@bitgo-beta/sdk-core 8.2.1-beta.212 → 8.2.1-beta.2121

package/dist/src/bitgo/wallet/safeKeychain.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @prettier
+ */
+import { BitGoBase } from '../bitgoBase';
+import { IKeychains, Keychain, KeychainWithEncryptedPrv } from '../keychain';
+import type { DecryptedKeychainData } from './iWallet';
+export declare class InvalidRootKeychainSourceError extends Error {
+    constructor(id: string, source: string | undefined);
+}
+/** Thrown when hardened derivation does not match the registered child public key. */
+export declare class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId: string, expectedPub: string, derivedPub: string);
+}
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+export declare class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId: string, detail: string);
+}
+/** Thrown when wallet sharing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+export declare class SafeShareNotImplementedError extends Error {
+    constructor(walletId: string, detail: string);
+}
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+export declare function isSafeChildPublicOnlyKeychain(walletSafeId: string | undefined, keychain: Keychain | undefined): keychain is Keychain & {
+    parent: string;
+};
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+export declare function fetchRootKeychainForSafeChild(keychains: IKeychains, childKeychain: Keychain): Promise<KeychainWithEncryptedPrv>;
+/**
+ * Shared params for resolving safe-owner key material (owner signing and wallet sharing).
+ * Both resolvers extend this so the precondition/derivation path cannot diverge.
+ */
+export interface SafeKeyMaterialBaseParams {
+    bitgo: BitGoBase;
+    keychains: IKeychains;
+    walletId: string;
+    /** Onchain secp256k1: hardened-derive and verify pub. Other slots throw. */
+    multisigType: string | undefined;
+    coinFamily: string;
+    childKeychain: Keychain;
+    walletPassphrase: string;
+    /** When already fetched (passphrase preflight), skip a second GET. */
+    rootKeychain?: KeychainWithEncryptedPrv;
+}
+export type ResolveSafeOwnerSigningPrvParams = SafeKeyMaterialBaseParams;
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/44'/<coinType>'/<slot>'/<account>'`), and verify the registered pub.
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+export declare function resolveSafeOwnerSigningPrv(params: ResolveSafeOwnerSigningPrvParams): Promise<string>;
+export interface ResolveSafeChildPrvForSharingParams extends SafeKeyMaterialBaseParams {
+    mpcAlgorithm?: 'ecdsa' | 'eddsa';
+}
+/**
+ * Resolve sharing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), verify the registered pub, and return the CHILD `{prv, pub}` — never the root.
+ * TSS and ed25519 onchain: throw `SafeShareNotImplementedError` naming the slot + blocker.
+ *
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+export declare function resolveSafeChildPrvForSharing(params: ResolveSafeChildPrvForSharingParams): Promise<DecryptedKeychainData>;
+//# sourceMappingURL=safeKeychain.d.ts.map

package/dist/src/bitgo/wallet/safeKeychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeKeychain.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/wallet/safeKeychain.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAA6B,UAAU,EAAE,QAAQ,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAIxG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEvD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAOnD;AAED,sFAAsF;AACtF,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAOtE;AAED,kGAAkG;AAClG,qBAAa,mCAAoC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAED,mGAAmG;AACnG,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI7C;AAKD;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAC7B,QAAQ,IAAI,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAE3C;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,UAAU,EACrB,aAAa,EAAE,QAAQ,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAYnC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,QAAQ,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,MAAM,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;AAoEzE;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,gCAAgC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB1G;AAED,MAAM,WAAW,mCAAoC,SAAQ,yBAAyB;IACpF,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAClC;AAYD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAMhC"}

package/dist/src/bitgo/wallet/safeKeychain.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeShareNotImplementedError = exports.SafeOwnerSigningNotImplementedError = exports.SafeDerivedPublicKeyMismatchError = exports.InvalidRootKeychainSourceError = void 0;
+exports.isSafeChildPublicOnlyKeychain = isSafeChildPublicOnlyKeychain;
+exports.fetchRootKeychainForSafeChild = fetchRootKeychainForSafeChild;
+exports.resolveSafeOwnerSigningPrv = resolveSafeOwnerSigningPrv;
+exports.resolveSafeChildPrvForSharing = resolveSafeChildPrvForSharing;
+const keychain_1 = require("../keychain");
+const sdk_lib_safes_1 = require("@bitgo-beta/sdk-lib-safes");
+const codecs_1 = require("../utils/codecs");
+const errors_1 = require("../errors");
+class InvalidRootKeychainSourceError extends Error {
+    constructor(id, source) {
+        super(`Root keychain ${id} has source '${source ?? 'unknown'}'; expected 'user'. ` +
+            `Using a backup or BitGo root would fail at signing.`);
+        this.name = 'InvalidRootKeychainSourceError';
+    }
+}
+exports.InvalidRootKeychainSourceError = InvalidRootKeychainSourceError;
+/** Thrown when hardened derivation does not match the registered child public key. */
+class SafeDerivedPublicKeyMismatchError extends Error {
+    constructor(walletId, expectedPub, derivedPub) {
+        super(`Safe wallet ${walletId}: derived child public key does not match the registered user key. ` +
+            `Expected ${expectedPub}, got ${derivedPub}.`);
+        this.name = 'SafeDerivedPublicKeyMismatchError';
+    }
+}
+exports.SafeDerivedPublicKeyMismatchError = SafeDerivedPublicKeyMismatchError;
+/** Thrown when owner signing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+class SafeOwnerSigningNotImplementedError extends Error {
+    constructor(walletId, detail) {
+        super(`Safe wallet ${walletId}: ${detail}`);
+        this.name = 'SafeOwnerSigningNotImplementedError';
+    }
+}
+exports.SafeOwnerSigningNotImplementedError = SafeOwnerSigningNotImplementedError;
+/** Thrown when wallet sharing is not implemented for this safe slot (TSS, ed25519 multisig, …). */
+class SafeShareNotImplementedError extends Error {
+    constructor(walletId, detail) {
+        super(`Safe wallet ${walletId}: ${detail}`);
+        this.name = 'SafeShareNotImplementedError';
+    }
+}
+exports.SafeShareNotImplementedError = SafeShareNotImplementedError;
+/** ed25519 onchain multisig (slot ④). Needs SLIP-0010, not secp256k1 BIP32. */
+const ED25519_ONCHAIN_FAMILIES = new Set(['algo', 'xlm', 'hbar']);
+/**
+ * True when this is the safe minter's user key: wallet is in a safe, the key
+ * has a parent root, and there is no child-level encryptedPrv (sharees have one).
