@ledgerhq/revault-sdk 0.12.0

package/lib/engine.js

@@ -0,0 +1,704 @@
+import {
+  fetchAll
+} from "./chunk-VHZJP75X.js";
+import {
+  APPID_VAULT_ADMINISTRATOR,
+  PAGINATED_STATUS,
+  PATHS,
+  SCRIPT_IDS,
+  STATUS_LENGTH,
+  STREAMING_NEXT_ACTION,
+  STREAMING_RESPONSE,
+  STR_ROLES,
+  createApiDevice,
+  isTransportStatusError,
+  withDevicePolling
+} from "./chunk-DPHEFR6E.js";
+
+// src/engine/index.ts
+import invariant2 from "invariant";
+
+// src/device/real-device.ts
+import { DisconnectedDevice, LockedDeviceError } from "@ledgerhq/errors";
+import invariant from "invariant";
+import { from, lastValueFrom } from "rxjs";
+var MAX_CHUNK_LENGTH = 250;
+var FIXME_NOT_IMPLEMENTED = (fnName) => async () => {
+  throw new Error(`Not implemented: ${fnName}`);
+};
+var getPathFromPathString = (pathString) => {
+  const parts = pathString.split("'/").map((part) => parseInt(part, 10));
+  return parts.map((part) => (part | 2147483648) >>> 0);
+};
+var splitChunks = (chunk, buffer) => {
+  const chunks = [];
+  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {
+    chunks.push(buffer.slice(i, i + size));
+  }
+  return chunks;
+};
+var removeStatus = (result) => result.slice(0, result.length - STATUS_LENGTH);
+var sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH) => {
+  const chunks = splitChunks(chunkSize, data);
+  let response = Buffer.from([]);
+  for (let i = 0; i < chunks.length; i++) {
+    const chunk = chunks[i];
+    const apdu = [...command];
+    apdu[2] = i && 128;
+    response = await transport.send(apdu[0], apdu[1], apdu[2], apdu[3], chunk, [
+      36864,
+      ...PAGINATED_STATUS
+    ]);
+  }
+  return response;
+};
+var buildAttestation = (params) => {
+  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, "base64");
+  const sigLengthBuffer = Buffer.alloc(1);
+  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);
+  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, "base64");
+  const certLengthBuffer = Buffer.alloc(1);
+  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);
+  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, "base64");
+  const certChainData = Buffer.concat([
+    sigLengthBuffer,
+    sigBuffer,
+    pubBuffer,
+    certLengthBuffer,
+    certBuffer
+  ]);
+  const cliMsgBuffer = Buffer.from(params.handshake, "hex");
+  const cliMsgLengthBuffer = Buffer.alloc(1);
+  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);
+  const pidBuffer = Buffer.from(params.partitionId, "hex");
+  const pidLengthBuffer = Buffer.alloc(1);
+  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);
+  const certChainDataLengthBuff = Buffer.alloc(2);
+  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);
+  const data = Buffer.concat([
+    cliMsgLengthBuffer,
+    cliMsgBuffer,
+    certChainDataLengthBuff,
+    certChainData,
+    pidLengthBuffer,
+    pidBuffer
+  ]);
+  const totalLengthBuffer = Buffer.alloc(2);
+  totalLengthBuffer.writeUInt16BE(data.length, 0);
+  const toSend = Buffer.concat([totalLengthBuffer, data]);
+  return toSend;
+};
+var genericRetryOnError = (err) => {
+  if (err instanceof LockedDeviceError) return true;
+  if (isTransportStatusError(err) && err.statusCode === 27913) return true;
+  if (err instanceof DisconnectedDevice) return true;
+  return false;
+};
+function createRealDevice(options, logger) {
+  const { transportId } = options;
+  async function run(job, retryOnError = genericRetryOnError) {
+    return lastValueFrom(
+      withDevicePolling(transportId)((transport) => from(job(transport)), retryOnError)
+    );
+  }
+  const noRetry = () => false;
+  const poll = async () => {
+    await run(
+      // eslint-disable-next-line  @typescript-eslint/no-empty-function
+      async (_transport) => {
+      },
+      () => true
+    );
+    try {
+      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });
+      return { isAppOpened: true };
+    } catch (err) {
+      if (isTransportStatusError(err) && genericRetryOnError(err)) {
+        return { isAppOpened: false };
+      }
+      throw err;
+    }
+  };
+  const pollApp = async (appName) => {
+    const res = await run(
+      (transport) => transport.send(224, 216, 0, 0, Buffer.from(appName, "utf8"))
+    );
+    await new Promise((r) => setTimeout(r, 1e3));
+    return res.toString("hex");
+  };
+  const getPublicKey = async (pathString, { secp256k1, retryOnError }) => {
+    logger.info(`[device] getPublicKey (${pathString})`);
+    const path = getPathFromPathString(pathString);
