@bitgo-beta/sdk-core 8.2.1-beta.214 → 8.2.1-beta.2140

package/dist/src/bitgo/safe/recovery.d.ts

@@ -0,0 +1,192 @@
+/**
+ * @prettier
+ *
+ * @experimental WRW-facing safe recovery entry points.
+ */
+import { Buffer } from 'buffer';
+import type { RootKeyType } from '@bitgo/public-types';
+import { type Ed25519ExtendedKeyParts, type ExternalEd25519Signer } from './derivableEd25519Pub';
+import { BitGoBase } from '../bitgoBase';
+export type DecryptedMpcSafeRoot = {
+    signing: Buffer;
+    vrf: Buffer;
+};
+export type OnchainSafeRoot = {
+    user: string;
+    backup: string;
+    bitgo: string;
+};
+export type MpcSafeRoot = {
+    user: DecryptedMpcSafeRoot;
+    backup: DecryptedMpcSafeRoot;
+    bitgo: string;
+};
+export type Ed25519MultisigSafeRoot = {
+    user: string;
+    backup: {
+        prv: string;
+        chainCode: string;
+    };
+    bitgo: string;
+};
+export type Secp256k1MultisigChildKeys = {
+    user: {
+        prv: string;
+        pub: string;
+    };
+    backup: {
+        prv: string;
+        pub: string;
+    };
+    bitgo: {
+        pub: string;
+    };
+};
+export type EcdsaMpcChildKeys = {
+    commonKeychain: string;
+    user: string;
+    backup: string;
+};
+export type EddsaMpcChildKeys = EcdsaMpcChildKeys;
+/**
+ * A hardened (SLIP-0010) ed25519 child. The `kind` discriminator prevents a raw seed from being
+ * mistaken for an extended key downstream — both are 32-byte values that `isValidPub` would accept.
+ */
+export type SafeEd25519SeedKey = {
+    readonly kind: 'seed';
+    readonly seed: string;
+    readonly pub: string;
+};
+/**
+ * A soft (BIP32-Ed25519) ed25519 child. No 32-byte seed maps back to a soft-derived child, so the
+ * signer needs both halves directly: `kL` (the clamped scalar) and `kR` (the nonce prefix).
+ */
+export type SafeEd25519ExtendedKey = {
+    readonly kind: 'extended';
+} & Ed25519ExtendedKeyParts<string>;
+/** The three ed25519 co-signer children. BitGo is pub-only: its private key stays in the HSM. */
+export type Ed25519MultisigChildKeys = {
+    user: SafeEd25519SeedKey;
+    backup: SafeEd25519ExtendedKey;
+    bitgo: {
+        readonly pub: string;
+    };
+};
+export type DerivedSafeWalletKeys = {
+    slot: 'secp256k1Multisig';
+    path: string;
+    keys: Secp256k1MultisigChildKeys;
+} | {
+    slot: 'ecdsaMpc';
+    path: string;
+    keys: EcdsaMpcChildKeys;
+} | {
+    slot: 'eddsaMpc';
+    path: string;
+    keys: EddsaMpcChildKeys;
+} | {
+    slot: 'ed25519Multisig';
+    path: string;
+    keys: Ed25519MultisigChildKeys;
+};
+export type SecpSafeRecoverKeyParams = {
+    slot: 'secp256k1Multisig';
+    userKey: string;
+    backupKey: string;
+    bitgoKey: string;
+    walletPassphrase?: string;
+};
+/**
+ * Slot-2 (ed25519Multisig) safe recovery key params. A discriminated union on `mode`, so the invalid
+ * combos are not representable: signed mode always carries the lazy signer and never a `backupKey`,
+ * unsigned mode always carries the encoded `backupKey` and never a signer or passphrase.
+ *
+ * `rootAddress` is the wallet's on-chain address. For ALGO it's the 2-of-3 multisig address over the
+ * three child pubs — derivable here, but `recover()` still requires it as input. Note this is
+ * *derived*, not independently verified against a known wallet address; callers with a recorded
+ * address should cross-check it themselves. For HBAR this field is omitted so the caller's
+ * network-assigned account ID is preserved when the key params are spread into a recovery request.
+ */
+export type Ed25519SafeRecoverKeyParams = {
+    slot: 'ed25519Multisig';
+    mode: 'signed';
+    userKey: string;
+    bitgoKey: string;
+    walletPassphrase: string;
+    rootAddress?: string;
+    /**
+     * Lazy signer for the seedless backup child. The backup child has no seed, so it cannot be
+     * seed-signed; and its signature must cover `tx.bytesToSign()`, which only exists once
+     * `recover()` builds the tx. So instead of a pre-made signature we pass a closure that holds
+     * the private `kL`/`kR` and signs on demand — the private halves never leave it.
+     */
+    externalBackupSigner: ExternalEd25519Signer;
+} | {
+    slot: 'ed25519Multisig';
+    mode: 'unsigned';
+    userKey: string;
+    backupKey: string;
+    bitgoKey: string;
+    rootAddress?: string;
+};
+export type SafeRecoverKeyParams = SecpSafeRecoverKeyParams | Ed25519SafeRecoverKeyParams;
+export type DecryptedSafeRoots = {
+    secp256k1Multisig: OnchainSafeRoot;
+    ed25519Multisig: Ed25519MultisigSafeRoot;
+    ecdsaMpc: MpcSafeRoot;
+    eddsaMpc: MpcSafeRoot;
+};
+export declare function decryptSafeKeycard(params: {
+    bitgo: BitGoBase;
+    userKeyBox: string;
+    backupKeyBox: string;
+    bitgoKeyBox: string;
+    password: string;
+}): Promise<DecryptedSafeRoots>;
+/**
+ * Derives a Safe wallet's child keys at the BIP44 path for a given slot and account.
+ * Supports all four slots: `secp256k1Multisig`, `ed25519Multisig`, `ecdsaMpc`, and `eddsaMpc`.
+ */
+export declare function deriveSafeWalletKeys(params: {
+    coin: string;
+    slot: RootKeyType;
+    account: number;
+    roots: DecryptedSafeRoots;
+}): Promise<DerivedSafeWalletKeys>;
+/**
+ * The request shape for `buildSafeRecoverKeyParams`. The `slot` literal is the discriminant that
+ * ties each slot to its own `keys` shape, so TypeScript narrows `params.keys` automatically and a
+ * slot added without a branch is a compile error rather than a silent cast.
+ */
+export type SafeRecoverKeyParamsRequest = {
+    bitgo: BitGoBase;
+    coin: string;
+    mode: 'signed' | 'unsigned';
+} & ({
+    slot: 'secp256k1Multisig';
+    keys: Secp256k1MultisigChildKeys;
+} | {
+    slot: 'ed25519Multisig';
+    keys: Ed25519MultisigChildKeys;
+} | {
+    slot: 'ecdsaMpc';
+    keys: EcdsaMpcChildKeys;
+} | {
+    slot: 'eddsaMpc';
+    keys: EddsaMpcChildKeys;
+});
+/**
+ * Builds the key fields `coin.recover()` expects from derived Safe child keys.
+ * Supports `secp256k1Multisig` (slot 1) and `ed25519Multisig` (slot 2); the MPC slots fail closed.
+ * Signed mode re-encrypts the child secrets under a fresh ephemeral passphrase (v1/SJCL); unsigned
+ * mode returns pubs. Where supported, `rootAddress` is derived from the child keys, not independently
+ * verified; otherwise it is omitted so the caller can supply it.
+ */
+export declare function buildSafeRecoverKeyParams(params: Extract<SafeRecoverKeyParamsRequest, {
+    slot: 'secp256k1Multisig';
+}>): Promise<SecpSafeRecoverKeyParams>;
+export declare function buildSafeRecoverKeyParams(params: Extract<SafeRecoverKeyParamsRequest, {
+    slot: 'ed25519Multisig';
+}>): Promise<Ed25519SafeRecoverKeyParams>;
+export declare function buildSafeRecoverKeyParams(params: SafeRecoverKeyParamsRequest): Promise<SafeRecoverKeyParams>;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/src/bitgo/safe/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/recovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAiBvD,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACtG,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAErG,iGAAiG;AACjG,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAA;CAAE,GAC7E;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,2BAA2B,GACnC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,oBAAoB,EAAE,qBAAqB,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,GAAG,2BAA2B,CAAC;AAE1F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,iBAAiB,EAAE,eAAe,CAAC;IACnC,eAAe,EAAE,uBAAuB,CAAC;IACzC,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8D9B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,kBAAkB,CAAC;CAC3B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAwEjC;AA6BD;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC7B,GAAG,CACA;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAChD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,OAAO,CAAC,2BAA2B,EAAE;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAC,GAC1E,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACrC,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,OAAO,CAAC,2BAA2B,EAAE;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC,GACxE,OAAO,CAAC,2BAA2B,CAAC,CAAC;AACxC,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/src/bitgo/safe/recovery.js

@@ -0,0 +1,253 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptSafeKeycard = decryptSafeKeycard;
+exports.deriveSafeWalletKeys = deriveSafeWalletKeys;
+exports.buildSafeRecoverKeyParams = buildSafeRecoverKeyParams;
+/**
+ * @prettier
+ *
+ * @experimental WRW-facing safe recovery entry points.
+ */
+const buffer_1 = require("buffer");
+const crypto_1 = require("crypto");
+const utxo_lib_1 = require("@bitgo-beta/utxo-lib");
+const statics_1 = require("@bitgo-beta/statics");
+const sdk_lib_safes_1 = require("@bitgo-beta/sdk-lib-safes");
+const derivableEd25519Pub_1 = require("./derivableEd25519Pub");
+const sdk_lib_mpc_1 = require("@bitgo-beta/sdk-lib-mpc");
+const errors_1 = require("../errors");
+const keyShareEnvelope_1 = require("../utils/tss/keyShareEnvelope");
+async function decryptSafeKeycard(params) {
+    const { bitgo, userKeyBox, backupKeyBox, bitgoKeyBox, password } = params;
+    const userRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(userKeyBox);
+    const backupRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(backupKeyBox);
+    const bitgoRoots = (0, sdk_lib_safes_1.parseSafeKeycardBox)(bitgoKeyBox);
+    const decryptRoot = async (root) => {
+        try {
+            return await bitgo.decrypt({ input: root, password });
+        }
+        catch (e) {
+            throw new errors_1.IncorrectPasswordError('unable to decrypt the safe keycard with the provided password', e);
+        }
+    };
+    const unwrapMpcRoot = (decrypted) => {
+        try {
+            return (0, keyShareEnvelope_1.parseSafeMpcKeyEnvelopes)(decrypted);
+        }
+        catch (e) {
+            throw new errors_1.IncorrectPasswordError('unable to decrypt the safe keycard with the provided password', e);
+        }
+    };
+    // Only box B's ed25519Multisig slot may carry the derivable `{ prv, chainCode }` object; every
+    // other entry — all of boxes A and C, and every non-ed25519 slot in box B — is a bare string and
+    // fails closed if it carries the object instead.
+    const requireBareString = (entry) => {
+        if (sdk_lib_safes_1.Ed25519ChainCodeEntryCodec.is(entry)) {
+            throw new Error('unexpected ed25519 chain-code entry where a bare string was required');
+        }
+        return entry;
+    };
+    const decryptEd25519Backup = async (entry) => {
+        if (!sdk_lib_safes_1.Ed25519ChainCodeEntryCodec.is(entry)) {
+            throw new Error('ed25519 backup root must carry a chain code');
+        }
+        return { prv: await decryptRoot(entry.prv), chainCode: entry.chainCode };
+    };
+    return {
+        secp256k1Multisig: {
+            user: await decryptRoot(requireBareString(userRoots.secp256k1Multisig)),
+            backup: await decryptRoot(requireBareString(backupRoots.secp256k1Multisig)),
+            bitgo: requireBareString(bitgoRoots.secp256k1Multisig),
+        },
+        ed25519Multisig: {
+            user: await decryptRoot(requireBareString(userRoots.ed25519Multisig)),
+            backup: await decryptEd25519Backup(backupRoots.ed25519Multisig),
+            bitgo: requireBareString(bitgoRoots.ed25519Multisig),
+        },
+        ecdsaMpc: {
+            user: unwrapMpcRoot(await decryptRoot(requireBareString(userRoots.ecdsaMpc))),
+            backup: unwrapMpcRoot(await decryptRoot(requireBareString(backupRoots.ecdsaMpc))),
+            bitgo: requireBareString(bitgoRoots.ecdsaMpc),
+        },
+        eddsaMpc: {
+            user: unwrapMpcRoot(await decryptRoot(requireBareString(userRoots.eddsaMpc))),
+            backup: unwrapMpcRoot(await decryptRoot(requireBareString(backupRoots.eddsaMpc))),
+            bitgo: requireBareString(bitgoRoots.eddsaMpc),
+        },
+    };
+}
+/**
+ * Derives a Safe wallet's child keys at the BIP44 path for a given slot and account.
