@bitgo-beta/sdk-core 8.2.1-beta.214 → 8.2.1-beta.2140

package/dist/src/bitgo/safe/safe.d.ts

@@ -0,0 +1,88 @@
+import { FreezeSafeBody, SafeData, SafeShareData, SafeShareState } from '@bitgo/public-types';
+import { BitGoBase } from '../bitgoBase';
+import { Wallet } from '../wallet';
+import { AcceptSafeShareOptions, AddSafeMemberOptions, AddSafeWalletMemberOptions, CreateSafeWalletOptions, ISafe, RegisterSafePasskeyOptions, RegisterSafePasskeyResponse, RemoveSafePasskeyOptions, UpdateSafeOptions, WalletShareData } from './iSafe';
+/**
+ * @experimental
+ */
+export declare class Safe implements ISafe {
+    private readonly bitgo;
+    readonly _safe: SafeData;
+    constructor(bitgo: BitGoBase, safeData: SafeData);
+    id(): string;
+    enterpriseId(): string;
+    label(): string;
+    status(): SafeData['status'];
+    /**
+     * Enterprise-scoped v2 URL for this safe, e.g. /api/v2/enterprise/:eId/safes/:safeId
+     * @param extra
+     */
+    url(extra?: string): string;
+    /**
+     * Mint a child wallet: peek the next account for (slot, coinType), derive the child keys at
+     * `m/44'/<coinType>'/<slot>'/<account>'`, register them, then mint.
+     *
+     * `onchain`: hardened-derive the user child at that path, register it public-only; backup
+     * and BitGo children are soft-derived on the server at its soft twin.
+     *
+     * `tss`: decrypt the user root blob, run the user/BitGo hard-derive ceremony at that path,
+     * register the ordered child documents, then mint.
+     */
+    createWallet(params: CreateSafeWalletOptions): Promise<Wallet>;
+    /**
+     * TSS wallet mint: decrypt the user root blob, run the user/BitGo hard-derive
+     * ceremony, register the ordered child documents, then mint.
+     */
+    private createTssWalletInSafe;
+    private fetchSafeData;
+    /**
+     * Add a member to the whole safe (view/admin/spend). Spend opens a key share.
+     */
+    addMember(params: AddSafeMemberOptions): Promise<SafeData>;
+    /**
+     * Share ONE safe wallet with a non-member via the existing wallet-share handshake.
+     */
+    addMemberToWallet(params: AddSafeWalletMemberOptions): Promise<WalletShareData>;
+    /**
+     * List the safe key shares visible to the caller.
+     */
+    listShares(params?: {
+        state?: SafeShareState;
+    }): Promise<SafeShareData[]>;
+    /**
+     * Accept a safe key share addressed to the caller.
+     */
+    acceptShare(params: AcceptSafeShareOptions): Promise<SafeShareData>;
+    /**
+     * Update the safe label.
+     */
+    update(params: UpdateSafeOptions): Promise<SafeData>;
+    /**
+     * Freeze the safe — blocks withdrawals on all safe wallets. Safe stays 'active'.
+     * @param params
+     */
+    freeze(params?: FreezeSafeBody): Promise<SafeData>;
+    /**
+     * Archive the safe. Requires every safe wallet to already be archived; also the abandonment
+     * path for a stuck 'initializing' safe.
+     */
+    archive(): Promise<SafeData>;
+    /**
+     * Register a PRF passkey on every user root of the safe.
+     *
+     * For each user root (position 0 of each populated slot), decrypt the root with the Safe
+     * password, then re-encrypt it under the PRF-derived password (bound to the enterprise via
+     * AES-GCM AAD). One PRF assertion serves the whole safe; the write set is the user roots only
+     * — backup and BitGo roots are never wrapped.
+     */
+    registerPasskey(params: RegisterSafePasskeyOptions): Promise<RegisterSafePasskeyResponse>;
+    /**
+     * Remove a PRF passkey from every user root of the safe.
+     *
+     * The Safe password is verified client-side (decrypt one user root) before the server is
+     * called; the server enforces owner authorization and performs the idempotent per-root `$pull`.
+     */
+    removePasskey(params: RemoveSafePasskeyOptions): Promise<void>;
+    toJSON(): SafeData;
+}
+//# sourceMappingURL=safe.d.ts.map

package/dist/src/bitgo/safe/safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.d.ts","sourceRoot":"","sources":["../../../../src/bitgo/safe/safe.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAoB,MAAM,qBAAqB,CAAC;AAEhH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGnC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EAChB,MAAM,SAAS,CAAC;AAoEjB;;GAEG;AACH,qBAAa,IAAK,YAAW,KAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,SAAgB,KAAK,EAAE,QAAQ,CAAC;gBAEpB,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;IAKhD,EAAE,IAAI,MAAM;IAIZ,YAAY,IAAI,MAAM;IAItB,KAAK,IAAI,MAAM;IAIf,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAI5B;;;OAGG;IACH,GAAG,CAAC,KAAK,SAAK,GAAG,MAAM;IAIvB;;;;;;;;;OASG;IACG,YAAY,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqFpE;;;OAGG;YACW,qBAAqB;YAuDrB,aAAa;IAK3B;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,eAAe,CAAC;IAIrF;;OAEG;IACG,UAAU,CAAC,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,cAAc,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAInF;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAIzE;;OAEG;IACG,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK1D;;;OAGG;IACG,MAAM,CAAC,MAAM,GAAE,cAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK5D;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IAKlC;;;;;;;OAOG;IACG,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqE/F;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BpE,MAAM,IAAI,QAAQ;CAGnB"}

package/dist/src/bitgo/safe/safe.js

@@ -0,0 +1,417 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Safe = void 0;
+/**
+ * @prettier
+ *
+ * @experimental The safe client surface is experimental and may change (including breaking
+ * changes) before the public release.
+ */
+const t = __importStar(require("io-ts"));
+const public_types_1 = require("@bitgo/public-types");
+const errors_1 = require("../errors");
+const keychain_1 = require("../keychain");
+const utils_1 = require("../utils");
+const codecs_1 = require("../utils/codecs");
+const postWithCodec_1 = require("../utils/postWithCodec");
+const wallet_1 = require("../wallet");
+const safeKeychain_1 = require("../wallet/safeKeychain");
+const webauthn_1 = require("../webauthn");
+const rootCoin_1 = require("./rootCoin");
+const sdk_lib_safes_1 = require("@bitgo-beta/sdk-lib-safes");
+const SafeRootKeySlot = t.keyof({
+    secp256k1Multisig: null,
+    ecdsaMpc: null,
+    eddsaMpc: null,
+    ed25519Multisig: null,
+});
+const GetDerivationIndexResponse = t.type({
+    slot: SafeRootKeySlot,
+    coinType: (0, codecs_1.boundedInt)(0, 0x7fffffff, 'coinType'),
+    account: (0, codecs_1.boundedInt)(0, 0x7fffffff, 'account'),
+});
+const CreateWalletInSafeBody = t.union([
+    t.strict({
+        coin: t.string,
+        label: t.string,
+        type: t.literal('hot'),
+        multisigType: t.literal('onchain'),
+        keys: t.tuple([t.string]),
+    }),
+    // TSS mint uses ordered user, backup, and BitGo child documents.
+    t.strict({
+        coin: t.string,
+        label: t.string,
+        type: t.literal('hot'),
+        multisigType: t.literal('tss'),
+        keys: t.tuple([t.string, t.string, t.string]),
+    }),
+]);
+const PasskeyEntryCodec = t.type({
+    keyId: t.string,
+    encryptedPrv: t.string,
+});
+const RegisterSafePasskeyBody = t.type({
+    otpDeviceId: t.string,
+    prfSalt: t.string,
+    entries: t.array(PasskeyEntryCodec),
+});
+const RegisterSafePasskeyResponseCodec = t.type({
+    otpDeviceId: t.string,
+    updatedKeys: t.array(t.string),
+});
+function rootIdFromSafe(safe, slot, position) {
+    const triplet = safe.rootKeys?.hot?.[slot];
+    if (!triplet || triplet.length !== 3) {
+        return undefined;
+    }
+    const rootId = triplet[position];
+    return rootId.length > 0 ? rootId : undefined;
+}
+/**
+ * @experimental
+ */
+class Safe {
+    constructor(bitgo, safeData) {
+        this.bitgo = bitgo;
+        this._safe = safeData;
+    }
+    id() {
+        return this._safe.id;
+    }
+    enterpriseId() {
+        return this._safe.enterpriseId;
+    }
+    label() {
+        return this._safe.label;
+    }
+    status() {
+        return this._safe.status;
+    }
+    /**
+     * Enterprise-scoped v2 URL for this safe, e.g. /api/v2/enterprise/:eId/safes/:safeId
+     * @param extra
+     */
+    url(extra = '') {
+        return this.bitgo.url(`/enterprise/${this.enterpriseId()}/safes/${this.id()}${extra}`, 2);
+    }
+    /**
+     * Mint a child wallet: peek the next account for (slot, coinType), derive the child keys at
+     * `m/44'/<coinType>'/<slot>'/<account>'`, register them, then mint.
+     *
+     * `onchain`: hardened-derive the user child at that path, register it public-only; backup
+     * and BitGo children are soft-derived on the server at its soft twin.
+     *
+     * `tss`: decrypt the user root blob, run the user/BitGo hard-derive ceremony at that path,
+     * register the ordered child documents, then mint.
+     */
+    async createWallet(params) {
+        if (params.passphrase.length === 0) {
+            throw new Error('passphrase is required to mint a safe wallet');
+        }
+        if (params.type !== undefined && params.type !== 'hot') {
+            throw new Error('Safe wallets are hot-only in v1');
+        }
+        const multisigType = params.multisigType ?? 'onchain';
+        const isTss = multisigType === 'tss';
+        const coin = this.bitgo.coin(params.coin);
+        const slot = isTss ? (0, sdk_lib_safes_1.tssSlotForCoin)(coin.getChain()) : (0, sdk_lib_safes_1.onchainSlotForCoin)(coin.getChain());
+        const indexResponse = await this.bitgo
+            .get(this.url('/derivation-index'))
+            .query({ slot, coin: params.coin })
+            .result();
+        const peeked = (0, codecs_1.decodeWithCodec)(GetDerivationIndexResponse, indexResponse, 'GetDerivationIndexResponse');
+        if (peeked.slot !== slot) {
+            throw new Error(`derivation-index returned slot '${peeked.slot}', expected '${slot}'`);
+        }
+        // A statics version skew between SDK and server would put the child on another coin's tree.
