@pipeline-builder/api-core 0.0.1

package/lib/utils/secret-encryption.d.ts

@@ -0,0 +1,176 @@
+/** On-disk shape of an encrypted secret. JSON-serializable. */
+export interface EncryptedBlob {
+    /** Algorithm tag. Bump on format change so a future migration can detect old blobs. */
+    alg: 'aes-256-gcm-v1';
+    /** Base64-encoded 12-byte IV. */
+    iv: string;
+    /** Base64-encoded ciphertext + 16-byte authentication tag concatenated. */
+    ciphertext: string;
+    /** Optional key id  populated by KMS-backed providers, ignored by the env provider. */
+    kid?: string;
+}
+/** Pluggable key source. Env-backed by default; KMS-backed available. */
+export interface KeyProvider {
+    /** Derive a 32-byte symmetric key bound to `orgId`. */
+    deriveKey(orgId: string): Buffer;
+    /** Optional async variant for providers that need to do I/O (e.g.
+     *  per-org KMS lookup the first time an org is seen). Default
+     *  implementation forwards to the sync `deriveKey`. */
+    deriveKeyAsync?(orgId: string): Promise<Buffer>;
+    /** Optional KMS-key-id this provider used for `orgId`. Embedded in the
+     *  `EncryptedBlob.kid` field on write so decrypt can verify the right
+     *  KMS CMK is being used (defense against an attacker who swaps a blob
+     *  between orgs). Default returns undefined (env provider). */
+    kidFor?(orgId: string): string | undefined;
+}
+/**
+ * Default provider  derives a per-org key from `SECRET_ENCRYPTION_KEY` via
+ * HKDF-SHA256. Suitable for self-hosted / dev where operators don't have KMS.
+ *
+ * Fails fast if the env is missing or the key is the wrong length so misconfig
+ * surfaces at first use rather than silently fingerprinting all writes with
+ * a default zero key.
+ */
+export declare class EnvKeyProvider implements KeyProvider {
+    private readonly masterKey;
+    constructor(masterKeyOverride?: string);
+    deriveKey(orgId: string): Buffer;
+}
+export declare class KmsKeyProvider implements KeyProvider {
+    private masterKeyCache;
+    private readonly keyId;
+    private readonly ciphertextB64;
+    private readonly region?;
+    private readonly endpoint?;
+    private decryptInFlight;
+    constructor(opts?: {
+        keyId?: string;
+        ciphertextBase64?: string;
+        region?: string;
+        endpoint?: string;
+    });
+    deriveKey(orgId: string): Buffer;
+    /**
+     * Eagerly recover the master key from KMS so subsequent `deriveKey`
+     * calls are sync. Idempotent  concurrent callers share the same in-
+     * flight promise so we don't spawn multiple KMS Decrypt requests at
+     * boot. Throws on any KMS failure; the caller (typically the service's
+     * onBeforeStart hook) decides whether to fall back to a different
+     * provider or fail-startup.
+     */
+    warmup(): Promise<void>;
+    private fetchAndDecrypt;
+}
+/** Read the active default provider. Exposed so service code (e.g. an
+ *  admin endpoint that just rotated an org's KMS config) can call
+ *  `provider.evict(orgId)` on the live provider rather than reconstructing
+ *  one. Triggers lazy initialization on first access, same as the internal
+ *  callers below. */
+export declare function getDefaultKeyProvider(): KeyProvider;
+/** Reset the cached default provider  for tests that mutate `process.env`. */
+export declare function resetDefaultKeyProvider(): void;
+/** Replace the default provider  services that opt into KMS call this
+ * once at startup with a warmed-up `KmsKeyProvider`. */
+export declare function setKeyProvider(provider: KeyProvider): void;
+/** Per-org KMS config the operator supplies. The `keyId` identifies the
+ *  KMS CMK to call Decrypt on; `ciphertextBase64` is the wrapped 32-byte
+ *  master generated by `aws kms encrypt` against that key. */
+export interface PerOrgKmsConfig {
+    keyId: string;
+    ciphertextBase64: string;
+}
+/**
+ * Async resolver that maps an org id to its KMS config. Returns `null` when
+ * the org has no per-org config — the provider then falls back to the
+ * `fallback` provider supplied at construction (usually an EnvKeyProvider
+ * or a default KmsKeyProvider).
+ */
+export type PerOrgKmsResolver = (orgId: string) => Promise<PerOrgKmsConfig | null>;
+/**
+ * Per-org KMS-backed KeyProvider. The blast radius of a KMS key compromise
+ * is one org instead of every org under a shared master.
+ *
+ * Each org has its own KMS CMK + its own wrapped master (stored in Mongo
+ * via the operator's setup script). On first encrypt/decrypt for an org,
+ * the provider:
+ *   1. Calls the resolver to fetch the org's KMS config.
+ *   2. Calls `kms:Decrypt` to recover the 32-byte master.
+ *   3. Caches the recovered master in-memory for the process lifetime.
+ *   4. HKDF-derives per-call from that master + the org id salt.
+ *
+ * Blobs encrypted by this provider carry `kid = <kms-key-id>` so the
+ * decrypt path detects a stale config (operator rotated the key but
+ * existing rows weren't re-encrypted) BEFORE AES-GCM throws an opaque
+ * authentication-tag error.
+ *
+ * Orgs without per-org config fall through to the `fallback` provider —
+ * mixed-mode deployments where some orgs have KMS isolation and others
+ * stay on the shared master are explicitly supported.
+ */
+export declare class PerOrgKmsKeyProvider implements KeyProvider {
+    /** Cached per-org master keys, keyed by orgId. */
+    private readonly masters;
+    /** Resolved per-org configs cached for the process lifetime. */
+    private readonly configs;
+    /** In-flight resolver promises so concurrent first-touch callers share one KMS Decrypt.
+     *  Resolves to `null` for orgs with no per-org config — caller treats null as
+     *  "fall through to the fallback provider", same as a cold cache miss. */
+    private readonly inFlight;
+    /** Provider used for orgs that have no per-org config. */
+    private readonly fallback;
+    private readonly resolver;
+    private readonly region?;
+    private readonly endpoint?;
+    constructor(opts: {
+        resolver: PerOrgKmsResolver;
+        fallback: KeyProvider;
+        region?: string;
+        endpoint?: string;
+    });
+    /** Sync `deriveKey` only works for already-warmed orgs. Cold orgs fall
+     *  through to the fallback provider. Callers that want per-org isolation
+     *  MUST `await deriveKeyAsync(orgId)` once first (e.g. during request setup
+     *  or as part of a warmup pass) — otherwise the org silently uses the
+     *  shared master. */
+    deriveKey(orgId: string): Buffer;
+    deriveKeyAsync(orgId: string): Promise<Buffer>;
+    kidFor(orgId: string): string | undefined;
+    /**
+     * Resolve the org's KMS config, call Decrypt, cache the master. Subsequent
+     * calls for the same org are no-ops. Concurrent callers share the in-flight
+     * Decrypt promise.
+     *
+     * Returns silently when the org has no per-org config — the fallback
+     * provider handles those orgs.
+     */
+    ensureWarmed(orgId: string): Promise<void>;
+    private resolveAndDecrypt;
+    private fetchAndDecrypt;
+    /** Evict a cached per-org master. Use after a key rotation so the next
+     *  touch re-fetches the new wrapped master from the resolver. */
+    evict(orgId: string): void;
+}
+/**
+ * Encrypt a plaintext string for storage. Returns an `EncryptedBlob` that
+ * can be JSON-serialized into the underlying column / Mongo document.
+ *
+ * Empty strings round-trip as `null` so the calling model layer can treat
+ * "no secret set" identically to "field absent".
+ */
+export declare function encryptSecret(plaintext: string, orgId: string, provider?: KeyProvider): EncryptedBlob;
+/**
+ * Decrypt an `EncryptedBlob` written by `encryptSecret`. Throws on * - unknown `alg` (forces an explicit migration when the format changes)
+ * - wrong orgId (HKDF binding mismatch fails the auth tag)
+ * - tampered ciphertext (GCM auth tag check fails)
+ *
+ * Callers handle the throw  masking the failure as `null` would hide
+ * silent corruption / wrong-org reads.
+ */
+export declare function decryptSecret(blob: EncryptedBlob, orgId: string, provider?: KeyProvider): string;
+/**
+ * Type guard  handy for model layers that hold a column whose value may be
+ * either a clear-text string (legacy / unencrypted) OR an encrypted blob
+ * (post-migration). Mixed states arise mid-migration; the model decides
+ * what to do (decrypt on read, encrypt on next write).
+ */
+export declare function isEncryptedBlob(value: unknown): value is EncryptedBlob;

package/lib/utils/secret-encryption.js

@@ -0,0 +1,374 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ *  Per-org envelope encryption for secret columns.
+ *
+ * Today's posture for org-scoped secrets (aiProviderKeys, webhook URLs,
+ * registry credentials) is clear-text in Mongo / Postgres with app-layer
+ * masking on output. This module is the encryption primitive that lets the
+ * model layer swap clear-text strings for `EncryptedBlob` values at write
+ * time and decrypt at read time.
+ *
+ * Cryptography * - AES-256-GCM (authenticated encryption).
+ * - Per-org key derived via HKDF-SHA256(masterKey, salt=orgId, info='secrets-v1').
+ * Each org gets a unique key without operator key-management ceremony.
+ * - 12-byte IV generated per encryption with `crypto.randomBytes`.
+ * - 16-byte authentication tag concatenated with ciphertext (standard GCM).
+ *
+ * Operator configuration * - `SECRET_ENCRYPTION_KEY` env: hex- or base64-encoded 32-byte master key.
+ * Required when `encryptSecret`/`decryptSecret` are called. Missing key
+ * throws  encryption is fail-closed; we never silently round-trip a
+ * secret as plaintext.
+ *
+ * KMS migration path * - The two exported functions take a `provider` parameter. The default
+ * `EnvKeyProvider` implements HKDF derivation. A future `AwsKmsProvider`
+ * plugs in here: it can call KMS `Encrypt` / `Decrypt` to wrap a DEK
+ * rather than holding a master key in env. The on-disk blob shape
+ * (`{ alg, iv, ciphertext, kid? }`) is forward-compatible  `kid`
+ * carries the KMS key id when the provider needs it.
+ */
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from 'crypto';
+/**
+ * Default provider  derives a per-org key from `SECRET_ENCRYPTION_KEY` via
+ * HKDF-SHA256. Suitable for self-hosted / dev where operators don't have KMS.
+ *
+ * Fails fast if the env is missing or the key is the wrong length so misconfig
+ * surfaces at first use rather than silently fingerprinting all writes with
+ * a default zero key.
+ */
+export class EnvKeyProvider {
+    masterKey;
+    constructor(masterKeyOverride) {
+        const raw = masterKeyOverride ?? process.env.SECRET_ENCRYPTION_KEY;
+        if (!raw) {
+            throw new Error('SECRET_ENCRYPTION_KEY env is required for secret encryption');
+        }
+        // Accept either hex (64 chars) or base64 (44 chars including padding) for
+        // operator convenience  both decode to a 32-byte key.
+        const decoded = raw.length === 64 && /^[0-9a-f]+$/i.test(raw)
+            ? Buffer.from(raw, 'hex')
+            : Buffer.from(raw, 'base64');
+        if (decoded.length !== 32) {
+            throw new Error(`SECRET_ENCRYPTION_KEY must decode to 32 bytes (got ${decoded.length})`);
+        }
+        this.masterKey = decoded;
+    }
+    deriveKey(orgId) {
+        // HKDF binds the master key to the org so two orgs encrypting the same
+        // plaintext produce different ciphertexts  keeps a stolen DB unable to
+        // tell which orgs share secrets via ciphertext comparison.
+        const derived = hkdfSync('sha256', this.masterKey, Buffer.from(orgId, 'utf8'), 'secrets-v1', 32);
+        // hkdfSync returns ArrayBuffer in older Node typings; normalize to Buffer.
+        return Buffer.from(derived);
+    }
+}
+/**
+ *  AWS-KMS-backed KeyProvider.
+ *
+ * Trade-off picked: store ONE master key encrypted under a KMS CMK; on
+ * first use, call `kms:Decrypt` to recover the master key bytes; HKDF-
+ * derive per-org from it (same as EnvKeyProvider). The process then holds
+ * the plaintext master key in memory until restart.
+ *
+ * PROS: one KMS call per process lifetime (cheap, low p99 impact),
+ * the encrypted-master-key blob is safe to commit/log/checkin,
+ * KMS audit log records when the master is recovered.
