@ledgerhq/revault-sdk 0.22.9 → 0.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/lib/bake.cjs +84 -24
  2. package/lib/bake.cjs.map +1 -1
  3. package/lib/bake.d.cts +10 -1
  4. package/lib/bake.d.ts +10 -1
  5. package/lib/bake.js +71 -11
  6. package/lib/bake.js.map +1 -1
  7. package/lib/{chunk-P53CFOI6.cjs → chunk-2WGM7EWA.cjs} +14 -3
  8. package/lib/chunk-2WGM7EWA.cjs.map +1 -0
  9. package/lib/{chunk-2HKHCIKX.cjs → chunk-4ZXMEPRB.cjs} +4 -2
  10. package/lib/chunk-4ZXMEPRB.cjs.map +1 -0
  11. package/lib/{chunk-73OX5XDM.js → chunk-KV5FO7N5.js} +12 -1
  12. package/lib/chunk-KV5FO7N5.js.map +1 -0
  13. package/lib/{chunk-42CFPNWC.js → chunk-QWC3M2RL.js} +4 -2
  14. package/lib/{chunk-42CFPNWC.js.map → chunk-QWC3M2RL.js.map} +1 -1
  15. package/lib/crypto.cjs +4 -2
  16. package/lib/crypto.cjs.map +1 -1
  17. package/lib/crypto.d.cts +13 -1
  18. package/lib/crypto.d.ts +13 -1
  19. package/lib/crypto.js +3 -1
  20. package/lib/device.cjs +2 -2
  21. package/lib/device.js +1 -1
  22. package/lib/engine.cjs +117 -43
  23. package/lib/engine.cjs.map +1 -1
  24. package/lib/engine.d.cts +2 -2
  25. package/lib/engine.d.ts +2 -2
  26. package/lib/engine.js +90 -16
  27. package/lib/engine.js.map +1 -1
  28. package/lib/onboarding.d.cts +1 -1
  29. package/lib/onboarding.d.ts +1 -1
  30. package/lib/{types-mF8XT2Vl.d.cts → types-6nV5J9yp.d.cts} +8 -5
  31. package/lib/{types-BTcYWX_0.d.ts → types-BdCVJxZy.d.ts} +8 -5
  32. package/package.json +8 -5
  33. package/lib/chunk-2HKHCIKX.cjs.map +0 -1
  34. package/lib/chunk-73OX5XDM.js.map +0 -1
  35. package/lib/chunk-P53CFOI6.cjs.map +0 -1
package/lib/engine.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"names":["withApiUser","withWorkspace","withOnboarding","client","engine"],"mappings":"AAAA;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACPA,4FAAsB;ADStB;AACA;AEtBA,0CAAsD;AAGtD;AACA,4BAAoC;AAkBpC,IAAM,iBAAA,EAAmB,GAAA;AAMzB,IAAM,sBAAA,EACJ,CAAC,MAAA,EAAA,GACD,MAAA,CAAA,EAAA,GAAY;AACV,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,MAAM,CAAA,CAAA;AAC5C;AAE8D;AACpB,EAAA;AACP,EAAA;AACrC;AAEiE;AAC/C,EAAA;AACyB,EAAA;AACF,IAAA;AACvC,EAAA;AACO,EAAA;AACT;AAE8D;AAK5D;AAG0C,EAAA;AACb,EAAA;AACW,EAAA;AAChB,IAAA;AACE,IAAA;AAGT,IAAA;AAC4B,IAAA;AACzC,MAAA;AACG,MAAA;AACJ,IAAA;AACH,EAAA;AACO,EAAA;AACT;AAMc;AACyB,EAAA;AACC,EAAA;AACA,EAAA;AAEA,EAAA;AACC,EAAA;AACC,EAAA;AAEH,EAAA;AAED,EAAA;AAClC,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAEuC,EAAA;AACC,EAAA;AACV,EAAA;AAEM,EAAA;AACC,EAAA;AACA,EAAA;AAEC,EAAA;AACD,EAAA;AAEX,EAAA;AACzB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACD,EAAA;AAEuC,EAAA;AACH,EAAA;AAEP,EAAA;AAEvB,EAAA;AACT;AAImD;AAEX,EAAA;AAEC,EAAA;AAEA,EAAA;AAGhC,EAAA;AACT;AAE2E;AACjD,EAAA;AAIO,EAAA;AAEtB,IAAA;AAC8B,MAAA;AACrC,IAAA;AACF,EAAA;AAG+B,EAAA;AAEI,EAAA;AAGK,EAAA;AAEhC,IAAA;AAAA;AAEkB,MAAA;AAAC,MAAA;AACF,uBAAA;AACvB,IAAA;AAEI,IAAA;AAC8B,MAAA;AACL,MAAA;AACf,IAAA;AACuB,MAAA;AACL,QAAA;AAC9B,MAAA;AACM,MAAA;AACR,IAAA;AACF,EAAA;AAE4D,EAAA;AACxC,IAAA;AACK,MAAA;AACvB,IAAA;AAEuC,IAAA;AACd,IAAA;AAC3B,EAAA;AAII,EAAA;AAEoC,IAAA;AACH,IAAA;AACR,IAAA;AACA,MAAA;AACG,MAAA;AACA,QAAA;AACK,QAAA;AACxB,QAAA;AACR,MAAA;AACF,IAAA;AACgC,IAAA;AACV,IAAA;AACqB,MAAA;AAC1B,uBAAA;AAClB,IAAA;AACwC,IAAA;AAE5B,IAAA;AAIH,IAAA;AAEkB,IAAA;AAC7B,EAAA;AAEuB,EAAA;AACe,IAAA;AACC,MAAA;AAChB,MAAA;AACmB,MAAA;AACH,MAAA;AACC,MAAA;AAEA,MAAA;AACA,QAAA;AACH,QAAA;AAC/B,QAAA;AACoC,QAAA;AACpC,QAAA;AACD,MAAA;AAEkC,MAAA;AACD,MAAA;AAEP,MAAA;AACM,QAAA;AAC/B,QAAA;AAC8B,QAAA;AACF,QAAA;AAC5B,QAAA;AACA,QAAA;AACD,MAAA;AAE4B,MAAA;AACf,QAAA;AACd,MAAA;AAEoC,MAAA;AACtC,IAAA;AAEiC,IAAA;AAKH,MAAA;AACd,QAAA;AACd,MAAA;AACmC,MAAA;AACrC,IAAA;AAEsB,IAAA;AACO,IAAA;AAQvB,IAAA;AAC6B,MAAA;AACL,MAAA;AACS,MAAA;AAC9B,MAAA;AACQ,QAAA;AACmB,UAAA;AACG,UAAA;AACE,UAAA;AACrC,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACmC,IAAA;AACrB,MAAA;AACqB,MAAA;AACK,MAAA;AACf,MAAA;AACe,MAAA;AACC,MAAA;AAChC,MAAA;AAC6B,QAAA;AACD,QAAA;AACnC,MAAA;AACF,IAAA;AACgC,IAAA;AACO,IAAA;AACA,IAAA;AACC,IAAA;AAChB,IAAA;AACW,MAAA;AACS,MAAA;AACL,MAAA;AACC,MAAA;AAUL,MAAA;AACnC,IAAA;AAEkF,IAAA;AAC3C,MAAA;AACF,MAAA;AAEvB,MAAA;AAGgB,MAAA;AACD,MAAA;AAC7B,IAAA;AAEmC,IAAA;AAY7B,IAAA;AAC6B,MAAA;AACH,MAAA;AAEK,MAAA;AACA,MAAA;AACC,MAAA;AAEC,MAAA;AAED,MAAA;AACA,QAAA;AACD,QAAA;AACjC,QAAA;AACD,MAAA;AAEkC,MAAA;AACD,MAAA;AAEK,MAAA;AAEhB,MAAA;AACT,QAAA;AACd,MAAA;AAEQ,MAAA;AAC8B,MAAA;AACjC,MAAA;AACkC,MAAA;AAClC,MAAA;AACkC,MAAA;AACvC,MAAA;AACoC,MAAA;AAC/B,MAAA;AACE,MAAA;AAC6B,QAAA;AAClC,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACwE,IAAA;AAClC,MAAA;AACN,MAAA;AACK,MAAA;AACP,MAAA;AACW,MAAA;AACzC,IAAA;AAEmC,IAAA;AACA,MAAA;AACM,MAAA;AACV,MAAA;AACG,MAAA;AACK,MAAA;AACA,MAAA;AACvC,IAAA;AAC2B,IAAA;AACM,IAAA;AACnB,MAAA;AACwB,MAAA;AAC9B,MAAA;AACQ,QAAA;AACd,MAAA;AACF,IAAA;AAC+B,IAAA;AACjB,MAAA;AACuB,MAAA;AACP,MAAA;AACD,QAAA;AACG,QAAA;AACA,UAAA;AACK,UAAA;AACxB,UAAA;AACR,QAAA;AACF,MAAA;AAEkB,MAAA;AACgB,MAAA;AAEZ,MAAA;AACa,QAAA;AACL,QAAA;AACQ,QAAA;AACF,QAAA;AACZ,QAAA;AACT,UAAA;AACd,QAAA;AAC8B,QAAA;AACA,QAAA;AACR,QAAA;AACf,UAAA;AACqB,YAAA;AACxB,YAAA;AACG,UAAA;AAC4B,YAAA;AACG,YAAA;AACE,cAAA;AACR,gBAAA;AACF,gBAAA;AACC,gBAAA;AACzB,cAAA;AACF,YAAA;AACA,YAAA;AAAA;AAEF,UAAA;AACkB,YAAA;AACpB,QAAA;AACF,MAAA;AACsC,MAAA;AACxC,IAAA;AAEyC,IAAA;AACF,MAAA;AACC,MAAA;AACxC,IAAA;AACwB,IAAA;AACe,MAAA;AACJ,MAAA;AACM,MAAA;AACH,MAAA;AAEL,MAAA;AAExB,MAAA;AACT,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACO,EAAA;AACT;AFnH6C;AACA;AG/Ve;AAEtC;AAiB4D;AACvC,EAAA;AAChC,IAAA;AACI,MAAA;AACgB,QAAA;AACV,QAAA;AACC,QAAA;AAEoB,UAAA;AAEzB,UAAA;AAEC,YAAA;AAGA,YAAA;AAEkB,YAAA;AAElB,YAAA;AACD;AAEF,YAAA;AACL,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AACD,EAAA;AACM,EAAA;AACT;AHwU6C;AACA;AC7UX;AAChC,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAaa;AACkB,EAAA;AACP,IAAA;AACF,IAAA;AACY,IAAA;AACjC,EAAA;AACoC,EAAA;AACU,EAAA;AAC7C,IAAA;AACkB,IAAA;AACR,IAAA;AAC6B,IAAA;AACN,IAAA;AACL,IAAA;AACX,MAAA;AACY,MAAA;AAC7B,IAAA;AACF,EAAA;AACuC,EAAA;AACH,EAAA;AACb,IAAA;AACE,IAAA;AACS,IAAA;AACjC,EAAA;AACsC,EAAA;AAChB,IAAA;AACM,IAAA;AAC3B,IAAA;AACA,IAAA;AACD,EAAA;AACqC,EAAA;AACJ,EAAA;AACM,EAAA;AACN,EAAA;AACF,IAAA;AACS,IAAA;AAC3B,IAAA;AACe,IAAA;AACZ,EAAA;AAC4C,EAAA;AAC3D,IAAA;AACa,IAAA;AACI,MAAA;AACa,MAAA;AAC9B,IAAA;AACA,IAAA;AACiC,IAAA;AACD,IAAA;AAChC,IAAA;AACF,EAAA;AAC2C,EAAA;AAC7C;AAE6E;AAClC,EAAA;AACtB,IAAA;AACnB,EAAA;AACyC,EAAA;AACE,EAAA;AAElB,EAAA;AACvB,IAAA;AAC6B,IAAA;AAClB,IAAA;AACb,EAAA;AAIE,EAAA;AAEyC,IAAA;AACJ,IAAA;AACD,IAAA;AACtC,EAAA;AAIE,EAAA;AAEkC,IAAA;AACG,IAAA;AACD,IAAA;AACtC,EAAA;AAEyE,EAAA;AAClB,IAAA;AACjBA,IAAAA;AACtC,EAAA;AAIE,EAAA;AAEuC,IAAA;AACHC,IAAAA;AACtC,EAAA;AAIE,EAAA;AAEyC,IAAA;AACLC,IAAAA;AACtC,EAAA;AASa,EAAA;AAGH,IAAA;AAC2D,MAAA;AACnE,IAAA;AAImB,IAAA;AACjB,MAAA;AAEK,QAAA;AAC+C,UAAA;AACrB,YAAA;AACS,YAAA;AACCC,YAAAA;AAC1B,YAAA;AACT,UAAA;AACF,QAAA;AACJ,MAAA;AACF,IAAA;AAIsC,IAAA;AACyC,MAAA;AAC/CC,QAAAA;AACrB,QAAA;AAC+E,UAAA;AAC/C,YAAA;AAChB,YAAA;AACG,YAAA;AACW,YAAA;AACnC,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4B,IAAA;AACyD,MAAA;AACzD,QAAA;AACuB,QAAA;AACd,UAAA;AACZ,UAAA;AACG,YAAA;AACS,YAAA;AAC9B,UAAA;AAC4B,UAAA;AAC3B,YAAA;AACc,YAAA;AACR,YAAA;AAC0B,cAAA;AACD,cAAA;AAC/B,YAAA;AACD,UAAA;AACkC,UAAA;AACrC,QAAA;AACO,QAAA;AACoF,UAAA;AAC1D,YAAA;AACA,YAAA;AACP,cAAA;AACb,cAAA;AACR,YAAA;AACuB,YAAA;AACR,cAAA;AACS,cAAA;AACxB,YAAA;AACH,UAAA;AAEmC,UAAA;AACd,YAAA;AACG,cAAA;AACb,cAAA;AACR,YAAA;AACwB,YAAA;AACR,cAAA;AACO,gBAAA;AACK,gBAAA;AAC3B,cAAA;AACD,YAAA;AAC6B,YAAA;AACJ,YAAA;AACF,YAAA;AACtB,cAAA;AACc,cAAA;AACJ,cAAA;AACR,gBAAA;AACiB,gBAAA;AACK,gBAAA;AACjB,kBAAA;AACQ,kBAAA;AACb,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AAEiF,UAAA;AACxD,YAAA;AAErB,YAAA;AAIA,YAAA;AAGoB,YAAA;AACpB,cAAA;AACA,cAAA;AACA,cAAA;AACyB,cAAA;AAEP,gBAAA;AACd,gBAAA;AACA,gBAAA;AACD,cAAA;AACyB,cAAA;AAEH,gBAAA;AACrB,gBAAA;AAAA;AAEU,gBAAA;AACX,cAAA;AACJ,YAAA;AACH,UAAA;AAE0B,UAAA;AACH,YAAA;AACW,YAAA;AACnB,YAAA;AACU,cAAA;AACC,cAAA;AACC,cAAA;AACxB,YAAA;AAC8B,YAAA;AACV,cAAA;AACpB,YAAA;AACuB,YAAA;AACR,cAAA;AACd,cAAA;AACA,cAAA;AACD,YAAA;AACH,UAAA;AAE4B,UAAA;AACL,YAAA;AACY,YAAA;AACX,cAAA;AACE,cAAA;AACvB,YAAA;AACY,YAAA;AACU,cAAA;AACC,cAAA;AACC,cAAA;AACxB,YAAA;AAC+B,YAAA;AACX,cAAA;AACpB,YAAA;AAC8B,YAAA;AACN,cAAA;AACF,cAAA;AACC,cAAA;AACvB,YAAA;AAC0B,YAAA;AACH,YAAA;AACR,cAAA;AACd,cAAA;AACc,cAAA;AACZ,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACC,gBAAA;AACjB,kBAAA;AACkB,kBAAA;AACvB,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4B,IAAA;AAC1B,MAAA;AACc,QAAA;AACc,UAAA;AACjB,UAAA;AAQ+B,YAAA;AACT,cAAA;AACDD,cAAAA;AACtB,gBAAA;AACE,kBAAA;AACe,kBAAA;AACjB,gBAAA;AACmB,gBAAA;AACrB,cAAA;AACY,cAAA;AACiB,cAAA;AAC3B,gBAAA;AACe,gBAAA;AAChB,cAAA;AACmB,cAAA;AACH,gBAAA;AACf,gBAAA;AACA,gBAAA;AAC4B,gBAAA;AAC9B,cAAA;AACwBA,cAAAA;AACL,gBAAA;AACE,gBAAA;AACrB,cAAA;AACiC,cAAA;AACnB,gBAAA;AACd,cAAA;AAC0B,cAAA;AACE,cAAA;AACD,cAAA;AAG7B,YAAA;AAIwC,YAAA;AACf,cAAA;AACrB,gBAAA;AACmB,gBAAA;AACA,gBAAA;AACI,gBAAA;AACGA,kBAAAA;AACL,oBAAA;AACF,oBAAA;AACf,oBAAA;AACD,kBAAA;AACM,kBAAA;AACT,gBAAA;AACoB,gBAAA;AAED,kBAAA;AACE,kBAAA;AACjB,kBAAA;AACD,gBAAA;AACJ,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAIqC,IAAA;AACnC,MAAA;AACc,QAAA;AACM,UAAA;AACT,UAAA;AAGH,YAAA;AAM8B,cAAA;AAC5B,gBAAA;AACwB,kBAAA;AACI,kBAAA;AACf,kBAAA;AACb,gBAAA;AACmB,gBAAA;AACrB,cAAA;AACiC,cAAA;AACpB,gBAAA;AACb,cAAA;AAC4B,cAAA;AACD,cAAA;AAG7B,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAI4B,IAAA;AAC8D,MAAA;AAC3DC,QAAAA;AAEoB,QAAA;AACd,UAAA;AACE,UAAA;AACJ,UAAA;AACG,YAAA;AACD,YAAA;AAC9B,UAAA;AACkC,UAAA;AACrC,QAAA;AAGE,QAAA;AAGqB,UAAA;AACR,UAAA;AACU,YAAA;AACW,YAAA;AACT,YAAA;AACxB,UAAA;AACiC,UAAA;AACH,UAAA;AACV,YAAA;AACpB,UAAA;AACM,UAAA;AACT,QAAA;AAEO,QAAA;AAGH,UAAA;AAE4BD,YAAAA;AACI,YAAA;AACN,cAAA;AACV,cAAA;AACS,cAAA;AACrB,gBAAA;AACc,kBAAA;AACW,kBAAA;AACzB,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACgC,YAAA;AACP,cAAA;AACrB,gBAAA;AACc,kBAAA;AACW,kBAAA;AACzB,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACgB,YAAA;AAClB,UAAA;AAEA,UAAA;AAKoC,UAAA;AACJ,YAAA;AACC,cAAA;AACR,cAAA;AACvB,YAAA;AACF,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIqC,IAAA;AACsD,MAAA;AACpEC,QAAAA;AACZ,QAAA;AACoF,UAAA;AAC3DD,YAAAA;AACR,YAAA;AACH,YAAA;AACnB,UAAA;AAKoC,UAAA;AACH,YAAA;AACjB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AAKoC,UAAA;AACJ,YAAA;AAChB,cAAA;AACkB,cAAA;AAC/B,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAEO,IAAA;AACT,EAAA;AAEO,EAAA;AACF,IAAA;AACH,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;ADsN6C;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","sourcesContent":[null,"import