@ledgerhq/revault-sdk 0.21.8 → 0.21.10

package/lib/bake.cjs

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkI6B5U4JRcjs = require('./chunk-I6B5U4JR.cjs');
+var _chunkLH4QQXUHcjs = require('./chunk-LH4QQXUH.cjs');
 
 
 var _chunkP53CFOI6cjs = require('./chunk-P53CFOI6.cjs');
@@ -65,12 +65,12 @@ var flattenApprovers = (groups) => {
 };
 async function bakePledgeAdjustment(options, logger) {
   const { pledgeAdjustment, engine } = options;
-  const getDeviceIndex = _chunkI6B5U4JRcjs.createDeviceIndexResolver.call(void 0, engine);
+  const getDeviceIndex = _chunkLH4QQXUHcjs.createDeviceIndexResolver.call(void 0, engine);
   logger.info("Logging in with admin...");
   const admin = await engine.withDeviceIndex(4).login();
   logger.info("Fetching account, tradelink blueprint and network...");
   const [matchingAccounts, blueprint, network] = await Promise.all([
-    _chunkI6B5U4JRcjs.fetchAll.call(void 0, admin.client.accounts.list.query, { name: pledgeAdjustment.account }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.accounts.list.query, { name: pledgeAdjustment.account }),
     admin.client.tradelink.getNetworkBlueprint.query(),
     admin.client.tradelink.getNetwork.query()
   ]);
@@ -215,7 +215,7 @@ async function bakeWorkspace(options, logger) {
   const { workspace, engine, workspaceName } = options;
   const workspaceEngine = engine.withWorkspace(workspaceName);
   const { logTitle, logStep, logSubStep } = createBakeLogHelpers(logger);
-  const findDeviceIndex = _chunkI6B5U4JRcjs.createDeviceIndexResolver.call(void 0, workspaceEngine);
+  const findDeviceIndex = _chunkLH4QQXUHcjs.createDeviceIndexResolver.call(void 0, workspaceEngine);
   logger.info("Authenticating with two admins...");
   const [admin1, admin2] = await Promise.all([
     workspaceEngine.withDeviceIndex(4).login(),
@@ -230,11 +230,11 @@ async function bakeWorkspace(options, logger) {
     existingAccounts,
     tradelinkNetworkBlueprint
   ] = await Promise.all([
-    _chunkI6B5U4JRcjs.fetchAll.call(void 0, admin1.client.users.list.query, { status: "ACTIVE" }),
-    _chunkI6B5U4JRcjs.fetchAll.call(void 0, admin1.client.groups.list.query, { status: "ACTIVE" }),
-    _chunkI6B5U4JRcjs.fetchAll.call(void 0, admin1.client.whitelists.list.query, { status: "ACTIVE" }),
-    _chunkI6B5U4JRcjs.fetchAll.call(void 0, admin1.client.policies.list.query, { isPrivate: false }),
-    _chunkI6B5U4JRcjs.fetchAll.call(void 0, admin1.client.accounts.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.users.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.groups.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.whitelists.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.policies.list.query, { isPrivate: false }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.accounts.list.query, { status: "ACTIVE" }),
     admin1.client.tradelink.getNetworkBlueprint.query()
   ]);
   const tradelinkOrgExchangesByName = _lodash2.default.keyBy(_optionalChain([tradelinkNetworkBlueprint, 'optionalAccess', _3 => _3.exchanges]), "name");

package/lib/bake.d.cts

@@ -1,8 +1,8 @@
 import { L as Logger } from './logger-C-TPbnjv.cjs';
 import z from 'zod';
-import { E as Engine, f as WithWorkspace, c as WithDevice, l as WithPsdAuth } from './types-pUN38HdE.cjs';
+import { E as Engine, f as WithWorkspace, c as WithDevice, l as WithPsdAuth } from './types-DOi2cwia.cjs';
 import { VaultRequestResponse } from '@ledgerhq/revault-api';
-import { a as RouterInputs } from './types-Ct-F-l82.cjs';
+import { a as RouterInputs } from './types-CpGEbAxh.cjs';
 import './types-DJfbanPz.cjs';
 import '@trpc/client';
 import '@trpc/server';

package/lib/bake.d.ts

@@ -1,8 +1,8 @@
 import { L as Logger } from './logger-C-TPbnjv.js';
 import z from 'zod';
-import { E as Engine, f as WithWorkspace, c as WithDevice, l as WithPsdAuth } from './types-Dkr4g0qP.js';
+import { E as Engine, f as WithWorkspace, c as WithDevice, l as WithPsdAuth } from './types-StrV0mJs.js';
 import { VaultRequestResponse } from '@ledgerhq/revault-api';
-import { a as RouterInputs } from './types-Ct-F-l82.js';
+import { a as RouterInputs } from './types-CpGEbAxh.js';
 import './types-DJfbanPz.js';
 import '@trpc/client';
 import '@trpc/server';

package/lib/bake.js

@@ -1,7 +1,7 @@
 import {
   createDeviceIndexResolver,
   fetchAll
-} from "./chunk-IHGVWOD7.js";
+} from "./chunk-AXI72NFY.js";
 import {
   genKeys
 } from "./chunk-73OX5XDM.js";

package/lib/{chunk-IHGVWOD7.js → chunk-AXI72NFY.js}

@@ -1,10 +1,10 @@
 // src/utils.ts
 import invariant from "invariant";
-async function fetchAll(queryFn, query) {
+async function fetchAll(queryFn, query, trpcContext) {
   const res = [];
   let page = 1;
   while (page) {
-    const partial = await queryFn({ ...query, page });
+    const partial = await queryFn({ ...query, page }, trpcContext);
     res.push(...partial.results);
     page = partial.next;
   }
@@ -37,10 +37,14 @@ function createDeviceIndexResolver(engine) {
     return deviceIndex;
   };
 }
+function buildTrpcContext(opts) {
+  return opts?.correlationId ? { context: { headers: { "x-correlation-id": opts.correlationId } } } : void 0;
+}
 
 export {
   fetchAll,
   fetchAllCursor,
-  createDeviceIndexResolver
+  createDeviceIndexResolver,
+  buildTrpcContext
 };
-//# sourceMappingURL=chunk-IHGVWOD7.js.map
+//# sourceMappingURL=chunk-AXI72NFY.js.map