+ */
+function isSafeChildPublicOnlyKeychain(walletSafeId, keychain) {
+    return !!(walletSafeId && keychain?.parent && !keychain.encryptedPrv);
+}
+/**
+ * Fetch the root user keychain for a safe child key.
+ * Requires `source === 'user'` so a misconfigured parent fails early.
+ */
+async function fetchRootKeychainForSafeChild(keychains, childKeychain) {
+    if (!childKeychain.parent) {
+        throw new Error('childKeychain.parent is required to fetch the root keychain');
+    }
+    const root = await keychains.get({ id: childKeychain.parent });
+    if (root.source !== 'user') {
+        throw new InvalidRootKeychainSourceError(root.id, root.source);
+    }
+    if (!root.encryptedPrv) {
+        throw new Error(`root keychain ${root.id} does not have property encryptedPrv`);
+    }
+    return root;
+}
+/**
+ * Shared core that resolves safe key material for a pub-only safe child. Returns the CHILD
+ * `{prv, pub}` only — never the root — so the root can never leak into a share document.
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), and verify the registered pub. TSS and ed25519 onchain throw via
+ * `makeNotImplementedError` — the caller constructs its own error class + message, so the
+ * guard set stays shared while signing/sharing report their own errors.
+ */
+async function resolveSafeKeyMaterial(params) {
+    const { bitgo, keychains, walletId, multisigType, coinFamily, childKeychain, walletPassphrase, makeNotImplementedError, } = params;
+    if (multisigType !== 'onchain') {
+        throw makeNotImplementedError('tss', walletId);
+    }
+    if (ED25519_ONCHAIN_FAMILIES.has(coinFamily)) {
+        throw makeNotImplementedError('ed25519', walletId);
+    }
+    const rootKeychain = params.rootKeychain ?? (await fetchRootKeychainForSafeChild(keychains, childKeychain));
+    const rootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(bitgo, rootKeychain, walletPassphrase);
+    if (!rootPrv) {
+        throw new errors_1.IncorrectPasswordError();
+    }
+    if (!childKeychain.pub) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing pub for pre-sign verification`);
+    }
+    if (childKeychain.derivedFromParentWithPath === undefined) {
+        throw new Error(`Safe wallet ${walletId}: child keychain is missing derivedFromParentWithPath`);
+    }
+    const derived = (0, sdk_lib_safes_1.deriveSafeChildHardenedFromXprv)(rootPrv, (0, codecs_1.decodeWithCodec)(sdk_lib_safes_1.DerivedFromParentWithHardenedPath, childKeychain.derivedFromParentWithPath, 'derivedFromParentWithPath'));
+    if (derived.pub !== childKeychain.pub) {
+        throw new SafeDerivedPublicKeyMismatchError(walletId, childKeychain.pub, derived.pub);
+    }
+    if (derived.pub === rootKeychain.pub) {
+        throw new Error(`Safe wallet ${walletId}: derived child pub unexpectedly equals the root pub`);
+    }
+    return { prv: derived.prv, pub: derived.pub };
+}
+/**
+ * Resolve signing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/44'/<coinType>'/<slot>'/<account>'`), and verify the registered pub.
+ * TSS and ed25519 onchain: throw — do not return root material or BIP32-derive the wrong curve.
+ *
+ * Do not use for wallet sharing — that must not receive root key material.
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+async function resolveSafeOwnerSigningPrv(params) {
+    const { prv } = await resolveSafeKeyMaterial({
+        ...params,
+        makeNotImplementedError: (slot, walletId) => slot === 'ed25519'
+            ? new SafeOwnerSigningNotImplementedError(walletId, `ed25519 multisig owner derivation (${params.coinFamily}) is not implemented; BIP32 would produce the wrong child key.`)
+            : new SafeOwnerSigningNotImplementedError(walletId, 'TSS owner signing from the root keyshare is not implemented. ' +
+                'Returning the root private key would expose material that can derive every child in this slot.'),
+    });
+    return prv;
+}
+/** Slot-named not-implemented detail for wallet sharing. */
+function safeShareSlotDetail(slot, params) {
+    if (slot === 'ed25519') {
+        return `ed25519 multisig safe sharing (${params.coinFamily}) is not implemented; BIP32 would derive the wrong child.`;
+    }
+    return params.mpcAlgorithm === 'eddsa'
+        ? 'eddsaMpc safe sharing is not implemented (needs the EdDSA derive ceremony).'
+        : 'ecdsaMpc safe sharing is not implemented (needs the DKLS derive ceremony).';
+}
+/**
+ * Resolve sharing material for a safe owner (child key has no encryptedPrv).
+ *
+ * Onchain secp256k1: decrypt root, hardened-derive at `derivedFromParentWithPath`
+ * (`m/<n>'`), verify the registered pub, and return the CHILD `{prv, pub}` — never the root.
+ * TSS and ed25519 onchain: throw `SafeShareNotImplementedError` naming the slot + blocker.
+ *
+ * Call only when `isSafeChildPublicOnlyKeychain` is true.