type {\n ApiChallenge,\n ClaimedRole,\n OnboardingSeedChallenge,\n PsdChallenge,\n UserRegistrationChallenge,\n UserRegistrationChallengeResponse,\n UserRegistrationDeviceData,\n UserRegistrationResponse,\n VaultRequestResponse,\n WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n ApproveRequestParams,\n CorrelationIdOpts,\n DecorateWithApiUserAndWorkspaceUnauthenticated,\n DecorateWithDevice,\n DecorateWithDeviceAndOnboarding,\n DecorateWithDeviceAndWorkspaceUnauthenticated,\n DecorateWithWorkspaceApiAuthenticated,\n DecorateWithWorkspacePsdAuthenticated,\n DecorateWithWorkspaceUnauthenticated,\n Engine,\n EngineBase,\n EngineOptions,\n RegisterOnboardingDeviceParams,\n WithApiAuth,\n WithApiUser,\n WithDevice,\n WithOnboarding,\n WithPsdAuth,\n WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n device,\n name,\n role,\n getChallenge,\n submitChallenge,\n}: {\n device: Device;\n name: string;\n role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n getChallenge: (p: {\n pubKey: string;\n deviceData: UserRegistrationDeviceData;\n }) => Promise<UserRegistrationChallenge>;\n submitChallenge: (p: {\n pubKey: string;\n challengeResponse: UserRegistrationChallengeResponse;\n }) => Promise<T>;\n}): Promise<T> {\n const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n device.getAttestation(),\n device.getU2FPubKey(),\n device.getConfidentialityPubKey(),\n ]);\n const ephemeralPubKey = await device.initPairingHandshake();\n const deviceData: UserRegistrationDeviceData = {\n name,\n pubKey: u2fPubKey.pubKey,\n psdModel: \"STAX\",\n confidentialityKey: confidentialityKey.pubKey,\n psdEphemeralKey: ephemeralPubKey.pubKey,\n psdEphemeralKeyAttestation: {\n ...attestation.attestation,\n signature: ephemeralPubKey.signature,\n },\n };\n const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n const pairingPayload = await device.finalizePairingHandshake({\n handshake: challenge.handshake,\n partitionId: challenge.ciphertext,\n handshakeAttestation: challenge.handshakeAttestation,\n });\n const register = await device.register({\n challenge: challenge.challenge,\n u2fRegisterData: challenge.u2fRegisterData,\n name,\n role,\n });\n const validationPubKey = await device.getValidationPubKey();\n const registerData = await device.registerData({ challenge: challenge.challenge });\n const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n const u2fRegister = Buffer.concat([\n register.u2fRegister.slice(0, attestationOffset),\n Buffer.from([attestation.buffer.length]),\n attestation.buffer,\n register.u2fRegister.slice(attestationOffset),\n ]).toString(\"hex\");\n const challengeResponse: UserRegistrationChallengeResponse = {\n registerData,\n certificate: {\n ...attestation.attestation,\n signature: validationPubKey.signature,\n },\n u2fRegister,\n u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n validationKey: validationPubKey.pubKey,\n pairingPayload,\n };\n return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n const clientOptions: TRPCClientOptions = {\n baseUrl: options.baseUrl,\n };\n const client = createClient(clientOptions);\n const apiDevice = createApiDevice(options, logger);\n\n const base: EngineBase = {\n client,\n createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n __options: options,\n };\n\n const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n this: Engine<T>,\n deviceIndex: number,\n ) {\n const device = apiDevice.with(deviceIndex);\n const withPsd: WithDevice = { device };\n return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n };\n\n const withTransportId: Engine[\"withTransportId\"] = function <T>(\n this: Engine<T>,\n transportId: string,\n ) {\n const device = createRealDevice({ transportId }, logger);\n const withPsd: WithDevice = { device };\n return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n };\n\n const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n const withApiUser: WithApiUser = { __isApiUser: true };\n return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n };\n\n const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n this: Engine<T>,\n workspaceName: string,\n ) {\n const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n };\n\n const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n this: Engine<T>,\n onboardingId: string,\n ) {\n const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n };\n\n function decorateEngine<T>(\n engine: Engine<\n T &\n Partial<\n WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n >\n >,\n ): Engine<T> {\n function decorate<TEnhanced, TDecoration>(\n decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n ): void {\n Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n }\n\n // DecorateWithDevice\n // -------------------------------------------------------------------------\n if (engine.device) {\n decorate<WithDevice, DecorateWithDevice<T>>(\n (engine) =>\n ({\n getWorkspaces: async (): Promise<string[]> => {\n const { device, client } = engine;\n const { pubKey } = await device.getU2FPubKey();\n const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n return workspaceNames;\n },\n }) satisfies DecorateWithDevice<T>,\n );\n }\n\n // DecorateWithWorkspaceUnauthenticated\n // -------------------------------------------------------------------------\n if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n const { __workspaceName } = engine;\n return {\n withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n const withPsdAuth: WithPsdAuth = { __psdToken: token };\n const psdAuth = `${__workspaceName}:${token}`;\n const client = engine.createClient({ psdAuth });\n return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n },\n } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n });\n }\n\n // DecorateWithDeviceAndOnboarding\n // -------------------------------------------------------------------------\n if (engine.device && engine.__onboardingId) {\n decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n const { device, client, __onboardingId } = engine;\n async function enforcePairing(): Promise<void> {\n if (await device.hasPairing()) return;\n const [{ pubKey }, confidentialityKey] = await Promise.all([\n device.getU2FPubKey(),\n device.getConfidentialityKey(),\n ]);\n const pairing = await client.onboarding.pairDevicePartition.mutate({\n pubKey,\n onboardingId: __onboardingId,\n data: {\n confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n },\n });\n await device.setPairing({ pairing });\n }\n return {\n claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n const { role, deviceName } = params;\n const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n device.getU2FPubKey(),\n device.getConfidentialityPubKey(),\n ]);\n await client.onboarding.claimDevice.mutate({\n onboardingId: __onboardingId,\n claim: { role, pubKey, deviceName, confidentialityKey },\n });\n },\n\n collectWrappingKeyFragment: async (wrappingKey: WrappingKeyResponse): Promise<void> => {\n const [{ pubKey }, confidentialityKey] = await Promise.all([\n device.getU2FPubKey(),\n device.getConfidentialityPubKey(),\n ]);\n await device.openSession({\n secureChannel: {\n pubKey: wrappingKey.ephemeralPubKey,\n certificate: wrappingKey.ephemeralCertificate,\n },\n });\n const { attestation } = await device.getAttestation();\n const blob = await device.generateWrappingKeyFragment();\n await client.onboarding.submitWrappingKeyFragment.mutate({\n pubKey,\n onboardingId: __onboardingId,\n fragment: {\n blob,\n ephemeralPubKey: confidentialityKey.pubKey,\n ephemeralCertificate: {\n ...attestation,\n signature: confidentialityKey.signature,\n },\n },\n });\n },\n\n registerDevice: async (params: RegisterOnboardingDeviceParams): Promise<void> => {\n const { role, name } = params;\n const getChallengeMutation =\n role === \"ADMIN\"\n ? client.onboarding.generateMasterAdminRegistrationChallenge\n : client.onboarding.generateSharedOwnerRegistrationChallenge;\n const submitChallengeMutation =\n role === \"ADMIN\"\n ? client.onboarding.submitMasterAdminRegistration\n : client.onboarding.submitSharedOwnerRegistration;\n await genericRegister({\n device: device,\n name,\n role,\n getChallenge: ({ pubKey, deviceData }) =>\n getChallengeMutation.mutate({\n onboardingId: __onboardingId,\n pubKey,\n deviceData,\n }),\n submitChallenge: ({ pubKey, challengeResponse }) =>\n submitChallengeMutation.mutate({\n onboardingId: engine.