@bitgo-beta/sdk-core 8.2.1-beta.213 → 8.2.1-beta.2131

package/dist/src/bitgo/utils/tss/keyVerification.js

@@ -0,0 +1,192 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEddsaUserSigningMaterial = parseEddsaUserSigningMaterial;
+exports.eddsaUserSigningMaterialMatchesCommonKeychain = eddsaUserSigningMaterialMatchesCommonKeychain;
+/**
+ * @prettier
+ */
+const t = __importStar(require("io-ts"));
+const tss_1 = __importDefault(require("../../../account-lib/mpc/tss"));
+const HEX_32_BYTES = /^[0-9a-f]{64}$/i;
+/** 32-byte hex string; every hex field of genuine MPCv1 signing material is fixed-width 32 bytes. */
+const Hex32Bytes = new t.Type('Hex32Bytes', (u) => typeof u === 'string' && HEX_32_BYTES.test(u), (u, c) => (typeof u === 'string' && HEX_32_BYTES.test(u) ? t.success(u) : t.failure(u, c)), t.identity);
+const UShareCodec = t.type({
+    i: t.number,
+    t: t.number,
+    n: t.number,
+    y: Hex32Bytes,
+    seed: Hex32Bytes,
+    chaincode: Hex32Bytes,
+});
+/**
+ * `v` is the optional VSS commitment: absent on shares created without verifiable secret sharing.
+ * It is declared through `t.partial` rather than a union with `undefined` so that decoding an
+ * absent `v` does not materialize it as an own property on the share handed to `keyCombine`.
+ */
+const YShareCodec = t.intersection([
+    t.type({
+        i: t.number,
+        j: t.number,
+        y: Hex32Bytes,
+        u: Hex32Bytes,
+        chaincode: Hex32Bytes,
+    }),
+    t.partial({ v: Hex32Bytes }),
+]);
+const UserSigningMaterialCodec = t.type({
+    uShare: UShareCodec,
+    bitgoYShare: YShareCodec,
+    backupYShare: YShareCodec,
+});
+/**
+ * Maps a decode failure to a constant message. Never interpolates `error.value`: the input is
+ * private key material. This is also why the codecs call `t.failure` without a message and why
+ * the `validationErrors` reporter in `utils/decode.ts` is not used — both embed the failing value.
+ */
+function toInvalidKeyMessage(errors) {
+    const [error] = errors;
+    // the head of the context is the root codec itself, so the remaining keys are the field path.
+    // purely numeric keys are intersection/union member indices rather than field names.
+    const segments = error.context
+        .slice(1)
+        .map((entry) => entry.key)
+        .filter((key) => !/^\d+$/.test(key));
+    if (segments.length === 0) {
+        return 'Invalid user key - signing material is not an object';
+    }
+    if (segments.length === 1 && (error.value === undefined || error.value === null)) {
+        return `Invalid user key - missing ${segments[0]}`;
+    }
+    return `Invalid user key - ${segments[0]} is not a valid share`;
+}
+/**
+ * Parses the user TSS EdDSA signing material that a client passes as `prv` when signing,
+ * and rejects anything that does not decode as user signing material.
+ *
+ * Decoding is a shape check only, but it keeps malformed input away from the combine routine,
+ * which throws raw, input-interpolating errors for malformed shares.
+ *
+ * The input is private key material, so no error message may interpolate any part of it.
+ * In particular, JSON.parse errors on Node >= 20 include the raw input in their message,
+ * which is why parse failures are rethrown with a constant message.
+ *
+ * @param prv - stringified user signing material (`uShare`, `bitgoYShare`, `backupYShare`)
+ */
+function parseEddsaUserSigningMaterial(prv) {
+    let parsed;
+    try {
+        parsed = JSON.parse(prv);
+    }
+    catch (e) {
+        throw new Error('Invalid user key - could not parse signing material');
+    }
+    const decoded = UserSigningMaterialCodec.decode(parsed);
+    if (decoded._tag === 'Left') {
+        throw new Error(toInvalidKeyMessage(decoded.left));
+    }
+    return decoded.right;
+}
+/**
+ * Checks that `uShare.y` is the public point actually derived from `uShare.seed`.
+ *
+ * `keyCombine` derives the private scalar from the seed but reconstructs the common keychain from
+ * the declared `y` fields, so it never compares the two. Without this check a caller who knows
+ * only the wallet's public commonKeychain can submit genuine public fields alongside a seed they
+ * do not own and still verify. Re-running `keyShare` with the share's own seed and chaincode
+ * reproduces the derivation and yields the `y` the seed really commits to.
+ */
+function uShareSeedMatchesY(MPC, uShare) {
+    const seedchain = Buffer.concat([Buffer.from(uShare.seed, 'hex'), Buffer.from(uShare.chaincode, 'hex')]);
+    let derived;
+    try {
+        derived = MPC.keyShare(uShare.i, uShare.t, uShare.n, seedchain).uShare;
+    }
+    catch (e) {
+        // keyShare rejects an out-of-range index or threshold, which makes the share unusable
+        return false;
+    }
+    return derived.y === uShare.y;
+}
+/**
+ * Verifies that user TSS EdDSA signing material (`prv`) recombines to a given commonKeychain.
+ *
+ * Recombines the user's share with the BitGo and backup Y shares — the same computation the
+ * SDK performs when creating the user keychain or signing — and compares the result against
+ * the wallet's commonKeychain. Returns false rather than throwing when the keys do not match.
+ * Shares that pass the shape check but are cryptographically inconsistent are rejected with
+ * a constant message: the combine routine throws raw errors, some of which interpolate
+ * submitter-controlled fields, which must not surface through the API.
+ *
+ * Recombination alone is not proof of possession, so two further checks run first. The seed is
+ * bound to `uShare.y`, and the Y shares must carry their VSS commitment `v` — `keyCombine`
+ * verifies a Y share's secret `u` only when `v` is present, so material without `v` cannot be
+ * verified at all and throws a distinct error rather than being judged a non-match. Genuine
+ * shares produced by `keyShare` always carry `v`.
+ *
+ * A true result is a consistency check for a caller inspecting its own material, not proof of
+ * possession, and must never be used as an authorization signal: a caller who knows only the
+ * wallet's public commonKeychain can construct material that passes — an `uShare` whose seed
+ * matches its `y`, plus Y shares with a chosen secret `u` and the `v` solved from it, whose
+ * `y` values sum to the common key.
+ *
+ * @param params.prv - stringified user signing material, as passed as `prv` when signing
+ * @param params.commonKeychain - the wallet's user keychain commonKeychain
+ */
+async function eddsaUserSigningMaterialMatchesCommonKeychain(params) {
+    const signingMaterial = parseEddsaUserSigningMaterial(params.prv);
+    const MPC = await tss_1.default.initialize();
+    if (!uShareSeedMatchesY(MPC, signingMaterial.uShare)) {
+        return false;
+    }
+    // keyCombine verifies a Y share's secret `u` against its commitment only when `v` is present,
+    // so material without `v` cannot be verified at all; reject it distinctly instead of judging
+    // it a non-match, which would misreport genuine material that lacks the commitment
+    if (signingMaterial.bitgoYShare.v === undefined || signingMaterial.backupYShare.v === undefined) {
+        throw new Error('Unable to verify key - signing material has no VSS commitment');
+    }
+    let combinedKey;
+    try {
+        combinedKey = MPC.keyCombine(signingMaterial.uShare, [signingMaterial.bitgoYShare, signingMaterial.backupYShare]);
+    }
+    catch (e) {
+        throw new Error('Invalid user key - could not combine signing material');
+    }