+ */
+async function resolveSafeChildPrvForSharing(params) {
+    return resolveSafeKeyMaterial({
+        ...params,
+        makeNotImplementedError: (slot, walletId) => new SafeShareNotImplementedError(walletId, safeShareSlotDetail(slot, params)),
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2FmZUtleWNoYWluLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3dhbGxldC9zYWZlS2V5Y2hhaW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBc0RBLHNFQUtDO0FBTUQsc0VBZUM7QUFpR0QsZ0VBZ0JDO0FBeUJELHNFQVFDO0FBOU5ELDBDQUF3RztBQUN4Ryw2REFBK0c7QUFDL0csNENBQWtEO0FBQ2xELHNDQUFtRDtBQUduRCxNQUFhLDhCQUErQixTQUFRLEtBQUs7SUFDdkQsWUFBWSxFQUFVLEVBQUUsTUFBMEI7UUFDaEQsS0FBSyxDQUNILGlCQUFpQixFQUFFLGdCQUFnQixNQUFNLElBQUksU0FBUyxzQkFBc0I7WUFDMUUscURBQXFELENBQ3hELENBQUM7UUFDRixJQUFJLENBQUMsSUFBSSxHQUFHLGdDQUFnQyxDQUFDO0lBQy9DLENBQUM7Q0FDRjtBQVJELHdFQVFDO0FBRUQsc0ZBQXNGO0FBQ3RGLE1BQWEsaUNBQWtDLFNBQVEsS0FBSztJQUMxRCxZQUFZLFFBQWdCLEVBQUUsV0FBbUIsRUFBRSxVQUFrQjtRQUNuRSxLQUFLLENBQ0gsZUFBZSxRQUFRLHFFQUFxRTtZQUMxRixZQUFZLFdBQVcsU0FBUyxVQUFVLEdBQUcsQ0FDaEQsQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLEdBQUcsbUNBQW1DLENBQUM7SUFDbEQsQ0FBQztDQUNGO0FBUkQsOEVBUUM7QUFFRCxrR0FBa0c7QUFDbEcsTUFBYSxtQ0FBb0MsU0FBUSxLQUFLO0lBQzVELFlBQVksUUFBZ0IsRUFBRSxNQUFjO1FBQzFDLEtBQUssQ0FBQyxlQUFlLFFBQVEsS0FBSyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLElBQUksQ0FBQyxJQUFJLEdBQUcscUNBQXFDLENBQUM7SUFDcEQsQ0FBQztDQUNGO0FBTEQsa0ZBS0M7QUFFRCxtR0FBbUc7QUFDbkcsTUFBYSw0QkFBNkIsU0FBUSxLQUFLO0lBQ3JELFlBQVksUUFBZ0IsRUFBRSxNQUFjO1FBQzFDLEtBQUssQ0FBQyxlQUFlLFFBQVEsS0FBSyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLElBQUksQ0FBQyxJQUFJLEdBQUcsOEJBQThCLENBQUM7SUFDN0MsQ0FBQztDQUNGO0FBTEQsb0VBS0M7QUFFRCwrRUFBK0U7QUFDL0UsTUFBTSx3QkFBd0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUVsRTs7O0dBR0c7QUFDSCxTQUFnQiw2QkFBNkIsQ0FDM0MsWUFBZ0MsRUFDaEMsUUFBOEI7SUFFOUIsT0FBTyxDQUFDLENBQUMsQ0FBQyxZQUFZLElBQUksUUFBUSxFQUFFLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztBQUN4RSxDQUFDO0FBRUQ7OztHQUdHO0FBQ0ksS0FBSyxVQUFVLDZCQUE2QixDQUNqRCxTQUFxQixFQUNyQixhQUF1QjtJQUV2QixJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUNqRixDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxFQUFFLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQy9ELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksOEJBQThCLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQkFBaUIsSUFBSSxDQUFDLEVBQUUsc0NBQXNDLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsT0FBTyxJQUFnQyxDQUFDO0FBQzFDLENBQUM7QUE0QkQ7Ozs7Ozs7O0dBUUc7QUFDSCxLQUFLLFVBQVUsc0JBQXNCLENBQUMsTUFBb0M7SUFDeEUsTUFBTSxFQUNKLEtBQUssRUFDTCxTQUFTLEVBQ1QsUUFBUSxFQUNSLFlBQVksRUFDWixVQUFVLEVBQ1YsYUFBYSxFQUNiLGdCQUFnQixFQUNoQix1QkFBdUIsR0FDeEIsR0FBRyxNQUFNLENBQUM7SUFFWCxJQUFJLFlBQVksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMvQixNQUFNLHVCQUF1QixDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLHVCQUF1QixDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLFlBQVksSUFBSSxDQUFDLE1BQU0sNkJBQTZCLENBQUMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDNUcsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFBLG9DQUF5QixFQUFDLEtBQUssRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztJQUN2RixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksK0JBQXNCLEVBQUUsQ0FBQztJQUNyQyxDQUFDO0lBRUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGVBQWUsUUFBUSwyREFBMkQsQ0FBQyxDQUFDO0lBQ3RHLENBQUM7SUFDRCxJQUFJLGFBQWEsQ0FBQyx5QkFBeUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksS0FBSyxDQUFDLGVBQWUsUUFBUSx1REFBdUQsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxJQUFBLCtDQUErQixFQUM3QyxPQUFPLEVBQ1AsSUFBQSx3QkFBZSxFQUNiLGlEQUFpQyxFQUNqQyxhQUFhLENBQUMseUJBQXlCLEVBQ3ZDLDJCQUEyQixDQUM1QixDQUNGLENBQUM7SUFDRixJQUFJLE9BQU8sQ0FBQyxHQUFHLEtBQUssYUFBYSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sSUFBSSxpQ0FBaUMsQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUVELElBQUksT0FBTyxDQUFDLEdBQUcsS0FBSyxZQUFZLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxlQUFlLFFBQVEsc0RBQXNELENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsT0FBTyxFQUFFLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDaEQsQ0FBQztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNJLEtBQUssVUFBVSwwQkFBMEIsQ0FBQyxNQUF3QztJQUN2RixNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxzQkFBc0IsQ0FBQztRQUMzQyxHQUFHLE1BQU07UUFDVCx1QkFBdUIsRUFBRSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUMxQyxJQUFJLEtBQUssU0FBUztZQUNoQixDQUFDLENBQUMsSUFBSSxtQ0FBbUMsQ0FDckMsUUFBUSxFQUNSLHNDQUFzQyxNQUFNLENBQUMsVUFBVSxnRUFBZ0UsQ0FDeEg7WUFDSCxDQUFDLENBQUMsSUFBSSxtQ0FBbUMsQ0FDckMsUUFBUSxFQUNSLCtEQUErRDtnQkFDN0QsZ0dBQWdHLENBQ25HO0tBQ1IsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDO0FBTUQsNERBQTREO0FBQzVELFNBQVMsbUJBQW1CLENBQUMsSUFBeUIsRUFBRSxNQUEyQztJQUNqRyxJQUFJLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN2QixPQUFPLGtDQUFrQyxNQUFNLENBQUMsVUFBVSwyREFBMkQsQ0FBQztJQUN4SCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsWUFBWSxLQUFLLE9BQU87UUFDcEMsQ0FBQyxDQUFDLDZFQUE2RTtRQUMvRSxDQUFDLENBQUMsNEVBQTRFLENBQUM7QUFDbkYsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0ksS0FBSyxVQUFVLDZCQUE2QixDQUNqRCxNQUEyQztJQUUzQyxPQUFPLHNCQUFzQixDQUFDO1FBQzVCLEdBQUcsTUFBTTtRQUNULHVCQUF1QixFQUFFLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQzFDLElBQUksNEJBQTRCLENBQUMsUUFBUSxFQUFFLG1CQUFtQixDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztLQUNoRixDQUFDLENBQUM7QUFDTCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqL1xuaW1wb3J0IHsgQml0R29CYXNlIH0gZnJvbSAnLi4vYml0Z29CYXNlJztcbmltcG9ydCB7IGRlY3J5cHRLZXljaGFpblByaXZhdGVLZXksIElLZXljaGFpbnMsIEtleWNoYWluLCBLZXljaGFpbldpdGhFbmNyeXB0ZWRQcnYgfSBmcm9tICcuLi9rZXljaGFpbic7XG5pbXBvcnQgeyBkZXJpdmVTYWZlQ2hpbGRIYXJkZW5lZEZyb21YcHJ2LCBEZXJpdmVkRnJvbVBhcmVudFdpdGhIYXJkZW5lZFBhdGggfSBmcm9tICdAYml0Z28tYmV0YS9zZGstbGliLXNhZmVzJztcbmltcG9ydCB7IGRlY29kZVdpdGhDb2RlYyB9IGZyb20gJy4uL3V0aWxzL2NvZGVjcyc7XG5pbXBvcnQgeyBJbmNvcnJlY3RQYXNzd29yZEVycm9yIH0gZnJvbSAnLi4vZXJyb3JzJztcbmltcG9ydCB0eXBlIHsgRGVjcnlwdGVkS2V5Y2hhaW5EYXRhIH0gZnJvbSAnLi9pV2FsbGV0JztcblxuZXhwb3J0IGNsYXNzIEludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgY29uc3RydWN0b3IoaWQ6IHN0cmluZywgc291cmNlOiBzdHJpbmcgfCB1bmRlZmluZWQpIHtcbiAgICBzdXBlcihcbiAgICAgIGBSb290IGtleWNoYWluICR7aWR9IGhhcyBzb3VyY2UgJyR7c291cmNlID8/ICd1bmtub3duJ30nOyBleHBlY3RlZCAndXNlcicuIGAgK1xuICAgICAgICBgVXNpbmcgYSBiYWNrdXAgb3IgQml0R28gcm9vdCB3b3VsZCBmYWlsIGF0IHNpZ25pbmcuYFxuICAgICk7XG4gICAgdGhpcy5uYW1lID0gJ0ludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvcic7XG4gIH1cbn1cblxuLyoqIFRocm93biB3aGVuIGhhcmRlbmVkIGRlcml2YXRpb24gZG9lcyBub3QgbWF0Y2ggdGhlIHJlZ2lzdGVyZWQgY2hpbGQgcHVibGljIGtleS4gKi9cbmV4cG9ydCBjbGFzcyBTYWZlRGVyaXZlZFB1YmxpY0tleU1pc21hdGNoRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIGNvbnN0cnVjdG9yKHdhbGxldElkOiBzdHJpbmcsIGV4cGVjdGVkUHViOiBzdHJpbmcsIGRlcml2ZWRQdWI6IHN0cmluZykge1xuICAgIHN1cGVyKFxuICAgICAgYFNhZmUgd2FsbGV0ICR7d2FsbGV0SWR9OiBkZXJpdmVkIGNoaWxkIHB1YmxpYyBrZXkgZG9lcyBub3QgbWF0Y2ggdGhlIHJlZ2lzdGVyZWQgdXNlciBrZXkuIGAgK1xuICAgICAgICBgRXhwZWN0ZWQgJHtleHBlY3RlZFB1Yn0sIGdvdCAke2Rlcml2ZWRQdWJ9LmBcbiAgICApO1xuICAgIHRoaXMubmFtZSA9ICdTYWZlRGVyaXZlZFB1YmxpY0tleU1pc21hdGNoRXJyb3InO1xuICB9XG59XG5cbi8qKiBUaHJvd24gd2hlbiBvd25lciBzaWduaW5nIGlzIG5vdCBpbXBsZW1lbnRlZCBmb3IgdGhpcyBzYWZlIHNsb3QgKFRTUywgZWQyNTUxOSBtdWx0aXNpZywg4oCmKS4gKi9cbmV4cG9ydCBjbGFzcyBTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgY29uc3RydWN0b3Iod2FsbGV0SWQ6IHN0cmluZywgZGV0YWlsOiBzdHJpbmcpIHtcbiAgICBzdXBlcihgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06ICR7ZGV0YWlsfWApO1xuICAgIHRoaXMubmFtZSA9ICdTYWZlT3duZXJTaWduaW5nTm90SW1wbGVtZW50ZWRFcnJvcic7XG4gIH1cbn1cblxuLyoqIFRocm93biB3aGVuIHdhbGxldCBzaGFyaW5nIGlzIG5vdCBpbXBsZW1lbnRlZCBmb3IgdGhpcyBzYWZlIHNsb3QgKFRTUywgZWQyNTUxOSBtdWx0aXNpZywg4oCmKS4gKi9cbmV4cG9ydCBjbGFzcyBTYWZlU2hhcmVOb3RJbXBsZW1lbnRlZEVycm9yIGV4dGVuZHMgRXJyb3Ige1xuICBjb25zdHJ1Y3Rvcih3YWxsZXRJZDogc3RyaW5nLCBkZXRhaWw6IHN0cmluZykge1xuICAgIHN1cGVyKGBTYWZlIHdhbGxldCAke3dhbGxldElkfTogJHtkZXRhaWx9YCk7XG4gICAgdGhpcy5uYW1lID0gJ1NhZmVTaGFyZU5vdEltcGxlbWVudGVkRXJyb3InO1xuICB9XG59XG5cbi8qKiBlZDI1NTE5IG9uY2hhaW4gbXVsdGlzaWcgKHNsb3Qg4pGjKS4gTmVlZHMgU0xJUC0wMDEwLCBub3Qgc2VjcDI1NmsxIEJJUDMyLiAqL1xuY29uc3QgRUQyNTUxOV9PTkNIQUlOX0ZBTUlMSUVTID0gbmV3IFNldChbJ2FsZ28nLCAneGxtJywgJ2hiYXInXSk7XG5cbi8qKlxuICogVHJ1ZSB3aGVuIHRoaXMgaXMgdGhlIHNhZmUgbWludGVyJ3MgdXNlciBrZXk6IHdhbGxldCBpcyBpbiBhIHNhZmUsIHRoZSBrZXlcbiAqIGhhcyBhIHBhcmVudCByb290LCBhbmQgdGhlcmUgaXMgbm8gY2hpbGQtbGV2ZWwgZW5jcnlwdGVkUHJ2IChzaGFyZWVzIGhhdmUgb25lKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzU2FmZUNoaWxkUHVibGljT25seUtleWNoYWluKFxuICB3YWxsZXRTYWZlSWQ6IHN0cmluZyB8IHVuZGVmaW5lZCxcbiAga2V5Y2hhaW46IEtleWNoYWluIHwgdW5kZWZpbmVkXG4pOiBrZXljaGFpbiBpcyBLZXljaGFpbiAmIHsgcGFyZW50OiBzdHJpbmcgfSB7XG4gIHJldHVybiAhISh3YWxsZXRTYWZlSWQgJiYga2V5Y2hhaW4/LnBhcmVudCAmJiAha2V5Y2hhaW4uZW5jcnlwdGVkUHJ2KTtcbn1cblxuLyoqXG4gKiBGZXRjaCB0aGUgcm9vdCB1c2VyIGtleWNoYWluIGZvciBhIHNhZmUgY2hpbGQga2V5LlxuICogUmVxdWlyZXMgYHNvdXJjZSA9PT0gJ3VzZXInYCBzbyBhIG1pc2NvbmZpZ3VyZWQgcGFyZW50IGZhaWxzIGVhcmx5LlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZmV0Y2hSb290S2V5Y2hhaW5Gb3JTYWZlQ2hpbGQoXG4gIGtleWNoYWluczogSUtleWNoYWlucyxcbiAgY2hpbGRLZXljaGFpbjogS2V5Y2hhaW5cbik6IFByb21pc2U8S2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2PiB7XG4gIGlmICghY2hpbGRLZXljaGFpbi5wYXJlbnQpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2NoaWxkS2V5Y2hhaW4ucGFyZW50IGlzIHJlcXVpcmVkIHRvIGZldGNoIHRoZSByb290IGtleWNoYWluJyk7XG4gIH1cbiAgY29uc3Qgcm9vdCA9IGF3YWl0IGtleWNoYWlucy5nZXQoeyBpZDogY2hpbGRLZXljaGFpbi5wYXJlbnQgfSk7XG4gIGlmIChyb290LnNvdXJjZSAhPT0gJ3VzZXInKSB7XG4gICAgdGhyb3cgbmV3IEludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvcihyb290LmlkLCByb290LnNvdXJjZSk7XG4gIH1cbiAgaWYgKCFyb290LmVuY3J5cHRlZFBydikge1xuICAgIHRocm93IG5ldyBFcnJvcihgcm9vdCBrZXljaGFpbiAke3Jvb3QuaWR9IGRvZXMgbm90IGhhdmUgcHJvcGVydHkgZW5jcnlwdGVkUHJ2YCk7XG4gIH1cbiAgcmV0dXJuIHJvb3QgYXMgS2V5Y2hhaW5XaXRoRW5jcnlwdGVkUHJ2O1xufVxuXG4vKipcbiAqIFNoYXJlZCBwYXJhbXMgZm9yIHJlc29sdmluZyBzYWZlLW93bmVyIGtleSBtYXRlcmlhbCAob3duZXIgc2lnbmluZyBhbmQgd2FsbGV0IHNoYXJpbmcpLlxuICogQm90aCByZXNvbHZlcnMgZXh0ZW5kIHRoaXMgc28gdGhlIHByZWNvbmRpdGlvbi9kZXJpdmF0aW9uIHBhdGggY2Fubm90IGRpdmVyZ2UuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2FmZUtleU1hdGVyaWFsQmFzZVBhcmFtcyB7XG4gIGJpdGdvOiBCaXRHb0Jhc2U7XG4gIGtleWNoYWluczogSUtleWNoYWlucztcbiAgd2FsbGV0SWQ6IHN0cmluZztcbiAgLyoqIE9uY2hhaW4gc2VjcDI1NmsxOiBoYXJkZW5lZC1kZXJpdmUgYW5kIHZlcmlmeSBwdWIuIE90aGVyIHNsb3RzIHRocm93LiAqL1xuICBtdWx0aXNpZ1R5cGU6IHN0cmluZyB8IHVuZGVmaW5lZDtcbiAgY29pbkZhbWlseTogc3RyaW5nO1xuICBjaGlsZEtleWNoYWluOiBLZXljaGFpbjtcbiAgd2FsbGV0UGFzc3BocmFzZTogc3RyaW5nO1xuICAvKiogV2hlbiBhbHJlYWR5IGZldGNoZWQgKHBhc3NwaHJhc2UgcHJlZmxpZ2h0KSwgc2tpcCBhIHNlY29uZCBHRVQuICovXG4gIHJvb3RLZXljaGFpbj86IEtleWNoYWluV2l0aEVuY3J5cHRlZFBydjtcbn1cblxuZXhwb3J0IHR5cGUgUmVzb2x2ZVNhZmVPd25lclNpZ25pbmdQcnZQYXJhbXMgPSBTYWZlS2V5TWF0ZXJpYWxCYXNlUGFyYW1zO1xuXG50eXBlIFNhZmVLZXlNYXRlcmlhbFNsb3QgPSAndHNzJyB8ICdlZDI1NTE5JztcblxudHlwZSBSZXNvbHZlU2FmZUtleU1hdGVyaWFsUGFyYW1zID0gU2FmZUtleU1hdGVyaWFsQmFzZVBhcmFtcyAmIHtcbiAgLyoqIENvbnN0cnVjdHMgdGhlIG5vdC1pbXBsZW1lbnRlZCBlcnJvciBmb3IgdGhlIGN1cnJlbnQgcmVzb2x2ZXIgKHNpZ25pbmcgdnMgc2hhcmluZykuICovXG4gIG1ha2VOb3RJbXBsZW1lbnRlZEVycm9yOiAoc2xvdDogU2FmZUtleU1hdGVyaWFsU2xvdCwgd2FsbGV0SWQ6IHN0cmluZykgPT4gRXJyb3I7XG59O1xuXG4vKipcbiAqIFNoYXJlZCBjb3JlIHRoYXQgcmVzb2x2ZXMgc2FmZSBrZXkgbWF0ZXJpYWwgZm9yIGEgcHViLW9ubHkgc2FmZSBjaGlsZC4gUmV0dXJucyB0aGUgQ0hJTERcbiAqIGB7cHJ2LCBwdWJ9YCBvbmx5IOKAlCBuZXZlciB0aGUgcm9vdCDigJQgc28gdGhlIHJvb3QgY2FuIG5ldmVyIGxlYWsgaW50byBhIHNoYXJlIGRvY3VtZW50LlxuICpcbiAqIE9uY2hhaW4gc2VjcDI1NmsxOiBkZWNyeXB0IHJvb3QsIGhhcmRlbmVkLWRlcml2ZSBhdCBgZGVyaXZlZEZyb21QYXJlbnRXaXRoUGF0aGBcbiAqIChgbS88bj4nYCksIGFuZCB2ZXJpZnkgdGhlIHJlZ2lzdGVyZWQgcHViLiBUU1MgYW5kIGVkMjU1MTkgb25jaGFpbiB0aHJvdyB2aWFcbiAqIGBtYWtlTm90SW1wbGVtZW50ZWRFcnJvcmAg4oCUIHRoZSBjYWxsZXIgY29uc3RydWN0cyBpdHMgb3duIGVycm9yIGNsYXNzICsgbWVzc2FnZSwgc28gdGhlXG4gKiBndWFyZCBzZXQgc3RheXMgc2hhcmVkIHdoaWxlIHNpZ25pbmcvc2hhcmluZyByZXBvcnQgdGhlaXIgb3duIGVycm9ycy5cbiAqL1xuYXN5bmMgZnVuY3Rpb24gcmVzb2x2ZVNhZmVLZXlNYXRlcmlhbChwYXJhbXM6IFJlc29sdmVTYWZlS2V5TWF0ZXJpYWxQYXJhbXMpOiBQcm9taXNlPHsgcHJ2OiBzdHJpbmc7IHB1Yjogc3RyaW5nIH0+IHtcbiAgY29uc3Qge1xuICAgIGJpdGdvLFxuICAgIGtleWNoYWlucyxcbiAgICB3YWxsZXRJZCxcbiAgICBtdWx0aXNpZ1R5cGUsXG4gICAgY29pbkZhbWlseSxcbiAgICBjaGlsZEtleWNoYWluLFxuICAgIHdhbGxldFBhc3NwaHJhc2UsXG4gICAgbWFrZU5vdEltcGxlbWVudGVkRXJyb3IsXG4gIH0gPSBwYXJhbXM7XG5cbiAgaWYgKG11bHRpc2lnVHlwZSAhPT0gJ29uY2hhaW4nKSB7XG4gICAgdGhyb3cgbWFrZU5vdEltcGxlbWVudGVkRXJyb3IoJ3RzcycsIHdhbGxldElkKTtcbiAgfVxuICBpZiAoRUQyNTUxOV9PTkNIQUlOX0ZBTUlMSUVTLmhhcyhjb2luRmFtaWx5KSkge1xuICAgIHRocm93IG1ha2VOb3RJbXBsZW1lbnRlZEVycm9yKCdlZDI1NTE5Jywgd2FsbGV0SWQpO1xuICB9XG5cbiAgY29uc3Qgcm9vdEtleWNoYWluID0gcGFyYW1zLnJvb3RLZXljaGFpbiA/PyAoYXdhaXQgZmV0Y2hSb290S2V5Y2hhaW5Gb3JTYWZlQ2hpbGQoa2V5Y2hhaW5zLCBjaGlsZEtleWNoYWluKSk7XG4gIGNvbnN0IHJvb3RQcnYgPSBhd2FpdCBkZWNyeXB0S2V5Y2hhaW5Qcml2YXRlS2V5KGJpdGdvLCByb290S2V5Y2hhaW4sIHdhbGxldFBhc3NwaHJhc2UpO1xuICBpZiAoIXJvb3RQcnYpIHtcbiAgICB0aHJvdyBuZXcgSW5jb3JyZWN0UGFzc3dvcmRFcnJvcigpO1xuICB9XG5cbiAgaWYgKCFjaGlsZEtleWNoYWluLnB1Yikge1xuICAgIHRocm93IG5ldyBFcnJvcihgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06IGNoaWxkIGtleWNoYWluIGlzIG1pc3NpbmcgcHViIGZvciBwcmUtc2lnbiB2ZXJpZmljYXRpb25gKTtcbiAgfVxuICBpZiAoY2hpbGRLZXljaGFpbi5kZXJpdmVkRnJvbVBhcmVudFdpdGhQYXRoID09PSB1bmRlZmluZWQpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYFNhZmUgd2FsbGV0ICR7d2FsbGV0SWR9OiBjaGlsZCBrZXljaGFpbiBpcyBtaXNzaW5nIGRlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGhgKTtcbiAgfVxuXG4gIGNvbnN0IGRlcml2ZWQgPSBkZXJpdmVTYWZlQ2hpbGRIYXJkZW5lZEZyb21YcHJ2KFxuICAgIHJvb3RQcnYsXG4gICAgZGVjb2RlV2l0aENvZGVjKFxuICAgICAgRGVyaXZlZEZyb21QYXJlbnRXaXRoSGFyZGVuZWRQYXRoLFxuICAgICAgY2hpbGRLZXljaGFpbi5kZXJpdmVkRnJvbVBhcmVudFdpdGhQYXRoLFxuICAgICAgJ2Rlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGgnXG4gICAgKVxuICApO1xuICBpZiAoZGVyaXZlZC5wdWIgIT09IGNoaWxkS2V5Y2hhaW4ucHViKSB7XG4gICAgdGhyb3cgbmV3IFNhZmVEZXJpdmVkUHVibGljS2V5TWlzbWF0Y2hFcnJvcih3YWxsZXRJZCwgY2hpbGRLZXljaGFpbi5wdWIsIGRlcml2ZWQucHViKTtcbiAgfVxuXG4gIGlmIChkZXJpdmVkLnB1YiA9PT0gcm9vdEtleWNoYWluLnB1Yikge1xuICAgIHRocm93IG5ldyBFcnJvcihgU2FmZSB3YWxsZXQgJHt3YWxsZXRJZH06IGRlcml2ZWQgY2hpbGQgcHViIHVuZXhwZWN0ZWRseSBlcXVhbHMgdGhlIHJvb3QgcHViYCk7XG4gIH1cbiAgcmV0dXJuIHsgcHJ2OiBkZXJpdmVkLnBydiwgcHViOiBkZXJpdmVkLnB1YiB9O1xufVxuXG4vKipcbiAqIFJlc29sdmUgc2lnbmluZyBtYXRlcmlhbCBmb3IgYSBzYWZlIG93bmVyIChjaGlsZCBrZXkgaGFzIG5vIGVuY3J5cHRlZFBydikuXG4gKlxuICogT25jaGFpbiBzZWNwMjU2azE6IGRlY3J5cHQgcm9vdCwgaGFyZGVuZWQtZGVyaXZlIGF0IGBkZXJpdmVkRnJvbVBhcmVudFdpdGhQYXRoYFxuICogKGBtLzQ0Jy88Y29pblR5cGU+Jy88c2xvdD4nLzxhY2NvdW50PidgKSwgYW5kIHZlcmlmeSB0aGUgcmVnaXN0ZXJlZCBwdWIuXG4gKiBUU1MgYW5kIGVkMjU1MTkgb25jaGFpbjogdGhyb3cg4oCUIGRvIG5vdCByZXR1cm4gcm9vdCBtYXRlcmlhbCBvciBCSVAzMi1kZXJpdmUgdGhlIHdyb25nIGN1cnZlLlxuICpcbiAqIERvIG5vdCB1c2UgZm9yIHdhbGxldCBzaGFyaW5nIOKAlCB0aGF0IG11c3Qgbm90IHJlY2VpdmUgcm9vdCBrZXkgbWF0ZXJpYWwuXG4gKiBDYWxsIG9ubHkgd2hlbiBgaXNTYWZlQ2hpbGRQdWJsaWNPbmx5S2V5Y2hhaW5gIGlzIHRydWUuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZXNvbHZlU2FmZU93bmVyU2lnbmluZ1BydihwYXJhbXM6IFJlc29sdmVTYWZlT3duZXJTaWduaW5nUHJ2UGFyYW1zKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgeyBwcnYgfSA9IGF3YWl0IHJlc29sdmVTYWZlS2V5TWF0ZXJpYWwoe1xuICAgIC4uLnBhcmFtcyxcbiAgICBtYWtlTm90SW1wbGVtZW50ZWRFcnJvcjogKHNsb3QsIHdhbGxldElkKSA9PlxuICAgICAgc2xvdCA9PT0gJ2VkMjU1MTknXG4gICAgICAgID8gbmV3IFNhZmVPd25lclNpZ25pbmdOb3RJbXBsZW1lbnRlZEVycm9yKFxuICAgICAgICAgICAgd2FsbGV0SWQsXG4gICAgICAgICAgICBgZWQyNTUxOSBtdWx0aXNpZyBvd25lciBkZXJpdmF0aW9uICgke3BhcmFtcy5jb2luRmFtaWx5fSkgaXMgbm90IGltcGxlbWVudGVkOyBCSVAzMiB3b3VsZCBwcm9kdWNlIHRoZSB3cm9uZyBjaGlsZCBrZXkuYFxuICAgICAgICAgIClcbiAgICAgICAgOiBuZXcgU2FmZU93bmVyU2lnbmluZ05vdEltcGxlbWVudGVkRXJyb3IoXG4gICAgICAgICAgICB3YWxsZXRJZCxcbiAgICAgICAgICAgICdUU1Mgb3duZXIgc2lnbmluZyBmcm9tIHRoZSByb290IGtleXNoYXJlIGlzIG5vdCBpbXBsZW1lbnRlZC4gJyArXG4gICAgICAgICAgICAgICdSZXR1cm5pbmcgdGhlIHJvb3QgcHJpdmF0ZSBrZXkgd291bGQgZXhwb3NlIG1hdGVyaWFsIHRoYXQgY2FuIGRlcml2ZSBldmVyeSBjaGlsZCBpbiB0aGlzIHNsb3QuJ1xuICAgICAgICAgICksXG4gIH0pO1xuICByZXR1cm4gcHJ2O1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFJlc29sdmVTYWZlQ2hpbGRQcnZGb3JTaGFyaW5nUGFyYW1zIGV4dGVuZHMgU2FmZUtleU1hdGVyaWFsQmFzZVBhcmFtcyB7XG4gIG1wY0FsZ29yaXRobT86ICdlY2RzYScgfCAnZWRkc2EnO1xufVxuXG4vKiogU2xvdC1uYW1lZCBub3QtaW1wbGVtZW50ZWQgZGV0YWlsIGZvciB3YWxsZXQgc2hhcmluZy4gKi9cbmZ1bmN0aW9uIHNhZmVTaGFyZVNsb3REZXRhaWwoc2xvdDogU2FmZUtleU1hdGVyaWFsU2xvdCwgcGFyYW1zOiBSZXNvbHZlU2FmZUNoaWxkUHJ2Rm9yU2hhcmluZ1BhcmFtcyk6IHN0cmluZyB7XG4gIGlmIChzbG90ID09PSAnZWQyNTUxOScpIHtcbiAgICByZXR1cm4gYGVkMjU1MTkgbXVsdGlzaWcgc2FmZSBzaGFyaW5nICgke3BhcmFtcy5jb2luRmFtaWx5fSkgaXMgbm90IGltcGxlbWVudGVkOyBCSVAzMiB3b3VsZCBkZXJpdmUgdGhlIHdyb25nIGNoaWxkLmA7XG4gIH1cbiAgcmV0dXJuIHBhcmFtcy5tcGNBbGdvcml0aG0gPT09ICdlZGRzYSdcbiAgICA/ICdlZGRzYU1wYyBzYWZlIHNoYXJpbmcgaXMgbm90IGltcGxlbWVudGVkIChuZWVkcyB0aGUgRWREU0EgZGVyaXZlIGNlcmVtb255KS4nXG4gICAgOiAnZWNkc2FNcGMgc2FmZSBzaGFyaW5nIGlzIG5vdCBpbXBsZW1lbnRlZCAobmVlZHMgdGhlIERLTFMgZGVyaXZlIGNlcmVtb255KS4nO1xufVxuXG4vKipcbiAqIFJlc29sdmUgc2hhcmluZyBtYXRlcmlhbCBmb3IgYSBzYWZlIG93bmVyIChjaGlsZCBrZXkgaGFzIG5vIGVuY3J5cHRlZFBydikuXG4gKlxuICogT25jaGFpbiBzZWNwMjU2azE6IGRlY3J5cHQgcm9vdCwgaGFyZGVuZWQtZGVyaXZlIGF0IGBkZXJpdmVkRnJvbVBhcmVudFdpdGhQYXRoYFxuICogKGBtLzxuPidgKSwgdmVyaWZ5IHRoZSByZWdpc3RlcmVkIHB1YiwgYW5kIHJldHVybiB0aGUgQ0hJTEQgYHtwcnYsIHB1Yn1gIOKAlCBuZXZlciB0aGUgcm9vdC5cbiAqIFRTUyBhbmQgZWQyNTUxOSBvbmNoYWluOiB0aHJvdyBgU2FmZVNoYXJlTm90SW1wbGVtZW50ZWRFcnJvcmAgbmFtaW5nIHRoZSBzbG90ICsgYmxvY2tlci5cbiAqXG4gKiBDYWxsIG9ubHkgd2hlbiBgaXNTYWZlQ2hpbGRQdWJsaWNPbmx5S2V5Y2hhaW5gIGlzIHRydWUuXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZXNvbHZlU2FmZUNoaWxkUHJ2Rm9yU2hhcmluZyhcbiAgcGFyYW1zOiBSZXNvbHZlU2FmZUNoaWxkUHJ2Rm9yU2hhcmluZ1BhcmFtc1xuKTogUHJvbWlzZTxEZWNyeXB0ZWRLZXljaGFpbkRhdGE+IHtcbiAgcmV0dXJuIHJlc29sdmVTYWZlS2V5TWF0ZXJpYWwoe1xuICAgIC4uLnBhcmFtcyxcbiAgICBtYWtlTm90SW1wbGVtZW50ZWRFcnJvcjogKHNsb3QsIHdhbGxldElkKSA9PlxuICAgICAgbmV3IFNhZmVTaGFyZU5vdEltcGxlbWVudGVkRXJyb3Iod2FsbGV0SWQsIHNhZmVTaGFyZVNsb3REZXRhaWwoc2xvdCwgcGFyYW1zKSksXG4gIH0pO1xufVxuIl19