__onboardingId,\n pubKey,\n // FIXME this should be renamed to `challengeResponse` on backend side\n response: challengeResponse,\n }),\n });\n },\n\n reviewSharedOwner: async (challenge: PsdChallenge): Promise<void> => {\n await enforcePairing();\n const { pubKey } = await device.getU2FPubKey();\n await device.startKPatternAsResponder({\n handshake: challenge.handshake,\n handshakeAttestation: challenge.handshakeAttestation,\n partitionId: challenge.partitionId,\n });\n const signature = await device.validateVaultOperation({\n actions: challenge.wActions,\n });\n await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n onboardingId: __onboardingId,\n pubKey,\n signature,\n });\n },\n\n collectSeedFragment: async (challenge: OnboardingSeedChallenge): Promise<void> => {\n await enforcePairing();\n const [{ pubKey }, { attestation }] = await Promise.all([\n device.getU2FPubKey(),\n device.getAttestation(),\n ]);\n await device.startKPatternAsResponder({\n handshake: challenge.handshake,\n handshakeAttestation: challenge.handshakeAttestation,\n partitionId: challenge.partitionId,\n });\n const challengeResponse = await device.validateVaultOperation({\n actions: challenge.wActions,\n });\n const kkPattern = await device.startKKPatternAsResponder({\n partitionId: challenge.partitionId,\n handshake: challenge.kkHandshake,\n handshakeAttestation: challenge.kkHandshakeAttestation,\n });\n const approverBlob = await device.generateSeedFragment();\n await client.onboarding.submitSeedFragment.mutate({\n onboardingId: __onboardingId,\n pubKey,\n seedFragment: {\n challengeResponse,\n approverBlob,\n handshake: kkPattern.handshake,\n handshakeAttestation: {\n ...attestation,\n signature: kkPattern.signature,\n },\n },\n });\n },\n } satisfies DecorateWithDeviceAndOnboarding;\n });\n }\n\n // DecorateWithDeviceAndWorkspaceUnauthenticated\n // -------------------------------------------------------------------------\n if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n (engine) => {\n const { device, client, __workspaceName } = engine;\n return {\n login: async function <T>(\n this: Engine<T>,\n opts?: {\n validityDurationSecs?: number;\n onScreenDisplayed?: () => void | Promise<void>;\n correlationId?: string;\n },\n ): Promise<Engine<T & WithPsdAuth>> {\n const { pubKey } = await device.getU2FPubKey();\n const challenge = await client.auth.psd.generateChallenge.mutate(\n {\n pubKey,\n workspaceName: __workspaceName,\n },\n buildTrpcContext({ correlationId: opts?.correlationId }),\n );\n await opts?.onScreenDisplayed?.();\n const authentication = await device.authenticate({\n challenge,\n workspaceName: __workspaceName,\n });\n const authPayload = {\n workspaceName: __workspaceName,\n pubKey,\n authentication,\n validityDurationSecs: opts?.validityDurationSecs,\n };\n const { token } = await client.auth.psd.authenticate.mutate(\n { ...authPayload },\n buildTrpcContext({ correlationId: opts?.correlationId }),\n );\n const withPsdAuth: WithPsdAuth = {\n __psdToken: token,\n };\n const psdAuth = `${engine.__workspaceName}:${token}`;\n const __authClient = engine.createClient({ psdAuth });\n return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n T & WithPsdAuth\n >);\n },\n\n register: (\n registration: UserRegistrationResponse,\n ): Promise<UserRegistrationResponse> => {\n return genericRegister({\n device,\n name: registration.name,\n role: registration.role,\n getChallenge: async ({ deviceData }) => {\n const challenge = await client.userRegistrations.generateChallenge.mutate({\n id: registration.id,\n workspaceName: __workspaceName,\n deviceData,\n });\n return challenge;\n },\n submitChallenge: ({ challengeResponse }) =>\n client.userRegistrations.submitChallenge.mutate({\n workspaceName: __workspaceName,\n id: registration.id,\n challengeResponse,\n }),\n });\n },\n } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n },\n );\n }\n\n // DecorateWithApiUserAndWorkspaceUnauthenticated\n // -------------------------------------------------------------------------\n if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n (engine) => {\n const { client, __workspaceName } = engine;\n return {\n login: async function <T>(\n this: Engine<T>,\n credentials: {\n apiKeyId: string;\n apiKeySecret: string;\n },\n opts?: { correlationId?: string },\n ): Promise<Engine<T & WithApiAuth>> {\n const res = await client.auth.authenticate.mutate(\n {\n apiKeyId: credentials.apiKeyId,\n apiKeySecret: credentials.apiKeySecret,\n workspace: __workspaceName,\n },\n buildTrpcContext({ correlationId: opts?.correlationId }),\n );\n const withApiAuth: WithApiAuth = {\n __apiAuth: res,\n };\n const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n T & WithApiAuth\n >);\n },\n } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n },\n );\n }\n\n // DecorateWithWorkspacePsdAuthenticated\n // -------------------------------------------------------------------------\n if (engine.device && engine.__workspaceName && engine.__psdToken) {\n decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n const { client, device } = engine;\n\n async function enforcePairing(): Promise<void> {\n if (await device.hasPairing()) return;\n const confidentialityKey = await device.getConfidentialityKey();\n const pairing = await client.debug.pairDevicePartition.mutate({\n confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n });\n await device.setPairing({ pairing });\n }\n\n const approveChallenge = async (\n challenge: PsdChallenge,\n params?: ApproveRequestParams,\n ): Promise<string> => {\n await enforcePairing();\n await device.startKPatternAsResponder({\n handshake: challenge.handshake,\n handshakeAttestation: challenge.handshakeAttestation,\n partitionId: challenge.partitionId,\n });\n await params?.onScreenDisplayed?.();\n const signature = await device.validateVaultOperation({\n actions: challenge.wActions,\n });\n return signature;\n };\n\n return {\n approve: async (\n request: VaultRequestResponse,\n params?: ApproveRequestParams,\n ): Promise<VaultRequestResponse> => {\n const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n if (challenge.challengeType === \"PSD\") {\n const signature = await approveChallenge(challenge, params);\n await params?.onPsdChallengeSigned?.();\n return client.requests.approve.mutate(\n {\n id: request.id,\n data: { challengeType: \"PSD\", signature },\n },\n buildTrpcContext(params),\n );\n }\n if (challenge.challengeType === \"SOFT\") {\n return client.requests.approve.mutate(\n {\n id: request.id,\n data: { challengeType: \"SOFT\" },\n },\n buildTrpcContext(params),\n );\n }\n throw new Error(\"Challenge type must be either PSD or SOFT\");\n },\n\n approveChallenge,\n\n reject: (\n request: VaultRequestResponse,\n opts?: CorrelationIdOpts,\n ): Promise<VaultRequestResponse> => {\n return client.requests.reject.mutate(\n { id: request.id, data: null },\n buildTrpcContext(opts),\n );\n },\n } satisfies DecorateWithWorkspacePsdAuthenticated;\n });\n }\n\n // DecorateWithWorkspaceApiAuthenticated\n // -------------------------------------------------------------------------\n if (engine.__workspaceName && engine.__apiAuth) {\n decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n const { client } = engine;\n return {\n getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n return challenge.payload;\n },\n\n approve: (\n request: VaultRequestResponse,\n signature: string,\n ): Promise<VaultRequestResponse> => {\n return client.requests.approve.mutate({\n id: request.id,\n data: { challengeType: \"API\", signature },\n });\n },\n\n reject: (\n request: VaultRequestResponse,\n signature: string,\n ): Promise<VaultRequestResponse> => {\n return client.requests.reject.mutate({\n id: request.id,\n data: { challengeType: \"API\", signature },\n });\n },\n } satisfies DecorateWithWorkspaceApiAuthenticated;\n });\n }\n\n return engine;\n }\n\n return {\n ...base,\n withDeviceIndex,\n withTransportId,\n withApiUser,\n withWorkspace,\n withOnboarding,\n };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n APPID_VAULT_ADMINISTRATOR,\n PAGINATED_STATUS,\n PATHS,\n SCRIPT_IDS,\n STATUS_LENGTH,\n STR_ROLES,\n STREAMING_NEXT_ACTION,\n STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n transportId: string;\n};\n\nconst FIXME_NOT_IMPLEMENTED =\n (fnName: string): (() => Promise<never>) =>\n async () => {\n throw new Error(`Not implemented: ${fnName}`);\n };\n\nconst getPathFromPathString = (pathString: string): number[] => {\n const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n const chunks = [];\n for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n chunks.push(buffer.slice(i, i + size));\n }\n return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n transport: Transport,\n command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n data: Buffer,\n chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n const chunks = splitChunks(chunkSize, data);\n let response = Buffer.from([]);\n for (let i = 0; i < chunks.length; i++) {\n const chunk = chunks[i];\n const apdu = [...command];\n // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n /* v8 ignore next -- @preserve */\n apdu[2] = i && 0x80;\n response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n 0x9000,\n ...PAGINATED_STATUS,\n ])) as Buffer<ArrayBuffer>;\n }\n return response;\n};\n\nconst buildAttestation = (params: {\n handshake: string;\n handshakeAttestation: HsmCertificate;\n partitionId: string;\n}): Buffer => {\n const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n const sigLengthBuffer = Buffer.alloc(1);\n sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n const certLengthBuffer = Buffer.alloc(1);\n certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n const certChainData = Buffer.concat([\n sigLengthBuffer,\n sigBuffer,\n pubBuffer,\n certLengthBuffer,\n certBuffer,\n ]);\n\n const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n