From 176e440195f975253cdfeab08636b1a897bf78a5 Mon Sep 17 00:00:00 2001
From: Craig Raw <craigraw@gmail.com>
Date: Tue, 31 Jan 2023 09:30:53 +0200
Subject: [PATCH] unseal satscard functionality added to sweep private key
 dialog

---
 build.gradle                                  |   4 +-
 .../sparrow/control/DevicePane.java           |  61 +++++++++++++++++-
 .../sparrow/control/DeviceUnsealDialog.java   |  32 +++++++++
 .../control/PrivateKeySweepDialog.java        |  21 +++++-
 .../sparrow/event/DeviceUnsealedEvent.java    |  22 +++++++
 .../com/sparrowwallet/sparrow/io/CardApi.java |  55 +++++++++++++++-
 .../sparrow/io/ckcard/CardProtocol.java       |  27 +++++++-
 .../sparrow/io/ckcard/CardStatus.java         |  14 +++-
 .../sparrow/io/ckcard/CardUnseal.java         |  15 +++++
 .../sparrow/io/ckcard/CkCardApi.java          |  48 ++++++++++++++
 src/main/resources/image/satscard.png         | Bin 0 -> 3758 bytes
 src/main/resources/image/satscard@2x.png      | Bin 0 -> 4335 bytes
 src/main/resources/image/satscard@3x.png      | Bin 0 -> 5635 bytes
 13 files changed, 291 insertions(+), 8 deletions(-)
 create mode 100644 src/main/java/com/sparrowwallet/sparrow/control/DeviceUnsealDialog.java
 create mode 100644 src/main/java/com/sparrowwallet/sparrow/event/DeviceUnsealedEvent.java
 create mode 100644 src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardUnseal.java
 create mode 100644 src/main/resources/image/satscard.png
 create mode 100644 src/main/resources/image/satscard@2x.png
 create mode 100644 src/main/resources/image/satscard@3x.png

diff --git a/build.gradle b/build.gradle
index cb6a7b77..a4761cca 100644
--- a/build.gradle
+++ b/build.gradle
@@ -161,7 +161,8 @@ run {
                                  "--add-opens=javafx.graphics/com.sun.glass.ui=com.sparrowwallet.sparrow",
                                  "--add-opens=javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow",
                                  "--add-opens=java.base/java.net=com.sparrowwallet.sparrow",
-                                 "--add-opens=java.base/java.io=com.google.gson"]
+                                 "--add-opens=java.base/java.io=com.google.gson",
+                                 "--add-opens=java.smartcardio/sun.security.smartcardio=com.sparrowwallet.sparrow"]
 
     if(os.macOsX) {
         applicationDefaultJvmArgs += ["-Dprism.lcdtext=false", "-Xdock:name=Sparrow", "-Xdock:icon=/Users/scy/git/sparrow/src/main/resources/sparrow-large.png",
@@ -210,6 +211,7 @@ jlink {
                    "--add-opens=javafx.graphics/com.sun.javafx.application=com.sparrowwallet.sparrow",
                    "--add-opens=java.base/java.net=com.sparrowwallet.sparrow",
                    "--add-opens=java.base/java.io=com.google.gson",
+                   "--add-opens=java.smartcardio/sun.security.smartcardio=com.sparrowwallet.sparrow",
                    "--add-reads=com.sparrowwallet.merged.module=java.desktop",
                    "--add-reads=com.sparrowwallet.merged.module=java.sql",
                    "--add-reads=com.sparrowwallet.merged.module=com.sparrowwallet.sparrow",
diff --git a/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java b/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java
index 3b2699bb..91a701d9 100644
--- a/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java
+++ b/src/main/java/com/sparrowwallet/sparrow/control/DevicePane.java
@@ -5,6 +5,7 @@ import com.sparrowwallet.drongo.ExtendedKey;
 import com.sparrowwallet.drongo.KeyDerivation;
 import com.sparrowwallet.drongo.OutputDescriptor;
 import com.sparrowwallet.drongo.crypto.ChildNumber;
+import com.sparrowwallet.drongo.crypto.ECKey;
 import com.sparrowwallet.drongo.policy.Policy;
 import com.sparrowwallet.drongo.policy.PolicyType;
 import com.sparrowwallet.drongo.protocol.ScriptType;
@@ -65,6 +66,7 @@ public class DevicePane extends TitledDescriptionPane {
     private Button displayAddressButton;
     private Button signMessageButton;
     private Button discoverKeystoresButton;
+    private Button unsealButton;
 
     private final SimpleStringProperty passphrase = new SimpleStringProperty("");
     private final SimpleStringProperty pin = new SimpleStringProperty("");
@@ -199,6 +201,32 @@ public class DevicePane extends TitledDescriptionPane {
         buttonBox.getChildren().addAll(setPassphraseButton, discoverKeystoresButton);
     }
 
+    public DevicePane(Device device, boolean defaultDevice) {
+        super(device.getModel().toDisplayString(), "", "", "image/" + device.getType() + ".png");
+        this.deviceOperation = DeviceOperation.UNSEAL;
+        this.wallet = null;
+        this.psbt = null;
+        this.outputDescriptor = null;
+        this.keyDerivation = null;
+        this.message = null;
+        this.device = device;
+        this.defaultDevice = defaultDevice;
+        this.availableAccounts = null;
+
+        setDefaultStatus();
+        showHideLink.setVisible(false);
+
+        createUnsealButton();
+
+        initialise(device);
+
+        messageProperty.addListener((observable, oldValue, newValue) -> {
+            Platform.runLater(() -> setDescription(newValue));
+        });
+
+        buttonBox.getChildren().add(unsealButton);
+    }
+
     private void initialise(Device device) {
         if(device.isNeedsPinSent()) {
             unlockButton.setDefaultButton(defaultDevice);
@@ -342,6 +370,17 @@ public class DevicePane extends TitledDescriptionPane {
         discoverKeystoresButton.setVisible(false);
     }
 
+    private void createUnsealButton() {
+        unsealButton = new Button("Unseal");
+        unsealButton.setAlignment(Pos.CENTER_RIGHT);
+        unsealButton.setOnAction(event -> {
+            unsealButton.setDisable(true);
+            unseal();
+        });
+        unsealButton.managedProperty().bind(unsealButton.visibleProperty());
+        unsealButton.setVisible(false);
+    }
+
     private void unlock(Device device) {
         if(device.getModel().requiresPinPrompt()) {
             promptPin();
@@ -816,6 +855,22 @@ public class DevicePane extends TitledDescriptionPane {
         getXpubsService.start();
     }
 