package/lib/chunk-AXI72NFY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils.ts"],"sourcesContent":["import type { CursorPaginated, Paginated } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { CorrelationIdOpts, Engine, WithWorkspace } from \"./engine/types\";\nimport type { TRPCContext } from \"./trpc\";\n\n/**\n * Utility function that collect results on all pages until there is no more next page\n */\nexport async function fetchAll<TData, TQuery extends { page?: number }>(\n  queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>,\n  query: TQuery,\n  trpcContext?: TRPCContext,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let page: number | null = 1;\n  while (page) {\n    const partial = await queryFn({ ...query, page }, trpcContext);\n    res.push(...partial.results);\n    page = partial.next;\n  }\n  return res;\n}\n\n/**\n * Utility function that collect results on all cursors until cursor is null\n */\nexport async function fetchAllCursor<TData, TQuery extends { cursor?: number | string }>(\n  queryFn: (query: TQuery) => Promise<CursorPaginated<TData>>,\n  query: TQuery,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let cursor: number | string | null = null;\n  do {\n    const partial = await queryFn({ ...query, ...(cursor === null ? {} : { cursor }) });\n    res.push(...partial.results);\n    cursor = partial.next;\n  } while (cursor);\n  return res;\n}\n\n/**\n * Return a function that retrieve a device index based on a given deviceUserId\n * Holds a cache of found indexes to avoid spamming device-api\n */\nexport function createDeviceIndexResolver(engine: Engine<WithWorkspace>) {\n  // Cache to avoid spamming device-api when seeking for same index multiple times\n  const _deviceUserIdByDeviceIndexCache: Record<string, Promise<string>> = {};\n\n  return async function findDeviceIndex(deviceUserId: string): Promise<number> {\n    let deviceIndex: number | null = null;\n    for (let i = 4; i < 50; i++) {\n      const promise =\n        i in _deviceUserIdByDeviceIndexCache\n          ? _deviceUserIdByDeviceIndexCache[i]!\n          : engine.withDeviceIndex(i).device.getDeviceUserId();\n      _deviceUserIdByDeviceIndexCache[i] = promise;\n      const candidate = await promise;\n      // /!\\ we need to decide in which casing we want this information\n      // -> device-api returns it in uppercase\n      // -> we save it in lowercase in revault-api DB\n      // -> doing \"safe\" comparison here by always user the uppercase version, but hey!\n      if (candidate.toUpperCase() === deviceUserId.toUpperCase()) {\n        deviceIndex = i;\n        break;\n      }\n    }\n    invariant(deviceIndex, `Could not find index for device user id ${deviceUserId}`);\n    return deviceIndex;\n  };\n}\n\nexport function buildTrpcContext(opts?: CorrelationIdOpts) {\n  return opts?.correlationId\n    ? { context: { headers: { \"x-correlation-id\": opts.correlationId } } }\n    : undefined;\n}\n"],"mappings":";AACA,OAAO,eAAe;AAQtB,eAAsB,SACpB,SACA,OACA,aACkB;AAClB,QAAM,MAAe,CAAC;AACtB,MAAI,OAAsB;AAC1B,SAAO,MAAM;AACX,UAAM,UAAU,MAAM,QAAQ,EAAE,GAAG,OAAO,KAAK,GAAG,WAAW;AAC7D,QAAI,KAAK,GAAG,QAAQ,OAAO;AAC3B,WAAO,QAAQ;AAAA,EACjB;AACA,SAAO;AACT;AAKA,eAAsB,eACpB,SACA,OACkB;AAClB,QAAM,MAAe,CAAC;AACtB,MAAI,SAAiC;AACrC,KAAG;AACD,UAAM,UAAU,MAAM,QAAQ,EAAE,GAAG,OAAO,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,OAAO,EAAG,CAAC;AAClF,QAAI,KAAK,GAAG,QAAQ,OAAO;AAC3B,aAAS,QAAQ;AAAA,EACnB,SAAS;AACT,SAAO;AACT;AAMO,SAAS,0BAA0B,QAA+B;AAEvE,QAAM,kCAAmE,CAAC;AAE1E,SAAO,eAAe,gBAAgB,cAAuC;AAC3E,QAAI,cAA6B;AACjC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,YAAM,UACJ,KAAK,kCACD,gCAAgC,CAAC,IACjC,OAAO,gBAAgB,CAAC,EAAE,OAAO,gBAAgB;AACvD,sCAAgC,CAAC,IAAI;AACrC,YAAM,YAAY,MAAM;AAKxB,UAAI,UAAU,YAAY,MAAM,aAAa,YAAY,GAAG;AAC1D,sBAAc;AACd;AAAA,MACF;AAAA,IACF;AACA,cAAU,aAAa,2CAA2C,YAAY,EAAE;AAChF,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,MAA0B;AACzD,SAAO,MAAM,gBACT,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,KAAK,cAAc,EAAE,EAAE,IACnE;AACN;","names":[]}

package/lib/{chunk-I6B5U4JR.cjs → chunk-LH4QQXUH.cjs}

@@ -1,10 +1,10 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }// src/utils.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/utils.ts
 var _invariant = require('invariant'); var _invariant2 = _interopRequireDefault(_invariant);
-async function fetchAll(queryFn, query) {
+async function fetchAll(queryFn, query, trpcContext) {
   const res = [];
   let page = 1;
   while (page) {
-    const partial = await queryFn({ ...query, page });
+    const partial = await queryFn({ ...query, page }, trpcContext);
     res.push(...partial.results);
     page = partial.next;
   }
@@ -37,10 +37,14 @@ function createDeviceIndexResolver(engine) {
     return deviceIndex;
   };
 }
+function buildTrpcContext(opts) {
+  return _optionalChain([opts, 'optionalAccess', _ => _.correlationId]) ? { context: { headers: { "x-correlation-id": opts.correlationId } } } : void 0;
+}
+
 
 
 
 
 
-exports.fetchAll = fetchAll; exports.fetchAllCursor = fetchAllCursor; exports.createDeviceIndexResolver = createDeviceIndexResolver;
-//# sourceMappingURL=chunk-I6B5U4JR.cjs.map
+exports.fetchAll = fetchAll; exports.fetchAllCursor = fetchAllCursor; exports.createDeviceIndexResolver = createDeviceIndexResolver; exports.buildTrpcContext = buildTrpcContext;
+//# sourceMappingURL=chunk-LH4QQXUH.cjs.map

package/lib/chunk-LH4QQXUH.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/chunk-LH4QQXUH.cjs","../src/utils.ts"],"names":[],"mappings":"AAAA;ACCA,4FAAsB;AAQtB,MAAA,SAAsB,QAAA,CACpB,OAAA,EACA,KAAA,EACA,WAAA,EACkB;AAClB,EAAA,MAAM,IAAA,EAAe,CAAC,CAAA;AACtB,EAAA,IAAI,KAAA,EAAsB,CAAA;AAC1B,EAAA,MAAA,CAAO,IAAA,EAAM;AACX,IAAA,MAAM,QAAA,EAAU,MAAM,OAAA,CAAQ,EAAE,GAAG,KAAA,EAAO,KAAK,CAAA,EAAG,WAAW,CAAA;AAC7D,IAAA,GAAA,CAAI,IAAA,CAAK,GAAG,OAAA,CAAQ,OAAO,CAAA;AAC3B,IAAA,KAAA,EAAO,OAAA,CAAQ,IAAA;AAAA,EACjB;AACA,EAAA,OAAO,GAAA;AACT;AAKA,MAAA,SAAsB,cAAA,CACpB,OAAA,EACA,KAAA,EACkB;AAClB,EAAA,MAAM,IAAA,EAAe,CAAC,CAAA;AACtB,EAAA,IAAI,OAAA,EAAiC,IAAA;AACrC,EAAA,GAAG;AACD,IAAA,MAAM,QAAA,EAAU,MAAM,OAAA,CAAQ,EAAE,GAAG,KAAA,EAAO,GAAI,OAAA,IAAW,KAAA,EAAO,CAAC,EAAA,EAAI,EAAE,OAAO,EAAG,CAAC,CAAA;AAClF,IAAA,GAAA,CAAI,IAAA,CAAK,GAAG,OAAA,CAAQ,OAAO,CAAA;AAC3B,IAAA,OAAA,EAAS,OAAA,CAAQ,IAAA;AAAA,EACnB,EAAA,MAAA,CAAS,MAAA,CAAA;AACT,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,yBAAA,CAA0B,MAAA,EAA+B;AAEvE,EAAA,MAAM,gCAAA,EAAmE,CAAC,CAAA;AAE1E,EAAA,OAAO,MAAA,SAAe,eAAA,CAAgB,YAAA,EAAuC;AAC3E,IAAA,IAAI,YAAA,EAA6B,IAAA;AACjC,IAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,MAAA,MAAM,QAAA,EACJ,EAAA,GAAK,gCAAA,EACD,+BAAA,CAAgC,CAAC,EAAA,EACjC,MAAA,CAAO,eAAA,CAAgB,CAAC,CAAA,CAAE,MAAA,CAAO,eAAA,CAAgB,CAAA;AACvD,MAAA,+BAAA,CAAgC,CAAC,EAAA,EAAI,OAAA;AACrC,MAAA,MAAM,UAAA,EAAY,MAAM,OAAA;AAKxB,MAAA,GAAA,CAAI,SAAA,CAAU,WAAA,CAAY,EAAA,IAAM,YAAA,CAAa,WAAA,CAAY,CAAA,EAAG;AAC1D,QAAA,YAAA,EAAc,CAAA;AACd,QAAA,KAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,iCAAA,WAAU,EAAa,CAAA,wCAAA,EAA2C,YAAY,CAAA,CAAA;AACvE,IAAA;AACT,EAAA;AACF;AAE2D;AAEJ,EAAA;AAEvD;ADlCmF;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/chunk-LH4QQXUH.cjs","sourcesContent":[null,"import type { CursorPaginated, Paginated } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { CorrelationIdOpts, Engine, WithWorkspace } from \"./engine/types\";\nimport type { TRPCContext } from \"./trpc\";\n\n/**\n * Utility function that collect results on all pages until there is no more next page\n */\nexport async function fetchAll<TData, TQuery extends { page?: number }>(\n  queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>,\n  query: TQuery,\n  trpcContext?: TRPCContext,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let page: number | null = 1;\n  while (page) {\n    const partial = await queryFn({ ...query, page }, trpcContext);\n    res.push(...partial.results);\n    page = partial.next;\n  }\n  return res;\n}\n\n/**\n * Utility function that collect results on all cursors until cursor is null\n */\nexport async function fetchAllCursor<TData, TQuery extends { cursor?: number | string }>(\n  queryFn: (query: TQuery) => Promise<CursorPaginated<TData>>,\n  query: TQuery,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let cursor: number | string | null = null;\n  do {\n    const partial = await queryFn({ ...query, ...(cursor === null ? {} : { cursor }) });\n    res.push(...partial.results);\n    cursor = partial.next;\n  } while (cursor);\n  return res;\n}\n\n/**\n * Return a function that retrieve a device index based on a given deviceUserId\n * Holds a cache of found indexes to avoid spamming device-api\n */\nexport function createDeviceIndexResolver(engine: Engine<WithWorkspace>) {\n  // Cache to avoid spamming device-api when seeking for same index multiple times\n  const _deviceUserIdByDeviceIndexCache: Record<string, Promise<string>> = {};\n\n  return async function findDeviceIndex(deviceUserId: string): Promise<number> {\n    let deviceIndex: number | null = null;\n    for (let i = 4; i < 50; i++) {\n      const promise =\n        i in _deviceUserIdByDeviceIndexCache\n          ? _deviceUserIdByDeviceIndexCache[i]!\n          : engine.withDeviceIndex(i).device.getDeviceUserId();\n      _deviceUserIdByDeviceIndexCache[i] = promise;\n      const candidate = await promise;\n      // /!\\ we need to decide in which casing we want this information\n      // -> device-api returns it in uppercase\n      // -> we save it in lowercase in revault-api DB\n      // -> doing \"safe\" comparison here by always user the uppercase version, but hey!\n      if (candidate.toUpperCase() === deviceUserId.toUpperCase()) {\n        deviceIndex = i;\n        break;\n      }\n    }\n    invariant(deviceIndex, `Could not find index for device user id ${deviceUserId}`);\n    return deviceIndex;\n  };\n}\n\nexport function buildTrpcContext(opts?: CorrelationIdOpts) {\n  return opts?.correlationId\n    ? { context: { headers: { \"x-correlation-id\": opts.correlationId } } }\n    : undefined;\n}\n"]}