+ * Supports all four slots: `secp256k1Multisig`, `ed25519Multisig`, `ecdsaMpc`, and `eddsaMpc`.
+ */
+async function deriveSafeWalletKeys(params) {
+    if (!Number.isInteger(params.account) || params.account < 0 || params.account > statics_1.MAX_BIP32_INDEX) {
+        throw new Error(`deriveSafeWalletKeys: invalid account '${params.account}'`);
+    }
+    const { account, roots } = params;
+    const path = (0, sdk_lib_safes_1.buildSafeBip44Path)((0, sdk_lib_safes_1.getSafeBip44CoinType)(params.coin), params.slot, account);
+    const { coinType, slotOrdinal } = (0, sdk_lib_safes_1.parseSafeBip44Path)(path);
+    if (params.slot === 'secp256k1Multisig') {
+        return { slot: 'secp256k1Multisig', path, keys: (0, sdk_lib_safes_1.deriveSafeChildTriplet)(roots.secp256k1Multisig, path) };
+    }
+    if (params.slot === 'ecdsaMpc') {
+        const { commonKeychain, userChild, backupChild } = await sdk_lib_mpc_1.DklsVrfUtils.deriveSafeEcdsaMpcChild({
+            userRoot: roots.ecdsaMpc.user,
+            backupRoot: roots.ecdsaMpc.backup,
+            account,
+            coinType,
+            safeSlotOrdinal: slotOrdinal,
+        });
+        return {
+            slot: 'ecdsaMpc',
+            path,
+            keys: { commonKeychain, user: userChild, backup: backupChild },
+        };
+    }
+    if (params.slot === 'eddsaMpc') {
+        const { commonKeychain, userChild, backupChild } = await sdk_lib_mpc_1.MpsVrfUtils.deriveSafeEddsaMpcChild({
+            userRoot: roots.eddsaMpc.user,
+            backupRoot: roots.eddsaMpc.backup,
+            account,
+            coinType,
+            safeSlotOrdinal: slotOrdinal,
+        });
+        return {
+            slot: 'eddsaMpc',
+            path,
+            keys: { commonKeychain, user: userChild, backup: backupChild },
+        };
+    }
+    if (params.slot === 'ed25519Multisig') {
+        const root = roots.ed25519Multisig;
+        const cosignerPath = (0, sdk_lib_safes_1.toSoftTwinPath)(path);
+        const user = (0, sdk_lib_safes_1.deriveSafeChildEd25519Hardened)(root.user, path);
+        const backup = await (0, derivableEd25519Pub_1.softDeriveChildPrvEd25519AtPath)({
+            seedStrKey: root.backup.prv,
+            chainCode: root.backup.chainCode,
+            path: cosignerPath,
+        });
+        const bitgo = await (0, derivableEd25519Pub_1.softDeriveChildPubEd25519AtPath)(root.bitgo, cosignerPath);
+        return {
+            slot: 'ed25519Multisig',
+            path,
+            keys: {
+                user: { kind: 'seed', seed: user.prv, pub: (0, sdk_lib_safes_1.decodeEd25519StrKeyPublicKey)(user.pub).toString('hex') },
+                backup: {
+                    kind: 'extended',
+                    kL: backup.kL.toString('hex'),
+                    kR: backup.kR.toString('hex'),
+                    pub: backup.pub.toString('hex'),
+                },
+                bitgo: { pub: bitgo.toString('hex') },
+            },
+        };
+    }
+    throw new Error(`deriveSafeWalletKeys: slot '${params.slot}' is not supported yet`);
+}
+/**
+ * Per-coin encoders for the `ed25519Multisig` slot: each slot-2 coin re-encodes the same 32-byte
+ * children into its own address/seed string formats. A coin absent from the registry is not yet
+ * supported for slot-2 recovery (xlm is a future arm).
+ */
+const ALGO_ENCODERS = {
+    encodePub: sdk_lib_safes_1.encodeAlgoKey,
+    encodeSeed: sdk_lib_safes_1.encodeAlgoKey,
+    deriveRootAddress: (userPub, backupPub, bitgoPub) => (0, sdk_lib_safes_1.algoMultisigAddress)(1, 2, [userPub, backupPub, bitgoPub]),
+};
+const ED25519_MULTISIG_COIN_ENCODERS = {
+    algo: ALGO_ENCODERS,
+    talgo: ALGO_ENCODERS,
+    hbar: { encodePub: sdk_lib_safes_1.encodeHbarPublicKeyDer, encodeSeed: sdk_lib_safes_1.encodeHbarPrivateKeyDer },
+    thbar: { encodePub: sdk_lib_safes_1.encodeHbarPublicKeyDer, encodeSeed: sdk_lib_safes_1.encodeHbarPrivateKeyDer },
+};
+async function buildSafeRecoverKeyParams(params) {
+    const { bitgo, mode } = params;
+    if (params.slot === 'ed25519Multisig') {
+        return buildEd25519MultisigRecoverKeyParams(bitgo, params.coin, params.keys, mode);
+    }
+    if (params.slot === 'secp256k1Multisig') {
+        const keys = params.keys;
+        if (mode === 'unsigned') {
+            return {
+                slot: 'secp256k1Multisig',
+                userKey: keys.user.pub,
+                backupKey: keys.backup.pub,
+                bitgoKey: keys.bitgo.pub,
+            };
+        }
+        const userPrv = utxo_lib_1.bip32.fromBase58(keys.user.prv);
+        const backupPrv = utxo_lib_1.bip32.fromBase58(keys.backup.prv);
+        if (!userPrv.privateKey || !backupPrv.privateKey) {
+            throw new Error('buildSafeRecoverKeyParams: keys.user.prv and keys.backup.prv must be private xprvs');
+        }
+        const walletPassphrase = (0, crypto_1.randomBytes)(32).toString('hex');
+        const [userKey, backupKey] = await Promise.all([
+            bitgo.encrypt({ input: keys.user.prv, password: walletPassphrase, encryptionVersion: 1 }),
+            bitgo.encrypt({ input: keys.backup.prv, password: walletPassphrase, encryptionVersion: 1 }),
+        ]);
+        return {
+            slot: 'secp256k1Multisig',
+            userKey,
+            backupKey,
+            bitgoKey: keys.bitgo.pub,
+            walletPassphrase,
+        };
+    }
+    throw new Error(`buildSafeRecoverKeyParams: slot '${params.slot}' is not supported yet`);
+}
+async function buildEd25519MultisigRecoverKeyParams(bitgo, coin, keys, mode) {
+    const encoders = ED25519_MULTISIG_COIN_ENCODERS[coin];
+    if (!encoders) {
+        throw new Error(`buildSafeRecoverKeyParams: coin '${coin}' ed25519Multisig is not supported yet`);
+    }
+    for (const pub of [keys.user.pub, keys.backup.pub, keys.bitgo.pub]) {
+        // strict hex, not length-only: Buffer.from(pub, 'hex') truncates at the first bad pair, so a
+        // length check alone would accept trailing garbage
+        if (!/^[0-9a-f]{64}$/i.test(pub)) {
+            throw new Error('buildSafeRecoverKeyParams: ed25519 child public keys must be 32 bytes');
+        }
+    }
+    const userPub = buffer_1.Buffer.from(keys.user.pub, 'hex');
+    const backupPub = buffer_1.Buffer.from(keys.backup.pub, 'hex');
+    const bitgoPub = buffer_1.Buffer.from(keys.bitgo.pub, 'hex');
+    // The root address is derivable from child pubs for ALGO (version-1 2-of-3 multisig), but
+    // not for HBAR (Hedera account IDs are network-assigned). Each coin declares, via its registry
+    // entry, whether it can derive one; the caller supplies it otherwise.
+    const rootAddress = encoders.deriveRootAddress?.(userPub, backupPub, bitgoPub);
+    const rootAddressParams = rootAddress === undefined ? {} : { rootAddress };
+    if (mode === 'unsigned') {
+        return {
+            slot: 'ed25519Multisig',
+            mode: 'unsigned',
+            userKey: encoders.encodePub(userPub),
+            backupKey: encoders.encodePub(backupPub),
+            bitgoKey: encoders.encodePub(bitgoPub),
+            ...rootAddressParams,
+        };
+    }
+    // The user child is a hardened SLIP-0010 seed, so it re-encrypts exactly like slot 1. The backup
+    // child is a seedless soft extended key: it cannot be re-encrypted as a seed, so it becomes a lazy
+    // external signer over the tx bytes (WCN-2895's extended-key signer, invoked by the coin).