+    private void unseal() {
+        if(device.isCard()) {
+            try {
+                CardApi cardApi = CardApi.getCardApi(device.getModel(), pin.get());
+                Service<ECKey> unsealService = cardApi.getUnsealService(messageProperty);
+                handleCardOperation(unsealService, unsealButton, "Unseal", event -> {
+                    EventManager.get().post(new DeviceUnsealedEvent(unsealService.getValue(), cardApi.getDefaultScriptType()));
+                });
+            } catch(Exception e) {
+                log.error("Unseal Error: " + e.getMessage(), e);
+                setError("Unseal Error", e.getMessage());
+                unsealButton.setDisable(false);
+            }
+        }
+    }
+
     private void showOperationButton() {
         if(deviceOperation.equals(DeviceOperation.IMPORT)) {
             if(defaultDevice) {
@@ -842,6 +897,10 @@ public class DevicePane extends TitledDescriptionPane {
             discoverKeystoresButton.setDefaultButton(defaultDevice);
             discoverKeystoresButton.setVisible(true);
             showHideLink.setVisible(false);
+        } else if(deviceOperation.equals(DeviceOperation.UNSEAL)) {
+            unsealButton.setDefaultButton(defaultDevice);
+            unsealButton.setVisible(true);
+            showHideLink.setVisible(false);
         }
     }
 
@@ -959,6 +1018,6 @@ public class DevicePane extends TitledDescriptionPane {
     }
 
     public enum DeviceOperation {
-        IMPORT, SIGN, DISPLAY_ADDRESS, SIGN_MESSAGE, DISCOVER_KEYSTORES;
+        IMPORT, SIGN, DISPLAY_ADDRESS, SIGN_MESSAGE, DISCOVER_KEYSTORES, UNSEAL;
     }
 }
diff --git a/src/main/java/com/sparrowwallet/sparrow/control/DeviceUnsealDialog.java b/src/main/java/com/sparrowwallet/sparrow/control/DeviceUnsealDialog.java
new file mode 100644
index 00000000..034bfd57
--- /dev/null
+++ b/src/main/java/com/sparrowwallet/sparrow/control/DeviceUnsealDialog.java
@@ -0,0 +1,32 @@
+package com.sparrowwallet.sparrow.control;
+
+import com.google.common.eventbus.Subscribe;
+import com.sparrowwallet.drongo.crypto.ECKey;
+import com.sparrowwallet.drongo.protocol.ScriptType;
+import com.sparrowwallet.sparrow.EventManager;
+import com.sparrowwallet.sparrow.event.DeviceUnsealedEvent;
+import com.sparrowwallet.sparrow.io.Device;
+
+import java.util.List;
+
+public class DeviceUnsealDialog extends DeviceDialog<DeviceUnsealDialog.UnsealedKey> {
+    public DeviceUnsealDialog(List<String> operationFingerprints) {
+        super(operationFingerprints);
+        EventManager.get().register(this);
+        setOnCloseRequest(event -> {
+            EventManager.get().unregister(this);
+        });
+    }
+
+    @Override
+    protected DevicePane getDevicePane(Device device, boolean defaultDevice) {
+        return new DevicePane(device, defaultDevice);
+    }
+
+    @Subscribe
+    public void deviceUnsealed(DeviceUnsealedEvent event) {
+        setResult(new UnsealedKey(event.getPrivateKey(), event.getScriptType()));
+    }
+
+    public record UnsealedKey(ECKey privateKey, ScriptType scriptType) {}
+}
diff --git a/src/main/java/com/sparrowwallet/sparrow/control/PrivateKeySweepDialog.java b/src/main/java/com/sparrowwallet/sparrow/control/PrivateKeySweepDialog.java
index 3b8372be..6438ad8b 100644
--- a/src/main/java/com/sparrowwallet/sparrow/control/PrivateKeySweepDialog.java
+++ b/src/main/java/com/sparrowwallet/sparrow/control/PrivateKeySweepDialog.java
@@ -14,6 +14,7 @@ import com.sparrowwallet.drongo.psbt.PSBTInput;
 import com.sparrowwallet.drongo.wallet.Wallet;
 import com.sparrowwallet.sparrow.AppServices;
 import com.sparrowwallet.sparrow.glyphfont.FontAwesome5;
+import com.sparrowwallet.sparrow.io.CardApi;
 import com.sparrowwallet.sparrow.net.ElectrumServer;
 import javafx.application.Platform;
 import javafx.collections.FXCollections;
@@ -42,7 +43,7 @@ import tornadofx.control.Form;
 import java.io.File;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import java.util.stream.Collectors;
@@ -96,6 +97,14 @@ public class PrivateKeySweepDialog extends Dialog<Transaction> {
         HBox.setHgrow(key, Priority.ALWAYS);
         keyField.getInputs().add(keyBox);
 
+        if(CardApi.isReaderAvailable()) {
+            VBox cardButtonBox = new VBox(5);
+            Button cardKey = new Button("", getGlyph(FontAwesome5.Glyph.WIFI));
+            cardKey.setOnAction(event -> unsealPrivateKey());
+            cardButtonBox.getChildren().add(cardKey);
+            keyBox.getChildren().add(cardButtonBox);
+        }
+
         Field keyScriptTypeField = new Field();
         keyScriptTypeField.setText("Script Type:");
         keyScriptType = new ComboBox<>();
@@ -279,6 +288,16 @@ public class PrivateKeySweepDialog extends Dialog<Transaction> {
         }
     }
 