package/lib/engine.cjs

@@ -1,7 +1,8 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkI6B5U4JRcjs = require('./chunk-I6B5U4JR.cjs');
+
+var _chunkLH4QQXUHcjs = require('./chunk-LH4QQXUH.cjs');
 
 
 
@@ -358,12 +359,15 @@ var createClient = (options) => {
       _client.httpLink.call(void 0, {
         url: `${options.baseUrl}/trpc`,
         transformer: _superjson2.default,
-        headers() {
+        headers(opts) {
+          const contextHeaders = _optionalChain([opts, 'access', _2 => _2.op, 'access', _3 => _3.context, 'optionalAccess', _4 => _4.headers]) || {};
           return {
             ...options.debugAuthToken ? { "x-revault-debug-auth-token": options.debugAuthToken } : {},
             ...options.rootAuthToken ? { "x-revault-root-auth-token": options.rootAuthToken } : {},
             ...options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {},
-            ...options.apiAccessToken ? { Authorization: `Bearer ${options.apiAccessToken}` } : {}
+            ...options.apiAccessToken ? { Authorization: `Bearer ${options.apiAccessToken}` } : {},
+            // Merge in any headers passed via context
+            ...contextHeaders
           };
         }
       })
@@ -631,11 +635,14 @@ function createEngine(options, logger) {
           return {
             login: async function(opts) {
               const { pubKey } = await device.getU2FPubKey();
-              const challenge = await client2.auth.psd.generateChallenge.mutate({
-                pubKey,
-                workspaceName: __workspaceName
-              });
-              _optionalChain([opts, 'optionalAccess', _2 => _2.onScreenDisplayed, 'optionalCall', _3 => _3()]);
+              const challenge = await client2.auth.psd.generateChallenge.mutate(
+                {
+                  pubKey,
+                  workspaceName: __workspaceName
+                },
+                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _5 => _5.correlationId]) })
+              );
+              await _optionalChain([opts, 'optionalAccess', _6 => _6.onScreenDisplayed, 'optionalCall', _7 => _7()]);
               const authentication = await device.authenticate({
                 challenge,
                 workspaceName: __workspaceName
@@ -644,9 +651,12 @@ function createEngine(options, logger) {
                 workspaceName: __workspaceName,
                 pubKey,
                 authentication,
-                validityDurationSecs: _optionalChain([opts, 'optionalAccess', _4 => _4.validityDurationSecs])
+                validityDurationSecs: _optionalChain([opts, 'optionalAccess', _8 => _8.validityDurationSecs])
               };
-              const { token } = await client2.auth.psd.authenticate.mutate({ ...authPayload });
+              const { token } = await client2.auth.psd.authenticate.mutate(
+                { ...authPayload },
+                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _9 => _9.correlationId]) })
+              );
               const withPsdAuth = {
                 __psdToken: token
               };
@@ -683,12 +693,15 @@ function createEngine(options, logger) {
         (engine2) => {
           const { client: client2, __workspaceName } = engine2;
           return {
-            login: async function(credentials) {
-              const res = await client2.auth.authenticate.mutate({
-                apiKeyId: credentials.apiKeyId,
-                apiKeySecret: credentials.apiKeySecret,
-                workspace: __workspaceName
-              });
+            login: async function(credentials, opts) {
+              const res = await client2.auth.authenticate.mutate(
+                {
+                  apiKeyId: credentials.apiKeyId,
+                  apiKeySecret: credentials.apiKeySecret,
+                  workspace: __workspaceName
+                },
+                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _10 => _10.correlationId]) })
+              );
               const withApiAuth = {
                 __apiAuth: res
               };
@@ -718,7 +731,7 @@ function createEngine(options, logger) {
             handshakeAttestation: challenge.handshakeAttestation,
             partitionId: challenge.partitionId
           });
-          _optionalChain([params, 'optionalAccess', _5 => _5.onScreenDisplayed, 'optionalCall', _6 => _6()]);
+          await _optionalChain([params, 'optionalAccess', _11 => _11.onScreenDisplayed, 'optionalCall', _12 => _12()]);
           const signature = await device.validateVaultOperation({
             actions: challenge.wActions
           });
@@ -729,14 +742,20 @@ function createEngine(options, logger) {
             const { challenge } = await client2.requests.getChallenge.query({ id: request.id });
             _invariant2.default.call(void 0, challenge.challengeType === "PSD", "Challenge type must be PSD");
             const signature = await approveChallenge(challenge, params);
-            return client2.requests.approve.mutate({
-              id: request.id,
-              data: { challengeType: "PSD", signature }
-            });
+            return client2.requests.approve.mutate(
+              {
+                id: request.id,
+                data: { challengeType: "PSD", signature }
+              },
+              _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, params)
+            );
           },
           approveChallenge,
-          reject: (request) => {
-            return client2.requests.reject.mutate({ id: request.id, data: null });
+          reject: (request, opts) => {
+            return client2.requests.reject.mutate(
+              { id: request.id, data: null },
+              _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, opts)
+            );
           }
         };
       });
@@ -780,6 +799,6 @@ function createEngine(options, logger) {
 
 
 