+ * CONS: process memory still holds the master key  same posture as
+ * EnvKeyProvider once warmed up. For stronger isolation an
+ * operator can move to per-record envelope encryption (call
+ * GenerateDataKey on every write); that's a follow-on.
+ *
+ * Operator setup * 1. Create a KMS CMK with key policy allowing the platform service's
+ * IAM role kms:Decrypt.
+ * 2. Generate a random 32-byte master * head -c 32 /dev/urandom | base64
+ * 3. Wrap it with KMS * aws kms encrypt --key-id <KEY_ID> \
+ * --plaintext <base64-from-step-2> --output text \
+ * --query CiphertextBlob
+ * 4. Set on the service * SECRET_ENCRYPTION_KMS_KEY_ID=<KEY_ID>
+ * SECRET_ENCRYPTION_KMS_CIPHERTEXT=<base64-output-of-step-3>
+ * 5. Pick this provider via `setKeyProvider(new KmsKeyProvider())`.
+ *
+ * Construct lazily  importing the AWS SDK has a non-trivial cold-start
+ * cost so envs that stay on EnvKeyProvider never load it.
+ */
+/**
+ * KMS-decrypt a base64 ciphertext into a 32-byte key. Shared by both KMS key
+ * providers (single-master + per-org), which previously copy-pasted this
+ * dynamic-import + Decrypt + empty/length guards. `@aws-sdk/client-kms` is
+ * dynamically imported so EnvKeyProvider-only envs never load the SDK.
+ */
+async function kmsDecrypt32(keyId, ciphertextB64, region, endpoint) {
+    const { KMSClient, DecryptCommand } = await import('@aws-sdk/client-kms');
+    const client = new KMSClient({ region, ...(endpoint ? { endpoint } : {}) });
+    const resp = await client.send(new DecryptCommand({
+        KeyId: keyId,
+        CiphertextBlob: Buffer.from(ciphertextB64, 'base64'),
+    }));
+    if (!resp.Plaintext)
+        throw new Error(`KMS Decrypt returned an empty Plaintext for key ${keyId}`);
+    const buf = Buffer.from(resp.Plaintext);
+    if (buf.length !== 32)
+        throw new Error(`KMS Decrypt returned ${buf.length}-byte key for ${keyId}; expected 32`);
+    return buf;
+}
+export class KmsKeyProvider {
+    masterKeyCache = null;
+    keyId;
+    ciphertextB64;
+    region;
+    endpoint;
+    decryptInFlight = null;
+    constructor(opts) {
+        const keyId = opts?.keyId ?? process.env.SECRET_ENCRYPTION_KMS_KEY_ID;
+        const ciphertext = opts?.ciphertextBase64 ?? process.env.SECRET_ENCRYPTION_KMS_CIPHERTEXT;
+        if (!keyId)
+            throw new Error('SECRET_ENCRYPTION_KMS_KEY_ID env is required for KmsKeyProvider');
+        if (!ciphertext)
+            throw new Error('SECRET_ENCRYPTION_KMS_CIPHERTEXT env is required for KmsKeyProvider');
+        this.keyId = keyId;
+        this.ciphertextB64 = ciphertext;
+        this.region = opts?.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+        this.endpoint = opts?.endpoint ?? process.env.AWS_KMS_ENDPOINT;
+    }
+    deriveKey(orgId) {
+        if (!this.masterKeyCache) {
+            throw new Error('KmsKeyProvider is not warmed up. Call `await provider.warmup()` once at service startup before any encrypt/decrypt.');
+        }
+        const derived = hkdfSync('sha256', this.masterKeyCache, Buffer.from(orgId, 'utf8'), 'secrets-v1', 32);
+        return Buffer.from(derived);
+    }
+    /**
+     * Eagerly recover the master key from KMS so subsequent `deriveKey`
+     * calls are sync. Idempotent  concurrent callers share the same in-
+     * flight promise so we don't spawn multiple KMS Decrypt requests at
+     * boot. Throws on any KMS failure; the caller (typically the service's
+     * onBeforeStart hook) decides whether to fall back to a different
+     * provider or fail-startup.
+     */
+    async warmup() {
+        if (this.masterKeyCache)
+            return;
+        if (!this.decryptInFlight) {
+            this.decryptInFlight = this.fetchAndDecrypt();
+        }
+        try {
+            this.masterKeyCache = await this.decryptInFlight;
+        }
+        catch (err) {
+            // A transient KMS failure must not permanently poison the provider: clear
+            // the rejected in-flight promise so a later warmup() retries instead of
+            // re-awaiting the same rejection forever (matches PerOrgKmsKeyProvider).
+            this.decryptInFlight = null;
+            throw err;
+        }
+    }
+    fetchAndDecrypt() {
+        return kmsDecrypt32(this.keyId, this.ciphertextB64, this.region, this.endpoint);
+    }
+}
+// Lazy singleton  operator code in long-lived services pays the env-parse
+// cost once, and tests can mint their own provider with a literal key.
+let defaultProvider = null;
+function getDefaultProvider() {
+    if (!defaultProvider)
+        defaultProvider = new EnvKeyProvider();
+    return defaultProvider;
+}
+/** Read the active default provider. Exposed so service code (e.g. an
+ *  admin endpoint that just rotated an org's KMS config) can call
+ *  `provider.evict(orgId)` on the live provider rather than reconstructing
+ *  one. Triggers lazy initialization on first access, same as the internal
+ *  callers below. */
+export function getDefaultKeyProvider() {
+    return getDefaultProvider();
+}
+/** Reset the cached default provider  for tests that mutate `process.env`. */
+export function resetDefaultKeyProvider() { defaultProvider = null; }
+/** Replace the default provider  services that opt into KMS call this
+ * once at startup with a warmed-up `KmsKeyProvider`. */
+export function setKeyProvider(provider) { defaultProvider = provider; }
+/**
+ * Per-org KMS-backed KeyProvider. The blast radius of a KMS key compromise
+ * is one org instead of every org under a shared master.
+ *
+ * Each org has its own KMS CMK + its own wrapped master (stored in Mongo
+ * via the operator's setup script). On first encrypt/decrypt for an org,
+ * the provider:
+ *   1. Calls the resolver to fetch the org's KMS config.
+ *   2. Calls `kms:Decrypt` to recover the 32-byte master.
+ *   3. Caches the recovered master in-memory for the process lifetime.
+ *   4. HKDF-derives per-call from that master + the org id salt.
+ *
+ * Blobs encrypted by this provider carry `kid = <kms-key-id>` so the
+ * decrypt path detects a stale config (operator rotated the key but
+ * existing rows weren't re-encrypted) BEFORE AES-GCM throws an opaque
+ * authentication-tag error.
+ *
+ * Orgs without per-org config fall through to the `fallback` provider —
+ * mixed-mode deployments where some orgs have KMS isolation and others
+ * stay on the shared master are explicitly supported.
+ */
+export class PerOrgKmsKeyProvider {
+    /** Cached per-org master keys, keyed by orgId. */
+    masters = new Map();
+    /** Resolved per-org configs cached for the process lifetime. */
+    configs = new Map();
+    /** In-flight resolver promises so concurrent first-touch callers share one KMS Decrypt.
+     *  Resolves to `null` for orgs with no per-org config — caller treats null as
+     *  "fall through to the fallback provider", same as a cold cache miss. */
+    inFlight = new Map();
+    /** Provider used for orgs that have no per-org config. */
+    fallback;
+    resolver;
+    region;
+    endpoint;
+    constructor(opts) {
+        this.resolver = opts.resolver;
+        this.fallback = opts.fallback;
+        this.region = opts.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+        this.endpoint = opts.endpoint ?? process.env.AWS_KMS_ENDPOINT;
+    }
+    /** Sync `deriveKey` only works for already-warmed orgs. Cold orgs fall
+     *  through to the fallback provider. Callers that want per-org isolation
+     *  MUST `await deriveKeyAsync(orgId)` once first (e.g. during request setup
+     *  or as part of a warmup pass) — otherwise the org silently uses the
+     *  shared master. */
+    deriveKey(orgId) {
+        const cached = this.masters.get(orgId);
+        if (!cached)
+            return this.fallback.deriveKey(orgId);
+        const derived = hkdfSync('sha256', cached.key, Buffer.from(orgId, 'utf8'), 'secrets-v1', 32);
+        return Buffer.from(derived);
+    }
+    async deriveKeyAsync(orgId) {
+        await this.ensureWarmed(orgId);
+        return this.deriveKey(orgId);
+    }
+    kidFor(orgId) {
+        return this.masters.get(orgId)?.kid ?? this.fallback.kidFor?.(orgId);
+    }
+    /**
+     * Resolve the org's KMS config, call Decrypt, cache the master. Subsequent
+     * calls for the same org are no-ops. Concurrent callers share the in-flight
+     * Decrypt promise.
+     *
+     * Returns silently when the org has no per-org config — the fallback
+     * provider handles those orgs.
+     */
+    async ensureWarmed(orgId) {
+        if (this.masters.has(orgId))
+            return;
+        // Install the in-flight promise SYNCHRONOUSLY before yielding so concurrent
+        // callers find it on the second-and-later passes. Awaiting the resolver
+        // before populating the map is the bug that lets a Promise.all of 3
+        // callers fire 3 KMS Decrypts.
+        let promise = this.inFlight.get(orgId);
+        if (!promise) {
+            promise = this.resolveAndDecrypt(orgId);
+            this.inFlight.set(orgId, promise);
+            void promise.finally(() => { if (this.inFlight.get(orgId) === promise)
+                this.inFlight.delete(orgId); });
+        }
+        const result = await promise;
+        if (result)
+            this.masters.set(orgId, result);
+    }
+    async resolveAndDecrypt(orgId) {
+        let cfg = this.configs.get(orgId);
+        if (!cfg) {
+            const resolved = await this.resolver(orgId);
+            if (!resolved)
+                return null; // no per-org config → caller uses fallback
+            cfg = resolved;
+            this.configs.set(orgId, cfg);
+        }
+        const key = await this.fetchAndDecrypt(cfg);
+        return { key, kid: cfg.keyId };
+    }
+    fetchAndDecrypt(cfg) {
+        return kmsDecrypt32(cfg.keyId, cfg.ciphertextBase64, this.region, this.endpoint);
+    }
+    /** Evict a cached per-org master. Use after a key rotation so the next
+     *  touch re-fetches the new wrapped master from the resolver. */
+    evict(orgId) {
+        this.masters.delete(orgId);
+        this.configs.delete(orgId);
+    }
+}
+/**
+ * Encrypt a plaintext string for storage. Returns an `EncryptedBlob` that
+ * can be JSON-serialized into the underlying column / Mongo document.
+ *
+ * Empty strings round-trip as `null` so the calling model layer can treat
+ * "no secret set" identically to "field absent".
+ */
+export function encryptSecret(plaintext, orgId, provider = getDefaultProvider()) {
+    if (!plaintext) {
+        throw new Error('Refusing to encrypt empty string; caller should store null instead');
+    }
+    const key = provider.deriveKey(orgId);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const enc = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    // PerOrgKmsKeyProvider tags blobs with the KMS key id used so the
+    // decrypt path can refuse to operate if the operator later swaps in a
+    // different per-org config (a misconfigured swap shouldn't silently
+    // accept a stale blob it can't verify against the right CMK).
+    const kid = provider.kidFor?.(orgId);
+    return {
+        alg: 'aes-256-gcm-v1',
+        iv: iv.toString('base64'),
+        // GCM tag MUST travel with the ciphertext or `decryptSecret` can't
+        // verify integrity  concatenate so the on-disk shape is one field.
+        ciphertext: Buffer.concat([enc, tag]).toString('base64'),
+        ...(kid !== undefined ? { kid } : {}),
+    };
+}
+/**
+ * Decrypt an `EncryptedBlob` written by `encryptSecret`. Throws on * - unknown `alg` (forces an explicit migration when the format changes)
+ * - wrong orgId (HKDF binding mismatch fails the auth tag)
+ * - tampered ciphertext (GCM auth tag check fails)
+ *
+ * Callers handle the throw  masking the failure as `null` would hide
+ * silent corruption / wrong-org reads.
+ */
+export function decryptSecret(blob, orgId, provider = getDefaultProvider()) {
+    if (blob.alg !== 'aes-256-gcm-v1') {
+        throw new Error(`Unsupported encryption alg: ${blob.alg}`);
+    }
+    // If both the provider AND the blob report a kid, they must match.
+    // Mismatch usually means an operator rotated/replaced an org's KMS
+    // config and is now reading a blob encrypted under the OLD key —
+    // failing loud here beats letting AES-GCM throw an opaque auth-tag error.