+    private void unsealPrivateKey() {
+        DeviceUnsealDialog deviceUnsealDialog = new DeviceUnsealDialog(Collections.emptyList());
+        Optional<DeviceUnsealDialog.UnsealedKey> optPrivateKey = deviceUnsealDialog.showAndWait();
+        if(optPrivateKey.isPresent()) {
+            DeviceUnsealDialog.UnsealedKey unsealedKey = optPrivateKey.get();
+            key.setText(unsealedKey.privateKey().getPrivateKeyEncoded().toBase58());
+            keyScriptType.setValue(unsealedKey.scriptType());
+        }
+    }
+
     private void createTransaction() {
         try {
             DumpedPrivateKey privateKey = getPrivateKey();
diff --git a/src/main/java/com/sparrowwallet/sparrow/event/DeviceUnsealedEvent.java b/src/main/java/com/sparrowwallet/sparrow/event/DeviceUnsealedEvent.java
new file mode 100644
index 00000000..b8507442
--- /dev/null
+++ b/src/main/java/com/sparrowwallet/sparrow/event/DeviceUnsealedEvent.java
@@ -0,0 +1,22 @@
+package com.sparrowwallet.sparrow.event;
+
+import com.sparrowwallet.drongo.crypto.ECKey;
+import com.sparrowwallet.drongo.protocol.ScriptType;
+
+public class DeviceUnsealedEvent {
+    private final ECKey privateKey;
+    private final ScriptType scriptType;
+
+    public DeviceUnsealedEvent(ECKey privateKey, ScriptType scriptType) {
+        this.privateKey = privateKey;
+        this.scriptType = scriptType;
+    }
+
+    public ECKey getPrivateKey() {
+        return privateKey;
+    }
+
+    public ScriptType getScriptType() {
+        return scriptType;
+    }
+}
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/CardApi.java b/src/main/java/com/sparrowwallet/sparrow/io/CardApi.java
index b7a3f3a4..318f9d3a 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/CardApi.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/CardApi.java
@@ -1,6 +1,8 @@
 package com.sparrowwallet.sparrow.io;
 
+import com.google.common.base.Throwables;
 import com.sparrowwallet.drongo.crypto.ChildNumber;
+import com.sparrowwallet.drongo.crypto.ECKey;
 import com.sparrowwallet.drongo.protocol.ScriptType;
 import com.sparrowwallet.drongo.psbt.PSBT;
 import com.sparrowwallet.drongo.wallet.Keystore;
@@ -13,7 +15,10 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.smartcardio.CardException;
+import javax.smartcardio.CardTerminals;
 import javax.smartcardio.TerminalFactory;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
 import java.util.Collections;
 import java.util.List;
 
@@ -45,6 +50,8 @@ public abstract class CardApi {
 
     public abstract WalletModel getCardType() throws CardException;
 
+    public abstract ScriptType getDefaultScriptType();
+
     public abstract Service<Void> getAuthDelayService() throws CardException;
 
     public abstract boolean requiresBackup() throws CardException;
@@ -63,6 +70,8 @@ public abstract class CardApi {
 
     public abstract Service<String> getSignMessageService(String message, ScriptType scriptType, List<ChildNumber> derivation, StringProperty messageProperty);
 
+    public abstract Service<ECKey> getUnsealService(StringProperty messageProperty);
+
     public abstract void disconnect();
 
     public static boolean isReaderAvailable() {
@@ -70,9 +79,53 @@ public abstract class CardApi {
             TerminalFactory tf = TerminalFactory.getDefault();
             return !tf.terminals().list().isEmpty();
         } catch(Exception e) {
-            log.error("Error detecting card terminals", e);
+            Throwable cause = Throwables.getRootCause(e);
+            if(cause.getMessage().equals("SCARD_E_NO_SERVICE")) {
+                recoverNoService();
+            } else {
+                log.error("Error detecting card terminals", e);
+            }
         }
 
         return false;
     }
+
+    private static void recoverNoService() {
+        try {
+            Class<?> pcscterminal = Class.forName("sun.security.smartcardio.PCSCTerminals");
+            Field contextId = pcscterminal.getDeclaredField("contextId");
+            contextId.setAccessible(true);
+
+            if(contextId.getLong(pcscterminal) != 0L)
+            {
+                // First get a new context value
+                Class<?> pcsc = Class.forName("sun.security.smartcardio.PCSC");
+                Method SCardEstablishContext = pcsc.getDeclaredMethod(
+                        "SCardEstablishContext",
+                        Integer.TYPE);
+                SCardEstablishContext.setAccessible(true);
+
+                Field SCARD_SCOPE_USER = pcsc.getDeclaredField("SCARD_SCOPE_USER");
+                SCARD_SCOPE_USER.setAccessible(true);
+
+                long newId = ((Long)SCardEstablishContext.invoke(pcsc,
+                        new Object[] { SCARD_SCOPE_USER.getInt(pcsc) }
+                ));
+                contextId.setLong(pcscterminal, newId);
+
+
+                // Then clear the terminals in cache
+                TerminalFactory factory = TerminalFactory.getDefault();
+                CardTerminals terminals = factory.terminals();
+                Field fieldTerminals = pcscterminal.getDeclaredField("terminals");
+                fieldTerminals.setAccessible(true);
+                Class<?> classMap = Class.forName("java.util.Map");
+                Method clearMap = classMap.getDeclaredMethod("clear");
+
+                clearMap.invoke(fieldTerminals.get(terminals));
+            }
+        } catch(Exception e) {
+            log.error("Failed to recover card service", e);
+        }
+    }
 }
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardProtocol.java b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardProtocol.java
index 96ca9c70..628d0c01 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardProtocol.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardProtocol.java
@@ -188,6 +188,16 @@ public class CardProtocol {
         return gson.fromJson(backup, CardBackup.class);
     }
 
+    public CardUnseal unseal(String cvc) throws CardException {
+        CardStatus status = getStatus();
+
+        Map<String, Object> args = new HashMap<>();
+        args.put("slot", status.getSlot());
+
+        JsonObject unseal = sendAuth("unseal", args, cvc);
+        return gson.fromJson(unseal, CardUnseal.class);
+    }
+
     public void disconnect() throws CardException {
         cardTransport.disconnect();
     }
@@ -206,11 +216,18 @@ public class CardProtocol {
     }
 
     private JsonObject sendAuth(String cmd, Map<String, Object> args, String cvc) throws CardException {
-        addAuth(cmd, args, cvc);
-        return send(cmd, args);
+        byte[] sessionKey = addAuth(cmd, args, cvc);
+        JsonObject jsonObject = send(cmd, args);
+
+        if(jsonObject.get("privkey") != null) {
+            byte[] privKeyBytes = Utils.hexToBytes(jsonObject.get("privkey").getAsString());
+            jsonObject.add("privkey", new JsonPrimitive(Utils.bytesToHex(Utils.xor(sessionKey, privKeyBytes))));
+        }
+
+        return jsonObject;
     }
 