+    return combinedKey.pShare.y + combinedKey.pShare.chaincode === params.commonKeychain;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5VmVyaWZpY2F0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2JpdGdvL3V0aWxzL3Rzcy9rZXlWZXJpZmljYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFtRkEsc0VBWUM7QUFnREQsc0dBc0JDO0FBcktEOztHQUVHO0FBQ0gseUNBQTJCO0FBQzNCLHVFQUFpRTtBQUdqRSxNQUFNLFlBQVksR0FBRyxpQkFBaUIsQ0FBQztBQUV2QyxxR0FBcUc7QUFDckcsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLENBQUMsSUFBSSxDQUMzQixZQUFZLEVBQ1osQ0FBQyxDQUFDLEVBQWUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUNqRSxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssUUFBUSxJQUFJLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQzFGLENBQUMsQ0FBQyxRQUFRLENBQ1gsQ0FBQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDekIsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNO0lBQ1gsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNO0lBQ1gsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNO0lBQ1gsQ0FBQyxFQUFFLFVBQVU7SUFDYixJQUFJLEVBQUUsVUFBVTtJQUNoQixTQUFTLEVBQUUsVUFBVTtDQUN0QixDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxXQUFXLEdBQUcsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUNqQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ0wsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNO1FBQ1gsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNO1FBQ1gsQ0FBQyxFQUFFLFVBQVU7UUFDYixDQUFDLEVBQUUsVUFBVTtRQUNiLFNBQVMsRUFBRSxVQUFVO0tBQ3RCLENBQUM7SUFDRixDQUFDLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDO0NBQzdCLENBQUMsQ0FBQztBQUVILE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUN0QyxNQUFNLEVBQUUsV0FBVztJQUNuQixXQUFXLEVBQUUsV0FBVztJQUN4QixZQUFZLEVBQUUsV0FBVztDQUMxQixDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsU0FBUyxtQkFBbUIsQ0FBQyxNQUFnQjtJQUMzQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsTUFBTSxDQUFDO0lBQ3ZCLDhGQUE4RjtJQUM5RixxRkFBcUY7SUFDckYsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLE9BQU87U0FDM0IsS0FBSyxDQUFDLENBQUMsQ0FBQztTQUNSLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQztTQUN6QixNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3ZDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMxQixPQUFPLHNEQUFzRCxDQUFDO0lBQ2hFLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ2pGLE9BQU8sOEJBQThCLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3JELENBQUM7SUFDRCxPQUFPLHNCQUFzQixRQUFRLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDO0FBQ2xFLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxTQUFnQiw2QkFBNkIsQ0FBQyxHQUFXO0lBQ3ZELElBQUksTUFBZSxDQUFDO0lBQ3BCLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsTUFBTSxJQUFJLEtBQUssQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDeEQsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDLEtBQTRCLENBQUM7QUFDOUMsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBUyxrQkFBa0IsQ0FBQyxHQUFVLEVBQUUsTUFBcUM7SUFDM0UsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3pHLElBQUksT0FBc0MsQ0FBQztJQUMzQyxJQUFJLENBQUM7UUFDSCxPQUFPLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDekUsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDWCxzRkFBc0Y7UUFDdEYsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUMsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFDaEMsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0F3Qkc7QUFDSSxLQUFLLFVBQVUsNkNBQTZDLENBQUMsTUFHbkU7SUFDQyxNQUFNLGVBQWUsR0FBRyw2QkFBNkIsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbEUsTUFBTSxHQUFHLEdBQUcsTUFBTSxhQUFLLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDckMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxlQUFlLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUNyRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCw4RkFBOEY7SUFDOUYsNkZBQTZGO0lBQzdGLG1GQUFtRjtJQUNuRixJQUFJLGVBQWUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxLQUFLLFNBQVMsSUFBSSxlQUFlLENBQUMsWUFBWSxDQUFDLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELElBQUksV0FBdUIsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDSCxXQUFXLEdBQUcsR0FBRyxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLENBQUMsZUFBZSxDQUFDLFdBQVcsRUFBRSxlQUFlLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUNwSCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxXQUFXLENBQUMsTUFBTSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsY0FBYyxDQUFDO0FBQ3ZGLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBwcmV0dGllclxuICovXG5pbXBvcnQgKiBhcyB0IGZyb20gJ2lvLXRzJztcbmltcG9ydCBFZGRzYSwgeyBLZXlDb21iaW5lIH0gZnJvbSAnLi4vLi4vLi4vYWNjb3VudC1saWIvbXBjL3Rzcyc7XG5pbXBvcnQgeyBVc2VyU2lnbmluZ01hdGVyaWFsIH0gZnJvbSAnLi4vLi4vdHNzL2VkZHNhL3R5cGVzJztcblxuY29uc3QgSEVYXzMyX0JZVEVTID0gL15bMC05YS1mXXs2NH0kL2k7XG5cbi8qKiAzMi1ieXRlIGhleCBzdHJpbmc7IGV2ZXJ5IGhleCBmaWVsZCBvZiBnZW51aW5lIE1QQ3YxIHNpZ25pbmcgbWF0ZXJpYWwgaXMgZml4ZWQtd2lkdGggMzIgYnl0ZXMuICovXG5jb25zdCBIZXgzMkJ5dGVzID0gbmV3IHQuVHlwZTxzdHJpbmcsIHN0cmluZywgdW5rbm93bj4oXG4gICdIZXgzMkJ5dGVzJyxcbiAgKHUpOiB1IGlzIHN0cmluZyA9PiB0eXBlb2YgdSA9PT0gJ3N0cmluZycgJiYgSEVYXzMyX0JZVEVTLnRlc3QodSksXG4gICh1LCBjKSA9PiAodHlwZW9mIHUgPT09ICdzdHJpbmcnICYmIEhFWF8zMl9CWVRFUy50ZXN0KHUpID8gdC5zdWNjZXNzKHUpIDogdC5mYWlsdXJlKHUsIGMpKSxcbiAgdC5pZGVudGl0eVxuKTtcblxuY29uc3QgVVNoYXJlQ29kZWMgPSB0LnR5cGUoe1xuICBpOiB0Lm51bWJlcixcbiAgdDogdC5udW1iZXIsXG4gIG46IHQubnVtYmVyLFxuICB5OiBIZXgzMkJ5dGVzLFxuICBzZWVkOiBIZXgzMkJ5dGVzLFxuICBjaGFpbmNvZGU6IEhleDMyQnl0ZXMsXG59KTtcblxuLyoqXG4gKiBgdmAgaXMgdGhlIG9wdGlvbmFsIFZTUyBjb21taXRtZW50OiBhYnNlbnQgb24gc2hhcmVzIGNyZWF0ZWQgd2l0aG91dCB2ZXJpZmlhYmxlIHNlY3JldCBzaGFyaW5nLlxuICogSXQgaXMgZGVjbGFyZWQgdGhyb3VnaCBgdC5wYXJ0aWFsYCByYXRoZXIgdGhhbiBhIHVuaW9uIHdpdGggYHVuZGVmaW5lZGAgc28gdGhhdCBkZWNvZGluZyBhblxuICogYWJzZW50IGB2YCBkb2VzIG5vdCBtYXRlcmlhbGl6ZSBpdCBhcyBhbiBvd24gcHJvcGVydHkgb24gdGhlIHNoYXJlIGhhbmRlZCB0byBga2V5Q29tYmluZWAuXG4gKi9cbmNvbnN0IFlTaGFyZUNvZGVjID0gdC5pbnRlcnNlY3Rpb24oW1xuICB0LnR5cGUoe1xuICAgIGk6IHQubnVtYmVyLFxuICAgIGo6IHQubnVtYmVyLFxuICAgIHk6IEhleDMyQnl0ZXMsXG4gICAgdTogSGV4MzJCeXRlcyxcbiAgICBjaGFpbmNvZGU6IEhleDMyQnl0ZXMsXG4gIH0pLFxuICB0LnBhcnRpYWwoeyB2OiBIZXgzMkJ5dGVzIH0pLFxuXSk7XG5cbmNvbnN0IFVzZXJTaWduaW5nTWF0ZXJpYWxDb2RlYyA9IHQudHlwZSh7XG4gIHVTaGFyZTogVVNoYXJlQ29kZWMsXG4gIGJpdGdvWVNoYXJlOiBZU2hhcmVDb2RlYyxcbiAgYmFja3VwWVNoYXJlOiBZU2hhcmVDb2RlYyxcbn0pO1xuXG4vKipcbiAqIE1hcHMgYSBkZWNvZGUgZmFpbHVyZSB0byBhIGNvbnN0YW50IG1lc3NhZ2UuIE5ldmVyIGludGVycG9sYXRlcyBgZXJyb3IudmFsdWVgOiB0aGUgaW5wdXQgaXNcbiAqIHByaXZhdGUga2V5IG1hdGVyaWFsLiBUaGlzIGlzIGFsc28gd2h5IHRoZSBjb2RlY3MgY2FsbCBgdC5mYWlsdXJlYCB3aXRob3V0IGEgbWVzc2FnZSBhbmQgd2h5XG4gKiB0aGUgYHZhbGlkYXRpb25FcnJvcnNgIHJlcG9ydGVyIGluIGB1dGlscy9kZWNvZGUudHNgIGlzIG5vdCB1c2VkIOKAlCBib3RoIGVtYmVkIHRoZSBmYWlsaW5nIHZhbHVlLlxuICovXG5mdW5jdGlvbiB0b0ludmFsaWRLZXlNZXNzYWdlKGVycm9yczogdC5FcnJvcnMpOiBzdHJpbmcge1xuICBjb25zdCBbZXJyb3JdID0gZXJyb3JzO1xuICAvLyB0aGUgaGVhZCBvZiB0aGUgY29udGV4dCBpcyB0aGUgcm9vdCBjb2RlYyBpdHNlbGYsIHNvIHRoZSByZW1haW5pbmcga2V5cyBhcmUgdGhlIGZpZWxkIHBhdGguXG4gIC8vIHB1cmVseSBudW1lcmljIGtleXMgYXJlIGludGVyc2VjdGlvbi91bmlvbiBtZW1iZXIgaW5kaWNlcyByYXRoZXIgdGhhbiBmaWVsZCBuYW1lcy5cbiAgY29uc3Qgc2VnbWVudHMgPSBlcnJvci5jb250ZXh0XG4gICAgLnNsaWNlKDEpXG4gICAgLm1hcCgoZW50cnkpID0+IGVudHJ5LmtleSlcbiAgICAuZmlsdGVyKChrZXkpID0+ICEvXlxcZCskLy50ZXN0KGtleSkpO1xuICBpZiAoc2VnbWVudHMubGVuZ3RoID09PSAwKSB7XG4gICAgcmV0dXJuICdJbnZhbGlkIHVzZXIga2V5IC0gc2lnbmluZyBtYXRlcmlhbCBpcyBub3QgYW4gb2JqZWN0JztcbiAgfVxuICBpZiAoc2VnbWVudHMubGVuZ3RoID09PSAxICYmIChlcnJvci52YWx1ZSA9PT0gdW5kZWZpbmVkIHx8IGVycm9yLnZhbHVlID09PSBudWxsKSkge1xuICAgIHJldHVybiBgSW52YWxpZCB1c2VyIGtleSAtIG1pc3NpbmcgJHtzZWdtZW50c1swXX1gO1xuICB9XG4gIHJldHVybiBgSW52YWxpZCB1c2VyIGtleSAtICR7c2VnbWVudHNbMF19IGlzIG5vdCBhIHZhbGlkIHNoYXJlYDtcbn1cblxuLyoqXG4gKiBQYXJzZXMgdGhlIHVzZXIgVFNTIEVkRFNBIHNpZ25pbmcgbWF0ZXJpYWwgdGhhdCBhIGNsaWVudCBwYXNzZXMgYXMgYHBydmAgd2hlbiBzaWduaW5nLFxuICogYW5kIHJlamVjdHMgYW55dGhpbmcgdGhhdCBkb2VzIG5vdCBkZWNvZGUgYXMgdXNlciBzaWduaW5nIG1hdGVyaWFsLlxuICpcbiAqIERlY29kaW5nIGlzIGEgc2hhcGUgY2hlY2sgb25seSwgYnV0IGl0IGtlZXBzIG1hbGZvcm1lZCBpbnB1dCBhd2F5IGZyb20gdGhlIGNvbWJpbmUgcm91dGluZSxcbiAqIHdoaWNoIHRocm93cyByYXcsIGlucHV0LWludGVycG9sYXRpbmcgZXJyb3JzIGZvciBtYWxmb3JtZWQgc2hhcmVzLlxuICpcbiAqIFRoZSBpbnB1dCBpcyBwcml2YXRlIGtleSBtYXRlcmlhbCwgc28gbm8gZXJyb3IgbWVzc2FnZSBtYXkgaW50ZXJwb2xhdGUgYW55IHBhcnQgb2YgaXQuXG4gKiBJbiBwYXJ0aWN1bGFyLCBKU09OLnBhcnNlIGVycm9ycyBvbiBOb2RlID49IDIwIGluY2x1ZGUgdGhlIHJhdyBpbnB1dCBpbiB0aGVpciBtZXNzYWdlLFxuICogd2hpY2ggaXMgd2h5IHBhcnNlIGZhaWx1cmVzIGFyZSByZXRocm93biB3aXRoIGEgY29uc3RhbnQgbWVzc2FnZS5cbiAqXG4gKiBAcGFyYW0gcHJ2IC0gc3RyaW5naWZpZWQgdXNlciBzaWduaW5nIG1hdGVyaWFsIChgdVNoYXJlYCwgYGJpdGdvWVNoYXJlYCwgYGJhY2t1cFlTaGFyZWApXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBwYXJzZUVkZHNhVXNlclNpZ25pbmdNYXRlcmlhbChwcnY6IHN0cmluZyk6IFVzZXJTaWduaW5nTWF0ZXJpYWwge1xuICBsZXQgcGFyc2VkOiB1bmtub3duO1xuICB0cnkge1xuICAgIHBhcnNlZCA9IEpTT04ucGFyc2UocHJ2KTtcbiAgfSBjYXRjaCAoZSkge1xuICAgIHRocm93IG5ldyBFcnJvcignSW52YWxpZCB1c2VyIGtleSAtIGNvdWxkIG5vdCBwYXJzZSBzaWduaW5nIG1hdGVyaWFsJyk7XG4gIH1cbiAgY29uc3QgZGVjb2RlZCA9IFVzZXJTaWduaW5nTWF0ZXJpYWxDb2RlYy5kZWNvZGUocGFyc2VkKTtcbiAgaWYgKGRlY29kZWQuX3RhZyA9PT0gJ0xlZnQnKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKHRvSW52YWxpZEtleU1lc3NhZ2UoZGVjb2RlZC5sZWZ0KSk7XG4gIH1cbiAgcmV0dXJuIGRlY29kZWQucmlnaHQgYXMgVXNlclNpZ25pbmdNYXRlcmlhbDtcbn1cblxuLyoqXG4gKiBDaGVja3MgdGhhdCBgdVNoYXJlLnlgIGlzIHRoZSBwdWJsaWMgcG9pbnQgYWN0dWFsbHkgZGVyaXZlZCBmcm9tIGB1U2hhcmUuc2VlZGAuXG4gKlxuICogYGtleUNvbWJpbmVgIGRlcml2ZXMgdGhlIHByaXZhdGUgc2NhbGFyIGZyb20gdGhlIHNlZWQgYnV0IHJlY29uc3RydWN0cyB0aGUgY29tbW9uIGtleWNoYWluIGZyb21cbiAqIHRoZSBkZWNsYXJlZCBgeWAgZmllbGRzLCBzbyBpdCBuZXZlciBjb21wYXJlcyB0aGUgdHdvLiBXaXRob3V0IHRoaXMgY2hlY2sgYSBjYWxsZXIgd2hvIGtub3dzXG4gKiBvbmx5IHRoZSB3YWxsZXQncyBwdWJsaWMgY29tbW9uS2V5Y2hhaW4gY2FuIHN1Ym1pdCBnZW51aW5lIHB1YmxpYyBmaWVsZHMgYWxvbmdzaWRlIGEgc2VlZCB0aGV5XG4gKiBkbyBub3Qgb3duIGFuZCBzdGlsbCB2ZXJpZnkuIFJlLXJ1bm5pbmcgYGtleVNoYXJlYCB3aXRoIHRoZSBzaGFyZSdzIG93biBzZWVkIGFuZCBjaGFpbmNvZGVcbiAqIHJlcHJvZHVjZXMgdGhlIGRlcml2YXRpb24gYW5kIHlpZWxkcyB0aGUgYHlgIHRoZSBzZWVkIHJlYWxseSBjb21taXRzIHRvLlxuICovXG5mdW5jdGlvbiB1U2hhcmVTZWVkTWF0Y2hlc1koTVBDOiBFZGRzYSwgdVNoYXJlOiBVc2VyU2lnbmluZ01hdGVyaWFsWyd1U2hhcmUnXSk6IGJvb2xlYW4ge1xuICBjb25zdCBzZWVkY2hhaW4gPSBCdWZmZXIuY29uY2F0KFtCdWZmZXIuZnJvbSh1U2hhcmUuc2VlZCwgJ2hleCcpLCBCdWZmZXIuZnJvbSh1U2hhcmUuY2hhaW5jb2RlLCAnaGV4JyldKTtcbiAgbGV0IGRlcml2ZWQ6IFVzZXJTaWduaW5nTWF0ZXJpYWxbJ3VTaGFyZSddO1xuICB0cnkge1xuICAgIGRlcml2ZWQgPSBNUEMua2V5U2hhcmUodVNoYXJlLmksIHVTaGFyZS50LCB1U2hhcmUubiwgc2VlZGNoYWluKS51U2hhcmU7XG4gIH0gY2F0Y2ggKGUpIHtcbiAgICAvLyBrZXlTaGFyZSByZWplY3RzIGFuIG91dC1vZi1yYW5nZSBpbmRleCBvciB0aHJlc2hvbGQsIHdoaWNoIG1ha2VzIHRoZSBzaGFyZSB1bnVzYWJsZVxuICAgIHJldHVybiBmYWxzZTtcbiAgfVxuICByZXR1cm4gZGVyaXZlZC55ID09PSB1U2hhcmUueTtcbn1cblxuLyoqXG4gKiBWZXJpZmllcyB0aGF0IHVzZXIgVFNTIEVkRFNBIHNpZ25pbmcgbWF0ZXJpYWwgKGBwcnZgKSByZWNvbWJpbmVzIHRvIGEgZ2l2ZW4gY29tbW9uS2V5Y2hhaW4uXG4gKlxuICogUmVjb21iaW5lcyB0aGUgdXNlcidzIHNoYXJlIHdpdGggdGhlIEJpdEdvIGFuZCBiYWNrdXAgWSBzaGFyZXMg4oCUIHRoZSBzYW1lIGNvbXB1dGF0aW9uIHRoZVxuICogU0RLIHBlcmZvcm1zIHdoZW4gY3JlYXRpbmcgdGhlIHVzZXIga2V5Y2hhaW4gb3Igc2lnbmluZyDigJQgYW5kIGNvbXBhcmVzIHRoZSByZXN1bHQgYWdhaW5zdFxuICogdGhlIHdhbGxldCdzIGNvbW1vbktleWNoYWluLiBSZXR1cm5zIGZhbHNlIHJhdGhlciB0aGFuIHRocm93aW5nIHdoZW4gdGhlIGtleXMgZG8gbm90IG1hdGNoLlxuICogU2hhcmVzIHRoYXQgcGFzcyB0aGUgc2hhcGUgY2hlY2sgYnV0IGFyZSBjcnlwdG9ncmFwaGljYWxseSBpbmNvbnNpc3RlbnQgYXJlIHJlamVjdGVkIHdpdGhcbiAqIGEgY29uc3RhbnQgbWVzc2FnZTogdGhlIGNvbWJpbmUgcm91dGluZSB0aHJvd3MgcmF3IGVycm9ycywgc29tZSBvZiB3aGljaCBpbnRlcnBvbGF0ZVxuICogc3VibWl0dGVyLWNvbnRyb2xsZWQgZmllbGRzLCB3aGljaCBtdXN0IG5vdCBzdXJmYWNlIHRocm91Z2ggdGhlIEFQSS5cbiAqXG4gKiBSZWNvbWJpbmF0aW9uIGFsb25lIGlzIG5vdCBwcm9vZiBvZiBwb3NzZXNzaW9uLCBzbyB0d28gZnVydGhlciBjaGVja3MgcnVuIGZpcnN0LiBUaGUgc2VlZCBpc1xuICogYm91bmQgdG8gYHVTaGFyZS55YCwgYW5kIHRoZSBZIHNoYXJlcyBtdXN0IGNhcnJ5IHRoZWlyIFZTUyBjb21taXRtZW50IGB2YCDigJQgYGtleUNvbWJpbmVgXG4gKiB2ZXJpZmllcyBhIFkgc2hhcmUncyBzZWNyZXQgYHVgIG9ubHkgd2hlbiBgdmAgaXMgcHJlc2VudCwgc28gbWF0ZXJpYWwgd2l0aG91dCBgdmAgY2Fubm90IGJlXG4gKiB2ZXJpZmllZCBhdCBhbGwgYW5kIHRocm93cyBhIGRpc3RpbmN0IGVycm9yIHJhdGhlciB0aGFuIGJlaW5nIGp1ZGdlZCBhIG5vbi1tYXRjaC4gR2VudWluZVxuICogc2hhcmVzIHByb2R1Y2VkIGJ5IGBrZXlTaGFyZWAgYWx3YXlzIGNhcnJ5IGB2YC5cbiAqXG4gKiBBIHRydWUgcmVzdWx0IGlzIGEgY29uc2lzdGVuY3kgY2hlY2sgZm9yIGEgY2FsbGVyIGluc3BlY3RpbmcgaXRzIG93biBtYXRlcmlhbCwgbm90IHByb29mIG9mXG4gKiBwb3NzZXNzaW9uLCBhbmQgbXVzdCBuZXZlciBiZSB1c2VkIGFzIGFuIGF1dGhvcml6YXRpb24gc2lnbmFsOiBhIGNhbGxlciB3aG8ga25vd3Mgb25seSB0aGVcbiAqIHdhbGxldCdzIHB1YmxpYyBjb21tb25LZXljaGFpbiBjYW4gY29uc3RydWN0IG1hdGVyaWFsIHRoYXQgcGFzc2VzIOKAlCBhbiBgdVNoYXJlYCB3aG9zZSBzZWVkXG4gKiBtYXRjaGVzIGl0cyBgeWAsIHBsdXMgWSBzaGFyZXMgd2l0aCBhIGNob3NlbiBzZWNyZXQgYHVgIGFuZCB0aGUgYHZgIHNvbHZlZCBmcm9tIGl0LCB3aG9zZVxuICogYHlgIHZhbHVlcyBzdW0gdG8gdGhlIGNvbW1vbiBrZXkuXG4gKlxuICogQHBhcmFtIHBhcmFtcy5wcnYgLSBzdHJpbmdpZmllZCB1c2VyIHNpZ25pbmcgbWF0ZXJpYWwsIGFzIHBhc3NlZCBhcyBgcHJ2YCB3aGVuIHNpZ25pbmdcbiAqIEBwYXJhbSBwYXJhbXMuY29tbW9uS2V5Y2hhaW4gLSB0aGUgd2FsbGV0J3MgdXNlciBrZXljaGFpbiBjb21tb25LZXljaGFpblxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZWRkc2FVc2VyU2lnbmluZ01hdGVyaWFsTWF0Y2hlc0NvbW1vbktleWNoYWluKHBhcmFtczoge1xuICBwcnY6IHN0cmluZztcbiAgY29tbW9uS2V5Y2hhaW46IHN0cmluZztcbn0pOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgY29uc3Qgc2lnbmluZ01hdGVyaWFsID0gcGFyc2VFZGRzYVVzZXJTaWduaW5nTWF0ZXJpYWwocGFyYW1zLnBydik7XG4gIGNvbnN0IE1QQyA9IGF3YWl0IEVkZHNhLmluaXRpYWxpemUoKTtcbiAgaWYgKCF1U2hhcmVTZWVkTWF0Y2hlc1koTVBDLCBzaWduaW5nTWF0ZXJpYWwudVNoYXJlKSkge1xuICAgIHJldHVybiBmYWxzZTtcbiAgfVxuICAvLyBrZXlDb21iaW5lIHZlcmlmaWVzIGEgWSBzaGFyZSdzIHNlY3JldCBgdWAgYWdhaW5zdCBpdHMgY29tbWl0bWVudCBvbmx5IHdoZW4gYHZgIGlzIHByZXNlbnQsXG4gIC8vIHNvIG1hdGVyaWFsIHdpdGhvdXQgYHZgIGNhbm5vdCBiZSB2ZXJpZmllZCBhdCBhbGw7IHJlamVjdCBpdCBkaXN0aW5jdGx5IGluc3RlYWQgb2YganVkZ2luZ1xuICAvLyBpdCBhIG5vbi1tYXRjaCwgd2hpY2ggd291bGQgbWlzcmVwb3J0IGdlbnVpbmUgbWF0ZXJpYWwgdGhhdCBsYWNrcyB0aGUgY29tbWl0bWVudFxuICBpZiAoc2lnbmluZ01hdGVyaWFsLmJpdGdvWVNoYXJlLnYgPT09IHVuZGVmaW5lZCB8fCBzaWduaW5nTWF0ZXJpYWwuYmFja3VwWVNoYXJlLnYgPT09IHVuZGVmaW5lZCkge1xuICAgIHRocm93IG5ldyBFcnJvcignVW5hYmxlIHRvIHZlcmlmeSBrZXkgLSBzaWduaW5nIG1hdGVyaWFsIGhhcyBubyBWU1MgY29tbWl0bWVudCcpO1xuICB9XG4gIGxldCBjb21iaW5lZEtleTogS2V5Q29tYmluZTtcbiAgdHJ5IHtcbiAgICBjb21iaW5lZEtleSA9IE1QQy5rZXlDb21iaW5lKHNpZ25pbmdNYXRlcmlhbC51U2hhcmUsIFtzaWduaW5nTWF0ZXJpYWwuYml0Z29ZU2hhcmUsIHNpZ25pbmdNYXRlcmlhbC5iYWNrdXBZU2hhcmVdKTtcbiAgfSBjYXRjaCAoZSkge1xuICAgIHRocm93IG5ldyBFcnJvcignSW52YWxpZCB1c2VyIGtleSAtIGNvdWxkIG5vdCBjb21iaW5lIHNpZ25pbmcgbWF0ZXJpYWwnKTtcbiAgfVxuICByZXR1cm4gY29tYmluZWRLZXkucFNoYXJlLnkgKyBjb21iaW5lZEtleS5wU2hhcmUuY2hhaW5jb2RlID09PSBwYXJhbXMuY29tbW9uS2V5Y2hhaW47XG59XG4iXX0=

package/dist/src/bitgo/utils/tss/preHashedSignable.d.ts

@@ -0,0 +1,23 @@
+import { IBaseCoin } from '../../baseCoin';
+import { SignableTransaction } from './baseTypes';
+export interface CoinWithPreHashedSignable {
+    /**
+     * Returns true when the signableHex for this transaction is already the
+     * final signing hash (SHA-256 for Avalanche atomic txs), and the MPC
+     * signing flow should use it directly without additional hashing.
+     */
+    isSignablePreHashed(unsignedTx: SignableTransaction): boolean;
+}
+export declare function isCoinWithPreHashedSignable(coin: unknown): coin is CoinWithPreHashedSignable;
+/**
+ * Detect Avalanche atomic cross-chain transactions by codec prefix.
+ *
+ * Avalanche codec type IDs start with 0x00000000 (first 4 hex chars = '0000').