+    const walletPassphrase = (0, crypto_1.randomBytes)(32).toString('hex');
+    const userKey = await bitgo.encrypt({
+        input: encoders.encodeSeed(buffer_1.Buffer.from(keys.user.seed, 'hex')),
+        password: walletPassphrase,
+        encryptionVersion: 1,
+    });
+    return {
+        slot: 'ed25519Multisig',
+        mode: 'signed',
+        userKey,
+        bitgoKey: encoders.encodePub(bitgoPub),
+        walletPassphrase,
+        ...rootAddressParams,
+        externalBackupSigner: {
+            publicKey: keys.backup.pub,
+            sign: async (message) => ({
+                signature: (await (0, derivableEd25519Pub_1.signEd25519Extended)(buffer_1.Buffer.from(message), buffer_1.Buffer.from(keys.backup.kL, 'hex'), buffer_1.Buffer.from(keys.backup.kR, 'hex'))).toString('hex'),
+            }),
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3ZlcnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9yZWNvdmVyeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWdKQSxnREFvRUM7QUFNRCxvREE2RUM7QUEyREQsOERBeUNDO0FBM1lEOzs7O0dBSUc7QUFDSCxtQ0FBZ0M7QUFDaEMsbUNBQXFDO0FBQ3JDLG1EQUE2QztBQUM3QyxpREFBc0Q7QUFFdEQsNkRBZW1DO0FBQ25DLCtEQU0rQjtBQUMvQix5REFBb0U7QUFFcEUsc0NBQW1EO0FBQ25ELG9FQUF5RTtBQTRHbEUsS0FBSyxVQUFVLGtCQUFrQixDQUFDLE1BTXhDO0lBQ0MsTUFBTSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLENBQUM7SUFFMUUsTUFBTSxTQUFTLEdBQUcsSUFBQSxtQ0FBbUIsRUFBQyxVQUFVLENBQUMsQ0FBQztJQUNsRCxNQUFNLFdBQVcsR0FBRyxJQUFBLG1DQUFtQixFQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3RELE1BQU0sVUFBVSxHQUFHLElBQUEsbUNBQW1CLEVBQUMsV0FBVyxDQUFDLENBQUM7SUFFcEQsTUFBTSxXQUFXLEdBQUcsS0FBSyxFQUFFLElBQVksRUFBbUIsRUFBRTtRQUMxRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSwrQkFBc0IsQ0FBQywrREFBK0QsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN2RyxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxTQUFpQixFQUF3QixFQUFFO1FBQ2hFLElBQUksQ0FBQztZQUNILE9BQU8sSUFBQSwyQ0FBd0IsRUFBQyxTQUFTLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSwrQkFBc0IsQ0FBQywrREFBK0QsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN2RyxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBRUYsK0ZBQStGO0lBQy9GLGlHQUFpRztJQUNqRyxpREFBaUQ7SUFDakQsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLEtBQTJCLEVBQVUsRUFBRTtRQUNoRSxJQUFJLDBDQUEwQixDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDLENBQUM7SUFFRixNQUFNLG9CQUFvQixHQUFHLEtBQUssRUFBRSxLQUEyQixFQUErQyxFQUFFO1FBQzlHLElBQUksQ0FBQywwQ0FBMEIsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMxQyxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxXQUFXLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDM0UsQ0FBQyxDQUFDO0lBRUYsT0FBTztRQUNMLGlCQUFpQixFQUFFO1lBQ2pCLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUN2RSxNQUFNLEVBQUUsTUFBTSxXQUFXLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLGlCQUFpQixDQUFDLENBQUM7WUFDM0UsS0FBSyxFQUFFLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQztTQUN2RDtRQUNELGVBQWUsRUFBRTtZQUNmLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDckUsTUFBTSxFQUFFLE1BQU0sb0JBQW9CLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQztZQUMvRCxLQUFLLEVBQUUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQztTQUNyRDtRQUNELFFBQVEsRUFBRTtZQUNSLElBQUksRUFBRSxhQUFhLENBQUMsTUFBTSxXQUFXLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDN0UsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNqRixLQUFLLEVBQUUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztTQUM5QztRQUNELFFBQVEsRUFBRTtZQUNSLElBQUksRUFBRSxhQUFhLENBQUMsTUFBTSxXQUFXLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDN0UsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNqRixLQUFLLEVBQUUsaUJBQWlCLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztTQUM5QztLQUNGLENBQUM7QUFDSixDQUFDO0FBRUQ7OztHQUdHO0FBQ0ksS0FBSyxVQUFVLG9CQUFvQixDQUFDLE1BSzFDO0lBQ0MsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEdBQUcseUJBQWUsRUFBRSxDQUFDO1FBQ2hHLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNsQyxNQUFNLElBQUksR0FBRyxJQUFBLGtDQUFrQixFQUFDLElBQUEsb0NBQW9CLEVBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDekYsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFBLGtDQUFrQixFQUFDLElBQUksQ0FBQyxDQUFDO0lBRTNELElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxtQkFBbUIsRUFBRSxDQUFDO1FBQ3hDLE9BQU8sRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFBLHNDQUFzQixFQUFDLEtBQUssQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQzFHLENBQUM7SUFFRCxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDL0IsTUFBTSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLEdBQUcsTUFBTSwwQkFBWSxDQUFDLHVCQUF1QixDQUFDO1lBQzVGLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUk7WUFDN0IsVUFBVSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTTtZQUNqQyxPQUFPO1lBQ1AsUUFBUTtZQUNSLGVBQWUsRUFBRSxXQUFXO1NBQzdCLENBQUMsQ0FBQztRQUNILE9BQU87WUFDTCxJQUFJLEVBQUUsVUFBVTtZQUNoQixJQUFJO1lBQ0osSUFBSSxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRTtTQUMvRCxDQUFDO0lBQ0osQ0FBQztJQUVELElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUMvQixNQUFNLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsR0FBRyxNQUFNLHlCQUFXLENBQUMsdUJBQXVCLENBQUM7WUFDM0YsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSTtZQUM3QixVQUFVLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNO1lBQ2pDLE9BQU87WUFDUCxRQUFRO1lBQ1IsZUFBZSxFQUFFLFdBQVc7U0FDN0IsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNMLElBQUksRUFBRSxVQUFVO1lBQ2hCLElBQUk7WUFDSixJQUFJLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFO1NBQy9ELENBQUM7SUFDSixDQUFDO0lBRUQsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLGVBQWUsQ0FBQztRQUNuQyxNQUFNLFlBQVksR0FBRyxJQUFBLDhCQUFjLEVBQUMsSUFBSSxDQUFDLENBQUM7UUFFMUMsTUFBTSxJQUFJLEdBQUcsSUFBQSw4Q0FBOEIsRUFBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzdELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBQSxxREFBK0IsRUFBQztZQUNuRCxVQUFVLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHO1lBQzNCLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVM7WUFDaEMsSUFBSSxFQUFFLFlBQVk7U0FDbkIsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFBLHFEQUErQixFQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFFOUUsT0FBTztZQUNMLElBQUksRUFBRSxpQkFBaUI7WUFDdkIsSUFBSTtZQUNKLElBQUksRUFBRTtnQkFDSixJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFBLDRDQUE0QixFQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUU7Z0JBQ25HLE1BQU0sRUFBRTtvQkFDTixJQUFJLEVBQUUsVUFBVTtvQkFDaEIsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztvQkFDN0IsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztvQkFDN0IsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztpQkFDaEM7Z0JBQ0QsS0FBSyxFQUFFLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUU7YUFDdEM7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLE1BQU0sQ0FBQyxJQUFJLHdCQUF3QixDQUFDLENBQUM7QUFDdEYsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLGFBQWEsR0FBRztJQUNwQixTQUFTLEVBQUUsNkJBQWE7SUFDeEIsVUFBVSxFQUFFLDZCQUFhO0lBQ3pCLGlCQUFpQixFQUFFLENBQUMsT0FBZSxFQUFFLFNBQWlCLEVBQUUsUUFBZ0IsRUFBRSxFQUFFLENBQzFFLElBQUEsbUNBQW1CLEVBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7Q0FDNUQsQ0FBQztBQUVGLE1BQU0sOEJBQThCLEdBUWhDO0lBQ0YsSUFBSSxFQUFFLGFBQWE7SUFDbkIsS0FBSyxFQUFFLGFBQWE7SUFDcEIsSUFBSSxFQUFFLEVBQUUsU0FBUyxFQUFFLHNDQUFzQixFQUFFLFVBQVUsRUFBRSx1Q0FBdUIsRUFBRTtJQUNoRixLQUFLLEVBQUUsRUFBRSxTQUFTLEVBQUUsc0NBQXNCLEVBQUUsVUFBVSxFQUFFLHVDQUF1QixFQUFFO0NBQ2xGLENBQUM7QUFnQ0ssS0FBSyxVQUFVLHlCQUF5QixDQUFDLE1BQW1DO0lBQ2pGLE1BQU0sRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBRS9CLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sb0NBQW9DLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBRUQsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLG1CQUFtQixFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztRQUV6QixJQUFJLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUN4QixPQUFPO2dCQUNMLElBQUksRUFBRSxtQkFBbUI7Z0JBQ3pCLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7Z0JBQ3RCLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUc7Z0JBQzFCLFFBQVEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUc7YUFDekIsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxnQkFBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2hELE1BQU0sU0FBUyxHQUFHLGdCQUFLLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyxvRkFBb0YsQ0FBQyxDQUFDO1FBQ3hHLENBQUM7UUFFRCxNQUFNLGdCQUFnQixHQUFHLElBQUEsb0JBQVcsRUFBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDekQsTUFBTSxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7WUFDN0MsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxRQUFRLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDekYsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRSxRQUFRLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQUUsQ0FBQyxFQUFFLENBQUM7U0FDNUYsQ0FBQyxDQUFDO1FBRUgsT0FBTztZQUNMLElBQUksRUFBRSxtQkFBbUI7WUFDekIsT0FBTztZQUNQLFNBQVM7WUFDVCxRQUFRLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHO1lBQ3hCLGdCQUFnQjtTQUNqQixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLE1BQU0sQ0FBQyxJQUFJLHdCQUF3QixDQUFDLENBQUM7QUFDM0YsQ0FBQztBQUVELEtBQUssVUFBVSxvQ0FBb0MsQ0FDakQsS0FBZ0IsRUFDaEIsSUFBWSxFQUNaLElBQThCLEVBQzlCLElBQTJCO0lBRTNCLE1BQU0sUUFBUSxHQUFHLDhCQUE4QixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3RELElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLElBQUksd0NBQXdDLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBRUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuRSw2RkFBNkY7UUFDN0YsbURBQW1EO1FBQ25ELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLHVFQUF1RSxDQUFDLENBQUM7UUFDM0YsQ0FBQztJQUNILENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxlQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ2xELE1BQU0sU0FBUyxHQUFHLGVBQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDdEQsTUFBTSxRQUFRLEdBQUcsZUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUVwRCwwRkFBMEY7SUFDMUYsK0ZBQStGO0lBQy9GLHNFQUFzRTtJQUN0RSxNQUFNLFdBQVcsR0FBRyxRQUFRLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxPQUFPLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQy9FLE1BQU0saUJBQWlCLEdBQUcsV0FBVyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDO0lBRTNFLElBQUksSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3hCLE9BQU87WUFDTCxJQUFJLEVBQUUsaUJBQWlCO1lBQ3ZCLElBQUksRUFBRSxVQUFVO1lBQ2hCLE9BQU8sRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQztZQUNwQyxTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7WUFDeEMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDO1lBQ3RDLEdBQUcsaUJBQWlCO1NBQ3JCLENBQUM7SUFDSixDQUFDO0lBRUQsaUdBQWlHO0lBQ2pHLG1HQUFtRztJQUNuRywyRkFBMkY7SUFDM0YsTUFBTSxnQkFBZ0IsR0FBRyxJQUFBLG9CQUFXLEVBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3pELE1BQU0sT0FBTyxHQUFHLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQztRQUNsQyxLQUFLLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxlQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzlELFFBQVEsRUFBRSxnQkFBZ0I7UUFDMUIsaUJBQWlCLEVBQUUsQ0FBQztLQUNyQixDQUFDLENBQUM7SUFFSCxPQUFPO1FBQ0wsSUFBSSxFQUFFLGlCQUFpQjtRQUN2QixJQUFJLEVBQUUsUUFBUTtRQUNkLE9BQU87UUFDUCxRQUFRLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUM7UUFDdEMsZ0JBQWdCO1FBQ2hCLEdBQUcsaUJBQWlCO1FBQ3BCLG9CQUFvQixFQUFFO1lBQ3BCLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUc7WUFDMUIsSUFBSSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ3hCLFNBQVMsRUFBRSxDQUNULE1BQU0sSUFBQSx5Q0FBbUIsRUFDdkIsZUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFDcEIsZUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFDbEMsZUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FDbkMsQ0FDRixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7YUFDbEIsQ0FBQztTQUNIO0tBQ0YsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBwcmV0dGllclxuICpcbiAqIEBleHBlcmltZW50YWwgV1JXLWZhY2luZyBzYWZlIHJlY292ZXJ5IGVudHJ5IHBvaW50cy5cbiAqL1xuaW1wb3J0IHsgQnVmZmVyIH0gZnJvbSAnYnVmZmVyJztcbmltcG9ydCB7IHJhbmRvbUJ5dGVzIH0gZnJvbSAnY3J5cHRvJztcbmltcG9ydCB7IGJpcDMyIH0gZnJvbSAnQGJpdGdvLWJldGEvdXR4by1saWInO1xuaW1wb3J0IHsgTUFYX0JJUDMyX0lOREVYIH0gZnJvbSAnQGJpdGdvLWJldGEvc3RhdGljcyc7XG5pbXBvcnQgdHlwZSB7IFJvb3RLZXlUeXBlIH0gZnJvbSAnQGJpdGdvL3B1YmxpYy10eXBlcyc7XG5pbXBvcnQge1xuICBidWlsZFNhZmVCaXA0NFBhdGgsXG4gIGRlY29kZUVkMjU1MTlTdHJLZXlQdWJsaWNLZXksXG4gIGRlcml2ZVNhZmVDaGlsZEVkMjU1MTlIYXJkZW5lZCxcbiAgZGVyaXZlU2FmZUNoaWxkVHJpcGxldCxcbiAgRWQyNTUxOUNoYWluQ29kZUVudHJ5Q29kZWMsXG4gIGdldFNhZmVCaXA0NENvaW5UeXBlLFxuICBwYXJzZVNhZmVCaXA0NFBhdGgsXG4gIHBhcnNlU2FmZUtleWNhcmRCb3gsXG4gIHRvU29mdFR3aW5QYXRoLFxuICBhbGdvTXVsdGlzaWdBZGRyZXNzLFxuICBlbmNvZGVBbGdvS2V5LFxuICBlbmNvZGVIYmFyUHVibGljS2V5RGVyLFxuICBlbmNvZGVIYmFyUHJpdmF0ZUtleURlcixcbiAgdHlwZSBTYWZlS2V5Y2FyZFJvb3RFbnRyeSxcbn0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWxpYi1zYWZlcyc7XG5pbXBvcnQge1xuICBzaWduRWQyNTUxOUV4dGVuZGVkLFxuICBzb2Z0RGVyaXZlQ2hpbGRQdWJFZDI1NTE5QXRQYXRoLFxuICBzb2Z0RGVyaXZlQ2hpbGRQcnZFZDI1NTE5QXRQYXRoLFxuICB0eXBlIEVkMjU1MTlFeHRlbmRlZEtleVBhcnRzLFxuICB0eXBlIEV4dGVybmFsRWQyNTUxOVNpZ25lcixcbn0gZnJvbSAnLi9kZXJpdmFibGVFZDI1NTE5UHViJztcbmltcG9ydCB7IERrbHNWcmZVdGlscywgTXBzVnJmVXRpbHMgfSBmcm9tICdAYml0Z28tYmV0YS9zZGstbGliLW1wYyc7XG5pbXBvcnQgeyBCaXRHb0Jhc2UgfSBmcm9tICcuLi9iaXRnb0Jhc2UnO1xuaW1wb3J0IHsgSW5jb3JyZWN0UGFzc3dvcmRFcnJvciB9IGZyb20gJy4uL2Vycm9ycyc7XG5pbXBvcnQgeyBwYXJzZVNhZmVNcGNLZXlFbnZlbG9wZXMgfSBmcm9tICcuLi91dGlscy90c3Mva2V5U2hhcmVFbnZlbG9wZSc7XG5cbmV4cG9ydCB0eXBlIERlY3J5cHRlZE1wY1NhZmVSb290ID0geyBzaWduaW5nOiBCdWZmZXI7IHZyZjogQnVmZmVyIH07XG5cbmV4cG9ydCB0eXBlIE9uY2hhaW5TYWZlUm9vdCA9IHsgdXNlcjogc3RyaW5nOyBiYWNrdXA6IHN0cmluZzsgYml0Z286IHN0cmluZyB9O1xuZXhwb3J0IHR5cGUgTXBjU2FmZVJvb3QgPSB7IHVzZXI6IERlY3J5cHRlZE1wY1NhZmVSb290OyBiYWNrdXA6IERlY3J5cHRlZE1wY1NhZmVSb290OyBiaXRnbzogc3RyaW5nIH07XG5leHBvcnQgdHlwZSBFZDI1NTE5TXVsdGlzaWdTYWZlUm9vdCA9IHtcbiAgdXNlcjogc3RyaW5nO1xuICBiYWNrdXA6IHsgcHJ2OiBzdHJpbmc7IGNoYWluQ29kZTogc3RyaW5nIH07XG4gIGJpdGdvOiBzdHJpbmc7XG59O1xuXG5leHBvcnQgdHlwZSBTZWNwMjU2azFNdWx0aXNpZ0NoaWxkS2V5cyA9IHtcbiAgdXNlcjogeyBwcnY6IHN0cmluZzsgcHViOiBzdHJpbmcgfTtcbiAgYmFja3VwOiB7IHBydjogc3RyaW5nOyBwdWI6IHN0cmluZyB9O1xuICBiaXRnbzogeyBwdWI6IHN0cmluZyB9O1xufTtcblxuZXhwb3J0IHR5cGUgRWNkc2FNcGNDaGlsZEtleXMgPSB7XG4gIGNvbW1vbktleWNoYWluOiBzdHJpbmc7XG4gIHVzZXI6IHN0cmluZztcbiAgYmFja3VwOiBzdHJpbmc7XG59O1xuXG5leHBvcnQgdHlwZSBFZGRzYU1wY0NoaWxkS2V5cyA9IEVjZHNhTXBjQ2hpbGRLZXlzO1xuXG4vKipcbiAqIEEgaGFyZGVuZWQgKFNMSVAtMDAxMCkgZWQyNTUxOSBjaGlsZC4gVGhlIGBraW5kYCBkaXNjcmltaW5hdG9yIHByZXZlbnRzIGEgcmF3IHNlZWQgZnJvbSBiZWluZ1xuICogbWlzdGFrZW4gZm9yIGFuIGV4dGVuZGVkIGtleSBkb3duc3RyZWFtIOKAlCBib3RoIGFyZSAzMi1ieXRlIHZhbHVlcyB0aGF0IGBpc1ZhbGlkUHViYCB3b3VsZCBhY2NlcHQuXG4gKi9cbmV4cG9ydCB0eXBlIFNhZmVFZDI1NTE5U2VlZEtleSA9IHtcbiAgcmVhZG9ubHkga2luZDogJ3NlZWQnO1xuICByZWFkb25seSBzZWVkOiBzdHJpbmc7IC8vIDMyLWJ5dGUgY2hpbGQgc2VlZCAoaGV4KSDigJQgdGhlIHNpZ25lciBpbnB1dFxuICByZWFkb25seSBwdWI6IHN0cmluZzsgLy8gMzItYnl0ZSBwdWJsaWMga2V5IChoZXgpXG59O1xuXG4vKipcbiAqIEEgc29mdCAoQklQMzItRWQyNTUxOSkgZWQyNTUxOSBjaGlsZC4gTm8gMzItYnl0ZSBzZWVkIG1hcHMgYmFjayB0byBhIHNvZnQtZGVyaXZlZCBjaGlsZCwgc28gdGhlXG4gKiBzaWduZXIgbmVlZHMgYm90aCBoYWx2ZXMgZGlyZWN0bHk6IGBrTGAgKHRoZSBjbGFtcGVkIHNjYWxhcikgYW5kIGBrUmAgKHRoZSBub25jZSBwcmVmaXgpLlxuICovXG5leHBvcnQgdHlwZSBTYWZlRWQyNTUxOUV4dGVuZGVkS2V5ID0geyByZWFkb25seSBraW5kOiAnZXh0ZW5kZWQnIH0gJiBFZDI1NTE5RXh0ZW5kZWRLZXlQYXJ0czxzdHJpbmc+OyAvLyBoZXhcblxuLyoqIFRoZSB0aHJlZSBlZDI1NTE5IGNvLXNpZ25lciBjaGlsZHJlbi4gQml0R28gaXMgcHViLW9ubHk6IGl0cyBwcml2YXRlIGtleSBzdGF5cyBpbiB0aGUgSFNNLiAqL1xuZXhwb3J0IHR5cGUgRWQyNTUxOU11bHRpc2lnQ2hpbGRLZXlzID0ge1xuICB1c2VyOiBTYWZlRWQyNTUxOVNlZWRLZXk7XG4gIGJhY2t1cDogU2FmZUVkMjU1MTlFeHRlbmRlZEtleTtcbiAgYml0Z286IHsgcmVhZG9ubHkgcHViOiBzdHJpbmcgfTtcbn07XG5cbmV4cG9ydCB0eXBlIERlcml2ZWRTYWZlV2FsbGV0S2V5cyA9XG4gIHwgeyBzbG90OiAnc2VjcDI1NmsxTXVsdGlzaWcnOyBwYXRoOiBzdHJpbmc7IGtleXM6IFNlY3AyNTZrMU11bHRpc2lnQ2hpbGRLZXlzIH1cbiAgfCB7IHNsb3Q6ICdlY2RzYU1wYyc7IHBhdGg6IHN0cmluZzsga2V5czogRWNkc2FNcGNDaGlsZEtleXMgfVxuICB8IHsgc2xvdDogJ2VkZHNhTXBjJzsgcGF0aDogc3RyaW5nOyBrZXlzOiBFZGRzYU1wY0NoaWxkS2V5cyB9XG4gIHwgeyBzbG90OiAnZWQyNTUxOU11bHRpc2lnJzsgcGF0aDogc3RyaW5nOyBrZXlzOiBFZDI1NTE5TXVsdGlzaWdDaGlsZEtleXMgfTtcblxuZXhwb3J0IHR5cGUgU2VjcFNhZmVSZWNvdmVyS2V5UGFyYW1zID0ge1xuICBzbG90OiAnc2VjcDI1NmsxTXVsdGlzaWcnO1xuICB1c2VyS2V5OiBzdHJpbmc7XG4gIGJhY2t1cEtleTogc3RyaW5nO1xuICBiaXRnb0tleTogc3RyaW5nO1xuICB3YWxsZXRQYXNzcGhyYXNlPzogc3RyaW5nO1xufTtcblxuLyoqXG4gKiBTbG90LTIgKGVkMjU1MTlNdWx0aXNpZykgc2FmZSByZWNvdmVyeSBrZXkgcGFyYW1zLiBBIGRpc2NyaW1pbmF0ZWQgdW5pb24gb24gYG1vZGVgLCBzbyB0aGUgaW52YWxpZFxuICogY29tYm9zIGFyZSBub3QgcmVwcmVzZW50YWJsZTogc2lnbmVkIG1vZGUgYWx3YXlzIGNhcnJpZXMgdGhlIGxhenkgc2lnbmVyIGFuZCBuZXZlciBhIGBiYWNrdXBLZXlgLFxuICogdW5zaWduZWQgbW9kZSBhbHdheXMgY2FycmllcyB0aGUgZW5jb2RlZCBgYmFja3VwS2V5YCBhbmQgbmV2ZXIgYSBzaWduZXIgb3IgcGFzc3BocmFzZS5cbiAqXG4gKiBgcm9vdEFkZHJlc3NgIGlzIHRoZSB3YWxsZXQncyBvbi1jaGFpbiBhZGRyZXNzLiBGb3IgQUxHTyBpdCdzIHRoZSAyLW9mLTMgbXVsdGlzaWcgYWRkcmVzcyBvdmVyIHRoZVxuICogdGhyZWUgY2hpbGQgcHVicyDigJQgZGVyaXZhYmxlIGhlcmUsIGJ1dCBgcmVjb3ZlcigpYCBzdGlsbCByZXF1aXJlcyBpdCBhcyBpbnB1dC4gTm90ZSB0aGlzIGlzXG4gKiAqZGVyaXZlZCosIG5vdCBpbmRlcGVuZGVudGx5IHZlcmlmaWVkIGFnYWluc3QgYSBrbm93biB3YWxsZXQgYWRkcmVzczsgY2FsbGVycyB3aXRoIGEgcmVjb3JkZWRcbiAqIGFkZHJlc3Mgc2hvdWxkIGNyb3NzLWNoZWNrIGl0IHRoZW1zZWx2ZXMuIEZvciBIQkFSIHRoaXMgZmllbGQgaXMgb21pdHRlZCBzbyB0aGUgY2FsbGVyJ3NcbiAqIG5ldHdvcmstYXNzaWduZWQgYWNjb3VudCBJRCBpcyBwcmVzZXJ2ZWQgd2hlbiB0aGUga2V5IHBhcmFtcyBhcmUgc3ByZWFkIGludG8gYSByZWNvdmVyeSByZXF1ZXN0LlxuICovXG5leHBvcnQgdHlwZSBFZDI1NTE5U2FmZVJlY292ZXJLZXlQYXJhbXMgPVxuICB8IHtcbiAgICAgIHNsb3Q6ICdlZDI1NTE5TXVsdGlzaWcnO1xuICAgICAgbW9kZTogJ3NpZ25lZCc7XG4gICAgICB1c2VyS2V5OiBzdHJpbmc7XG4gICAgICBiaXRnb0tleTogc3RyaW5nO1xuICAgICAgd2FsbGV0UGFzc3BocmFzZTogc3RyaW5nO1xuICAgICAgcm9vdEFkZHJlc3M/OiBzdHJpbmc7XG4gICAgICAvKipcbiAgICAgICAqIExhenkgc2lnbmVyIGZvciB0aGUgc2VlZGxlc3MgYmFja3VwIGNoaWxkLiBUaGUgYmFja3VwIGNoaWxkIGhhcyBubyBzZWVkLCBzbyBpdCBjYW5ub3QgYmVcbiAgICAgICAqIHNlZWQtc2lnbmVkOyBhbmQgaXRzIHNpZ25hdHVyZSBtdXN0IGNvdmVyIGB0eC5ieXRlc1RvU2lnbigpYCwgd2hpY2ggb25seSBleGlzdHMgb25jZVxuICAgICAgICogYHJlY292ZXIoKWAgYnVpbGRzIHRoZSB0eC4gU28gaW5zdGVhZCBvZiBhIHByZS1tYWRlIHNpZ25hdHVyZSB3ZSBwYXNzIGEgY2xvc3VyZSB0aGF0IGhvbGRzXG4gICAgICAgKiB0aGUgcHJpdmF0ZSBga0xgL2BrUmAgYW5kIHNpZ25zIG9uIGRlbWFuZCDigJQgdGhlIHByaXZhdGUgaGFsdmVzIG5ldmVyIGxlYXZlIGl0LlxuICAgICAgICovXG4gICAgICBleHRlcm5hbEJhY2t1cFNpZ25lcjogRXh0ZXJuYWxFZDI1NTE5U2lnbmVyO1xuICAgIH1cbiAgfCB7XG4gICAgICBzbG90OiAnZWQyNTUxOU11bHRpc2lnJztcbiAgICAgIG1vZGU6ICd1bnNpZ25lZCc7XG4gICAgICB1c2VyS2V5OiBzdHJpbmc7XG4gICAgICBiYWNrdXBLZXk6IHN0cmluZztcbiAgICAgIGJpdGdvS2V5OiBzdHJpbmc7XG4gICAgICByb290QWRkcmVzcz86IHN0cmluZztcbiAgICB9O1xuXG5leHBvcnQgdHlwZSBTYWZlUmVjb3ZlcktleVBhcmFtcyA9IFNlY3BTYWZlUmVjb3ZlcktleVBhcmFtcyB8IEVkMjU1MTlTYWZlUmVjb3ZlcktleVBhcmFtcztcblxuZXhwb3J0IHR5cGUgRGVjcnlwdGVkU2FmZVJvb3RzID0ge1xuICBzZWNwMjU2azFNdWx0aXNpZzogT25jaGFpblNhZmVSb290O1xuICBlZDI1NTE5TXVsdGlzaWc6IEVkMjU1MTlNdWx0aXNpZ1NhZmVSb290O1xuICBlY2RzYU1wYzogTXBjU2FmZVJvb3Q7XG4gIGVkZHNhTXBjOiBNcGNTYWZlUm9vdDtcbn07XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBkZWNyeXB0U2FmZUtleWNhcmQocGFyYW1zOiB7XG4gIGJpdGdvOiBCaXRHb0Jhc2U7XG4gIHVzZXJLZXlCb3g6IHN0cmluZztcbiAgYmFja3VwS2V5Qm94OiBzdHJpbmc7XG4gIGJpdGdvS2V5Qm94OiBzdHJpbmc7XG4gIHBhc3N3b3JkOiBzdHJpbmc7XG59KTogUHJvbWlzZTxEZWNyeXB0ZWRTYWZlUm9vdHM+IHtcbiAgY29uc3QgeyBiaXRnbywgdXNlcktleUJveCwgYmFja3VwS2V5Qm94LCBiaXRnb0tleUJveCwgcGFzc3dvcmQgfSA9IHBhcmFtcztcblxuICBjb25zdCB1c2VyUm9vdHMgPSBwYXJzZVNhZmVLZXljYXJkQm94KHVzZXJLZXlCb3gpO1xuICBjb25zdCBiYWNrdXBSb290cyA9IHBhcnNlU2FmZUtleWNhcmRCb3goYmFja3VwS2V5Qm94KTtcbiAgY29uc3QgYml0Z29Sb290cyA9IHBhcnNlU2FmZUtleWNhcmRCb3goYml0Z29LZXlCb3gpO1xuXG4gIGNvbnN0IGRlY3J5cHRSb290ID0gYXN5bmMgKHJvb3Q6IHN0cmluZyk6IFByb21pc2U8c3RyaW5nPiA9PiB7XG4gICAgdHJ5IHtcbiAgICAgIHJldHVybiBhd2FpdCBiaXRnby5kZWNyeXB0KHsgaW5wdXQ6IHJvb3QsIHBhc3N3b3JkIH0pO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCd1bmFibGUgdG8gZGVjcnlwdCB0aGUgc2FmZSBrZXljYXJkIHdpdGggdGhlIHByb3ZpZGVkIHBhc3N3b3JkJywgZSk7XG4gICAgfVxuICB9O1xuXG4gIGNvbnN0IHVud3JhcE1wY1Jvb3QgPSAoZGVjcnlwdGVkOiBzdHJpbmcpOiBEZWNyeXB0ZWRNcGNTYWZlUm9vdCA9PiB7XG4gICAgdHJ5IHtcbiAgICAgIHJldHVybiBwYXJzZVNhZmVNcGNLZXlFbnZlbG9wZXMoZGVjcnlwdGVkKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICB0aHJvdyBuZXcgSW5jb3JyZWN0UGFzc3dvcmRFcnJvcigndW5hYmxlIHRvIGRlY3J5cHQgdGhlIHNhZmUga2V5Y2FyZCB3aXRoIHRoZSBwcm92aWRlZCBwYXNzd29yZCcsIGUpO1xuICAgIH1cbiAgfTtcblxuICAvLyBPbmx5IGJveCBCJ3MgZWQyNTUxOU11bHRpc2lnIHNsb3QgbWF5IGNhcnJ5IHRoZSBkZXJpdmFibGUgYHsgcHJ2LCBjaGFpbkNvZGUgfWAgb2JqZWN0OyBldmVyeVxuICAvLyBvdGhlciBlbnRyeSDigJQgYWxsIG9mIGJveGVzIEEgYW5kIEMsIGFuZCBldmVyeSBub24tZWQyNTUxOSBzbG90IGluIGJveCBCIOKAlCBpcyBhIGJhcmUgc3RyaW5nIGFuZFxuICAvLyBmYWlscyBjbG9zZWQgaWYgaXQgY2FycmllcyB0aGUgb2JqZWN0IGluc3RlYWQuXG4gIGNvbnN0IHJlcXVpcmVCYXJlU3RyaW5nID0gKGVudHJ5OiBTYWZlS2V5Y2FyZFJvb3RFbnRyeSk6IHN0cmluZyA9PiB7XG4gICAgaWYgKEVkMjU1MTlDaGFpbkNvZGVFbnRyeUNvZGVjLmlzKGVudHJ5KSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCd1bmV4cGVjdGVkIGVkMjU1MTkgY2hhaW4tY29kZSBlbnRyeSB3aGVyZSBhIGJhcmUgc3RyaW5nIHdhcyByZXF1aXJlZCcpO1xuICAgIH1cbiAgICByZXR1cm4gZW50cnk7XG4gIH07XG5cbiAgY29uc3QgZGVjcnlwdEVkMjU1MTlCYWNrdXAgPSBhc3luYyAoZW50cnk6IFNhZmVLZXljYXJkUm9vdEVudHJ5KTogUHJvbWlzZTx7IHBydjogc3RyaW5nOyBjaGFpbkNvZGU6IHN0cmluZyB9PiA9PiB7XG4gICAgaWYgKCFFZDI1NTE5Q2hhaW5Db2RlRW50cnlDb2RlYy5pcyhlbnRyeSkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignZWQyNTUxOSBiYWNrdXAgcm9vdCBtdXN0IGNhcnJ5IGEgY2hhaW4gY29kZScpO1xuICAgIH1cbiAgICByZXR1cm4geyBwcnY6IGF3YWl0IGRlY3J5cHRSb290KGVudHJ5LnBydiksIGNoYWluQ29kZTogZW50cnkuY2hhaW5Db2RlIH07XG4gIH07XG5cbiAgcmV0dXJuIHtcbiAgICBzZWNwMjU2azFNdWx0aXNpZzoge1xuICAgICAgdXNlcjogYXdhaXQgZGVjcnlwdFJvb3QocmVxdWlyZUJhcmVTdHJpbmcodXNlclJvb3RzLnNlY3AyNTZrMU11bHRpc2lnKSksXG4gICAgICBiYWNrdXA6IGF3YWl0IGRlY3J5cHRSb290KHJlcXVpcmVCYXJlU3RyaW5nKGJhY2t1cFJvb3RzLnNlY3AyNTZrMU11bHRpc2lnKSksXG4gICAgICBiaXRnbzogcmVxdWlyZUJhcmVTdHJpbmcoYml0Z29Sb290cy5zZWNwMjU2azFNdWx0aXNpZyksXG4gICAgfSxcbiAgICBlZDI1NTE5TXVsdGlzaWc6IHtcbiAgICAgIHVzZXI6IGF3YWl0IGRlY3J5cHRSb290KHJlcXVpcmVCYXJlU3RyaW5nKHVzZXJSb290cy5lZDI1NTE5TXVsdGlzaWcpKSxcbiAgICAgIGJhY2t1cDogYXdhaXQgZGVjcnlwdEVkMjU1MTlCYWNrdXAoYmFja3VwUm9vdHMuZWQyNTUxOU11bHRpc2lnKSxcbiAgICAgIGJpdGdvOiByZXF1aXJlQmFyZVN0cmluZyhiaXRnb1Jvb3RzLmVkMjU1MTlNdWx0aXNpZyksXG4gICAgfSxcbiAgICBlY2RzYU1wYzoge1xuICAgICAgdXNlcjogdW53cmFwTXBjUm9vdChhd2FpdCBkZWNyeXB0Um9vdChyZXF1aXJlQmFyZVN0cmluZyh1c2VyUm9vdHMuZWNkc2FNcGMpKSksXG4gICAgICBiYWNrdXA6IHVud3JhcE1wY1Jvb3QoYXdhaXQgZGVjcnlwdFJvb3QocmVxdWlyZUJhcmVTdHJpbmcoYmFja3VwUm9vdHMuZWNkc2FNcGMpKSksXG4gICAgICBiaXRnbzogcmVxdWlyZUJhcmVTdHJpbmcoYml0Z29Sb290cy5lY2RzYU1wYyksXG4gICAgfSxcbiAgICBlZGRzYU1wYzoge1xuICAgICAgdXNlcjogdW53cmFwTXBjUm9vdChhd2FpdCBkZWNyeXB0Um9vdChyZXF1aXJlQmFyZVN0cmluZyh1c2VyUm9vdHMuZWRkc2FNcGMpKSksXG4gICAgICBiYWNrdXA6IHVud3JhcE1wY1Jvb3QoYXdhaXQgZGVjcnlwdFJvb3QocmVxdWlyZUJhcmVTdHJpbmcoYmFja3VwUm9vdHMuZWRkc2FNcGMpKSksXG4gICAgICBiaXRnbzogcmVxdWlyZUJhcmVTdHJpbmcoYml0Z29Sb290cy5lZGRzYU1wYyksXG4gICAgfSxcbiAgfTtcbn1cblxuLyoqXG4gKiBEZXJpdmVzIGEgU2FmZSB3YWxsZXQncyBjaGlsZCBrZXlzIGF0IHRoZSBCSVA0NCBwYXRoIGZvciBhIGdpdmVuIHNsb3QgYW5kIGFjY291bnQuXG4gKiBTdXBwb3J0cyBhbGwgZm91ciBzbG90czogYHNlY3AyNTZrMU11bHRpc2lnYCwgYGVkMjU1MTlNdWx0aXNpZ2AsIGBlY2RzYU1wY2AsIGFuZCBgZWRkc2FNcGNgLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZGVyaXZlU2FmZVdhbGxldEtleXMocGFyYW1zOiB7XG4gIGNvaW46IHN0cmluZztcbiAgc2xvdDogUm9vdEtleVR5cGU7XG4gIGFjY291bnQ6IG51bWJlcjtcbiAgcm9vdHM6IERlY3J5cHRlZFNhZmVSb290cztcbn0pOiBQcm9taXNlPERlcml2ZWRTYWZlV2FsbGV0S2V5cz4ge1xuICBpZiAoIU51bWJlci5pc0ludGVnZXIocGFyYW1zLmFjY291bnQpIHx8IHBhcmFtcy5hY2NvdW50IDwgMCB8fCBwYXJhbXMuYWNjb3VudCA+IE1BWF9CSVAzMl9JTkRFWCkge1xuICAgIHRocm93IG5ldyBFcnJvcihgZGVyaXZlU2FmZVdhbGxldEtleXM6IGludmFsaWQgYWNjb3VudCAnJHtwYXJhbXMuYWNjb3VudH0nYCk7XG4gIH1cblxuICBjb25zdCB7IGFjY291bnQsIHJvb3RzIH0gPSBwYXJhbXM7XG4gIGNvbnN0IHBhdGggPSBidWlsZFNhZmVCaXA0NFBhdGgoZ2V0U2FmZUJpcDQ0Q29pblR5cGUocGFyYW1zLmNvaW4pLCBwYXJhbXMuc2xvdCwgYWNjb3VudCk7XG4gIGNvbnN0IHsgY29pblR5cGUsIHNsb3RPcmRpbmFsIH0gPSBwYXJzZVNhZmVCaXA0NFBhdGgocGF0aCk7XG5cbiAgaWYgKHBhcmFtcy5zbG90ID09PSAnc2VjcDI1NmsxTXVsdGlzaWcnKSB7XG4gICAgcmV0dXJuIHsgc2xvdDogJ3NlY3AyNTZrMU11bHRpc2lnJywgcGF0aCwga2V5czogZGVyaXZlU2FmZUNoaWxkVHJpcGxldChyb290cy5zZWNwMjU2azFNdWx0aXNpZywgcGF0aCkgfTtcbiAgfVxuXG4gIGlmIChwYXJhbXMuc2xvdCA9PT0gJ2VjZHNhTXBjJykge1xuICAgIGNvbnN0IHsgY29tbW9uS2V5Y2hhaW4sIHVzZXJDaGlsZCwgYmFja3VwQ2hpbGQgfSA9IGF3YWl0IERrbHNWcmZVdGlscy5kZXJpdmVTYWZlRWNkc2FNcGNDaGlsZCh7XG4gICAgICB1c2VyUm9vdDogcm9vdHMuZWNkc2FNcGMudXNlcixcbiAgICAgIGJhY2t1cFJvb3Q6IHJvb3RzLmVjZHNhTXBjLmJhY2t1cCxcbiAgICAgIGFjY291bnQsXG4gICAgICBjb2luVHlwZSxcbiAgICAgIHNhZmVTbG90T3JkaW5hbDogc2xvdE9yZGluYWwsXG4gICAgfSk7XG4gICAgcmV0dXJuIHtcbiAgICAgIHNsb3Q6ICdlY2RzYU1wYycsXG4gICAgICBwYXRoLFxuICAgICAga2V5czogeyBjb21tb25LZXljaGFpbiwgdXNlcjogdXNlckNoaWxkLCBiYWNrdXA6IGJhY2t1cENoaWxkIH0sXG4gICAgfTtcbiAgfVxuXG4gIGlmIChwYXJhbXMuc2xvdCA9PT0gJ2VkZHNhTXBjJykge1xuICAgIGNvbnN0IHsgY29tbW9uS2V5Y2hhaW4sIHVzZXJDaGlsZCwgYmFja3VwQ2hpbGQgfSA9IGF3YWl0IE1wc1ZyZlV0aWxzLmRlcml2ZVNhZmVFZGRzYU1wY0NoaWxkKHtcbiAgICAgIHVzZXJSb290OiByb290cy5lZGRzYU1wYy51c2VyLFxuICAgICAgYmFja3VwUm9vdDogcm9vdHMuZWRkc2FNcGMuYmFja3VwLFxuICAgICAgYWNjb3VudCxcbiAgICAgIGNvaW5UeXBlLFxuICAgICAgc2FmZVNsb3RPcmRpbmFsOiBzbG90T3JkaW5hbCxcbiAgICB9KTtcbiAgICByZXR1cm4ge1xuICAgICAgc2xvdDogJ2VkZHNhTXBjJyxcbiAgICAgIHBhdGgsXG4gICAgICBrZXlzOiB7IGNvbW1vbktleWNoYWluLCB1c2VyOiB1c2VyQ2hpbGQsIGJhY2t1cDogYmFja3VwQ2hpbGQgfSxcbiAgICB9O1xuICB9XG5cbiAgaWYgKHBhcmFtcy5zbG90ID09PSAnZWQyNTUxOU11bHRpc2lnJykge1xuICAgIGNvbnN0IHJvb3QgPSByb290cy5lZDI1NTE5TXVsdGlzaWc7XG4gICAgY29uc3QgY29zaWduZXJQYXRoID0gdG9Tb2Z0VHdpblBhdGgocGF0aCk7XG5cbiAgICBjb25zdCB1c2VyID0gZGVyaXZlU2FmZUNoaWxkRWQyNTUxOUhhcmRlbmVkKHJvb3QudXNlciwgcGF0aCk7XG4gICAgY29uc3QgYmFja3VwID0gYXdhaXQgc29mdERlcml2ZUNoaWxkUHJ2RWQyNTUxOUF0UGF0aCh7XG4gICAgICBzZWVkU3RyS2V5OiByb290LmJhY2t1cC5wcnYsXG4gICAgICBjaGFpbkNvZGU6IHJvb3QuYmFja3VwLmNoYWluQ29kZSxcbiAgICAgIHBhdGg6IGNvc2lnbmVyUGF0aCxcbiAgICB9KTtcbiAgICBjb25zdCBiaXRnbyA9IGF3YWl0IHNvZnREZXJpdmVDaGlsZFB1YkVkMjU1MTlBdFBhdGgocm9vdC5iaXRnbywgY29zaWduZXJQYXRoKTtcblxuICAgIHJldHVybiB7XG4gICAgICBzbG90OiAnZWQyNTUxOU11bHRpc2lnJyxcbiAgICAgIHBhdGgsXG4gICAgICBrZXlzOiB7XG4gICAgICAgIHVzZXI6IHsga2luZDogJ3NlZWQnLCBzZWVkOiB1c2VyLnBydiwgcHViOiBkZWNvZGVFZDI1NTE5U3RyS2V5UHVibGljS2V5KHVzZXIucHViKS50b1N0cmluZygnaGV4JykgfSxcbiAgICAgICAgYmFja3VwOiB7XG4gICAgICAgICAga2luZDogJ2V4dGVuZGVkJyxcbiAgICAgICAgICBrTDogYmFja3VwLmtMLnRvU3RyaW5nKCdoZXgnKSxcbiAgICAgICAgICBrUjogYmFja3VwLmtSLnRvU3RyaW5nKCdoZXgnKSxcbiAgICAgICAgICBwdWI6IGJhY2t1cC5wdWIudG9TdHJpbmcoJ2hleCcpLFxuICAgICAgICB9LFxuICAgICAgICBiaXRnbzogeyBwdWI6IGJpdGdvLnRvU3RyaW5nKCdoZXgnKSB9LFxuICAgICAgfSxcbiAgICB9O1xuICB9XG5cbiAgdGhyb3cgbmV3IEVycm9yKGBkZXJpdmVTYWZlV2FsbGV0S2V5czogc2xvdCAnJHtwYXJhbXMuc2xvdH0nIGlzIG5vdCBzdXBwb3J0ZWQgeWV0YCk7XG59XG5cbi8qKlxuICogUGVyLWNvaW4gZW5jb2RlcnMgZm9yIHRoZSBgZWQyNTUxOU11bHRpc2lnYCBzbG90OiBlYWNoIHNsb3QtMiBjb2luIHJlLWVuY29kZXMgdGhlIHNhbWUgMzItYnl0ZVxuICogY2hpbGRyZW4gaW50byBpdHMgb3duIGFkZHJlc3Mvc2VlZCBzdHJpbmcgZm9ybWF0cy4gQSBjb2luIGFic2VudCBmcm9tIHRoZSByZWdpc3RyeSBpcyBub3QgeWV0XG4gKiBzdXBwb3J0ZWQgZm9yIHNsb3QtMiByZWNvdmVyeSAoeGxtIGlzIGEgZnV0dXJlIGFybSkuXG4gKi9cbmNvbnN0IEFMR09fRU5DT0RFUlMgPSB7XG4gIGVuY29kZVB1YjogZW5jb2RlQWxnb0tleSxcbiAgZW5jb2RlU2VlZDogZW5jb2RlQWxnb0tleSxcbiAgZGVyaXZlUm9vdEFkZHJlc3M6ICh1c2VyUHViOiBCdWZmZXIsIGJhY2t1cFB1YjogQnVmZmVyLCBiaXRnb1B1YjogQnVmZmVyKSA9PlxuICAgIGFsZ29NdWx0aXNpZ0FkZHJlc3MoMSwgMiwgW3VzZXJQdWIsIGJhY2t1cFB1YiwgYml0Z29QdWJdKSxcbn07XG5cbmNvbnN0IEVEMjU1MTlfTVVMVElTSUdfQ09JTl9FTkNPREVSUzogUmVjb3JkPFxuICBzdHJpbmcsXG4gIHwge1xuICAgICAgZW5jb2RlUHViOiAoYnl0ZXM6IEJ1ZmZlcikgPT4gc3RyaW5nO1xuICAgICAgZW5jb2RlU2VlZDogKGJ5dGVzOiBCdWZmZXIpID0+IHN0cmluZztcbiAgICAgIGRlcml2ZVJvb3RBZGRyZXNzPzogKHVzZXJQdWI6IEJ1ZmZlciwgYmFja3VwUHViOiBCdWZmZXIsIGJpdGdvUHViOiBCdWZmZXIpID0+IHN0cmluZztcbiAgICB9XG4gIHwgdW5kZWZpbmVkXG4+ID0ge1xuICBhbGdvOiBBTEdPX0VOQ09ERVJTLFxuICB0YWxnbzogQUxHT19FTkNPREVSUyxcbiAgaGJhcjogeyBlbmNvZGVQdWI6IGVuY29kZUhiYXJQdWJsaWNLZXlEZXIsIGVuY29kZVNlZWQ6IGVuY29kZUhiYXJQcml2YXRlS2V5RGVyIH0sXG4gIHRoYmFyOiB7IGVuY29kZVB1YjogZW5jb2RlSGJhclB1YmxpY0tleURlciwgZW5jb2RlU2VlZDogZW5jb2RlSGJhclByaXZhdGVLZXlEZXIgfSxcbn07XG5cbi8qKlxuICogVGhlIHJlcXVlc3Qgc2hhcGUgZm9yIGBidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zYC4gVGhlIGBzbG90YCBsaXRlcmFsIGlzIHRoZSBkaXNjcmltaW5hbnQgdGhhdFxuICogdGllcyBlYWNoIHNsb3QgdG8gaXRzIG93biBga2V5c2Agc2hhcGUsIHNvIFR5cGVTY3JpcHQgbmFycm93cyBgcGFyYW1zLmtleXNgIGF1dG9tYXRpY2FsbHkgYW5kIGFcbiAqIHNsb3QgYWRkZWQgd2l0aG91dCBhIGJyYW5jaCBpcyBhIGNvbXBpbGUgZXJyb3IgcmF0aGVyIHRoYW4gYSBzaWxlbnQgY2FzdC5cbiAqL1xuZXhwb3J0IHR5cGUgU2FmZVJlY292ZXJLZXlQYXJhbXNSZXF1ZXN0ID0ge1xuICBiaXRnbzogQml0R29CYXNlO1xuICBjb2luOiBzdHJpbmc7XG4gIG1vZGU6ICdzaWduZWQnIHwgJ3Vuc2lnbmVkJztcbn0gJiAoXG4gIHwgeyBzbG90OiAnc2VjcDI1NmsxTXVsdGlzaWcnOyBrZXlzOiBTZWNwMjU2azFNdWx0aXNpZ0NoaWxkS2V5cyB9XG4gIHwgeyBzbG90OiAnZWQyNTUxOU11bHRpc2lnJzsga2V5czogRWQyNTUxOU11bHRpc2lnQ2hpbGRLZXlzIH1cbiAgfCB7IHNsb3Q6ICdlY2RzYU1wYyc7IGtleXM6IEVjZHNhTXBjQ2hpbGRLZXlzIH1cbiAgfCB7IHNsb3Q6ICdlZGRzYU1wYyc7IGtleXM6IEVkZHNhTXBjQ2hpbGRLZXlzIH1cbik7XG5cbi8qKlxuICogQnVpbGRzIHRoZSBrZXkgZmllbGRzIGBjb2luLnJlY292ZXIoKWAgZXhwZWN0cyBmcm9tIGRlcml2ZWQgU2FmZSBjaGlsZCBrZXlzLlxuICogU3VwcG9ydHMgYHNlY3AyNTZrMU11bHRpc2lnYCAoc2xvdCAxKSBhbmQgYGVkMjU1MTlNdWx0aXNpZ2