+        const expectedCoinType = (0, sdk_lib_safes_1.getSafeBip44CoinType)(coin.getChain());
+        if (peeked.coinType !== expectedCoinType) {
+            throw new Error(`derivation-index returned coinType ${peeked.coinType}, expected ${expectedCoinType}`);
+        }
+        const path = (0, sdk_lib_safes_1.buildSafeBip44Path)(peeked.coinType, slot, peeked.account);
+        const safeData = rootIdFromSafe(this._safe, slot, 0) !== undefined ? this._safe : await this.fetchSafeData();
+        const userRootId = rootIdFromSafe(safeData, slot, 0);
+        if (userRootId === undefined) {
+            throw new Error(`Safe ${this.id()} is missing rootKeys.hot.${slot}`);
+        }
+        if (isTss) {
+            const backupRootId = rootIdFromSafe(safeData, slot, 1);
+            const bitgoRootId = rootIdFromSafe(safeData, slot, 2);
+            if (backupRootId === undefined) {
+                throw new Error(`Safe ${this.id()} is missing rootKeys.hot.${slot} backup key`);
+            }
+            if (bitgoRootId === undefined) {
+                throw new Error(`Safe ${this.id()} is missing rootKeys.hot.${slot} bitgo key`);
+            }
+            return this.createTssWalletInSafe(coin, slot, userRootId, backupRootId, bitgoRootId, path, params);
+        }
+        const keychains = coin.keychains();
+        const rootKeychain = await keychains.get({ id: userRootId });
+        if (rootKeychain.source !== 'user') {
+            throw new safeKeychain_1.InvalidRootKeychainSourceError(rootKeychain.id, rootKeychain.source);
+        }
+        const rootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(this.bitgo, rootKeychain, params.passphrase);
+        if (!rootPrv) {
+            throw new errors_1.IncorrectPasswordError();
+        }
+        const derived = slot === 'ed25519Multisig'
+            ? (0, sdk_lib_safes_1.deriveSafeChildEd25519Hardened)(rootPrv, path)
+            : (0, sdk_lib_safes_1.deriveAndSelfCheckSafeChildHardened)(rootPrv, path);
+        const child = await keychains.add({
+            pub: derived.pub,
+            source: 'user',
+            keyType: 'independent',
+            parent: userRootId,
+            safeId: this.id(),
+            derivedFromParentWithPath: derived.derivationPath,
+        });
+        const childId = child.id;
+        if (childId.length === 0) {
+            throw new Error('safe child key registration returned an empty id');
+        }
+        const keys = [childId];
+        const response = await (0, postWithCodec_1.postWithCodec)(this.bitgo, this.url('/wallets'), CreateWalletInSafeBody, {
+            coin: params.coin,
+            label: params.label,
+            type: 'hot',
+            multisigType,
+            keys,
+        }).result();
+        return new wallet_1.Wallet(this.bitgo, coin, response);
+    }
+    /**
+     * TSS wallet mint: decrypt the user root blob, run the user/BitGo hard-derive
+     * ceremony, register the ordered child documents, then mint.
+     */
+    async createTssWalletInSafe(coin, slot, userRootId, backupRootId, bitgoRootId, path, params) {
+        if (slot !== 'ecdsaMpc' && slot !== 'eddsaMpc') {
+            throw new Error(`Expected an MPC safe root slot, got '${slot}'`);
+        }
+        const keychains = coin.keychains();
+        const userRootKeychain = await keychains.get({ id: userRootId });
+        if (userRootKeychain.source !== 'user') {
+            throw new safeKeychain_1.InvalidRootKeychainSourceError(userRootKeychain.id, userRootKeychain.source);
+        }
+        const userRootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(this.bitgo, userRootKeychain, params.passphrase);
+        if (!userRootPrv) {
+            throw new errors_1.IncorrectPasswordError();
+        }
+        const userRootMaterial = (0, utils_1.parseSafeMpcKeyEnvelopes)(userRootPrv);
+        const tssUtils = slot === 'eddsaMpc'
+            ? new utils_1.EDDSAUtils.EddsaVrfMPCv2Utils(this.bitgo, coin)
+            : new utils_1.ECDSAUtils.EcdsaVrfMPCv2Utils(this.bitgo, coin);
+        const { userKeychain, backupKeychain, bitgoKeychain } = await tssUtils.createSafeChildKeychains({
+            passphrase: params.passphrase,
+            enterprise: this.enterpriseId(),
+            safeId: this.id(),
+            parentKeyId: bitgoRootId,
+            path,
+            userRootKeyId: userRootId,
+            backupRootKeyId: backupRootId,
+            userRootKeyShare: userRootMaterial.signing,
+            userRootVrfKeyShare: userRootMaterial.vrf,
+        });
+        if (userKeychain.id.length === 0 || backupKeychain.id.length === 0 || bitgoKeychain.id.length === 0) {
+            throw new Error('safe child key registration returned an empty id');
+        }
+        const keys = [userKeychain.id, backupKeychain.id, bitgoKeychain.id];
+        const response = await (0, postWithCodec_1.postWithCodec)(this.bitgo, this.url('/wallets'), CreateWalletInSafeBody, {
+            coin: params.coin,
+            label: params.label,
+            type: 'hot',
+            multisigType: 'tss',
+            keys,
+        }).result();
+        return new wallet_1.Wallet(this.bitgo, coin, response);
+    }
+    async fetchSafeData() {
+        const response = await this.bitgo.get(this.url()).result();
+        return (0, codecs_1.decodeWithCodec)(public_types_1.SafeData, response, 'SafeData');
+    }
+    /**
+     * Add a member to the whole safe (view/admin/spend). Spend opens a key share.
+     */
+    async addMember(params) {
+        throw new Error('Safe.addMember is not yet implemented');
+    }
+    /**
+     * Share ONE safe wallet with a non-member via the existing wallet-share handshake.
+     */
+    async addMemberToWallet(params) {
+        throw new Error('Safe.addMemberToWallet is not yet implemented');
+    }
+    /**
+     * List the safe key shares visible to the caller.
+     */
+    async listShares(params = {}) {
+        throw new Error('Safe.listShares is not yet implemented');
+    }
+    /**
+     * Accept a safe key share addressed to the caller.
+     */
+    async acceptShare(params) {
+        throw new Error('Safe.acceptShare is not yet implemented');
+    }
+    /**
+     * Update the safe label.
+     */
+    async update(params) {
+        const response = await this.bitgo.put(this.url()).send({ label: params.label }).result();
+        return (0, codecs_1.decodeWithCodec)(public_types_1.SafeData, response, 'SafeData');
+    }
+    /**
+     * Freeze the safe — blocks withdrawals on all safe wallets. Safe stays 'active'.
+     * @param params
+     */
+    async freeze(params = {}) {
+        const response = await (0, postWithCodec_1.postWithCodec)(this.bitgo, this.url('/freeze'), public_types_1.FreezeSafeBody, params).result();
+        return (0, codecs_1.decodeWithCodec)(public_types_1.SafeData, response, 'SafeData');
+    }
+    /**
+     * Archive the safe. Requires every safe wallet to already be archived; also the abandonment
+     * path for a stuck 'initializing' safe.
+     */
+    async archive() {
+        const response = await this.bitgo.post(this.url('/archive')).send().result();
+        return (0, codecs_1.decodeWithCodec)(public_types_1.SafeData, response, 'SafeData');
+    }
+    /**
+     * Register a PRF passkey on every user root of the safe.
+     *
+     * For each user root (position 0 of each populated slot), decrypt the root with the Safe
+     * password, then re-encrypt it under the PRF-derived password (bound to the enterprise via
+     * AES-GCM AAD). One PRF assertion serves the whole safe; the write set is the user roots only
+     * — backup and BitGo roots are never wrapped.
+     */
+    async registerPasskey(params) {
+        const { device, safePassphrase, provider, encryptionVersion } = params;
+        if (!device.id) {
+            throw new Error('device.id is required to register a passkey on the safe');
+        }
+        if (!device.prfSalt) {
+            throw new Error('PRF extension not supported by this device. Please use a different passkey.');
+        }
+        const enterpriseId = this.enterpriseId();
+        const prfSalt = (0, webauthn_1.deriveEnterpriseSalt)(device.prfSalt, enterpriseId);
+        const entries = [];
+        for (const slot of rootCoin_1.SAFE_ROOT_SLOTS) {
+            const userRootId = rootIdFromSafe(this._safe, slot, 0);
+            if (userRootId === undefined) {
+                continue;
+            }
+            const keychain = await (0, rootCoin_1.coinForRoot)(this.bitgo, slot).keychains().get({ id: userRootId });
+            if (keychain.source !== 'user') {
+                throw new safeKeychain_1.InvalidRootKeychainSourceError(keychain.id, keychain.source);
+            }
+            const rootPrv = await (0, keychain_1.decryptKeychainPrivateKey)(this.bitgo, keychain, safePassphrase);
+            if (!rootPrv) {
+                throw new errors_1.IncorrectPasswordError();
+            }
+            entries.push({ keyId: userRootId, encryptedPrv: rootPrv });
+        }
+        if (entries.length === 0) {
+            throw new Error(`Safe ${this.id()} has no user roots to attach a passkey to`);
+        }
+        const nodeBuf = (0, webauthn_1.base64UrlToBuffer)(device.credentialId);
+        const credentialIdBuffer = nodeBuf.buffer.slice(nodeBuf.byteOffset, nodeBuf.byteOffset + nodeBuf.byteLength);
+        const authResult = await provider.get({
+            publicKey: {
+                allowCredentials: [{ type: 'public-key', id: credentialIdBuffer }],
+            },
+            evalByCredential: { [device.credentialId]: prfSalt },
+        });
+        if (!authResult.prfResult) {
+            throw new Error('PRF assertion did not return a result.');
+        }
+        if ((0, webauthn_1.toBase64Url)(authResult.credentialId) !== (0, webauthn_1.toBase64Url)(device.credentialId)) {
+            throw new Error('PRF assertion returned an unexpected credential.');
+        }
+        const prfPassword = (0, webauthn_1.derivePassword)(authResult.prfResult);
+        const wrappedEntries = await Promise.all(entries.map(async ({ keyId, encryptedPrv }) => ({
+            keyId,
+            encryptedPrv: await this.bitgo.encrypt({
+                password: prfPassword,
+                input: encryptedPrv,
+                encryptionVersion,
+                adata: enterpriseId,
+            }),
+        })));
+        const response = await (0, postWithCodec_1.postWithCodec)(this.bitgo, this.url('/passkeys'), RegisterSafePasskeyBody, {
+            otpDeviceId: device.id,
+            prfSalt,
+            entries: wrappedEntries,
+        }).result();
+        return (0, codecs_1.decodeWithCodec)(RegisterSafePasskeyResponseCodec, response, 'RegisterSafePasskeyResponse');
+    }
+    /**
+     * Remove a PRF passkey from every user root of the safe.
+     *
+     * The Safe password is verified client-side (decrypt one user root) before the server is
+     * called; the server enforces owner authorization and performs the idempotent per-root `$pull`.