+    const data = Buffer.concat([
+      Buffer.from([path.length]),
+      ...path.map((derivation) => {
+        const buf = Buffer.alloc(4);
+        buf.writeUInt32BE(derivation, 0);
+        return buf;
+      })
+    ]);
+    const curve = secp256k1 ? 1 : 2;
+    const response = await run(
+      (transport) => transport.send(224, 64, curve, 0, data),
+      retryOnError ?? genericRetryOnError
+    );
+    const pubKeyLength = response.readInt8(0);
+    const pubKey = response.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
+    const signature = response.slice(pubKeyLength + 1, response.length - STATUS_LENGTH).toString("base64");
+    return { pubKey, signature };
+  };
+  const device = {
+    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {
+      logger.info(`[device] Authenticate`);
+      invariant(role !== "READ_ONLY_API_KEY", "Invalid role for authenticate: READ_ONLY_API_KEY");
+      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, "hex");
+      const nameBuffer = Buffer.from(name);
+      const workspaceBuffer = Buffer.from(workspaceName);
+      const keyHandleData = Buffer.concat([
+        Buffer.from(STR_ROLES[role], "hex"),
+        Buffer.from([nameBuffer.length]),
+        nameBuffer,
+        Buffer.from([workspaceBuffer.length]),
+        workspaceBuffer
+      ]);
+      const keyHandleDataLength = Buffer.alloc(2);
+      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);
+      const data = Buffer.concat([
+        Buffer.from(challenge, "base64"),
+        applicationBuffer,
+        Buffer.from([keyHandle.length]),
+        Buffer.from(keyHandle, "hex"),
+        keyHandleDataLength,
+        keyHandleData
+      ]);
+      const authentication = await run(
+        (transport) => sendByChunk(transport, [224, 2, 0, 0], data)
+      );
+      return removeStatus(authentication).toString("hex");
+    },
+    finalizePairingHandshake: FIXME_NOT_IMPLEMENTED("finalizePairingHandshake"),
+    generateSeedFragment: FIXME_NOT_IMPLEMENTED("generateSeedFragment"),
+    generateWrappingKeyFragment: FIXME_NOT_IMPLEMENTED("generateWrappingKeyFragment"),
+    getAttestation: FIXME_NOT_IMPLEMENTED("getAttestation"),
+    getConfidentialityKey: async () => {
+      logger.info(`[device] getConfidentialityKey`);
+      const bufWithStatus = await run((transport) => transport.send(224, 77, 0, 0));
+      const buf = removeStatus(bufWithStatus);
+      const keyLength = buf[0];
+      const key = buf.slice(1, 1 + keyLength);
+      const sig = buf.slice(1 + keyLength + 1);
+      return {
+        confidentialityKeyCurve25519: key.toString("hex"),
+        confidentialityKeySignature: sig.toString("hex")
+      };
+    },
+    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),
+    getDeviceUserId: FIXME_NOT_IMPLEMENTED("getDeviceUserId"),
+    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),
+    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),
+    hasPairing: async () => {
+      logger.info(`[device] hasPairing`);
+      const apdu = [224, 81, 0, 0, 181];
+      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));
+      const hex = Buffer.from(res).toString("hex");
+      return hex !== "6f45" && hex !== "6a87";
+    },
+    initPairingHandshake: FIXME_NOT_IMPLEMENTED("initPairingHandshake"),
+    openSession: FIXME_NOT_IMPLEMENTED("openSession"),
+    register: FIXME_NOT_IMPLEMENTED("register"),
+    registerData: FIXME_NOT_IMPLEMENTED("registerData"),
+    setPairing: async ({ pairing }) => {
+      logger.info(`[device] setPairing`);
+      const psdPayload = Buffer.from(pairing.blob, "base64");
+      const length = Buffer.alloc(2);
+      length.writeUInt16BE(psdPayload.length, 0);
+      const final = Buffer.concat([length, psdPayload]);
+      await run((transport) => sendByChunk(transport, [224, 78, 0, 0], final));
+    },
+    startKKPatternAsResponder: FIXME_NOT_IMPLEMENTED("startKKPatternAsResponder"),
+    startKPatternAsResponder: async (params) => {
+      logger.info(`[device] startKPatternAsResponder`);
+      const data = buildAttestation(params);
+      await run(
+        (transport) => sendByChunk(transport, [224, 73, 0, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
+      );
+    },
+    validateVaultOperation: async (params) => {
+      logger.info(`[device] validateVaultOperation`);
+      const path = getPathFromPathString(PATHS.VALIDATION);
+      const paths = Buffer.concat([
+        Buffer.from([path.length]),