AgKHNsb3QgMik7IHRoZSBNUEMgc2xvdHMgZmFpbCBjbG9zZWQuXG4gKiBTaWduZWQgbW9kZSByZS1lbmNyeXB0cyB0aGUgY2hpbGQgc2VjcmV0cyB1bmRlciBhIGZyZXNoIGVwaGVtZXJhbCBwYXNzcGhyYXNlICh2MS9TSkNMKTsgdW5zaWduZWRcbiAqIG1vZGUgcmV0dXJucyBwdWJzLiBXaGVyZSBzdXBwb3J0ZWQsIGByb290QWRkcmVzc2AgaXMgZGVyaXZlZCBmcm9tIHRoZSBjaGlsZCBrZXlzLCBub3QgaW5kZXBlbmRlbnRseVxuICogdmVyaWZpZWQ7IG90aGVyd2lzZSBpdCBpcyBvbWl0dGVkIHNvIHRoZSBjYWxsZXIgY2FuIHN1cHBseSBpdC5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGJ1aWxkU2FmZVJlY292ZXJLZXlQYXJhbXMoXG4gIHBhcmFtczogRXh0cmFjdDxTYWZlUmVjb3ZlcktleVBhcmFtc1JlcXVlc3QsIHsgc2xvdDogJ3NlY3AyNTZrMU11bHRpc2lnJyB9PlxuKTogUHJvbWlzZTxTZWNwU2FmZVJlY292ZXJLZXlQYXJhbXM+O1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGJ1aWxkU2FmZVJlY292ZXJLZXlQYXJhbXMoXG4gIHBhcmFtczogRXh0cmFjdDxTYWZlUmVjb3ZlcktleVBhcmFtc1JlcXVlc3QsIHsgc2xvdDogJ2VkMjU1MTlNdWx0aXNpZycgfT5cbik6IFByb21pc2U8RWQyNTUxOVNhZmVSZWNvdmVyS2V5UGFyYW1zPjtcbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zKHBhcmFtczogU2FmZVJlY292ZXJLZXlQYXJhbXNSZXF1ZXN0KTogUHJvbWlzZTxTYWZlUmVjb3ZlcktleVBhcmFtcz47XG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gYnVpbGRTYWZlUmVjb3ZlcktleVBhcmFtcyhwYXJhbXM6IFNhZmVSZWNvdmVyS2V5UGFyYW1zUmVxdWVzdCk6IFByb21pc2U8U2FmZVJlY292ZXJLZXlQYXJhbXM+IHtcbiAgY29uc3QgeyBiaXRnbywgbW9kZSB9ID0gcGFyYW1zO1xuXG4gIGlmIChwYXJhbXMuc2xvdCA9PT0gJ2VkMjU1MTlNdWx0aXNpZycpIHtcbiAgICByZXR1cm4gYnVpbGRFZDI1NTE5TXVsdGlzaWdSZWNvdmVyS2V5UGFyYW1zKGJpdGdvLCBwYXJhbXMuY29pbiwgcGFyYW1zLmtleXMsIG1vZGUpO1xuICB9XG5cbiAgaWYgKHBhcmFtcy5zbG90ID09PSAnc2VjcDI1NmsxTXVsdGlzaWcnKSB7XG4gICAgY29uc3Qga2V5cyA9IHBhcmFtcy5rZXlzO1xuXG4gICAgaWYgKG1vZGUgPT09ICd1bnNpZ25lZCcpIHtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHNsb3Q6ICdzZWNwMjU2azFNdWx0aXNpZycsXG4gICAgICAgIHVzZXJLZXk6IGtleXMudXNlci5wdWIsXG4gICAgICAgIGJhY2t1cEtleToga2V5cy5iYWNrdXAucHViLFxuICAgICAgICBiaXRnb0tleToga2V5cy5iaXRnby5wdWIsXG4gICAgICB9O1xuICAgIH1cblxuICAgIGNvbnN0IHVzZXJQcnYgPSBiaXAzMi5mcm9tQmFzZTU4KGtleXMudXNlci5wcnYpO1xuICAgIGNvbnN0IGJhY2t1cFBydiA9IGJpcDMyLmZyb21CYXNlNTgoa2V5cy5iYWNrdXAucHJ2KTtcbiAgICBpZiAoIXVzZXJQcnYucHJpdmF0ZUtleSB8fCAhYmFja3VwUHJ2LnByaXZhdGVLZXkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignYnVpbGRTYWZlUmVjb3ZlcktleVBhcmFtczoga2V5cy51c2VyLnBydiBhbmQga2V5cy5iYWNrdXAucHJ2IG11c3QgYmUgcHJpdmF0ZSB4cHJ2cycpO1xuICAgIH1cblxuICAgIGNvbnN0IHdhbGxldFBhc3NwaHJhc2UgPSByYW5kb21CeXRlcygzMikudG9TdHJpbmcoJ2hleCcpO1xuICAgIGNvbnN0IFt1c2VyS2V5LCBiYWNrdXBLZXldID0gYXdhaXQgUHJvbWlzZS5hbGwoW1xuICAgICAgYml0Z28uZW5jcnlwdCh7IGlucHV0OiBrZXlzLnVzZXIucHJ2LCBwYXNzd29yZDogd2FsbGV0UGFzc3BocmFzZSwgZW5jcnlwdGlvblZlcnNpb246IDEgfSksXG4gICAgICBiaXRnby5lbmNyeXB0KHsgaW5wdXQ6IGtleXMuYmFja3VwLnBydiwgcGFzc3dvcmQ6IHdhbGxldFBhc3NwaHJhc2UsIGVuY3J5cHRpb25WZXJzaW9uOiAxIH0pLFxuICAgIF0pO1xuXG4gICAgcmV0dXJuIHtcbiAgICAgIHNsb3Q6ICdzZWNwMjU2azFNdWx0aXNpZycsXG4gICAgICB1c2VyS2V5LFxuICAgICAgYmFja3VwS2V5LFxuICAgICAgYml0Z29LZXk6IGtleXMuYml0Z28ucHViLFxuICAgICAgd2FsbGV0UGFzc3BocmFzZSxcbiAgICB9O1xuICB9XG5cbiAgdGhyb3cgbmV3IEVycm9yKGBidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zOiBzbG90ICcke3BhcmFtcy5zbG90fScgaXMgbm90IHN1cHBvcnRlZCB5ZXRgKTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gYnVpbGRFZDI1NTE5TXVsdGlzaWdSZWNvdmVyS2V5UGFyYW1zKFxuICBiaXRnbzogQml0R29CYXNlLFxuICBjb2luOiBzdHJpbmcsXG4gIGtleXM6IEVkMjU1MTlNdWx0aXNpZ0NoaWxkS2V5cyxcbiAgbW9kZTogJ3NpZ25lZCcgfCAndW5zaWduZWQnXG4pOiBQcm9taXNlPEVkMjU1MTlTYWZlUmVjb3ZlcktleVBhcmFtcz4ge1xuICBjb25zdCBlbmNvZGVycyA9IEVEMjU1MTlfTVVMVElTSUdfQ09JTl9FTkNPREVSU1tjb2luXTtcbiAgaWYgKCFlbmNvZGVycykge1xuICAgIHRocm93IG5ldyBFcnJvcihgYnVpbGRTYWZlUmVjb3ZlcktleVBhcmFtczogY29pbiAnJHtjb2lufScgZWQyNTUxOU11bHRpc2lnIGlzIG5vdCBzdXBwb3J0ZWQgeWV0YCk7XG4gIH1cblxuICBmb3IgKGNvbnN0IHB1YiBvZiBba2V5cy51c2VyLnB1Yiwga2V5cy5iYWNrdXAucHViLCBrZXlzLmJpdGdvLnB1Yl0pIHtcbiAgICAvLyBzdHJpY3QgaGV4LCBub3QgbGVuZ3RoLW9ubHk6IEJ1ZmZlci5mcm9tKHB1YiwgJ2hleCcpIHRydW5jYXRlcyBhdCB0aGUgZmlyc3QgYmFkIHBhaXIsIHNvIGFcbiAgICAvLyBsZW5ndGggY2hlY2sgYWxvbmUgd291bGQgYWNjZXB0IHRyYWlsaW5nIGdhcmJhZ2VcbiAgICBpZiAoIS9eWzAtOWEtZl17NjR9JC9pLnRlc3QocHViKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdidWlsZFNhZmVSZWNvdmVyS2V5UGFyYW1zOiBlZDI1NTE5IGNoaWxkIHB1YmxpYyBrZXlzIG11c3QgYmUgMzIgYnl0ZXMnKTtcbiAgICB9XG4gIH1cblxuICBjb25zdCB1c2VyUHViID0gQnVmZmVyLmZyb20oa2V5cy51c2VyLnB1YiwgJ2hleCcpO1xuICBjb25zdCBiYWNrdXBQdWIgPSBCdWZmZXIuZnJvbShrZXlzLmJhY2t1cC5wdWIsICdoZXgnKTtcbiAgY29uc3QgYml0Z29QdWIgPSBCdWZmZXIuZnJvbShrZXlzLmJpdGdvLnB1YiwgJ2hleCcpO1xuXG4gIC8vIFRoZSByb290IGFkZHJlc3MgaXMgZGVyaXZhYmxlIGZyb20gY2hpbGQgcHVicyBmb3IgQUxHTyAodmVyc2lvbi0xIDItb2YtMyBtdWx0aXNpZyksIGJ1dFxuICAvLyBub3QgZm9yIEhCQVIgKEhlZGVyYSBhY2NvdW50IElEcyBhcmUgbmV0d29yay1hc3NpZ25lZCkuIEVhY2ggY29pbiBkZWNsYXJlcywgdmlhIGl0cyByZWdpc3RyeVxuICAvLyBlbnRyeSwgd2hldGhlciBpdCBjYW4gZGVyaXZlIG9uZTsgdGhlIGNhbGxlciBzdXBwbGllcyBpdCBvdGhlcndpc2UuXG4gIGNvbnN0IHJvb3RBZGRyZXNzID0gZW5jb2RlcnMuZGVyaXZlUm9vdEFkZHJlc3M/Lih1c2VyUHViLCBiYWNrdXBQdWIsIGJpdGdvUHViKTtcbiAgY29uc3Qgcm9vdEFkZHJlc3NQYXJhbXMgPSByb290QWRkcmVzcyA9PT0gdW5kZWZpbmVkID8ge30gOiB7IHJvb3RBZGRyZXNzIH07XG5cbiAgaWYgKG1vZGUgPT09ICd1bnNpZ25lZCcpIHtcbiAgICByZXR1cm4ge1xuICAgICAgc2xvdDogJ2VkMjU1MTlNdWx0aXNpZycsXG4gICAgICBtb2RlOiAndW5zaWduZWQnLFxuICAgICAgdXNlcktleTogZW5jb2RlcnMuZW5jb2RlUHViKHVzZXJQdWIpLFxuICAgICAgYmFja3VwS2V5OiBlbmNvZGVycy5lbmNvZGVQdWIoYmFja3VwUHViKSxcbiAgICAgIGJpdGdvS2V5OiBlbmNvZGVycy5lbmNvZGVQdWIoYml0Z29QdWIpLFxuICAgICAgLi4ucm9vdEFkZHJlc3NQYXJhbXMsXG4gICAgfTtcbiAgfVxuXG4gIC8vIFRoZSB1c2VyIGNoaWxkIGlzIGEgaGFyZGVuZWQgU0xJUC0wMDEwIHNlZWQsIHNvIGl0IHJlLWVuY3J5cHRzIGV4YWN0bHkgbGlrZSBzbG90IDEuIFRoZSBiYWNrdXBcbiAgLy8gY2hpbGQgaXMgYSBzZWVkbGVzcyBzb2Z0IGV4dGVuZGVkIGtleTogaXQgY2Fubm90IGJlIHJlLWVuY3J5cHRlZCBhcyBhIHNlZWQsIHNvIGl0IGJlY29tZXMgYSBsYXp5XG4gIC8vIGV4dGVybmFsIHNpZ25lciBvdmVyIHRoZSB0eCBieXRlcyAoV0NOLTI4OTUncyBleHRlbmRlZC1rZXkgc2lnbmVyLCBpbnZva2VkIGJ5IHRoZSBjb2luKS5cbiAgY29uc3Qgd2FsbGV0UGFzc3BocmFzZSA9IHJhbmRvbUJ5dGVzKDMyKS50b1N0cmluZygnaGV4Jyk7XG4gIGNvbnN0IHVzZXJLZXkgPSBhd2FpdCBiaXRnby5lbmNyeXB0KHtcbiAgICBpbnB1dDogZW5jb2RlcnMuZW5jb2RlU2VlZChCdWZmZXIuZnJvbShrZXlzLnVzZXIuc2VlZCwgJ2hleCcpKSxcbiAgICBwYXNzd29yZDogd2FsbGV0UGFzc3BocmFzZSxcbiAgICBlbmNyeXB0aW9uVmVyc2lvbjogMSxcbiAgfSk7XG5cbiAgcmV0dXJuIHtcbiAgICBzbG90OiAnZWQyNTUxOU11bHRpc2lnJyxcbiAgICBtb2RlOiAnc2lnbmVkJyxcbiAgICB1c2VyS2V5LFxuICAgIGJpdGdvS2V5OiBlbmNvZGVycy5lbmNvZGVQdWIoYml0Z29QdWIpLFxuICAgIHdhbGxldFBhc3NwaHJhc2UsXG4gICAgLi4ucm9vdEFkZHJlc3NQYXJhbXMsXG4gICAgZXh0ZXJuYWxCYWNrdXBTaWduZXI6IHtcbiAgICAgIHB1YmxpY0tleToga2V5cy5iYWNrdXAucHViLFxuICAgICAgc2lnbjogYXN5bmMgKG1lc3NhZ2UpID0+ICh7XG4gICAgICAgIHNpZ25hdHVyZTogKFxuICAgICAgICAgIGF3YWl0IHNpZ25FZDI1NTE5RXh0ZW5kZWQoXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShtZXNzYWdlKSxcbiAgICAgICAgICAgIEJ1ZmZlci5mcm9tKGtleXMuYmFja3VwLmtMLCAnaGV4JyksXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShrZXlzLmJhY2t1cC5rUiwgJ2hleCcpXG4gICAgICAgICAgKVxuICAgICAgICApLnRvU3RyaW5nKCdoZXgnKSxcbiAgICAgIH0pLFxuICAgIH0sXG4gIH07XG59XG4iXX0=

package/dist/src/bitgo/safe/rootCoin.d.ts

@@ -0,0 +1,15 @@
+import { RootKeyType } from '@bitgo/public-types';
+import { IBaseCoin } from '../baseCoin';
+import { BitGoBase } from '../bitgoBase';
+/**
+ * Canonical order of the safe root slots. Shared by safe minting (Safes.createSafeKeys) and
+ * passkey register/remove (Safe) so both iterate the slots identically.