+ * Standard EVM RLP encoding starts with 0xf8xx — overlap is currently impossible.
+ *
+ * Note: The WP strips the '0x' prefix from serializedTxHex before storing,
+ * so we check for '0000' not '0x0000'.
+ */
+export declare function isAvalancheAtomicTx(unsignedTx: SignableTransaction): boolean;
+export declare function shouldUsePreHashedSignable(coin: IBaseCoin, unsignedTx: SignableTransaction): boolean;
+//# sourceMappingURL=preHashedSignable.d.ts.map

package/dist/src/bitgo/utils/tss/preHashedSignable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preHashedSignable.d.ts","sourceRoot":"","sources":["../../../../../src/bitgo/utils/tss/preHashedSignable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,mBAAmB,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC;CAC/D;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,yBAAyB,CAM5F;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAE5E;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAEpG"}

package/dist/src/bitgo/utils/tss/preHashedSignable.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCoinWithPreHashedSignable = isCoinWithPreHashedSignable;
+exports.isAvalancheAtomicTx = isAvalancheAtomicTx;
+exports.shouldUsePreHashedSignable = shouldUsePreHashedSignable;
+function isCoinWithPreHashedSignable(coin) {
+    return (coin !== null &&
+        typeof coin === 'object' &&
+        typeof coin.isSignablePreHashed === 'function');
+}
+/**
+ * Detect Avalanche atomic cross-chain transactions by codec prefix.
+ *
+ * Avalanche codec type IDs start with 0x00000000 (first 4 hex chars = '0000').
+ * Standard EVM RLP encoding starts with 0xf8xx — overlap is currently impossible.
+ *
+ * Note: The WP strips the '0x' prefix from serializedTxHex before storing,
+ * so we check for '0000' not '0x0000'.
+ */
+function isAvalancheAtomicTx(unsignedTx) {
+    return unsignedTx.serializedTxHex.startsWith('0000');
+}
+function shouldUsePreHashedSignable(coin, unsignedTx) {
+    return isCoinWithPreHashedSignable(coin) && coin.isSignablePreHashed(unsignedTx);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJlSGFzaGVkU2lnbmFibGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYml0Z28vdXRpbHMvdHNzL3ByZUhhc2hlZFNpZ25hYmxlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBWUEsa0VBTUM7QUFXRCxrREFFQztBQUVELGdFQUVDO0FBdkJELFNBQWdCLDJCQUEyQixDQUFDLElBQWE7SUFDdkQsT0FBTyxDQUNMLElBQUksS0FBSyxJQUFJO1FBQ2IsT0FBTyxJQUFJLEtBQUssUUFBUTtRQUN4QixPQUFRLElBQWtDLENBQUMsbUJBQW1CLEtBQUssVUFBVSxDQUM5RSxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBZ0IsbUJBQW1CLENBQUMsVUFBK0I7SUFDakUsT0FBTyxVQUFVLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUN2RCxDQUFDO0FBRUQsU0FBZ0IsMEJBQTBCLENBQUMsSUFBZSxFQUFFLFVBQStCO0lBQ3pGLE9BQU8sMkJBQTJCLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLG1CQUFtQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ25GLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBJQmFzZUNvaW4gfSBmcm9tICcuLi8uLi9iYXNlQ29pbic7XG5pbXBvcnQgeyBTaWduYWJsZVRyYW5zYWN0aW9uIH0gZnJvbSAnLi9iYXNlVHlwZXMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIENvaW5XaXRoUHJlSGFzaGVkU2lnbmFibGUge1xuICAvKipcbiAgICogUmV0dXJucyB0cnVlIHdoZW4gdGhlIHNpZ25hYmxlSGV4IGZvciB0aGlzIHRyYW5zYWN0aW9uIGlzIGFscmVhZHkgdGhlXG4gICAqIGZpbmFsIHNpZ25pbmcgaGFzaCAoU0hBLTI1NiBmb3IgQXZhbGFuY2hlIGF0b21pYyB0eHMpLCBhbmQgdGhlIE1QQ1xuICAgKiBzaWduaW5nIGZsb3cgc2hvdWxkIHVzZSBpdCBkaXJlY3RseSB3aXRob3V0IGFkZGl0aW9uYWwgaGFzaGluZy5cbiAgICovXG4gIGlzU2lnbmFibGVQcmVIYXNoZWQodW5zaWduZWRUeDogU2lnbmFibGVUcmFuc2FjdGlvbik6IGJvb2xlYW47XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBpc0NvaW5XaXRoUHJlSGFzaGVkU2lnbmFibGUoY29pbjogdW5rbm93bik6IGNvaW4gaXMgQ29pbldpdGhQcmVIYXNoZWRTaWduYWJsZSB7XG4gIHJldHVybiAoXG4gICAgY29pbiAhPT0gbnVsbCAmJlxuICAgIHR5cGVvZiBjb2luID09PSAnb2JqZWN0JyAmJlxuICAgIHR5cGVvZiAoY29pbiBhcyBDb2luV2l0aFByZUhhc2hlZFNpZ25hYmxlKS5pc1NpZ25hYmxlUHJlSGFzaGVkID09PSAnZnVuY3Rpb24nXG4gICk7XG59XG5cbi8qKlxuICogRGV0ZWN0IEF2YWxhbmNoZSBhdG9taWMgY3Jvc3MtY2hhaW4gdHJhbnNhY3Rpb25zIGJ5IGNvZGVjIHByZWZpeC5cbiAqXG4gKiBBdmFsYW5jaGUgY29kZWMgdHlwZSBJRHMgc3RhcnQgd2l0aCAweDAwMDAwMDAwIChmaXJzdCA0IGhleCBjaGFycyA9ICcwMDAwJykuXG4gKiBTdGFuZGFyZCBFVk0gUkxQIGVuY29kaW5nIHN0YXJ0cyB3aXRoIDB4Zjh4eCDigJQgb3ZlcmxhcCBpcyBjdXJyZW50bHkgaW1wb3NzaWJsZS5cbiAqXG4gKiBOb3RlOiBUaGUgV1Agc3RyaXBzIHRoZSAnMHgnIHByZWZpeCBmcm9tIHNlcmlhbGl6ZWRUeEhleCBiZWZvcmUgc3RvcmluZyxcbiAqIHNvIHdlIGNoZWNrIGZvciAnMDAwMCcgbm90ICcweDAwMDAnLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNBdmFsYW5jaGVBdG9taWNUeCh1bnNpZ25lZFR4OiBTaWduYWJsZVRyYW5zYWN0aW9uKTogYm9vbGVhbiB7XG4gIHJldHVybiB1bnNpZ25lZFR4LnNlcmlhbGl6ZWRUeEhleC5zdGFydHNXaXRoKCcwMDAwJyk7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBzaG91bGRVc2VQcmVIYXNoZWRTaWduYWJsZShjb2luOiBJQmFzZUNvaW4sIHVuc2lnbmVkVHg6IFNpZ25hYmxlVHJhbnNhY3Rpb24pOiBib29sZWFuIHtcbiAgcmV0dXJuIGlzQ29pbldpdGhQcmVIYXNoZWRTaWduYWJsZShjb2luKSAmJiBjb2luLmlzU2lnbmFibGVQcmVIYXNoZWQodW5zaWduZWRUeCk7XG59XG4iXX0=

package/dist/src/bitgo/utils/tss/recipientUtils.d.ts

@@ -0,0 +1,42 @@
+import { TransactionParams } from '../../baseCoin';
+import { TxRequest } from './baseTypes';
+/**
+ * Transaction types that legitimately carry no explicit recipients.
+ * These are the intentType strings as stored in TxRequest.intent.intentType by WP.
+ * verifyTransaction handles no-recipient validation for these internally.
+ * Mirrors the bypass list in abstractEthLikeNewCoins.ts verifyTssTransaction.
+ *
+ * ECDSA types: acceleration, fillNonce, transferToken, tokenApproval, consolidate,
+ *              bridgeFunds, enableToken, customTx, wrapApprove, wrap, unwrap,
+ *              finalizeUnwrap, contractCall
+ * BSC/BNB delegation-based staking: delegate, undelegate, switchValidator
+ * CELO/ETH lock-based staking: stake, unstake, stakeWithCallData, unstakeWithCallData,
+ *              transferStake, increaseStake, goUnstake
+ * Claim rewards (BSC, CELO — TRX/SOL use EdDSA and are unaffected): claim, stakeClaimRewards
+ */
+export declare const NO_RECIPIENT_TX_TYPES: Set<string>;
+/**
+ * Resolves the effective txParams for TSS signing recipient verification.
+ *
+ * For smart contract interactions, recipients live in txRequest.intent.recipients
+ * (native amount = 0, so buildParams is empty). Falls back to intent recipients
+ * mapped to ITransactionRecipient shape when txParams.recipients is absent.
+ *
+ * tokenName is derived from tokenData.tokenName when present, otherwise from
+ * amount.symbol when chainName is provided and symbol differs from it.
+ *
+ * Staking intents (BSC delegate/undelegate, CELO stake/unstake, etc.) are
+ * identified generically by the presence of `stakingRequestId` on the intent —
+ * a required field on BaseStakeIntent in @bitgo/public-types. These intents
+ * have no txParams recipients by design; validation is done at the coin layer.
+ *
+ * Throws InvalidTransactionError if no recipients can be resolved and the
+ * transaction is not a known no-recipient type.
+ *
+ * @param txRequest - the transaction request containing the persisted intent
+ * @param txParams - the caller-supplied transaction parameters (may be undefined)
+ * @param chainName - the base chain name (e.g. 'sol', 'tsol') used to exclude
+ *   native-coin transfers from tokenName; pass baseCoin.getChain()
+ */
+export declare function resolveEffectiveTxParams(txRequest: TxRequest, txParams: TransactionParams | undefined, chainName?: string): TransactionParams;
+//# sourceMappingURL=recipientUtils.d.ts.map

package/dist/src/bitgo/utils/tss/recipientUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipientUtils.d.ts","sourceRoot":"","sources":["../../../../../src/bitgo/utils/tss/recipientUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAmB,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,aAsFhC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,SAAS,CAAC,EAAE,MAAM,GACjB,iBAAiB,CAwEnB"}

package/dist/src/bitgo/utils/tss/recipientUtils.js

@@ -0,0 +1,179 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_RECIPIENT_TX_TYPES = void 0;
+exports.resolveEffectiveTxParams = resolveEffectiveTxParams;
+const errors_1 = require("../../errors");
+/**
+ * Transaction types that legitimately carry no explicit recipients.
+ * These are the intentType strings as stored in TxRequest.intent.intentType by WP.
+ * verifyTransaction handles no-recipient validation for these internally.
+ * Mirrors the bypass list in abstractEthLikeNewCoins.ts verifyTssTransaction.
+ *
+ * ECDSA types: acceleration, fillNonce, transferToken, tokenApproval, consolidate,
+ *              bridgeFunds, enableToken, customTx, wrapApprove, wrap, unwrap,
+ *              finalizeUnwrap, contractCall
+ * BSC/BNB delegation-based staking: delegate, undelegate, switchValidator
+ * CELO/ETH lock-based staking: stake, unstake, stakeWithCallData, unstakeWithCallData,
+ *              transferStake, increaseStake, goUnstake
+ * Claim rewards (BSC, CELO — TRX/SOL use EdDSA and are unaffected): claim, stakeClaimRewards
+ */
+exports.NO_RECIPIENT_TX_TYPES = new Set([
+    // ECDSA types
+    'acceleration',
+    'fillNonce',
+    'transferToken',
+    'tokenApproval',
+    'consolidate',
+    'bridgeFunds',
+    'enableToken',
+    'enabletoken',
+    'disableToken',
+    'disabletoken',
+    'customTx',
+    // DeFi vault operations — recipients/calldata built server-side from defiParams
+    'defiApprove',
+    'defiDeposit',
+    'defiWithdraw',
+    // Native wrap/unwrap (WETH9 deposit()/withdraw()) — calldata and the WETH9
+    // address are resolved server-side from the vault binding, so no recipients.
