnaGV4JyksXG4gICAgICAgICAga1I6IGJhY2t1cC5rUi50b1N0cmluZygnaGV4JyksXG4gICAgICAgICAgcHViOiBiYWNrdXAucHViLnRvU3RyaW5nKCdoZXgnKSxcbiAgICAgICAgfSxcbiAgICAgICAgYml0Z286IHsgcHViOiBiaXRnby50b1N0cmluZygnaGV4JykgfSxcbiAgICAgIH0sXG4gICAgfTtcbiAgfVxuXG4gIHRocm93IG5ldyBFcnJvcihgZGVyaXZlU2FmZVdhbGxldEtleXM6IHNsb3QgJyR7cGFyYW1zLnNsb3R9JyBpcyBub3Qgc3VwcG9ydGVkIHlldGApO1xufVxuXG4vKipcbiAqIEJ1aWxkcyB0aGUga2V5IGZpZWxkcyBgY29pbi5yZWNvdmVyKClgIGV4cGVjdHMgZnJvbSBkZXJpdmVkIFNhZmUgY2hpbGQga2V5cy5cbiAqIE9ubHkgYHNlY3AyNTZrMU11bHRpc2lnYCAoc2xvdCAxKSBpcyBzdXBwb3J0ZWQgZm9yIG5vdy4gU2lnbmVkIG1vZGUgcmUtZW5jcnlwdHMgdGhlXG4gKiBjaGlsZCB4cHJ2cyB1bmRlciBhIGZyZXNoIGVwaGVtZXJhbCBwYXNzcGhyYXNlICh2MS9TSkNMKTsgdW5zaWduZWQgbW9kZSByZXR1cm5zIHB1YnMuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zKHBhcmFtczoge1xuICBiaXRnbzogQml0R29CYXNlO1xuICBjb2luOiBzdHJpbmc7XG4gIHNsb3Q6IFJvb3RLZXlUeXBlO1xuICBrZXlzOiBTZWNwMjU2azFNdWx0aXNpZ0NoaWxkS2V5cztcbiAgbW9kZTogJ3NpZ25lZCcgfCAndW5zaWduZWQnO1xufSk6IFByb21pc2U8U2FmZVJlY292ZXJLZXlQYXJhbXM+IHtcbiAgaWYgKHBhcmFtcy5zbG90ICE9PSAnc2VjcDI1NmsxTXVsdGlzaWcnKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zOiBzbG90ICcke3BhcmFtcy5zbG90fScgaXMgbm90IHN1cHBvcnRlZCB5ZXRgKTtcbiAgfVxuICBjb25zdCB7IGJpdGdvLCBrZXlzLCBtb2RlIH0gPSBwYXJhbXM7XG5cbiAgaWYgKG1vZGUgPT09ICd1bnNpZ25lZCcpIHtcbiAgICByZXR1cm4ge1xuICAgICAgdXNlcktleToga2V5cy51c2VyLnB1YixcbiAgICAgIGJhY2t1cEtleToga2V5cy5iYWNrdXAucHViLFxuICAgICAgYml0Z29LZXk6IGtleXMuYml0Z28ucHViLFxuICAgIH07XG4gIH1cblxuICBjb25zdCB1c2VyUHJ2ID0gYmlwMzIuZnJvbUJhc2U1OChrZXlzLnVzZXIucHJ2KTtcbiAgY29uc3QgYmFja3VwUHJ2ID0gYmlwMzIuZnJvbUJhc2U1OChrZXlzLmJhY2t1cC5wcnYpO1xuICBpZiAoIXVzZXJQcnYucHJpdmF0ZUtleSB8fCAhYmFja3VwUHJ2LnByaXZhdGVLZXkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2J1aWxkU2FmZVJlY292ZXJLZXlQYXJhbXM6IGtleXMudXNlci5wcnYgYW5kIGtleXMuYmFja3VwLnBydiBtdXN0IGJlIHByaXZhdGUgeHBydnMnKTtcbiAgfVxuXG4gIGNvbnN0IHdhbGxldFBhc3NwaHJhc2UgPSByYW5kb21CeXRlcygzMikudG9TdHJpbmcoJ2hleCcpO1xuICBjb25zdCBbdXNlcktleSwgYmFja3VwS2V5XSA9IGF3YWl0IFByb21pc2UuYWxsKFtcbiAgICBiaXRnby5lbmNyeXB0KHsgaW5wdXQ6IGtleXMudXNlci5wcnYsIHBhc3N3b3JkOiB3YWxsZXRQYXNzcGhyYXNlLCBlbmNyeXB0aW9uVmVyc2lvbjogMSB9KSxcbiAgICBiaXRnby5lbmNyeXB0KHsgaW5wdXQ6IGtleXMuYmFja3VwLnBydiwgcGFzc3dvcmQ6IHdhbGxldFBhc3NwaHJhc2UsIGVuY3J5cHRpb25WZXJzaW9uOiAxIH0pLFxuICBdKTtcblxuICByZXR1cm4ge1xuICAgIHVzZXJLZXksXG4gICAgYmFja3VwS2V5LFxuICAgIGJpdGdvS2V5OiBrZXlzLmJpdGdvLnB1YixcbiAgICB3YWxsZXRQYXNzcGhyYXNlLFxuICB9O1xufVxuIl19

package/dist/src/bitgo/safe/rootCoin.d.ts

@@ -0,0 +1,15 @@
+import { RootKeyType } from '@bitgo/public-types';