+ * @experimental
+ */
+export declare const SAFE_ROOT_SLOTS: RootKeyType[];
+/**
+ * Coin used to route a given root's key operations (see ROOT_COIN_BY_NETWORK).
+ * @experimental
+ */
+export declare function coinForRoot(bitgo: BitGoBase, slot: RootKeyType): IBaseCoin;
+//# sourceMappingURL=rootCoin.d.ts.map

package/dist/src/bitgo/safe/rootCoin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootCoin.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/rootCoin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,EAAqE,CAAC;AA4B/G;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS,CAK1E"}

package/dist/src/bitgo/safe/rootCoin.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_ROOT_SLOTS = void 0;
+exports.coinForRoot = coinForRoot;
+const common_1 = require("../../common");
+/**
+ * Canonical order of the safe root slots. Shared by safe minting (Safes.createSafeKeys) and
+ * passkey register/remove (Safe) so both iterate the slots identically.
+ * @experimental
+ */
+exports.SAFE_ROOT_SLOTS = ['secp256k1Multisig', 'ed25519Multisig', 'ecdsaMpc', 'eddsaMpc'];
+/**
+ * Representative coin per root slot, by network. Safe roots are curve/scheme-scoped, not
+ * coin-scoped — WP stamps `curve` server-side from the coin's key curve, so any coin of the
+ * right (curve, scheme) works. These are stable, always-available choices used only to route
+ * the key ceremony; the resulting root is interchangeable across coins of the slot.
+ * @experimental
+ */
+const ROOT_COIN_BY_NETWORK = {
+    mainnet: {
+        // multisig roots
+        secp256k1Multisig: 'btc',
+        ed25519Multisig: 'xlm',
+        // MPC roots
+        ecdsaMpc: 'eth',
+        eddsaMpc: 'sol',
+    },
+    testnet: {
+        // multisig roots
+        secp256k1Multisig: 'tbtc',
+        ed25519Multisig: 'txlm',
+        // MPC roots
+        ecdsaMpc: 'hteth',
+        eddsaMpc: 'tsol',
+    },
+};
+/**
+ * Coin used to route a given root's key operations (see ROOT_COIN_BY_NETWORK).
+ * @experimental
+ */
+function coinForRoot(bitgo, slot) {
+    // V1Network is exactly 'bitcoin' | 'testnet', so this branch is exhaustive over every
+    // environment: 'bitcoin' is mainnet and every other value is a testnet.
+    const network = common_1.Environments[bitgo.getEnv()].network === 'bitcoin' ? 'mainnet' : 'testnet';
+    return bitgo.coin(ROOT_COIN_BY_NETWORK[network][slot]);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9vdENvaW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYml0Z28vc2FmZS9yb290Q29pbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUEwQ0Esa0NBS0M7QUE5Q0QseUNBQTRDO0FBSTVDOzs7O0dBSUc7QUFDVSxRQUFBLGVBQWUsR0FBa0IsQ0FBQyxtQkFBbUIsRUFBRSxpQkFBaUIsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFFL0c7Ozs7OztHQU1HO0FBQ0gsTUFBTSxvQkFBb0IsR0FBK0Q7SUFDdkYsT0FBTyxFQUFFO1FBQ1AsaUJBQWlCO1FBQ2pCLGlCQUFpQixFQUFFLEtBQUs7UUFDeEIsZUFBZSxFQUFFLEtBQUs7UUFDdEIsWUFBWTtRQUNaLFFBQVEsRUFBRSxLQUFLO1FBQ2YsUUFBUSxFQUFFLEtBQUs7S0FDaEI7SUFDRCxPQUFPLEVBQUU7UUFDUCxpQkFBaUI7UUFDakIsaUJBQWlCLEVBQUUsTUFBTTtRQUN6QixlQUFlLEVBQUUsTUFBTTtRQUN2QixZQUFZO1FBQ1osUUFBUSxFQUFFLE9BQU87UUFDakIsUUFBUSxFQUFFLE1BQU07S0FDakI7Q0FDRixDQUFDO0FBRUY7OztHQUdHO0FBQ0gsU0FBZ0IsV0FBVyxDQUFDLEtBQWdCLEVBQUUsSUFBaUI7SUFDN0Qsc0ZBQXNGO0lBQ3RGLHdFQUF3RTtJQUN4RSxNQUFNLE9BQU8sR0FBRyxxQkFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzNGLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBSb290S2V5VHlwZSB9IGZyb20gJ0BiaXRnby9wdWJsaWMtdHlwZXMnO1xuaW1wb3J0IHsgRW52aXJvbm1lbnRzIH0gZnJvbSAnLi4vLi4vY29tbW9uJztcbmltcG9ydCB7IElCYXNlQ29pbiB9IGZyb20gJy4uL2Jhc2VDb2luJztcbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5cbi8qKlxuICogQ2Fub25pY2FsIG9yZGVyIG9mIHRoZSBzYWZlIHJvb3Qgc2xvdHMuIFNoYXJlZCBieSBzYWZlIG1pbnRpbmcgKFNhZmVzLmNyZWF0ZVNhZmVLZXlzKSBhbmRcbiAqIHBhc3NrZXkgcmVnaXN0ZXIvcmVtb3ZlIChTYWZlKSBzbyBib3RoIGl0ZXJhdGUgdGhlIHNsb3RzIGlkZW50aWNhbGx5LlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgY29uc3QgU0FGRV9ST09UX1NMT1RTOiBSb290S2V5VHlwZVtdID0gWydzZWNwMjU2azFNdWx0aXNpZycsICdlZDI1NTE5TXVsdGlzaWcnLCAnZWNkc2FNcGMnLCAnZWRkc2FNcGMnXTtcblxuLyoqXG4gKiBSZXByZXNlbnRhdGl2ZSBjb2luIHBlciByb290IHNsb3QsIGJ5IG5ldHdvcmsuIFNhZmUgcm9vdHMgYXJlIGN1cnZlL3NjaGVtZS1zY29wZWQsIG5vdFxuICogY29pbi1zY29wZWQg4oCUIFdQIHN0YW1wcyBgY3VydmVgIHNlcnZlci1zaWRlIGZyb20gdGhlIGNvaW4ncyBrZXkgY3VydmUsIHNvIGFueSBjb2luIG9mIHRoZVxuICogcmlnaHQgKGN1cnZlLCBzY2hlbWUpIHdvcmtzLiBUaGVzZSBhcmUgc3RhYmxlLCBhbHdheXMtYXZhaWxhYmxlIGNob2ljZXMgdXNlZCBvbmx5IHRvIHJvdXRlXG4gKiB0aGUga2V5IGNlcmVtb255OyB0aGUgcmVzdWx0aW5nIHJvb3QgaXMgaW50ZXJjaGFuZ2VhYmxlIGFjcm9zcyBjb2lucyBvZiB0aGUgc2xvdC5cbiAqIEBleHBlcmltZW50YWxcbiAqL1xuY29uc3QgUk9PVF9DT0lOX0JZX05FVFdPUks6IFJlY29yZDwnbWFpbm5ldCcgfCAndGVzdG5ldCcsIFJlY29yZDxSb290S2V5VHlwZSwgc3RyaW5nPj4gPSB7XG4gIG1haW5uZXQ6IHtcbiAgICAvLyBtdWx0aXNpZyByb290c1xuICAgIHNlY3AyNTZrMU11bHRpc2lnOiAnYnRjJyxcbiAgICBlZDI1NTE5TXVsdGlzaWc6ICd4bG0nLFxuICAgIC8vIE1QQyByb290c1xuICAgIGVjZHNhTXBjOiAnZXRoJyxcbiAgICBlZGRzYU1wYzogJ3NvbCcsXG4gIH0sXG4gIHRlc3RuZXQ6IHtcbiAgICAvLyBtdWx0aXNpZyByb290c1xuICAgIHNlY3AyNTZrMU11bHRpc2lnOiAndGJ0YycsXG4gICAgZWQyNTUxOU11bHRpc2lnOiAndHhsbScsXG4gICAgLy8gTVBDIHJvb3RzXG4gICAgZWNkc2FNcGM6ICdodGV0aCcsXG4gICAgZWRkc2FNcGM6ICd0c29sJyxcbiAgfSxcbn07XG5cbi8qKlxuICogQ29pbiB1c2VkIHRvIHJvdXRlIGEgZ2l2ZW4gcm9vdCdzIGtleSBvcGVyYXRpb25zIChzZWUgUk9PVF9DT0lOX0JZX05FVFdPUkspLlxuICogQGV4cGVyaW1lbnRhbFxuICovXG5leHBvcnQgZnVuY3Rpb24gY29pbkZvclJvb3QoYml0Z286IEJpdEdvQmFzZSwgc2xvdDogUm9vdEtleVR5cGUpOiBJQmFzZUNvaW4ge1xuICAvLyBWMU5ldHdvcmsgaXMgZXhhY3RseSAnYml0Y29pbicgfCAndGVzdG5ldCcsIHNvIHRoaXMgYnJhbmNoIGlzIGV4aGF1c3RpdmUgb3ZlciBldmVyeVxuICAvLyBlbnZpcm9ubWVudDogJ2JpdGNvaW4nIGlzIG1haW5uZXQgYW5kIGV2ZXJ5IG90aGVyIHZhbHVlIGlzIGEgdGVzdG5ldC5cbiAgY29uc3QgbmV0d29yayA9IEVudmlyb25tZW50c1tiaXRnby5nZXRFbnYoKV0ubmV0d29yayA9PT0gJ2JpdGNvaW4nID8gJ21haW5uZXQnIDogJ3Rlc3RuZXQnO1xuICByZXR1cm4gYml0Z28uY29pbihST09UX0NPSU5fQllfTkVUV09SS1tuZXR3b3JrXVtzbG90XSk7XG59XG4iXX0=