@cubist-labs/cubesigner-sdk-key-import 0.4.68-0

package/README.md

@@ -0,0 +1,90 @@
+# CubeSigner key import
+
+This library implements the client-side encryption used to import keys
+into CubeSigner.
+
+## WARNING
+
+Importing keys using code running in an untrusted environment is **dangerous**
+because that code must process secret key material. For example, importing
+keys from a user's web browser is **very risky**: exposing secret keys
+in browsers means that malicious web pages, advertisements, and extensions
+may be able to steal your key. JS execution environments are also great
+targets for side-channel attackers.
+
+Whenever possible, Cubist strongly recommends generating keys using the
+`createKey` API. We strongly recommend against using local keygen plus
+import as a replacement for real disaster-recovery backup. Please contact
+us if you have questions about or need help with disaster-recovery planning.
+
+## Example
+
+```ts
+import * as cs from "@cubist-labs/cubesigner-sdk";
+import * as csFs from "@cubist-labs/cubesigner-sdk-fs-storage";
+import { KeyImporter, type MnemonicToImport } from "@cubist-labs/cubesigner-sdk-key-import";
+
+// create a CubeSigner client from credentials on-disk, which
+// you can create by running `cs login` from the CLI.
+const client = await cs.CubeSignerClient.create(csFs.defaultManagementSessionManager());
+
+// create the key-importer instance
+const keyImporter = new KeyImporter(client.org());
+
+// mnemonics to import directly as EVM keys
+const evmMnemonics: MnemonicToImport[] = [
+  {
+    mnemonic: "car split like parrot uphold faint amount alert inch bean priority custom auction denial reason oyster food duck horn top battle video seed company",
+    derivationPath: "m/44'/60'/0'/0/0",
+  },
+  {
+    mnemonic: "force focus walnut scale barrel faint hotel fabric source because heavy provide bridge intact they receive stairs matter fetch family color happy slender accident",
+    derivationPath: "m/44'/60'/1'/0/0",
+    password: "bip39 passwords are silly",
+  },
+];
+// mnemonic to import directly as Bitcoin Segwit keys
+const btcMnemonics: MnemonicToImport[] = [
+  {
+    mnemonic: "style goddess hair mountain open when train mail fly engage fork walnut end toe mail price priority ocean uncover immune spray person slogan avoid",
+    derivationPath: "m/84'/0'/0'/0/0",
+  },
+  {
+    mnemonic: "marine airport maze doll note assume deliver second bus include deal escape detail friend letter captain glide actual resemble nation shell search elephant busy",
+    derivationPath: "m/84'/0'/9'/0/1",
+  },
+];
+
+// import the keys
+const evmKeys = await keyImporter.importMnemonics(cs.Secp256k1.Evm, evmMnemonics);
+const btcKeys = await keyImporter.importMnemonics(cs.Secp256k1.Btc, btcMnemonics);
+
+// If you want to derive many keys from the same mnemonic, you should import
+// the bare mnemonic and use the `deriveKey` and/or `deriveKeys` methods to
+// create keys.
+const bareMnemonic: MnemonicToImport = {
+  mnemonic: "divide impact town typical inhale uncover rifle pet multiply idea long before debate apart pulse type need produce among pony attend cat injury ring",
+};
+
+// First, import the bare mnemonic
+const mnemonic = (await keyImporter.importMnemonics(cs.Mnemonic, [bareMnemonic]))[0];
+
+// Then derive keys from it.
+const deriveResponse = await org.deriveKey(cs.Secp256k1.Taproot, "m/86'/0'/3'/1/0", mnemonic.materialId);
+const otherDeriveResponses = await org.deriveKeys(
+  cs.Secp256k1.Ava,
+  [
+    "m/1'/2'/3",
+    "m/4'/5/6",
+    "m/7/8'/9",
+  ],
+  mnemonic.materialId,
+);
+```
+
+# License
+
+Copyright (C) 2024 Cubist, Inc. All rights reserved.
+
+This library is licensed under the MIT and Apache-2.0 licenses.
+See the [../../NOTICE] file for further information.

package/dist/import.d.ts

@@ -0,0 +1,23 @@
+import type { Key, KeyType, Org } from "@cubist-labs/cubesigner-sdk";
+import type { MnemonicToImport } from "./mnemonic";
+/**
+ * An import encryption key and the corresponding attestation document
+ */
+export declare class KeyImporter {
+    #private;
+    /**
+     * Construct from a CubeSigner `Org` instance
+     *
+     * @param { Org } cs A CubeSigner `Org` instance
+     */
+    constructor(cs: Org);
+    /**
+     * Encrypts a set of mnemonics and imports them.
+     *
+     * @param { KeyType } keyType The type of key to import
+     * @param { MnemonicToImport[] } mnes The mnemonics to import, with optional derivation paths and passwords
+     * @return { Promise<Key[]> } `Key` objects for each imported key.
+     */
+    importMnemonics(keyType: KeyType, mnes: MnemonicToImport[]): Promise<Key[]>;
+}
+//# sourceMappingURL=import.d.ts.map

package/dist/import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../src/import.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAIV,GAAG,EACH,OAAO,EACP,GAAG,EACJ,MAAM,6BAA6B,CAAC;AAWrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAoLnD;;GAEG;AACH,qBAAa,WAAW;;IAOtB;;;;OAIG;gBACS,EAAE,EAAE,GAAG;IAoDnB;;;;;;OAMG;IACU,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAyEzF"}

package/dist/import.js

@@ -0,0 +1,333 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _WrappedImportKey_instances, _WrappedImportKey_enclaveAttestation, _WrappedImportKey_enclaveSignature, _WrappedImportKey_verifyImportKey, _WrappedImportKey_signedData, _KeyImporter_instances, _KeyImporter_wrappedImportKey, _KeyImporter_subtleCrypto, _KeyImporter_publicKeyHandle, _KeyImporter_hpkeSuite, _KeyImporter_cs, _KeyImporter_getWrappedImportAndPubKey, _KeyImporter_getSubtleCrypto, _KeyImporter_encrypt;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyImporter = void 0;
+const cubesigner_sdk_1 = require("@cubist-labs/cubesigner-sdk");
+const core_1 = require("@hpke/core");
+const asn1_ecc_1 = require("@peculiar/asn1-ecc");
+const asn1_schema_1 = require("@peculiar/asn1-schema");
+const x509_1 = require("@peculiar/x509");
+const mnemonic_1 = require("./mnemonic");
+const util_1 = require("./util");
+// domain-separation tag used when generating signing hash for import key
+const IMPORT_KEY_SIGNING_DST = new TextEncoder().encode("CUBESIGNER_EPHEMERAL_IMPORT_P384");
+// attestation document slack times
+const MAX_ATTESTATION_AGE_MINUTES = 15n;
+const MAX_ATTESTATION_FUTURE_MINUTES = 5n;
+const WIK_REFRESH_EARLY_MILLIS = 60000n;
+// OIDs for elliptic curve X509 certs
+const EC_PUBLIC_KEY = "1.2.840.10045.2.1";
+const NIST_P384 = "1.3.132.0.34";
+// Maximum number of keys to import in a single API call
+const MAX_IMPORTS_PER_API_CALL = 32n;
+// AWS Nitro Enclaves root CA certificate
+// https://aws-nitro-enclaves.amazonaws.com/AWS_NitroEnclaves_Root-G1.zip
+//
+// See the documentation about AWS Nitro Enclaves verification:
+// https://docs.aws.amazon.com/enclaves/latest/user/verify-root.html
+const AWS_CA_CERT = "MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYDVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZEh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkFR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYCMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPWrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6NIwLz3/Y=";
+/**
+ * The result of deserializing a CreateKeyImportKeyResponse
+ */
+class WrappedImportKey {
+    /**
+     * Constructor. This is only called from `WrappedImportKey.createAndVerify()`.
+     *
+     * @param { CreateKeyImportKeyResponse } resp The response from CubeSigner
+     */
+    constructor(resp) {
+        _WrappedImportKey_instances.add(this);
+        _WrappedImportKey_enclaveAttestation.set(this, void 0);
+        _WrappedImportKey_enclaveSignature.set(this, void 0);
+        if (!resp.enclave_attestation || !resp.enclave_signature) {
+            throw new Error("No attestation found in CreateKeyImportKeyResponse");
+        }
+        // parse the response
+        this.publicKey = new Uint8Array(Buffer.from(resp.public_key, "base64"));
+        this.publicKeyBase64 = resp.public_key;
+        this.skEnc = new Uint8Array(Buffer.from(resp.sk_enc, "base64"));
+        this.skEncBase64 = resp.sk_enc;
+        this.dkEnc = new Uint8Array(Buffer.from(resp.dk_enc, "base64"));
+        this.dkEncBase64 = resp.dk_enc;
+        __classPrivateFieldSet(this, _WrappedImportKey_enclaveAttestation, new Uint8Array(Buffer.from(resp.enclave_attestation, "base64")), "f");
+        __classPrivateFieldSet(this, _WrappedImportKey_enclaveSignature, new Uint8Array(Buffer.from(resp.enclave_signature, "base64")), "f");
+        this.expEpochSeconds = BigInt(resp.expires);
+        // this array is updated in createAndVerify once verification succeeds
+        this.verifiedHash = new Uint8Array(32);
+    }
+    /**
+     * Create and verify an instance of this type
+     *
+     * @param { CreateKeyImportKeyResponse } resp The response from CubeSigner
+     * @param { SubtleCrypto } subtle An instance of SubtleCrypto used for verification
+     * @return { Promise<WrappedImportKey> } A newly constructed instance
+     */
+    static async createAndVerify(resp, subtle) {
+        const ret = new WrappedImportKey(resp);
+        const hash = await __classPrivateFieldGet(ret, _WrappedImportKey_instances, "m", _WrappedImportKey_verifyImportKey).call(ret, subtle);
+        ret.verifiedHash.set(hash);
+        return ret;
+    }
+    /**
+     * Returns `true` if this WrappedImportKey needs to be refreshed.
+     *
+     * @return { boolean } True just if this key needs to be refreshed.
+     */
+    needsRefresh() {
+        // force refresh if we're within WIK_REFRESH_EARLY_MILLIS of the expiration
+        return (0, util_1.nowEpochMillis)() + WIK_REFRESH_EARLY_MILLIS > this.expEpochSeconds * 1000n;
+    }
+}
+_WrappedImportKey_enclaveAttestation = new WeakMap(), _WrappedImportKey_enclaveSignature = new WeakMap(), _WrappedImportKey_instances = new WeakSet(), _WrappedImportKey_verifyImportKey = 
+/**
+ * Verify this wrapped import key.