+import { IBaseCoin } from '../baseCoin';
+import { BitGoBase } from '../bitgoBase';
+/**
+ * Canonical order of the safe root slots. Shared by safe minting (Safes.createSafeKeys) and
+ * passkey register/remove (Safe) so both iterate the slots identically.
+ * @experimental
+ */
+export declare const SAFE_ROOT_SLOTS: RootKeyType[];
+/**
+ * Coin used to route a given root's key operations (see ROOT_COIN_BY_NETWORK).
+ * @experimental
+ */
+export declare function coinForRoot(bitgo: BitGoBase, slot: RootKeyType): IBaseCoin;
+//# sourceMappingURL=rootCoin.d.ts.map

package/dist/src/bitgo/safe/rootCoin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootCoin.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/rootCoin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,EAAqE,CAAC;AA4B/G;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,CAK1E"}

package/dist/src/bitgo/safe/rootCoin.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_ROOT_SLOTS = void 0;
+exports.coinForRoot = coinForRoot;
+const common_1 = require("../../common");
+/**
+ * Canonical order of the safe root slots. Shared by safe minting (Safes.createSafeKeys) and
+ * passkey register/remove (Safe) so both iterate the slots identically.
+ * @experimental
+ */
+exports.SAFE_ROOT_SLOTS = ['secp256k1Multisig', 'ed25519Multisig', 'ecdsaMpc', 'eddsaMpc'];
+/**
+ * Representative coin per root slot, by network. Safe roots are curve/scheme-scoped, not
+ * coin-scoped — WP stamps `curve` server-side from the coin's key curve, so any coin of the
+ * right (curve, scheme) works. These are stable, always-available choices used only to route
+ * the key ceremony; the resulting root is interchangeable across coins of the slot.
+ * @experimental
+ */
+const ROOT_COIN_BY_NETWORK = {
+    mainnet: {
+        // multisig roots
+        secp256k1Multisig: 'btc',
+        ed25519Multisig: 'xlm',
+        // MPC roots
+        ecdsaMpc: 'eth',
+        eddsaMpc: 'sol',
+    },
+    testnet: {
+        // multisig roots
+        secp256k1Multisig: 'tbtc',
+        ed25519Multisig: 'txlm',
+        // MPC roots
+        ecdsaMpc: 'hteth',
+        eddsaMpc: 'tsol',
+    },
+};
+/**
+ * Coin used to route a given root's key operations (see ROOT_COIN_BY_NETWORK).
+ * @experimental
+ */
+function coinForRoot(bitgo, slot) {
+    // V1Network is exactly 'bitcoin' | 'testnet', so this branch is exhaustive over every
+    // environment: 'bitcoin' is mainnet and every other value is a testnet.