+        ...path.map((derivation) => {
+          const buf = Buffer.alloc(4);
+          buf.writeUInt32BE(derivation, 0);
+          return buf;
+        })
+      ]);
+      let nextActionId = 1;
+      let finalResponse;
+      while (!finalResponse) {
+        const screen = Buffer.from(params.actions[nextActionId - 1], "base64");
+        const length = Buffer.alloc(2);
+        length.writeUInt16BE(screen.length, 0);
+        const data = Buffer.concat([paths, length, screen]);
+        const response = await run(
+          (transport) => sendByChunk(transport, [224, 69, 0, 0], data)
+        );
+        const responseType = response.readInt8(0);
+        let responseStatus = response.readUInt16BE(response.length - 2);
+        if (responseType === STREAMING_NEXT_ACTION) {
+          nextActionId = response.readUIntBE(1, 2);
+        } else if (responseType === STREAMING_RESPONSE) {
+          finalResponse = response.slice(3, response.length - 2);
+          while (responseStatus !== 36864) {
+            const resp = await run((transport) => transport.send(0, 192, 0, 0));
+            responseStatus = resp.readUInt16BE(resp.length - 2);
+            finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);
+          }
+        } else {
+          throw Error(`${responseType}`);
+        }
+      }
+      return finalResponse.toString("base64");
+    },
+    sendAPDU: async (apduCommand) => {
+      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, "hex")));
+      return Buffer.from(res).toString("hex");
+    },
+    poll,
+    pollApp
+  };
+  return device;
+}
+
+// src/trpc.ts
+import { createTRPCClient, httpBatchLink } from "@trpc/client";
+import superjson from "superjson";
+var createClient = (options) => {
+  const trpc = createTRPCClient({
+    links: [
+      httpBatchLink({
+        url: `${options.baseUrl}/trpc`,
+        transformer: superjson,
+        headers() {
+          return {
+            ...options.debugAuthToken ? { "x-revault-debug-auth-token": options.debugAuthToken } : {},
+            ...options.rootAuthToken ? { "x-revault-root-auth-token": options.rootAuthToken } : {},
+            ...options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}
+          };
+        }
+      })
+    ]
+  });
+  return trpc;
+};
+
+// src/engine/index.ts
+async function genericRegister({
+  device,
+  name,
+  role,
+  getChallenge,
+  submitChallenge
+}) {
+  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
+    device.getAttestation(),
+    device.getU2FPubKey(),
+    device.getConfidentialityPubKey()
+  ]);
+  const ephemeralPubKey = await device.initPairingHandshake();
+  const deviceData = {
+    name,
+    pubKey: u2fPubKey.pubKey,
+    psdModel: "STAX",
+    confidentialityKey: confidentialityKey.pubKey,
+    psdEphemeralKey: ephemeralPubKey.pubKey,
+    psdEphemeralKeyAttestation: {
+      ...attestation.attestation,
+      signature: ephemeralPubKey.signature
+    }
+  };
+  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });
+  const pairingPayload = await device.finalizePairingHandshake({
+    handshake: challenge.handshake,
+    ciphertext: challenge.ciphertext
+  });
+  const register = await device.register({
+    challenge: challenge.challenge,
+    u2fRegisterData: challenge.u2fRegisterData,
+    name,
+    role
+  });
+  const validationPubKey = await device.getValidationPubKey();
+  const registerData = await device.registerData({ challenge: challenge.challenge });
+  const attestationOffset = 67 + register.u2fRegister.readInt8(66);
+  const u2fRegister = Buffer.concat([
+    register.u2fRegister.slice(0, attestationOffset),
+    Buffer.from([attestation.buffer.length]),
+    attestation.buffer,
+    register.u2fRegister.slice(attestationOffset)
+  ]).toString("hex");
+  const challengeResponse = {
+    registerData,
+    certificate: {
+      ...attestation.attestation,
+      signature: validationPubKey.signature
+    },
+    u2fRegister,
+    u2fKeyHandle: register.keyHandle.toString("hex"),
+    validationKey: validationPubKey.pubKey,
+    pairingPayload
+  };
+  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });
+}
+function createEngine(options, logger) {
+  const clientOptions = {
+    baseUrl: options.baseUrl
+  };
+  const client = createClient(clientOptions);
+  const apiDevice = createApiDevice(options, logger);
+  const base = {
+    client,
+    createClient: (overrides) => createClient({ ...clientOptions, ...overrides })
+  };