+    // Registered in BOTH spellings on purpose: this set is matched against
+    // txParams.type, which is buildParams.type (camelCase, from wallet.sendMany),
+    // AND against intent.intentType (kebab-case, as WP persists it). Signing paths
+    // that carry no txParams — notably pendingApproval.approve() →
+    // recreateTxRequest() → signTxRequest() with no txParams — only ever see the
+    // kebab-case spelling.
+    'wrapNative',
+    'wrap-native',
+    'unwrapNative',
+    'unwrap-native',
+    // ERC-7984 shield/unshield: approve/wrap/unwrap calldata is built server-side from the
+    // intent, and finalizeUnwrap txnReqs are WP-created at READY_TO_FINALIZE (client signs
+    // only) — none carry SDK-level recipients.
+    'wrapApprove',
+    'wrap',
+    'unwrap',
+    'finalizeUnwrap',
+    // Smart contract invocations with no explicit SDK-level recipients
+    'contractCall',
+    // BSC/BNB delegation-based staking — intentType strings from TxRequest.intent.intentType.
+    // Note: SOL solDelegateIntent also uses intentType "delegate".
+    'delegate',
+    'undelegate',
+    'switchValidator',
+    // CELO/ETH lock-based staking
+    'stake',
+    'unstake',
+    'stakeWithCallData',
+    'unstakeWithCallData',
+    'transferStake',
+    'increaseStake',
+    'goUnstake',
+    // Claim rewards — BSC and CELO (TRX/SOL/Cosmos use EdDSA, not affected by this guard)
+    'claim',
+    'stakeClaimRewards',
+    'createAccount',
+    // Canton operations with no SDK-level recipients. Canton.verifyTransaction validates these from the transaction itself.
+    'transferAccept',
+    'transferReject',
+    'transferOfferWithdrawn',
+    'cosignDelegationAccept',
+    'allocationAllocate',
+    'allocationOfferWithdrawn',
+    'cantonCommand',
+    'cantonEndInvestorOnboardingOffer',
+    'cantonEndInvestorOnboardingAccept',
+    'cantonEndInvestorOnboardingReject',
+    'cantonParticipantOnboardingRequest',
+    'pledge',
+    // Avalanche / Flare cross-chain atomic imports — recipients are not supplied
+    // by the client because the import consumes UTXOs already owned by the
+    // wallet; the destination address is the wallet itself. WP issues these
+    // with intentType 'import' (P-chain) or 'importtoc' (C-chain).
+    'import',
+    'importtoc',
+    // SOL: deactivate stake account — no on-chain transfer recipient.
+    'deactivate',
+    // SOL: authorize stake account — no transfer recipient.
+    'authorize',
+]);
+/**
+ * Resolves the effective txParams for TSS signing recipient verification.
+ *
+ * For smart contract interactions, recipients live in txRequest.intent.recipients
+ * (native amount = 0, so buildParams is empty). Falls back to intent recipients
+ * mapped to ITransactionRecipient shape when txParams.recipients is absent.
+ *
+ * tokenName is derived from tokenData.tokenName when present, otherwise from
+ * amount.symbol when chainName is provided and symbol differs from it.
+ *
+ * Staking intents (BSC delegate/undelegate, CELO stake/unstake, etc.) are
+ * identified generically by the presence of `stakingRequestId` on the intent —
+ * a required field on BaseStakeIntent in @bitgo/public-types. These intents
+ * have no txParams recipients by design; validation is done at the coin layer.
+ *
+ * Throws InvalidTransactionError if no recipients can be resolved and the
+ * transaction is not a known no-recipient type.
+ *
+ * @param txRequest - the transaction request containing the persisted intent
+ * @param txParams - the caller-supplied transaction parameters (may be undefined)
+ * @param chainName - the base chain name (e.g. 'sol', 'tsol') used to exclude
+ *   native-coin transfers from tokenName; pass baseCoin.getChain()
+ */
+function resolveEffectiveTxParams(txRequest, txParams, chainName) {
+    const intentRecipients = txRequest.intent?.recipients?.map((intentRecipient) => {
+        // Prefer tokenData.tokenName; fall back to amount.symbol when chainName is
+        // provided and differs from it. When absent, skip the symbol fallback.
+        const { symbol } = intentRecipient.amount;
+        const tokenName = intentRecipient.tokenData?.tokenName ||
+            (chainName !== undefined && symbol && symbol !== chainName ? symbol : undefined);
+        return {
+            address: intentRecipient.address.address,
+            amount: intentRecipient.amount.value,
+            data: intentRecipient.data,
+            ...(tokenName && { tokenName }),
+        };
+    });
+    const effectiveTxParams = {
+        ...txParams,
+        recipients: txParams?.recipients?.length ? txParams.recipients : intentRecipients,
+    };
+    // Fall back to intent.intentType when txParams.type is not explicitly set.
+    // Staking wallets call signTransaction without txParams, so the type lives only in the intent.
+    const txType = effectiveTxParams.type ?? txRequest.intent?.intentType ?? '';
+    // Propagate the resolved type so downstream callers
+    if (!effectiveTxParams.type && txType) {
+        effectiveTxParams.type = txType;
+    }
+    // Propagate stakingRequestId from intent into effectiveTxParams so verifyTssTransaction
+    // overrides can bypass the no-recipient guard without needing access to txRequest directly.
+    const intentStakingRequestId = txRequest.intent?.stakingRequestId;
+    if (intentStakingRequestId && !effectiveTxParams.stakingRequestId) {
+        effectiveTxParams.stakingRequestId = intentStakingRequestId;
+    }
+    // Propagate the ERC-7984 shield params from the persisted intent. Signing paths that carry no
+    // txParams (pendingApproval.approve() -> recreateTxRequest() -> signTxRequest()) would otherwise reach
+    // the coin verifier without wrapParams, and the wrapApprove calldata check would reject valid bytes.
+    // WP flattens wrapParams into intent.tokenName / intent.amount (see mpcUtils.createIntent).
+    const intent = txRequest.intent;
+    if (!effectiveTxParams.wrapParams &&
+        (intent?.intentType === 'wrapApprove' || intent?.intentType === 'wrap') &&
+        typeof intent.tokenName === 'string' &&
+        typeof intent.amount === 'string') {
+        effectiveTxParams.wrapParams = { tokenName: intent.tokenName, amount: intent.amount };
+    }
+    // All staking intents (BSC delegate/undelegate, CELO stake/unstake, etc.) carry
+    // stakingRequestId as a required field on BaseStakeIntent (@bitgo/public-types).
+    // Use its presence as a generic staking signal — no need to enumerate every intentType.
+    const isStakingIntent = !!txRequest.intent?.stakingRequestId;
+    // buildParams.type from the wallet UI is PascalCase ('Import'); intent.intentType from WP