-exports.createEngine = createEngine; exports.fetchAll = _chunkI6B5U4JRcjs.fetchAll; exports.fetchAllCursor = _chunkI6B5U4JRcjs.fetchAllCursor;
+exports.createEngine = createEngine; exports.fetchAll = _chunkLH4QQXUHcjs.fetchAll; exports.fetchAllCursor = _chunkLH4QQXUHcjs.fetchAllCursor;
 /* v8 ignore next -- @preserve */
 //# sourceMappingURL=engine.cjs.map

package/lib/engine.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"names":["withApiUser","withWorkspace","withOnboarding","client","engine"],"mappings":"AAAA;AACE;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACNA,4FAAsB;ADQtB;AACA;AErBA,0CAAsD;AAGtD;AACA,4BAAoC;AAkBpC,IAAM,iBAAA,EAAmB,GAAA;AAMzB,IAAM,sBAAA,EACJ,CAAC,MAAA,EAAA,GACD,MAAA,CAAA,EAAA,GAAY;AACV,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAA;AAC5C;AAE8D;AACpB,EAAA;AACP,EAAA;AACrC;AAEiE;AAC/C,EAAA;AACyB,EAAA;AACF,IAAA;AACvC,EAAA;AACO,EAAA;AACT;AAE8D;AAK5D;AAG0C,EAAA;AACb,EAAA;AACW,EAAA;AAChB,IAAA;AACE,IAAA;AAGT,IAAA;AAC4B,IAAA;AACzC,MAAA;AACG,MAAA;AACJ,IAAA;AACH,EAAA;AACO,EAAA;AACT;AAMc;AACyB,EAAA;AACC,EAAA;AACA,EAAA;AAEA,EAAA;AACC,EAAA;AACC,EAAA;AAEH,EAAA;AAED,EAAA;AAClC,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAEuC,EAAA;AACC,EAAA;AACV,EAAA;AAEM,EAAA;AACC,EAAA;AACA,EAAA;AAEC,EAAA;AACD,EAAA;AAEX,EAAA;AACzB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAEuC,EAAA;AACH,EAAA;AAEP,EAAA;AAEvB,EAAA;AACT;AAImD;AAEX,EAAA;AAEC,EAAA;AAEA,EAAA;AAGhC,EAAA;AACT;AAE2E;AACjD,EAAA;AAIO,EAAA;AAEtB,IAAA;AAC8B,MAAA;AACrC,IAAA;AACF,EAAA;AAG+B,EAAA;AAEI,EAAA;AAGK,EAAA;AAEhC,IAAA;AAAA;AAEkB,MAAA;AAAC,MAAA;AACF,uBAAA;AACvB,IAAA;AAEI,IAAA;AAC8B,MAAA;AACL,MAAA;AACf,IAAA;AACuB,MAAA;AACL,QAAA;AAC9B,MAAA;AACM,MAAA;AACR,IAAA;AACF,EAAA;AAE4D,EAAA;AACxC,IAAA;AACK,MAAA;AACvB,IAAA;AAEuC,IAAA;AACd,IAAA;AAC3B,EAAA;AAII,EAAA;AAEoC,IAAA;AACH,IAAA;AACR,IAAA;AACA,MAAA;AACG,MAAA;AACA,QAAA;AACK,QAAA;AACxB,QAAA;AACR,MAAA;AACF,IAAA;AACgC,IAAA;AACV,IAAA;AACqB,MAAA;AAC1B,uBAAA;AAClB,IAAA;AACwC,IAAA;AAE5B,IAAA;AAIH,IAAA;AAEkB,IAAA;AAC7B,EAAA;AAEuB,EAAA;AACe,IAAA;AACC,MAAA;AAChB,MAAA;AACmB,MAAA;AACH,MAAA;AACC,MAAA;AAEA,MAAA;AACA,QAAA;AACH,QAAA;AAC/B,QAAA;AACoC,QAAA;AACpC,QAAA;AACD,MAAA;AAEkC,MAAA;AACD,MAAA;AAEP,MAAA;AACM,QAAA;AAC/B,QAAA;AAC8B,QAAA;AACF,QAAA;AAC5B,QAAA;AACA,QAAA;AACD,MAAA;AAE4B,MAAA;AACf,QAAA;AACd,MAAA;AAEoC,MAAA;AACtC,IAAA;AAEiC,IAAA;AAKH,MAAA;AACd,QAAA;AACd,MAAA;AACmC,MAAA;AACrC,IAAA;AAEsB,IAAA;AACO,IAAA;AAQvB,IAAA;AAC6B,MAAA;AACL,MAAA;AACS,MAAA;AAC9B,MAAA;AACQ,QAAA;AACmB,UAAA;AACG,UAAA;AACE,UAAA;AACrC,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACmC,IAAA;AACrB,MAAA;AACqB,MAAA;AACK,MAAA;AACf,MAAA;AACe,MAAA;AACC,MAAA;AAChC,MAAA;AAC6B,QAAA;AACD,QAAA;AACnC,MAAA;AACF,IAAA;AACgC,IAAA;AACO,IAAA;AACA,IAAA;AACC,IAAA;AAChB,IAAA;AACW,MAAA;AACS,MAAA;AACL,MAAA;AACC,MAAA;AAUL,MAAA;AACnC,IAAA;AAEkF,IAAA;AAC3C,MAAA;AACF,MAAA;AAEvB,MAAA;AAGgB,MAAA;AACD,MAAA;AAC7B,IAAA;AAEmC,IAAA;AAY7B,IAAA;AAC6B,MAAA;AACH,MAAA;AAEK,MAAA;AACA,MAAA;AACC,MAAA;AAEC,MAAA;AAED,MAAA;AACA,QAAA;AACD,QAAA;AACjC,QAAA;AACD,MAAA;AAEkC,MAAA;AACD,MAAA;AAEK,MAAA;AAEhB,MAAA;AACT,QAAA;AACd,MAAA;AAEQ,MAAA;AAC8B,MAAA;AACjC,MAAA;AACkC,MAAA;AAClC,MAAA;AACkC,MAAA;AACvC,MAAA;AACoC,MAAA;AAC/B,MAAA;AACE,MAAA;AAC6B,QAAA;AAClC,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACwE,IAAA;AAClC,MAAA;AACN,MAAA;AACK,MAAA;AACP,MAAA;AACW,MAAA;AACzC,IAAA;AAEmC,IAAA;AACA,MAAA;AACM,MAAA;AACV,MAAA;AACG,MAAA;AACK,MAAA;AACA,MAAA;AACvC,IAAA;AAC2B,IAAA;AACM,IAAA;AACnB,MAAA;AACwB,MAAA;AAC9B,MAAA;AACQ,QAAA;AACd,MAAA;AACF,IAAA;AAC+B,IAAA;AACjB,MAAA;AACuB,MAAA;AACP,MAAA;AACD,QAAA;AACG,QAAA;AACA,UAAA;AACK,UAAA;AACxB,UAAA;AACR,QAAA;AACF,MAAA;AAEkB,MAAA;AACgB,MAAA;AAEZ,MAAA;AACa,QAAA;AACL,QAAA;AACQ,QAAA;AACF,QAAA;AACZ,QAAA;AACT,UAAA;AACd,QAAA;AAC8B,QAAA;AACA,QAAA;AACR,QAAA;AACf,UAAA;AACqB,YAAA;AACxB,YAAA;AACG,UAAA;AAC4B,YAAA;AACG,YAAA;AACE,cAAA;AACR,gBAAA;AACF,gBAAA;AACC,gBAAA;AACzB,cAAA;AACF,YAAA;AACA,YAAA;AAAA;AAEF,UAAA;AACkB,YAAA;AACpB,QAAA;AACF,MAAA;AACsC,MAAA;AACxC,IAAA;AAEyC,IAAA;AACF,MAAA;AACC,MAAA;AACxC,IAAA;AACwB,IAAA;AACe,MAAA;AACJ,MAAA;AACM,MAAA;AACH,MAAA;AAEL,MAAA;AAExB,MAAA;AACT,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACO,EAAA;AACT;AFpH6C;AACA;AG9Ve;AAEtC;AAe4D;AACvC,EAAA;AAChC,IAAA;AACI,MAAA;AACgB,QAAA;AACV,QAAA;AACH,QAAA;AACD,UAAA;AAEC,YAAA;AAGA,YAAA;AAEkB,YAAA;AAElB,YAAA;AAER,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AACD,EAAA;AACM,EAAA;AACT;AH2U6C;AACA;AC3UX;AAChC,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAaa;AACkB,EAAA;AACP,IAAA;AACF,IAAA;AACY,IAAA;AACjC,EAAA;AACoC,EAAA;AACU,EAAA;AAC7C,IAAA;AACkB,IAAA;AACR,IAAA;AAC6B,IAAA;AACN,IAAA;AACL,IAAA;AACX,MAAA;AACY,MAAA;AAC7B,IAAA;AACF,EAAA;AACuC,EAAA;AACH,EAAA;AACb,IAAA;AACE,IAAA;AACS,IAAA;AACjC,EAAA;AACsC,EAAA;AAChB,IAAA;AACM,IAAA;AAC3B,IAAA;AACA,IAAA;AACD,EAAA;AACqC,EAAA;AACJ,EAAA;AACM,EAAA;AACN,EAAA;AACF,IAAA;AACS,IAAA;AAC3B,IAAA;AACe,IAAA;AACZ,EAAA;AAC4C,EAAA;AAC3D,IAAA;AACa,IAAA;AACI,MAAA;AACa,MAAA;AAC9B,IAAA;AACA,IAAA;AACiC,IAAA;AACD,IAAA;AAChC,IAAA;AACF,EAAA;AAC2C,EAAA;AAC7C;AAE6E;AAClC,EAAA;AACtB,IAAA;AACnB,EAAA;AACyC,EAAA;AACE,EAAA;AAElB,EAAA;AACvB,IAAA;AAC6B,IAAA;AAC/B,EAAA;AAIE,EAAA;AAEyC,IAAA;AACJ,IAAA;AACD,IAAA;AACtC,EAAA;AAIE,EAAA;AAEkC,IAAA;AACG,IAAA;AACD,IAAA;AACtC,EAAA;AAEyE,EAAA;AAClB,IAAA;AACjBA,IAAAA;AACtC,EAAA;AAIE,EAAA;AAEuC,IAAA;AACHC,IAAAA;AACtC,EAAA;AAIE,EAAA;AAEyC,IAAA;AACLC,IAAAA;AACtC,EAAA;AASa,EAAA;AAGH,IAAA;AAC2D,MAAA;AACnE,IAAA;AAImB,IAAA;AACjB,MAAA;AAEK,QAAA;AAC+C,UAAA;