+  const withDeviceIndex = function(deviceIndex) {
+    const device = apiDevice.with(deviceIndex);
+    const withPsd = { device };
+    return decorateEngine({ ...this, ...withPsd });
+  };
+  const withTransportId = function(transportId) {
+    const device = createRealDevice({ transportId }, logger);
+    const withPsd = { device };
+    return decorateEngine({ ...this, ...withPsd });
+  };
+  const withApiUser = function() {
+    const withApiUser2 = { __isApiUser: true };
+    return decorateEngine({ ...this, ...withApiUser2 });
+  };
+  const withWorkspace = function(workspaceName) {
+    const withWorkspace2 = { __workspaceName: workspaceName };
+    return decorateEngine({ ...this, ...withWorkspace2 });
+  };
+  const withOnboarding = function(onboardingId) {
+    const withOnboarding2 = { __onboardingId: onboardingId };
+    return decorateEngine({ ...this, ...withOnboarding2 });
+  };
+  function decorateEngine(engine) {
+    function decorate(decorator) {
+      Object.assign(engine, decorator(engine));
+    }
+    if (engine.device) {
+      decorate(
+        (engine2) => ({
+          getWorkspaces: async () => {
+            const { device, client: client2 } = engine2;
+            const { pubKey } = await device.getU2FPubKey();
+            const { workspaceNames } = await client2.auth.psd.findWorkspaceNames.query({ pubKey });
+            return workspaceNames;
+          }
+        })
+      );
+    }
+    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {
+      decorate((engine2) => {
+        const { __workspaceName } = engine2;
+        return {
+          withPsdToken: function(token) {
+            const withPsdAuth = { __psdToken: token };
+            const psdAuth = `${__workspaceName}:${token}`;
+            const client2 = engine2.createClient({ psdAuth });
+            return decorateEngine({ ...this, client: client2, ...withPsdAuth });
+          }
+        };
+      });
+    }
+    if (engine.device && engine.__onboardingId) {
+      decorate((engine2) => {
+        const { device, client: client2, __onboardingId } = engine2;
+        async function enforcePairing() {
+          if (await device.hasPairing()) return;
+          const [{ pubKey }, confidentialityKey] = await Promise.all([
+            device.getU2FPubKey(),
+            device.getConfidentialityKey()
+          ]);
+          const pairing = await client2.onboarding.pairDevicePartition.mutate({
+            pubKey,
+            onboardingId: __onboardingId,
+            data: {
+              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+            }
+          });
+          await device.setPairing({ pairing });
+        }
+        return {
+          claimDevice: async (params) => {
+            const { role, deviceName } = params;
+            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([
+              device.getU2FPubKey(),
+              device.getConfidentialityPubKey()
+            ]);
+            await client2.onboarding.claimDevice.mutate({
+              onboardingId: __onboardingId,
+              claim: { role, pubKey, deviceName, confidentialityKey }
+            });
+          },
+          collectWrappingKeyFragment: async (wrappingKey) => {
+            const [{ pubKey }, confidentialityKey] = await Promise.all([
+              device.getU2FPubKey(),
+              device.getConfidentialityPubKey()
+            ]);
+            await device.openSession({
+              secureChannel: {
+                pubKey: wrappingKey.ephemeralPubKey,
+                certificate: wrappingKey.ephemeralCertificate
+              }
+            });
+            const { attestation } = await device.getAttestation();
+            const blob = await device.generateWrappingKeyFragment();
+            await client2.onboarding.submitWrappingKeyFragment.mutate({
+              pubKey,
+              onboardingId: __onboardingId,
+              fragment: {
+                blob,
+                ephemeralPubKey: confidentialityKey.pubKey,
+                ephemeralCertificate: {
+                  ...attestation,
+                  signature: confidentialityKey.signature
+                }
+              }
+            });
+          },
+          registerDevice: async (params) => {
+            const { role, name } = params;
+            const getChallengeMutation = role === "ADMIN" ? client2.onboarding.generateMasterAdminRegistrationChallenge : client2.onboarding.generateSharedOwnerRegistrationChallenge;