const cliMsgLengthBuffer = Buffer.alloc(1);\n cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n const pidLengthBuffer = Buffer.alloc(1);\n pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n const certChainDataLengthBuff = Buffer.alloc(2);\n certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n const data = Buffer.concat([\n cliMsgLengthBuffer,\n cliMsgBuffer,\n certChainDataLengthBuff,\n certChainData,\n pidLengthBuffer,\n pidBuffer,\n ]);\n\n const totalLengthBuffer = Buffer.alloc(2);\n totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n // device is locked\n if (err instanceof LockedDeviceError) return true;\n // user is on dashboard when receiving a Vault app apdu\n if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n // VG-24797 error that can happen in BLE in some situations (still unclear)\n if (err instanceof DisconnectedDevice) return true;\n\n // for everything else, we don't want to retry\n return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n const { transportId } = options;\n\n async function run<T>(\n job: (transport: Transport) => Promise<T>,\n retryOnError: RetryOnError = genericRetryOnError,\n ): Promise<T> {\n return lastValueFrom(\n withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n );\n }\n\n /* v8 ignore next -- @preserve */\n const noRetry = (): boolean => false;\n /* v8 ignore next -- @preserve */\n const alwaysRetry = (): boolean => true;\n const poll = async (\n opts: { retryOnError?: RetryOnError } = {},\n ): Promise<{ isAppOpened: boolean }> => {\n // waiting for device to be turned on\n await run(\n // eslint-disable-next-line @typescript-eslint/no-empty-function\n async (_transport) => {},\n opts.retryOnError ?? alwaysRetry,\n );\n // checking if app is opened: should return directly on getPubKey\n try {\n await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n return { isAppOpened: true };\n } catch (err) {\n if (isTransportStatusError(err) && genericRetryOnError(err)) {\n return { isAppOpened: false };\n }\n throw err;\n }\n };\n\n const pollApp = async (appName: string): Promise<string> => {\n const res = await run((transport) =>\n transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n );\n // little delay to give time to the app to be fully opened\n await new Promise((r) => setTimeout(r, 1e3));\n return res.toString(\"hex\");\n };\n\n const getPublicKey = async (\n pathString: string,\n { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n ): Promise<{ pubKey: string; signature: string }> => {\n logger.info(`[device] getPublicKey (${pathString})`);\n const path = getPathFromPathString(pathString);\n const data = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n const curve = secp256k1 ? 0x01 : 0x02;\n const response = await run(\n (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n retryOnError ?? genericRetryOnError,\n );\n const pubKeyLength = response.readInt8(0);\n const pubKey = response\n .slice(1, pubKeyLength + 1)\n .toString(\"hex\")\n .toUpperCase();\n const signature = response\n .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n .toString(\"base64\");\n return { pubKey, signature };\n };\n\n const device: Device = {\n authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n logger.info(`[device] Authenticate`);\n invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n const nameBuffer = Buffer.from(name);\n const workspaceBuffer = Buffer.from(workspaceName);\n\n const keyHandleData = Buffer.concat([\n Buffer.from(STR_ROLES[role], \"hex\"),\n Buffer.from([nameBuffer.length]),\n nameBuffer,\n Buffer.from([workspaceBuffer.length]),\n workspaceBuffer,\n ]);\n\n const keyHandleDataLength = Buffer.alloc(2);\n keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n const data = Buffer.concat([\n Buffer.from(challenge, \"base64\"),\n applicationBuffer,\n Buffer.from([keyHandle.length]),\n Buffer.from(keyHandle, \"hex\"),\n keyHandleDataLength,\n keyHandleData,\n ]);\n\n const authentication = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n );\n\n return removeStatus(authentication).toString(\"hex\");\n },\n\n finalizePairingHandshake: async (params: {\n handshake: string;\n partitionId: string;\n handshakeAttestation: HsmCertificate;\n }): Promise<string> => {\n const bufWithStatus = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n );\n return removeStatus(bufWithStatus).toString(\"hex\");\n },\n\n generateSeedFragment: FIXME_NOT_IMPLEMENTED(\"generateSeedFragment\"),\n generateWrappingKeyFragment: FIXME_NOT_IMPLEMENTED(\"generateWrappingKeyFragment\"),\n getAttestation: async (): Promise<{\n attestation: {\n codeHash: string;\n attestationPub: string;\n certificate: string;\n };\n buffer: Buffer;\n }> => {\n const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n const buffer = removeStatus(bufWithStatus);\n const certLen = buffer.readInt8(32 + 65 + 1);\n return {\n attestation: {\n codeHash: buffer.slice(0, 32).toString(\"base64\"),\n attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n },\n buffer,\n };\n },\n getConfidentialityKey: async () => {\n logger.info(`[device] getConfidentialityKey`);\n const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n const buf = removeStatus(bufWithStatus);\n const keyLength = buf[0]!;\n const key = buf.slice(1, 1 + keyLength);\n const sig = buf.slice(1 + keyLength + 1);\n return {\n confidentialityKeyCurve25519: key.toString(\"hex\"),\n confidentialityKeySignature: sig.toString(\"hex\"),\n };\n },\n getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n getDeviceUserId: FIXME_NOT_IMPLEMENTED(\"getDeviceUserId\"),\n getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n hasPairing: async () => {\n logger.info(`[device] hasPairing`);\n const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n const hex = Buffer.from(res).toString(\"hex\");\n\n // 6f45 => this error means that there is no partition ID on the device\n // if no error, it means there is (at least) one\n //\n // 6a87 => TEMPORARY hack because Stax apparently does not implement\n // the \"get partition id\" APDU, so it returns \"incorrect length\"\n // easier to just assume that in this case there is no partition,\n // and try to insert one anyway (done on revault onboarding)\n //\n return hex !== \"6f45\" && hex !== \"6a87\";\n },\n\n initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n const pubKeyLength = res.readInt8(0);\n const pubKey = res\n .slice(1, pubKeyLength + 1)\n .toString(\"hex\")\n .toUpperCase();\n const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n return { pubKey, signature };\n },\n\n openSession: FIXME_NOT_IMPLEMENTED(\"openSession\"),\n\n register: async (params: {\n challenge: string;\n u2fRegisterData: string;\n name: string;\n role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n }): Promise<{\n u2fRegister: Buffer;\n keyHandle: Buffer;\n rfu: number;\n pubKey: string;\n }> => {\n const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n const challenge = Buffer.from(strChallenge, \"hex\");\n\n invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n const userNameBuff = Buffer.from(name);\n\n const keyHandleData = Buffer.concat([\n Buffer.from(STR_ROLES[role], \"hex\"),\n Buffer.from([userNameBuff.length]),\n userNameBuff,\n ]);\n\n const keyHandleDataLength = Buffer.alloc(2);\n keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n const response = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n );\n\n let i = 0;\n const rfu = response.slice(i, i + 1)[0]!;\n i += 1;\n const pubKey = response.slice(i, i + 65).toString(\"hex\");\n i += 65;\n const keyHandleLength = response.slice(i, i + 1)[0]!;\n i++;\n const keyHandle = response.slice(i, i + keyHandleLength);\n i += keyHandleLength;\n return {\n u2fRegister: removeStatus(response),\n keyHandle,\n rfu,\n pubKey,\n };\n },\n registerData: async (params: { challenge: string }): Promise<string> => {\n const { challenge: strChallenge } = params;\n const challenge = Buffer.from(strChallenge, \"hex\");\n invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n return removeStatus(response).toString(\"hex\");\n },\n\n setPairing: async ({ pairing }) => {\n logger.info(`[device] setPairing`);\n const psdPayload = Buffer.from(pairing.blob, \"base64\");\n const length = Buffer.alloc(2);\n length.writeUInt16BE(psdPayload.length, 0);\n const final = Buffer.concat([length, psdPayload]);\n await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n },\n startKKPatternAsResponder: FIXME_NOT_IMPLEMENTED(\"startKKPatternAsResponder\"),\n startKPatternAsResponder: async (params) => {\n logger.info(`[device] startKPatternAsResponder`);\n const data = buildAttestation(params);\n await run((transport) =>\n sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n );\n },\n validateVaultOperation: async (params) => {\n logger.info(`[device] validateVaultOperation`);\n const path = getPathFromPathString(PATHS.VALIDATION);\n const paths = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n\n let nextActionId = 1;\n let finalResponse: Buffer | null = null;\n\n while (!finalResponse) {\n const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n const length = Buffer.alloc(2);\n length.writeUInt16BE(screen.length, 0);\n const data = Buffer.concat([paths, length, screen]);\n const response = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n );\n const responseType = response.readInt8(0);\n let responseStatus = response.readUInt16BE(response.length - 2);\n switch (responseType) {\n case STREAMING_NEXT_ACTION:\n nextActionId = response.readUIntBE(1, 2);\n break;\n case STREAMING_RESPONSE:\n finalResponse = response.slice(3, response.length - 2);\n while (responseStatus !