+    const providerKid = provider.kidFor?.(orgId);
+    if (providerKid !== undefined && blob.kid !== undefined && providerKid !== blob.kid) {
+        throw new Error(`KMS key id mismatch: blob was encrypted under ${blob.kid}, current provider uses ${providerKid} for org ${orgId}`);
+    }
+    const key = provider.deriveKey(orgId);
+    const iv = Buffer.from(blob.iv, 'base64');
+    const all = Buffer.from(blob.ciphertext, 'base64');
+    // Split off the 16-byte auth tag appended in encryptSecret. Any tampering
+    //  to either the ciphertext OR the tag  causes the next `final()` to
+    // throw with "Unsupported state or unable to authenticate data".
+    const tag = all.subarray(all.length - 16);
+    const enc = all.subarray(0, all.length - 16);
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const dec = Buffer.concat([decipher.update(enc), decipher.final()]);
+    return dec.toString('utf8');
+}
+/**
+ * Type guard  handy for model layers that hold a column whose value may be
+ * either a clear-text string (legacy / unencrypted) OR an encrypted blob
+ * (post-migration). Mixed states arise mid-migration; the model decides
+ * what to do (decrypt on read, encrypt on next write).
+ */
+export function isEncryptedBlob(value) {
+    return (typeof value === 'object'
+        && value !== null
+        && value.alg === 'aes-256-gcm-v1'
+        && typeof value.iv === 'string'
+        && typeof value.ciphertext === 'string');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LWVuY3J5cHRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvc2VjcmV0LWVuY3J5cHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0EwQkc7QUFFSCxPQUFPLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsTUFBTSxRQUFRLENBQUM7QUE2QmpGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLE9BQU8sY0FBYztJQUNSLFNBQVMsQ0FBUztJQUVuQyxZQUFZLGlCQUEwQjtRQUNwQyxNQUFNLEdBQUcsR0FBRyxpQkFBaUIsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLHFCQUFxQixDQUFDO1FBQ25FLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUNqRixDQUFDO1FBQ0QsMEVBQTBFO1FBQzFFLHNEQUFzRDtRQUN0RCxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsTUFBTSxLQUFLLEVBQUUsSUFBSSxjQUFjLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztZQUMzRCxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDO1lBQ3pCLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUMvQixJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7UUFDM0YsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDO0lBQzNCLENBQUM7SUFFRCxTQUFTLENBQUMsS0FBYTtRQUNyQix1RUFBdUU7UUFDdkUsdUVBQXVFO1FBQ3ZFLDJEQUEyRDtRQUMzRCxNQUFNLE9BQU8sR0FBRyxRQUFRLENBQUUsUUFBUSxFQUNoQyxJQUFJLENBQUMsU0FBUyxFQUNkLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxFQUMxQixZQUFZLEVBQ1osRUFBRSxDQUNILENBQUM7UUFDRiwyRUFBMkU7UUFDM0UsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlCLENBQUM7Q0FDRjtBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBNEJHO0FBQ0g7Ozs7O0dBS0c7QUFDSCxLQUFLLFVBQVUsWUFBWSxDQUFDLEtBQWEsRUFBRSxhQUFxQixFQUFFLE1BQWUsRUFBRSxRQUFpQjtJQUNsRyxNQUFNLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDMUUsTUFBTSxNQUFNLEdBQUcsSUFBSSxTQUFTLENBQUMsRUFBRSxNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sSUFBSSxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLGNBQWMsQ0FBQztRQUNoRCxLQUFLLEVBQUUsS0FBSztRQUNaLGNBQWMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxRQUFRLENBQUM7S0FDckQsQ0FBQyxDQUFDLENBQUM7SUFDSixJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2pHLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3hDLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxFQUFFO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsR0FBRyxDQUFDLE1BQU0saUJBQWlCLEtBQUssZUFBZSxDQUFDLENBQUM7SUFDaEgsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDO0FBRUQsTUFBTSxPQUFPLGNBQWM7SUFDakIsY0FBYyxHQUFrQixJQUFJLENBQUM7SUFDNUIsS0FBSyxDQUFTO0lBQ2QsYUFBYSxDQUFTO0lBQ3RCLE1BQU0sQ0FBVTtJQUNoQixRQUFRLENBQVU7SUFDM0IsZUFBZSxHQUEyQixJQUFJLENBQUM7SUFFdkQsWUFBWSxJQUF3RjtRQUNsRyxNQUFNLEtBQUssR0FBRyxJQUFJLEVBQUUsS0FBSyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsNEJBQTRCLENBQUM7UUFDdEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxFQUFFLGdCQUFnQixJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0NBQWdDLENBQUM7UUFDMUYsSUFBSSxDQUFDLEtBQUs7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7UUFDL0YsSUFBSSxDQUFDLFVBQVU7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDeEcsSUFBSSxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDbkIsSUFBSSxDQUFDLGFBQWEsR0FBRyxVQUFVLENBQUM7UUFDaEMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsTUFBTSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUM7UUFDdkYsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLEVBQUUsUUFBUSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUM7SUFDakUsQ0FBQztJQUVELFNBQVMsQ0FBQyxLQUFhO1FBQ3JCLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDekIsTUFBTSxJQUFJLEtBQUssQ0FBRSxxSEFBcUgsQ0FDckksQ0FBQztRQUNKLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxRQUFRLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsWUFBWSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3RHLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNILEtBQUssQ0FBQyxNQUFNO1FBQ1YsSUFBSSxJQUFJLENBQUMsY0FBYztZQUFFLE9BQU87UUFDaEMsSUFBSSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNoRCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLGNBQWMsR0FBRyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDbkQsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYiwwRUFBMEU7WUFDMUUsd0VBQXdFO1lBQ3hFLHlFQUF5RTtZQUN6RSxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQztZQUM1QixNQUFNLEdBQUcsQ0FBQztRQUNaLENBQUM7SUFDSCxDQUFDO0lBRU8sZUFBZTtRQUNyQixPQUFPLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxhQUFhLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEYsQ0FBQztDQUNGO0FBRUQsMEVBQTBFO0FBQzFFLHVFQUF1RTtBQUN2RSxJQUFJLGVBQWUsR0FBdUIsSUFBSSxDQUFDO0FBQy9DLFNBQVMsa0JBQWtCO0lBQ3pCLElBQUksQ0FBQyxlQUFlO1FBQUUsZUFBZSxHQUFHLElBQUksY0FBYyxFQUFFLENBQUM7SUFDN0QsT0FBTyxlQUFlLENBQUM7QUFDekIsQ0FBQztBQUVEOzs7O3FCQUlxQjtBQUNyQixNQUFNLFVBQVUscUJBQXFCO0lBQ25DLE9BQU8sa0JBQWtCLEVBQUUsQ0FBQztBQUM5QixDQUFDO0FBRUQsOEVBQThFO0FBQzlFLE1BQU0sVUFBVSx1QkFBdUIsS0FBVyxlQUFlLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUUzRTt3REFDd0Q7QUFDeEQsTUFBTSxVQUFVLGNBQWMsQ0FBQyxRQUFxQixJQUFVLGVBQWUsR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDO0FBa0IzRjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FvQkc7QUFDSCxNQUFNLE9BQU8sb0JBQW9CO0lBQy9CLGtEQUFrRDtJQUNqQyxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQXdDLENBQUM7SUFDM0UsZ0VBQWdFO0lBQy9DLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBMkIsQ0FBQztJQUM5RDs7OEVBRTBFO0lBQ3pELFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBd0QsQ0FBQztJQUM1RiwwREFBMEQ7SUFDekMsUUFBUSxDQUFjO0lBQ3RCLFFBQVEsQ0FBb0I7SUFDNUIsTUFBTSxDQUFVO0lBQ2hCLFFBQVEsQ0FBVTtJQUVuQyxZQUFZLElBS1g7UUFDQyxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDOUIsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDO1FBQzlCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFDO1FBQ3RGLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO0lBQ2hFLENBQUM7SUFFRDs7Ozt5QkFJcUI7SUFDckIsU0FBUyxDQUFDLEtBQWE7UUFDckIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkMsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25ELE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsRUFBRSxZQUFZLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDN0YsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFRCxLQUFLLENBQUMsY0FBYyxDQUFDLEtBQWE7UUFDaEMsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQy9CLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUMvQixDQUFDO0lBRUQsTUFBTSxDQUFDLEtBQWE7UUFDbEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxHQUFHLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNILEtBQUssQ0FBQyxZQUFZLENBQUMsS0FBYTtRQUM5QixJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztZQUFFLE9BQU87UUFDcEMsNEVBQTRFO1FBQzVFLHdFQUF3RTtRQUN4RSxvRUFBb0U7UUFDcEUsK0JBQStCO1FBQy9CLElBQUksT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE9BQU8sR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDeEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQ2xDLEtBQUssT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxLQUFLLE9BQU87Z0JBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RyxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUM7UUFDN0IsSUFBSSxNQUFNO1lBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFTyxLQUFLLENBQUMsaUJBQWlCLENBQUMsS0FBYTtRQUMzQyxJQUFJLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDVCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDNUMsSUFBSSxDQUFDLFFBQVE7Z0JBQUUsT0FBTyxJQUFJLENBQUMsQ0FBQywyQ0FBMkM7WUFDdkUsR0FBRyxHQUFHLFFBQVEsQ0FBQztZQUNmLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsQ0FBQztRQUMvQixDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzVDLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUNqQyxDQUFDO0lBRU8sZUFBZSxDQUFDLEdBQW9CO1FBQzFDLE9BQU8sWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLGdCQUFnQixFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFRDtxRUFDaUU7SUFDakUsS0FBSyxDQUFDLEtBQWE7UUFDakIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLGFBQWEsQ0FBRSxTQUFpQixFQUM5QyxLQUFhLEVBQ2IsUUFBUSxHQUFnQixrQkFBa0IsRUFBRTtJQUU1QyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDZixNQUFNLElBQUksS0FBSyxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDdEMsTUFBTSxFQUFFLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzNCLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxhQUFhLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3RELE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUNoQyxrRUFBa0U7SUFDbEUsc0VBQXNFO0lBQ3RFLG9FQUFvRTtJQUNwRSw4REFBOEQ7SUFDOUQsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3JDLE9BQU87UUFDTCxHQUFHLEVBQUUsZ0JBQWdCO1FBQ3JCLEVBQUUsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUN6QixtRUFBbUU7UUFDbkUsbUVBQW1FO1FBQ25FLFVBQVUsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUN4RCxHQUFHLENBQUMsR0FBRyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0tBQ3RDLENBQUM7QUFDSixDQUFDO0FBRUQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sVUFBVSxhQUFhLENBQUUsSUFBbUIsRUFDaEQsS0FBYSxFQUNiLFFBQVEsR0FBZ0Isa0JBQWtCLEVBQUU7SUFFNUMsSUFBSSxJQUFJLENBQUMsR0FBRyxLQUFLLGdCQUFnQixFQUFFLENBQUM7UUFDbEMsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELG1FQUFtRTtJQUNuRSxtRUFBbUU7SUFDbkUsaUVBQWlFO0lBQ2pFLDBFQUEwRTtJQUMxRSxNQUFNLFdBQVcsR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDN0MsSUFBSSxXQUFXLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLFdBQVcsS0FBSyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDcEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsSUFBSSxDQUFDLEdBQUcsMkJBQTJCLFdBQVcsWUFBWSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3RJLENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxRQUFRLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUMxQyxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDbkQsMEVBQTBFO0lBQzFFLHFFQUFxRTtJQUNyRSxpRUFBaUU7SUFDakUsTUFBTSxHQUFHLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzFDLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxNQUFNLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDN0MsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsYUFBYSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMxRCxRQUFRLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3pCLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDcEUsT0FBTyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQzlCLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxlQUFlLENBQUMsS0FBYztJQUM1QyxPQUFPLENBQUUsT0FBTyxLQUFLLEtBQUssUUFBUTtXQUM3QixLQUFLLEtBQUssSUFBSTtXQUNiLEtBQTJCLENBQUMsR0FBRyxLQUFLLGdCQUFnQjtXQUNyRCxPQUFRLEtBQTBCLENBQUMsRUFBRSxLQUFLLFFBQVE7V0FDbEQsT0FBUSxLQUFrQyxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQ3RFLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogIFBlci1vcmcgZW52ZWxvcGUgZW5jcnlwdGlvbiBmb3Igc2VjcmV0IGNvbHVtbnMuXG4gKlxuICogVG9kYXkncyBwb3N0dXJlIGZvciBvcmctc2NvcGVkIHNlY3JldHMgKGFpUHJvdmlkZXJLZXlzLCB3ZWJob29rIFVSTHMsXG4gKiByZWdpc3RyeSBjcmVkZW50aWFscykgaXMgY2xlYXItdGV4dCBpbiBNb25nbyAvIFBvc3RncmVzIHdpdGggYXBwLWxheWVyXG4gKiBtYXNraW5nIG9uIG91dHB1dC4gVGhpcyBtb2R1bGUgaXMgdGhlIGVuY3J5cHRpb24gcHJpbWl0aXZlIHRoYXQgbGV0cyB0aGVcbiAqIG1vZGVsIGxheWVyIHN3YXAgY2xlYXItdGV4dCBzdHJpbmdzIGZvciBgRW5jcnlwdGVkQmxvYmAgdmFsdWVzIGF0IHdyaXRlXG4gKiB0aW1lIGFuZCBkZWNyeXB0IGF0IHJlYWQgdGltZS5cbiAqXG4gKiBDcnlwdG9ncmFwaHkgKiAtIEFFUy0yNTYtR0NNIChhdXRoZW50aWNhdGVkIGVuY3J5cHRpb24pLlxuICogLSBQZXItb3JnIGtleSBkZXJpdmVkIHZpYSBIS0RGLVNIQTI1NihtYXN0ZXJLZXksIHNhbHQ9b3JnSWQsIGluZm89J3NlY3JldHMtdjEnKS5cbiAqIEVhY2ggb3JnIGdldHMgYSB1bmlxdWUga2V5IHdpdGhvdXQgb3BlcmF0b3Iga2V5LW1hbmFnZW1lbnQgY2VyZW1vbnkuXG4gKiAtIDEyLWJ5dGUgSVYgZ2VuZXJhdGVkIHBlciBlbmNyeXB0aW9uIHdpdGggYGNyeXB0by5yYW5kb21CeXRlc2AuXG4gKiAtIDE2LWJ5dGUgYXV0aGVudGljYXRpb24gdGFnIGNvbmNhdGVuYXRlZCB3aXRoIGNpcGhlcnRleHQgKHN0YW5kYXJkIEdDTSkuXG4gKlxuICogT3BlcmF0b3IgY29uZmlndXJhdGlvbiAqIC0gYFNFQ1JFVF9FTkNSWVBUSU9OX0tFWWAgZW52OiBoZXgtIG9yIGJhc2U2NC1lbmNvZGVkIDMyLWJ5dGUgbWFzdGVyIGtleS5cbiAqIFJlcXVpcmVkIHdoZW4gYGVuY3J5cHRTZWNyZXRgL2BkZWNyeXB0U2VjcmV0YCBhcmUgY2FsbGVkLiBNaXNzaW5nIGtleVxuICogdGhyb3dzICBlbmNyeXB0aW9uIGlzIGZhaWwtY2xvc2VkOyB3ZSBuZXZlciBzaWxlbnRseSByb3VuZC10cmlwIGFcbiAqIHNlY3JldCBhcyBwbGFpbnRleHQuXG4gKlxuICogS01TIG1pZ3JhdGlvbiBwYXRoICogLSBUaGUgdHdvIGV4cG9ydGVkIGZ1bmN0aW9ucyB0YWtlIGEgYHByb3ZpZGVyYCBwYXJhbWV0ZXIuIFRoZSBkZWZhdWx0XG4gKiBgRW52S2V5UHJvdmlkZXJgIGltcGxlbWVudHMgSEtERiBkZXJpdmF0aW9uLiBBIGZ1dHVyZSBgQXdzS21zUHJvdmlkZXJgXG4gKiBwbHVncyBpbiBoZXJlOiBpdCBjYW4gY2FsbCBLTVMgYEVuY3J5cHRgIC8gYERlY3J5cHRgIHRvIHdyYXAgYSBERUtcbiAqIHJhdGhlciB0aGFuIGhvbGRpbmcgYSBtYXN0ZXIga2V5IGluIGVudi4gVGhlIG9uLWRpc2sgYmxvYiBzaGFwZVxuICogKGB7IGFsZywgaXYsIGNpcGhlcnRleHQsIGtpZD8gfWApIGlzIGZvcndhcmQtY29tcGF0aWJsZSAgYGtpZGBcbiAqIGNhcnJpZXMgdGhlIEtNUyBrZXkgaWQgd2hlbiB0aGUgcHJvdmlkZXIgbmVlZHMgaXQuXG4gKi9cblxuaW1wb3J0IHsgY3JlYXRlQ2lwaGVyaXYsIGNyZWF0ZURlY2lwaGVyaXYsIGhrZGZTeW5jLCByYW5kb21CeXRlcyB9IGZyb20gJ2NyeXB0byc7XG5cbi8qKiBPbi1kaXNrIHNoYXBlIG9mIGFuIGVuY3J5cHRlZCBzZWNyZXQuIEpTT04tc2VyaWFsaXphYmxlLiAqL1xuZXhwb3J0IGludGVyZmFjZSBFbmNyeXB0ZWRCbG9iIHtcbiAgLyoqIEFsZ29yaXRobSB0YWcuIEJ1bXAgb24gZm9ybWF0IGNoYW5nZSBzbyBhIGZ1dHVyZSBtaWdyYXRpb24gY2FuIGRldGVjdCBvbGQgYmxvYnMuICovXG4gIGFsZzogJ2Flcy0yNTYtZ2NtLXYxJztcbiAgLyoqIEJhc2U2NC1lbmNvZGVkIDEyLWJ5dGUgSVYuICovXG4gIGl2OiBzdHJpbmc7XG4gIC8qKiBCYXNlNjQtZW5jb2RlZCBjaXBoZXJ0ZXh0ICsgMTYtYnl0ZSBhdXRoZW50aWNhdGlvbiB0YWcgY29uY2F0ZW5hdGVkLiAqL1xuICBjaXBoZXJ0ZXh0OiBzdHJpbmc7XG4gIC8qKiBPcHRpb25hbCBrZXkgaWQgIHBvcHVsYXRlZCBieSBLTVMtYmFja2VkIHByb3ZpZGVycywgaWdub3JlZCBieSB0aGUgZW52IHByb3ZpZGVyLiAqL1xuICBraWQ/OiBzdHJpbmc7XG59XG5cbi8qKiBQbHVnZ2FibGUga2V5IHNvdXJjZS4gRW52LWJhY2tlZCBieSBkZWZhdWx0OyBLTVMtYmFja2VkIGF2YWlsYWJsZS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgS2V5UHJvdmlkZXIge1xuICAvKiogRGVyaXZlIGEgMzItYnl0ZSBzeW1tZXRyaWMga2V5IGJvdW5kIHRvIGBvcmdJZGAuICovXG4gIGRlcml2ZUtleShvcmdJZDogc3RyaW5nKTogQnVmZmVyO1xuICAvKiogT3B0aW9uYWwgYXN5bmMgdmFyaWFudCBmb3IgcHJvdmlkZXJzIHRoYXQgbmVlZCB0byBkbyBJL08gKGUuZy5cbiAgICogIHBlci1vcmcgS01TIGxvb2t1cCB0aGUgZmlyc3QgdGltZSBhbiBvcmcgaXMgc2VlbikuIERlZmF1bHRcbiAgICogIGltcGxlbWVudGF0aW9uIGZvcndhcmRzIHRvIHRoZSBzeW5jIGBkZXJpdmVLZXlgLiAqL1xuICBkZXJpdmVLZXlBc3luYz8ob3JnSWQ6IHN0cmluZyk6IFByb21pc2U8QnVmZmVyPjtcbiAgLyoqIE9wdGlvbmFsIEtNUy1rZXktaWQgdGhpcyBwcm92aWRlciB1c2VkIGZvciBgb3JnSWRgLiBFbWJlZGRlZCBpbiB0aGVcbiAgICogIGBFbmNyeXB0ZWRCbG9iLmtpZGAgZmllbGQgb24gd3JpdGUgc28gZGVjcnlwdCBjYW4gdmVyaWZ5IHRoZSByaWdodFxuICAgKiAgS01TIENNSyBpcyBiZWluZyB1c2VkIChkZWZlbnNlIGFnYWluc3QgYW4gYXR0YWNrZXIgd2hvIHN3YXBzIGEgYmxvYlxuICAgKiAgYmV0d2VlbiBvcmdzKS4gRGVmYXVsdCByZXR1cm5zIHVuZGVmaW5lZCAoZW52IHByb3ZpZGVyKS4gKi9cbiAga2lkRm9yPyhvcmdJZDogc3RyaW5nKTogc3RyaW5nIHwgdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIERlZmF1bHQgcHJvdmlkZXIgIGRlcml2ZXMgYSBwZXItb3JnIGtleSBmcm9tIGBTRUNSRVRfRU5DUllQVElPTl9LRVlgIHZpYVxuICogSEtERi1TSEEyNTYuIFN1aXRhYmxlIGZvciBzZWxmLWhvc3RlZCAvIGRldiB3aGVyZSBvcGVyYXRvcnMgZG9uJ3QgaGF2ZSBLTVMuXG4gKlxuICogRmFpbHMgZmFzdCBpZiB0aGUgZW52IGlzIG1pc3Npbmcgb3IgdGhlIGtleSBpcyB0aGUgd3JvbmcgbGVuZ3RoIHNvIG1pc2NvbmZpZ1xuICogc3VyZmFjZXMgYXQgZmlyc3QgdXNlIHJhdGhlciB0aGFuIHNpbGVudGx5IGZpbmdlcnByaW50aW5nIGFsbCB3cml0ZXMgd2l0aFxuICogYSBkZWZhdWx0IHplcm8ga2V5LlxuICovXG5leHBvcnQgY2xhc3MgRW52S2V5UHJvdmlkZXIgaW1wbGVtZW50cyBLZXlQcm92aWRlciB7XG4gIHByaXZhdGUgcmVhZG9ubHkgbWFzdGVyS2V5OiBCdWZmZXI7XG5cbiAgY29uc3RydWN0b3IobWFzdGVyS2V5T3ZlcnJpZGU/OiBzdHJpbmcpIHtcbiAgICBjb25zdCByYXcgPSBtYXN0ZXJLZXlPdmVycmlkZSA/PyBwcm9jZXNzLmVudi5TRUNSRVRfRU5DUllQVElPTl9LRVk7XG4gICAgaWYgKCFyYXcpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignU0VDUkVUX0VOQ1JZUFRJT05fS0VZIGVudiBpcyByZXF1aXJlZCBmb3Igc2VjcmV0IGVuY3J5cHRpb24nKTtcbiAgICB9XG4gICAgLy8gQWNjZXB0IGVpdGhlciBoZXggKDY0IGNoYXJzKSBvciBiYXNlNjQgKDQ0IGNoYXJzIGluY2x1ZGluZyBwYWRkaW5nKSBmb3JcbiAgICAvLyBvcGVyYXRvciBjb252ZW5pZW5jZSAgYm90aCBkZWNvZGUgdG8gYSAzMi1ieXRlIGtleS5cbiAgICBjb25zdCBkZWNvZGVkID0gcmF3Lmxlbmd0aCA9PT0gNjQgJiYgL15bMC05YS1mXSskL2kudGVzdChyYXcpXG4gICAgICA/IEJ1ZmZlci5mcm9tKHJhdywgJ2hleCcpXG4gICAgICA6IEJ1ZmZlci5mcm9tKHJhdywgJ2Jhc2U2NCcpO1xuICAgIGlmIChkZWNvZGVkLmxlbmd0aCAhPT0gMzIpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgU0VDUkVUX0VOQ1JZUFRJT05fS0VZIG11c3QgZGVjb2RlIHRvIDMyIGJ5dGVzIChnb3QgJHtkZWNvZGVkLmxlbmd0aH0pYCk7XG4gICAgfVxuICAgIHRoaXMubWFzdGVyS2V5ID0gZGVjb2RlZDtcbiAgfVxuXG4gIGRlcml2ZUtleShvcmdJZDogc3RyaW5nKTogQnVmZmVyIHtcbiAgICAvLyBIS0RGIGJpbmRzIHRoZSBtYXN0ZXIga2V5IHRvIHRoZSBvcmcgc28gdHdvIG9yZ3MgZW5jcnlwdGluZyB0aGUgc2FtZVxuICAgIC8vIHBsYWludGV4dCBwcm9kdWNlIGRpZmZlcmVudCBjaXBoZXJ0ZXh0cyAga2VlcHMgYSBzdG9sZW4gREIgdW5hYmxlIHRvXG4gICAgLy8gdGVsbCB3aGljaCBvcmdzIHNoYXJlIHNlY3JldHMgdmlhIGNpcGhlcnRleHQgY29tcGFyaXNvbi5cbiAgICBjb25zdCBkZXJpdmVkID0gaGtkZlN5bmMoICdzaGEyNTYnLFxuICAgICAgdGhpcy5tYXN0ZXJLZXksXG4gICAgICBCdWZmZXIuZnJvbShvcmdJZCwgJ3V0ZjgnKSxcbiAgICAgICdzZWNyZXRzLXYxJyxcbiAgICAgIDMyLFxuICAgICk7XG4gICAgLy8gaGtkZlN5bmMgcmV0dXJucyBBcnJheUJ1ZmZlciBpbiBvbGRlciBOb2RlIHR5cGluZ3M7IG5vcm1hbGl6ZSB0byBCdWZmZXIuXG4gICAgcmV0dXJuIEJ1ZmZlci5mcm9tKGRlcml2ZWQpO1xuICB9XG59XG5cbi8qKlxuICogIEFXUy1LTVMtYmFja2VkIEtleVByb3ZpZGVyLlxuICpcbiAqIFRyYWRlLW9mZiBwaWNrZWQ6IHN0b3JlIE9ORSBtYXN0ZXIga2V5IGVuY3J5cHRlZCB1bmRlciBhIEtNUyBDTUs7IG9uXG4gKiBmaXJzdCB1c2UsIGNhbGwgYGttczpEZWNyeXB0YCB0byByZWNvdmVyIHRoZSBtYXN0ZXIga2V5IGJ5dGVzOyBIS0RGLVxuICogZGVyaXZlIHBlci1vcmcgZnJvbSBpdCAoc2FtZSBhcyBFbnZLZXlQcm92aWRlcikuIFRoZSBwcm9jZXNzIHRoZW4gaG9sZHNcbiAqIHRoZSBwbGFpbnRleHQgbWFzdGVyIGtleSBpbiBtZW1vcnkgdW50aWwgcmVzdGFydC5cbiAqXG4gKiBQUk9TOiBvbmUgS01TIGNhbGwgcGVyIHByb2Nlc3MgbGlmZXRpbWUgKGNoZWFwLCBsb3cgcDk5IGltcGFjdCksXG4gKiB0aGUgZW5jcnlwdGVkLW1hc3Rlci1rZXkgYmxvYiBpcyBzYWZlIHRvIGNvbW1pdC9sb2cvY2hlY2tpbixcbiAqIEtNUyBhdWRpdCBsb2cgcmVjb3JkcyB3aGVuIHRoZSBtYXN0ZXIgaXMgcmVjb3ZlcmVkLlxuICogQ09OUzogcHJvY2VzcyBtZW1vcnkgc3RpbGwgaG9sZHMgdGhlIG1hc3RlciBrZXkgIHNhbWUgcG9zdHVyZSBhc1xuICogRW52S2V5UHJvdmlkZXIgb25jZSB3YXJtZWQgdXAuIEZvciBzdHJvbmdlciBpc29sYXRpb24gYW5cbiAqIG9wZXJhdG9yIGNhbiBtb3ZlIHRvIHBlci1yZWNvcmQgZW52ZWxvcGUgZW5jcnlwdGlvbiAoY2FsbFxuICogR2VuZXJhdGVEYXRhS2V5IG9uIGV2ZXJ5IHdyaXRlKTsgdGhhdCdzIGEgZm9sbG93LW9uLlxuICpcbiAqIE9wZXJhdG9yIHNldHVwICogMS4gQ3JlYXRlIGEgS01TIENNSyB3aXRoIGtleSBwb2xpY3kgYWxsb3dpbmcgdGhlIHBsYXRmb3JtIHNlcnZpY2Unc1xuICogSUFNIHJvbGUga21zOkRlY3J5cHQuXG4gKiAyLiBHZW5lcmF0ZSBhIHJhbmRvbSAzMi1ieXRlIG1hc3RlciAqIGhlYWQgLWMgMzIgL2Rldi91cmFuZG9tIHwgYmFzZTY0XG4gKiAzLiBXcmFwIGl0IHdpdGggS01TICogYXdzIGttcyBlbmNyeXB0IC0ta2V5LWlkIDxLRVlfSUQ+IFxcXG4gKiAtLXBsYWludGV4dCA8YmFzZTY0LWZyb20tc3RlcC0yPiAtLW91dHB1dCB0ZXh0IFxcXG4gKiAtLXF1ZXJ5IENpcGhlcnRleHRCbG9iXG4gKiA0LiBTZXQgb24gdGhlIHNlcnZpY2UgKiBTRUNSRVRfRU5DUllQVElPTl9LTVNfS0VZX0lEPTxLRVlfSUQ+XG4gKiBTRUNSRVRfRU5DUllQVElPTl9LTVNfQ0lQSEVSVEVYVD08YmFzZTY0LW91dHB1dC1vZi1zdGVwLTM+XG4gKiA1LiBQaWNrIHRoaXMgcHJvdmlkZXIgdmlhIGBzZXRLZXlQcm92aWRlcihuZXcgS21zS2V5UHJvdmlkZXIoKSlgLlxuICpcbiAqIENvbnN0cnVjdCBsYXppbHkgIGltcG9ydGluZyB0aGUgQVdTIFNESyBoYXMgYSBub24tdHJpdmlhbCBjb2xkLXN0YXJ0XG4gKiBjb3N0IHNvIGVudnMgdGhhdCBzdGF5IG9uIEVudktleVByb3ZpZGVyIG5ldmVyIGxvYWQgaXQuXG4gKi9cbi8qKlxuICogS01TLWRlY3J5cHQgYSBiYXNlNjQgY2lwaGVydGV4dCBpbnRvIGEgMzItYnl0ZSBrZXkuIFNoYXJlZCBieSBib3RoIEtNUyBrZXlcbiAqIHByb3ZpZGVycyAoc2luZ2xlLW1hc3RlciArIHBlci1vcmcpLCB3aGljaCBwcmV2aW91c2x5IGNvcHktcGFzdGVkIHRoaXNcbiAqIGR5bmFtaWMtaW1wb3J0ICsgRGVjcnlwdCArIGVtcHR5L2xlbmd0aCBndWFyZHMuIGBAYXdzLXNkay9jbGllbnQta21zYCBpc1xuICogZHluYW1pY2FsbHkgaW1wb3J0ZWQgc28gRW52S2V5UHJvdmlkZXItb25seSBlbnZzIG5ldmVyIGxvYWQgdGhlIFNESy5cbiAqL1xuYXN5bmMgZnVuY3Rpb24ga21zRGVjcnlwdDMyKGtleUlkOiBzdHJpbmcsIGNpcGhlcnRleHRCNjQ6IHN0cmluZywgcmVnaW9uPzogc3RyaW5nLCBlbmRwb2ludD86IHN0cmluZyk6IFByb21pc2U8QnVmZmVyPiB7XG4gIGNvbnN0IHsgS01TQ2xpZW50LCBEZWNyeXB0Q29tbWFuZCB9ID0gYXdhaXQgaW1wb3J0KCdAYXdzLXNkay9jbGllbnQta21zJyk7XG4gIGNvbnN0IGNsaWVudCA9IG5ldyBLTVNDbGllbnQoeyByZWdpb24sIC4uLihlbmRwb2ludCA/IHsgZW5kcG9pbnQgfSA6IHt9KSB9KTtcbiAgY29uc3QgcmVzcCA9IGF3YWl0IGNsaWVudC5zZW5kKG5ldyBEZWNyeXB0Q29tbWFuZCh7XG4gICAgS2V5SWQ6IGtleUlkLFxuICAgIENpcGhlcnRleHRCbG9iOiBCdWZmZXIuZnJvbShjaXBoZXJ0ZXh0QjY0LCAnYmFzZTY0JyksXG4gIH0pKTtcbiAgaWYgKCFyZXNwLlBsYWludGV4dCkgdGhyb3cgbmV3IEVycm9yKGBLTVMgRGVjcnlwdCByZXR1cm5lZCBhbiBlbXB0eSBQbGFpbnRleHQgZm9yIGtleSAke2tleUlkfWApO1xuICBjb25zdCBidWYgPSBCdWZmZXIuZnJvbShyZXNwLlBsYWludGV4dCk7XG4gIGlmIChidWYubGVuZ3RoICE9PSAzMikgdGhyb3cgbmV3IEVycm9yKGBLTVMgRGVjcnlwdCByZXR1cm5lZCAke2J1Zi5sZW5ndGh9LWJ5dGUga2V5IGZvciAke2tleUlkfTsgZXhwZWN0ZWQgMzJgKTtcbiAgcmV0dXJuIGJ1Zjtcbn1cblxuZXhwb3J0IGNsYXNzIEttc0tleVByb3ZpZGVyIGltcGxlbWVudHMgS2V5UHJvdmlkZXIge1xuICBwcml2YXRlIG1hc3RlcktleUNhY2hlOiBCdWZmZXIgfCBudWxsID0gbnVsbDtcbiAgcHJpdmF0ZSByZWFkb25seSBrZXlJZDogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IGNpcGhlcnRleHRCNjQ6IHN0cmluZztcbiAgcHJpdmF0ZSByZWFkb25seSByZWdpb24/OiBzdHJpbmc7XG4gIHByaXZhdGUgcmVhZG9ubHkgZW5kcG9pbnQ/OiBzdHJpbmc7XG4gIHByaXZhdGUgZGVjcnlwdEluRmxpZ2h0OiBQcm9taXNlPEJ1ZmZlcj4gfCBudWxsID0gbnVsbDtcblxuICBjb25zdHJ1Y3RvcihvcHRzPzogeyBrZXlJZD86IHN0cmluZzsgY2lwaGVydGV4dEJhc2U2ND86IHN0cmluZzsgcmVnaW9uPzogc3RyaW5nOyBlbmRwb2ludD86IHN0cmluZyB9KSB7XG4gICAgY29uc3Qga2V5SWQgPSBvcHRzPy5rZXlJZCA/PyBwcm9jZXNzLmVudi5TRUNSRVRfRU5DUllQVElPTl9LTVNfS0VZX0lEO1xuICAgIGNvbnN0IGNpcGhlcnRleHQgPSBvcHRzPy5jaXBoZXJ0ZXh0QmFzZTY0ID8/IHByb2Nlc3MuZW52LlNFQ1JFVF9FTkNSWVBUSU9OX0tNU19DSVBIRVJURVhUO1xuICAgIGlmICgha2V5SWQpIHRocm93IG5ldyBFcnJvcignU0VDUkVUX0VOQ1JZUFRJT05fS01TX0tFWV9JRCBlbnYgaXMgcmVxdWlyZWQgZm9yIEttc0tleVByb3ZpZGVyJyk7XG4gICAgaWYgKCFjaXBoZXJ0ZXh0KSB0aHJvdyBuZXcgRXJyb3IoJ1NFQ1JFVF9FTkNSWVBUSU9OX0tNU19DSVBIRVJURVhUIGVudiBpcyByZXF1aXJlZCBmb3IgS21zS2V5UHJvdmlkZXInKTtcbiAgICB0aGlzLmtleUlkID0ga2V5SWQ7XG4gICAgdGhpcy5jaXBoZXJ0ZXh0QjY0ID0gY2lwaGVydGV4dDtcbiAgICB0aGlzLnJlZ2lvbiA9IG9wdHM/LnJlZ2lvbiA/PyBwcm9jZXNzLmVudi5BV1NfUkVHSU9OID8/IHByb2Nlc3MuZW52LkFXU19ERUZBVUxUX1JFR0lPTjtcbiAgICB0aGlzLmVuZHBvaW50ID0gb3B0cz8uZW5kcG9pbnQgPz8gcHJvY2Vzcy5lbnYuQVdTX0tNU19FTkRQT0lOVDtcbiAgfVxuXG4gIGRlcml2ZUtleShvcmdJZDogc3RyaW5nKTogQnVmZmVyIHtcbiAgICBpZiAoIXRoaXMubWFzdGVyS2V5Q2FjaGUpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvciggJ0ttc0tleVByb3ZpZGVyIGlzIG5vdCB3YXJtZWQgdXAuIENhbGwgYGF3YWl0IHByb3ZpZGVyLndhcm11cCgpYCBvbmNlIGF0IHNlcnZpY2Ugc3RhcnR1cCBiZWZvcmUgYW55IGVuY3J5cHQvZGVjcnlwdC4nLFxuICAgICAgKTtcbiAgICB9XG4gICAgY29uc3QgZGVyaXZlZCA9IGhrZGZTeW5jKCdzaGEyNTYnLCB0aGlzLm1hc3RlcktleUNhY2hlLCBCdWZmZXIuZnJvbShvcmdJZCwgJ3V0ZjgnKSwgJ3NlY3JldHMtdjEnLCAzMik7XG4gICAgcmV0dXJuIEJ1ZmZlci5mcm9tKGRlcml2ZWQpO1xuICB9XG5cbiAgLyoqXG4gICAqIEVhZ2VybHkgcmVjb3ZlciB0aGUgbWFzdGVyIGtleSBmcm9tIEtNUyBzbyBzdWJzZXF1ZW50IGBkZXJpdmVLZXlgXG4gICAqIGNhbGxzIGFyZSBzeW5jLiBJZGVtcG90ZW50ICBjb25jdXJyZW50IGNhbGxlcnMgc2hhcmUgdGhlIHNhbWUgaW4tXG4gICAqIGZsaWdodCBwcm9taXNlIHNvIHdlIGRvbid0IHNwYXduIG11bHRpcGxlIEtNUyBEZWNyeXB0IHJlcXVlc3RzIGF0XG4gICAqIGJvb3QuIFRocm93cyBvbiBhbnkgS01TIGZhaWx1cmU7IHRoZSBjYWxsZXIgKHR5cGljYWxseSB0aGUgc2VydmljZSdzXG4gICAqIG9uQmVmb3JlU3RhcnQgaG9vaykgZGVjaWRlcyB3aGV0aGVyIHRvIGZhbGwgYmFjayB0byBhIGRpZmZlcmVudFxuICAgKiBwcm92aWRlciBvciBmYWlsLXN0YXJ0dXAuXG4gICAqL1xuICBhc3luYyB3YXJtdXAoKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgaWYgKHRoaXMubWFzdGVyS2V5Q2FjaGUpIHJldHVybjtcbiAgICBpZiAoIXRoaXMuZGVjcnlwdEluRmxpZ2h0KSB7XG4gICAgICB0aGlzLmRlY3J5cHRJbkZsaWdodCA9IHRoaXMuZmV0Y2hBbmREZWNyeXB0KCk7XG4gICAgfVxuICAgIHRyeSB7XG4gICAgICB0aGlzLm1hc3RlcktleUNhY2hlID0gYXdhaXQgdGhpcy5kZWNyeXB0SW5GbGlnaHQ7XG4gICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICAvLyBBIHRyYW5zaWVudCBLTVMgZmFpbHVyZSBtdXN0IG5vdCBwZXJtYW5lbnRseSBwb2lzb24gdGhlIHByb3ZpZGVyOiBjbGVhclxuICAgICAgLy8gdGhlIHJlamVjdGVkIGluLWZsaWdodCBwcm9taXNlIHNvIGEgbGF0ZXIgd2FybXVwKCkgcmV0cmllcyBpbnN0ZWFkIG9mXG4gICAgICAvLyByZS1hd2FpdGluZyB0aGUgc2FtZSByZWplY3Rpb24gZm9yZXZlciAobWF0Y2hlcyBQZXJPcmdLbXNLZXlQcm92aWRlcikuXG4gICAgICB0aGlzLmRlY3J5cHRJbkZsaWdodCA9IG51bGw7XG4gICAgICB0aHJvdyBlcnI7XG4gICAgfVxuICB9XG5cbiAgcHJpdmF0ZSBmZXRjaEFuZERlY3J5cHQoKTogUHJvbWlzZTxCdWZmZXI+IHtcbiAgICByZXR1cm4ga21zRGVjcnlwdDMyKHRoaXMua2V5SWQsIHRoaXMuY2lwaGVydGV4dEI2NCwgdGhpcy5yZWdpb24sIHRoaXMuZW5kcG9pbnQpO1xuICB9XG59XG5cbi8vIExhenkgc2luZ2xldG9uICBvcGVyYXRvciBjb2RlIGluIGxvbmctbGl2ZWQgc2VydmljZXMgcGF5cyB0aGUgZW52LXBhcnNlXG4vLyBjb3N0IG9uY2UsIGFuZCB0ZXN0cyBjYW4gbWludCB0aGVpciBvd24gcHJvdmlkZXIgd2l0aCBhIGxpdGVyYWwga2V5LlxubGV0IGRlZmF1bHRQcm92aWRlcjogS2V5UHJvdmlkZXIgfCBudWxsID0gbnVsbDtcbmZ1bmN0aW9uIGdldERlZmF1bHRQcm92aWRlcigpOiBLZXlQcm92aWRlciB7XG4gIGlmICghZGVmYXVsdFByb3ZpZGVyKSBkZWZhdWx0UHJvdmlkZXIgPSBuZXcgRW52S2V5UHJvdmlkZXIoKTtcbiAgcmV0dXJuIGRlZmF1bHRQcm92aWRlcjtcbn1cblxuLyoqIFJlYWQgdGhlIGFjdGl2ZSBkZWZhdWx0IHByb3ZpZGVyLiBFeHBvc2VkIHNvIHNlcnZpY2UgY29kZSAoZS5nLiBhblxuICogIGFkbWluIGVuZHBvaW50IHRoYXQganVzdCByb3RhdGVkIGFuIG9yZydzIEtNUyBjb25maWcpIGNhbiBjYWxsXG4gKiAgYHByb3ZpZGVyLmV2aWN0KG9yZ0lkKWAgb24gdGhlIGxpdmUgcHJvdmlkZXIgcmF0aGVyIHRoYW4gcmVjb25zdHJ1Y3RpbmdcbiAqICBvbmUuIFRyaWdnZXJzIGxhenkgaW5pdGlhbGl6YXRpb24gb24gZmlyc3QgYWNjZXNzLCBzYW1lIGFzIHRoZSBpbnRlcm5hbFxuICogIGNhbGxlcnMgYmVsb3cuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0RGVmYXVsdEtleVByb3ZpZGVyKCk6IEtleVByb3ZpZGVyIHtcbiAgcmV0dXJuIGdldERlZmF1bHRQcm92aWRlcigpO1xufVxuXG4vKiogUmVzZXQgdGhlIGNhY2hlZCBkZWZhdWx0IHByb3ZpZGVyICBmb3IgdGVzdHMgdGhhdCBtdXRhdGUgYHByb2Nlc3MuZW52YC4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNldERlZmF1bHRLZXlQcm92aWRlcigpOiB2b2lkIHsgZGVmYXVsdFByb3ZpZGVyID0gbnVsbDsgfVxuXG4vKiogUmVwbGFjZSB0aGUgZGVmYXVsdCBwcm92aWRlciAgc2VydmljZXMgdGhhdCBvcHQgaW50byBLTVMgY2FsbCB0aGlzXG4gKiBvbmNlIGF0IHN0YXJ0dXAgd2l0aCBhIHdhcm1lZC11cCBgS21zS2V5UHJvdmlkZXJgLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNldEtleVByb3ZpZGVyKHByb3ZpZGVyOiBLZXlQcm92aWRlcik6IHZvaWQgeyBkZWZhdWx0UHJvdmlkZXIgPSBwcm92aWRlcjsgfVxuXG4vKiogUGVyLW9yZyBLTVMgY29uZmlnIHRoZSBvcGVyYXRvciBzdXBwbGllcy4gVGhlIGBrZXlJZGAgaWRlbnRpZmllcyB0aGVcbiAqICBLTVMgQ01LIHRvIGNhbGwgRGVjcnlwdCBvbjsgYGNpcGhlcnRleHRCYXNlNjRgIGlzIHRoZSB3cmFwcGVkIDMyLWJ5dGVcbiAqICBtYXN0ZXIgZ2VuZXJhdGVkIGJ5IGBhd3Mga21zIGVuY3J5cHRgIGFnYWluc3QgdGhhdCBrZXkuICovXG5leHBvcnQgaW50ZXJmYWNlIFBlck9yZ0ttc0NvbmZpZyB7XG4gIGtleUlkOiBzdHJpbmc7XG4gIGNpcGhlcnRleHRCYXNlNjQ6IHN0cmluZztcbn1cblxuLyoqXG4gKiBBc3luYyByZXNvbHZlciB0aGF0IG1hcHMgYW4gb3JnIGlkIHRvIGl0cyBLTVMgY29uZmlnLiBSZXR1cm5zIGBudWxsYCB3aGVuXG4gKiB0aGUgb3JnIGhhcyBubyBwZXItb3JnIGNvbmZpZyDigJQgdGhlIHByb3ZpZGVyIHRoZW4gZmFsbHMgYmFjayB0byB0aGVcbiAqIGBmYWxsYmFja2AgcHJvdmlkZXIgc3VwcGxpZWQgYXQgY29uc3RydWN0aW9uICh1c3VhbGx5IGFuIEVudktleVByb3ZpZGVyXG4gKiBvciBhIGRlZmF1bHQgS21zS2V5UHJvdmlkZXIpLlxuICovXG5leHBvcnQgdHlwZSBQZXJPcmdLbXNSZXNvbHZlciA9IChvcmdJZDogc3RyaW5nKSA9PiBQcm9taXNlPFBlck9yZ0ttc0NvbmZpZyB8IG51bGw+O1xuXG4vKipcbiAqIFBlci1vcmcgS01TLWJhY2tlZCBLZXlQcm92aWRlci4gVGhlIGJsYXN0IHJhZGl1cyBvZiBhIEtNUyBrZXkgY29tcHJvbWlzZVxuICogaXMgb25lIG9yZyBpbnN0ZWFkIG9mIGV2ZXJ5IG9yZyB1bmRlciBhIHNoYXJlZCBtYXN0ZXIuXG4gKlxuICogRWFjaCBvcmcgaGFzIGl0cyBvd24gS01TIENNSyArIGl0cyBvd24gd3JhcHBlZCBtYXN0ZXIgKHN0b3JlZCBpbiBNb25nb1xuICogdmlhIHRoZSBvcGVyYXRvcidzIHNldHVwIHNjcmlwdCkuIE9uIGZpcnN0IGVuY3J5cHQvZGVjcnlwdCBmb3IgYW4gb3JnLFxuICogdGhlIHByb3ZpZGVyOlxuICogICAxLiBDYWxscyB0aGUgcmVzb2x2ZXIgdG8gZmV0Y2ggdGhlIG9yZydzIEtNUyBjb25maWcuXG4gKiAgIDIuIENhbGxzIGBrbXM6RGVjcnlwdGAgdG8gcmVjb3ZlciB0aGUgMzItYnl0ZSBtYXN0ZXIuXG4gKiAgIDMuIENhY2hlcyB0aGUgcmVjb3ZlcmVkIG1hc3RlciBpbi1tZW1vcnkgZm9yIHRoZSBwcm9jZXNzIGxpZmV0aW1lLlxuICogICA0LiBIS0RGLWRlcml2ZXMgcGVyLWNhbGwgZnJvbSB0aGF0IG1hc3RlciArIHRoZSBvcmcgaWQgc2FsdC5cbiAqXG4gKiBCbG9icyBlbmNyeXB0ZWQgYnkgdGhpcyBwcm92aWRlciBjYXJyeSBga2lkID0gPGttcy1rZXktaWQ+YCBzbyB0aGVcbiAqIGRlY3J5cHQgcGF0aCBkZXRlY3RzIGEgc3RhbGUgY29uZmlnIChvcGVyYXRvciByb3RhdGVkIHRoZSBrZXkgYnV0XG4gKiBleGlzdGluZyByb3dzIHdlcmVuJ3QgcmUtZW5jcnlwdGVkKSBCRUZPUkUgQUVTLUdDTSB0aHJvd3MgYW4gb3BhcXVlXG4gKiBhdXRoZW50aWNhdGlvbi10YWcgZXJyb3IuXG4gKlxuICogT3JncyB3aXRob3V0IHBlci1vcmcgY29uZmlnIGZhbGwgdGhyb3VnaCB0byB0aGUgYGZhbGxiYWNrYCBwcm92aWRlciDigJRcbiAqIG1peGVkLW1vZGUgZGVwbG95bWVudHMgd2hlcmUgc29tZSBvcmdzIGhhdmUgS01TIGlzb2xhdGlvbiBhbmQgb3RoZXJzXG4gKiBzdGF5IG9uIHRoZSBzaGFyZWQgbWFzdGVyIGFyZSBleHBsaWNpdGx5IHN1cHBvcnRlZC5cbiAqL1xuZXhwb3J0IGNsYXNzIFBlck9yZ0ttc0tleVByb3ZpZGVyIGltcGxlbWVudHMgS2V5UHJvdmlkZXIge1xuICAvKiogQ2FjaGVkIHBlci1vcmcgbWFzdGVyIGtleXMsIGtleWVkIGJ5IG9yZ0lkLiAqL1xuICBwcml2YXRlIHJlYWRvbmx5IG1hc3RlcnMgPSBuZXcgTWFwPHN0cmluZywgeyBrZXk6IEJ1ZmZlcjsga2lkOiBzdHJpbmcgfT4oKTtcbiAgLyoqIFJlc29sdmVkIHBlci1vcmcgY29uZmlncyBjYWNoZWQgZm9yIHRoZSBwcm9jZXNzIGxpZmV0aW1lLiAqL1xuICBwcml2YXRlIHJlYWRvbmx5IGNvbmZpZ3MgPSBuZXcgTWFwPHN0cmluZywgUGVyT3JnS21zQ29uZmlnPigpO1xuICAvKiogSW4tZmxpZ2h0IHJlc29sdmVyIHByb21pc2VzIHNvIGNvbmN1cnJlbnQgZmlyc3QtdG91Y2ggY2FsbGVycyBzaGFyZSBvbmUgS01TIERlY3J5cHQuXG4gICAqICBSZXNvbHZlcyB0byBgbnVsbGAgZm9yIG9yZ3Mgd2l0aCBubyBwZXItb3JnIGNvbmZpZyDigJQgY2FsbGVyIHRyZWF0cyBudWxsIGFzXG4gICAqICBcImZhbGwgdGhyb3VnaCB0byB0aGUgZmFsbGJhY2sgcHJvdmlkZXJcIiwgc2FtZSBhcyBhIGNvbGQgY2FjaGUgbWlzcy4gKi9cbiAgcHJpdmF0ZSByZWFkb25seSBpbkZsaWdodCA9IG5ldyBNYXA8c3RyaW5nLCBQcm9taXNlPHsga2V5OiBCdWZmZXI7IGtpZDogc3RyaW5nIH0gfCBudWxsPj4oKTtcbiAgLyoqIFByb3ZpZGVyIHVzZWQgZm9yIG9yZ3MgdGhhdCBoYXZlIG5vIHBlci1vcmcgY29uZmlnLiAqL1xuICBwcml2YXRlIHJlYWRvbmx5IGZhbGxiYWNrOiBLZXlQcm92aWRlcjtcbiAgcHJpdmF0ZSByZWFkb25seSByZXNvbHZlcjogUGVyT3JnS21zUmVzb2x2ZXI7XG4gIHByaXZhdGUgcmVhZG9ubHkgcmVnaW9uPzogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IGVuZHBvaW50Pzogc3RyaW5nO1xuXG4gIGNvbnN0cnVjdG9yKG9wdHM6IHtcbiAgICByZXNvbHZlcjogUGVyT3JnS21zUmVzb2x2ZXI7XG4gICAgZmFsbGJhY2s6IEtleVByb3ZpZGVyO1xuICAgIHJlZ2lvbj86IHN0cmluZztcbiAgICBlbmRwb2ludD86IHN0cmluZztcbiAgfSkge1xuICAgIHRoaXMucmVzb2x2ZXIgPSBvcHRzLnJlc29sdmVyO1xuICAgIHRoaXMuZmFsbGJhY2sgPSBvcHRzLmZhbGxiYWNrO1xuICAgIHRoaXMucmVnaW9uID0gb3B0cy5yZWdpb24gPz8gcHJvY2Vzcy5lbnYuQVdTX1JFR0lPTiA/PyBwcm9jZXNzLmVudi5BV1NfREVGQVVMVF9SRUdJT047XG4gICAgdGhpcy5lbmRwb2ludCA9IG9wdHMuZW5kcG9pbnQgPz8gcHJvY2Vzcy5lbnYuQVdTX0tNU19FTkRQT0lOVDtcbiAgfVxuXG4gIC8qKiBTeW5jIGBkZXJpdmVLZXlgIG9ubHkgd29ya3MgZm9yIGFscmVhZHktd2FybWVkIG9yZ3MuIENvbGQgb3JncyBmYWxsXG4gICAqICB0aHJvdWdoIHRvIHRoZSBmYWxsYmFjayBwcm92aWRlci4gQ2FsbGVycyB0aGF0IHdhbnQgcGVyLW9yZyBpc29sYXRpb25cbiAgICogIE1VU1QgYGF3YWl0IGRlcml2ZUtleUFzeW5jKG9yZ0lkKWAgb25jZSBmaXJzdCAoZS5nLiBkdXJpbmcgcmVxdWVzdCBzZXR1cFxuICAgKiAgb3IgYXMgcGFydCBvZiBhIHdhcm11cCBwYXNzKSDigJQgb3RoZXJ3aXNlIHRoZSBvcmcgc2lsZW50bHkgdXNlcyB0aGVcbiAgICogIHNoYXJlZCBtYXN0ZXIuICovXG4gIGRlcml2ZUtleShvcmdJZDogc3RyaW5nKTogQnVmZmVyIHtcbiAgICBjb25zdCBjYWNoZWQgPSB0aGlzLm1hc3RlcnMuZ2V0KG9yZ0lkKTtcbiAgICBpZiAoIWNhY2hlZCkgcmV0dXJuIHRoaXMuZmFsbGJhY2suZGVyaXZlS2V5KG9yZ0lkKTtcbiAgICBjb25zdCBkZXJpdmVkID0gaGtkZlN5bmMoJ3NoYTI1NicsIGNhY2hlZC5rZXksIEJ1ZmZlci5mcm9tKG9yZ0lkLCAndXRmOCcpLCAnc2VjcmV0cy12MScsIDMyKTtcbiAgICByZXR1cm4gQnVmZmVyLmZyb20oZGVyaXZlZCk7XG4gIH1cblxuICBhc3luYyBkZXJpdmVLZXlBc3luYyhvcmdJZDogc3RyaW5nKTogUHJvbWlzZTxCdWZmZXI+IHtcbiAgICBhd2FpdCB0aGlzLmVuc3VyZVdhcm1lZChvcmdJZCk7XG4gICAgcmV0dXJuIHRoaXMuZGVyaXZlS2V5KG9yZ0lkKTtcbiAgfVxuXG4gIGtpZEZvcihvcmdJZDogc3RyaW5nKTogc3RyaW5nIHwgdW5kZWZpbmVkIHtcbiAgICByZXR1cm4gdGhpcy5tYXN0ZXJzLmdldChvcmdJZCk/LmtpZCA/PyB0aGlzLmZhbGxiYWNrLmtpZEZvcj8uKG9yZ0lkKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXNvbHZlIHRoZSBvcmcncyBLTVMgY29uZmlnLCBjYWxsIERlY3J5cHQsIGNhY2hlIHRoZSBtYXN0ZXIuIFN1YnNlcXVlbnRcbiAgICogY2FsbHMgZm9yIHRoZSBzYW1lIG9yZyBhcmUgbm8tb3BzLiBDb25jdXJyZW50IGNhbGxlcnMgc2hhcmUgdGhlIGluLWZsaWdodFxuICAgKiBEZWNyeXB0IHByb21pc2UuXG4gICAqXG4gICAqIFJldHVybnMgc2lsZW50bHkgd2hlbiB0aGUgb3JnIGhhcyBubyBwZXItb3JnIGNvbmZpZyDigJQgdGhlIGZhbGxiYWNrXG4gICAqIHByb3ZpZGVyIGhhbmRsZXMgdGhvc2Ugb3Jncy5cbiAgICovXG4gIGFzeW5jIGVuc3VyZVdhcm1lZChvcmdJZDogc3RyaW5nKTogUHJvbWlzZTx2b2lkPiB7XG4gICAgaWYgKHRoaXMubWFzdGVycy5oYXMob3JnSWQpKSByZXR1cm47XG4gICAgLy8gSW5zdGFsbCB0aGUgaW4tZmxpZ2h0IHByb21pc2UgU1lOQ0hST05PVVNMWSBiZWZvcmUgeWllbGRpbmcgc28gY29uY3VycmVudFxuICAgIC8vIGNhbGxlcnMgZmluZCBpdCBvbiB0aGUgc2Vjb25kLWFuZC1sYXRlciBwYXNzZXMuIEF3YWl0aW5nIHRoZSByZXNvbHZlclxuICAgIC8vIGJlZm9yZSBwb3B1bGF0aW5nIHRoZSBtYXAgaXMgdGhlIGJ1ZyB0aGF0IGxldHMgYSBQcm9taXNlLmFsbCBvZiAzXG4gICAgLy8gY2FsbGVycyBmaXJlIDMgS01TIERlY3J5cHRzLlxuICAgIGxldCBwcm9taXNlID0gdGhpcy5pbkZsaWdodC5nZXQob3JnSWQpO1xuICAgIGlmICghcHJvbWlzZSkge1xuICAgICAgcHJvbWlzZSA9IHRoaXMucmVzb2x2ZUFuZERlY3J5cHQob3JnSWQpO1xuICAgICAgdGhpcy5pbkZsaWdodC5zZXQob3JnSWQsIHByb21pc2UpO1xuICAgICAgdm9pZCBwcm9taXNlLmZpbmFsbHkoKCkgPT4geyBpZiAodGhpcy5pbkZsaWdodC5nZXQob3JnSWQpID09PSBwcm9taXNlKSB0aGlzLmluRmxpZ2h0LmRlbGV0ZShvcmdJZCk7IH0pO1xuICAgIH1cbiAgICBjb25zdCByZXN1bHQgPSBhd2FpdCBwcm9taXNlO1xuICAgIGlmIChyZXN1bHQpIHRoaXMubWFzdGVycy5zZXQob3JnSWQsIHJlc3VsdCk7XG4gIH1cblxuICBwcml2YXRlIGFzeW5jIHJlc29sdmVBbmREZWNyeXB0KG9yZ0lkOiBzdHJpbmcpOiBQcm9taXNlPHsga2V5OiBCdWZmZXI7IGtpZDogc3RyaW5nIH0gfCBudWxsPiB7XG4gICAgbGV0IGNmZyA9IHRoaXMuY29uZmlncy5nZXQob3JnSWQpO1xuICAgIGlmICghY2ZnKSB7XG4gICAgICBjb25zdCByZXNvbHZlZCA9IGF3YWl0IHRoaXMucmVzb2x2ZXIob3JnSWQpO1xuICAgICAgaWYgKCFyZXNvbHZlZCkgcmV0dXJuIG51bGw7IC8vIG5vIHBlci1vcmcgY29uZmlnIOKGkiBjYWxsZXIgdXNlcyBmYWxsYmFja1xuICAgICAgY2ZnID0gcmVzb2x2ZWQ7XG4gICAgICB0aGlzLmNvbmZpZ3Muc2V0KG9yZ0lkLCBjZmcpO1xuICAgIH1cbiAgICBjb25zdCBrZXkgPSBhd2FpdCB0aGlzLmZldGNoQW5kRGVjcnlwdChjZmcpO1xuICAgIHJldHVybiB7IGtleSwga2lkOiBjZmcua2V5SWQgfTtcbiAgfVxuXG4gIHByaXZhdGUgZmV0Y2hBbmREZWNyeXB0KGNmZzogUGVyT3JnS21zQ29uZmlnKTogUHJvbWlzZTxCdWZmZXI+IHtcbiAgICByZXR1cm4ga21zRGVjcnlwdDMyKGNmZy5rZXlJZCwgY2ZnLmNpcGhlcnRleHRCYXNlNjQsIHRoaXMucmVnaW9uLCB0aGlzLmVuZHBvaW50KTtcbiAgfVxuXG4gIC8qKiBFdmljdCBhIGNhY2hlZCBwZXItb3JnIG1hc3Rlci4gVXNlIGFmdGVyIGEga2V5IHJvdGF0aW9uIHNvIHRoZSBuZXh0XG4gICAqICB0b3VjaCByZS1mZXRjaGVzIHRoZSBuZXcgd3JhcHBlZCBtYXN0ZXIgZnJvbSB0aGUgcmVzb2x2ZXIuICovXG4gIGV2aWN0KG9yZ0lkOiBzdHJpbmcpOiB2b2lkIHtcbiAgICB0aGlzLm1hc3RlcnMuZGVsZXRlKG