+    const network = common_1.Environments[bitgo.getEnv()].network === 'bitcoin' ? 'mainnet' : 'testnet';
+    return bitgo.coin(ROOT_COIN_BY_NETWORK[network][slot]);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9vdENvaW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9yb290Q29pbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUEwQ0Esa0NBS0M7QUE5Q0QseUNBQTRDO0FBSTVDOzs7O0dBSUc7QUFDVSxRQUFBLGVBQWUsR0FBa0IsQ0FBQyxtQkFBbUIsRUFBRSxpQkFBaUIsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFFL0c7Ozs7OztHQU1HO0FBQ0gsTUFBTSxvQkFBb0IsR0FBK0Q7SUFDdkYsT0FBTyxFQUFFO1FBQ1AsaUJBQWlCO1FBQ2pCLGlCQUFpQixFQUFFLEtBQUs7UUFDeEIsZUFBZSxFQUFFLEtBQUs7UUFDdEIsWUFBWTtRQUNaLFFBQVEsRUFBRSxLQUFLO1FBQ2YsUUFBUSxFQUFFLEtBQUs7S0FDaEI7SUFDRCxPQUFPLEVBQUU7UUFDUCxpQkFBaUI7UUFDakIsaUJBQWlCLEVBQUUsTUFBTTtRQUN6QixlQUFlLEVBQUUsTUFBTTtRQUN2QixZQUFZO1FBQ1osUUFBUSxFQUFFLE9BQU87UUFDakIsUUFBUSxFQUFFLE1BQU07S0FDakI7Q0FDRixDQUFDO0FBRUY7OztHQUdHO0FBQ0gsU0FBZ0IsV0FBVyxDQUFDLEtBQWdCLEVBQUUsSUFBaUI7SUFDN0Qsc0ZBQXNGO0lBQ3RGLHdFQUF3RTtJQUN4RSxNQUFNLE9BQU8sR0FBRyxxQkFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzNGLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBSb290S2V5VHlwZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHsgRW52aXJvbm1lbnRzIH0gZnJvbSAnLi4vLi4vY29tbW9uJztcbmltcG9ydCB7IElCYXNlQ29pbiB9IGZyb20gJy4uL2Jhc2VDb2luJztcbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5cbi8qKlxuICogQ2Fub25pY2FsIG9yZGVyIG9mIHRoZSBzYWZlIHJvb3Qgc2xvdHMuIFNoYXJlZCBieSBzYWZlIG1pbnRpbmcgKFNhZmVzLmNyZWF0ZVNhZmVLZXlzKSBhbmRcbiAqIHBhc3NrZXkgcmVnaXN0ZXIvcmVtb3ZlIChTYWZlKSBzbyBib3RoIGl0ZXJhdGUgdGhlIHNsb3RzIGlkZW50aWNhbGx5LlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgY29uc3QgU0FGRV9ST09UX1NMT1RTOiBSb290S2V5VHlwZVtdID0gWydzZWNwMjU2azFNdWx0aXNpZycsICdlZDI1NTE5TXVsdGlzaWcnLCAnZWNkc2FNcGMnLCAnZWRkc2FNcGMnXTtcblxuLyoqXG4gKiBSZXByZXNlbnRhdGl2ZSBjb2luIHBlciByb290IHNsb3QsIGJ5IG5ldHdvcmsuIFNhZmUgcm9vdHMgYXJlIGN1cnZlL3NjaGVtZS1zY29wZWQsIG5vdFxuICogY29pbi1zY29wZWQg4oCUIFdQIHN0YW1wcyBgY3VydmVgIHNlcnZlci1zaWRlIGZyb20gdGhlIGNvaW4ncyBrZXkgY3VydmUsIHNvIGFueSBjb2luIG9mIHRoZVxuICogcmlnaHQgKGN1cnZlLCBzY2hlbWUpIHdvcmtzLiBUaGVzZSBhcmUgc3RhYmxlLCBhbHdheXMtYXZhaWxhYmxlIGNob2ljZXMgdXNlZCBvbmx5IHRvIHJvdXRlXG4gKiB0aGUga2V5IGNlcmVtb255OyB0aGUgcmVzdWx0aW5nIHJvb3QgaXMgaW50ZXJjaGFuZ2VhYmxlIGFjcm9zcyBjb2lucyBvZiB0aGUgc2xvdC5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuY29uc3QgUk9PVF9DT