+ *
+ * @param { SubtleCrypto } subtle An instance of SubtleCrypto used for verification
+ * @return { Promise<Uint8Array> } The hash of the successfully verified wrapped import key
+ */
+async function _WrappedImportKey_verifyImportKey(subtle) {
+    // check expiration date
+    if ((0, util_1.nowEpochMillis)() > this.expEpochSeconds * 1000n) {
+        throw new Error("Import key is expired");
+    }
+    // make sure that there is an attestation
+    if (!__classPrivateFieldGet(this, _WrappedImportKey_enclaveSignature, "f") || !__classPrivateFieldGet(this, _WrappedImportKey_enclaveAttestation, "f")) {
+        throw new Error("No attestation found");
+    }
+    const signing_key = await verifyAttestationKey(__classPrivateFieldGet(this, _WrappedImportKey_enclaveAttestation, "f"));
+    // we use subtlecrypto's impl of RSA-PSS verification
+    const rsaPssKeyParams = {
+        name: "RSA-PSS",
+        hash: "SHA-256",
+    };
+    const pubkey = await subtle.importKey("spki", signing_key, rsaPssKeyParams, true, ["verify"]);
+    const pubkeyAlg = pubkey.algorithm;
+    // compute the signing hash and verify the signature
+    const message = __classPrivateFieldGet(this, _WrappedImportKey_instances, "m", _WrappedImportKey_signedData).call(this);
+    const mlen = Number(BigInt(pubkeyAlg.modulusLength) / 8n);
+    const rsaPssParams = {
+        name: "RSA-PSS",
+        saltLength: mlen - 2 - 32,
+    };
+    if (await subtle.verify(rsaPssParams, pubkey, __classPrivateFieldGet(this, _WrappedImportKey_enclaveSignature, "f"), message)) {
+        return new Uint8Array(await subtle.digest("SHA-256", message));
+    }
+    throw new Error("Import key signature verification failed");
+}, _WrappedImportKey_signedData = function _WrappedImportKey_signedData() {
+    const parts = [
+        // domain separation tag
+        (0, util_1.toBigEndian)(BigInt(IMPORT_KEY_SIGNING_DST.length), 2),
+        IMPORT_KEY_SIGNING_DST,
+        // public key
+        (0, util_1.toBigEndian)(BigInt(this.publicKey.length), 2),
+        this.publicKey,
+        // sk_enc
+        (0, util_1.toBigEndian)(BigInt(this.skEnc.length), 2),
+        this.skEnc,
+        // dk_enc
+        (0, util_1.toBigEndian)(BigInt(this.dkEnc.length), 2),
+        this.dkEnc,
+        // 8-byte big-endian expiration time in seconds since UNIX epoch
+        (0, util_1.toBigEndian)(this.expEpochSeconds, 8),
+    ];
+    return (0, util_1.concatArrays)(parts);
+};
+/**
+ * An import encryption key and the corresponding attestation document
+ */
+class KeyImporter {
+    /**
+     * Construct from a CubeSigner `Org` instance
+     *
+     * @param { Org } cs A CubeSigner `Org` instance
+     */
+    constructor(cs) {
+        _KeyImporter_instances.add(this);
+        _KeyImporter_wrappedImportKey.set(this, null);
+        _KeyImporter_subtleCrypto.set(this, null);
+        _KeyImporter_publicKeyHandle.set(this, null);
+        _KeyImporter_hpkeSuite.set(this, void 0);
+        _KeyImporter_cs.set(this, void 0);
+        __classPrivateFieldSet(this, _KeyImporter_cs, cs, "f");
+        __classPrivateFieldSet(this, _KeyImporter_hpkeSuite, new core_1.CipherSuite({
+            kem: new core_1.DhkemP384HkdfSha384(),
+            kdf: new core_1.HkdfSha384(),
+            aead: new core_1.Aes256Gcm(),
+        }), "f");
+    }
+    /**
+     * Encrypts a set of mnemonics and imports them.
+     *
+     * @param { KeyType } keyType The type of key to import
+     * @param { MnemonicToImport[] } mnes The mnemonics to import, with optional derivation paths and passwords
+     * @return { Promise<Key[]> } `Key` objects for each imported key.
+     */
+    async importMnemonics(keyType, mnes) {
+        const nChunks = Number((BigInt(mnes.length) + MAX_IMPORTS_PER_API_CALL - 1n) / MAX_IMPORTS_PER_API_CALL);
+        const keys = [];
+        for (let i = 0; i < nChunks; ++i) {
+            // first, make sure that the wrapped import key is valid, i.e., that
+            // we have retrieved it and that it hasn't expired. We do this here
+            // for a couple reasons:
+            //
+            // - all encryptions in a give request must use the same import key, and
+            //
+            // - when importing a huge number of keys the import pubkey might expire
+            //   during the import, so we check for expiration before each request
+            const { wik, ipk } = await __classPrivateFieldGet(this, _KeyImporter_instances, "m", _KeyImporter_getWrappedImportAndPubKey).call(this);
+            // next, encrypt this chunk of mnemonics
+            const start = Number(MAX_IMPORTS_PER_API_CALL) * i;
+            const end = Number(MAX_IMPORTS_PER_API_CALL) + start;
+            const mneSlice = mnes.slice(start, end);
+            const key_material = [];
+            for (const mne of mneSlice) {
+                const keyPkg = (0, mnemonic_1.newMnemonicKeyPackage)(mne);
+                const material = await __classPrivateFieldGet(this, _KeyImporter_instances, "m", _KeyImporter_encrypt).call(this, keyPkg, wik.verifiedHash, ipk);
+                key_material.push(material);
+            }
+            // construct the request
+            const req = {
+                public_key: wik.publicKeyBase64,
+                sk_enc: wik.skEncBase64,
+                dk_enc: wik.dkEncBase64,
+                expires: Number(wik.expEpochSeconds),
+                key_type: keyType,
+                key_material,
+            };
+            // send it and append the result to the return value
+            const resp = await __classPrivateFieldGet(this, _KeyImporter_cs, "f").importKeys(req);
+            keys.push(...resp);
+        }
+        return keys;
+    }
+}
+exports.KeyImporter = KeyImporter;
+_KeyImporter_wrappedImportKey = new WeakMap(), _KeyImporter_subtleCrypto = new WeakMap(), _KeyImporter_publicKeyHandle = new WeakMap(), _KeyImporter_hpkeSuite = new WeakMap(), _KeyImporter_cs = new WeakMap(), _KeyImporter_instances = new WeakSet(), _KeyImporter_getWrappedImportAndPubKey = 
+/**
+ * Check that the wrapped import key is unexpired and verified. Otherwise,
+ * request a new one, verify it, and update the verified signing hash.
+ *
+ * @return { Promise<[WrappedImportKey, CryptoKey]> } The verified signing hash.
+ */
+async function _KeyImporter_getWrappedImportAndPubKey() {
+    if (!__classPrivateFieldGet(this, _KeyImporter_wrappedImportKey, "f")) {
+        // first time we load a WrappedImportKey, make sure the x509 crypto
+        // provider is set correctly.
+        x509_1.cryptoProvider.set(await (0, cubesigner_sdk_1.loadCrypto)());
+    }
+    if (!__classPrivateFieldGet(this, _KeyImporter_wrappedImportKey, "f") || __classPrivateFieldGet(this, _KeyImporter_wrappedImportKey, "f").needsRefresh()) {
+        const kikResp = await __classPrivateFieldGet(this, _KeyImporter_cs, "f").createKeyImportKey();
+        const subtle = await __classPrivateFieldGet(this, _KeyImporter_instances, "m", _KeyImporter_getSubtleCrypto).call(this);
+        const wik = await WrappedImportKey.createAndVerify(kikResp, subtle);
+        // import the public key from the WrappedImportKey
+        const p384Params = {
+            name: "ECDH",
+            namedCurve: "P-384",
+        };
+        __classPrivateFieldSet(this, _KeyImporter_publicKeyHandle, await subtle.importKey("raw", wik.publicKey, p384Params, true, []), "f");
+        __classPrivateFieldSet(this, _KeyImporter_wrappedImportKey, wik, "f");
+    }
+    return {
+        wik: __classPrivateFieldGet(this, _KeyImporter_wrappedImportKey, "f"),
+        ipk: __classPrivateFieldGet(this, _KeyImporter_publicKeyHandle, "f"),
+    };
+}, _KeyImporter_getSubtleCrypto = 
+/**
+ * Get or create an instance of SubtleCrypto.
+ *
+ * @return { SubtleCrypto } The instance of SubtleCrypto.
+ */
+async function _KeyImporter_getSubtleCrypto() {
+    if (!__classPrivateFieldGet(this, _KeyImporter_subtleCrypto, "f")) {
+        __classPrivateFieldSet(this, _KeyImporter_subtleCrypto, await (0, cubesigner_sdk_1.loadSubtleCrypto)(), "f");
+    }
+    return __classPrivateFieldGet(this, _KeyImporter_subtleCrypto, "f");
+}, _KeyImporter_encrypt = 
+/**
+ * Encrypt to this wrapped import key. Stores the result in `this.encrypted_keys`
+ *
+ * @param { Uint8Array } data The data to encrypt
+ * @param { Uint8Array } verifiedHash The verified signing hash of the wrapped import key to which to encrypt
+ * @param { CryptoKey } pubkey The public key to encrypt to
+ * @return { Promise<ImportKeyRequestMaterial> } The encrypted key material
+ */
+async function _KeyImporter_encrypt(data, verifiedHash, pubkey) {
+    // set up the HPKE sender
+    const sender = await __classPrivateFieldGet(this, _KeyImporter_hpkeSuite, "f").createSenderContext({
+        recipientPublicKey: pubkey,
+        info: verifiedHash,
+    });
+    // encrypt and construct the return value
+    const senderCtext = await sender.seal(data);
+    return {
+        salt: "",
+        client_public_key: Buffer.from(sender.enc).toString("base64"),
+        ikm_enc: Buffer.from(senderCtext).toString("base64"),
+    };
+};
+/**
+ * Verifies the attestation key against the AWS Nitro Enclaves signing
+ * key and returns the attested signing key.
+ *
+ * @param { Uint8Array } attBytes An attestation from an AWS nitro enclave
+ * @return { Promise<Uint8Array> } The signing key that was attested, or null if verification failed
+ */
+async function verifyAttestationKey(attBytes) {
+    // cbor-x is being imported as ESM, so we must asynchronously import it here.
+    // Because we only use that and auth0/cose here, we import both this way.