+    // is lowercase ('import'). Either may be the source of truth depending on the signing path.
+    const intentType = txRequest.intent?.intentType ?? '';
+    if (!effectiveTxParams.recipients?.length &&
+        !isStakingIntent &&
+        !exports.NO_RECIPIENT_TX_TYPES.has(txType) &&
+        !exports.NO_RECIPIENT_TX_TYPES.has(intentType)) {
+        throw new errors_1.InvalidTransactionError('Recipient details are required to verify this transaction before signing. Pass txParams with at least one recipient.');
+    }
+    return effectiveTxParams;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjaXBpZW50VXRpbHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYml0Z28vdXRpbHMvdHNzL3JlY2lwaWVudFV0aWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWlJQSw0REE0RUM7QUE1TUQseUNBQXVEO0FBR3ZEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDVSxRQUFBLHFCQUFxQixHQUFHLElBQUksR0FBRyxDQUFDO0lBQzNDLGNBQWM7SUFDZCxjQUFjO0lBQ2QsV0FBVztJQUNYLGVBQWU7SUFDZixlQUFlO0lBQ2YsYUFBYTtJQUNiLGFBQWE7SUFDYixhQUFhO0lBQ2IsYUFBYTtJQUNiLGNBQWM7SUFDZCxjQUFjO0lBQ2QsVUFBVTtJQUNWLGdGQUFnRjtJQUNoRixhQUFhO0lBQ2IsYUFBYTtJQUNiLGNBQWM7SUFDZCwyRUFBMkU7SUFDM0UsNkVBQTZFO0lBQzdFLHVFQUF1RTtJQUN2RSw4RUFBOEU7SUFDOUUsK0VBQStFO0lBQy9FLCtEQUErRDtJQUMvRCw2RUFBNkU7SUFDN0UsdUJBQXVCO0lBQ3ZCLFlBQVk7SUFDWixhQUFhO0lBQ2IsY0FBYztJQUNkLGVBQWU7SUFDZix1RkFBdUY7SUFDdkYsdUZBQXVGO0lBQ3ZGLDJDQUEyQztJQUMzQyxhQUFhO0lBQ2IsTUFBTTtJQUNOLFFBQVE7SUFDUixnQkFBZ0I7SUFDaEIsbUVBQW1FO0lBQ25FLGNBQWM7SUFFZCwwRkFBMEY7SUFDMUYsK0RBQStEO0lBQy9ELFVBQVU7SUFDVixZQUFZO0lBQ1osaUJBQWlCO0lBRWpCLDhCQUE4QjtJQUM5QixPQUFPO0lBQ1AsU0FBUztJQUNULG1CQUFtQjtJQUNuQixxQkFBcUI7SUFDckIsZUFBZTtJQUNmLGVBQWU7SUFDZixXQUFXO0lBRVgsc0ZBQXNGO0lBQ3RGLE9BQU87SUFDUCxtQkFBbUI7SUFFbkIsZUFBZTtJQUNmLHdIQUF3SDtJQUN4SCxnQkFBZ0I7SUFDaEIsZ0JBQWdCO0lBQ2hCLHdCQUF3QjtJQUN4Qix3QkFBd0I7SUFDeEIsb0JBQW9CO0lBQ3BCLDBCQUEwQjtJQUMxQixlQUFlO0lBQ2Ysa0NBQWtDO0lBQ2xDLG1DQUFtQztJQUNuQyxtQ0FBbUM7SUFDbkMsb0NBQW9DO0lBRXBDLFFBQVE7SUFFUiw2RUFBNkU7SUFDN0UsdUVBQXVFO0lBQ3ZFLHdFQUF3RTtJQUN4RSwrREFBK0Q7SUFDL0QsUUFBUTtJQUNSLFdBQVc7SUFFWCxrRUFBa0U7SUFDbEUsWUFBWTtJQUVaLHdEQUF3RDtJQUN4RCxXQUFXO0NBQ1osQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FzQkc7QUFDSCxTQUFnQix3QkFBd0IsQ0FDdEMsU0FBb0IsRUFDcEIsUUFBdUMsRUFDdkMsU0FBa0I7SUFFbEIsTUFBTSxnQkFBZ0IsR0FBSSxTQUFTLENBQUMsTUFBMEIsRUFBRSxVQUFVLEVBQUUsR0FBRyxDQUFDLENBQUMsZUFBZSxFQUFFLEVBQUU7UUFDbEcsMkVBQTJFO1FBQzNFLHVFQUF1RTtRQUN2RSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsZUFBZSxDQUFDLE1BQU0sQ0FBQztRQUMxQyxNQUFNLFNBQVMsR0FDYixlQUFlLENBQUMsU0FBUyxFQUFFLFNBQVM7WUFDcEMsQ0FBQyxTQUFTLEtBQUssU0FBUyxJQUFJLE1BQU0sSUFBSSxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ25GLE9BQU87WUFDTCxPQUFPLEVBQUUsZUFBZSxDQUFDLE9BQU8sQ0FBQyxPQUFPO1lBQ3hDLE1BQU0sRUFBRSxlQUFlLENBQUMsTUFBTSxDQUFDLEtBQUs7WUFDcEMsSUFBSSxFQUFFLGVBQWUsQ0FBQyxJQUFJO1lBQzFCLEdBQUcsQ0FBQyxTQUFTLElBQUksRUFBRSxTQUFTLEVBQUUsQ0FBQztTQUNoQyxDQUFDO0lBQ0osQ0FBQyxDQUFDLENBQUM7SUFFSCxNQUFNLGlCQUFpQixHQUFzQjtRQUMzQyxHQUFHLFFBQVE7UUFDWCxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLGdCQUFnQjtLQUNsRixDQUFDO0lBRUYsMkVBQTJFO0lBQzNFLCtGQUErRjtJQUMvRixNQUFNLE1BQU0sR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLElBQUssU0FBUyxDQUFDLE1BQTBCLEVBQUUsVUFBVSxJQUFJLEVBQUUsQ0FBQztJQUVqRyxvREFBb0Q7SUFDcEQsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUN0QyxpQkFBaUIsQ0FBQyxJQUFJLEdBQUcsTUFBTSxDQUFDO0lBQ2xDLENBQUM7SUFFRCx3RkFBd0Y7SUFDeEYsNEZBQTRGO0lBQzVGLE1BQU0sc0JBQXNCLEdBQUksU0FBUyxDQUFDLE1BQTBCLEVBQUUsZ0JBQWdCLENBQUM7SUFDdkYsSUFBSSxzQkFBc0IsSUFBSSxDQUFDLGlCQUFpQixDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDbEUsaUJBQWlCLENBQUMsZ0JBQWdCLEdBQUcsc0JBQXNCLENBQUM7SUFDOUQsQ0FBQztJQUVELDhGQUE4RjtJQUM5Rix1R0FBdUc7SUFDdkcscUdBQXFHO0lBQ3JHLDRGQUE0RjtJQUM1RixNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsTUFBeUIsQ0FBQztJQUNuRCxJQUNFLENBQUMsaUJBQWlCLENBQUMsVUFBVTtRQUM3QixDQUFDLE1BQU0sRUFBRSxVQUFVLEtBQUssYUFBYSxJQUFJLE1BQU0sRUFBRSxVQUFVLEtBQUssTUFBTSxDQUFDO1FBQ3ZFLE9BQU8sTUFBTSxDQUFDLFNBQVMsS0FBSyxRQUFRO1FBQ3BDLE9BQU8sTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRLEVBQ2pDLENBQUM7UUFDRCxpQkFBaUIsQ0FBQyxVQUFVLEdBQUcsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3hGLENBQUM7SUFFRCxnRkFBZ0Y7SUFDaEYsaUZBQWlGO0lBQ2pGLHdGQUF3RjtJQUN4RixNQUFNLGVBQWUsR0FBRyxDQUFDLENBQUUsU0FBUyxDQUFDLE1BQTBCLEVBQUUsZ0JBQWdCLENBQUM7SUFFbEYsMEZBQTBGO0lBQzFGLDRGQUE0RjtJQUM1RixNQUFNLFVBQVUsR0FBSSxTQUFTLENBQUMsTUFBMEIsRUFBRSxVQUFVLElBQUksRUFBRSxDQUFDO0lBRTNFLElBQ0UsQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLEVBQUUsTUFBTTtRQUNyQyxDQUFDLGVBQWU7UUFDaEIsQ0FBQyw2QkFBcUIsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDO1FBQ2xDLENBQUMsNkJBQXFCLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUN0QyxDQUFDO1FBQ0QsTUFBTSxJQUFJLGdDQUF1QixDQUMvQixzSEFBc0gsQ0FDdkgsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPLGlCQUFpQixDQUFDO0FBQzNCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBUcmFuc2FjdGlvblBhcmFtcyB9IGZyb20gJy4uLy4uL2Jhc2VDb2luJztcbmltcG9ydCB7IEludmFsaWRUcmFuc2FjdGlvbkVycm9yIH0gZnJvbSAnLi4vLi4vZXJyb3JzJztcbmltcG9ydCB7IFBvcHVsYXRlZEludGVudCwgVHhSZXF1ZXN0IH0gZnJvbSAnLi9iYXNlVHlwZXMnO1xuXG4vKipcbiAqIFRyYW5zYWN0aW9uIHR5cGVzIHRoYXQgbGVnaXRpbWF0ZWx5IGNhcnJ5IG5vIGV4cGxpY2l0IHJlY2lwaWVudHMuXG4gKiBUaGVzZSBhcmUgdGhlIGludGVudFR5cGUgc3RyaW5ncyBhcyBzdG9yZWQgaW4gVHhSZXF1ZXN0LmludGVudC5pbnRlbnRUeXBlIGJ5IFdQLlxuICogdmVyaWZ5VHJhbnNhY3Rpb24gaGFuZGxlcyBuby1yZWNpcGllbnQgdmFsaWRhdGlvbiBmb3IgdGhlc2UgaW50ZXJuYWxseS5cbiAqIE1pcnJvcnMgdGhlIGJ5cGFzcyBsaXN0IGluIGFic3RyYWN0RXRoTGlrZU5ld0NvaW5zLnRzIHZlcmlmeVRzc1RyYW5zYWN0aW9uLlxuICpcbiAqIEVDRFNBIHR5cGVzOiBhY2NlbGVyYXRpb24sIGZpbGxOb25jZSwgdHJhbnNmZXJUb2tlbiwgdG9rZW5BcHByb3ZhbCwgY29uc29saWRhdGUsXG4gKiAgICAgICAgICAgICAgYnJpZGdlRnVuZHMsIGVuYWJsZVRva2VuLCBjdXN0b21UeCwgd3JhcEFwcHJvdmUsIHdyYXAsIHVud3JhcCxcbiAqICAgICAgICAgICAgICBmaW5hbGl6ZVVud3JhcCwgY29udHJhY3RDYWxsXG4gKiBCU0MvQk5CIGRlbGVnYXRpb24tYmFzZWQgc3Rha2luZzogZGVsZWdhdGUsIHVuZGVsZWdhdGUsIHN3aXRjaFZhbGlkYXRvclxuICogQ0VMTy9FVEggbG9jay1iYXNlZCBzdGFraW5nOiBzdGFrZSwgdW5zdGFrZSwgc3Rha2VXaXRoQ2FsbERhdGEsIHVuc3Rha2VXaXRoQ2FsbERhdGEsXG4gKiAgICAgICAgICAgICAgdHJhbnNmZXJTdGFrZSwgaW5jcmVhc2VTdGFrZSwgZ29VbnN0YWtlXG4gKiBDbGFpbSByZXdhcmRzIChCU0MsIENFTE8g4oCUIFRSWC9TT0wgdXNlIEVkRFNBIGFuZCBhcmUgdW5hZmZlY3RlZCk6IGNsYWltLCBzdGFrZUNsYWltUmV3YXJkc1xuICovXG5leHBvcnQgY29uc3QgTk9fUkVDSVBJRU5UX1RYX1RZUEVTID0gbmV3IFNldChbXG4gIC8vIEVDRFNBIHR5cGVzXG4gICdhY2NlbGVyYXRpb24nLFxuICAnZmlsbE5vbmNlJyxcbiAgJ3RyYW5zZmVyVG9rZW4nLFxuICAndG9rZW5BcHByb3ZhbCcsXG4gICdjb25zb2xpZGF0ZScsXG4gICdicmlkZ2VGdW5kcycsXG4gICdlbmFibGVUb2tlbicsXG4gICdlbmFibGV0b2tlbicsXG4gICdkaXNhYmxlVG9rZW4nLFxuICAnZGlzYWJsZXRva2VuJyxcbiAgJ2N1c3RvbVR4JyxcbiAgLy8gRGVGaSB2YXVsdCBvcGVyYXRpb25zIOKAlCByZWNpcGllbnRzL2NhbGxkYXRhIGJ1aWx0IHNlcnZlci1zaWRlIGZyb20gZGVmaVBhcmFtc1xuICAnZGVmaUFwcHJvdmUnLFxuICAnZGVmaURlcG9zaXQnLFxuICAnZGVmaVdpdGhkcmF3JyxcbiAgLy8gTmF0aXZlIHdyYXAvdW53cmFwIChXRVRIOSBkZXBvc2l0KCkvd2l0aGRyYXcoKSkg4oCUIGNhbGxkYXRhIGFuZCB0aGUgV0VUSDlcbiAgLy8gYWRkcmVzcyBhcmUgcmVzb2x2ZWQgc2VydmVyLXNpZGUgZnJvbSB0aGUgdmF1bHQgYmluZGluZywgc28gbm8gcmVjaXBpZW50cy5cbiAgLy8gUmVnaXN0ZXJlZCBpbiBCT1RIIHNwZWxsaW5ncyBvbiBwdXJwb3NlOiB0aGlzIHNldCBpcyBtYXRjaGVkIGFnYWluc3RcbiAgLy8gdHhQYXJhbXMudHlwZSwgd2hpY2ggaXMgYnVpbGRQYXJhbXMudHlwZSAoY2FtZWxDYXNlLCBmcm9tIHdhbGxldC5zZW5kTWFueSksXG4gIC8vIEFORCBhZ2FpbnN0IGludGVudC5pbnRlbnRUeXBlIChrZWJhYi1jYXNlLCBhcyBXUCBwZXJzaXN0cyBpdCkuIFNpZ25pbmcgcGF0aHNcbiAgLy8gdGhhdCBjYXJyeSBubyB0eFBhcmFtcyDigJQgbm90YWJseSBwZW5kaW5nQXBwcm92YWwuYXBwcm92ZSgpIOKGklxuICAvLyByZWNyZWF0ZVR4UmVxdWVzdCgpIOKGkiBzaWduVHhSZXF1ZXN0KCkgd2l0aCBubyB0eFBhcmFtcyDigJQgb25seSBldmVyIHNlZSB0aGVcbiAgLy8ga2ViYWItY2FzZSBzcGVsbGluZy5cbiAgJ3dyYXBOYXRpdmUnLFxuICAnd3JhcC1uYXRpdmUnLFxuICAndW53cmFwTmF0aXZlJyxcbiAgJ3Vud3JhcC1uYXRpdmUnLFxuICAvLyBFUkMtNzk4NCBzaGllbGQvdW5zaGllbGQ6IGFwcHJvdmUvd3JhcC91bndyYXAgY2FsbGRhdGEgaXMgYnVpbHQgc2VydmVyLXNpZGUgZnJvbSB0aGVcbiAgLy8gaW50ZW50LCBhbmQgZmluYWxpemVVbndyYXAgdHhuUmVxcyBhcmUgV1AtY3JlYXRlZCBhdCBSRUFEWV9UT19GSU5BTElaRSAoY2xpZW50IHNpZ25zXG4gIC8vIG9ubHkpIOKAlCBub25lIGNhcnJ5IFNESy1sZXZlbCByZWNpcGllbnRzLlxuICAnd3JhcEFwcHJvdmUnLFxuICAnd3JhcCcsXG4gICd1bndyYXAnLFxuICAnZmluYWxpemVVbndyYXAnLFxuICAvLyBTbWFydCBjb250cmFjdCBpbnZvY2F0aW9ucyB3aXRoIG5vIGV4cGxpY2l0IFNESy1sZXZlbCByZWNpcGllbnRzXG4gICdjb250cmFjdENhbGwnLFxuXG4gIC8vIEJTQy9CTkIgZGVsZWdhdGlvbi1iYXNlZCBzdGFraW5nIOKAlCBpbnRlbnRUeXBlIHN0cmluZ3MgZnJvbSBUeFJlcXVlc3QuaW50ZW50LmludGVudFR5cGUuXG4gIC8vIE5vdGU6IFNPTCBzb2xEZWxlZ2F0ZUludGVudCBhbHNvIHVzZXMgaW50ZW50VHlwZSBcImRlbGVnYXRlXCIuXG4gICdkZWxlZ2F0ZScsXG4gICd1bmRlbGVnYXRlJyxcbiAgJ3N3aXRjaFZhbGlkYXRvcicsXG5cbiAgLy8gQ0VMTy9FVEggbG9jay1iYXNlZCBzdGFraW5nXG4gICdzdGFrZScsXG4gICd1bnN0YWtlJyxcbiAgJ3N0YWtlV2l0aENhbGxEYXRhJyxcbiAgJ3Vuc3Rha2VXaXRoQ2FsbERhdGEnLFxuICAndHJhbnNmZXJTdGFrZScsXG4gICdpbmNyZWFzZVN0YWtlJyxcbiAgJ2dvVW5zdGFrZScsXG5cbiAgLy8gQ2xhaW0gcmV3YXJkcyDigJQgQlNDIGFuZCBDRUxPIChUUlgvU09ML0Nvc21vcyB1c2UgRWREU0EsIG5vdCBhZmZlY3RlZCBieSB0aGlzIGd1YXJkKVxuICAnY2xhaW0nLFxuICAnc3Rha2VDbGFpbVJld2FyZHMnLFxuXG4gICdjcmVhdGVBY2NvdW50JyxcbiAgLy8gQ2FudG9uIG9wZXJhdGlvbnMgd2l0aCBubyBTREstbGV2ZWwgcmVjaXBpZW50cy4gQ2FudG9uLnZlcmlmeVRyYW5zYWN0aW9uIHZhbGlkYXRlcyB0aGVzZSBmcm9tIHRoZSB0cmFuc2FjdGlvbiBpdHNlbGYuXG4gICd0cmFuc2ZlckFjY2VwdCcsXG4gICd0cmFuc2ZlclJlamVjdCcsXG4gICd0cmFuc2Zlck9mZmVyV2l0aGRyYXduJyxcbiAgJ2Nvc2lnbkRlbGVnYXRpb25BY2NlcHQnLFxuICAnYWxsb2NhdGlvbkFsbG9jYXRlJyxcbiAgJ2FsbG9jYXRpb25PZmZlcldpdGhkcmF3bicsXG4gICdjYW50b25Db21tYW5kJyxcbiAgJ2NhbnRvbkVuZEludmVzdG9yT25ib2FyZGluZ09mZmVyJyxcbiAgJ2NhbnRvbkVuZEludmVzdG9yT25ib2FyZGluZ0FjY2VwdCcsXG4gICdjYW50b25FbmRJbnZlc3Rvck9uYm9hcmRpbmdSZWplY3QnLFxuICAnY2FudG9uUGFydGljaXBhbnRPbmJvYXJkaW5nUmVxdWVzdCcsXG5cbiAgJ3BsZWRnZScsXG5cbiAgLy8gQXZhbGFuY2hlIC8gRmxhcmUgY3Jvc3MtY2hhaW4gYXRvbWljIGltcG9ydHMg4oCUIHJlY2lwaWVudHMgYXJlIG5vdCBzdXBwbGllZFxuICAvLyBieSB0aGUgY2xpZW50IGJlY2F1c2UgdGhlIGltcG9ydCBjb25zdW1lcyBVVFhPcyBhbHJlYWR5IG93bmVkIGJ5IHRoZVxuICAvLyB3YWxsZXQ7IHRoZSBkZXN0aW5hdGlvbiBhZGRyZXNzIGlzIHRoZSB3YWxsZXQgaXRzZWxmLiBXUCBpc3N1ZXMgdGhlc2VcbiAgLy8gd2l0aCBpbnRlbnRUeXBlICdpbXBvcnQnIChQLWNoYWluKSBvciAnaW1wb3J0dG9jJyAoQy1jaGFpbikuXG4gICdpbXBvcnQnLFxuICAnaW1wb3J0dG9jJyxcblxuICAvLyBTT0w6IGRlYWN0aXZhdGUgc3Rha2UgYWNjb3VudCDigJQgbm8gb24tY2hhaW4gdHJhbnNmZXIgcmVjaXBpZW50LlxuICAnZGVhY3RpdmF0ZScsXG5cbiAgLy8gU09MOiBhdXRob3JpemUgc3Rha2UgYWNjb3VudCDigJQgbm8gdHJhbnNmZXIgcmVjaXBpZW50LlxuICAnYXV0aG9yaXplJyxcbl0pO1xuXG4vKipcbiAqIFJlc29sdmVzIHRoZSBlZmZlY3RpdmUgdHhQYXJhbXMgZm9yIFRTUyBzaWduaW5nIHJlY2lwaWVudCB2ZXJpZmljYXRpb24uXG4gKlxuICogRm9yIHNtYXJ0IGNvbnRyYWN0IGludGVyYWN0aW9ucywgcmVjaXBpZW50cyBsaXZlIGluIHR4UmVxdWVzdC5pbnRlbnQucmVjaXBpZW50c1xuICogKG5hdGl2ZSBhbW91bnQgPSAwLCBzbyBidWlsZFBhcmFtcyBpcyBlbXB0eSkuIEZhbGxzIGJhY2sgdG8gaW50ZW50IHJlY2lwaWVudHNcbiAqIG1hcHBlZCB0byBJVHJhbnNhY3Rpb25SZWNpcGllbnQgc2hhcGUgd2hlbiB0eFBhcmFtcy5yZWNpcGllbnRzIGlzIGFic2VudC5cbiAqXG4gKiB0b2tlbk5hbWUgaXMgZGVyaXZlZCBmcm9tIHRva2VuRGF0YS50b2tlbk5hbWUgd2hlbiBwcmVzZW50LCBvdGhlcndpc2UgZnJvbVxuICogYW1vdW50LnN5bWJvbCB3aGVuIGNoYWluTmFtZSBpcyBwcm92aWRlZCBhbmQgc3ltYm9sIGRpZmZlcnMgZnJvbSBpdC5cbiAqXG4gKiBTdGFraW5nIGludGVudHMgKEJTQyBkZWxlZ2F0ZS91bmRlbGVnYXRlLCBDRUxPIHN0YWtlL3Vuc3Rha2UsIGV0Yy4pIGFyZVxuICogaWRlbnRpZmllZCBnZW5lcmljYWxseSBieSB0aGUgcHJlc2VuY2Ugb2YgYHN0YWtpbmdSZXF1ZXN0SWRgIG9uIHRoZSBpbnRlbnQg4oCUXG4gKiBhIHJlcXVpcmVkIGZpZWxkIG9uIEJhc2VTdGFrZUludGVudCBpbiBAYml0Z28vcHVibGljLXR5cGVzLiBUaGVzZSBpbnRlbnRzXG4gKiBoYXZlIG5vIHR4UGFyYW1zIHJlY2lwaWVudHMgYnkgZGVzaWduOyB2YWxpZGF0aW9uIGlzIGRvbmUgYXQgdGhlIGNvaW4gbGF5ZXIuXG4gKlxuICogVGhyb3dzIEludmFsaWRUcmFuc2FjdGlvbkVycm9yIGlmIG5vIHJlY2lwaWVudHMgY2FuIGJlIHJlc29sdmVkIGFuZCB0aGVcbiAqIHRyYW5zYWN0aW9uIGlzIG5vdCBhIGtub3duIG5vLXJlY2lwaWVudCB0eXBlLlxuICpcbiAqIEBwYXJhbSB0eFJlcXVlc3QgLSB0aGUgdHJhbnNhY3Rpb24gcmVxdWVzdCBjb250YWluaW5nIHRoZSBwZXJzaXN0ZWQgaW50ZW50XG4gKiBAcGFyYW0gdHhQYXJhbXMgLSB0aGUgY2FsbGVyLXN1cHBsaWVkIHRyYW5zYWN0aW9uIHBhcmFtZXRlcnMgKG1heSBiZSB1bmRlZmluZWQpXG4gKiBAcGFyYW0gY2hhaW5OYW1lIC0gdGhlIGJhc2UgY2hhaW4gbmFtZSAoZS5nLiAnc29sJywgJ3Rzb2wnKSB1c2VkIHRvIGV4Y2x1ZGVcbiAqICAgbmF0aXZlLWNvaW4gdHJhbnNmZXJzIGZyb20gdG9rZW5OYW1lOyBwYXNzIGJhc2VDb2luLmdldENoYWluKClcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc29sdmVFZmZlY3RpdmVUeFBhcmFtcyhcbiAgdHhSZXF1ZXN0OiBUeFJlcXVlc3QsXG4gIHR4UGFyYW1zOiBUcmFuc2FjdGlvblBhcmFtcyB8IHVuZGVmaW5lZCxcbiAgY2hhaW5OYW1lPzogc3RyaW5nXG4pOiBUcmFuc2FjdGlvblBhcmFtcyB7XG4gIGNvbnN0IGludGVudFJlY2lwaWVudHMgPSAodHhSZXF1ZXN0LmludGVudCBhcyBQb3B1bGF0ZWRJbnRlbnQpPy5yZWNpcGllbnRzPy5tYXAoKGludGVudFJlY2lwaWVudCkgPT4ge1xuICAgIC8vIFByZWZlciB0b2tlbkRhdGEudG9rZW5OYW1lOyBmYWxsIGJhY2sgdG8gYW1vdW50LnN5bWJvbCB3aGVuIGNoYWluTmFtZSBpc1xuICAgIC8vIHByb3ZpZGVkIGFuZCBkaWZmZXJzIGZyb20gaXQuIFdoZW4gYWJzZW50LCBza2lwIHRoZSBzeW1ib2wgZmFsbGJhY2suXG4gICAgY29uc3QgeyBzeW1ib2wgfSA9IGludGVudFJlY2lwaWVudC5hbW91bnQ7XG4gICAgY29uc3QgdG9rZW5OYW1lID1cbiAgICAgIGludGVudFJlY2lwaWVudC50b2tlbkRhdGE/LnRva2VuTmFtZSB8fFxuICAgICAgKGNoYWluTmFtZSAhPT0gdW5kZWZpbmVkICYmIHN5bWJvbCAmJiBzeW1ib2wgIT09IGNoYWluTmFtZSA/IHN5bWJvbCA6IHVuZGVmaW5lZCk7XG4gICAgcmV0dXJuIHtcbiAgICAgIGFkZHJlc3M6IGludGVudFJlY2lwaWVudC5hZGRyZXNzLmFkZHJlc3MsXG4gICAgICBhbW91bnQ6IGludGVudFJlY2lwaWVudC5hbW91bnQudmFsdWUsXG4gICAgICBkYXRhOiBpbnRlbnRSZWNpcGllbnQuZGF0YSxcbiAgICAgIC4uLih0b2tlbk5hbWUgJiYgeyB0b2tlbk5hbWUgfSksXG4gICAgfTtcbiAgfSk7XG5cbiAgY29uc3QgZWZmZWN0aXZlVHhQYXJhbXM6IFRyYW5zYWN0aW9uUGFyYW1zID0ge1xuICAgIC4uLnR4UGFyYW1zLFxuICAgIHJlY2lwaWVudHM6IHR4UGFyYW1zPy5yZWNpcGllbnRzPy5sZW5ndGggPyB0eFBhcmFtcy5yZWNpcGllbnRzIDogaW50ZW50UmVjaXBpZW50cyxcbiAgfTtcblxuICAvLyBGYWxsIGJhY2sgdG8gaW50ZW50LmludGVudFR5cGUgd2hlbiB0eFBhcmFtcy50eXBlIGlzIG5vdCBleHBsaWNpdGx5IHNldC5cbiAgLy8gU3Rha2luZyB3YWxsZXRzIGNhbGwgc2lnblRyYW5zYWN0aW9uIHdpdGhvdXQgdHhQYXJhbXMsIHNvIHRoZSB0eXBlIGxpdmVzIG9ubHkgaW4gdGhlIGludGVudC5cbiAgY29uc3QgdHhUeXBlID0gZWZmZWN0aXZlVHhQYXJhbXMudHlwZSA/PyAodHhSZXF1ZXN0LmludGVudCBhcyBQb3B1bGF0ZWRJbnRlbnQpPy5pbnRlbnRUeXBlID8/ICcnO1xuXG4gIC8vIFByb3BhZ2F0ZSB0aGUgcmVzb2x2ZWQgdHlwZSBzbyBkb3duc3RyZWFtIGNhbGxlcnNcbiAgaWYgKCFlZmZlY3RpdmVUeFBhcmFtcy50eXBlICYmIHR4VHlwZSkge1xuICAgIGVmZmVjdGl2ZVR4UGFyYW1zLnR5cGUgPSB0eFR5cGU7XG4gIH1cblxuICAvLyBQcm9wYWdhdGUgc3Rha2luZ1JlcXVlc3RJZCBmcm9tIGludGVudCBpbnRvIGVmZmVjdGl2ZVR4UGFyYW1zIHNvIHZlcmlmeVRzc1RyYW5zYWN0aW9uXG4gIC8vIG92ZXJyaWRlcyBjYW4gYnlwYXNzIHRoZSBuby1yZWNpcGllbnQgZ3VhcmQgd2l0aG91dCBuZWVkaW5nIGFjY2VzcyB0byB0eFJlcXVlc3QgZGlyZWN0bHkuXG4gIGNvbnN0IGludGVudFN0YWtpbmdSZXF1ZXN0SWQgPSAodHhSZXF1ZXN0LmludGVudCBhcyBQb3B1bGF0ZWRJbnRlbnQpPy5zdGFraW5nUmVxdWVzdElkO1xuICBpZiAoaW50ZW50U3Rha2luZ1JlcXVlc3RJZCAmJiAhZWZmZWN0aXZlVHhQYXJhbXMuc3Rha2luZ1JlcXVlc3RJZCkge1xuICAgIGVmZmVjdGl2ZVR4UGFyYW1zLnN0YWtpbmdSZXF1ZXN0SWQgPSBpbnRlbnRTdGFraW5nUmVxdWVzdElkO1xuICB9XG5cbiAgLy8gUHJvcGFnYXRlIHRoZSBFUkMtNzk4NCBzaGllbGQgcGFyYW1zIGZyb20gdGhlIHBlcnNpc3RlZCBpbnRlbnQuIFNpZ25pbmcgcGF0aHMgdGhhdCBjYXJyeSBub1xuICAvLyB0eFBhcmFtcyAocGVuZGluZ0FwcHJvdmFsLmFwcHJvdmUoKSAtPiByZWNyZWF0ZVR4UmVxdWVzdCgpIC0+IHNpZ25UeFJlcXVlc3QoKSkgd291bGQgb3RoZXJ3aXNlIHJlYWNoXG4gIC8vIHRoZSBjb2luIHZlcmlmaWVyIHdpdGhvdXQgd3JhcFBhcmFtcywgYW5kIHRoZSB3cmFwQXBwcm92ZSBjYWxsZGF0YSBjaGVjayB3b3VsZCByZWplY3QgdmFsaWQgYnl0ZXMuXG4gIC8vIFdQIGZsYXR0ZW5zIHdyYXBQYXJhbXMgaW50byBpbnRlbnQudG9rZW5OYW1lIC8gaW50ZW50LmFtb3VudCAoc2VlIG1wY1V0aWxzLmNyZWF0ZUludGVudCkuXG4gIGNvbnN0IGludGVudCA9IHR4UmVxdWVzdC5pbnRlbnQgYXMgUG9wdWxhdGVkSW50ZW50O1xuICBpZiAoXG4gICAgIWVmZmVjdGl2ZVR4UGFyYW1zLndyYXBQYXJhbXMgJiZcbiAgICAoaW50ZW50Py5pbnRlbnRUeXBlID09PSAnd3JhcEFwcHJvdmUnIHx8IGludGVudD8uaW50ZW50VHlwZSA9PT0gJ3dyYXAnKSAmJlxuICAgIHR5cGVvZiBpbnRlbnQudG9rZW5OYW1lID09PSAnc3RyaW5nJyAmJlxuICAgIHR5cGVvZiBpbnRlbnQuYW1vdW50ID09PSAnc3RyaW5nJ1xuICApIHtcbiAgICBlZmZlY3RpdmVUeFBhcmFtcy53cmFwUGFyYW1zID0geyB0b2tlbk5hbWU6IGludGVudC50b2tlbk5hbWUsIGFtb3VudDogaW50ZW50LmFtb3VudCB9O1xuICB9XG5cbiAgLy8gQWxsIHN0YWtpbmcgaW50ZW50cyAoQlNDIGRlbGVnYXRlL3VuZGVsZWdhdGUsIENFTE8gc3Rha2UvdW5zdGFrZSwgZXRjLikgY2FycnlcbiAgLy8gc3Rha2luZ1JlcXVlc3RJZCBhcyBhIHJlcXVpcmVkIGZpZWxkIG9uIEJhc2VTdGFrZUludGVudCAoQGJpdGdvL3B1YmxpYy10eXBlcykuXG4gIC8vIFVzZSBpdHMgcHJlc2VuY2UgYXMgYSBnZW5lcmljIHN0YWtpbmcgc2lnbmFsIOKAlCBubyBuZWVkIHRvIGVudW1lcmF0ZSBldmVyeSBpbnRlbnRUeXBlLlxuICBjb25zdCBpc1N0YWtpbmdJbnRlbnQgPSAhISh0eFJlcXVlc3QuaW50ZW50IGFzIFBvcHVsYXRlZEludGVudCk/LnN0YWtpbmdSZXF1ZXN0SWQ7XG5cbiAgLy8gYnVpbGRQYXJhbXMudHlwZSBmcm9tIHRoZSB3YWxsZXQgVUkgaXMgUGFzY2FsQ2FzZSAoJ0ltcG9ydCcpOyBpbnRlbnQuaW50ZW50VHlwZSBmcm9tIFdQXG4gIC8vIGlzIGxvd2VyY2FzZSAoJ2ltcG9ydCcpLiBFaXRoZXIgbWF5IGJlIHRoZSBzb3VyY2Ugb2YgdHJ1dGggZGVwZW5kaW5nIG9uIHRoZSBzaWduaW5nIHBhdGguXG4gIGNvbnN0IGludGVudFR5cGUgPSAodHhSZXF1ZXN0LmludGVudCBhcyBQb3B1bGF0ZWRJbnRlbnQpPy5pbnRlbnRUeXBlID8/ICcnO1xuXG4gIGlmIChcbiAgICAhZWZmZWN0aXZlVHhQYXJhbXMucmVjaXBpZW50cz8ubGVuZ3RoICYmXG4gICAgIWlzU3Rha2luZ0ludGVudCAmJlxuICAgICFOT19SRUNJUElFTlRfVFhfVFlQRVMuaGFzKHR4VHlwZSkgJiZcbiAgICAhTk9fUkVDSVBJRU5UX1RYX1RZUEVTLmhhcyhpbnRlbnRUeXBlKVxuICApIHtcbiAgICB0aHJvdyBuZXcgSW52YWxpZFRyYW5zYWN0aW9uRXJyb3IoXG4gICAgICAnUmVjaXBpZW50IGRldGFpbHMgYXJlIHJlcXVpcmVkIHRvIHZlcmlmeSB0aGlzIHRyYW5zYWN0aW9uIGJlZm9yZSBzaWduaW5nLiBQYXNzIHR4UGFyYW1zIHdpdGggYXQgbGVhc3Qgb25lIHJlY2lwaWVudC4nXG4gICAgKTtcbiAgfVxuXG4gIHJldHVybiBlZmZlY3RpdmVUeFBhcmFtcztcbn1cbiJdfQ==

package/dist/src/bitgo/utils/tss/redpallas/SMC/utils.d.ts

@@ -0,0 +1,29 @@
+import { RedpallasBitgoToOVC1Round1Response, RedpallasBitgoToOVC1Round2Response, RedpallasMPCv2KeyGenRound1Response, RedpallasMPCv2KeyGenRound2Response, RedpallasOVC1ToBitgoRound1Payload, RedpallasOVC2ToBitgoRound2Payload } from '@bitgo/public-types';
+import { IBaseCoin } from '../../../../baseCoin';
+import { BitGoBase } from '../../../../bitgoBase';
+import { Keychain } from '../../../..';
+import { RedpallasMPCv2KeyGenSendFn } from '../redpallasMPCv2KeyGenSender';
+/**
+ * Custodial (SMC/OVC) DKG-only key generation for the Zcash Orchard shielded pool (RedPallas).
+ *
+ * Mirrors for both custodial and SMC wallet
+ * ceremonies driven by external OVC (offline vault console) clients: round1/round2 payloads are
+ * relayed from OVC1/OVC2 to BitGo and back. There is no round3 (no signing) - RedPallas MPS DKG
+ * completes key generation in 2 online rounds, same as EdDSA MPS DKG.
+ */
+export declare class RedpallasMPCv2SMCUtils {
+    private bitgo;
+    private baseCoin;
+    private MPCv2Utils;
+    constructor(bitgo: BitGoBase, baseCoin: IBaseCoin);
+    keyGenRound1(enterprise: string, payload: RedpallasOVC1ToBitgoRound1Payload): Promise<RedpallasBitgoToOVC1Round1Response>;
+    keyGenRound2(enterprise: string, payload: RedpallasOVC2ToBitgoRound2Payload): Promise<RedpallasBitgoToOVC1Round2Response>;
+    keyGenRound1BySender(senderFn: RedpallasMPCv2KeyGenSendFn<RedpallasMPCv2KeyGenRound1Response>, payload: RedpallasOVC1ToBitgoRound1Payload): Promise<RedpallasBitgoToOVC1Round1Response>;
+    keyGenRound2BySender(senderFn: RedpallasMPCv2KeyGenSendFn<RedpallasMPCv2KeyGenRound2Response>, payload: RedpallasOVC2ToBitgoRound2Payload): Promise<RedpallasBitgoToOVC1Round2Response>;
+    uploadClientKeys(bitgoKeyId: string, userCommonKeychain: string, backupCommonKeychain: string): Promise<{
+        userKeychain: Keychain;
+        backupKeychain: Keychain;
+        bitgoKeychain: Keychain;
+    }>;
+}
+//# sourceMappingURL=utils.d.ts.map

package/dist/src/bitgo/utils/tss/redpallas/SMC/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/bitgo/utils/tss/redpallas/SMC/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,kCAAkC,EAClC,kCAAkC,EAElC,kCAAkC,EAClC,kCAAkC,EAClC,iCAAiC,EACjC,iCAAiC,EAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAgB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,0BAA0B,EAAsC,MAAM,+BAA+B,CAAC;AAE/G;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IAGrB,OAAO,CAAC,KAAK;IAAa,OAAO,CAAC,QAAQ;IAFtD,OAAO,CAAC,UAAU,CAAsB;gBAEpB,KAAK,EAAE,SAAS,EAAU,QAAQ,EAAE,SAAS;IAIpD,YAAY,CACvB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,kCAAkC,CAAC;IAIjC,YAAY,CACvB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,kCAAkC,CAAC;IAIjC,oBAAoB,CAC/B,QAAQ,EAAE,0BAA0B,CAAC,kCAAkC,CAAC,EACxE,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,kCAAkC,CAAC;IAwCjC,oBAAoB,CAC/B,QAAQ,EAAE,0BAA0B,CAAC,kCAAkC,CAAC,EACxE,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,kCAAkC,CAAC;IAsDjC,gBAAgB,CAC3B,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,MAAM,EAC1B,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC;QAAE,YAAY,EAAE,QAAQ,CAAC;QAAC,cAAc,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,QAAQ,CAAA;KAAE,CAAC;CA8B1F"}