+     */
+    async removePasskey(params) {
+        const { device, safePassphrase } = params;
+        if (!device.id) {
+            throw new Error('device.id is required to remove a passkey from the safe');
+        }
+        const userRoots = rootCoin_1.SAFE_ROOT_SLOTS.flatMap((slot) => {
+            const userRootId = rootIdFromSafe(this._safe, slot, 0);
+            return userRootId === undefined ? [] : [{ slot, userRootId }];
+        });
+        if (userRoots.length === 0) {
+            throw new Error(`Safe ${this.id()} has no user roots to remove a passkey from`);
+        }
+        let verified = false;
+        for (const { slot, userRootId } of userRoots) {
+            const keychain = await (0, rootCoin_1.coinForRoot)(this.bitgo, slot).keychains().get({ id: userRootId });
+            const decrypted = await (0, keychain_1.decryptKeychainPrivateKey)(this.bitgo, keychain, safePassphrase);
+            if (decrypted) {
+                verified = true;
+                break;
+            }
+        }
+        if (!verified) {
+            throw new errors_1.IncorrectPasswordError();
+        }
+        await this.bitgo.del(this.url(`/passkeys/${device.id}`)).result();
+    }
+    toJSON() {
+        return this._safe;
+    }
+}
+exports.Safe = Safe;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2FmZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9iaXRnby9zYWZlL3NhZmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUE7Ozs7O0dBS0c7QUFDSCx5Q0FBMkI7QUFDM0Isc0RBQWdIO0FBR2hILHNDQUFtRDtBQUNuRCwwQ0FBd0Q7QUFDeEQsb0NBQTRFO0FBQzVFLDRDQUE4RDtBQUM5RCwwREFBdUQ7QUFDdkQsc0NBQW1DO0FBQ25DLHlEQUF3RTtBQUN4RSwwQ0FBbUc7QUFhbkcseUNBQTBEO0FBQzFELDZEQVFtQztBQUVuQyxNQUFNLGVBQWUsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDO0lBQzlCLGlCQUFpQixFQUFFLElBQUk7SUFDdkIsUUFBUSxFQUFFLElBQUk7SUFDZCxRQUFRLEVBQUUsSUFBSTtJQUNkLGVBQWUsRUFBRSxJQUFJO0NBQ3RCLENBQUMsQ0FBQztBQUVILE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUN4QyxJQUFJLEVBQUUsZUFBZTtJQUNyQixRQUFRLEVBQUUsSUFBQSxtQkFBVSxFQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDO0lBQy9DLE9BQU8sRUFBRSxJQUFBLG1CQUFVLEVBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUM7Q0FDOUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDO0lBQ3JDLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFDUCxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU07UUFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE1BQU07UUFDZixJQUFJLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDdEIsWUFBWSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDO1FBQ2xDLElBQUksRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0tBQzFCLENBQUM7SUFDRixpRUFBaUU7SUFDakUsQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUNQLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTTtRQUNkLEtBQUssRUFBRSxDQUFDLENBQUMsTUFBTTtRQUNmLElBQUksRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUN0QixZQUFZLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDOUIsSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0tBQzlDLENBQUM7Q0FDSCxDQUFDLENBQUM7QUFFSCxNQUFNLGlCQUFpQixHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDL0IsS0FBSyxFQUFFLENBQUMsQ0FBQyxNQUFNO0lBQ2YsWUFBWSxFQUFFLENBQUMsQ0FBQyxNQUFNO0NBQ3ZCLENBQUMsQ0FBQztBQUVILE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUNyQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLE1BQU07SUFDckIsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNO0lBQ2pCLE9BQU8sRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDO0NBQ3BDLENBQUMsQ0FBQztBQUVILE1BQU0sZ0NBQWdDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUM5QyxXQUFXLEVBQUUsQ0FBQyxDQUFDLE1BQU07SUFDckIsV0FBVyxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQztDQUMvQixDQUFDLENBQUM7QUFFSCxTQUFTLGNBQWMsQ0FBQyxJQUFjLEVBQUUsSUFBaUIsRUFBRSxRQUFtQjtJQUM1RSxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzNDLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pDLE9BQU8sTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ2hELENBQUM7QUFFRDs7R0FFRztBQUNILE1BQWEsSUFBSTtJQUlmLFlBQVksS0FBZ0IsRUFBRSxRQUFrQjtRQUM5QyxJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixJQUFJLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQztJQUN4QixDQUFDO0lBRUQsRUFBRTtRQUNBLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7SUFDdkIsQ0FBQztJQUVELFlBQVk7UUFDVixPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO0lBQ2pDLENBQUM7SUFFRCxLQUFLO1FBQ0gsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQztJQUMxQixDQUFDO0lBRUQsTUFBTTtRQUNKLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7SUFDM0IsQ0FBQztJQUVEOzs7T0FHRztJQUNILEdBQUcsQ0FBQyxLQUFLLEdBQUcsRUFBRTtRQUNaLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsZUFBZSxJQUFJLENBQUMsWUFBWSxFQUFFLFVBQVUsSUFBSSxDQUFDLEVBQUUsRUFBRSxHQUFHLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzVGLENBQUM7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSCxLQUFLLENBQUMsWUFBWSxDQUFDLE1BQStCO1FBQ2hELElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbkMsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDdkQsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ3JELENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxNQUFNLENBQUMsWUFBWSxJQUFJLFNBQVMsQ0FBQztRQUN0RCxNQUFNLEtBQUssR0FBRyxZQUFZLEtBQUssS0FBSyxDQUFDO1FBRXJDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMxQyxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUEsOEJBQWMsRUFBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBQSxrQ0FBa0IsRUFBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUUzRixNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLO2FBQ25DLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLG1CQUFtQixDQUFDLENBQUM7YUFDbEMsS0FBSyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7YUFDbEMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLE1BQU0sR0FBRyxJQUFBLHdCQUFlLEVBQUMsMEJBQTBCLEVBQUUsYUFBYSxFQUFFLDRCQUE0QixDQUFDLENBQUM7UUFDeEcsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLE1BQU0sQ0FBQyxJQUFJLGdCQUFnQixJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFDRCw0RkFBNEY7UUFDNUYsTUFBTSxnQkFBZ0IsR0FBRyxJQUFBLG9DQUFvQixFQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLE1BQU0sQ0FBQyxRQUFRLGNBQWMsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDO1FBQ3pHLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxJQUFBLGtDQUFrQixFQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUV2RSxNQUFNLFFBQVEsR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUM3RyxNQUFNLFVBQVUsR0FBRyxjQUFjLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNyRCxJQUFJLFVBQVUsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEVBQUUsRUFBRSw0QkFBNEIsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN2RSxDQUFDO1FBRUQsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNWLE1BQU0sWUFBWSxHQUFHLGNBQWMsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sV0FBVyxHQUFHLGNBQWMsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3RELElBQUksWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUMvQixNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEVBQUUsRUFBRSw0QkFBNEIsSUFBSSxhQUFhLENBQUMsQ0FBQztZQUNsRixDQUFDO1lBQ0QsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzlCLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsRUFBRSxFQUFFLDRCQUE0QixJQUFJLFlBQVksQ0FBQyxDQUFDO1lBQ2pGLENBQUM7WUFDRCxPQUFPLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNyRyxDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ25DLE1BQU0sWUFBWSxHQUFHLE1BQU0sU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzdELElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUNuQyxNQUFNLElBQUksNkNBQThCLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRSxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBQSxvQ0FBeUIsRUFBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDN0YsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLCtCQUFzQixFQUFFLENBQUM7UUFDckMsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUNYLElBQUksS0FBSyxpQkFBaUI7WUFDeEIsQ0FBQyxDQUFDLElBQUEsOENBQThCLEVBQUMsT0FBTyxFQUFFLElBQUksQ0FBQztZQUMvQyxDQUFDLENBQUMsSUFBQSxtREFBbUMsRUFBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFFekQsTUFBTSxLQUFLLEdBQUcsTUFBTSxTQUFTLENBQUMsR0FBRyxDQUFDO1lBQ2hDLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRztZQUNoQixNQUFNLEVBQUUsTUFBTTtZQUNkLE9BQU8sRUFBRSxhQUFhO1lBQ3RCLE1BQU0sRUFBRSxVQUFVO1lBQ2xCLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFO1lBQ2pCLHlCQUF5QixFQUFFLE9BQU8sQ0FBQyxjQUFjO1NBQ2xELENBQUMsQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekIsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztRQUN0RSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUVqQyxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUEsNkJBQWEsRUFBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsc0JBQXNCLEVBQUU7WUFDN0YsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJO1lBQ2pCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztZQUNuQixJQUFJLEVBQUUsS0FBSztZQUNYLFlBQVk7WUFDWixJQUFJO1NBQ0wsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1osT0FBTyxJQUFJLGVBQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ssS0FBSyxDQUFDLHFCQUFxQixDQUNqQyxJQUFlLEVBQ2YsSUFBaUIsRUFDakIsVUFBa0IsRUFDbEIsWUFBb0IsRUFDcEIsV0FBbUIsRUFDbkIsSUFBdUMsRUFDdkMsTUFBK0I7UUFFL0IsSUFBSSxJQUFJLEtBQUssVUFBVSxJQUFJLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDbkMsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUNqRSxJQUFJLGdCQUFnQixDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUN2QyxNQUFNLElBQUksNkNBQThCLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxFQUFFLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFFRCxNQUFNLFdBQVcsR0FBRyxNQUFNLElBQUEsb0NBQXlCLEVBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDckcsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sSUFBSSwrQkFBc0IsRUFBRSxDQUFDO1FBQ3JDLENBQUM7UUFDRCxNQUFNLGdCQUFnQixHQUFHLElBQUEsZ0NBQXdCLEVBQUMsV0FBVyxDQUFDLENBQUM7UUFFL0QsTUFBTSxRQUFRLEdBQ1osSUFBSSxLQUFLLFVBQVU7WUFDakIsQ0FBQyxDQUFDLElBQUksa0JBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQztZQUNyRCxDQUFDLENBQUMsSUFBSSxrQkFBVSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDMUQsTUFBTSxFQUFFLFlBQVksRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLEdBQUcsTUFBTSxRQUFRLENBQUMsd0JBQXdCLENBQUM7WUFDOUYsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO1lBQzdCLFVBQVUsRUFBRSxJQUFJLENBQUMsWUFBWSxFQUFFO1lBQy9CLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFO1lBQ2pCLFdBQVcsRUFBRSxXQUFXO1lBQ3hCLElBQUk7WUFDSixhQUFhLEVBQUUsVUFBVTtZQUN6QixlQUFlLEVBQUUsWUFBWTtZQUM3QixnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQyxPQUFPO1lBQzFDLG1CQUFtQixFQUFFLGdCQUFnQixDQUFDLEdBQUc7U0FDMUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxZQUFZLENBQUMsRUFBRSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksY0FBYyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLGFBQWEsQ0FBQyxFQUFFLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3BHLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztRQUN0RSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQTZCLENBQUMsWUFBWSxDQUFDLEVBQUUsRUFBRSxjQUFjLENBQUMsRUFBRSxFQUFFLGFBQWEsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUU5RixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUEsNkJBQWEsRUFBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsc0JBQXNCLEVBQUU7WUFDN0YsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJO1lBQ2pCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztZQUNuQixJQUFJLEVBQUUsS0FBSztZQUNYLFlBQVksRUFBRSxLQUFLO1lBQ25CLElBQUk7U0FDTCxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixPQUFPLElBQUksZUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYTtRQUN6QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzNELE9BQU8sSUFBQSx3QkFBZSxFQUFDLHVCQUFRLEVBQUUsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxTQUFTLENBQUMsTUFBNEI7UUFDMUMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxNQUFrQztRQUN4RCxNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLFVBQVUsQ0FBQyxTQUFxQyxFQUFFO1FBQ3RELE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsV0FBVyxDQUFDLE1BQThCO1FBQzlDLE1BQU0sSUFBSSxLQUFLLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQXlCO1FBQ3BDLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3pGLE9BQU8sSUFBQSx3QkFBZSxFQUFDLHVCQUFRLEVBQUUsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFRDs7O09BR0c7SUFDSCxLQUFLLENBQUMsTUFBTSxDQUFDLFNBQXlCLEVBQUU7UUFDdEMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFBLDZCQUFhLEVBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxFQUFFLDZCQUFjLEVBQUUsTUFBTSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDdkcsT0FBTyxJQUFBLHdCQUFlLEVBQUMsdUJBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVEOzs7T0FHRztJQUNILEtBQUssQ0FBQyxPQUFPO1FBQ1gsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDN0UsT0FBTyxJQUFBLHdCQUFlLEVBQUMsdUJBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSCxLQUFLLENBQUMsZUFBZSxDQUFDLE1BQWtDO1FBQ3RELE1BQU0sRUFBRSxNQUFNLEVBQUUsY0FBYyxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsRUFBRSxHQUFHLE1BQU0sQ0FBQztRQUV2RSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3BCLE1BQU0sSUFBSSxLQUFLLENBQUMsNkVBQTZFLENBQUMsQ0FBQztRQUNqRyxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3pDLE1BQU0sT0FBTyxHQUFHLElBQUEsK0JBQW9CLEVBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxZQUFZLENBQUMsQ0FBQztRQUVuRSxNQUFNLE9BQU8sR0FBOEMsRUFBRSxDQUFDO1FBQzlELEtBQUssTUFBTSxJQUFJLElBQUksMEJBQWUsRUFBRSxDQUFDO1lBQ25DLE1BQU0sVUFBVSxHQUFHLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztZQUN2RCxJQUFJLFVBQVUsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDN0IsU0FBUztZQUNYLENBQUM7WUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUEsc0JBQVcsRUFBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1lBQ3pGLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztnQkFDL0IsTUFBTSxJQUFJLDZDQUE4QixDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3pFLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEsb0NBQXlCLEVBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDdEYsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNiLE1BQU0sSUFBSSwrQkFBc0IsRUFBRSxDQUFDO1lBQ3JDLENBQUM7WUFDRCxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBRUQsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsRUFBRSxFQUFFLDJDQUEyQyxDQUFDLENBQUM7UUFDaEYsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLElBQUEsNEJBQWlCLEVBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sa0JBQWtCLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM3RyxNQUFNLFVBQVUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxHQUFHLENBQUM7WUFDcEMsU0FBUyxFQUFFO2dCQUNULGdCQUFnQixFQUFFLENBQUMsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLEVBQUUsRUFBRSxrQkFBa0IsRUFBRSxDQUFDO2FBQzlCO1lBQ3RDLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsT0FBTyxFQUFFO1NBQ3JELENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxJQUFJLElBQUEsc0JBQVcsRUFBQyxVQUFVLENBQUMsWUFBWSxDQUFDLEtBQUssSUFBQSxzQkFBVyxFQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztRQUN0RSxDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsSUFBQSx5QkFBYyxFQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUV6RCxNQUFNLGNBQWMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQzlDLEtBQUs7WUFDTCxZQUFZLEVBQUUsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztnQkFDckMsUUFBUSxFQUFFLFdBQVc7Z0JBQ3JCLEtBQUssRUFBRSxZQUFZO2dCQUNuQixpQkFBaUI7Z0JBQ2pCLEtBQUssRUFBRSxZQUFZO2FBQ3BCLENBQUM7U0FDSCxDQUFDLENBQUMsQ0FDSixDQUFDO1FBRUYsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFBLDZCQUFhLEVBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLHVCQUF1QixFQUFFO1lBQy9GLFdBQVcsRUFBRSxNQUFNLENBQUMsRUFBRTtZQUN0QixPQUFPO1lBQ1AsT0FBTyxFQUFFLGNBQWM7U0FDeEIsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1osT0FBTyxJQUFBLHdCQUFlLEVBQUMsZ0NBQWdDLEVBQUUsUUFBUSxFQUFFLDZCQUE2QixDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsS0FBSyxDQUFDLGFBQWEsQ0FBQyxNQUFnQztRQUNsRCxNQUFNLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxHQUFHLE1BQU0sQ0FBQztRQUMxQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRywwQkFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1lBQ2pELE1BQU0sVUFBVSxHQUFHLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztZQUN2RCxPQUFPLFVBQVUsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQ2hFLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsRUFBRSxFQUFFLDZDQUE2QyxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUVELElBQUksUUFBUSxHQUFHLEtBQUssQ0FBQztRQUNyQixLQUFLLE1BQU0sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksU0FBUyxFQUFFLENBQUM7WUFDN0MsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFBLHNCQUFXLEVBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztZQUN6RixNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUEsb0NBQXlCLEVBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDeEYsSUFBSSxTQUFTLEVBQUUsQ0FBQztnQkFDZCxRQUFRLEdBQUcsSUFBSSxDQUFDO2dCQUNoQixNQUFNO1lBQ1IsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDZCxNQUFNLElBQUksK0JBQXNCLEVBQUUsQ0FBQztRQUNyQyxDQUFDO1FBRUQsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUNwRSxDQUFDO0lBRUQsTUFBTTtRQUNKLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQztJQUNwQixDQUFDO0NBQ0Y7QUExV0Qsb0JBMFdDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFRoZSBzYWZlIGNsaWVudCBzdXJmYWNlIGlzIGV4cGVyaW1lbnRhbCBhbmQgbWF5IGNoYW5nZSAoaW5jbHVkaW5nIGJyZWFraW5nXG4gKiBjaGFuZ2VzKSBiZWZvcmUgdGhlIHB1YmxpYyByZWxlYXNlLlxuICovXG5pbXBvcnQgKiBhcyB0IGZyb20gJ2lvLXRzJztcbmltcG9ydCB7IEZyZWV6ZVNhZmVCb2R5LCBTYWZlRGF0YSwgU2FmZVNoYXJlRGF0YSwgU2FmZVNoYXJlU3RhdGUsIHR5cGUgUm9vdEtleVR5cGUgfSBmcm9tICdAYml0Z28vcHVibGljLXR5cGVzJztcbmltcG9ydCB7IElCYXNlQ29pbiB9IGZyb20gJy4uL2Jhc2VDb2luJztcbmltcG9ydCB7IEJpdEdvQmFzZSB9IGZyb20gJy4uL2JpdGdvQmFzZSc7XG5pbXBvcnQgeyBJbmNvcnJlY3RQYXNzd29yZEVycm9yIH0gZnJvbSAnLi4vZXJyb3JzJztcbmltcG9ydCB7IGRlY3J5cHRLZXljaGFpblByaXZhdGVLZXkgfSBmcm9tICcuLi9rZXljaGFpbic7XG5pbXBvcnQgeyBFQ0RTQVV0aWxzLCBwYXJzZVNhZmVNcGNLZXlFbnZlbG9wZXMsIEVERFNBVXRpbHMgfSBmcm9tICcuLi91dGlscyc7XG5pbXBvcnQgeyBib3VuZGVkSW50LCBkZWNvZGVXaXRoQ29kZWMgfSBmcm9tICcuLi91dGlscy9jb2RlY3MnO1xuaW1wb3J0IHsgcG9zdFdpdGhDb2RlYyB9IGZyb20gJy4uL3V0aWxzL3Bvc3RXaXRoQ29kZWMnO1xuaW1wb3J0IHsgV2FsbGV0IH0gZnJvbSAnLi4vd2FsbGV0JztcbmltcG9ydCB7IEludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvciB9IGZyb20gJy4uL3dhbGxldC9zYWZlS2V5Y2hhaW4nO1xuaW1wb3J0IHsgYmFzZTY0VXJsVG9CdWZmZXIsIGRlcml2ZUVudGVycHJpc2VTYWx0LCBkZXJpdmVQYXNzd29yZCwgdG9CYXNlNjRVcmwgfSBmcm9tICcuLi93ZWJhdXRobic7XG5pbXBvcnQge1xuICBBY2NlcHRTYWZlU2hhcmVPcHRpb25zLFxuICBBZGRTYWZlTWVtYmVyT3B0aW9ucyxcbiAgQWRkU2FmZVdhbGxldE1lbWJlck9wdGlvbnMsXG4gIENyZWF0ZVNhZmVXYWxsZXRPcHRpb25zLFxuICBJU2FmZSxcbiAgUmVnaXN0ZXJTYWZlUGFzc2tleU9wdGlvbnMsXG4gIFJlZ2lzdGVyU2FmZVBhc3NrZXlSZXNwb25zZSxcbiAgUmVtb3ZlU2FmZVBhc3NrZXlPcHRpb25zLFxuICBVcGRhdGVTYWZlT3B0aW9ucyxcbiAgV2FsbGV0U2hhcmVEYXRhLFxufSBmcm9tICcuL2lTYWZlJztcbmltcG9ydCB7IGNvaW5Gb3JSb290LCBTQUZFX1JPT1RfU0xPVFMgfSBmcm9tICcuL3Jvb3RDb2luJztcbmltcG9ydCB7XG4gIGJ1aWxkU2FmZUJpcDQ0UGF0aCxcbiAgZGVyaXZlQW5kU2VsZkNoZWNrU2FmZUNoaWxkSGFyZGVuZWQsXG4gIGRlcml2ZVNhZmVDaGlsZEVkMjU1MTlIYXJkZW5lZCxcbiAgRGVyaXZlZEZyb21QYXJlbnRXaXRoSGFyZGVuZWRQYXRoLFxuICBnZXRTYWZlQmlwNDRDb2luVHlwZSxcbiAgb25jaGFpblNsb3RGb3JDb2luLFxuICB0c3NTbG90Rm9yQ29pbixcbn0gZnJvbSAnQGJpdGdvLWJldGEvc2RrLWxpYi1zYWZlcyc7XG5cbmNvbnN0IFNhZmVSb290S2V5U2xvdCA9IHQua2V5b2Yoe1xuICBzZWNwMjU2azFNdWx0aXNpZzogbnVsbCxcbiAgZWNkc2FNcGM6IG51bGwsXG4gIGVkZHNhTXBjOiBudWxsLFxuICBlZDI1NTE5TXVsdGlzaWc6IG51bGwsXG59KTtcblxuY29uc3QgR2V0RGVyaXZhdGlvbkluZGV4UmVzcG9uc2UgPSB0LnR5cGUoe1xuICBzbG90OiBTYWZlUm9vdEtleVNsb3QsXG4gIGNvaW5UeXBlOiBib3VuZGVkSW50KDAsIDB4N2ZmZmZmZmYsICdjb2luVHlwZScpLFxuICBhY2NvdW50OiBib3VuZGVkSW50KDAsIDB4N2ZmZmZmZmYsICdhY2NvdW50JyksXG59KTtcblxuY29uc3QgQ3JlYXRlV2FsbGV0SW5TYWZlQm9keSA9IHQudW5pb24oW1xuICB0LnN0cmljdCh7XG4gICAgY29pbjogdC5zdHJpbmcsXG4gICAgbGFiZWw6IHQuc3RyaW5nLFxuICAgIHR5cGU6IHQubGl0ZXJhbCgnaG90JyksXG4gICAgbXVsdGlzaWdUeXBlOiB0LmxpdGVyYWwoJ29uY2hhaW4nKSxcbiAgICBrZXlzOiB0LnR1cGxlKFt0LnN0cmluZ10pLFxuICB9KSxcbiAgLy8gVFNTIG1pbnQgdXNlcyBvcmRlcmVkIHVzZXIsIGJhY2t1cCwgYW5kIEJpdEdvIGNoaWxkIGRvY3VtZW50cy5cbiAgdC5zdHJpY3Qoe1xuICAgIGNvaW46IHQuc3RyaW5nLFxuICAgIGxhYmVsOiB0LnN0cmluZyxcbiAgICB0eXBlOiB0LmxpdGVyYWwoJ2hvdCcpLFxuICAgIG11bHRpc2lnVHlwZTogdC5saXRlcmFsKCd0c3MnKSxcbiAgICBrZXlzOiB0