+    const { Sign1 } = await import("@auth0/cose");
+    const { decode: cborDecode } = await import("cbor-x");
+    const att = Sign1.decode(attBytes);
+    const attDoc = cborDecode(att.payload);
+    // check expiration date of attestation
+    const latest = (0, util_1.nowEpochMillis)() + MAX_ATTESTATION_FUTURE_MINUTES * 60n * 1000n;
+    const earliest = latest - (MAX_ATTESTATION_FUTURE_MINUTES + MAX_ATTESTATION_AGE_MINUTES) * 60n * 1000n;
+    if (attDoc.timestamp < earliest || attDoc.timestamp > latest) {
+        throw new Error("Attestation is expired");
+    }
+    // if there's no public key in this attestation, give up
+    if (!attDoc.public_key) {
+        throw new Error("Attestation did not include a signing public key");
+    }
+    // Verify certificate chain starting with AWS Nitro CA cert
+    let parent = new x509_1.X509Certificate(AWS_CA_CERT);
+    for (let i = 0; i < attDoc.cabundle.length; ++i) {
+        const cert = new x509_1.X509Certificate(attDoc.cabundle[i]);
+        if (!(await cert.verify(parent))) {
+            throw new Error(`Attestation certificate chain failed at index ${i}`);
+        }
+        parent = cert;
+    }
+    const cert = new x509_1.X509Certificate(attDoc.certificate);
+    if (!(await cert.verify(parent))) {
+        throw new Error("Attestation certificate chain failed at leaf");
+    }
+    const pubkey = cert.publicKey;
+    // make sure that we got the expected public key type
+    const alg = new x509_1.AlgorithmProvider().toAsnAlgorithm(pubkey.algorithm);
+    if (alg.algorithm != EC_PUBLIC_KEY) {
+        // not the expected algorithm, i.e., elliptic curve signing
+        throw new Error("Attestation contained unexpected signature algorithm");
+    }
+    const params = asn1_schema_1.AsnParser.parse(alg.parameters, asn1_ecc_1.ECParameters);
+    if (!params.namedCurve || params.namedCurve !== NIST_P384) {
+        // not the expected params, i.e., NIST P384
+        throw new Error("Attestation contained unexpected signature algorithm");
+    }
+    // verify the cose signature with the key, which we verified against
+    // the AWS Nitro CA certificate above
+    await att.verify(await pubkey.export());
+    return attDoc.public_key;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW1wb3J0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2ltcG9ydC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7QUFRQSxnRUFBMkU7QUFDM0UscUNBQXFGO0FBQ3JGLGlEQUFrRDtBQUNsRCx1REFBa0Q7QUFDbEQseUNBSXdCO0FBR3hCLHlDQUFtRDtBQUNuRCxpQ0FBbUU7QUFFbkUseUVBQXlFO0FBQ3pFLE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsa0NBQWtDLENBQUMsQ0FBQztBQUU1RixtQ0FBbUM7QUFDbkMsTUFBTSwyQkFBMkIsR0FBRyxHQUFHLENBQUM7QUFDeEMsTUFBTSw4QkFBOEIsR0FBRyxFQUFFLENBQUM7QUFDMUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFPLENBQUM7QUFFekMscUNBQXFDO0FBQ3JDLE1BQU0sYUFBYSxHQUFHLG1CQUFtQixDQUFDO0FBQzFDLE1BQU0sU0FBUyxHQUFHLGNBQWMsQ0FBQztBQUVqQyx3REFBd0Q7QUFDeEQsTUFBTSx3QkFBd0IsR0FBRyxHQUFHLENBQUM7QUFFckMseUNBQXlDO0FBQ3pDLHlFQUF5RTtBQUN6RSxFQUFFO0FBQ0YsK0RBQStEO0FBQy9ELG9FQUFvRTtBQUNwRSxNQUFNLFdBQVcsR0FDZiwwc0JBQTBzQixDQUFDO0FBRTdzQjs7R0FFRztBQUNILE1BQU0sZ0JBQWdCO0lBZ0JwQjs7OztPQUlHO0lBQ0gsWUFBb0IsSUFBZ0M7O1FBUjNDLHVEQUFnQztRQUNoQyxxREFBOEI7UUFRckMsSUFBSSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsSUFBSSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3pELE1BQU0sSUFBSSxLQUFLLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBRUQscUJBQXFCO1FBQ3JCLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBRXZDLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBRS9CLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBRS9CLHVCQUFBLElBQUksd0NBQXVCLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLFFBQVEsQ0FBQyxDQUFDLE1BQUEsQ0FBQztRQUMzRix1QkFBQSxJQUFJLHNDQUFxQixJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxRQUFRLENBQUMsQ0FBQyxNQUFBLENBQUM7UUFDdkYsSUFBSSxDQUFDLGVBQWUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRTVDLHNFQUFzRTtRQUN0RSxJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FDakMsSUFBZ0MsRUFDaEMsTUFBb0I7UUFFcEIsTUFBTSxHQUFHLEdBQUcsSUFBSSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2QyxNQUFNLElBQUksR0FBRyxNQUFNLHVCQUFBLEdBQUcsc0VBQWlCLE1BQXBCLEdBQUcsRUFBa0IsTUFBTSxDQUFDLENBQUM7UUFDaEQsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDM0IsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDO0lBMENEOzs7O09BSUc7SUFDSSxZQUFZO1FBQ2pCLDJFQUEyRTtRQUMzRSxPQUFPLElBQUEscUJBQWMsR0FBRSxHQUFHLHdCQUF3QixHQUFHLElBQUksQ0FBQyxlQUFlLEdBQUcsS0FBSyxDQUFDO0lBQ3BGLENBQUM7Q0ErQkY7O0FBL0VDOzs7OztHQUtHO0FBQ0gsS0FBSyw0Q0FBa0IsTUFBb0I7SUFDekMsd0JBQXdCO0lBQ3hCLElBQUksSUFBQSxxQkFBYyxHQUFFLEdBQUcsSUFBSSxDQUFDLGVBQWUsR0FBRyxLQUFLLEVBQUUsQ0FBQztRQUNwRCxNQUFNLElBQUksS0FBSyxDQUFDLHVCQUF1QixDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVELHlDQUF5QztJQUN6QyxJQUFJLENBQUMsdUJBQUEsSUFBSSwwQ0FBa0IsSUFBSSxDQUFDLHVCQUFBLElBQUksNENBQW9CLEVBQUUsQ0FBQztRQUN6RCxNQUFNLElBQUksS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLE1BQU0sb0JBQW9CLENBQUMsdUJBQUEsSUFBSSw0Q0FBb0IsQ0FBQyxDQUFDO0lBRXpFLHFEQUFxRDtJQUNyRCxNQUFNLGVBQWUsR0FBRztRQUN0QixJQUFJLEVBQUUsU0FBUztRQUNmLElBQUksRUFBRSxTQUFTO0tBQ2hCLENBQUM7SUFDRixNQUFNLE1BQU0sR0FBRyxNQUFNLE1BQU0sQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsSUFBSSxFQUFFLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5RixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBaUQsQ0FBQztJQUUzRSxvREFBb0Q7SUFDcEQsTUFBTSxPQUFPLEdBQUcsdUJBQUEsSUFBSSxpRUFBWSxNQUFoQixJQUFJLENBQWMsQ0FBQztJQUNuQyxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUMxRCxNQUFNLFlBQVksR0FBRztRQUNuQixJQUFJLEVBQUUsU0FBUztRQUNmLFVBQVUsRUFBRSxJQUFJLEdBQUcsQ0FBQyxHQUFHLEVBQUU7S0FDMUIsQ0FBQztJQUVGLElBQUksTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxNQUFNLEVBQUUsdUJBQUEsSUFBSSwwQ0FBa0IsRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQy9FLE9BQU8sSUFBSSxVQUFVLENBQUMsTUFBTSxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7QUFDOUQsQ0FBQztJQWtCQyxNQUFNLEtBQUssR0FBaUI7UUFDMUIsd0JBQXdCO1FBQ3hCLElBQUEsa0JBQVcsRUFBQyxNQUFNLENBQUMsc0JBQXNCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3JELHNCQUFzQjtRQUV0QixhQUFhO1FBQ2IsSUFBQSxrQkFBVyxFQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3QyxJQUFJLENBQUMsU0FBUztRQUVkLFNBQVM7UUFDVCxJQUFBLGtCQUFXLEVBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3pDLElBQUksQ0FBQyxLQUFLO1FBRVYsU0FBUztRQUNULElBQUEsa0JBQVcsRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDekMsSUFBSSxDQUFDLEtBQUs7UUFFVixnRUFBZ0U7UUFDaEUsSUFBQSxrQkFBVyxFQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQyxDQUFDO0tBQ3JDLENBQUM7SUFFRixPQUFPLElBQUEsbUJBQVksRUFBQyxLQUFLLENBQUMsQ0FBQztBQUM3QixDQUFDO0FBV0g7O0dBRUc7QUFDSCxNQUFhLFdBQVc7SUFPdEI7Ozs7T0FJRztJQUNILFlBQVksRUFBTzs7UUFYbkIsd0NBQTZDLElBQUksRUFBQztRQUNsRCxvQ0FBcUMsSUFBSSxFQUFDO1FBQzFDLHVDQUFxQyxJQUFJLEVBQUM7UUFDakMseUNBQXdCO1FBQ3hCLGtDQUFTO1FBUWhCLHVCQUFBLElBQUksbUJBQU8sRUFBRSxNQUFBLENBQUM7UUFDZCx1QkFBQSxJQUFJLDBCQUFjLElBQUksa0JBQVcsQ0FBQztZQUNoQyxHQUFHLEVBQUUsSUFBSSwwQkFBbUIsRUFBRTtZQUM5QixHQUFHLEVBQUUsSUFBSSxpQkFBVSxFQUFFO1lBQ3JCLElBQUksRUFBRSxJQUFJLGdCQUFTLEVBQUU7U0FDdEIsQ0FBQyxNQUFBLENBQUM7SUFDTCxDQUFDO0lBNkNEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxlQUFlLENBQUMsT0FBZ0IsRUFBRSxJQUF3QjtRQUNyRSxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQ3BCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyx3QkFBd0IsR0FBRyxFQUFFLENBQUMsR0FBRyx3QkFBd0IsQ0FDakYsQ0FBQztRQUNGLE1BQU0sSUFBSSxHQUFHLEVBQUUsQ0FBQztRQUVoQixLQUFLLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsT0FBTyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDakMsb0VBQW9FO1lBQ3BFLG1FQUFtRTtZQUNuRSx3QkFBd0I7WUFDeEIsRUFBRTtZQUNGLHdFQUF3RTtZQUN4RSxFQUFFO1lBQ0Ysd0VBQXdFO1lBQ3hFLHNFQUFzRTtZQUN0RSxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sdUJBQUEsSUFBSSxzRUFBMkIsTUFBL0IsSUFBSSxDQUE2QixDQUFDO1lBRTdELHdDQUF3QztZQUN4QyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDbkQsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEdBQUcsS0FBSyxDQUFDO1lBQ3JELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ3hDLE1BQU0sWUFBWSxHQUFHLEVBQUUsQ0FBQztZQUN4QixLQUFLLE1BQU0sR0FBRyxJQUFJLFFBQVEsRUFBRSxDQUFDO2dCQUMzQixNQUFNLE1BQU0sR0FBRyxJQUFBLGdDQUFxQixFQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUMxQyxNQUFNLFFBQVEsR0FBRyxNQUFNLHVCQUFBLElBQUksb0RBQVMsTUFBYixJQUFJLEVBQVUsTUFBTSxFQUFFLEdBQUcsQ0FBQyxZQUFZLEVBQUUsR0FBRyxDQUFDLENBQUM7Z0JBQ3BFLFlBQVksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDOUIsQ0FBQztZQUVELHdCQUF3QjtZQUN4QixNQUFNLEdBQUcsR0FBcUI7Z0JBQzVCLFVBQVUsRUFBRSxHQUFHLENBQUMsZUFBZTtnQkFDL0IsTUFBTSxFQUFFLEdBQUcsQ0FBQyxXQUFXO2dCQUN2QixNQUFNLEVBQUUsR0FBRyxDQUFDLFdBQVc7Z0JBQ3ZCLE9BQU8sRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDcEMsUUFBUSxFQUFFLE9BQU87Z0JBQ2pCLFlBQVk7YUFDYixDQUFDO1lBRUYsb0RBQW9EO1lBQ3BELE1BQU0sSUFBSSxHQUFHLE1BQU0sdUJBQUEsSUFBSSx1QkFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM1QyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUM7UUFDckIsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztDQTZCRjtBQWhKRCxrQ0FnSkM7O0FBM0hDOzs7OztHQUtHO0FBQ0gsS0FBSztJQUNILElBQUksQ0FBQyx1QkFBQSxJQUFJLHFDQUFrQixFQUFFLENBQUM7UUFDNUIsbUVBQW1FO1FBQ25FLDZCQUE2QjtRQUM3QixxQkFBa0IsQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFBLDJCQUFVLEdBQUUsQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFDRCxJQUFJLENBQUMsdUJBQUEsSUFBSSxxQ0FBa0IsSUFBSSx1QkFBQSxJQUFJLHFDQUFrQixDQUFDLFlBQVksRUFBRSxFQUFFLENBQUM7UUFDckUsTUFBTSxPQUFPLEdBQUcsTUFBTSx1QkFBQSxJQUFJLHVCQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUNwRCxNQUFNLE1BQU0sR0FBRyxNQUFNLHVCQUFBLElBQUksNERBQWlCLE1BQXJCLElBQUksQ0FBbUIsQ0FBQztRQUM3QyxNQUFNLEdBQUcsR0FBRyxNQUFNLGdCQUFnQixDQUFDLGVBQWUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFFcEUsa0RBQWtEO1FBQ2xELE1BQU0sVUFBVSxHQUFHO1lBQ2pCLElBQUksRUFBRSxNQUFNO1lBQ1osVUFBVSxFQUFFLE9BQU87U0FDcEIsQ0FBQztRQUNGLHVCQUFBLElBQUksZ0NBQW9CLE1BQU0sTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLFNBQVMsRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQyxNQUFBLENBQUM7UUFDM0YsdUJBQUEsSUFBSSxpQ0FBcUIsR0FBRyxNQUFBLENBQUM7SUFDL0IsQ0FBQztJQUNELE9BQU87UUFDTCxHQUFHLEVBQUUsdUJBQUEsSUFBSSxxQ0FBa0I7UUFDM0IsR0FBRyxFQUFFLHVCQUFBLElBQUksb0NBQWtCO0tBQzVCLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILEtBQUs7SUFDSCxJQUFJLENBQUMsdUJBQUEsSUFBSSxpQ0FBYyxFQUFFLENBQUM7UUFDeEIsdUJBQUEsSUFBSSw2QkFBaUIsTUFBTSxJQUFBLGlDQUFnQixHQUFFLE1BQUEsQ0FBQztJQUNoRCxDQUFDO0lBQ0QsT0FBTyx1QkFBQSxJQUFJLGlDQUFjLENBQUM7QUFDNUIsQ0FBQztBQXVERDs7Ozs7OztHQU9HO0FBQ0gsS0FBSywrQkFDSCxJQUFnQixFQUNoQixZQUF3QixFQUN4QixNQUFpQjtJQUVqQix5QkFBeUI7SUFDekIsTUFBTSxNQUFNLEdBQUcsTUFBTSx1QkFBQSxJQUFJLDhCQUFXLENBQUMsbUJBQW1CLENBQUM7UUFDdkQsa0JBQWtCLEVBQUUsTUFBTTtRQUMxQixJQUFJLEVBQUUsWUFBWTtLQUNuQixDQUFDLENBQUM7SUFFSCx5Q0FBeUM7SUFDekMsTUFBTSxXQUFXLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzVDLE9BQU87UUFDTCxJQUFJLEVBQUUsRUFBRTtRQUNSLGlCQUFpQixFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFDN0QsT0FBTyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztLQUNyRCxDQUFDO0FBQ0osQ0FBQztBQW9CSDs7Ozs7O0dBTUc7QUFDSCxLQUFLLFVBQVUsb0JBQW9CLENBQUMsUUFBb0I7SUFDdEQsNkVBQTZFO0lBQzdFLHlFQUF5RTtJQUN6RSxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDOUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUV0RCxNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFtQixDQUFDO0lBRXpELHVDQUF1QztJQUN2QyxNQUFNLE1BQU0sR0FBRyxJQUFBLHFCQUFjLEdBQUUsR0FBRyw4QkFBOEIsR0FBRyxHQUFHLEdBQUcsS0FBSyxDQUFDO0lBQy9FLE1BQU0sUUFBUSxHQUNaLE1BQU0sR0FBRyxDQUFDLDhCQUE4QixHQUFHLDJCQUEyQixDQUFDLEdBQUcsR0FBRyxHQUFHLEtBQUssQ0FBQztJQUN4RixJQUFJLE1BQU0sQ0FBQyxTQUFTLEdBQUcsUUFBUSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEdBQUcsTUFBTSxFQUFFLENBQUM7UUFDN0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRCx3REFBd0Q7SUFDeEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVELDJEQUEyRDtJQUMzRCxJQUFJLE1BQU0sR0FBRyxJQUFJLHNCQUFlLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDOUMsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxJQUFJLEdBQUcsSUFBSSxzQkFBZSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRCxJQUFJLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELE1BQU0sR0FBRyxJQUFJLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sSUFBSSxHQUFHLElBQUksc0JBQWUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDckQsSUFBSSxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7SUFFOUIscURBQXFEO0lBQ3JELE1BQU0sR0FBRyxHQUFHLElBQUksd0JBQWlCLEVBQUUsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3JFLElBQUksR0FBRyxDQUFDLFNBQVMsSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUNuQywyREFBMkQ7UUFDM0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyx1QkFBUyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsVUFBVyxFQUFFLHVCQUFZLENBQUMsQ0FBQztJQUM5RCxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzFELDJDQUEyQztRQUMzQyxNQUFNLElBQUksS0FBSyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUVELG9FQUFvRTtJQUNwRSxxQ0FBcUM7SUFDckMsTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFFeEMsT0FBTyxNQUFNLENBQUMsVUFBVSxDQUFDO0FBQzNCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgdHlwZSB7XG4gIENyZWF0ZUtleUltcG9ydEtleVJlc3BvbnNlLFxuICBJbXBvcnRLZXlSZXF1ZXN0LFxuICBJbXBvcnRLZXlSZXF1ZXN0TWF0ZXJpYWwsXG4gIEtleSxcbiAgS2V5VHlwZSxcbiAgT3JnLFxufSBmcm9tIFwiQGN1YmlzdC1sYWJzL2N1YmVzaWduZXItc2RrXCI7XG5pbXBvcnQgeyBsb2FkQ3J5cHRvLCBsb2FkU3VidGxlQ3J5cHRvIH0gZnJvbSBcIkBjdWJpc3QtbGFicy9jdWJlc2lnbmVyLXNka1wiO1xuaW1wb3J0IHsgQ2lwaGVyU3VpdGUsIEFlczI1NkdjbSwgSGtkZlNoYTM4NCwgRGhrZW1QMzg0SGtkZlNoYTM4NCB9IGZyb20gXCJAaHBrZS9jb3JlXCI7XG5pbXBvcnQgeyBFQ1BhcmFtZXRlcnMgfSBmcm9tIFwiQHBlY3VsaWFyL2FzbjEtZWNjXCI7XG5pbXBvcnQgeyBBc25QYXJzZXIgfSBmcm9tIFwiQHBlY3VsaWFyL2FzbjEtc2NoZW1hXCI7XG5pbXBvcnQge1xuICBBbGdvcml0aG1Qcm92aWRlcixcbiAgWDUwOUNlcnRpZmljYXRlLFxuICBjcnlwdG9Qcm92aWRlciBhcyB4NTA5Q3J5cHRvUHJvdmlkZXIsXG59IGZyb20gXCJAcGVjdWxpYXIveDUwOVwiO1xuXG5pbXBvcnQgdHlwZSB7IE1uZW1vbmljVG9JbXBvcnQgfSBmcm9tIFwiLi9tbmVtb25pY1wiO1xuaW1wb3J0IHsgbmV3TW5lbW9uaWNLZXlQYWNrYWdlIH0gZnJvbSBcIi4vbW5lbW9uaWNcIjtcbmltcG9ydCB7IHRvQmlnRW5kaWFuLCBjb25jYXRBcnJheXMsIG5vd0Vwb2NoTWlsbGlzIH0gZnJvbSBcIi4vdXRpbFwiO1xuXG4vLyBkb21haW4tc2VwYXJhdGlvbiB0YWcgdXNlZCB3aGVuIGdlbmVyYXRpbmcgc2lnbmluZyBoYXNoIGZvciBpbXBvcnQga2V5XG5jb25zdCBJTVBPUlRfS0VZX1NJR05JTkdfRFNUID0gbmV3IFRleHRFbmNvZGVyKCkuZW5jb2RlKFwiQ1VCRVNJR05FUl9FUEhFTUVSQUxfSU1QT1JUX1AzODRcIik7XG5cbi8vIGF0dGVzdGF0aW9uIGRvY3VtZW50IHNsYWNrIHRpbWVzXG5jb25zdCBNQVhfQVRURVNUQVRJT05fQUdFX01JTlVURVMgPSAxNW47XG5jb25zdCBNQVhfQVRURVNUQVRJT05fRlVUVVJFX01JTlVURVMgPSA1bjtcbmNvbnN0IFdJS19SRUZSRVNIX0VBUkxZX01JTExJUyA9IDYwXzAwMG47XG5cbi8vIE9JRHMgZm9yIGVsbGlwdGljIGN1cnZlIFg1MDkgY2VydHNcbmNvbnN0IEVDX1BVQkxJQ19LRVkgPSBcIjEuMi44NDAuMTAwNDUuMi4xXCI7XG5jb25zdCBOSVNUX1AzODQgPSBcIjEuMy4xMzIuMC4zNFwiO1xuXG4vLyBNYXhpbXVtIG51bWJlciBvZiBrZXlzIHRvIGltcG9ydCBpbiBhIHNpbmdsZSBBUEkgY2FsbFxuY29uc3QgTUFYX0lNUE9SVFNfUEVSX0FQSV9DQUxMID0gMzJuO1xuXG4vLyBBV1MgTml0cm8gRW5jbGF2ZXMgcm9vdCBDQSBjZXJ0aWZpY2F0ZVxuLy8gaHR0cHM6Ly9hd3Mtbml0cm8tZW5jbGF2ZXMuYW1hem9uYXdzLmNvbS9BV1NfTml0cm9FbmNsYXZlc19Sb290LUcxLnppcFxuLy9cbi8vIFNlZSB0aGUgZG9jdW1lbnRhdGlvbiBhYm91dCBBV1MgTml0cm8gRW5jbGF2ZXMgdmVyaWZpY2F0aW9uOlxuLy8gaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL2VuY2xhdmVzL2xhdGVzdC91c2VyL3ZlcmlmeS1yb290Lmh0bWxcbmNvbnN0IEFXU19DQV9DRVJUID1cbiAgXCJNSUlDRVRDQ0FaYWdBd0lCQWdJUkFQa3hkV2dia0svaEhVYk10T1RuK0ZZd0NnWUlLb1pJemowRUF3TXdTVEVMTUFrR0ExVUVCaE1DVlZNeER6QU5CZ05WQkFvTUJrRnRZWHB2YmpFTU1Bb0dBMVVFQ3d3RFFWZFRNUnN3R1FZRFZRUUREQkpoZDNNdWJtbDBjbTh0Wlc1amJHRjJaWE13SGhjTk1Ua3hNREk0TVRNeU9EQTFXaGNOTkRreE1ESTRNVFF5T0RBMVdqQkpNUXN3Q1FZRFZRUUdFd0pWVXpFUE1BMEdBMVVFQ2d3R1FXMWhlbTl1TVF3d0NnWURWUVFMREFOQlYxTXhHekFaQmdOVkJBTU1FbUYzY3k1dWFYUnlieTFsYm1Oc1lYWmxjekIyTUJBR0J5cUdTTTQ5QWdFR0JTdUJCQUFpQTJJQUJQd0NWT3VtQ01IemFIRGltdHFRdmtZNE1wSnpib2xMLy9aeTJZbEVTMUJSNVRTa3NmYmI0OEM4V0JveXQ3RjJCdzdlRXRhYVArb2hHMmJuVXM5OTBkMEpYMjhUY1BRWENFUFozQkFCSWVUUFl3RW9DV1pFaDhsNVlvUXdUY1UvOUtOQ01FQXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVrQ1cxRGRrRlIrZVd3NWI2Y3AzUG1hbmZTNVl3RGdZRFZSMFBBUUgvQkFRREFnR0dNQW9HQ0NxR1NNNDlCQU1EQTJrQU1HWUNNUUNqZnkrUm9jbTlYdWU0WW53V21OSlZBNDRmQTBQNVcyT3BZb3c5T1lDVlJhRWV2TDh1TzFYWXJ1NXh0TVBXcmZNQ01RQ2k4NXNXQmJKd0tLWGRTNkJwdFFGdVpiVDczby9nQmgxcVV4bC9uTnIxMlVPOFlmd3I2d1BMYis2Tkl3THozL1k9XCI7XG5cbi8qKlxuICogVGhlIHJlc3VsdCBvZiBkZXNlcmlhbGl6aW5nIGEgQ3JlYXRlS2V5SW1wb3J0S2V5UmVzcG9uc2VcbiAqL1xuY2xhc3MgV3JhcHBlZEltcG9ydEtleSB7XG4gIHJlYWRvbmx5IHZlcmlmaWVkSGFzaDogVWludDhBcnJheTtcblxuICByZWFkb25seSBwdWJsaWNLZXk6IFVpbnQ4QXJyYXk7XG4gIHJlYWRvbmx5IHB1YmxpY0tleUJhc2U2NDogc3RyaW5nO1xuXG4gIHJlYWRvbmx5IHNrRW5jOiBVaW50OEFycmF5O1xuICByZWFkb25seSBza0VuY0Jhc2U2NDogc3RyaW5nO1xuXG4gIHJlYWRvbmx5IGRrRW5jOiBVaW50OEFycmF5O1xuICByZWFkb25seSBka0VuY0Jhc2U2NDogc3RyaW5nO1xuXG4gIHJlYWRvbmx5IGV4cEVwb2NoU2Vjb25kczogYmlnaW50O1xuICByZWFkb25seSAjZW5jbGF2ZUF0dGVzdGF0aW9uOiBVaW50OEFycmF5O1xuICByZWFkb25seSAjZW5jbGF2ZVNpZ25hdHVyZTogVWludDhBcnJheTtcblxuICAvKipcbiAgICogQ29uc3RydWN0b3IuIFRoaXMgaXMgb25seSBjYWxsZWQgZnJvbSBgV3JhcHBlZEltcG9ydEtleS5jcmVhdGVBbmRWZXJpZnkoKWAuXG4gICAqXG4gICAqIEBwYXJhbSB7IENyZWF0ZUtleUltcG9ydEtleVJlc3BvbnNlIH0gcmVzcCBUaGUgcmVzcG9uc2UgZnJvbSBDdWJlU2lnbmVyXG4gICAqL1xuICBwcml2YXRlIGNvbnN0cnVjdG9yKHJlc3A6IENyZWF0ZUtleUltcG9ydEtleVJlc3BvbnNlKSB7XG4gICAgaWYgKCFyZXNwLmVuY2xhdmVfYXR0ZXN0YXRpb24gfHwgIXJlc3AuZW5jbGF2ZV9zaWduYXR1cmUpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihcIk5vIGF0dGVzdGF0aW9uIGZvdW5kIGluIENyZWF0ZUtleUltcG9ydEtleVJlc3BvbnNlXCIpO1xuICAgIH1cblxuICAgIC8vIHBhcnNlIHRoZSByZXNwb25zZVxuICAgIHRoaXMucHVibGljS2V5ID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20ocmVzcC5wdWJsaWNfa2V5LCBcImJhc2U2NFwiKSk7XG4gICAgdGhpcy5wdWJsaWNLZXlCYXNlNjQgPSByZXNwLnB1YmxpY19rZXk7XG5cbiAgICB0aGlzLnNrRW5jID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20ocmVzcC5za19lbmMsIFwiYmFzZTY0XCIpKTtcbiAgICB0aGlzLnNrRW5jQmFzZTY0ID0gcmVzcC5za19lbmM7XG5cbiAgICB0aGlzLmRrRW5jID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20ocmVzcC5ka19lbmMsIFwiYmFzZTY0XCIpKTtcbiAgICB0aGlzLmRrRW5jQmFzZTY0ID0gcmVzcC5ka19lbmM7XG5cbiAgICB0aGlzLiNlbmNsYXZlQXR0ZXN0YXRpb24gPSBuZXcgVWludDhBcnJheShCdWZmZXIuZnJvbShyZXNwLmVuY2xhdmVfYXR0ZXN0YXRpb24sIFwiYmFzZTY0XCIpKTtcbiAgICB0aGlzLiNlbmNsYXZlU2lnbmF0dXJlID0gbmV3IFVpbnQ4QXJyYXkoQnVmZmVyLmZyb20ocmVzcC5lbmNsYXZlX3NpZ25hdHVyZSwgXCJiYXNlNjRcIikpO1xuICAgIHRoaXMuZXhwRXBvY2hTZWNvbmRzID0gQmlnSW50KHJlc3AuZXhwaXJlcyk7XG5cbiAgICAvLyB0aGlzIGFycmF5IGlzIHVwZGF0ZWQgaW4gY3JlYXRlQW5kVmVyaWZ5IG9uY2UgdmVyaWZpY2F0aW9uIHN1Y2NlZWRzXG4gICAgdGhpcy52ZXJpZmllZEhhc2ggPSBuZXcgVWludDhBcnJheSgzMik7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuZCB2ZXJpZnkgYW4gaW5zdGFuY2Ugb2YgdGhpcyB0eXBlXG4gICAqXG4gICAqIEBwYXJhbSB7IENyZWF0ZUtleUltcG9ydEtleVJlc3BvbnNlIH0gcmVzcCBUaGUgcmVzcG9uc2UgZnJvbSBDdWJlU2lnbmVyXG4gICAqIEBwYXJhbSB7IFN1YnRsZUNyeXB0byB9IHN1YnRsZSBBbiBpbnN0YW5jZSBvZiBTdWJ0bGVDcnlwdG8gdXNlZCBmb3IgdmVyaWZpY2F0aW9uXG4gICAqIEByZXR1cm4geyBQcm9taXNlPFdyYXBwZWRJbXBvcnRLZXk+IH0gQSBuZXdseSBjb25zdHJ1Y3RlZCBpbnN0YW5jZVxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhc3luYyBjcmVhdGVBbmRWZXJpZnkoXG4gICAgcmVzcDogQ3JlYXRlS2V5SW1wb3J0S2V5UmVzcG9uc2UsXG4gICAgc3VidGxlOiBTdWJ0bGVDcnlwdG8sXG4gICk6IFByb21pc2U8V3JhcHBlZEltcG9ydEtleT4ge1xuICAgIGNvbnN0IHJldCA9IG5ldyBXcmFwcGVkSW1wb3J0S2V5KHJlc3ApO1xuICAgIGNvbnN0IGhhc2ggPSBhd2FpdCByZXQuI3ZlcmlmeUltcG9ydEtleShzdWJ0bGUpO1xuICAgIHJldC52ZXJpZmllZEhhc2guc2V0KGhhc2gpO1xuICAgIHJldHVybiByZXQ7XG4gIH1cblxuICAvKipcbiAgICogVmVyaWZ5IHRoaXMgd3JhcHBlZCBpbXBvcnQga2V5LlxuICAgKlxuICAgKiBAcGFyYW0geyBTdWJ0bGVDcnlwdG8gfSBzdWJ0bGUgQW4gaW5zdGFuY2Ugb2YgU3VidGxlQ3J5cHRvIHVzZWQgZm9yIHZlcmlmaWNhdGlvblxuICAgKiBAcmV0dXJuIHsgUHJvbWlzZTxVaW50OEFycmF5PiB9IFRoZSBoYXNoIG9mIHRoZSBzdWNjZXNzZnVsbHkgdmVyaWZpZWQgd3JhcHBlZCBpbXBvcnQga2V5XG4gICAqL1xuICBhc3luYyAjdmVyaWZ5SW1wb3J0S2V5KHN1YnRsZTogU3VidGxlQ3J5cHRvKTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gICAgLy8gY2hlY2sgZXhwaXJhdGlvbiBkYXRlXG4gICAgaWYgKG5vd0Vwb2NoTWlsbGlzKCkgPiB0aGlzLmV4cEVwb2NoU2Vjb25kcyAqIDEwMDBuKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoXCJJbXBvcnQga2V5IGlzIGV4cGlyZWRcIik7XG4gICAgfVxuXG4gICAgLy8gbWFrZSBzdXJlIHRoYXQgdGhlcmUgaXMgYW4gYXR0ZXN0YXRpb25cbiAgICBpZiAoIXRoaXMuI2VuY2xhdmVTaWduYXR1cmUgfHwgIXRoaXMuI2VuY2xhdmVBdHRlc3RhdGlvbikge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFwiTm8gYXR0ZXN0YXRpb24gZm91bmRcIik7XG4gICAgfVxuICAgIGNvbnN0IHNpZ25pbmdfa2V5ID0gYXdhaXQgdmVyaWZ5QXR0ZXN0YXRpb25LZXkodGhpcy4jZW5jbGF2ZUF0dGVzdGF0aW9uKTtcblxuICAgIC8vIHdlIHVzZSBzdWJ0bGVjcnlwdG8ncyBpbXBsIG9mIFJTQS1QU1MgdmVyaWZpY2F0aW9uXG4gICAgY29uc3QgcnNhUHNzS2V5UGFyYW1zID0ge1xuICAgICAgbmFtZTogXCJSU0EtUFNTXCIsXG4gICAgICBoYXNoOiBcIlNIQS0yNTZcIixcbiAgICB9O1xuICAgIGNvbnN0IHB1YmtleSA9IGF3YWl0IHN1YnRsZS5pbXBvcnRLZXkoXCJzcGtpXCIsIHNpZ25pbmdfa2V5LCByc2FQc3NLZXlQYXJhbXMsIHRydWUsIFtcInZlcmlmeVwiXSk7XG4gICAgY29uc3QgcHVia2V5QWxnID0gcHVia2V5LmFsZ29yaXRobSBhcyB1bmtub3duIGFzIHsgbW9kdWx1c0xlbmd0aDogbnVtYmVyIH07XG5cbiAgICAvLyBjb21wdXRlIHRoZSBzaWduaW5nIGhhc2ggYW5kIHZlcmlmeSB0aGUgc2lnbmF0dXJlXG4gICAgY29uc3QgbWVzc2FnZSA9IHRoaXMuI3NpZ25lZERhdGEoKTtcbiAgICBjb25zdCBtbGVuID0gTnVtYmVyKEJpZ0ludChwdWJrZXlBbGcubW9kdWx1c0xlbmd0aCkgLyA4bik7XG4gICAgY29uc3QgcnNhUHNzUGFyYW1zID0ge1xuICAgICAgbmFtZTogXCJSU0EtUFNTXCIsXG4gICAgICBzYWx0TGVuZ3RoOiBtbGVuIC0gMiAtIDMyLFxuICAgIH07XG5cbiAgICBpZiAoYXdhaXQgc3VidGxlLnZlcmlmeShyc2FQc3NQYXJhbXMsIHB1YmtleSwgdGhpcy4jZW5jbGF2ZVNpZ25hdHVyZSwgbWVzc2FnZSkpIHtcbiAgICAgIHJldHVybiBuZXcgVWludDhBcnJheShhd2FpdCBzdWJ0bGUuZGlnZXN0KFwiU0hBLTI1NlwiLCBtZXNzYWdlKSk7XG4gICAgfVxuICAgIHRocm93IG5ldyBFcnJvcihcIkltcG9ydCBrZXkgc2lnbmF0dXJlIHZlcmlmaWNhdGlvbiBmYWlsZWRcIik7XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJucyBgdHJ1ZWAgaWYgdGhpcyBXcmFwcGVkSW1wb3J0S2V5IG5lZWRzIHRvIGJlIHJlZnJlc2hlZC5cbiAgICpcbiAgICogQHJldHVybiB7IGJvb2xlYW4gfSBUcnVlIGp1c3QgaWYgdGhpcyBrZXkgbmVlZHMgdG8gYmUgcmVmcmVzaGVkLlxuICAgKi9cbiAgcHVibGljIG5lZWRzUmVmcmVzaCgpOiBib29sZWFuIHtcbiAgICAvLyBmb3JjZSByZWZyZXNoIGlmIHdlJ3JlIHdpdGhpbiBXSUtfUkVGUkVTSF9FQVJMWV9NSUxMSVMgb2YgdGhlIGV4cGlyYXRpb25cbiAgICByZXR1cm4gbm93RXBvY2hNaWxsaXMoKSArIFdJS19SRUZSRVNIX0VBUkxZX01JTExJUyA+IHRoaXMuZXhwRXBvY2hTZWNvbmRzICogMTAwMG47XG4gIH1cblxuICAvKipcbiAgICogQ29tcHV0ZXMgdGhlIHNpZ25pbmcgaGFzaCBmb3IgYSB3cmFwcGVkIGltcG9ydCBrZXlcbiAgICpcbiAgICogQHJldHVybiB7IFVpbnQ4QXJyYXkgfSBUaGUgc2lnbmluZyBoYXNoXG4gICAqL1xuICAjc2lnbmVkRGF0YSgpOiBVaW50OEFycmF5IHtcbiAgICBjb25zdCBwYXJ0czogVWludDhBcnJheVtdID0gW1xuICAgICAgLy8gZG9tYWluIHNlcGFyYXRpb24gdGFnXG4gICAgICB0b0JpZ0VuZGlhbihCaWdJbnQoSU1QT1JUX0tFWV9TSUdOSU5HX0RTVC5sZW5ndGgpLCAyKSxcbiAgICAgIElNUE9SVF9LRVlfU0lHTklOR19EU1QsXG5cbiAgICAgIC8vIHB1YmxpYyBrZXlcbiAgICAgIHRvQmlnRW5kaWFuKEJpZ0ludCh0aGlzLnB1YmxpY0tleS5sZW5ndGgpLCAyKSxcbiAgICAgIHRoaXMucHVibGljS2V5LFxuXG4gICAgICAvLyBza19lbmNcbiAgICAgIHRvQmlnRW5kaWFuKEJpZ0ludCh0aGlzLnNrRW5jLmxlbmd0aCksIDIpLFxuICAgICAgdGhpcy5za0VuYyxcblxuICAgICAgLy8gZGtfZW5jXG4gICAgICB0b0JpZ0VuZGlhbihCaWdJbnQodGhpcy5ka0VuYy5sZW5ndGgpLCAyKSxcbiAgICAgIHRoaXMuZGtFbmMsXG5cbiAgICAgIC8vIDgtYnl0ZSBiaWctZW5kaWFuIGV4cGlyYXRpb24gdGltZSBpbiBzZWNvbmRzIHNpbmNlIFVOSVggZXBvY2hcbiAgICAgIHRvQmlnRW5kaWFuKHRoaXMuZXhwRXBvY2hTZWNvbmRzLCA4KSxcbiAgICBdO1xuXG4gICAgcmV0dXJuIGNvbmNhdEFycmF5cyhwYXJ0cyk7XG4gIH1cbn1cblxuLyoqXG4gKiBUaGUgcmV0dXJuIHZhbHVlIGZyb20gS2V5SW1wb3J0ZXIuI2dldFdyYXBwZWRJbXBvcnRBbmRQdWJLZXkoKVxuICovXG50eXBlIFdyYXBwZWRJbXBvcnRBbmRQdWJLZXkgPSB7XG4gIHdpazogV3JhcHBlZEltcG9ydEtleTtcbiAgaXBrOiBDcnlwdG9LZXk7XG59O1xuXG4vKipcbiAqIEFuIGltcG9ydCBlbmNyeXB0aW9uIGtleSBhbmQgdGhlIGNvcnJlc3BvbmRpbmcgYXR0ZXN0YXRpb24gZG9jdW1lbnRcbiAqL1xuZXhwb3J0IGNsYXNzIEtleUltcG9ydGVyIHtcbiAgI3dyYXBwZWRJbXBvcnRLZXk6IG51bGwgfCBXcmFwcGVkSW1wb3J0S2V5ID0gbnVsbDtcbiAgI3N1YnRsZUNyeXB0bzogbnVsbCB8IFN1YnRsZUNyeXB0byA9IG51bGw7XG4gICNwdWJsaWNLZXlIYW5kbGU6IG51bGwgfCBDcnlwdG9LZXkgPSBudWxsO1xuICByZWFkb25seSAjaHBrZVN1aXRlOiBDaXBoZXJTdWl0ZTtcbiAgcmVhZG9ubHkgI2NzOiBPcmc7XG5cbiAgLyoqXG4gICAqIENvbnN0cnVjdCBmcm9tIGEgQ3ViZVNpZ25lciBgT3JnYCBpbnN0YW5jZVxuICAgKlxuICAgKiBAcGFyYW0geyBPcmcgfSBjcyBBIEN1YmVTaWduZXIgYE9yZ2AgaW5zdGFuY2VcbiAgICovXG4gIGNvbnN0cnVjdG9yKGNzOiBPcmcpIHtcbiAgICB0aGlzLiNjcyA9IGNzO1xuICAgIHRoaXMuI2hwa2VTdWl0ZSA9IG5ldyBDaXBoZXJTdWl0ZSh7XG4gICAgICBrZW06IG5ldyBEaGtlbVAzODRIa2RmU2hhMzg0KCksXG4gICAgICBrZGY6IG5ldyBIa2RmU2hhMzg0KCksXG4gICAgICBhZWFkOiBuZXcgQWVzMjU2R2NtKCksXG4gICAgfSk7XG4gIH1cblxuICAvKipcbiAgICogQ2hlY2sgdGhhdCB0aGUgd3JhcHBlZCBpbXBvcnQga2V5IGlzIHVuZXhwaXJlZCBhbmQgdmVyaWZpZWQuIE90aGVyd2lzZSxcbiAgICogcmVxdWVzdCBhIG5ldyBvbmUsIHZlcmlmeSBpdCwgYW5kIHVwZGF0ZSB0aGUgdmVyaWZpZWQgc2lnbmluZyBoYXNoLlxuICAgKlxuICAgKiBAcmV0dXJuIHsgUHJvbWlzZTxbV3JhcHBlZEltcG9ydEtleSwgQ3J5cHRvS2V5XT4gfSBUaGUgdmVyaWZpZWQgc2lnbmluZyBoYXNoLlxuICAgKi9cbiAgYXN5bmMgI2dldFdyYXBwZWRJbXBvcnRBbmRQdWJLZXkoKTogUHJvbWlzZTxXcmFwcGVkSW1wb3J0QW5kUHViS2V5PiB7XG4gICAgaWYgKCF0aGlzLiN3cmFwcGVkSW1wb3J0S2V5KSB7XG4gICAgICAvLyBmaXJzdCB0aW1lIHdlIGxvYWQgYSBXcmFwcGVkSW1wb3J0S2V5LCBtYWtlIHN1cmUgdGhlIHg1MDkgY3J5cHRvXG4gICAgICAvLyBwcm92aWRlciBpcyBzZXQgY29ycmVjdGx5LlxuICAgICAgeDUwOUNyeXB0b1Byb3ZpZGVyLnNldChhd2FpdCBsb2FkQ3J5cHRvKCkpO1xuICAgIH1cbiAgICBpZiAoIXRoaXMuI3dyYXBwZWRJbXBvcnRLZXkgfHwgdGhpcy4jd3JhcHBlZEltcG9ydEtleS5uZWVkc1JlZnJlc2goKSkge1xuICAgICAgY29uc3Qga2lrUmVzcCA9IGF3YWl0IHRoaXMuI2NzLmNyZWF0ZUtleUltcG9ydEtleSgpO1xuICAgICAgY29uc3Qgc3VidGxlID0gYXdhaXQgdGhpcy4jZ2V0U3VidGxlQ3J5cHRvKCk7XG4gICAgICBjb25zdCB3aWsgPSBhd2FpdCBXcmFwcGVkSW1wb3J0S2V5LmNyZWF0ZUFuZFZlcmlmeShraWtSZXNwLCBzdWJ0bGUpO1xuXG4gICAgICAvLyBpbXBvcnQgdGhlIHB1YmxpYyBrZXkgZnJvbSB0aGUgV3JhcHBlZEltcG9ydEtleVxuICAgICAgY29uc3QgcDM4NFBhcmFtcyA9IHtcbiAgICAgICAgbmFtZTogXCJFQ0RIXCIsXG4gICAgICAgIG5hbWVkQ3VydmU6IFwiUC0zODRcIixcbiAgICAgIH07XG4gICAgICB0aGlzLiNwdWJsaWNLZXlIYW5kbGUgPSBhd2FpdCBzdWJ0bGUuaW1wb3J0S2V5KFwicmF3XCIsIHdpay5wdWJsaWNLZXksIHAzODRQYXJhbXMsIHRydWUsIFtdKTtcbiAgICAgIHRoaXMuI3dyYXBwZWRJbXBvcnRLZXkgPSB3aWs7XG4gICAgfVxuICAgIHJldHVybiB7XG4gICAgICB3aWs6IHRoaXMuI3dyYXBwZWRJbXBvcnRLZXksXG4gICAgICBpcGs6IHRoaXMuI3B1YmxpY0tleUhhbmRsZSEsXG4gICAgfTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHZXQgb3IgY3JlYXRlIGFuIGluc3RhbmNlIG9mIFN1YnRsZUNyeXB0by5cbiAgICpcbiAgICogQHJldHVybiB7IFN1YnRsZUNyeXB0byB9IFRoZSBpbnN0YW5jZSBvZiBTdWJ0bGVDcnlwdG8uXG4gICAqL1xuICBhc3luYyAjZ2V0U3VidGxlQ3J5cHRvKCk6IFByb21pc2U8U3VidGxlQ3J5cHRvPiB7XG4gICAgaWYgKCF0aGlzLiNzdWJ0bGVDcnlwdG8pIHtcbiAgICAgIHRoaXMuI3N1YnRsZUNyeXB0byA9IGF3YWl0IGxvYWRTdWJ0bGVDcnlwdG8oKTtcbiAgICB9XG4gICAgcmV0dXJuIHRoaXMuI3N1YnRsZUNyeXB0bztcbiAgfVxuXG4gIC8qKlxuICAgKiBFbmNyeXB0cyBhIHNldCBvZiBtbmVtb25pY3MgYW5kIGltcG9ydHMgdGhlbS5cbiAgICpcbiAgICogQHBhcmFtIHsgS2V5VHlwZSB9IGtleVR5cGUgVGhlIHR5cGUgb2Yga2V5IHRvIGltcG9ydFxuICAgKiBAcGFyYW0geyBNbmVtb25pY1RvSW1wb3J0W10gfSBtbmVzIFRoZSBtbmVtb25pY3MgdG8gaW1wb3J0LCB3aXRoIG9wdGlvbmFsIGRlcml2YXRpb24gcGF0aHMgYW5kIHBhc3N3b3Jkc1xuICAgKiBAcmV0dXJuIHsgUHJvbWlzZTxLZXlbXT4gfSBgS2V5YCBvYmplY3RzIGZvciBlYWNoIGltcG9ydGVkIGtleS5cbiAgICovXG4gIHB1YmxpYyBhc3luYyBpbXBvcnRNbmVtb25pY3Moa2V5VHlwZTogS2V5VHlwZSwgbW5lczogTW5lbW9uaWNUb0ltcG9ydFtdKTogUHJvbWlzZTxLZXlbXT4ge1xuICAgIGNvbnN0IG5DaHVua3MgPSBOdW1iZXIoXG4gICAgICAoQmlnSW50KG1uZXMubGVuZ3RoKSArIE1BWF9JTVBPUlRTX1BFUl9BUElfQ0FMTCAtIDFuKSAvIE1BWF9JTVBPUlRTX1BFUl9BUElfQ0FMTCxcbiAgICApO1xuICAgIGNvbnN0IGtleXMgPSBbXTtcblxuICAgIGZvciAobGV0IGkgPSAwOyBpIDwgbkNodW5rczsgKytpKSB7XG4gICAgICAvLyBmaXJzdCwgbWFrZSBzdXJlIHRoYXQgdGhlIHdyYXBwZWQgaW1wb3J0IGtleSBpcyB2YWxpZCwgaS5lLiwgdGhhdFxuICAgICAgLy8gd2UgaGF2ZSByZXRyaWV2ZWQgaXQgYW5kIHRoYXQgaXQgaGFzbid0IGV4cGlyZWQuIFdlIGRvIHRoaXMgaGVyZVxuICAgICAgLy8gZm9yIGEgY291cGxlIHJlYXNvbnM6XG4gICAgICAvL1xuICAgICAgLy8gLSBhbGwgZW5jcnlwdGlvbnMgaW4gYSBnaXZlIHJlcXVlc3QgbXVzdCB1c2UgdGhlIHNhbWUgaW1wb3J0IGtleSwgYW5kXG4gICAgICAvL1xuICAgICAgLy8gLSB3aGVuIGltcG9ydGluZyBhIGh1Z2UgbnVtYmVyIG9mIGtleXMgdGhlIGltcG9ydCBwdWJrZXkgbWlnaHQgZXhwaXJlXG4gICAgICAvLyAgIGR1cmluZyB0aGUgaW1wb3J0LCBzbyB3ZSBjaGVjayBmb3IgZXhwaXJhdGlvbiBiZWZvcmUgZWFjaCByZXF1ZXN0XG4gICAgICBjb25zdCB7IHdpaywgaXBrIH0gPSBhd2FpdCB0aGlzLiNnZXRXcmFwcGVkSW1wb3J0QW5kUHViS2V5KCk7XG5cbiAgICAgIC8vIG5leHQsIGVuY3J5cHQgdGhpcyBjaHVuayBvZiBtbmVtb25pY3NcbiAgICAgIGNvbnN0IHN0YXJ0ID0gTnVtYmVyKE1BWF9JTVBPUlRTX1BFUl9BUElfQ0FMTCkgKiBpO1xuICAgICAgY29uc3QgZW5kID0gTnVtYmVyKE1BWF9JTVBPUlRTX1BFUl9BUElfQ0FMTCkgKyBzdGFydDtcbiAgICAgIGNvbnN0IG1uZVNsaWNlID0gbW5lcy5zbGljZShzdGFydCwgZW5kKTtcbiAgICAgIGNvbnN0IGtleV9tYXRlcmlhbCA9IFtdO1xuICAgICAgZm9yIChjb25zdCBtbmUgb2YgbW5lU2xpY2UpIHtcbiAgICAgICAgY29uc3Qga2V5UGtnID0gbmV3TW5lbW9uaWNLZXlQYWNrYWdlKG1uZSk7XG4gICAgICAgIGNvbnN0IG1hdGVyaWFsID0gYXdhaXQgdGhpcy4jZW5jcnlwdChrZXlQa2csIHdpay52ZXJpZmllZEhhc2gsIGlwayk7XG4gICAgICAgIGtleV9tYXRlcmlhbC5wdXNoKG1hdGVyaWFsKTtcbiAgICAgIH1cblxuICAgICAgLy8gY29uc3RydWN0IHRoZSByZXF1ZXN0XG4gICAgICBjb25zdCByZXE6IEltcG9ydEtleVJlcXVlc3QgPSB7XG4gICAgICAgIHB1YmxpY19rZXk6IHdpay5wdWJsaWNLZXlCYXNlNjQsXG4gICAgICAgIHNrX2VuYzogd2lrLnNrRW5jQmFzZTY0LFxuICAgICAgICBka19lbmM6IHdpay5ka0VuY0Jhc2U2NCxcbiAgICAgICAgZXhwaXJlczogTnVtYmVyKHdpay5leHBFcG9jaFNlY29uZHMpLFxuICAgICAgICBrZXlfdHlwZToga2V5VHlwZSxcbiAgICAgICAga2V5X21hdGVyaWFsLFxuICAgICAgfTtcblxuICAgICAgLy8gc2VuZCBpdCBhbmQgYXBwZW5kIHRoZSByZXN1bHQgdG8gdGhlIHJldHVybiB2YWx1ZVxuICAgICAgY29uc3QgcmVzcCA9IGF3YWl0IHRoaXMuI2NzLmltcG9ydEtleXMocmVxKTtcbiAgICAgIGtleXMucHVzaCguLi5yZXNwKTtcbiAgICB9XG5cbiAgICByZXR1cm4ga2V5cztcbiAgfVxuXG4gIC8qKlxuICAgKiBFbmNyeXB0IHRvIHRoaXMgd3JhcHBlZCBpbXBvcnQga2V5LiBTdG9yZXMgdGhlIHJlc3VsdCBpbiBgdGhpcy5lbmNyeXB0ZWRfa2V5c2BcbiAgICpcbiAgICogQHBhcmFtIHsgVWludDhBcnJheSB9IGRhdGEgVGhlIGRhdGEgdG8gZW5jcnlwdFxuICAgKiBAcGFyYW0geyBVaW50OEFycmF5IH0gdmVyaWZpZWRIYXNoIFRoZSB2ZXJpZmllZCBzaWduaW5nIGhhc2ggb2YgdGhlIHdyYXBwZWQgaW1wb3J0IGtleSB0byB3aGljaCB0byBlbmNyeXB0XG4gICAqIEBwYXJhbSB7IENyeXB0b0tleSB9IHB1YmtleSBUaGUgcHVibGljIGtleSB0byBlbmNyeXB0IHRvXG4gICAqIEByZXR1cm4geyBQcm9taXNlPEltcG9ydEtleVJlcXVlc3RNYXRlcmlhbD4gfSBUaGUgZW5jcnlwdGVkIGtleSBtYXRlcmlhbFxuICAgKi9cbiAgYXN5bmMgI2VuY3J5cHQoXG4gICAgZGF0YTogVWludDhBcnJheSxcbiAgICB2ZXJpZmllZEhhc2g6IFVpbnQ4QXJyYXksXG4gICAgcHVia2V5OiBDcnlwdG9LZXksXG4gICk6IFByb21pc2U8SW1wb3J0S2V5UmVxdWVzdE1hdGVyaWFsPiB7XG4gICAgLy8gc2V0IHVwIHRoZSBIUEtFIHNlbmRlclxuICAgIGNvbnN0IHNlbmRlciA9IGF3YWl0IHRoaXMuI2hwa2VTdWl0ZS5jcmVhdGVTZW5kZXJDb250ZXh0KHtcbiAgICAgIHJlY2lwaWVudFB1YmxpY0tleTogcHVia2V5LFxuICAgICAgaW5mbzogdmVyaWZpZWRIYXNoLFxuICAgIH0pO1xuXG4gICAgLy8gZW5jcnlwdCBhbmQgY29uc3RydWN0IHRoZSByZXR1cm4gdmFsdWVcbiAgICBjb25zdCBzZW5kZXJDdGV4dCA9IGF3YWl0IHNlbmRlci5zZWFsKGRhdGEpO1xuICAgIHJldHVybiB7XG4gICAgICBzYWx0OiBcIlwiLFxuICAgICAgY2xpZW50X3B1YmxpY19rZXk6IEJ1ZmZlci5mcm9tKHNlbmRlci5lbmMpLnRvU3RyaW5nKFwiYmFzZTY0XCIpLFxuICAgICAgaWttX2VuYzogQnVmZmVyLmZyb20oc2VuZGVyQ3RleHQpLnRvU3RyaW5nKFwiYmFzZTY0XCIpLFxuICAgIH07XG4gIH1cbn1cblxuLypcbiAqIEFuIEFXUyBOaXRybyBhdHRlc3RhdGlvbiBkb2N1bWVudFxuICpcbiAqIGh0dHBzOi8vZ2l0aHViLmNvbS9hd3MvYXdzLW5pdHJvLWVuY2xhdmVzLW5zbS1hcGkvYmxvYi80Yjg1MWYzMDA2YzZmYTk4ZjIzZGNmZmIyY2JhMDNiMzlkZTliOGFmL3NyYy9hcGkvbW9kLnJzI0wyMDhcbiAqL1xudHlwZSBBdHRlc3RhdGlvbkRvYyA9IHtcbiAgbW9kdWxlX2lkOiBzdHJpbmc7XG4gIGRpZ2VzdDogXCJTSEEyNTZcIiB8IFwiU0hBMzg0XCIgfCBcIlNIQTUxMlwiO1xuICB0aW1lc3RhbXA6IGJpZ2ludDtcbiAgcGNyczogTWFwPG51bWJlciwgVWludDhBcnJheT47XG4gIGNlcnRpZmljYXRlOiBVaW50OEFycmF5O1xuICBjYWJ1bmRsZTogVWludDhBcnJheVtdO1xuICBwdWJsaWNfa2V5PzogVWludDhBcnJheTtcbiAgdXNlcl9kYXRhPzogVWludDhBcnJheTtcbiAgbm9uY2U/OiBVaW50OEFycmF5O1xufTtcblxuLyoqXG4gKiBWZXJpZmllcyB0aGUgYXR0ZXN0YXRpb24ga2V5IGFnYWluc3QgdGhlIEFXUyBOaXRybyBFbmNsYXZlcyBzaWduaW5nXG4gKiBrZXkgYW5kIHJldHVybnMgdGhlIGF0dGVzdGVkIHNpZ25pbmcga2V5LlxuICpcbiAqIEBwYXJhbSB7IFVpbnQ4QXJyYXkgfSBhdHRCeXRlcyBBbiBhdHRlc3RhdGlvbiBmcm9tIGFuIEFXUyBuaXRybyBlbmNsYXZlXG4gKiBAcmV0dXJuIHsgUHJvbWlzZTxVaW50OEFycmF5PiB9IFRoZSBzaWduaW5nIGtleSB0aGF0IHdhcyBhdHRlc3RlZCwgb3IgbnVsbCBpZiB2ZXJpZmljYXRpb24gZmFpbGVkXG4gKi9cbmFzeW5jIGZ1bmN0aW9uIHZlcmlmeUF0dGVzdGF0aW9uS2V5KGF0dEJ5dGVzOiBVaW50OEFycmF5KTogUHJvbWlzZTxVaW50OEFycmF5PiB7XG4gIC8vIGNib3IteCBpcyBiZWluZyBpbXBvcnRlZCBhcyBFU00sIHNvIHdlIG11c3QgYXN5bmNocm9ub3VzbHkgaW1wb3J0IGl0IGhlcmUuXG4gIC8vIEJlY2F1c2Ugd2Ugb25seSB1c2UgdGhhdCBhbmQgYXV0aDAvY29zZSBoZXJlLCB3ZSBpbXBvcnQgYm90aCB0aGlzIHdheS5cbiAgY29uc3QgeyBTaWduMSB9ID0gYXdhaXQgaW1wb3J0KFwiQGF1dGgwL2Nvc2VcIik7XG4gIGNvbnN0IHsgZGVjb2RlOiBjYm9yRGVjb2RlIH0gPSBhd2FpdCBpbXBvcnQoXCJjYm9yLXhcIik7XG5cbiAgY29uc3QgYXR0ID0gU2lnbjEuZGVjb2RlKGF0dEJ5dGVzKTtcbiAgY29uc3QgYXR0RG9jID0gY2JvckRlY29kZShhdHQucGF5bG9hZCkgYXMgQXR0ZXN0YXRpb25Eb2M7XG5cbiAgLy8gY2hlY2sgZXhwaXJhdGlvbiBkYXRlIG9mIGF0dGVzdGF0aW9uXG4gIGNvbnN0IGxhdGVzdCA9IG5vd0Vwb2NoTWlsbGlzKCkgKyBNQVhfQVRURVNUQVRJT05fRlVUVVJFX01JTlVURVMgKiA2MG4gKiAxMDAwbjtcbiAgY29uc3QgZWFybGllc3QgPVxuICAgIGxhdGVzdCAtIChNQVhfQVRURVNUQVRJT05fRlVUVVJFX01JTlVURVMgKyBNQVhfQVRURVNUQVRJT05fQUdFX01JTlVURVMpICogNjBuICogMTAwMG47XG4gIGlmIChhdHREb2MudGltZXN0YW1wIDwgZWFybGllc3QgfHwgYXR0RG9jLnRpbWVzdGFtcCA+IGxhdGVzdCkge1xuICAgIHRocm93IG5ldyBFcnJvcihcIkF0dGVzdGF0aW9uIGlzIGV4cGlyZWRcIik7XG4gIH1cblxuICAvLyBpZiB0aGVyZSdzIG5vIHB1YmxpYyBrZXkgaW4gdGhpcyBhdHRlc3RhdGlvbiwgZ2l2ZSB1cFxuICBpZiAoIWF0dERvYy5wdWJsaWNfa2V5KSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFwiQXR0ZXN0YXRpb24gZGlkIG5vdCBpbmNsdWRlIGEgc2lnbmluZyBwdWJsaWMga2V5XCIpO1xuICB9XG5cbiAgLy8gVmVyaWZ5IGNlcnRpZmljYXRlIGNoYWluIHN0YXJ0aW5nIHdpdGggQVdTIE5pdHJvIENBIGNlcnRcbiAgbGV0IHBhcmVudCA9IG5ldyBYNTA5Q2VydGlmaWNhdGUoQVdTX0NBX0NFUlQpO1xuICBmb3IgKGxldCBpID0gMDsgaSA8IGF0dERvYy5jYWJ1bmRsZS5sZW5ndGg7ICsraSkge1xuICAgIGNvbnN0IGNlcnQgPSBuZXcgWDUwOUNlcnRpZmljYXRlKGF0dERvYy5jYWJ1bmRsZVtpXSk7XG4gICAgaWYgKCEoYXdhaXQgY2VydC52ZXJpZnkocGFyZW50KSkpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgQXR0ZXN0YXRpb24gY2VydGlmaWNhdGUgY2hhaW4gZmFpbGVkIGF0IGluZGV4ICR7aX1gKTtcbiAgICB9XG4gICAgcGFyZW50ID0gY2VydDtcbiAgfVxuICBjb25zdCBjZXJ0ID0gbmV3IFg1MDlDZXJ0aWZpY2F0ZShhdHREb2MuY2VydGlmaWNhdGUpO1xuICBpZiAoIShhd2FpdCBjZXJ0LnZlcmlmeShwYXJlbnQpKSkge1xuICAgIHRocm93IG5ldyBFcnJvcihcIkF0dGVzdGF0aW9uIGNlcnRpZmljYXRlIGNoYWluIGZhaWxlZCBhdCBsZWFmXCIpO1xuICB9XG4gIGNvbnN0IHB1YmtleSA9IGNlcnQucHVibGljS2V5O1xuXG4gIC8vIG1ha2Ugc3VyZSB0aGF0IHdlIGdvdCB0aGUgZXhwZWN0ZWQgcHVibGljIGtleSB0eXBlXG4gIGNvbnN0IGFsZyA9IG5ldyBBbGdvcml0aG1Qcm92aWRlcigpLnRvQXNuQWxnb3JpdGhtKHB1YmtleS5hbGdvcml0aG0pO1xuICBpZiAoYWxnLmFsZ29yaXRobSAhPSBFQ19QVUJMSUNfS0VZKSB7XG4gICAgLy8gbm90IHRoZSBleHBlY3RlZCBhbGdvcml0aG0sIGkuZS4sIGVsbGlwdGljIGN1cnZlIHNpZ25pbmdcbiAgICB0aHJvdyBuZXcgRXJyb3IoXCJBdHRlc3RhdGlvbiBjb250YWluZWQgdW5leHBlY3RlZCBzaWduYXR1cmUgYWxnb3JpdGhtXCIpO1xuICB9XG4gIGNvbnN0IHBhcmFtcyA9IEFzblBhcnNlci5wYXJzZShhbGcucGFyYW1ldGVycyEsIEVDUGFyYW1ldGVycyk7XG4gIGlmICghcGFyYW1zLm5hbWVkQ3VydmUgfHwgcGFyYW1zLm5hbWVkQ3VydmUgIT09IE5JU1RfUDM4NCkge1xuICAgIC8vIG5vdCB0aGUgZXhwZWN0ZWQgcGFyYW1zLCBpLmUuLCBOSVNUIFAzODRcbiAgICB0aHJvdyBuZXcgRXJyb3IoXCJBdHRlc3RhdGlvbiBjb250YWluZWQgdW5leHBlY3RlZCBzaWduYXR1cmUgYWxnb3JpdGhtXCIpO1xuICB9XG5cbiAgLy8gdmVyaWZ5IHRoZSBjb3NlIHNpZ25hdHVyZSB3aXRoIHRoZSBrZXksIHdoaWNoIHdlIHZlcmlmaWVkIGFnYWluc3RcbiAgLy8gdGhlIEFXUyBOaXRybyBDQSBjZXJ0aWZpY2F0ZSBhYm92ZVxuICBhd2FpdCBhdHQudmVyaWZ5KGF3YWl0IHB1YmtleS5leHBvcnQoKSk7XG5cbiAgcmV0dXJuIGF0dERvYy5wdWJsaWNfa2V5O1xufVxuIl19

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { KeyImporter } from "./import";
+export { MnemonicToImport } from "./mnemonic";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyImporter = void 0;
+var import_1 = require("./import");
+Object.defineProperty(exports, "KeyImporter", { enumerable: true, get: function () { return import_1.KeyImporter; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbUNBQXVDO0FBQTlCLHFHQUFBLFdBQVcsT0FBQSIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCB7IEtleUltcG9ydGVyIH0gZnJvbSBcIi4vaW1wb3J0XCI7XG5leHBvcnQgeyBNbmVtb25pY1RvSW1wb3J0IH0gZnJvbSBcIi4vbW5lbW9uaWNcIjtcbiJdfQ==

package/dist/mnemonic.d.ts

@@ -0,0 +1,35 @@
+export type MnemonicKeyPackage = {
+    EnglishMnemonic: {
+        mnemonic: {
+            entropy: Uint8Array;
+        };
+        der_path: {
+            path: number[];
+        };
+        password: string;
+    };
+};
+/**
+ * A BIP39 mnemonic to be imported, plus optional BIP39 password
+ * and BIP32 derivation path.
+ */
+export type MnemonicToImport = {
+    mnemonic: string;
+    derivationPath?: string;
+    password?: string;
+};
+/**
+ * Create a new MnemonicKeyPackage value
+ *
+ * @param { MnemonicToImport } mne A BIP39 mnemonic and optional BIP39 password and BIP32 derivation path
+ * @return { Uint8Array } A serialized key package for import to CubeSigner
+ */
+export declare function newMnemonicKeyPackage(mne: MnemonicToImport): Uint8Array;
+/**
+ * Parse a derivation path into a sequence of 32-bit integers
+ *
+ * @param { string } derp The derivation path to parse; must start with 'm/'
+ * @return { number[] } The parsed path
+ */
+export declare function parseDerivationPath(derp: string): number[];
+//# sourceMappingURL=mnemonic.d.ts.map

package/dist/mnemonic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mnemonic.d.ts","sourceRoot":"","sources":["../src/mnemonic.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,EAAE;QACf,QAAQ,EAAE;YACR,OAAO,EAAE,UAAU,CAAC;SACrB,CAAC;QACF,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,EAAE,CAAC;SAChB,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,UAAU,CAgBvE;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA6B1D"}