9yZ0lkKTtcbiAgICB0aGlzLmNvbmZpZ3MuZGVsZXRlKG9yZ0lkKTtcbiAgfVxufVxuXG4vKipcbiAqIEVuY3J5cHQgYSBwbGFpbnRleHQgc3RyaW5nIGZvciBzdG9yYWdlLiBSZXR1cm5zIGFuIGBFbmNyeXB0ZWRCbG9iYCB0aGF0XG4gKiBjYW4gYmUgSlNPTi1zZXJpYWxpemVkIGludG8gdGhlIHVuZGVybHlpbmcgY29sdW1uIC8gTW9uZ28gZG9jdW1lbnQuXG4gKlxuICogRW1wdHkgc3RyaW5ncyByb3VuZC10cmlwIGFzIGBudWxsYCBzbyB0aGUgY2FsbGluZyBtb2RlbCBsYXllciBjYW4gdHJlYXRcbiAqIFwibm8gc2VjcmV0IHNldFwiIGlkZW50aWNhbGx5IHRvIFwiZmllbGQgYWJzZW50XCIuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBlbmNyeXB0U2VjcmV0KCBwbGFpbnRleHQ6IHN0cmluZyxcbiAgb3JnSWQ6IHN0cmluZyxcbiAgcHJvdmlkZXI6IEtleVByb3ZpZGVyID0gZ2V0RGVmYXVsdFByb3ZpZGVyKCksXG4pOiBFbmNyeXB0ZWRCbG9iIHtcbiAgaWYgKCFwbGFpbnRleHQpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ1JlZnVzaW5nIHRvIGVuY3J5cHQgZW1wdHkgc3RyaW5nOyBjYWxsZXIgc2hvdWxkIHN0b3JlIG51bGwgaW5zdGVhZCcpO1xuICB9XG4gIGNvbnN0IGtleSA9IHByb3ZpZGVyLmRlcml2ZUtleShvcmdJZCk7XG4gIGNvbnN0IGl2ID0gcmFuZG9tQnl0ZXMoMTIpO1xuICBjb25zdCBjaXBoZXIgPSBjcmVhdGVDaXBoZXJpdignYWVzLTI1Ni1nY20nLCBrZXksIGl2KTtcbiAgY29uc3QgZW5jID0gQnVmZmVyLmNvbmNhdChbY2lwaGVyLnVwZGF0ZShwbGFpbnRleHQsICd1dGY4JyksIGNpcGhlci5maW5hbCgpXSk7XG4gIGNvbnN0IHRhZyA9IGNpcGhlci5nZXRBdXRoVGFnKCk7XG4gIC8vIFBlck9yZ0ttc0tleVByb3ZpZGVyIHRhZ3MgYmxvYnMgd2l0aCB0aGUgS01TIGtleSBpZCB1c2VkIHNvIHRoZVxuICAvLyBkZWNyeXB0IHBhdGggY2FuIHJlZnVzZSB0byBvcGVyYXRlIGlmIHRoZSBvcGVyYXRvciBsYXRlciBzd2FwcyBpbiBhXG4gIC8vIGRpZmZlcmVudCBwZXItb3JnIGNvbmZpZyAoYSBtaXNjb25maWd1cmVkIHN3YXAgc2hvdWxkbid0IHNpbGVudGx5XG4gIC8vIGFjY2VwdCBhIHN0YWxlIGJsb2IgaXQgY2FuJ3QgdmVyaWZ5IGFnYWluc3QgdGhlIHJpZ2h0IENNSykuXG4gIGNvbnN0IGtpZCA9IHByb3ZpZGVyLmtpZEZvcj8uKG9yZ0lkKTtcbiAgcmV0dXJuIHtcbiAgICBhbGc6ICdhZXMtMjU2LWdjbS12MScsXG4gICAgaXY6IGl2LnRvU3RyaW5nKCdiYXNlNjQnKSxcbiAgICAvLyBHQ00gdGFnIE1VU1QgdHJhdmVsIHdpdGggdGhlIGNpcGhlcnRleHQgb3IgYGRlY3J5cHRTZWNyZXRgIGNhbid0XG4gICAgLy8gdmVyaWZ5IGludGVncml0eSAgY29uY2F0ZW5hdGUgc28gdGhlIG9uLWRpc2sgc2hhcGUgaXMgb25lIGZpZWxkLlxuICAgIGNpcGhlcnRleHQ6IEJ1ZmZlci5jb25jYXQoW2VuYywgdGFnXSkudG9TdHJpbmcoJ2Jhc2U2NCcpLFxuICAgIC4uLihraWQgIT09IHVuZGVmaW5lZCA/IHsga2lkIH0gOiB7fSksXG4gIH07XG59XG5cbi8qKlxuICogRGVjcnlwdCBhbiBgRW5jcnlwdGVkQmxvYmAgd3JpdHRlbiBieSBgZW5jcnlwdFNlY3JldGAuIFRocm93cyBvbiAqIC0gdW5rbm93biBgYWxnYCAoZm9yY2VzIGFuIGV4cGxpY2l0IG1pZ3JhdGlvbiB3aGVuIHRoZSBmb3JtYXQgY2hhbmdlcylcbiAqIC0gd3Jvbmcgb3JnSWQgKEhLREYgYmluZGluZyBtaXNtYXRjaCBmYWlscyB0aGUgYXV0aCB0YWcpXG4gKiAtIHRhbXBlcmVkIGNpcGhlcnRleHQgKEdDTSBhdXRoIHRhZyBjaGVjayBmYWlscylcbiAqXG4gKiBDYWxsZXJzIGhhbmRsZSB0aGUgdGhyb3cgIG1hc2tpbmcgdGhlIGZhaWx1cmUgYXMgYG51bGxgIHdvdWxkIGhpZGVcbiAqIHNpbGVudCBjb3JydXB0aW9uIC8gd3Jvbmctb3JnIHJlYWRzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gZGVjcnlwdFNlY3JldCggYmxvYjogRW5jcnlwdGVkQmxvYixcbiAgb3JnSWQ6IHN0cmluZyxcbiAgcHJvdmlkZXI6IEtleVByb3ZpZGVyID0gZ2V0RGVmYXVsdFByb3ZpZGVyKCksXG4pOiBzdHJpbmcge1xuICBpZiAoYmxvYi5hbGcgIT09ICdhZXMtMjU2LWdjbS12MScpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYFVuc3VwcG9ydGVkIGVuY3J5cHRpb24gYWxnOiAke2Jsb2IuYWxnfWApO1xuICB9XG4gIC8vIElmIGJvdGggdGhlIHByb3ZpZGVyIEFORCB0aGUgYmxvYiByZXBvcnQgYSBraWQsIHRoZXkgbXVzdCBtYXRjaC5cbiAgLy8gTWlzbWF0Y2ggdXN1YWxseSBtZWFucyBhbiBvcGVyYXRvciByb3RhdGVkL3JlcGxhY2VkIGFuIG9yZydzIEtNU1xuICAvLyBjb25maWcgYW5kIGlzIG5vdyByZWFkaW5nIGEgYmxvYiBlbmNyeXB0ZWQgdW5kZXIgdGhlIE9MRCBrZXkg4oCUXG4gIC8vIGZhaWxpbmcgbG91ZCBoZXJlIGJlYXRzIGxldHRpbmcgQUVTLUdDTSB0aHJvdyBhbiBvcGFxdWUgYXV0aC10YWcgZXJyb3IuXG4gIGNvbnN0IHByb3ZpZGVyS2lkID0gcHJvdmlkZXIua2lkRm9yPy4ob3JnSWQpO1xuICBpZiAocHJvdmlkZXJLaWQgIT09IHVuZGVmaW5lZCAmJiBibG9iLmtpZCAhPT0gdW5kZWZpbmVkICYmIHByb3ZpZGVyS2lkICE9PSBibG9iLmtpZCkge1xuICAgIHRocm93IG5ldyBFcnJvcihgS01TIGtleSBpZCBtaXNtYXRjaDogYmxvYiB3YXMgZW5jcnlwdGVkIHVuZGVyICR7YmxvYi5raWR9LCBjdXJyZW50IHByb3ZpZGVyIHVzZXMgJHtwcm92aWRlcktpZH0gZm9yIG9yZyAke29yZ0lkfWApO1xuICB9XG4gIGNvbnN0IGtleSA9IHByb3ZpZGVyLmRlcml2ZUtleShvcmdJZCk7XG4gIGNvbnN0IGl2ID0gQnVmZmVyLmZyb20oYmxvYi5pdiwgJ2Jhc2U2NCcpO1xuICBjb25zdCBhbGwgPSBCdWZmZXIuZnJvbShibG9iLmNpcGhlcnRleHQsICdiYXNlNjQnKTtcbiAgLy8gU3BsaXQgb2ZmIHRoZSAxNi1ieXRlIGF1dGggdGFnIGFwcGVuZGVkIGluIGVuY3J5cHRTZWNyZXQuIEFueSB0YW1wZXJpbmdcbiAgLy8gIHRvIGVpdGhlciB0aGUgY2lwaGVydGV4dCBPUiB0aGUgdGFnICBjYXVzZXMgdGhlIG5leHQgYGZpbmFsKClgIHRvXG4gIC8vIHRocm93IHdpdGggXCJVbnN1cHBvcnRlZCBzdGF0ZSBvciB1bmFibGUgdG8gYXV0aGVudGljYXRlIGRhdGFcIi5cbiAgY29uc3QgdGFnID0gYWxsLnN1YmFycmF5KGFsbC5sZW5ndGggLSAxNik7XG4gIGNvbnN0IGVuYyA9IGFsbC5zdWJhcnJheSgwLCBhbGwubGVuZ3RoIC0gMTYpO1xuICBjb25zdCBkZWNpcGhlciA9IGNyZWF0ZURlY2lwaGVyaXYoJ2Flcy0yNTYtZ2NtJywga2V5LCBpdik7XG4gIGRlY2lwaGVyLnNldEF1dGhUYWcodGFnKTtcbiAgY29uc3QgZGVjID0gQnVmZmVyLmNvbmNhdChbZGVjaXBoZXIudXBkYXRlKGVuYyksIGRlY2lwaGVyLmZpbmFsKCldKTtcbiAgcmV0dXJuIGRlYy50b1N0cmluZygndXRmOCcpO1xufVxuXG4vKipcbiAqIFR5cGUgZ3VhcmQgIGhhbmR5IGZvciBtb2RlbCBsYXllcnMgdGhhdCBob2xkIGEgY29sdW1uIHdob3NlIHZhbHVlIG1heSBiZVxuICogZWl0aGVyIGEgY2xlYXItdGV4dCBzdHJpbmcgKGxlZ2FjeSAvIHVuZW5jcnlwdGVkKSBPUiBhbiBlbmNyeXB0ZWQgYmxvYlxuICogKHBvc3QtbWlncmF0aW9uKS4gTWl4ZWQgc3RhdGVzIGFyaXNlIG1pZC1taWdyYXRpb247IHRoZSBtb2RlbCBkZWNpZGVzXG4gKiB3aGF0IHRvIGRvIChkZWNyeXB0IG9uIHJlYWQsIGVuY3J5cHQgb24gbmV4dCB3cml0ZSkuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpc0VuY3J5cHRlZEJsb2IodmFsdWU6IHVua25vd24pOiB2YWx1ZSBpcyBFbmNyeXB0ZWRCbG9iIHtcbiAgcmV0dXJuICggdHlwZW9mIHZhbHVlID09PSAnb2JqZWN0J1xuICAgICYmIHZhbHVlICE9PSBudWxsXG4gICAgJiYgKHZhbHVlIGFzIHsgYWxnPzogdW5rbm93biB9KS5hbGcgPT09ICdhZXMtMjU2LWdjbS12MSdcbiAgICAmJiB0eXBlb2YgKHZhbHVlIGFzIHsgaXY/OiB1bmtub3duIH0pLml2ID09PSAnc3RyaW5nJ1xuICAgICYmIHR5cGVvZiAodmFsdWUgYXMgeyBjaXBoZXJ0ZXh0PzogdW5rbm93biB9KS5jaXBoZXJ0ZXh0ID09PSAnc3RyaW5nJ1xuICApO1xufVxuIl19

package/lib/utils/ssrf.d.ts

@@ -0,0 +1,30 @@
+/**
+ * True for loopback / private / link-local / CGNAT / cloud-metadata / ULA
+ * addresses — the ranges an outbound tenant webhook must never reach.
+ */
+export declare function isPrivateAddress(ip: string): boolean;
+/** Options for {@link assertSafeUrl}. */
+export interface SafeUrlOptions {
+    /** Allowed URL protocols (default: `['https:']`). */
+    protocols?: string[];
+}
+/**
+ * Reject a URL that is malformed, uses a disallowed protocol, or points at a
+ * private/loopback/link-local/metadata address (by IP literal or by DNS
+ * resolution). Throws a plain `Error` with a caller-safe message on rejection;
+ * resolves silently when the URL is safe to fetch.
+ */
+export declare function assertSafeUrl(rawUrl: string, opts?: SafeUrlOptions): Promise<void>;
+/**
+ * `fetch` init fragment every SSRF-guarded call MUST spread so a redirect can't
+ * pivot to an unvalidated (and re-resolved) host. Callers treat a 3xx / opaque
+ * redirect response as a failed delivery rather than following it.
+ */
+export declare const SSRF_FETCH_INIT: {
+    redirect: 'manual';
+};
+/** True when a `fetch` Response is (or was) a redirect the caller must refuse. */
+export declare function isRefusedRedirect(resp: {
+    type?: string;
+    status: number;
+}): boolean;