-    public void addAuth(String cmd, Map<String, Object> args, String cvc) throws CardException {
+    public byte[] addAuth(String cmd, Map<String, Object> args, String cvc) throws CardException {
         if(cvc.length() < 6 || cvc.length() > 32) {
             throw new IllegalArgumentException("CVC cannot be of length " + cvc.length());
         }
@@ -235,6 +252,10 @@ public class CardProtocol {
                 } else if(cmd.equals("change") && args.get("data") instanceof byte[] dataBytes) {
                     args.put("data", Utils.xor(dataBytes, Arrays.copyOf(sessionKey, dataBytes.length)));
                 }
+
+                return sessionKey;
+            } else {
+                throw new IllegalStateException("Native library libsecp256k1 required but not enabled");
             }
         } catch(NativeSecp256k1Util.AssertFailException e) {
             throw new RuntimeException(e);
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardStatus.java b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardStatus.java
index 26f6e7e0..2d133696 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardStatus.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardStatus.java
@@ -17,12 +17,14 @@ public class CardStatus extends CardResponse {
     boolean tapsigner;
     List<BigInteger> path;
     BigInteger num_backups;
+    List<BigInteger> slots;
+    String addr;
     byte[] pubkey;
     BigInteger auth_delay;
     boolean testnet;
 
     public boolean isInitialized() {
-        return path != null;
+        return getCardType() != WalletModel.TAPSIGNER || path != null;
     }
 
     public String getIdentifier() {
@@ -47,6 +49,14 @@ public class CardStatus extends CardResponse {
         return tapsigner ? WalletModel.TAPSIGNER : WalletModel.SATSCARD;
     }
 
+    public int getSlot() {
+        if(slots == null || slots.isEmpty()) {
+            return 0;
+        }
+
+        return slots.get(0).intValue();
+    }
+
     @Override
     public String toString() {
         return "CardStatus{" +
@@ -56,6 +66,8 @@ public class CardStatus extends CardResponse {
                 ", tapsigner=" + tapsigner +
                 ", path=" + path +
                 ", num_backups=" + num_backups +
+                ", slots=" + slots +
+                ", addr='" + addr + '\'' +
                 ", pubkey=" + Arrays.toString(pubkey) +
                 ", auth_delay=" + auth_delay +
                 ", testnet=" + testnet +
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardUnseal.java b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardUnseal.java
new file mode 100644
index 00000000..67a8885d
--- /dev/null
+++ b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CardUnseal.java
@@ -0,0 +1,15 @@
+package com.sparrowwallet.sparrow.io.ckcard;
+
+import com.sparrowwallet.drongo.crypto.ECKey;
+
+public class CardUnseal extends CardResponse {
+    int slot;
+    byte[] privkey;
+    byte[] pubkey;
+    byte[] master_pk;
+    byte[] chain_code;
+
+    public ECKey getPrivateKey() {
+        return ECKey.fromPrivate(privkey);
+    }
+}
diff --git a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CkCardApi.java b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CkCardApi.java
index 0b90ec04..2fb4f811 100644
--- a/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CkCardApi.java
+++ b/src/main/java/com/sparrowwallet/sparrow/io/ckcard/CkCardApi.java
@@ -61,6 +61,11 @@ public class CkCardApi extends CardApi {
         return cardStatus.getCardType();
     }
 
+    @Override
+    public ScriptType getDefaultScriptType() {
+        return ScriptType.P2WPKH;
+    }
+
     CardStatus getStatus() throws CardException {
         CardStatus cardStatus = cardProtocol.getStatus();
         if(cardType != null && cardStatus.getCardType() != cardType) {
@@ -239,6 +244,16 @@ public class CkCardApi extends CardApi {
         }
     }
 
+    @Override
+    public Service<ECKey> getUnsealService(StringProperty messageProperty) {
+        return new UnsealService(messageProperty);
+    }
+
+    ECKey unseal() throws CardException {
+        CardUnseal cardUnseal = cardProtocol.unseal(cvc);
+        return cardUnseal.getPrivateKey();
+    }
+
     @Override
     public void disconnect() {
         try {
@@ -302,6 +317,10 @@ public class CkCardApi extends CardApi {
                 @Override
                 protected PSBT call() throws Exception {
                     CardStatus cardStatus = getStatus();
+                    if(cardStatus.getCardType() != WalletModel.TAPSIGNER) {
+                        throw new IllegalStateException("Please use a " + WalletModel.TAPSIGNER.toDisplayString() + " to sign transactions.");
+                    }
+
                     checkWait(cardStatus, new SimpleIntegerProperty(), messageProperty);
 
                     sign(wallet, psbt);
@@ -359,6 +378,10 @@ public class CkCardApi extends CardApi {
                 @Override
                 protected String call() throws Exception {
                     CardStatus cardStatus = getStatus();
+                    if(cardStatus.getCardType() != WalletModel.TAPSIGNER) {
+                        throw new IllegalStateException("Please use a " + WalletModel.TAPSIGNER.toDisplayString() + " to sign messages.");
+                    }
+
                     checkWait(cardStatus, new SimpleIntegerProperty(), messageProperty);
 
                     return signMessage(message, scriptType, derivation);
@@ -366,4 +389,29 @@ public class CkCardApi extends CardApi {
             };
         }
     }
+
+    public class UnsealService extends Service<ECKey> {
+        private final StringProperty messageProperty;
+
+        public UnsealService(StringProperty messageProperty) {
+            this.messageProperty = messageProperty;
+        }
+
+        @Override
+        protected Task<ECKey> createTask() {
+            return new Task<>() {
+                @Override
+                protected ECKey call() throws Exception {
+                    CardStatus cardStatus = getStatus();
+                    if(cardStatus.getCardType() != WalletModel.SATSCARD) {
+                        throw new IllegalStateException("Please use a " + WalletModel.SATSCARD.toDisplayString() + " to unseal private keys.");
+                    }
+
+                    checkWait(cardStatus, new SimpleIntegerProperty(), messageProperty);
+
+                    return unseal();
+                }
+            };
+        }
+    }
 }
diff --git a/src/main/resources/image/satscard.png b/src/main/resources/image/satscard.png
new file mode 100644
index 0000000000000000000000000000000000000000..cafed8481b50a54828e1203f39ca4ddf293f03bc
GIT binary patch
literal 3758
zcmdT{dsGzX6`uu4fC?Id79rAgfds*Q%<Ky$%Ti<kH@b*qdD#Xt?9Rf-va{V8*j<jG
zwJL~J3n@uGL_n=I-~$tDF;R|CJzzsMIibWxqa=|8HDEkQg`Oa%-|UM8mo!cO%5Y}p
z^4<HpkMBO_+g+I%>45=Z0T2WQDpxDAz#Cz1KVR^SNUC`YysqPUN}Wmt#RA$7dWsbc
zc>{_C{vcKu^b;EmL4~Yv7rluU<B;(JGB5<5&|+|#Scr`d0d!3@0r@zvZ-6&Lu4Eq0
zcP3%M^`#h1n%J2pl8x|0JPGhjfFP&<MiH0|3s6Lgilh+a{d*sm-kugOmtLgBdxmB#
zIMJ|_4U15L6osYGAJCjh!16b)&Zi)V7s=c#%aNpVur@`g^XNR)T2w=p@-Qt~i1RF^
zMn)4Pv!H-1#c7OfDb*V&)RM@tNuYpcmiZjEO@uB<<m9O`*(sz6XG?ejo`53{V6)jW
zlU9djDbgHp@LwXQn5K;=pKmssd1fJxG!^mTgoFgX0O2DD7f5g^tAWNWTmuzpSK`#8
zz$uN1Fwz8RU^9BLLb8lb<Zu{6uFLKxZXsqY87N0sAV5CD;ln%u-xCZ3t5Uf<oQ1Ps
zMjNcO)FYCjQ_F!bj@UdRDYeyz^RsY@EHi2F)N<TFM|yICCUo=o&TziX_iwlF$(FI0
zq)DonG<t@**mkS7l-hS%#_S_%E8jc?QHmQVkQKRDAhT`o6O5S@xdHR%1G+KXfVSkI
z>r6xuVZihXQd0)Z(n^IKFnC%*iz2v0D24@EE{5p}xuSTThMR!kg<LTnFP2JlSOOve
z{>`iA2~(>H3N)tGEou<Et)gGTe?5EE$<PzF$~0mo3TM)t$Z_V|Rm!ePWiYm~K`By4
zn=uofTm%A=Co?U`&U9vmjlevF9izfDgn`M`3K`!MYQ}q)0f%;TF>a7ELxC%Rxv*62
z912{47!`mGv1_wQ&98(oP&8)H;EwGkzVmk5wY$ORw}EMx)|P8bI7Z`Ir(=%QxiA@@
z83B6Y$CC$5F=i;jwQ{~QGUvkF&}Ir_R_YK~?fe@2(9~%qVxa^>q+GFB3Oc1wn*cfm
z6o>{dgf$`oBGd`RPA~tT)KOUZ_e`8UowNJO*{e_Xq0HXIKX3-P!Dmw7P_2Bj-oM+X
z**$ZEyQya8H_8kIeHl~f*#?4^BQn0H<+&&@_P}hwYz+cCAnt2(<@09D$b|yi#fO=f
z1MAM8i_QNZSa-e~7DSGwFuhBf)Fi2wdpg_LQaVd&jsg{_C3IE=7yz!3<)Q8wQ*M%T
zbl9B0XX)@T_FV4TCFkf+fy0d!qcNuzAu~LM0yQi~MPd|@#0kI&&Hgn(XUV$haeX~e
zWl9P--suQEE~m26SFx3;DH1qABH<!DkW7zq9`&S<deQ^}$K^tI*vzs6W$z}p^O9{!
z+E>A8OdbI8;5^yM1G<Bb9s=h}lTwkaF8<BvAK%{{j)(SM7&Je3`qgF9GbPD-e%u}1
z8p-$}HYa#rM8!+wV_}GbtO!<Q-Wk}v%@T5cJY;);%#!y;;1HWg-EsWfdp#oIert1Y
zN=J<D*7)Mco^tt7|Az;L({Bw|-YW8av(<K4jV<j4v$<p0PAoV3%HLF3%Bsdc-)*@u
zDv#yxYcA^=mTUg8zG+x0l}OZzChrG|BPmE+-`JPN_$e#CYh+~PlCpktTU+kyGAeSx
z#cRjUwAWrPs}HQczglrJOoKohz0MAOkPo&0JR+iM=o!tO$W3Q9B<H{OGwAF#@2$OI
zd(w(e+<b27#RJCO+EpLEdGDQQcss<Kyz~_GQ+#a8kqqrk%VhBK*0{0Oy<ctFo_p=>
zkCs3|tdWE7hOgK<J~<grN*V|2&Ih*K6-;Or`J_itC8LYFUJbhWY}W_R%j37T{prSN
zQ^!XI>VX|aSA#A!e<(`4OQUsX%B!_Q0`bxXzJuOf)6>(@C8O`e*42bqn+AbL``2wQ
zi1UIT{^$JfZl7ILx5FgrxlE(nuOAykVbRaxFEm~m`S{3^RP1m}>@m7+!-kU1HSd?C
zR&*A`N9-G1ZauL{!D@+0+IM?$&&s}noPmX(#&GMCLNzC^3_tuN^r62pm-r%TaBcs%
zusO6dM=J{3(b(9Ss~!+%{35$OB=zamd;MpBInl7CzU{A&EMn(p%d$Hcd^#1}_<H5%
z-qVL4eRH((%g*$#doP;z9)F>X^VQDWYcJL-)c@YD_3!mvT(>b}-MZ4#A5S%C?^nE)
zHPG6Yk*ZBItupl;Jl$6Dd1H<FT5-pXQMO;x`hi!v{Z>R>Q1;WOIyyR*`E;*YQ&861
zfA=rVQM+m`?}m6ezG*rv^wGkgpq@C@5ZP7G-U07l8`~%8dmB;pCqOiMAZG9F_uBq-
z{d#@Xh31RYsb5(+2Qr59vn#{9B7^?U&8|EaQ;XCdGP7ja(OCmaw@&!}wmVl|)mg;d
zs2H-=_sO%S(#CGH{d7<P>(tB99RK=_-Va{Xe(`c&=;>3{(_YyPSm;>Q^sz^W``g=%
zH(Q^{m)=vnCg>fzMec!f6f5snEh#(LhE9~dJNBsLMCa2!-PKTR`a-CKwczU2x{1%?
z)1gn+5AZiXo(_Nho5XXx8?{L}`u#zWwjp`opUfqDFclPbuJ}@OZCD2LTT7Xmp*Xqf
Hm2Lk8ApFB(