0lOX0JZX05FVFdPUks6IFJlY29yZDwnbWFpbm5ldCcgfCAndGVzdG5ldCcsIFJlY29yZDxSb290S2V5VHlwZSwgc3RyaW5nPj4gPSB7XG4gIG1haW5uZXQ6IHtcbiAgICAvLyBtdWx0aXNpZyByb290c1xuICAgIHNlY3AyNTZrMU11bHRpc2lnOiAnYnRjJyxcbiAgICBlZDI1NTE5TXVsdGlzaWc6ICd4bG0nLFxuICAgIC8vIE1QQyByb290c1xuICAgIGVjZHNhTXBjOiAnZXRoJyxcbiAgICBlZGRzYU1wYzogJ3NvbCcsXG4gIH0sXG4gIHRlc3RuZXQ6IHtcbiAgICAvLyBtdWx0aXNpZyByb290c1xuICAgIHNlY3AyNTZrMU11bHRpc2lnOiAndGJ0YycsXG4gICAgZWQyNTUxOU11bHRpc2lnOiAndHhsbScsXG4gICAgLy8gTVBDIHJvb3RzXG4gICAgZWNkc2FNcGM6ICdodGV0aCcsXG4gICAgZWRkc2FNcGM6ICd0c29sJyxcbiAgfSxcbn07XG5cbi8qKlxuICogQ29pbiB1c2VkIHRvIHJvdXRlIGEgZ2l2ZW4gcm9vdCdzIGtleSBvcGVyYXRpb25zIChzZWUgUk9PVF9DT0lOX0JZX05FVFdPUkspLlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgZnVuY3Rpb24gY29pbkZvclJvb3QoYml0Z286IEJpdEdvQmFzZSwgc2xvdDogUm9vdEtleVR5cGUpOiBJQmFzZUNvaW4ge1xuICAvLyBWMU5ldHdvcmsgaXMgZXhhY3RseSAnYml0Y29pbicgfCAndGVzdG5ldCcsIHNvIHRoaXMgYnJhbmNoIGlzIGV4aGF1c3RpdmUgb3ZlciBldmVyeVxuICAvLyBlbnZpcm9ubWVudDogJ2JpdGNvaW4nIGlzIG1haW5uZXQgYW5kIGV2ZXJ5IG90aGVyIHZhbHVlIGlzIGEgdGVzdG5ldC5cbiAgY29uc3QgbmV0d29yayA9IEVudmlyb25tZW50c1tiaXRnby5nZXRFbnYoKV0ubmV0d29yayA9PT0gJ2JpdGNvaW4nID8gJ21haW5uZXQnIDogJ3Rlc3RuZXQnO1xuICByZXR1cm4gYml0Z28uY29pbihST09UX0NPSU5fQllfTkVUV09SS1tuZXR3b3JrXVtzbG90XSk7XG59XG4iXX0=

package/dist/src/bitgo/safe/safe.d.ts

@@ -0,0 +1,88 @@
+import { FreezeSafeBody, SafeData, SafeShareData, SafeShareState } from '@bitgo/public-types';
+import { BitGoBase } from '../bitgoBase';
+import { Wallet } from '../wallet';
+import { AcceptSafeShareOptions, AddSafeMemberOptions, AddSafeWalletMemberOptions, CreateSafeWalletOptions, ISafe, RegisterSafePasskeyOptions, RegisterSafePasskeyResponse, RemoveSafePasskeyOptions, UpdateSafeOptions, WalletShareData } from './iSafe';
+/**
+ * @experimental
+ */
+export declare class Safe implements ISafe {
+    private readonly bitgo;
+    readonly _safe: SafeData;
+    constructor(bitgo: BitGoBase, safeData: SafeData);
+    id(): string;
+    enterpriseId(): string;
+    label(): string;
+    status(): SafeData['status'];
+    /**
+     * Enterprise-scoped v2 URL for this safe, e.g. /api/v2/enterprise/:eId/safes/:safeId
+     * @param extra
+     */
+    url(extra?: string): string;
+    /**
+     * Mint a child wallet: peek the next account for (slot, coinType), derive the child keys at
+     * `m/44'/<coinType>'/<slot>'/<account>'`, register them, then mint.