== 0x9000) {\n /* v8 ignore next -- @preserve */ {\n const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n responseStatus = resp.readUInt16BE(resp.length - 2);\n finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n }\n }\n break;\n /* v8 ignore next -- @preserve */\n default:\n throw new Error(`Invalid response type: ${responseType}`);\n }\n }\n return finalResponse.toString(\"base64\");\n },\n\n sendAPDU: async (apduCommand: string) => {\n const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n return Buffer.from(res).toString(\"hex\");\n },\n getVersion: async () => {\n const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n const appNameLen = res.readInt8(1);\n const appVersionLen = res.readInt8(2 + appNameLen);\n const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n const appVersion = Buffer.from(appVersionHex).toString();\n\n return appVersion;\n },\n poll,\n pollApp,\n };\n return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n baseUrl: string;\n debugAuthToken?: string;\n rootAuthToken?: string;\n apiAccessToken?: string;\n psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n const trpc = createTRPCClient<AppRouter>({\n links: [\n httpLink({\n url: `${options.baseUrl}/trpc`,\n transformer: superjson,\n headers(opts) {\n // Extract headers from the operation context\n const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n return {\n ...(options.debugAuthToken\n ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n : {}),\n ...(options.rootAuthToken\n ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n : {}),\n ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n ...(options.apiAccessToken\n ? { Authorization: `Bearer ${options.apiAccessToken}` }\n : {}),\n // Merge in any headers passed via context\n ...contextHeaders,\n };\n },\n }),\n ],\n });\n return trpc;\n};\n"]}
1
+ {"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"names":["engine","client"],"mappings":"AAAA;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACPA,4FAAsB;ADStB;AACA;AEtBA,0CAAsD;AAGtD;AACA,4BAAoC;AAkBpC,IAAM,iBAAA,EAAmB,GAAA;AAMzB,IAAM,sBAAA,EAAwB,CAAC,UAAA,EAAA,GAAiC;AAC9D,EAAA,MAAM,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,EAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA,EAAM,EAAE,CAAC,CAAA;AAC5E,EAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,EAAA,GAAA,CAAU,KAAA,EAAO,UAAA,EAAA,IAAgB,CAAC,CAAA;AACtD,CAAA;AAEA,IAAM,YAAA,EAAc,CAAC,KAAA,EAAe,MAAA,EAAA,GAA6B;AAC/D,EAAA,MAAM,OAAA,EAAS,CAAC,CAAA;AAChB,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,KAAA,EAAO,KAAA,EAAO,EAAA,EAAI,MAAA,CAAO,MAAA,EAAQ,EAAA,GAAK,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA;AACT,CAAA;AAEA,IAAM,aAAA,EAAe,CAAC,MAAA,EAAA,GAA2B,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,OAAA,EAAS,+BAAa,CAAA;AAE9F,IAAM,YAAA,EAAc,MAAA,CAClB,SAAA,EACA,OAAA,EACA,IAAA,EACA,UAAA,EAAoB,gBAAA,EAAA,GACA;AACpB,EAAA,MAAM,OAAA,EAAS,WAAA,CAAY,SAAA,EAAW,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAC7B,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA;AACtB,IAAA,MAAM,KAAA,EAAO,CAAC,GAAG,OAAO,CAAA;AAGxB,IAAA,IAAA,CAAK,CAAC,EAAA,EAAI,EAAA,GAAK,GAAA;AACf,IAAA,SAAA,EAAY,MAAM,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,CAAC,CAAA,EAAI,KAAA,EAAO;AAAA,MAC7E,KAAA;AAAA,MACA,GAAG;AAAA,IACL,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,QAAA;AACT,CAAA;AAEA,IAAM,iBAAA,EAAmB,CAAC,MAAA,EAAA,GAIZ;AACZ,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,SAAA,EAAW,QAAQ,CAAA;AAC7E,EAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACtC,EAAA,eAAA,CAAgB,WAAA,CAAY,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAElD,EAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,WAAA,EAAa,QAAQ,CAAA;AAChF,EAAA,MAAM,iBAAA,EAAmB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACvC,EAAA,gBAAA,CAAiB,WAAA,CAAY,UAAA,CAAW,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAEpD,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,cAAA,EAAgB,QAAQ,CAAA;AAElF,EAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,IAClC,eAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,KAAK,CAAA;AACxD,EAAA,MAAM,mBAAA,EAAqB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACzC,EAAA,kBAAA,CAAmB,WAAA,CAAY,YAAA,CAAa,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAExD,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,WAAA,EAAa,KAAK,CAAA;AACvD,EAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACtC,EAAA,eAAA,CAAgB,WAAA,CAAY,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAElD,EAAA,MAAM,wBAAA,EAA0B,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC9C,EAAA,uBAAA,CAAwB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAE7D,EAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,IACzB,kBAAA;AAAA,IACA,YAAA;AAAA,IACA,uBAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxC,EAAA,iBAAA,CAAkB,aAAA,CAAc,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAA;AAE9C,EAAA,MAAM,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,CAAC,iBAAA,EAAmB,IAAI,CAAC,CAAA;AAEtD,EAAA,OAAO,MAAA;AACT,CAAA;AAIA,IAAM,oBAAA,EAAoC,CAAC,GAAA,EAAA,GAAQ;AAEjD,EAAA,GAAA,CAAI,IAAA,WAAe,yBAAA,EAAmB,OAAO,IAAA;AAE7C,EAAA,GAAA,CAAI,sDAAA,GAA0B,EAAA,GAAK,GAAA,CAAI,WAAA,IAAe,KAAA,EAAQ,OAAO,IAAA;AAErE,EAAA,GAAA,CAAI,IAAA,WAAe,0BAAA,EAAoB,OAAO,IAAA;AAG9C,EAAA,OAAO,KAAA;AACT,CAAA;AAEO,SAAS,gBAAA,CAAiB,OAAA,EAAkB,MAAA,EAAwB;AACzE,EAAA,MAAM,EAAE,YAAY,EAAA,EAAI,OAAA;AAExB,EAAA,MAAA,SAAe,GAAA,CACb,GAAA,EACA,aAAA,EAA6B,mBAAA,EACjB;AACZ,IAAA,OAAO,iCAAA;AAAA,MACL,iDAAA,WAA6B,CAAA,CAAK,CAAC,SAAA,EAAA,GAAc,wBAAA,GAAK,CAAI,SAAS,CAAC,CAAA,EAAG,YAAY;AAAA,IACrF,CAAA;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,EAAU,CAAA,EAAA,GAAe,KAAA;AAE/B,EAAA,MAAM,YAAA,EAAc,CAAA,EAAA,GAAe,IAAA;AACnC,EAAA,MAAM,KAAA,EAAO,MAAA,CACX,KAAA,EAAwC,CAAC,CAAA,EAAA,GACH;AAEtC,IAAA,MAAM,GAAA;AAAA;AAAA,MAEJ,MAAA,CAAO,UAAA,EAAA,GAAe;AAAA,MAAC,CAAA;AAAA,uBACvB,IAAA,CAAK,YAAA,UAAgB;AAAA,IACvB,CAAA;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,CAAa,uBAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,YAAA,EAAc,QAAQ,CAAC,CAAA;AACxE,MAAA,OAAO,EAAE,WAAA,EAAa,KAAK,CAAA;AAAA,IAC7B,EAAA,MAAA,CAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,sDAAA,GAA0B,EAAA,GAAK,mBAAA,CAAoB,GAAG,CAAA,EAAG;AAC3D,QAAA,OAAO,EAAE,WAAA,EAAa,MAAM,CAAA;AAAA,MAC9B;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,QAAA,EAAU,MAAA,CAAO,OAAA,EAAA,GAAqC;AAC1D,IAAA,MAAM,IAAA,EAAM,MAAM,GAAA;AAAA,MAAI,CAAC,SAAA,EAAA,GACrB,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,MAAM,CAAC;AAAA,IACrE,CAAA;AAEA,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,CAAA,EAAA,GAAM,UAAA,CAAW,CAAA,EAAG,GAAG,CAAC,CAAA;AAC3C,IAAA,OAAO,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,EAC3B,CAAA;AAEA,EAAA,MAAM,aAAA,EAAe,MAAA,CACnB,UAAA,EACA,EAAE,SAAA,EAAW,aAAa,CAAA,EAAA,GACyB;AACnD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,CAAG,CAAA;AACnD,IAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,UAAU,CAAA;AAC7C,IAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,MACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,MACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,QAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,QAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,QAAA,OAAO,GAAA;AAAA,MACT,CAAC;AAAA,IACH,CAAC,CAAA;AACD,IAAA,MAAM,MAAA,EAAQ,UAAA,EAAY,EAAA,EAAO,CAAA;AACjC,IAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,MACrB,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,KAAA,EAAO,CAAA,EAAM,IAAI,CAAA;AAAA,uBAC3D,YAAA,UAAgB;AAAA,IAClB,CAAA;AACA,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,QAAA,CAAS,CAAC,CAAA;AACxC,IAAA,MAAM,OAAA,EAAS,QAAA,CACZ,KAAA,CAAM,CAAA,EAAG,aAAA,EAAe,CAAC,CAAA,CACzB,QAAA,CAAS,KAAK,CAAA,CACd,WAAA,CAAY,CAAA;AACf,IAAA,MAAM,UAAA,EAAY,QAAA,CACf,KAAA,CAAM,aAAA,EAAe,CAAA,EAAG,QAAA,CAAS,OAAA,EAAS,+BAAa,CAAA,CACvD,QAAA,CAAS,QAAQ,CAAA;AACpB,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,EAC7B,CAAA;AAEA,EAAA,MAAM,OAAA,EAAiB;AAAA,IACrB,YAAA,EAAc,MAAA,CAAO,EAAE,SAAA,EAAW,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,UAAU,CAAA,EAAG,cAAc,CAAA,EAAA,GAAM;AAC1F,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,qBAAA,CAAuB,CAAA;AACnC,MAAA,iCAAA,KAAU,IAAS,mBAAA,EAAqB,kDAAkD,CAAA;AAC1F,MAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,2CAAA,EAA2B,KAAK,CAAA;AACtE,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnC,MAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA;AAEjD,MAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,2BAAA,CAAU,IAAI,CAAA,EAAG,KAAK,CAAA;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,CAAC,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,QAC/B,UAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,QACpC;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,oBAAA,EAAsB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1C,MAAA,mBAAA,CAAoB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAEzD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA;AAAA,QAC/B,iBAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,QAC9B,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,KAAK,CAAA;AAAA,QAC5B,mBAAA;AAAA,QACA;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,eAAA,EAAiB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAChC,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,MACvD,CAAA;AAEA,MAAA,OAAO,YAAA,CAAa,cAAc,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IACpD,CAAA;AAAA,IAEA,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAA,GAIV;AACrB,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC/B