literal 0
HcmV?d00001

diff --git a/src/main/resources/image/satscard@2x.png b/src/main/resources/image/satscard@2x.png
new file mode 100644
index 0000000000000000000000000000000000000000..ec5686f145a3ad6aa48de730eb30c67aa6fba151
GIT binary patch
literal 4335
zcmdT|dsq`!7QaCYNKwJs;@cQ0MN1wtc_3qmK*CFnMTjg?wN8==jO0ZUOhEiTYV8_S
z!1_WIYklDQC~MuSTdb+HMN=iN(1K8HYb{psfu%)6Ub-_0fq=2w-Tt)+GjntA`JKo8
zopa`X<R>hM9qBW{2LLcKK2DTKJmuu&?Md9VKW&o`kE>Wpyh1DnGl{V`@S=<X!-x@u
z_yWoV@Pd5|fRr+^f4qVc+$ZBf$UuO&gO`a*M}h6*vBcQC4hO^gu%*P49EOlL=Q9B}
zVM-Nh(CDZMIt>+Oa2PxQU=|D`EC_)iD#SwIP=pf-z_3lj`}Lmxz@uNU{DWZwW72{X
z4TVx64#EmWpiod!RzuhXBeZdg^#CxYlNZHQHfJR<_XL-u7*fRZ5t&BCK;;@K#xSY0
zq$a>OA;eIH8BnT8rBv$?Q#j2ofe>SInn|PDMGP6?v=ngyRjAQnR33xHV9^9VR4SFP
zlPi!!QA{74_!Uk|HyE@ClW8;>8Adikqf28#VPRoR7R-cUIw3*VXR8gUiLTa9cPMe{
z5n+0n4%ZrRjhag8MWvc7LpY5_8tVTz{KQQ7fF-rQFDxQJCb`0d7%Zkc7!j;k-0$Ha
zoC($1VJekdq}~v{lJKQ3Hn&K<BwLFy6EVFeODDskS7K_zbaze|aK&?cCs%&Y_useg
z&XzV^W6<c+HCp%3{$+<%JEe}D=9Bw~*wZ&fgsU*Mo?t})u~>Zj4nMOpz>y1b@pF+b
zD=tVoJ;)n6JPlW)N|8pEMHn{3iv+|1LypT47~`?I5KB%+QH7MwnWd1?!(dEG=VG(C
zp*#f|2J;99pR48>Q*pSSD9vn_xQXcPIh}-M4xV)`C~<pkYEhjYBMA?uIT`Oy=KfqI
zG4{kk^csc1i0ZJ&G$J5DBw2*i1SdCC7-GQGU@<Dg)g)Up_)K@G0q^?_^l3MyV`>4}
z7U(R94uwjbZGq0>A|zuDZFZ^WE5X%z1FDu`ecO%y;q7*4cY#0O1}Y<qTOiY6r~#8Z
z9qXGN3ga`$CZNRse|V6kqv|wFE?_z%b50BmZ6GlQQ3pd3=lkH#QYYte**p{urE|HV
zM5RdOVML`62_nO!kc`8E*$Ot->E(YzogQ8JKN9Dlb8uZbYxUVW<U5M^Pxb&8_y7fc
zs^g!{_dm924$oZRE~?26j*tyOnMG#$A~kLhz<j2=>7gj1?Ge2JwHFA~2XUPnDxWf7
zM!;s-KTM)Oll5*l=ej-=yZAp~UDsW(MC6E&tX+*xqR}V??oKy$N(V^|Q6SdHaYeR>
zXaM~!%T3;srd%Y4=&(D14btJJ?e)9skQ|~zOdN0Ir~!3qVUx|1&5}S|ghTxCUS|<!
zG{@Tn86@kXr~mzl#0!PQ0Z)M|F@ZiYHi{Y_E#yIAJRTip5M;WQbE`+FQEGHV;Fy5z
z3LBX2LpiF+<-}y~l8#y8JSOlVcyONW1U{SJo3Iyv7mmk^A|<BMmha}JFIhCstM#ez
z^6ruYqr2y(3lG=l><X#~;*3%+8EN);d0}wVunk9}0(=-tXMCcseb;;DC#}a@Bkx7s
zjar&QORYN>w;Z1T+Q#E2q;Uu1t_AMCbMyVSim&F6%i8=%;JM&NcgurIrOembE?bPZ
z-q$mzYyG0UrwzK9)rZ!d+-+`e_v}8rh#lg&ocDNfonUA3_f@Y>G2hPaki#X#fN!(y
z{UL$|+m;0G8$GY=>+3DOv4xW=-kOm$rqbenx^8&uWdGHRW^UUFHeJ45Z?oB60`E`T
z_r#kUP|~?ySHXX2Z_B~&4!n5qn>ztJIyrgs8&BDM!BJbON9!x#5ue#~`oS(+4{hJ%
zX`uDQl^jatXpj){igl7TdupwRCkUclZ#$EAwEk{^nR|MDmzVlhFl}w^v=@F%XA~!a
zO&8>+;I?<n4GrPouh%BdJ=_iMZ&+9aHXcYkycAktsNWE=`B23&VTL&F$GRh1Q;+#S
zlANYk$8CAs-LN4-<U7WU1^QLTQMbPr5i<Sllo*fW8;48BkEnvlg-zqk!N0!QYVi)t
z|8&p1q@*NY5b5{fnA%IT&h3a}w_WVwwTVGw=}wVhOUbUx6^1R3TZ}ZM+E(OY0yi{1
zaNZnB?)obci%zC4oicuWXJcmRFt9SFxyZBanCM|s7ZZIlva&(+aMnJH*Xy>P3pF)0
z(z3+-np~M>9CRQ*KfgE9@BZjjp(nC@b});p|55{8EWV^js;;hHXHGXZ{wug_O?`d+
z97S5%v6T-lD?Xl`oSe)DcRu1ywpP?Cc}MG4v?n*7iZaj2fiHaC(ffU2)BVu%hZ1&A
zg9~D0pQV;Bi?#-?$rT)1f9@wrnWQ<x3<Wj*1FPN^wO4D=Kdq{&N-l4Y6wSi?YZHUE
zR4fS|oBZV|i>l?oi-ko+Q@>6<8!H+eU3xP?ajSTCkY7!6bMpvV&g6*Z3~zrN1gxQ&
z$`TLv)ZcAll(*x+`Vmh)>B<=PS&Q+PAB=xHcu=}Jwfk7r9BjO-kYWnC$ig!=e+m45
zrr1E<?d)s$&13VvT-f!^k<P96PQT^x_``Z@Jh)70oKO~&7cMfaK+zk%d7VT;%<Wla
zh7@VG(`yT-f1X*&VQY%Mr8kWGc)z9gNWjluHJ>ObX_|kldG2S2t(CU?J-@yBT(a#8
zccQ8BzCBMf#LLHQ8G&R3a>CyJWqtgp!X^o*D%n~SxUc=>s!Iy}_{tFJaIvVNq~hxF
zdvM;-iIyj$dVgqWFwzwTPvd(YeVTZ8VtIRpt@On=_n1#Ww~Ax-XCAct@^#s~f*Ut(
zgf3}V3bfRy;^YG8`jva_d#=v*^zuquaq{X>P{`IdNAIznN#EGHJSV5CtL3f93yy7%
zPU7v#nphBXsB87=)dUe9hB*@^UGES+9i~cV7gtxDOr<|uyiYO{SDwjz)4P^!$=xiJ
z#>B?11N@?sSwExQx$|bU_f}R`b{77sv3B&v?&!P_+~7w`mCRkeFyxinUpROTy42Cj
zVV@O>UMmT!3)w!Z?fj0W0Oqou@!-7G8hhf(ZNJRYDH#p>^&$gdj2`=8ZT<JH=d=^A
zO!>y2>kArVMY5KWG8+oKWOdU)Yyq@NTGxEBD<XCDDD$;9bd%D;6SB2=pU8f<==`cv
zrpA5ztuNq6w?pT5<g9wfJfXZyoymEy-peacrB<tPrSiU>hE&-))~c?j{xe0pv?I#;
z8D8F=O}j`j>jEl9{ivL|?MQU`r!($Zg`l$S%zR|`6xpq}KT;Jyl)SmCK2N)L^XARv
zmSr8=5*JQ+oLheO?AesyvC{D0ghTox`P2Ad>bWn5^M88x1M>e9AU=A5=<iX>*Zdp1
CVbsF_