AACrB,YAAA;AACS,YAAA;AACCC,YAAAA;AAC1B,YAAA;AACT,UAAA;AACF,QAAA;AACJ,MAAA;AACF,IAAA;AAIsC,IAAA;AACyC,MAAA;AAC/CC,QAAAA;AACrB,QAAA;AAC+E,UAAA;AAC/C,YAAA;AAChB,YAAA;AACG,YAAA;AACW,YAAA;AACnC,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4B,IAAA;AACyD,MAAA;AACzD,QAAA;AACuB,QAAA;AACd,UAAA;AACZ,UAAA;AACG,YAAA;AACS,YAAA;AAC9B,UAAA;AAC4B,UAAA;AAC3B,YAAA;AACc,YAAA;AACR,YAAA;AAC0B,cAAA;AACD,cAAA;AAC/B,YAAA;AACD,UAAA;AACkC,UAAA;AACrC,QAAA;AACO,QAAA;AACoF,UAAA;AAC1D,YAAA;AACA,YAAA;AACP,cAAA;AACb,cAAA;AACR,YAAA;AACuB,YAAA;AACR,cAAA;AACS,cAAA;AACxB,YAAA;AACH,UAAA;AAEmC,UAAA;AACd,YAAA;AACG,cAAA;AACb,cAAA;AACR,YAAA;AACwB,YAAA;AACR,cAAA;AACO,gBAAA;AACK,gBAAA;AAC3B,cAAA;AACD,YAAA;AAC6B,YAAA;AACJ,YAAA;AACF,YAAA;AACtB,cAAA;AACc,cAAA;AACJ,cAAA;AACR,gBAAA;AACiB,gBAAA;AACK,gBAAA;AACjB,kBAAA;AACQ,kBAAA;AACb,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AAEiF,UAAA;AACxD,YAAA;AAErB,YAAA;AAIA,YAAA;AAGoB,YAAA;AACpB,cAAA;AACA,cAAA;AACA,cAAA;AACyB,cAAA;AAEP,gBAAA;AACd,gBAAA;AACA,gBAAA;AACD,cAAA;AACyB,cAAA;AAEH,gBAAA;AACrB,gBAAA;AAAA;AAEU,gBAAA;AACX,cAAA;AACJ,YAAA;AACH,UAAA;AAE0B,UAAA;AACH,YAAA;AACW,YAAA;AACnB,YAAA;AACU,cAAA;AACC,cAAA;AACC,cAAA;AACxB,YAAA;AAC8B,YAAA;AACV,cAAA;AACpB,YAAA;AACuB,YAAA;AACR,cAAA;AACd,cAAA;AACA,cAAA;AACD,YAAA;AACH,UAAA;AAE4B,UAAA;AACL,YAAA;AACY,YAAA;AACX,cAAA;AACE,cAAA;AACvB,YAAA;AACY,YAAA;AACU,cAAA;AACC,cAAA;AACC,cAAA;AACxB,YAAA;AAC+B,YAAA;AACX,cAAA;AACpB,YAAA;AAC8B,YAAA;AACN,cAAA;AACF,cAAA;AACC,cAAA;AACvB,YAAA;AAC0B,YAAA;AACH,YAAA;AACR,cAAA;AACd,cAAA;AACc,cAAA;AACZ,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACC,gBAAA;AACjB,kBAAA;AACkB,kBAAA;AACvB,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4B,IAAA;AAC1B,MAAA;AACc,QAAA;AACc,UAAA;AACjB,UAAA;AAI+B,YAAA;AACT,cAAA;AACDD,cAAAA;AACtB,gBAAA;AACe,gBAAA;AAChB,cAAA;AACyB,8BAAA;AACG,cAAA;AAC3B,gBAAA;AACe,gBAAA;AAChB,cAAA;AACmB,cAAA;AACH,gBAAA;AACf,gBAAA;AACA,gBAAA;AAC4B,gBAAA;AAC9B,cAAA;AACwBA,cAAAA;AACS,cAAA;AACnB,gBAAA;AACd,cAAA;AAC0B,cAAA;AACE,cAAA;AACD,cAAA;AAG7B,YAAA;AAIwC,YAAA;AACf,cAAA;AACrB,gBAAA;AACmB,gBAAA;AACA,gBAAA;AACI,gBAAA;AACGA,kBAAAA;AACL,oBAAA;AACF,oBAAA;AACf,oBAAA;AACD,kBAAA;AACM,kBAAA;AACT,gBAAA;AACoB,gBAAA;AAED,kBAAA;AACE,kBAAA;AACjB,kBAAA;AACD,gBAAA;AACJ,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAIqC,IAAA;AACnC,MAAA;AACc,QAAA;AACM,UAAA;AACT,UAAA;AAGH,YAAA;AAK8B,cAAA;AACN,gBAAA;AACI,gBAAA;AACf,gBAAA;AACZ,cAAA;AACgC,cAAA;AACpB,gBAAA;AACb,cAAA;AAC4B,cAAA;AACD,cAAA;AAG7B,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAI4B,IAAA;AAC8D,MAAA;AAC3DC,QAAAA;AAEoB,QAAA;AACd,UAAA;AACE,UAAA;AACJ,UAAA;AACG,YAAA;AACD,YAAA;AAC9B,UAAA;AACkC,UAAA;AACrC,QAAA;AAGE,QAAA;AAGqB,UAAA;AACR,UAAA;AACU,YAAA;AACW,YAAA;AACT,YAAA;AACxB,UAAA;AAC2B,0BAAA;AACG,UAAA;AACV,YAAA;AACpB,UAAA;AACM,UAAA;AACT,QAAA;AAEO,QAAA;AAGH,UAAA;AAE4BD,YAAAA;AACR,YAAA;AACI,YAAA;AACO,YAAA;AACjB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AAEA,UAAA;AAE0E,UAAA;AAC1C,YAAA;AAChC,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIqC,IAAA;AACsD,MAAA;AACpEC,QAAAA;AACZ,QAAA;AACoF,UAAA;AAC3DD,YAAAA;AACR,YAAA;AACH,YAAA;AACnB,UAAA;AAKoC,UAAA;AACH,YAAA;AACjB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AAKoC,UAAA;AACJ,YAAA;AAChB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAEO,IAAA;AACT,EAAA;AAEO,EAAA;AACF,IAAA;AACH,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;AD4N6C;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","sourcesContent":[null,"import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type TRPCClientOptions } from \"@/trpc\";\n\nimport type {\n  ApproveRequestParams,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (wrappingKey: WrappingKeyResponse): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (params: RegisterOnboardingDeviceParams): Promise<void> => {\n            const { role, name } = params;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n            });\n          },\n\n          reviewSharedOwner: async (challenge: PsdChallenge): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (challenge: OnboardingSeedChallenge): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: { validityDurationSecs?: number; onScreenDisplayed?: () => void },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate({\n                pubKey,\n                workspaceName: __workspaceName,\n              });\n              opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate({ ...authPayload });\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate({\n                apiKeyId: credentials.apiKeyId,\n                apiKeySecret: credentials.apiKeySecret,\n                workspace: __workspaceName,\n              });\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"PSD\", \"Challenge type must be PSD\");\n            const signature = await approveChallenge(challenge, params);\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"PSD\", signature },\n            });\n          },\n\n          approveChallenge,\n\n          reject: (request: VaultRequestResponse): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({ id: request.id, data: null });\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst FIXME_NOT_IMPLEMENTED =\n  (fnName: string): (() => Promise<never>) =>\n  async () => {\n    throw new Error(`Not implemented: ${fnName}`);\n  };\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: FIXME_NOT_IMPLEMENTED(\"generateSeedFragment\"),\n    generateWrappingKeyFragment: FIXME_NOT_IMPLEMENTED(\"generateWrappingKeyFragment\"),\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: FIXME_NOT_IMPLEMENTED(\"getDeviceUserId\"),\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: FIXME_NOT_IMPLEMENTED(\"openSession\"),\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: FIXME_NOT_IMPLEMENTED(\"startKKPatternAsResponder\"),\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers() {\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n"]}