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,gBAAA,CAAiB,MAAM,CAAC;AAAA,MAC3E,CAAA;AACA,MAAA,OAAO,YAAA,CAAa,aAAa,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IACnD,CAAA;AAAA,IAEA,oBAAA,EAAsB,MAAA,CAAA,EAAA,GAA6B;AACjD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,6BAAA,CAA+B,CAAA;AAC3C,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,YAAY,CAAA;AACrD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AACD,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,IAAI,CAAC,CAAA;AACtF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,2BAAA,EAA6B,MAAA,CAAA,EAAA,GAA6B;AACxD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oCAAA,CAAsC,CAAA;AAClD,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,YAAY,CAAA;AACrD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AACD,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,IAAI,CAAC,CAAA;AACtF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,cAAA,EAAgB,MAAA,CAAA,EAAA,GAOV;AACJ,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AACrF,MAAA,MAAM,OAAA,EAAS,YAAA,CAAa,aAAa,CAAA;AACzC,MAAA,MAAM,QAAA,EAAU,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAA;AAC3C,MAAA,OAAO;AAAA,QACL,WAAA,EAAa;AAAA,UACX,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,UAC/C,cAAA,EAAgB,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI,GAAA,EAAK,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,UAC3D,WAAA,EAAa,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,EAAA,EAAI,OAAO,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,QAC7E,CAAA;AAAA,QACA;AAAA,MACF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,qBAAA,EAAuB,MAAA,CAAA,EAAA,GAAY;AACjC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,8BAAA,CAAgC,CAAA;AAC5C,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AACrF,MAAA,MAAM,IAAA,EAAM,YAAA,CAAa,aAAa,CAAA;AACtC,MAAA,MAAM,UAAA,EAAY,GAAA,CAAI,CAAC,CAAA;AACvB,MAAA,MAAM,IAAA,EAAM,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,SAAS,CAAA;AACtC,MAAA,MAAM,IAAA,EAAM,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,UAAA,EAAY,CAAC,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,4BAAA,EAA8B,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,QAChD,2BAAA,EAA6B,GAAA,CAAI,QAAA,CAAS,KAAK;AAAA,MACjD,CAAA;AAAA,IACF,CAAA;AAAA,IACA,wBAAA,EAA0B,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,eAAA,EAAiB,EAAE,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,IACvF,eAAA,EAAiB,MAAA,CAAA,EAAA,GAA6B;AAC5C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,wBAAA,CAA0B,CAAA;AACtC,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAChF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA,CAAE,WAAA,CAAY,CAAA;AAAA,IAC5D,CAAA;AAAA,IACA,YAAA,EAAc,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAC,CAAA;AAAA,IAChE,mBAAA,EAAqB,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,UAAA,EAAY,EAAE,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,IAC7E,UAAA,EAAY,MAAA,CAAA,EAAA,GAAY;AACtB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,CAAqB,CAAA;AACjC,MAAA,MAAM,KAAA,EAAO,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,GAAI,CAAA;AAC1C,MAAA,MAAM,IAAA,EAAM,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAC1E,MAAA,MAAM,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAU3C,MAAA,OAAO,IAAA,IAAQ,OAAA,GAAU,IAAA,IAAQ,MAAA;AAAA,IACnC,CAAA;AAAA,IAEA,oBAAA,EAAsB,MAAA,CAAA,EAAA,GAA4D;AAChF,MAAA,MAAM,IAAA,EAAM,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAC3E,MAAA,MAAM,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,CAAC,CAAA;AACnC,MAAA,MAAM,OAAA,EAAS,GAAA,CACZ,KAAA,CAAM,CAAA,EAAG,aAAA,EAAe,CAAC,CAAA,CACzB,QAAA,CAAS,KAAK,CAAA,CACd,WAAA,CAAY,CAAA;AACf,MAAA,MAAM,UAAA,EAAY,GAAA,CAAI,KAAA,CAAM,aAAA,EAAe,CAAA,EAAG,GAAA,CAAI,OAAA,EAAS,+BAAa,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAC3F,MAAA,OAAO,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,IAC7B,CAAA;AAAA,IAEA,WAAA,EAAa,MAAA,CAAO,MAAA,EAAA,GAEC;AACnB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oBAAA,CAAsB,CAAA;AAClC,MAAA,MAAM,EAAE,cAAc,EAAA,EAAI,MAAA;AAE1B,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,eAAe,CAAA;AACxD,MAAA,MAAM,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO;AAAA,QACnC,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AAED,MAAA,MAAM,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,CAAA;AAEtD,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA;AAC3E,MAAA,MAAM,qBAAA,EAAuB,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,cAAA,EAAgB,QAAQ,CAAA;AAC3F,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,WAAA,EAAa,QAAQ,CAAA;AAC9E,MAAA,MAAM,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO;AAAA,QAChC,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,QAC9B,SAAA;AAAA,QACA,oBAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxC,MAAA,iBAAA,CAAkB,aAAA,CAAc,WAAA,CAAY,MAAA,EAAQ,CAAC,CAAA;AAErD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,cAAA,EAAgB,MAAA,EAAQ,iBAAA,EAAmB,WAAW,CAAC,CAAA;AAEnF,MAAA,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GACT,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,YAAY,CAAA,EAAG,IAAI;AAAA,MAC1E,CAAA;AAAA,IACF,CAAA;AAAA,IAEA,QAAA,EAAU,MAAA,CAAO,MAAA,EAAA,GAUX;AACJ,MAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,eAAA,EAAiB,CAAA,EAAG,IAAA,EAAM,KAAK,EAAA,EAAI,MAAA;AACpE,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAEjD,MAAA,iCAAA,SAAU,CAAU,OAAA,IAAW,EAAA,EAAI,4CAA4C,CAAA;AAC/E,MAAA,MAAM,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,2CAAA,EAA2B,KAAK,CAAA;AACnE,MAAA,iCAAA,cAAU,CAAe,OAAA,IAAW,EAAA,EAAI,8CAA8C,CAAA;AAEtF,MAAA,MAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAErC,MAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,2BAAA,CAAU,IAAI,CAAA,EAAG,KAAK,CAAA;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,CAAC,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,oBAAA,EAAsB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1C,MAAA,mBAAA,CAAoB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAEzD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,cAAA,EAAgB,mBAAA,EAAqB,aAAa,CAAC,CAAA;AAE1F,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC1B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,MACvD,CAAA;AAEA,MAAA,IAAI,EAAA,EAAI,CAAA;AACR,MAAA,MAAM,IAAA,EAAM,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AACtC,MAAA,EAAA,GAAK,CAAA;AACL,MAAA,MAAM,OAAA,EAAS,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AACvD,MAAA,EAAA,GAAK,EAAA;AACL,MAAA,MAAM,gBAAA,EAAkB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AAClD,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,eAAe,CAAA;AACvD,MAAA,EAAA,GAAK,eAAA;AACL,MAAA,OAAO;AAAA,QACL,WAAA,EAAa,YAAA,CAAa,QAAQ,CAAA;AAAA,QAClC,SAAA;AAAA,QACA,GAAA;AAAA,QACA;AAAA,MACF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,MAAA,EAAA,GAAmD;AACtE,MAAA,MAAM,EAAE,SAAA,EAAW,aAAa,EAAA,EAAI,MAAA;AACpC,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACjD,MAAA,iCAAA,SAAU,CAAU,OAAA,IAAW,EAAA,EAAI,4CAA4C,CAAA;AAC/E,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAA,EAAM,SAAS,CAAC,CAAA;AAC3F,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC9C,CAAA;AAAA,IAEA,UAAA,EAAY,MAAA,CAAO,EAAE,QAAQ,CAAA,EAAA,GAAM;AACjC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,CAAqB,CAAA;AACjC,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA;AACrD,MAAA,MAAM,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,MAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AACzC,MAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAChD,MAAA,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,yBAAA,EAA2B,MAAA,CAAO,MAAA,EAAA,GAIuB;AACvD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,kCAAA,CAAoC,CAAA;AAChD,MAAA,MAAM,KAAA,EAAO,gBAAA,CAAiB,MAAM,CAAA;AACpC,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC/B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,uBAAuB,CAAA,EAAG,IAAI;AAAA,MACrF,CAAA;AACA,MAAA,MAAM,OAAA,EAAS,YAAA,CAAa,aAAa,CAAA;AACzC,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA;AACpC,MAAA,OAAO;AAAA,QACL,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,WAAA,EAAa,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,QAC5D,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,MAC3D,CAAA;AAAA,IACF,CAAA;AAAA,IACA,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAA,GAAW;AAC1C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,CAAmC,CAAA;AAC/C,MAAA,MAAM,KAAA,EAAO,gBAAA,CAAiB,MAAM,CAAA;AACpC,MAAA,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GACT,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,uBAAuB,CAAA,EAAG,IAAI;AAAA,MACrF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,sBAAA,EAAwB,MAAA,CAAO,MAAA,EAAA,GAAW;AACxC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,+BAAA,CAAiC,CAAA;AAC7C,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,UAAU,CAAA;AACnD,MAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO;AAAA,QAC1B,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AAED,MAAA,IAAI,aAAA,EAAe,CAAA;AACnB,MAAA,IAAI,cAAA,EAA+B,IAAA;AAEnC,MAAA,MAAA,CAAO,CAAC,aAAA,EAAe;AACrB,QAAA,MAAM,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,aAAA,EAAe,CAAC,CAAA,EAAI,QAAQ,CAAA;AACtE,QAAA,MAAM,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,QAAA,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,MAAA,EAAQ,CAAC,CAAA;AACrC,QAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAM,CAAC,CAAA;AAClD,QAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,UAAI,CAAC,SAAA,EAAA,GAC1B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,QACvD,CAAA;AACA,QAAA,MAAM,aAAA,EAAe,QAAA,CAAS,QAAA,CAAS,CAAC,CAAA;AACxC,QAAA,IAAI,eAAA,EAAiB,QAAA,CAAS,YAAA,CAAa,QAAA,CAAS,OAAA,EAAS,CAAC,CAAA;AAC9D,QAAA,OAAA,CAAQ,YAAA,EAAc;AAAA,UACpB,KAAK,uCAAA;AACH,YAAA,aAAA,EAAe,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AACvC,YAAA,KAAA;AAAA,UACF,KAAK,oCAAA;AACH,YAAA,cAAA,EAAgB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,QAAA,CAAS,OAAA,EAAS,CAAC,CAAA;AACrD,YAAA,MAAA,CAAO,eAAA,IAAmB,KAAA,EAAQ;AACE,cAAA;AAChC,gBAAA,MAAM,KAAA,EAAO,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,CAAA,EAAM,GAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAC5E,gBAAA,eAAA,EAAiB,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,CAAC,CAAA;AAClD,gBAAA,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO,CAAC,aAAA,EAAe,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,cACnE;AAAA,YACF;AACA,YAAA,KAAA;AAAA;AAAA,UAEF,OAAA;AACE,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,YAAY,CAAA,CAAA;AAC1D,QAAA;AACF,MAAA;AACsC,MAAA;AACxC,IAAA;AAEyC,IAAA;AACiB,MAAA;AAClB,MAAA;AACxC,IAAA;AACwB,IAAA;AAC0C,MAAA;AAC/B,MAAA;AACgB,MAAA;AACO,MAAA;AAED,MAAA;AAEhD,MAAA;AACT,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACO,EAAA;AACT;AF5HmE;AACA;AGnaP;AAEtC;AAiB4D;AACvC,EAAA;AAChC,IAAA;AACI,MAAA;AACgB,QAAA;AACV,QAAA;AACC,QAAA;AAEoE,UAAA;AAEzE,UAAA;AAEC,YAAA;AAGA,YAAA;AAE4C,YAAA;AAEnB,YAAA;AAC1B;AAEF,YAAA;AACL,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AACD,EAAA;AACM,EAAA;AACT;AH4YmE;AACA;AChZjC;AAChC,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAca;AAC8C,EAAA;AACnC,IAAA;AACF,IAAA;AACY,IAAA;AACjC,EAAA;AACyD,EAAA;AACX,EAAA;AAC7C,IAAA;AACkB,IAAA;AACR,IAAA;AAC6B,IAAA;AACN,IAAA;AACL,IAAA;AACX,MAAA;AACY,MAAA;AAC7B,IAAA;AACF,EAAA;AACiE,EAAA;AACJ,EAAA;AACtC,IAAA;AACE,IAAA;AACS,IAAA;AACjC,EAAA;AACyB,EAAA;AACa,EAAA;AAChB,IAAA;AACM,IAAA;AAC3B,IAAA;AACA,IAAA;AACD,EAAA;AACyD,EAAA;AACE,EAAA;AACG,EAAA;AAC7B,EAAA;AACe,IAAA;AACR,IAAA;AAC3B,IAAA;AACgC,IAAA;AAC7B,EAAA;AAC4C,EAAA;AAC3D,IAAA;AACa,IAAA;AACI,MAAA;AACa,MAAA;AAC9B,IAAA;AACA,IAAA;AAC+C,IAAA;AACf,IAAA;AAChC,IAAA;AACF,EAAA;AACmD,EAAA;AACrD;AAE6E;AAClC,EAAA;AACtB,IAAA;AACnB,EAAA;AACyC,EAAA;AACQ,EAAA;AAExB,EAAA;AACvB,IAAA;AAC8D,IAAA;AACnD,IAAA;AACb,EAAA;AAKE,EAAA;AACyC,IAAA;AACJ,IAAA;AACkC,IAAA;AACzE,EAAA;AAKE,EAAA;AACuD,IAAA;AAClB,IAAA;AACkC,IAAA;AACzE,EAAA;AAEyE,EAAA;AAClB,IAAA;AACuB,IAAA;AAC9E,EAAA;AAKE,EAAA;AACsE,IAAA;AACU,IAAA;AAClF,EAAA;AAKE,EAAA;AACsE,IAAA;AACY,IAAA;AACpF,EAAA;AASa,EAAA;AAGH,IAAA;AAC2D,MAAA;AACnE,IAAA;AAImB,IAAA;AACjB,MAAA;AAEK,QAAA;AAC+C,UAAA;AACjBA,YAAAA;AACkB,YAAA;AACI,YAAA;AAC1C,YAAA;AACT,UAAA;AACF,QAAA;AACJ,MAAA;AACF,IAAA;AAI4D,IAAA;AACmB,MAAA;AAC/CA,QAAAA;AACrB,QAAA;AAC+E,UAAA;AAC7B,YAAA;AACV,YAAA;AACG,YAAA;AACF,YAAA;AAC9C,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4C,IAAA;AACyC,MAAA;AACtCA,QAAAA;AACI,QAAA;AACd,UAAA;AACwB,UAAA;AACjC,YAAA;AACS,YAAA;AAC9B,UAAA;AACuC,UAAA;AACtC,YAAA;AACc,YAAA;AACR,YAAA;AAC6C,cAAA;AACD,cAAA;AAClD,YAAA;AACD,UAAA;AACkC,UAAA;AACrC,QAAA;AACO,QAAA;AACoF,UAAA;AAC1D,YAAA;AACwB,YAAA;AAC/B,cAAA;AACY,cAAA;AACjC,YAAA;AAC0C,YAAA;AAC3B,cAAA;AACqB,cAAA;AACpC,YAAA;AACH,UAAA;AAIE,UAAA;AAEuD,YAAA;AACjC,cAAA;AACY,cAAA;AACjC,YAAA;AACwB,YAAA;AACR,cAAA;AACO,gBAAA;AACK,gBAAA;AAC3B,cAAA;AACD,YAAA;AACmD,YAAA;AAClB,YAAA;AACoB,YAAA;AACJ,YAAA;AAChD,cAAA;AACc,cAAA;AACJ,cAAA;AACR,gBAAA;AACoC,gBAAA;AACd,gBAAA;AACjB,kBAAA;AAC2B,kBAAA;AAChC,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AAKoB,UAAA;AACK,YAAA;AAGjBC,YAAAA;AAIAA,YAAAA;AAEgB,YAAA;AACpB,cAAA;AACA,cAAA;AACA,cAAA;AAEE,cAAA;AACgB,gBAAA;AACd,gBAAA;AACA,gBAAA;AACD,cAAA;AAED,cAAA;AACuB,gBAAA;AACrB,gBAAA;AAAA;AAEU,gBAAA;AACX,cAAA;AACwB,cAAA;AAC5B,YAAA;AACH,UAAA;AAKoB,UAAA;AACG,YAAA;AACwB,YAAA;AACP,YAAA;AACf,cAAA;AACW,cAAA;AACT,cAAA;AACxB,YAAA;AACiC,YAAA;AACoB,YAAA;AACjC,cAAA;AACpB,YAAA;AACuB,YAAA;AACR,cAAA;AACd,cAAA;AACA,cAAA;AACD,YAAA;AACH,UAAA;AAKoB,UAAA;AACG,YAAA;AAC+B,YAAA;AAC9B,cAAA;AACE,cAAA;AACvB,YAAA;AACqC,YAAA;AACf,cAAA;AACW,cAAA;AACT,cAAA;AACxB,YAAA;AACiC,YAAA;AACK,YAAA;AAClB,cAAA;AACpB,YAAA;AAC8B,YAAA;AACN,cAAA;AACF,cAAA;AACW,cAAA;AACjC,YAAA;AACsD,YAAA;AACL,YAAA;AAClC,cAAA;AACd,cAAA;AACc,cAAA;AACZ,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACC,gBAAA;AACjB,kBAAA;AACkB,kBAAA;AACvB,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIuD,IAAA;AACrD,MAAA;AACc,QAAA;AACkCD,UAAAA;AACrC,UAAA;AAQ+B,YAAA;AACW,cAAA;AACL,cAAA;AACtC,gBAAA;AACE,kBAAA;AACe,kBAAA;AACjB,gBAAA;AACwC,gBAAA;AAC1C,cAAA;AACgC,cAAA;AACiB,cAAA;AAC/C,gBAAA;AACe,gBAAA;AAChB,cAAA;AACmB,cAAA;AACH,gBAAA;AACf,gBAAA;AACA,gBAAA;AAC4B,gBAAA;AAC9B,cAAA;AACwC,cAAA;AACrB,gBAAA;AACuB,gBAAA;AAC1C,cAAA;AACiC,cAAA;AACnB,gBAAA;AACd,cAAA;AACkD,cAAA;AACE,cAAA;AACX,cAAA;AAG3C,YAAA;AAIwC,YAAA;AACf,cAAA;AACrB,gBAAA;AACmB,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACP,kBAAA;AACZ,oBAAA;AACF,oBAAA;AACf,oBAAA;AACD,kBAAA;AACM,kBAAA;AACT,gBAAA;AAEEC,gBAAAA;AACiB,kBAAA;AACE,kBAAA;AACjB,kBAAA;AACD,gBAAA;AACJ,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAI4D,IAAA;AAC1D,MAAA;AACc,QAAA;AAC0BD,UAAAA;AAC7B,UAAA;AAQ+B,YAAA;AACS,cAAA;AACzC,gBAAA;AACwB,kBAAA;AACI,kBAAA;AACf,kBAAA;AACb,gBAAA;AACwC,gBAAA;AAC1C,cAAA;AACiC,cAAA;AACpB,gBAAA;AACb,cAAA;AAC2C,cAAA;AACF,cAAA;AAG3C,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAIsD,IAAA;AACoC,MAAA;AAC3DA,QAAAA;AAEoB,QAAA;AACd,UAAA;AACS,UAAA;AACe,UAAA;AACJ,YAAA;AACD,YAAA;AACjD,UAAA;AACkC,UAAA;AACrC,QAAA;AAKsB,QAAA;AACC,UAAA;AACiB,UAAA;AACf,YAAA;AACW,YAAA;AACT,YAAA;AACxB,UAAA;AACiC,UAAA;AACoB,UAAA;AACjC,YAAA;AACpB,UAAA;AACM,UAAA;AACT,QAAA;AAEO,QAAA;AAI+B,UAAA;AACU,YAAA;AACL,YAAA;AACe,cAAA;AACf,cAAA;AACN,cAAA;AAC7B,gBAAA;AACc,kBAAA;AAC4B,kBAAA;AAC1C,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACwC,YAAA;AACP,cAAA;AAC7B,gBAAA;AACc,kBAAA;AACkB,kBAAA;AAChC,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACgB,YAAA;AAClB,UAAA;AAEA,UAAA;AAKoC,UAAA;AACJ,YAAA;AACC,cAAA;AACR,cAAA;AACvB,YAAA;AACF,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIgD,IAAA;AAC2C,MAAA;AACpEA,QAAAA;AACZ,QAAA;AACoF,UAAA;AAC3C,YAAA;AACC,YAAA;AAC5B,YAAA;AACnB,UAAA;AAKoC,UAAA;AACI,YAAA;AACxB,cAAA;AAC4B,cAAA;AACzC,YAAA;AACH,UAAA;AAKoC,UAAA;AACG,YAAA;AACvB,cAAA;AAC4B,cAAA;AACzC,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAEO,IAAA;AACT,EAAA;AAEO,EAAA;AACF,IAAA;AACH,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;AD4QmE;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","sourcesContent":[null,"import type {\n ApiChallenge,\n ClaimedRole,\n OnboardingSeedChallenge,\n PsdChallenge,\n UserRegistrationChallenge,\n UserRegistrationChallengeResponse,\n UserRegistrationDeviceData,\n UserRegistrationResponse,\n VaultRequestResponse,\n WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n ApproveRequestParams,\n CorrelationIdOpts,\n DecorateWithApiUserAndWorkspaceUnauthenticated,\n DecorateWithDevice,\n DecorateWithDeviceAndOnboarding,\n DecorateWithDeviceAndWorkspaceUnauthenticated,\n DecorateWithWorkspaceApiAuthenticated,\n DecorateWithWorkspacePsdAuthenticated,\n DecorateWithWorkspaceUnauthenticated,\n Engine,\n EngineBase,\n EngineOptions,\n OnboardingOperationParams,\n RegisterOnboardingDeviceParams,\n WithApiAuth,\n WithApiUser,\n WithDevice,\n WithOnboarding,\n WithPsdAuth,\n WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n device,\n name,\n role,\n getChallenge,\n submitChallenge,\n onScreenDisplayed,\n}: {\n device: Device;\n name: string;\n role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n getChallenge: (p: {\n pubKey: string;\n deviceData: UserRegistrationDeviceData;\n }) => Promise<UserRegistrationChallenge>;\n submitChallenge: (p: {\n pubKey: string;\n challengeResponse: UserRegistrationChallengeResponse;\n }) => Promise<T>;\n onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n device.getAttestation(),\n device.getU2FPubKey(),\n device.getConfidentialityPubKey(),\n ]);\n const ephemeralPubKey = await device.initPairingHandshake();\n const deviceData: UserRegistrationDeviceData = {\n name,\n pubKey: u2fPubKey.pubKey,\n psdModel: \"STAX\",\n confidentialityKey: confidentialityKey.pubKey,\n psdEphemeralKey: ephemeralPubKey.pubKey,\n psdEphemeralKeyAttestation: {\n ...attestation.attestation,\n signature: ephemeralPubKey.signature,\n },\n };\n const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n const pairingPayload = await device.finalizePairingHandshake({\n handshake: challenge.handshake,\n partitionId: challenge.ciphertext,\n handshakeAttestation: challenge.handshakeAttestation,\n });\n await onScreenDisplayed?.