literal 0
HcmV?d00001

diff --git a/src/main/resources/image/satscard@3x.png b/src/main/resources/image/satscard@3x.png
new file mode 100644
index 0000000000000000000000000000000000000000..4440c1c5e3804612b752b8c03f0e7027f904fa3f
GIT binary patch
literal 5635
zcmdT|cU)7~9=~A=BH%-jX$aU_lq^Vq2w?>QA4CWVAfP2=Kp+E>uqq(#peUfFNL4^u
zpoA$9x0qIoSg_!$0mR2}AR;0nL!UU_4O@$Ewg0@6&%Ni|bAI37IKOeuCuu%JcTIHz
zbpQY~Jv|5{uy2$<YAWEnBCs+K>^d2No=k6Vzychr0jiMYfFd}8fIk3Y04Pt50U!)w
zI5&=jtev4z0BKMF_y$&h4<CY_8tZ~%(S8=7G=n_>_VVF+`D?cKVI?rw9IBAVhx+h&
zP&C{cjs*ZT5{<?oQ8+XTibCShHaKe=08q?Sn&aD0pfJa`u|RQtESE5gM%h47);OdM
z4rK%E`nGEnTv`(Cu|)s?a5MP>NhorR1Lxkc$brH@Z!a8;$AMGnyf6klffFs~1lT9w
zz#)erq(T!oY_0&8-~gMVz=31=Gy(>lA`wP8zyiH}psqYV1B!(s;Yb)>9SVio^XW_+
ziLh}74t_bnB80+d90Cy^9}kbWg7f&{2$Y?j9Ri6)pwX5fg{2^oE2Jh^as_77OlJ8I
z7y=rf6)j}(xKKG?Y8Wq8=m3Ms1<kc-JsAnCc}ZNsj9H+82>A*E1xF$lgMr3+d(Ub3
z0WN_WJq6=%7DWn#ZgHS4Gqx>?6p$0683+<Xz>DS67;bS4uFz~TC4?;ICv=yu{43r6
zwfx0oMMv<2JV696dU5F7^0d?`mrn1ry?h^WQ{fv(U~w2+0q7Mx8i}-@+Tq`=%=>5o
za?2-?3sx2&r`&_v%x8tOxKuWQM~ejo3q1*VZ~;zd(Q#-7)(V3{(k-b}W|*b5Et6(x
zhh~IXVi>j<8!VG*hsJ^mev-}aM0v0TU}`2Vup6{~DyIDyF(1y(F0ffsu^CO}3m9^T
zJHTc=J{Qb$u`0(*1rAQYV+!M`e1>y4Xb|36o`g`JS>Hg>C^#Cr)|*OWapm6n!XB|0
zYF_&}0W;j=BN%eufa!%qS)y#nvt_{&iNVP|HqC8{>eEbET!E0vr7>o<oAn=W_cZqf
z@K4L2(&WjFr|}t7A%i}v*v#z5Fnff&2(VfIKYpM^P`Tj@Ivz1=+3du}rp*V&2d+b-
z$g}6cA9Woai?PB|(KePCj18D6VRSn%Q@{YBF~U$ZYb4r=X@!~9^1pGNfExEdI&RvX
zALi9;uKqp`?WdFY57vMM@Oc-^u=f0Yy#HsLHm%tL_yX4Q3XYQ(1a_=E(kWb)5RbM;
zEH?cy3M_kIZJ<si2x<nhaPDLJz<DuvE96u|pyb^QcH#QR*e(ACyKsF07PK7aD$iXW
zpUmU2@r&JVrd;{~)kh4xd2|*tkpLEexstU=+{;BRp!|r(loE^&cq~%(=G2|0{D_A)
zc)g)hh16LtR`TL$g(RaeIBN_JgI$LN?`YGf3GM^h1$^etPn@T#D|o?Uve*o~faLB1
z^>lN^qU^9(OEesG=Av|q@^R&{d3?}t2Ht8RY<_wMHJwchZcI~Ea(WiLkKxrpKg{0k
z@an{LtttRe|Jjq^Oinm4)D_G&3eZ=5{yv@=fBE8hTNdqe4ClcfZ&Ezl<_6z4*kt0A
z$VSQSl!cFJf|K}KlrlN>4JosrXa%X1oSC`Sr3l{lF4f|fP0*1#PPQ=F^JM0u``?cj
zk7EYMf6dF-Z)t7*fOZsTRr~zCXUd2^3xBhDM|fQS<0L@m4>n(2^JfZeWmQ#(E6I}+
zZ^aja34il_`diT5<yiwEa2wxJ@}suS6gvG{`r*Uf><Wj_^nt^L8vzTLMumSAKPl<W
z`qVaqyG^HD_s88H9KY+(a(Abw5~5RDRbGCgqlVFxwyEfE>0$YXr_2=YPridw-tH46
zsYo@&23xws7u0&)D8{+Rj@j0C#{C?I+FI4_sN6dUOelJ|QOr^S=^$Xz)W>hJgFB5R
zzvluyXWCK-gbRfhK7?{HvFu4kg=Digkq9S9hF_Zfax}sF_2gu&__cPbDg|?7!}UIb
zxkfKu$5TsFGr6zhG;Mef=WJb_FbDO>7dX2y_}&#`l5AKuIIaO~Qz!`FB5iHYos~s8
zz+rAWX=7J?DUbpvtY^%gXCnO#V1JDX(fCU|B<cno{Z{;%1!V1ifL4(@v~}*L?k*yI
zu?Ci}9R1fi#@o+z2K;1`Nj+K{{KG0PyAzhdx<B7<2|Rn5ydyXrQyzR@@d&XbUgWX)
z@3BB**^|8Low>QW<)Wv~3MN|)p(bnYJf&<_DI(oa^l?Jx8E`q0px_7aFo)%<GvlxD