+            const submitChallengeMutation = role === "ADMIN" ? client2.onboarding.submitMasterAdminRegistration : client2.onboarding.submitSharedOwnerRegistration;
+            await genericRegister({
+              device,
+              name,
+              role,
+              getChallenge: ({ pubKey, deviceData }) => getChallengeMutation.mutate({
+                onboardingId: __onboardingId,
+                pubKey,
+                deviceData
+              }),
+              submitChallenge: ({ pubKey, challengeResponse }) => submitChallengeMutation.mutate({
+                onboardingId: engine2.__onboardingId,
+                pubKey,
+                // FIXME this should be renamed to `challengeResponse` on backend side
+                response: challengeResponse
+              })
+            });
+          },
+          reviewSharedOwner: async (challenge) => {
+            await enforcePairing();
+            const { pubKey } = await device.getU2FPubKey();
+            await device.startKPatternAsResponder({
+              handshake: challenge.handshake,
+              handshakeAttestation: challenge.handshakeAttestation,
+              partitionId: challenge.partitionId
+            });
+            const signature = await device.validateVaultOperation({
+              actions: challenge.wActions
+            });
+            await client2.onboarding.submitReviewByMasterAdminSignature.mutate({
+              onboardingId: __onboardingId,
+              pubKey,
+              signature
+            });
+          },
+          collectSeedFragment: async (challenge) => {
+            await enforcePairing();
+            const [{ pubKey }, { attestation }] = await Promise.all([
+              device.getU2FPubKey(),
+              device.getAttestation()
+            ]);
+            await device.startKPatternAsResponder({
+              handshake: challenge.handshake,
+              handshakeAttestation: challenge.handshakeAttestation,
+              partitionId: challenge.partitionId
+            });
+            const challengeResponse = await device.validateVaultOperation({
+              actions: challenge.wActions
+            });
+            const kkPattern = await device.startKKPatternAsResponder({
+              partitionId: challenge.partitionId,
+              handshake: challenge.kkHandshake,
+              handshakeAttestation: challenge.kkHandshakeAttestation
+            });
+            const approverBlob = await device.generateSeedFragment();
+            await client2.onboarding.submitSeedFragment.mutate({
+              onboardingId: __onboardingId,
+              pubKey,
+              seedFragment: {
+                challengeResponse,
+                approverBlob,
+                handshake: kkPattern.handshake,
+                handshakeAttestation: {
+                  ...attestation,
+                  signature: kkPattern.signature
+                }
+              }
+            });
+          }
+        };
+      });
+    }
+    if (engine.device && engine.__workspaceName && !engine.__psdToken) {
+      decorate(
+        (engine2) => {
+          const { device, client: client2, __workspaceName } = engine2;
+          return {
+            login: async function(opts) {
+              const { pubKey } = await device.getU2FPubKey();
+              const challenge = await client2.auth.psd.generateChallenge.mutate({
+                pubKey,
+                workspaceName: __workspaceName
+              });
+              opts?.onScreenDisplayed?.();
+              const authentication = await device.authenticate({
+                challenge,
+                workspaceName: __workspaceName
+              });
+              const authPayload = {
+                workspaceName: __workspaceName,
+                pubKey,
+                authentication,
+                validityDurationSecs: opts?.validityDurationSecs
+              };
+              const { token } = await client2.auth.psd.authenticate.mutate({ ...authPayload });
+              const withPsdAuth = {
+                __psdToken: token
+              };
+              const psdAuth = `${engine2.__workspaceName}:${token}`;
+              const __authClient = engine2.createClient({ psdAuth });
+              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth });
+            },
+            register: (params) => {
+              const { requestId, role, name } = params;
+              return genericRegister({
+                device,