+{"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"names":["withApiUser","withWorkspace","withOnboarding","client","engine"],"mappings":"AAAA;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACPA,4FAAsB;ADStB;AACA;AEtBA,0CAAsD;AAGtD;AACA,4BAAoC;AAkBpC,IAAM,iBAAA,EAAmB,GAAA;AAMzB,IAAM,sBAAA,EACJ,CAAC,MAAA,EAAA,GACD,MAAA,CAAA,EAAA,GAAY;AACV,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAA;AAC5C;AAE8D;AACpB,EAAA;AACP,EAAA;AACrC;AAEiE;AAC/C,EAAA;AACyB,EAAA;AACF,IAAA;AACvC,EAAA;AACO,EAAA;AACT;AAE8D;AAK5D;AAG0C,EAAA;AACb,EAAA;AACW,EAAA;AAChB,IAAA;AACE,IAAA;AAGT,IAAA;AAC4B,IAAA;AACzC,MAAA;AACG,MAAA;AACJ,IAAA;AACH,EAAA;AACO,EAAA;AACT;AAMc;AACyB,EAAA;AACC,EAAA;AACA,EAAA;AAEA,EAAA;AACC,EAAA;AACC,EAAA;AAEH,EAAA;AAED,EAAA;AAClC,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAEuC,EAAA;AACC,EAAA;AACV,EAAA;AAEM,EAAA;AACC,EAAA;AACA,EAAA;AAEC,EAAA;AACD,EAAA;AAEX,EAAA;AACzB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAEuC,EAAA;AACH,EAAA;AAEP,EAAA;AAEvB,EAAA;AACT;AAImD;AAEX,EAAA;AAEC,EAAA;AAEA,EAAA;AAGhC,EAAA;AACT;AAE2E;AACjD,EAAA;AAIO,EAAA;AAEtB,IAAA;AAC8B,MAAA;AACrC,IAAA;AACF,EAAA;AAG+B,EAAA;AAEI,EAAA;AAGK,EAAA;AAEhC,IAAA;AAAA;AAEkB,MAAA;AAAC,MAAA;AACF,uBAAA;AACvB,IAAA;AAEI,IAAA;AAC8B,MAAA;AACL,MAAA;AACf,IAAA;AACuB,MAAA;AACL,QAAA;AAC9B,MAAA;AACM,MAAA;AACR,IAAA;AACF,EAAA;AAE4D,EAAA;AACxC,IAAA;AACK,MAAA;AACvB,IAAA;AAEuC,IAAA;AACd,IAAA;AAC3B,EAAA;AAII,EAAA;AAEoC,IAAA;AACH,IAAA;AACR,IAAA;AACA,MAAA;AACG,MAAA;AACA,QAAA;AACK,QAAA;AACxB,QAAA;AACR,MAAA;AACF,IAAA;AACgC,IAAA;AACV,IAAA;AACqB,MAAA;AAC1B,uBAAA;AAClB,IAAA;AACwC,IAAA;AAE5B,IAAA;AAIH,IAAA;AAEkB,IAAA;AAC7B,EAAA;AAEuB,EAAA;AACe,IAAA;AACC,MAAA;AAChB,MAAA;AACmB,MAAA;AACH,MAAA;AACC,MAAA;AAEA,MAAA;AACA,QAAA;AACH,QAAA;AAC/B,QAAA;AACoC,QAAA;AACpC,QAAA;AACD,MAAA;AAEkC,MAAA;AACD,MAAA;AAEP,MAAA;AACM,QAAA;AAC/B,QAAA;AAC8B,QAAA;AACF,QAAA;AAC5B,QAAA;AACA,QAAA;AACD,MAAA;AAE4B,MAAA;AACf,QAAA;AACd,MAAA;AAEoC,MAAA;AACtC,IAAA;AAEiC,IAAA;AAKH,MAAA;AACd,QAAA;AACd,MAAA;AACmC,MAAA;AACrC,IAAA;AAEsB,IAAA;AACO,IAAA;AAQvB,IAAA;AAC6B,MAAA;AACL,MAAA;AACS,MAAA;AAC9B,MAAA;AACQ,QAAA;AACmB,UAAA;AACG,UAAA;AACE,UAAA;AACrC,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACmC,IAAA;AACrB,MAAA;AACqB,MAAA;AACK,MAAA;AACf,MAAA;AACe,MAAA;AACC,MAAA;AAChC,MAAA;AAC6B,QAAA;AACD,QAAA;AACnC,MAAA;AACF,IAAA;AACgC,IAAA;AACO,IAAA;AACA,IAAA;AACC,IAAA;AAChB,IAAA;AACW,MAAA;AACS,MAAA;AACL,MAAA;AACC,MAAA;AAUL,MAAA;AACnC,IAAA;AAEkF,IAAA;AAC3C,MAAA;AACF,MAAA;AAEvB,MAAA;AAGgB,MAAA;AACD,MAAA;AAC7B,IAAA;AAEmC,IAAA;AAY7B,IAAA;AAC6B,MAAA;AACH,MAAA;AAEK,MAAA;AACA,MAAA;AACC,MAAA;AAEC,MAAA;AAED,MAAA;AACA,QAAA;AACD,QAAA;AACjC,QAAA;AACD,MAAA;AAEkC,MAAA;AACD,MAAA;AAEK,MAAA;AAEhB,MAAA;AACT,QAAA;AACd,MAAA;AAEQ,MAAA;AAC8B,MAAA;AACjC,MAAA;AACkC,MAAA;AAClC,MAAA;AACkC,MAAA;AACvC,MAAA;AACoC,MAAA;AAC/B,MAAA;AACE,MAAA;AAC6B,QAAA;AAClC,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACwE,IAAA;AAClC,MAAA;AACN,MAAA;AACK,MAAA;AACP,MAAA;AACW,MAAA;AACzC,IAAA;AAEmC,IAAA;AACA,MAAA;AACM,MAAA;AACV,MAAA;AACG,MAAA;AACK,MAAA;AACA,MAAA;AACvC,IAAA;AAC2B,IAAA;AACM,IAAA;AACnB,MAAA;AACwB,MAAA;AAC9B,MAAA;AACQ,QAAA;AACd,MAAA;AACF,IAAA;AAC+B,IAAA;AACjB,MAAA;AACuB,MAAA;AACP,MAAA;AACD,QAAA;AACG,QAAA;AACA,UAAA;AACK,UAAA;AACxB,UAAA;AACR,QAAA;AACF,MAAA;AAEkB,MAAA;AACgB,MAAA;AAEZ,MAAA;AACa,QAAA;AACL,QAAA;AACQ,QAAA;AACF,QAAA;AACZ,QAAA;AACT,UAAA;AACd,QAAA;AAC8B,QAAA;AACA,QAAA;AACR,QAAA;AACf,UAAA;AACqB,YAAA;AACxB,YAAA;AACG,UAAA;AAC4B,YAAA;AACG,YAAA;AACE,cAAA;AACR,gBAAA;AACF,gBAAA;AACC,gBAAA;AACzB,cAAA;AACF,YAAA;AACA,YAAA;AAAA;AAEF,UAAA;AACkB,YAAA;AACpB,QAAA;AACF,MAAA;AACsC,MAAA;AACxC,IAAA;AAEyC,IAAA;AACF,MAAA;AACC,MAAA;AACxC,IAAA;AACwB,IAAA;AACe,MAAA;AACJ,MAAA;AACM,MAAA;AACH,MAAA;AAEL,MAAA;AAExB,MAAA;AACT,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACO,EAAA;AACT;AFnH6C;AACA;AG/Ve;AAEtC;AAiB4D;AACvC,EAAA;AAChC,IAAA;AACI,MAAA;AACgB,QAAA;AACV,QAAA;AACC,QAAA;AAEoB,UAAA;AAEzB,UAAA;AAEC,YAAA;AAGA,YAAA;AAEkB,YAAA;AAElB,YAAA;AACD;AAEF,YAAA;AACL,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AACD,EAAA;AACM,EAAA;AACT;AHwU6C;AACA;AC7UX;AAChC,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAaa;AACkB,EAAA;AACP,IAAA;AACF,IAAA;AACY,IAAA;AACjC,EAAA;AACoC,EAAA;AACU,EAAA;AAC7C,IAAA;AACkB,IAAA;AACR,IAAA;AAC6B,IAAA;AACN,IAAA;AACL,IAAA;AACX,MAAA;AACY,MAAA;AAC7B,IAAA;AACF,EAAA;AACuC,EAAA;AACH,EAAA;AACb,IAAA;AACE,IAAA;AACS,IAAA;AACjC,EAAA;AACsC,EAAA;AAChB,IAAA;AACM,IAAA;AAC3B,IAAA;AACA,IAAA;AACD,EAAA;AACqC,EAAA;AACJ,EAAA;AACM,EAAA;AACN,EAAA;AACF,IAAA;AACS,IAAA;AAC3B,IAAA;AACe,IAAA;AACZ,EAAA;AAC4C,EAAA;AAC3D,IAAA;AACa,IAAA;AACI,MAAA;AACa,MAAA;AAC9B,IAAA;AACA,IAAA;AACiC,IAAA;AACD,IAAA;AAChC,IAAA;AACF,EAAA;AAC2C,EAAA;AAC7C;AAE6E;AAClC,EAAA;AACtB,IAAA;AACnB,EAAA;AACyC,EAAA;AACE,EAAA;AAElB,EAAA;AACvB,IAAA;AAC6B,IAAA;AAC/B,EAAA;AAIE,EAAA;AAEyC,IAAA;AACJ,IAAA;AACD,IAAA;AACtC,EAAA;AAIE,EAAA;AAEkC,IAAA;AACG,IAAA;AACD,IAAA;AACtC,EAAA;AAEyE,EAAA;AAClB,IAAA;AACjBA,IAAAA;AACtC,EAAA;AAIE,EAAA;