+     *
+     * `onchain`: hardened-derive the user child at that path, register it public-only; backup
+     * and BitGo children are soft-derived on the server at its soft twin.
+     *
+     * `tss`: decrypt the user root blob, run the user/BitGo hard-derive ceremony at that path,
+     * register the ordered child documents, then mint.
+     */
+    createWallet(params: CreateSafeWalletOptions): Promise<Wallet>;
+    /**
+     * TSS wallet mint: decrypt the user root blob, run the user/BitGo hard-derive
+     * ceremony, register the ordered child documents, then mint.
+     */
+    private createTssWalletInSafe;
+    private fetchSafeData;
+    /**
+     * Add a member to the whole safe (view/admin/spend). Spend opens a key share.
+     */
+    addMember(params: AddSafeMemberOptions): Promise<SafeData>;
+    /**
+     * Share ONE safe wallet with a non-member via the existing wallet-share handshake.
+     */
+    addMemberToWallet(params: AddSafeWalletMemberOptions): Promise<WalletShareData>;
+    /**
+     * List the safe key shares visible to the caller.
+     */
+    listShares(params?: {
+        state?: SafeShareState;
+    }): Promise<SafeShareData[]>;
+    /**
+     * Accept a safe key share addressed to the caller.
+     */
+    acceptShare(params: AcceptSafeShareOptions): Promise<SafeShareData>;
+    /**
+     * Update the safe label.
+     */
+    update(params: UpdateSafeOptions): Promise<SafeData>;
+    /**
+     * Freeze the safe — blocks withdrawals on all safe wallets. Safe stays 'active'.
+     * @param params
+     */
+    freeze(params?: FreezeSafeBody): Promise<SafeData>;
+    /**
+     * Archive the safe. Requires every safe wallet to already be archived; also the abandonment
+     * path for a stuck 'initializing' safe.
+     */
+    archive(): Promise<SafeData>;
+    /**
+     * Register a PRF passkey on every user root of the safe.
+     *
+     * For each user root (position 0 of each populated slot), decrypt the root with the Safe
+     * password, then re-encrypt it under the PRF-derived password (bound to the enterprise via
+     * AES-GCM AAD). One PRF assertion serves the whole safe; the write set is the user roots only
+     * — backup and BitGo roots are never wrapped.
+     */
+    registerPasskey(params: RegisterSafePasskeyOptions): Promise<RegisterSafePasskeyResponse>;
+    /**
+     * Remove a PRF passkey from every user root of the safe.
+     *
+     * The Safe password is verified client-side (decrypt one user root) before the server is
+     * called; the server enforces owner authorization and performs the idempotent per-root `$pull`.
+     */
+    removePasskey(params: RemoveSafePasskeyOptions): Promise<void>;
+    toJSON(): SafeData;
+}
+//# sourceMappingURL=safe.d.ts.map

package/dist/src/bitgo/safe/safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/safe.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AAEhH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGnC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EAChB,MAAM,SAAS,CAAC;AAoEjB;;GAEG;AACH,qBAAa,IAAK,YAAW,KAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,SAAgB,KAAK,EAAE,QAAQ,CAAC;gBAEpB,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;IAKhD,EAAE,IAAI,MAAM;IAIZ,YAAY,IAAI,MAAM;IAItB,KAAK,IAAI,MAAM;IAIf,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAI5B;;;OAGG;IACH,GAAG,CAAC,KAAK,SAAK,GAAG,MAAM;IAIvB;;;;;;;;;OASG;IACG,YAAY,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqFpE;;;OAGG;YACW,qBAAqB;YAuDrB,aAAa;IAK3B;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,eAAe,CAAC;IAIrF;;OAEG;IACG,UAAU,CAAC,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,cAAc,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAInF;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAIzE;;OAEG;IACG,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK1D;;;OAGG;IACG,MAAM,CAAC,MAAM,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK5D;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAKlC;;;;;;;OAOG;IACG,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqE/F;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BpE,MAAM,IAAI,QAAQ;CAGnB"}