LnR1cGxlKFt0LnN0cmluZywgdC5zdHJpbmcsIHQuc3RyaW5nXSksXG4gIH0pLFxuXSk7XG5cbmNvbnN0IFBhc3NrZXlFbnRyeUNvZGVjID0gdC50eXBlKHtcbiAga2V5SWQ6IHQuc3RyaW5nLFxuICBlbmNyeXB0ZWRQcnY6IHQuc3RyaW5nLFxufSk7XG5cbmNvbnN0IFJlZ2lzdGVyU2FmZVBhc3NrZXlCb2R5ID0gdC50eXBlKHtcbiAgb3RwRGV2aWNlSWQ6IHQuc3RyaW5nLFxuICBwcmZTYWx0OiB0LnN0cmluZyxcbiAgZW50cmllczogdC5hcnJheShQYXNza2V5RW50cnlDb2RlYyksXG59KTtcblxuY29uc3QgUmVnaXN0ZXJTYWZlUGFzc2tleVJlc3BvbnNlQ29kZWMgPSB0LnR5cGUoe1xuICBvdHBEZXZpY2VJZDogdC5zdHJpbmcsXG4gIHVwZGF0ZWRLZXlzOiB0LmFycmF5KHQuc3RyaW5nKSxcbn0pO1xuXG5mdW5jdGlvbiByb290SWRGcm9tU2FmZShzYWZlOiBTYWZlRGF0YSwgc2xvdDogUm9vdEtleVR5cGUsIHBvc2l0aW9uOiAwIHwgMSB8IDIpOiBzdHJpbmcgfCB1bmRlZmluZWQge1xuICBjb25zdCB0cmlwbGV0ID0gc2FmZS5yb290S2V5cz8uaG90Py5bc2xvdF07XG4gIGlmICghdHJpcGxldCB8fCB0cmlwbGV0Lmxlbmd0aCAhPT0gMykge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbiAgY29uc3Qgcm9vdElkID0gdHJpcGxldFtwb3NpdGlvbl07XG4gIHJldHVybiByb290SWQubGVuZ3RoID4gMCA/IHJvb3RJZCA6IHVuZGVmaW5lZDtcbn1cblxuLyoqXG4gKiBAZXhwZXJpbWVudGFsXG4gKi9cbmV4cG9ydCBjbGFzcyBTYWZlIGltcGxlbWVudHMgSVNhZmUge1xuICBwcml2YXRlIHJlYWRvbmx5IGJpdGdvOiBCaXRHb0Jhc2U7XG4gIHB1YmxpYyByZWFkb25seSBfc2FmZTogU2FmZURhdGE7XG5cbiAgY29uc3RydWN0b3IoYml0Z286IEJpdEdvQmFzZSwgc2FmZURhdGE6IFNhZmVEYXRhKSB7XG4gICAgdGhpcy5iaXRnbyA9IGJpdGdvO1xuICAgIHRoaXMuX3NhZmUgPSBzYWZlRGF0YTtcbiAgfVxuXG4gIGlkKCk6IHN0cmluZyB7XG4gICAgcmV0dXJuIHRoaXMuX3NhZmUuaWQ7XG4gIH1cblxuICBlbnRlcnByaXNlSWQoKTogc3RyaW5nIHtcbiAgICByZXR1cm4gdGhpcy5fc2FmZS5lbnRlcnByaXNlSWQ7XG4gIH1cblxuICBsYWJlbCgpOiBzdHJpbmcge1xuICAgIHJldHVybiB0aGlzLl9zYWZlLmxhYmVsO1xuICB9XG5cbiAgc3RhdHVzKCk6IFNhZmVEYXRhWydzdGF0dXMnXSB7XG4gICAgcmV0dXJuIHRoaXMuX3NhZmUuc3RhdHVzO1xuICB9XG5cbiAgLyoqXG4gICAqIEVudGVycHJpc2Utc2NvcGVkIHYyIFVSTCBmb3IgdGhpcyBzYWZlLCBlLmcuIC9hcGkvdjIvZW50ZXJwcmlzZS86ZUlkL3NhZmVzLzpzYWZlSWRcbiAgICogQHBhcmFtIGV4dHJhXG4gICAqL1xuICB1cmwoZXh0cmEgPSAnJyk6IHN0cmluZyB7XG4gICAgcmV0dXJuIHRoaXMuYml0Z28udXJsKGAvZW50ZXJwcmlzZS8ke3RoaXMuZW50ZXJwcmlzZUlkKCl9L3NhZmVzLyR7dGhpcy5pZCgpfSR7ZXh0cmF9YCwgMik7XG4gIH1cblxuICAvKipcbiAgICogTWludCBhIGNoaWxkIHdhbGxldDogcGVlayB0aGUgbmV4dCBhY2NvdW50IGZvciAoc2xvdCwgY29pblR5cGUpLCBkZXJpdmUgdGhlIGNoaWxkIGtleXMgYXRcbiAgICogYG0vNDQnLzxjb2luVHlwZT4nLzxzbG90PicvPGFjY291bnQ+J2AsIHJlZ2lzdGVyIHRoZW0sIHRoZW4gbWludC5cbiAgICpcbiAgICogYG9uY2hhaW5gOiBoYXJkZW5lZC1kZXJpdmUgdGhlIHVzZXIgY2hpbGQgYXQgdGhhdCBwYXRoLCByZWdpc3RlciBpdCBwdWJsaWMtb25seTsgYmFja3VwXG4gICAqIGFuZCBCaXRHbyBjaGlsZHJlbiBhcmUgc29mdC1kZXJpdmVkIG9uIHRoZSBzZXJ2ZXIgYXQgaXRzIHNvZnQgdHdpbi5cbiAgICpcbiAgICogYHRzc2A6IGRlY3J5cHQgdGhlIHVzZXIgcm9vdCBibG9iLCBydW4gdGhlIHVzZXIvQml0R28gaGFyZC1kZXJpdmUgY2VyZW1vbnkgYXQgdGhhdCBwYXRoLFxuICAgKiByZWdpc3RlciB0aGUgb3JkZXJlZCBjaGlsZCBkb2N1bWVudHMsIHRoZW4gbWludC5cbiAgICovXG4gIGFzeW5jIGNyZWF0ZVdhbGxldChwYXJhbXM6IENyZWF0ZVNhZmVXYWxsZXRPcHRpb25zKTogUHJvbWlzZTxXYWxsZXQ+IHtcbiAgICBpZiAocGFyYW1zLnBhc3NwaHJhc2UubGVuZ3RoID09PSAwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ3Bhc3NwaHJhc2UgaXMgcmVxdWlyZWQgdG8gbWludCBhIHNhZmUgd2FsbGV0Jyk7XG4gICAgfVxuICAgIGlmIChwYXJhbXMudHlwZSAhPT0gdW5kZWZpbmVkICYmIHBhcmFtcy50eXBlICE9PSAnaG90Jykge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdTYWZlIHdhbGxldHMgYXJlIGhvdC1vbmx5IGluIHYxJyk7XG4gICAgfVxuICAgIGNvbnN0IG11bHRpc2lnVHlwZSA9IHBhcmFtcy5tdWx0aXNpZ1R5cGUgPz8gJ29uY2hhaW4nO1xuICAgIGNvbnN0IGlzVHNzID0gbXVsdGlzaWdUeXBlID09PSAndHNzJztcblxuICAgIGNvbnN0IGNvaW4gPSB0aGlzLmJpdGdvLmNvaW4ocGFyYW1zLmNvaW4pO1xuICAgIGNvbnN0IHNsb3QgPSBpc1RzcyA/IHRzc1Nsb3RGb3JDb2luKGNvaW4uZ2V0Q2hhaW4oKSkgOiBvbmNoYWluU2xvdEZvckNvaW4oY29pbi5nZXRDaGFpbigpKTtcblxuICAgIGNvbnN0IGluZGV4UmVzcG9uc2UgPSBhd2FpdCB0aGlzLmJpdGdvXG4gICAgICAuZ2V0KHRoaXMudXJsKCcvZGVyaXZhdGlvbi1pbmRleCcpKVxuICAgICAgLnF1ZXJ5KHsgc2xvdCwgY29pbjogcGFyYW1zLmNvaW4gfSlcbiAgICAgIC5yZXN1bHQoKTtcbiAgICBjb25zdCBwZWVrZWQgPSBkZWNvZGVXaXRoQ29kZWMoR2V0RGVyaXZhdGlvbkluZGV4UmVzcG9uc2UsIGluZGV4UmVzcG9uc2UsICdHZXREZXJpdmF0aW9uSW5kZXhSZXNwb25zZScpO1xuICAgIGlmIChwZWVrZWQuc2xvdCAhPT0gc2xvdCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBkZXJpdmF0aW9uLWluZGV4IHJldHVybmVkIHNsb3QgJyR7cGVla2VkLnNsb3R9JywgZXhwZWN0ZWQgJyR7c2xvdH0nYCk7XG4gICAgfVxuICAgIC8vIEEgc3RhdGljcyB2ZXJzaW9uIHNrZXcgYmV0d2VlbiBTREsgYW5kIHNlcnZlciB3b3VsZCBwdXQgdGhlIGNoaWxkIG9uIGFub3RoZXIgY29pbidzIHRyZWUuXG4gICAgY29uc3QgZXhwZWN0ZWRDb2luVHlwZSA9IGdldFNhZmVCaXA0NENvaW5UeXBlKGNvaW4uZ2V0Q2hhaW4oKSk7XG4gICAgaWYgKHBlZWtlZC5jb2luVHlwZSAhPT0gZXhwZWN0ZWRDb2luVHlwZSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBkZXJpdmF0aW9uLWluZGV4IHJldHVybmVkIGNvaW5UeXBlICR7cGVla2VkLmNvaW5UeXBlfSwgZXhwZWN0ZWQgJHtleHBlY3RlZENvaW5UeXBlfWApO1xuICAgIH1cbiAgICBjb25zdCBwYXRoID0gYnVpbGRTYWZlQmlwNDRQYXRoKHBlZWtlZC5jb2luVHlwZSwgc2xvdCwgcGVla2VkLmFjY291bnQpO1xuXG4gICAgY29uc3Qgc2FmZURhdGEgPSByb290SWRGcm9tU2FmZSh0aGlzLl9zYWZlLCBzbG90LCAwKSAhPT0gdW5kZWZpbmVkID8gdGhpcy5fc2FmZSA6IGF3YWl0IHRoaXMuZmV0Y2hTYWZlRGF0YSgpO1xuICAgIGNvbnN0IHVzZXJSb290SWQgPSByb290SWRGcm9tU2FmZShzYWZlRGF0YSwgc2xvdCwgMCk7XG4gICAgaWYgKHVzZXJSb290SWQgPT09IHVuZGVmaW5lZCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBTYWZlICR7dGhpcy5pZCgpfSBpcyBtaXNzaW5nIHJvb3RLZXlzLmhvdC4ke3Nsb3R9YCk7XG4gICAgfVxuXG4gICAgaWYgKGlzVHNzKSB7XG4gICAgICBjb25zdCBiYWNrdXBSb290SWQgPSByb290SWRGcm9tU2FmZShzYWZlRGF0YSwgc2xvdCwgMSk7XG4gICAgICBjb25zdCBiaXRnb1Jvb3RJZCA9IHJvb3RJZEZyb21TYWZlKHNhZmVEYXRhLCBzbG90LCAyKTtcbiAgICAgIGlmIChiYWNrdXBSb290SWQgPT09IHVuZGVmaW5lZCkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYFNhZmUgJHt0aGlzLmlkKCl9IGlzIG1pc3Npbmcgcm9vdEtleXMuaG90LiR7c2xvdH0gYmFja3VwIGtleWApO1xuICAgICAgfVxuICAgICAgaWYgKGJpdGdvUm9vdElkID09PSB1bmRlZmluZWQpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBTYWZlICR7dGhpcy5pZCgpfSBpcyBtaXNzaW5nIHJvb3RLZXlzLmhvdC4ke3Nsb3R9IGJpdGdvIGtleWApO1xuICAgICAgfVxuICAgICAgcmV0dXJuIHRoaXMuY3JlYXRlVHNzV2FsbGV0SW5TYWZlKGNvaW4sIHNsb3QsIHVzZXJSb290SWQsIGJhY2t1cFJvb3RJZCwgYml0Z29Sb290SWQsIHBhdGgsIHBhcmFtcyk7XG4gICAgfVxuXG4gICAgY29uc3Qga2V5Y2hhaW5zID0gY29pbi5rZXljaGFpbnMoKTtcbiAgICBjb25zdCByb290S2V5Y2hhaW4gPSBhd2FpdCBrZXljaGFpbnMuZ2V0KHsgaWQ6IHVzZXJSb290SWQgfSk7XG4gICAgaWYgKHJvb3RLZXljaGFpbi5zb3VyY2UgIT09ICd1c2VyJykge1xuICAgICAgdGhyb3cgbmV3IEludmFsaWRSb290S2V5Y2hhaW5Tb3VyY2VFcnJvcihyb290S2V5Y2hhaW4uaWQsIHJvb3RLZXljaGFpbi5zb3VyY2UpO1xuICAgIH1cbiAgICBjb25zdCByb290UHJ2ID0gYXdhaXQgZGVjcnlwdEtleWNoYWluUHJpdmF0ZUtleSh0aGlzLmJpdGdvLCByb290S2V5Y2hhaW4sIHBhcmFtcy5wYXNzcGhyYXNlKTtcbiAgICBpZiAoIXJvb3RQcnYpIHtcbiAgICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCk7XG4gICAgfVxuXG4gICAgY29uc3QgZGVyaXZlZCA9XG4gICAgICBzbG90ID09PSAnZWQyNTUxOU11bHRpc2lnJ1xuICAgICAgICA/IGRlcml2ZVNhZmVDaGlsZEVkMjU1MTlIYXJkZW5lZChyb290UHJ2LCBwYXRoKVxuICAgICAgICA6IGRlcml2ZUFuZFNlbGZDaGVja1NhZmVDaGlsZEhhcmRlbmVkKHJvb3RQcnYsIHBhdGgpO1xuXG4gICAgY29uc3QgY2hpbGQgPSBhd2FpdCBrZXljaGFpbnMuYWRkKHtcbiAgICAgIHB1YjogZGVyaXZlZC5wdWIsXG4gICAgICBzb3VyY2U6ICd1c2VyJyxcbiAgICAgIGtleVR5cGU6ICdpbmRlcGVuZGVudCcsXG4gICAgICBwYXJlbnQ6IHVzZXJSb290SWQsXG4gICAgICBzYWZlSWQ6IHRoaXMuaWQoKSxcbiAgICAgIGRlcml2ZWRGcm9tUGFyZW50V2l0aFBhdGg6IGRlcml2ZWQuZGVyaXZhdGlvblBhdGgsXG4gICAgfSk7XG4gICAgY29uc3QgY2hpbGRJZCA9IGNoaWxkLmlkO1xuICAgIGlmIChjaGlsZElkLmxlbmd0aCA9PT0gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdzYWZlIGNoaWxkIGtleSByZWdpc3RyYXRpb24gcmV0dXJuZWQgYW4gZW1wdHkgaWQnKTtcbiAgICB9XG4gICAgY29uc3Qga2V5czogW3N0cmluZ10gPSBbY2hpbGRJZF07XG5cbiAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IHBvc3RXaXRoQ29kZWModGhpcy5iaXRnbywgdGhpcy51cmwoJy93YWxsZXRzJyksIENyZWF0ZVdhbGxldEluU2FmZUJvZHksIHtcbiAgICAgIGNvaW46IHBhcmFtcy5jb2luLFxuICAgICAgbGFiZWw6IHBhcmFtcy5sYWJlbCxcbiAgICAgIHR5cGU6ICdob3QnLFxuICAgICAgbXVsdGlzaWdUeXBlLFxuICAgICAga2V5cyxcbiAgICB9KS5yZXN1bHQoKTtcbiAgICByZXR1cm4gbmV3IFdhbGxldCh0aGlzLmJpdGdvLCBjb2luLCByZXNwb25zZSk7XG4gIH1cblxuICAvKipcbiAgICogVFNTIHdhbGxldCBtaW50OiBkZWNyeXB0IHRoZSB1c2VyIHJvb3QgYmxvYiwgcnVuIHRoZSB1c2VyL0JpdEdvIGhhcmQtZGVyaXZlXG4gICAqIGNlcmVtb255LCByZWdpc3RlciB0aGUgb3JkZXJlZCBjaGlsZCBkb2N1bWVudHMsIHRoZW4gbWludC5cbiAgICovXG4gIHByaXZhdGUgYXN5bmMgY3JlYXRlVHNzV2FsbGV0SW5TYWZlKFxuICAgIGNvaW46IElCYXNlQ29pbixcbiAgICBzbG90OiBSb290S2V5VHlwZSxcbiAgICB1c2VyUm9vdElkOiBzdHJpbmcsXG4gICAgYmFja3VwUm9vdElkOiBzdHJpbmcsXG4gICAgYml0Z29Sb290SWQ6IHN0cmluZyxcbiAgICBwYXRoOiBEZXJpdmVkRnJvbVBhcmVudFdpdGhIYXJkZW5lZFBhdGgsXG4gICAgcGFyYW1zOiBDcmVhdGVTYWZlV2FsbGV0T3B0aW9uc1xuICApOiBQcm9taXNlPFdhbGxldD4ge1xuICAgIGlmIChzbG90ICE9PSAnZWNkc2FNcGMnICYmIHNsb3QgIT09ICdlZGRzYU1wYycpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYW4gTVBDIHNhZmUgcm9vdCBzbG90LCBnb3QgJyR7c2xvdH0nYCk7XG4gICAgfVxuXG4gICAgY29uc3Qga2V5Y2hhaW5zID0gY29pbi5rZXljaGFpbnMoKTtcbiAgICBjb25zdCB1c2VyUm9vdEtleWNoYWluID0gYXdhaXQga2V5Y2hhaW5zLmdldCh7IGlkOiB1c2VyUm9vdElkIH0pO1xuICAgIGlmICh1c2VyUm9vdEtleWNoYWluLnNvdXJjZSAhPT0gJ3VzZXInKSB7XG4gICAgICB0aHJvdyBuZXcgSW52YWxpZFJvb3RLZXljaGFpblNvdXJjZUVycm9yKHVzZXJSb290S2V5Y2hhaW4uaWQsIHVzZXJSb290S2V5Y2hhaW4uc291cmNlKTtcbiAgICB9XG5cbiAgICBjb25zdCB1c2VyUm9vdFBydiA9IGF3YWl0IGRlY3J5cHRLZXljaGFpblByaXZhdGVLZXkodGhpcy5iaXRnbywgdXNlclJvb3RLZXljaGFpbiwgcGFyYW1zLnBhc3NwaHJhc2UpO1xuICAgIGlmICghdXNlclJvb3RQcnYpIHtcbiAgICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCk7XG4gICAgfVxuICAgIGNvbnN0IHVzZXJSb290TWF0ZXJpYWwgPSBwYXJzZVNhZmVNcGNLZXlFbnZlbG9wZXModXNlclJvb3RQcnYpO1xuXG4gICAgY29uc3QgdHNzVXRpbHMgPVxuICAgICAgc2xvdCA9PT0gJ2VkZHNhTXBjJ1xuICAgICAgICA/IG5ldyBFRERTQVV0aWxzLkVkZHNhVnJmTVBDdjJVdGlscyh0aGlzLmJpdGdvLCBjb2luKVxuICAgICAgICA6IG5ldyBFQ0RTQVV0aWxzLkVjZHNhVnJmTVBDdjJVdGlscyh0aGlzLmJpdGdvLCBjb2luKTtcbiAgICBjb25zdCB7IHVzZXJLZXljaGFpbiwgYmFja3VwS2V5Y2hhaW4sIGJpdGdvS2V5Y2hhaW4gfSA9IGF3YWl0IHRzc1V0aWxzLmNyZWF0ZVNhZmVDaGlsZEtleWNoYWlucyh7XG4gICAgICBwYXNzcGhyYXNlOiBwYXJhbXMucGFzc3BocmFzZSxcbiAgICAgIGVudGVycHJpc2U6IHRoaXMuZW50ZXJwcmlzZUlkKCksXG4gICAgICBzYWZlSWQ6IHRoaXMuaWQoKSxcbiAgICAgIHBhcmVudEtleUlkOiBiaXRnb1Jvb3RJZCxcbiAgICAgIHBhdGgsXG4gICAgICB1c2VyUm9vdEtleUlkOiB1c2VyUm9vdElkLFxuICAgICAgYmFja3VwUm9vdEtleUlkOiBiYWNrdXBSb290SWQsXG4gICAgICB1c2VyUm9vdEtleVNoYXJlOiB1c2VyUm9vdE1hdGVyaWFsLnNpZ25pbmcsXG4gICAgICB1c2VyUm9vdFZyZktleVNoYXJlOiB1c2VyUm9vdE1hdGVyaWFsLnZyZixcbiAgICB9KTtcbiAgICBpZiAodXNlcktleWNoYWluLmlkLmxlbmd0aCA9PT0gMCB8fCBiYWNrdXBLZXljaGFpbi5pZC5sZW5ndGggPT09IDAgfHwgYml0Z29LZXljaGFpbi5pZC5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignc2FmZSBjaGlsZCBrZXkgcmVnaXN0cmF0aW9uIHJldHVybmVkIGFuIGVtcHR5IGlkJyk7XG4gICAgfVxuICAgIGNvbnN0IGtleXM6IFtzdHJpbmcsIHN0cmluZywgc3RyaW5nXSA9IFt1c2VyS2V5Y2hhaW4uaWQsIGJhY2t1cEtleWNoYWluLmlkLCBiaXRnb0tleWNoYWluLmlkXTtcblxuICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgcG9zdFdpdGhDb2RlYyh0aGlzLmJpdGdvLCB0aGlzLnVybCgnL3dhbGxldHMnKSwgQ3JlYXRlV2FsbGV0SW5TYWZlQm9keSwge1xuICAgICAgY29pbjogcGFyYW1zLmNvaW4sXG4gICAgICBsYWJlbDogcGFyYW1zLmxhYmVsLFxuICAgICAgdHlwZTogJ2hvdCcsXG4gICAgICBtdWx0aXNpZ1R5cGU6ICd0c3MnLFxuICAgICAga2V5cyxcbiAgICB9KS5yZXN1bHQoKTtcbiAgICByZXR1cm4gbmV3IFdhbGxldCh0aGlzLmJpdGdvLCBjb2luLCByZXNwb25zZSk7XG4gIH1cblxuICBwcml2YXRlIGFzeW5jIGZldGNoU2FmZURhdGEoKTogUHJvbWlzZTxTYWZlRGF0YT4ge1xuICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgdGhpcy5iaXRnby5nZXQodGhpcy51cmwoKSkucmVzdWx0KCk7XG4gICAgcmV0dXJuIGRlY29kZVdpdGhDb2RlYyhTYWZlRGF0YSwgcmVzcG9uc2UsICdTYWZlRGF0YScpO1xuICB9XG5cbiAgLyoqXG4gICAqIEFkZCBhIG1lbWJlciB0byB0aGUgd2hvbGUgc2FmZSAodmlldy9hZG1pbi9zcGVuZCkuIFNwZW5kIG9wZW5zIGEga2V5IHNoYXJlLlxuICAgKi9cbiAgYXN5bmMgYWRkTWVtYmVyKHBhcmFtczogQWRkU2FmZU1lbWJlck9wdGlvbnMpOiBQcm9taXNlPFNhZmVEYXRhPiB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdTYWZlLmFkZE1lbWJlciBpcyBub3QgeWV0IGltcGxlbWVudGVkJyk7XG4gIH1cblxuICAvKipcbiAgICogU2hhcmUgT05FIHNhZmUgd2FsbGV0IHdpdGggYSBub24tbWVtYmVyIHZpYSB0aGUgZXhpc3Rpbmcgd2FsbGV0LXNoYXJlIGhhbmRzaGFrZS5cbiAgICovXG4gIGFzeW5jIGFkZE1lbWJlclRvV2FsbGV0KHBhcmFtczogQWRkU2FmZVdhbGxldE1lbWJlck9wdGlvbnMpOiBQcm9taXNlPFdhbGxldFNoYXJlRGF0YT4ge1xuICAgIHRocm93IG5ldyBFcnJvcignU2FmZS5hZGRNZW1iZXJUb1dhbGxldCBpcyBub3QgeWV0IGltcGxlbWVudGVkJyk7XG4gIH1cblxuICAvKipcbiAgICogTGlzdCB0aGUgc2FmZSBrZXkgc2hhcmVzIHZpc2libGUgdG8gdGhlIGNhbGxlci5cbiAgICovXG4gIGFzeW5jIGxpc3RTaGFyZXMocGFyYW1zOiB7IHN0YXRlPzogU2FmZVNoYXJlU3RhdGUgfSA9IHt9KTogUHJvbWlzZTxTYWZlU2hhcmVEYXRhW10+IHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ1NhZmUubGlzdFNoYXJlcyBpcyBub3QgeWV0IGltcGxlbWVudGVkJyk7XG4gIH1cblxuICAvKipcbiAgICogQWNjZXB0IGEgc2FmZSBrZXkgc2hhcmUgYWRkcmVzc2VkIHRvIHRoZSBjYWxsZXIuXG4gICAqL1xuICBhc3luYyBhY2NlcHRTaGFyZShwYXJhbXM6IEFjY2VwdFNhZmVTaGFyZU9wdGlvbnMpOiBQcm9taXNlPFNhZmVTaGFyZURhdGE+IHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ1NhZmUuYWNjZXB0U2hhcmUgaXMgbm90IHlldCBpbXBsZW1lbnRlZCcpO1xuICB9XG5cbiAgLyoqXG4gICAqIFVwZGF0ZSB0aGUgc2FmZSBsYWJlbC5cbiAgICovXG4gIGFzeW5jIHVwZGF0ZShwYXJhbXM6IFVwZGF0ZVNhZmVPcHRpb25zKTogUHJvbWlzZTxTYWZlRGF0YT4ge1xuICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgdGhpcy5iaXRnby5wdXQodGhpcy51cmwoKSkuc2VuZCh7IGxhYmVsOiBwYXJhbXMubGFiZWwgfSkucmVzdWx0KCk7XG4gICAgcmV0dXJuIGRlY29kZVdpdGhDb2RlYyhTYWZlRGF0YSwgcmVzcG9uc2UsICdTYWZlRGF0YScpO1xuICB9XG5cbiAgLyoqXG4gICAqIEZyZWV6ZSB0aGUgc2FmZSDigJQgYmxvY2tzIHdpdGhkcmF3YWxzIG9uIGFsbCBzYWZlIHdhbGxldHMuIFNhZmUgc3RheXMgJ2FjdGl2ZScuXG4gICAqIEBwYXJhbSBwYXJhbXNcbiAgICovXG4gIGFzeW5jIGZyZWV6ZShwYXJhbXM6IEZyZWV6ZVNhZmVCb2R5ID0ge30pOiBQcm9taXNlPFNhZmVEYXRhPiB7XG4gICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBwb3N0V2l0aENvZGVjKHRoaXMuYml0Z28sIHRoaXMudXJsKCcvZnJlZXplJyksIEZyZWV6ZVNhZmVCb2R5LCBwYXJhbXMpLnJlc3VsdCgpO1xuICAgIHJldHVybiBkZWNvZGVXaXRoQ29kZWMoU2FmZURhdGEsIHJlc3BvbnNlLCAnU2FmZURhdGEnKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBBcmNoaXZlIHRoZSBzYWZlLiBSZXF1aXJlcyBldmVyeSBzYWZlIHdhbGxldCB0byBhbHJlYWR5IGJlIGFyY2hpdmVkOyBhbHNvIHRoZSBhYmFuZG9ubWVudFxuICAgKiBwYXRoIGZvciBhIHN0dWNrICdpbml0aWFsaXppbmcnIHNhZmUuXG4gICAqL1xuICBhc3luYyBhcmNoaXZlKCk6IFByb21pc2U8U2FmZURhdGE+IHtcbiAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IHRoaXMuYml0Z28ucG9zdCh0aGlzLnVybCgnL2FyY2hpdmUnKSkuc2VuZCgpLnJlc3VsdCgpO1xuICAgIHJldHVybiBkZWNvZGVXaXRoQ29kZWMoU2FmZURhdGEsIHJlc3BvbnNlLCAnU2FmZURhdGEnKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZWdpc3RlciBhIFBSRiBwYXNza2V5IG9uIGV2ZXJ5IHVzZXIgcm9vdCBvZiB0aGUgc2FmZS5cbiAgICpcbiAgICogRm9yIGVhY2ggdXNlciByb290IChwb3NpdGlvbiAwIG9mIGVhY2ggcG9wdWxhdGVkIHNsb3QpLCBkZWNyeXB0IHRoZSByb290IHdpdGggdGhlIFNhZmVcbiAgICogcGFzc3dvcmQsIHRoZW4gcmUtZW5jcnlwdCBpdCB1bmRlciB0aGUgUFJGLWRlcml2ZWQgcGFzc3dvcmQgKGJvdW5kIHRvIHRoZSBlbnRlcnByaXNlIHZpYVxuICAgKiBBRVMtR0NNIEFBRCkuIE9uZSBQUkYgYXNzZXJ0aW9uIHNlcnZlcyB0aGUgd2hvbGUgc2FmZTsgdGhlIHdyaXRlIHNldCBpcyB0aGUgdXNlciByb290cyBvbmx5XG4gICAqIOKAlCBiYWNrdXAgYW5kIEJpdEdvIHJvb3RzIGFyZSBuZXZlciB3cmFwcGVkLlxuICAgKi9cbiAgYXN5bmMgcmVnaXN0ZXJQYXNza2V5KHBhcmFtczogUmVnaXN0ZXJTYWZlUGFzc2tleU9wdGlvbnMpOiBQcm9taXNlPFJlZ2lzdGVyU2FmZVBhc3NrZXlSZXNwb25zZT4ge1xuICAgIGNvbnN0IHsgZGV2aWNlLCBzYWZlUGFzc3BocmFzZSwgcHJvdmlkZXIsIGVuY3J5cHRpb25WZXJzaW9uIH0gPSBwYXJhbXM7XG5cbiAgICBpZiAoIWRldmljZS5pZCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdkZXZpY2UuaWQgaXMgcmVxdWlyZWQgdG8gcmVnaXN0ZXIgYSBwYXNza2V5IG9uIHRoZSBzYWZlJyk7XG4gICAgfVxuICAgIGlmICghZGV2aWNlLnByZlNhbHQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignUFJGIGV4dGVuc2lvbiBub3Qgc3VwcG9ydGVkIGJ5IHRoaXMgZGV2aWNlLiBQbGVhc2UgdXNlIGEgZGlmZmVyZW50IHBhc3NrZXkuJyk7XG4gICAgfVxuICAgIGNvbnN0IGVudGVycHJpc2VJZCA9IHRoaXMuZW50ZXJwcmlzZUlkKCk7XG4gICAgY29uc3QgcHJmU2FsdCA9IGRlcml2ZUVudGVycHJpc2VTYWx0KGRldmljZS5wcmZTYWx0LCBlbnRlcnByaXNlSWQpO1xuXG4gICAgY29uc3QgZW50cmllczogeyBrZXlJZDogc3RyaW5nOyBlbmNyeXB0ZWRQcnY6IHN0cmluZyB9W10gPSBbXTtcbiAgICBmb3IgKGNvbnN0IHNsb3Qgb2YgU0FGRV9ST09UX1NMT1RTKSB7XG4gICAgICBjb25zdCB1c2VyUm9vdElkID0gcm9vdElkRnJvbVNhZmUodGhpcy5fc2FmZSwgc2xvdCwgMCk7XG4gICAgICBpZiAodXNlclJvb3RJZCA9PT0gdW5kZWZpbmVkKSB7XG4gICAgICAgIGNvbnRpbnVlO1xuICAgICAgfVxuICAgICAgY29uc3Qga2V5Y2hhaW4gPSBhd2FpdCBjb2luRm9yUm9vdCh0aGlzLmJpdGdvLCBzbG90KS5rZXljaGFpbnMoKS5nZXQoeyBpZDogdXNlclJvb3RJZCB9KTtcbiAgICAgIGlmIChrZXljaGFpbi5zb3VyY2UgIT09ICd1c2VyJykge1xuICAgICAgICB0aHJvdyBuZXcgSW52YWxpZFJvb3RLZXljaGFpblNvdXJjZUVycm9yKGtleWNoYWluLmlkLCBrZXljaGFpbi5zb3VyY2UpO1xuICAgICAgfVxuICAgICAgY29uc3Qgcm9vdFBydiA9IGF3YWl0IGRlY3J5cHRLZXljaGFpblByaXZhdGVLZXkodGhpcy5iaXRnbywga2V5Y2hhaW4sIHNhZmVQYXNzcGhyYXNlKTtcbiAgICAgIGlmICghcm9vdFBydikge1xuICAgICAgICB0aHJvdyBuZXcgSW5jb3JyZWN0UGFzc3dvcmRFcnJvcigpO1xuICAgICAgfVxuICAgICAgZW50cmllcy5wdXNoKHsga2V5SWQ6IHVzZXJSb290SWQsIGVuY3J5cHRlZFBydjogcm9vdFBydiB9KTtcbiAgICB9XG5cbiAgICBpZiAoZW50cmllcy5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgU2FmZSAke3RoaXMuaWQoKX0gaGFzIG5vIHVzZXIgcm9vdHMgdG8gYXR0YWNoIGEgcGFzc2tleSB0b2ApO1xuICAgIH1cblxuICAgIGNvbnN0IG5vZGVCdWYgPSBiYXNlNjRVcmxUb0J1ZmZlcihkZXZpY2UuY3JlZGVudGlhbElkKTtcbiAgICBjb25zdCBjcmVkZW50aWFsSWRCdWZmZXIgPSBub2RlQnVmLmJ1ZmZlci5zbGljZShub2RlQnVmLmJ5dGVPZmZzZXQsIG5vZGVCdWYuYnl0ZU9mZnNldCArIG5vZGVCdWYuYnl0ZUxlbmd0aCk7XG4gICAgY29uc3QgYXV0aFJlc3VsdCA9IGF3YWl0IHByb3ZpZGVyLmdldCh7XG4gICAgICBwdWJsaWNLZXk6IHtcbiAgICAgICAgYWxsb3dDcmVkZW50aWFsczogW3sgdHlwZTogJ3B1YmxpYy1rZXknLCBpZDogY3JlZGVudGlhbElkQnVmZmVyIH1dLFxuICAgICAgfSBhcyBQdWJsaWNLZXlDcmVkZW50aWFsUmVxdWVzdE9wdGlvbnMsXG4gICAgICBldmFsQnlDcmVkZW50aWFsOiB7IFtkZXZpY2UuY3JlZGVudGlhbElkXTogcHJmU2FsdCB9LFxuICAgIH0pO1xuICAgIGlmICghYXV0aFJlc3VsdC5wcmZSZXN1bHQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignUFJGIGFzc2VydGlvbiBkaWQgbm90IHJldHVybiBhIHJlc3VsdC4nKTtcbiAgICB9XG4gICAgaWYgKHRvQmFzZTY0VXJsKGF1dGhSZXN1bHQuY3JlZGVudGlhbElkKSAhPT0gdG9CYXNlNjRVcmwoZGV2aWNlLmNyZWRlbnRpYWxJZCkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignUFJGIGFzc2VydGlvbiByZXR1cm5lZCBhbiB1bmV4cGVjdGVkIGNyZWRlbnRpYWwuJyk7XG4gICAgfVxuICAgIGNvbnN0IHByZlBhc3N3b3JkID0gZGVyaXZlUGFzc3dvcmQoYXV0aFJlc3VsdC5wcmZSZXN1bHQpO1xuXG4gICAgY29uc3Qgd3JhcHBlZEVudHJpZXMgPSBhd2FpdCBQcm9taXNlLmFsbChcbiAgICAgIGVudHJpZXMubWFwKGFzeW5jICh7IGtleUlkLCBlbmNyeXB0ZWRQcnYgfSkgPT4gKHtcbiAgICAgICAga2V5SWQsXG4gICAgICAgIGVuY3J5cHRlZFBydjogYXdhaXQgdGhpcy5iaXRnby5lbmNyeXB0KHtcbiAgICAgICAgICBwYXNzd29yZDogcHJmUGFzc3dvcmQsXG4gICAgICAgICAgaW5wdXQ6IGVuY3J5cHRlZFBydixcbiAgICAgICAgICBlbmNyeXB0aW9uVmVyc2lvbixcbiAgICAgICAgICBhZGF0YTogZW50ZXJwcmlzZUlkLFxuICAgICAgICB9KSxcbiAgICAgIH0pKVxuICAgICk7XG5cbiAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IHBvc3RXaXRoQ29kZWModGhpcy5iaXRnbywgdGhpcy51cmwoJy9wYXNza2V5cycpLCBSZWdpc3RlclNhZmVQYXNza2V5Qm9keSwge1xuICAgICAgb3RwRGV2aWNlSWQ6IGRldmljZS5pZCxcbiAgICAgIHByZlNhbHQsXG4gICAgICBlbnRyaWVzOiB3cmFwcGVkRW50cmllcyxcbiAgICB9KS5yZXN1bHQoKTtcbiAgICByZXR1cm4gZGVjb2RlV2l0aENvZGVjKFJlZ2lzdGVyU2FmZVBhc3NrZXlSZXNwb25zZUNvZGVjLCByZXNwb25zZSwgJ1JlZ2lzdGVyU2FmZVBhc3NrZXlSZXNwb25zZScpO1xuICB9XG5cbiAgLyoqXG4gICAqIFJlbW92ZSBhIFBSRiBwYXNza2V5IGZyb20gZXZlcnkgdXNlciByb290IG9mIHRoZSBzYWZlLlxuICAgKlxuICAgKiBUaGUgU2FmZSBwYXNzd29yZCBpcyB2ZXJpZmllZCBjbGllbnQtc2lkZSAoZGVjcnlwdCBvbmUgdXNlciByb290KSBiZWZvcmUgdGhlIHNlcnZlciBpc1xuICAgKiBjYWxsZWQ7IHRoZSBzZXJ2ZXIgZW5mb3JjZXMgb3duZXIgYXV0aG9yaXphdGlvbiBhbmQgcGVyZm9ybXMgdGhlIGlkZW1wb3RlbnQgcGVyLXJvb3QgYCRwdWxsYC5cbiAgICovXG4gIGFzeW5jIHJlbW92ZVBhc3NrZXkocGFyYW1zOiBSZW1vdmVTYWZlUGFzc2tleU9wdGlvbnMpOiBQcm9taXNlPHZvaWQ+IHtcbiAgICBjb25zdCB7IGRldmljZSwgc2FmZVBhc3NwaHJhc2UgfSA9IHBhcmFtcztcbiAgICBpZiAoIWRldmljZS5pZCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdkZXZpY2UuaWQgaXMgcmVxdWlyZWQgdG8gcmVtb3ZlIGEgcGFzc2tleSBmcm9tIHRoZSBzYWZlJyk7XG4gICAgfVxuXG4gICAgY29uc3QgdXNlclJvb3RzID0gU0FGRV9ST09UX1NMT1RTLmZsYXRNYXAoKHNsb3QpID0+IHtcbiAgICAgIGNvbnN0IHVzZXJSb290SWQgPSByb290SWRGcm9tU2FmZSh0aGlzLl9zYWZlLCBzbG90LCAwKTtcbiAgICAgIHJldHVybiB1c2VyUm9vdElkID09PSB1bmRlZmluZWQgPyBbXSA6IFt7IHNsb3QsIHVzZXJSb290SWQgfV07XG4gICAgfSk7XG4gICAgaWYgKHVzZXJSb290cy5sZW5ndGggPT09IDApIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgU2FmZSAke3RoaXMuaWQoKX0gaGFzIG5vIHVzZXIgcm9vdHMgdG8gcmVtb3ZlIGEgcGFzc2tleSBmcm9tYCk7XG4gICAgfVxuXG4gICAgbGV0IHZlcmlmaWVkID0gZmFsc2U7XG4gICAgZm9yIChjb25zdCB7IHNsb3QsIHVzZXJSb290SWQgfSBvZiB1c2VyUm9vdHMpIHtcbiAgICAgIGNvbnN0IGtleWNoYWluID0gYXdhaXQgY29pbkZvclJvb3QodGhpcy5iaXRnbywgc2xvdCkua2V5Y2hhaW5zKCkuZ2V0KHsgaWQ6IHVzZXJSb290SWQgfSk7XG4gICAgICBjb25zdCBkZWNyeXB0ZWQgPSBhd2FpdCBkZWNyeXB0S2V5Y2hhaW5Qcml2YXRlS2V5KHRoaXMuYml0Z28sIGtleWNoYWluLCBzYWZlUGFzc3BocmFzZSk7XG4gICAgICBpZiAoZGVjcnlwdGVkKSB7XG4gICAgICAgIHZlcmlmaWVkID0gdHJ1ZTtcbiAgICAgICAgYnJlYWs7XG4gICAgICB9XG4gICAgfVxuICAgIGlmICghdmVyaWZpZWQpIHtcbiAgICAgIHRocm93IG5ldyBJbmNvcnJlY3RQYXNzd29yZEVycm9yKCk7XG4gICAgfVxuXG4gICAgYXdhaXQgdGhpcy5iaXRnby5kZWwodGhpcy51cmwoYC9wYXNza2V5cy8ke2RldmljZS5pZH1gKSkucmVzdWx0KCk7XG4gIH1cblxuICB0b0pTT04oKTogU2FmZURhdGEge1xuICAgIHJldHVybiB0aGlzLl9zYWZlO1xuICB9XG59XG4iXX0=