AAEuC,IAAA;AACHC,IAAAA;AACtC,EAAA;AAIE,EAAA;AAEyC,IAAA;AACLC,IAAAA;AACtC,EAAA;AASa,EAAA;AAGH,IAAA;AAC2D,MAAA;AACnE,IAAA;AAImB,IAAA;AACjB,MAAA;AAEK,QAAA;AAC+C,UAAA;AACrB,YAAA;AACS,YAAA;AACCC,YAAAA;AAC1B,YAAA;AACT,UAAA;AACF,QAAA;AACJ,MAAA;AACF,IAAA;AAIsC,IAAA;AACyC,MAAA;AAC/CC,QAAAA;AACrB,QAAA;AAC+E,UAAA;AAC/C,YAAA;AAChB,YAAA;AACG,YAAA;AACW,YAAA;AACnC,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4B,IAAA;AACyD,MAAA;AACzD,QAAA;AACuB,QAAA;AACd,UAAA;AACZ,UAAA;AACG,YAAA;AACS,YAAA;AAC9B,UAAA;AAC4B,UAAA;AAC3B,YAAA;AACc,YAAA;AACR,YAAA;AAC0B,cAAA;AACD,cAAA;AAC/B,YAAA;AACD,UAAA;AACkC,UAAA;AACrC,QAAA;AACO,QAAA;AACoF,UAAA;AAC1D,YAAA;AACA,YAAA;AACP,cAAA;AACb,cAAA;AACR,YAAA;AACuB,YAAA;AACR,cAAA;AACS,cAAA;AACxB,YAAA;AACH,UAAA;AAEmC,UAAA;AACd,YAAA;AACG,cAAA;AACb,cAAA;AACR,YAAA;AACwB,YAAA;AACR,cAAA;AACO,gBAAA;AACK,gBAAA;AAC3B,cAAA;AACD,YAAA;AAC6B,YAAA;AACJ,YAAA;AACF,YAAA;AACtB,cAAA;AACc,cAAA;AACJ,cAAA;AACR,gBAAA;AACiB,gBAAA;AACK,gBAAA;AACjB,kBAAA;AACQ,kBAAA;AACb,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AAEiF,UAAA;AACxD,YAAA;AAErB,YAAA;AAIA,YAAA;AAGoB,YAAA;AACpB,cAAA;AACA,cAAA;AACA,cAAA;AACyB,cAAA;AAEP,gBAAA;AACd,gBAAA;AACA,gBAAA;AACD,cAAA;AACyB,cAAA;AAEH,gBAAA;AACrB,gBAAA;AAAA;AAEU,gBAAA;AACX,cAAA;AACJ,YAAA;AACH,UAAA;AAE0B,UAAA;AACH,YAAA;AACW,YAAA;AACnB,YAAA;AACU,cAAA;AACC,cAAA;AACC,cAAA;AACxB,YAAA;AAC8B,YAAA;AACV,cAAA;AACpB,YAAA;AACuB,YAAA;AACR,cAAA;AACd,cAAA;AACA,cAAA;AACD,YAAA;AACH,UAAA;AAE4B,UAAA;AACL,YAAA;AACY,YAAA;AACX,cAAA;AACE,cAAA;AACvB,YAAA;AACY,YAAA;AACU,cAAA;AACC,cAAA;AACC,cAAA;AACxB,YAAA;AAC+B,YAAA;AACX,cAAA;AACpB,YAAA;AAC8B,YAAA;AACN,cAAA;AACF,cAAA;AACC,cAAA;AACvB,YAAA;AAC0B,YAAA;AACH,YAAA;AACR,cAAA;AACd,cAAA;AACc,cAAA;AACZ,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACC,gBAAA;AACjB,kBAAA;AACkB,kBAAA;AACvB,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4B,IAAA;AAC1B,MAAA;AACc,QAAA;AACc,UAAA;AACjB,UAAA;AAQ+B,YAAA;AACT,cAAA;AACDD,cAAAA;AACtB,gBAAA;AACE,kBAAA;AACe,kBAAA;AACjB,gBAAA;AACmB,gBAAA;AACrB,cAAA;AACY,cAAA;AACiB,cAAA;AAC3B,gBAAA;AACe,gBAAA;AAChB,cAAA;AACmB,cAAA;AACH,gBAAA;AACf,gBAAA;AACA,gBAAA;AAC4B,gBAAA;AAC9B,cAAA;AACwBA,cAAAA;AACL,gBAAA;AACE,gBAAA;AACrB,cAAA;AACiC,cAAA;AACnB,gBAAA;AACd,cAAA;AAC0B,cAAA;AACE,cAAA;AACD,cAAA;AAG7B,YAAA;AAIwC,YAAA;AACf,cAAA;AACrB,gBAAA;AACmB,gBAAA;AACA,gBAAA;AACI,gBAAA;AACGA,kBAAAA;AACL,oBAAA;AACF,oBAAA;AACf,oBAAA;AACD,kBAAA;AACM,kBAAA;AACT,gBAAA;AACoB,gBAAA;AAED,kBAAA;AACE,kBAAA;AACjB,kBAAA;AACD,gBAAA;AACJ,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAIqC,IAAA;AACnC,MAAA;AACc,QAAA;AACM,UAAA;AACT,UAAA;AAGH,YAAA;AAM8B,cAAA;AAC5B,gBAAA;AACwB,kBAAA;AACI,kBAAA;AACf,kBAAA;AACb,gBAAA;AACmB,gBAAA;AACrB,cAAA;AACiC,cAAA;AACpB,gBAAA;AACb,cAAA;AAC4B,cAAA;AACD,cAAA;AAG7B,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAI4B,IAAA;AAC8D,MAAA;AAC3DC,QAAAA;AAEoB,QAAA;AACd,UAAA;AACE,UAAA;AACJ,UAAA;AACG,YAAA;AACD,YAAA;AAC9B,UAAA;AACkC,UAAA;AACrC,QAAA;AAGE,QAAA;AAGqB,UAAA;AACR,UAAA;AACU,YAAA;AACW,YAAA;AACT,YAAA;AACxB,UAAA;AACiC,UAAA;AACH,UAAA;AACV,YAAA;AACpB,UAAA;AACM,UAAA;AACT,QAAA;AAEO,QAAA;AAGH,UAAA;AAE4BD,YAAAA;AACR,YAAA;AACI,YAAA;AACO,YAAA;AAC7B,cAAA;AACc,gBAAA;AACW,gBAAA;AACzB,cAAA;AACuB,cAAA;AACzB,YAAA;AACF,UAAA;AAEA,UAAA;AAKoC,UAAA;AACJ,YAAA;AACC,cAAA;AACR,cAAA;AACvB,YAAA;AACF,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIqC,IAAA;AACsD,MAAA;AACpEC,QAAAA;AACZ,QAAA;AACoF,UAAA;AAC3DD,YAAAA;AACR,YAAA;AACH,YAAA;AACnB,UAAA;AAKoC,UAAA;AACH,YAAA;AACjB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AAKoC,UAAA;AACJ,YAAA;AAChB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAEO,IAAA;AACT,EAAA;AAEO,EAAA;AACF,IAAA;AACH,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;ADsN6C;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","sourcesContent":[null,"import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (wrappingKey: WrappingKeyResponse): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (params: RegisterOnboardingDeviceParams): Promise<void> => {\n            const { role, name } = params;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n            });\n          },\n\n          reviewSharedOwner: async (challenge: PsdChallenge): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (challenge: OnboardingSeedChallenge): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"PSD\", \"Challenge type must be PSD\");\n            const signature = await approveChallenge(challenge, params);\n            return client.requests.approve.mutate(\n              {\n                id: request.id,\n                data: { challengeType: \"PSD\", signature },\n              },\n              buildTrpcContext(params),\n            );\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst FIXME_NOT_IMPLEMENTED =\n  (fnName: string): (() => Promise<never>) =>\n  async () => {\n    throw new Error(`Not implemented: ${fnName}`);\n  };\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: FIXME_NOT_IMPLEMENTED(\"generateSeedFragment\"),\n    generateWrappingKeyFragment: FIXME_NOT_IMPLEMENTED(\"generateWrappingKeyFragment\"),\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: FIXME_NOT_IMPLEMENTED(\"getDeviceUserId\"),\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: FIXME_NOT_IMPLEMENTED(\"openSession\"),\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: FIXME_NOT_IMPLEMENTED(\"startKKPatternAsResponder\"),\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n"]}