+                name,
+                role,
+                getChallenge: async ({ deviceData }) => {
+                  const req = await client2.requests.generateRegistrationChallenge.mutate({
+                    id: params.requestId,
+                    workspaceName: __workspaceName,
+                    deviceData
+                  });
+                  const registration = req.data.registration;
+                  invariant2(
+                    registration.subState === "PENDING",
+                    "Expected sub state to be PENDING"
+                  );
+                  return registration.challenge;
+                },
+                submitChallenge: ({ challengeResponse }) => client2.requests.confirmRegistrationChallenge.mutate({
+                  workspaceName: __workspaceName,
+                  id: requestId,
+                  challengeResponse
+                })
+              });
+            }
+          };
+        }
+      );
+    }
+    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {
+      decorate(
+        (engine2) => {
+          const { client: client2, __workspaceName } = engine2;
+          return {
+            login: async function(credentials) {
+              const res = await client2.auth.authenticate.mutate({
+                apiKeyId: credentials.apiKeyId,
+                apiKeySecret: credentials.apiKeySecret,
+                workspace: __workspaceName
+              });
+              const withApiAuth = {
+                __apiAuth: res
+              };
+              const __authClient = engine2.createClient({ apiAccessToken: res.accessToken });
+              return decorateEngine({ ...this, client: __authClient, ...withApiAuth });
+            }
+          };
+        }
+      );
+    }
+    if (engine.device && engine.__workspaceName && engine.__psdToken) {
+      decorate((engine2) => {
+        const { client: client2, device } = engine2;
+        async function enforcePairing() {
+          if (await device.hasPairing()) return;
+          const confidentialityKey = await device.getConfidentialityKey();
+          const pairing = await client2.debug.pairDevicePartition.mutate({
+            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+          });
+          await device.setPairing({ pairing });
+        }
+        return {
+          approve: async (request, params) => {
+            const { challenge } = await client2.requests.getChallenge.query({ id: request.id });
+            invariant2(challenge.challengeType === "PSD", "Challenge type must be PSD");
+            await enforcePairing();
+            await device.startKPatternAsResponder({
+              handshake: challenge.handshake,
+              handshakeAttestation: challenge.handshakeAttestation,
+              partitionId: challenge.partitionId
+            });
+            params?.onScreenDisplayed?.();
+            const signature = await device.validateVaultOperation({
+              actions: challenge.wActions
+            });
+            return client2.requests.approve.mutate({
+              id: request.id,
+              data: { challengeType: "PSD", signature }
+            });
+          },
+          reject: (request) => {
+            return client2.requests.reject.mutate({ id: request.id, data: null });
+          }
+        };
+      });
+    }
+    if (engine.__workspaceName && engine.__apiAuth) {
+      decorate((engine2) => {
+        const { client: client2 } = engine2;
+        return {
+          getChallenge: async (request) => {
+            const { challenge } = await client2.requests.getChallenge.query({ id: request.id });
+            invariant2(challenge.challengeType === "API", "Challenge type must be API");
+            return challenge.payload;
+          },
+          approve: (request, signature) => {
+            return client2.requests.approve.mutate({
+              id: request.id,
+              data: { challengeType: "API", signature }
+            });
+          },
+          reject: (request, signature) => {
+            return client2.requests.reject.mutate({
+              id: request.id,
+              data: { challengeType: "API", signature }
+            });
+          }
+        };
+      });
+    }
+    return engine;
+  }
+  return {
+    ...base,
+    withDeviceIndex,
+    withTransportId,
+    withApiUser,
+    withWorkspace,
+    withOnboarding
+  };
+}
+export {
+  createEngine,
+  fetchAll
+};
+//# sourceMappingURL=engine.js.map