z%nOM+OD><=1@-VcB!05BDe&4QvPJgSK_`~SkkXDEfSB?_okT{fv|*|$dm4BCIiLHl
zsS*gfri0B5&XnEN?@LHuxVg0DuE?SU#K#|UYgTd21m)vQp?Z+p_bXi~gFv^M;o!i)
z7L{m&C2BR|ypV0%>Ma`k_~+Na-aBny^XlA5<yM`ti=X46wY9Y+<&rDP+Toj*X!Igr
zFE(|Ao)1|@cxb1Sd-z=Cx~<5DH#I>O`;6B~+UnJMSKZfqQ7D<Xla`j&N_lbgvys8?
zer;({O-@d(k_1(7Y0WnQbVPor;g4TxNKc5~ERmjVXlVGg+&`Sh8@7uYIu5JRk}~V`
zYQXT-2-TMkieHOFZ@5h6XJaEp{$)2O#>Or!3q_<Fw!TYEe-c;;*sAur|0C($z-WI9
zqAG6vQS%8|V|!FWLV};R((d8PY7@_ON)!&nHiuY}QQ4;VP`$ggwUrw+R3PRaD!kQl
zvFFyxbX1k*(xoR1jE%R}UcD`qO5wC-WARtti8sE`rKXo2Y>c6t{K3C$o$u45qM7#i
zz3cTi%^K2my6QFzbgl#JNJd2dx`tym=-g&~_u-Ky&r?1fS;P{@$BEnMj-x8h)g5eX
z3Gsw2YIp1<rS-b%!G5K;@jB;!T=kb5EtlFlFQ6WgB|#4RCnk#yx9UI!hKF0Yopl2c
zO0u?-W8vWKPLj+9V((Ygo^K!f<o44@!*4bfkt_Ts_edt902M&!MmB3rSz>caobl}M
z=SQ{r_=%DMbF{U!up?-)THLJ+&3Ih7(}~g|YV-sB>3BRZuU_|7N>7e?ozk|0H~L5O
z$+BUEbEqdL4>n=}t$zObY*Ojit4O_`y&8IWc6y@1kbhImxnKewX=UZ7`21|OW>U|U
zB3a~HKzd#Ks<oNUon^fny1Ke@ic3oJofRHcR;(EjoL1la6BGE-W$C?hUM5n#NJ*zR
zb+`Lrqmgvf%kLcanh`Hj#z*Ui!(AG#1x>~P@v!dE`mKcegy+3KK3f$Pc=np=_hn^K
zhN)dK?WV9~XYH|lhm0M*vepV+ecv%pp*OB&wDQ{neiqsGwB{6owfA*5!i2SfrV8Cm
z$+<VpWBC&=eVWT^&*L|XowqM%JSAgf5!NmlITGwdG%#e~&@#B^`s72^J!^?e)v^>7
zT^>qPwe65l!m>Z<(;N?NSXCzW47@5kAks8MHvAwm5Br&~bGnplF_uu_zhf!8_Kw#k
zOX5lGOl80-rXA8-D7s{fZSCsX8X&9nXb5ZOSsNTG3&MQe#L(y!y6j4Frs&<Dt}>Al
zoN8|(rQ&+v#scw<kdP32J#1hp`P+tLdW7#+#!>?k+$lRS7|e<`<{gDswPKTu3qPz|
zU-m@fddBK6HwO=OB*y4fFS`)cUiqM{vreSjx=k@4=B;5*aGl}hX2>cI_ISn#`$Y8E
zG6eukF5zcKw`gZU>H>DV6EHylB-Kj%`t9Dmd&B$t`(2N}ZEkM9)OGjnb^|E~ICI_S
zfg9lHD_h+bDJha2W*iX`6pew$gM&@r{~}t3w0#ivfw26x&V4B6rCSl?;^N{*?Va_3
z>x*-~`Gz}cUnP18mkxSUVu^%pD#&dW{#T!w<XEXLGwR@^|Ko@L#0}t?QKCk<Oi#CK
zlgY*-i%0{aM|OnScJdT0<<XEfX|3)VVQg%dk&<)D&`q0t{fXlt@c1*N(q@`5Z}i~L
zVJR^&BP(_8l#8=M6vds*%-a6p%P+e-8yh{`y{sUsG7r(g`1Yf$R)|&`zPvvDCv<8+
zxg^8e%j?aGAw9t<6;)N$a*0-&hbQGMAprI*Ks?ZR^w7o!drM18H}09NXD)42(Kj+O
z@|T5^W7S5C0+f-JVy*Oyj4MWGegq4QH|&KUu-ZN8xAbm>=d#nMPxoh~pN}G@<sX!p
zrb{MLqAD_8;e|@lR8dl8;QD=%?JI$oz*^Jp(Qb|2rtL4Ebs5k!2OCn^srT;PGXlOO
z+|RrF8St!;jt&@yBC<D`0IQt>9#Xb)cEEE64__3GhdN=MzPp8t*j(tft1>$~TlOr>
zvlL|sqsE`VM*Y*zqWNPD>tvDrI-tF)Bdt*!EAk+<{Ul@7=87IjR;thy>9u!MQZ+oJ
zVa?*N;<(((*uM8oeKnG{JXeKX<zk+)bE^)gKtEH{2aIdj3qzo6!Z)L_Tr$z_=jTVQ
zD5&U9L_loyV|@c6R?$*+yn24`AgcW|JO***jicE~V*U+gZ4<y%t=7L)`GQM{4I<<<
z_K!L`?s%7E#Ww4C8I=Ry`jy6zTlrbjPAv~*q-w8T!!h@!z85ZX|2@^J*_qVS0-U=V
zG-(QCSq}5kxA@3@0b5xVrr3`EP-KI}#z}*=>!qF)tu=2rwnith;tu;=GM`^#_7emN
zZ9fR@q?NrIzVcqJ@bd0J^WF^xf9MK$YkXpJ@lh3fX|+E}{s*R~8<9}y61wZ3iq-gP

literal 0
HcmV?d00001