package/lib/engine.d.cts

@@ -1,9 +1,9 @@
 import { L as Logger } from './logger-C-TPbnjv.cjs';
-import { a as EngineOptions, E as Engine } from './types-pUN38HdE.cjs';
-export { A as ApproveRequestParams, m as DecorateWithApiUserAndWorkspaceUnauthenticated, D as DecorateWithDevice, e as DecorateWithDeviceAndOnboarding, k as DecorateWithDeviceAndWorkspaceUnauthenticated, g as DecorateWithWorkspace, j as DecorateWithWorkspaceApiAuthenticated, i as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, b as EngineBase, R as RegisterOnboardingDeviceParams, n as WithApiAuth, d as WithApiUser, c as WithDevice, W as WithOnboarding, l as WithPsdAuth, f as WithWorkspace } from './types-pUN38HdE.cjs';
+import { a as EngineOptions, E as Engine } from './types-DOi2cwia.cjs';
+export { A as ApproveRequestParams, C as CorrelationIdOpts, m as DecorateWithApiUserAndWorkspaceUnauthenticated, D as DecorateWithDevice, e as DecorateWithDeviceAndOnboarding, k as DecorateWithDeviceAndWorkspaceUnauthenticated, g as DecorateWithWorkspace, j as DecorateWithWorkspaceApiAuthenticated, i as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, b as EngineBase, R as RegisterOnboardingDeviceParams, n as WithApiAuth, d as WithApiUser, c as WithDevice, W as WithOnboarding, l as WithPsdAuth, f as WithWorkspace } from './types-DOi2cwia.cjs';
 import { Paginated, CursorPaginated } from '@ledgerhq/revault-api';
+import { T as TRPCContext } from './types-CpGEbAxh.cjs';
 import './types-DJfbanPz.cjs';
-import './types-Ct-F-l82.cjs';
 import '@trpc/client';
 import '@trpc/server';
 
@@ -12,7 +12,7 @@ import '@trpc/server';
  */
 declare function fetchAll<TData, TQuery extends {
     page?: number;
-}>(queryFn: (query: TQuery) => Promise<Paginated<TData>>, query: TQuery): Promise<TData[]>;
+}>(queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>, query: TQuery, trpcContext?: TRPCContext): Promise<TData[]>;
 /**
  * Utility function that collect results on all cursors until cursor is null
  */

package/lib/engine.d.ts

@@ -1,9 +1,9 @@
 import { L as Logger } from './logger-C-TPbnjv.js';
-import { a as EngineOptions, E as Engine } from './types-Dkr4g0qP.js';
-export { A as ApproveRequestParams, m as DecorateWithApiUserAndWorkspaceUnauthenticated, D as DecorateWithDevice, e as DecorateWithDeviceAndOnboarding, k as DecorateWithDeviceAndWorkspaceUnauthenticated, g as DecorateWithWorkspace, j as DecorateWithWorkspaceApiAuthenticated, i as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, b as EngineBase, R as RegisterOnboardingDeviceParams, n as WithApiAuth, d as WithApiUser, c as WithDevice, W as WithOnboarding, l as WithPsdAuth, f as WithWorkspace } from './types-Dkr4g0qP.js';
+import { a as EngineOptions, E as Engine } from './types-StrV0mJs.js';
+export { A as ApproveRequestParams, C as CorrelationIdOpts, m as DecorateWithApiUserAndWorkspaceUnauthenticated, D as DecorateWithDevice, e as DecorateWithDeviceAndOnboarding, k as DecorateWithDeviceAndWorkspaceUnauthenticated, g as DecorateWithWorkspace, j as DecorateWithWorkspaceApiAuthenticated, i as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, b as EngineBase, R as RegisterOnboardingDeviceParams, n as WithApiAuth, d as WithApiUser, c as WithDevice, W as WithOnboarding, l as WithPsdAuth, f as WithWorkspace } from './types-StrV0mJs.js';
 import { Paginated, CursorPaginated } from '@ledgerhq/revault-api';
+import { T as TRPCContext } from './types-CpGEbAxh.js';
 import './types-DJfbanPz.js';
-import './types-Ct-F-l82.js';
 import '@trpc/client';
 import '@trpc/server';
 
@@ -12,7 +12,7 @@ import '@trpc/server';
  */
 declare function fetchAll<TData, TQuery extends {
     page?: number;
-}>(queryFn: (query: TQuery) => Promise<Paginated<TData>>, query: TQuery): Promise<TData[]>;
+}>(queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>, query: TQuery, trpcContext?: TRPCContext): Promise<TData[]>;
 /**
  * Utility function that collect results on all cursors until cursor is null
  */