();\n const register = await device.register({\n challenge: challenge.challenge,\n u2fRegisterData: challenge.u2fRegisterData,\n name,\n role,\n });\n const validationPubKey = await device.getValidationPubKey();\n const registerData = await device.registerData({ challenge: challenge.challenge });\n const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n const u2fRegister = Buffer.concat([\n register.u2fRegister.slice(0, attestationOffset),\n Buffer.from([attestation.buffer.length]),\n attestation.buffer,\n register.u2fRegister.slice(attestationOffset),\n ]).toString(\"hex\");\n const challengeResponse: UserRegistrationChallengeResponse = {\n registerData,\n certificate: {\n ...attestation.attestation,\n signature: validationPubKey.signature,\n },\n u2fRegister,\n u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n validationKey: validationPubKey.pubKey,\n pairingPayload,\n };\n return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n const clientOptions: TRPCClientOptions = {\n baseUrl: options.baseUrl,\n };\n const client = createClient(clientOptions);\n const apiDevice = createApiDevice(options, logger);\n\n const base: EngineBase = {\n client,\n createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n __options: options,\n };\n\n const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n this: Engine<T>,\n deviceIndex: number,\n ) {\n const device = apiDevice.with(deviceIndex);\n const withPsd: WithDevice = { device };\n return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n };\n\n const withTransportId: Engine[\"withTransportId\"] = function <T>(\n this: Engine<T>,\n transportId: string,\n ) {\n const device = createRealDevice({ transportId }, logger);\n const withPsd: WithDevice = { device };\n return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n };\n\n const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n const withApiUser: WithApiUser = { __isApiUser: true };\n return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n };\n\n const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n this: Engine<T>,\n workspaceName: string,\n ) {\n const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n };\n\n const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n this: Engine<T>,\n onboardingId: string,\n ) {\n const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n };\n\n function decorateEngine<T>(\n engine: Engine<\n T &\n Partial<\n WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n >\n >,\n ): Engine<T> {\n function decorate<TEnhanced, TDecoration>(\n decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n ): void {\n Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n }\n\n // DecorateWithDevice\n // -------------------------------------------------------------------------\n if (engine.device) {\n decorate<WithDevice, DecorateWithDevice<T>>(\n (engine) =>\n ({\n getWorkspaces: async (): Promise<string[]> => {\n const { device, client } = engine;\n const { pubKey } = await device.getU2FPubKey();\n const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n return workspaceNames;\n },\n }) satisfies DecorateWithDevice<T>,\n );\n }\n\n // DecorateWithWorkspaceUnauthenticated\n // -------------------------------------------------------------------------\n if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n const { __workspaceName } = engine;\n return {\n withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n const withPsdAuth: WithPsdAuth = { __psdToken: token };\n const psdAuth = `${__workspaceName}:${token}`;\n const client = engine.createClient({ psdAuth });\n return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n },\n } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n });\n }\n\n // DecorateWithDeviceAndOnboarding\n // -------------------------------------------------------------------------\n if (engine.device && engine.__onboardingId) {\n decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n const { device, client, __onboardingId } = engine;\n async function enforcePairing(): Promise<void> {\n if (await device.hasPairing()) return;\n const [{ pubKey }, confidentialityKey] = await Promise.all([\n device.getU2FPubKey(),\n device.getConfidentialityKey(),\n ]);\n const pairing = await client.onboarding.pairDevicePartition.mutate({\n pubKey,\n onboardingId: __onboardingId,\n data: {\n confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n },\n });\n await device.setPairing({ pairing });\n }\n return {\n claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n const { role, deviceName } = params;\n const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n device.getU2FPubKey(),\n device.getConfidentialityPubKey(),\n ]);\n await client.onboarding.claimDevice.mutate({\n onboardingId: __onboardingId,\n claim: { role, pubKey, deviceName, confidentialityKey },\n });\n },\n\n collectWrappingKeyFragment: async (\n wrappingKey: WrappingKeyResponse,\n params?: OnboardingOperationParams,\n ): Promise<void> => {\n const [{ pubKey }, confidentialityKey] = await Promise.all([\n device.getU2FPubKey(),\n device.getConfidentialityPubKey(),\n ]);\n await device.openSession({\n secureChannel: {\n pubKey: wrappingKey.ephemeralPubKey,\n certificate: wrappingKey.ephemeralCertificate,\n },\n });\n const { attestation } = await device.getAttestation();\n await params?.onScreenDisplayed?.();\n const blob = await device.generateWrappingKeyFragment();\n await client.onboarding.submitWrappingKeyFragment.mutate({\n pubKey,\n onboardingId: __onboardingId,\n fragment: {\n blob,\n ephemeralPubKey: confidentialityKey.pubKey,\n ephemeralCertificate: {\n ...attestation,\n signature: confidentialityKey.signature,\n },\n },\n });\n },\n\n registerDevice: async (\n registerParams: RegisterOnboardingDeviceParams,\n params?: OnboardingOperationParams,\n ): Promise<void> => {\n const { role, name } = registerParams;\n const getChallengeMutation =\n role === \"ADMIN\"\n ? client.onboarding.generateMasterAdminRegistrationChallenge\n : client.onboarding.generateSharedOwnerRegistrationChallenge;\n const submitChallengeMutation =\n role === \"ADMIN\"\n ? client.onboarding.submitMasterAdminRegistration\n : client.onboarding.submitSharedOwnerRegistration;\n await genericRegister({\n device: device,\n name,\n role,\n getChallenge: ({ pubKey, deviceData }) =>\n getChallengeMutation.mutate({\n onboardingId: __onboardingId,\n pubKey,\n deviceData,\n }),\n submitChallenge: ({ pubKey, challengeResponse }) =>\n submitChallengeMutation.mutate({\n onboardingId: engine.__onboardingId,\n pubKey,\n // FIXME this should be renamed to `challengeResponse` on backend side\n response: challengeResponse,\n }),\n onScreenDisplayed: params?.onScreenDisplayed,\n });\n },\n\n reviewSharedOwner: async (\n challenge: PsdChallenge,\n params?: OnboardingOperationParams,\n ): Promise<void> => {\n await enforcePairing();\n const { pubKey } = await device.getU2FPubKey();\n await device.startKPatternAsResponder({\n handshake: challenge.handshake,\n handshakeAttestation: challenge.handshakeAttestation,\n partitionId: challenge.partitionId,\n });\n await params?.onScreenDisplayed?.();\n const signature = await device.validateVaultOperation({\n actions: challenge.wActions,\n });\n await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n onboardingId: __onboardingId,\n pubKey,\n signature,\n });\n },\n\n collectSeedFragment: async (\n challenge: OnboardingSeedChallenge,\n params?: OnboardingOperationParams,\n ): Promise<void> => {\n await enforcePairing();\n const [{ pubKey }, { attestation }] = await Promise.all([\n device.getU2FPubKey(),\n device.getAttestation(),\n ]);\n await device.startKPatternAsResponder({\n handshake: challenge.handshake,\n handshakeAttestation: challenge.handshakeAttestation,\n partitionId: challenge.partitionId,\n });\n await params?.onScreenDisplayed?.();\n const challengeResponse = await device.validateVaultOperation({\n actions: challenge.wActions,\n });\n const kkPattern = await device.startKKPatternAsResponder({\n partitionId: challenge.partitionId,\n handshake: challenge.kkHandshake,\n handshakeAttestation: challenge.kkHandshakeAttestation,\n });\n const approverBlob = await device.generateSeedFragment();\n await client.onboarding.submitSeedFragment.mutate({\n onboardingId: __onboardingId,\n pubKey,\n seedFragment: {\n challengeResponse,\n approverBlob,\n handshake: kkPattern.handshake,\n handshakeAttestation: {\n ...attestation,\n signature: kkPattern.signature,\n },\n },\n });\n },\n } satisfies DecorateWithDeviceAndOnboarding;\n });\n }\n\n // DecorateWithDeviceAndWorkspaceUnauthenticated\n // -------------------------------------------------------------------------\n if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n (engine) => {\n const { device, client, __workspaceName } = engine;\n return {\n login: async function <T>(\n this: Engine<T>,\n opts?: {\n validityDurationSecs?: number;\n onScreenDisplayed?: () => void | Promise<void>;\n correlationId?: string;\n },\n ): Promise<Engine<T & WithPsdAuth>> {\n const { pubKey } = await device.getU2FPubKey();\n const challenge = await client.auth.psd.generateChallenge.mutate(\n {\n pubKey,\n workspaceName: __workspaceName,\n },\n buildTrpcContext({ correlationId: opts?.correlationId }),\n );\n await opts?.onScreenDisplayed?.();\n const authentication = await device.authenticate({\n challenge,\n workspaceName: __workspaceName,\n });\n const authPayload = {\n workspaceName: __workspaceName,\n pubKey,\n authentication,\n validityDurationSecs: opts?.validityDurationSecs,\n };\n const { token } = await client.auth.psd.authenticate.mutate(\n { ...authPayload },\n buildTrpcContext({ correlationId: opts?.correlationId }),\n );\n const withPsdAuth: WithPsdAuth = {\n __psdToken: token,\n };\n const psdAuth = `${engine.__workspaceName}:${token}`;\n const __authClient = engine.createClient({ psdAuth });\n return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n T & WithPsdAuth\n >);\n },\n\n register: (\n registration: UserRegistrationResponse,\n ): Promise<UserRegistrationResponse> => {\n return genericRegister({\n device,\n name: registration.name,\n role: registration.role,\n getChallenge: async ({ deviceData }) => {\n const challenge = await client.userRegistrations.generateChallenge.mutate({\n id: registration.id,\n workspaceName: __workspaceName,\n deviceData,\n });\n return challenge;\n },\n submitChallenge: ({ challengeResponse }) =>\n client.userRegistrations.submitChallenge.mutate({\n workspaceName: __workspaceName,\n id: registration.id,\n challengeResponse,\n }),\n });\n },\n } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n },\n );\n }\n\n // DecorateWithApiUserAndWorkspaceUnauthenticated\n // -------------------------------------------------------------------------\n if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n (engine) => {\n const { client, __workspaceName } = engine;\n return {\n login: async function <T>(\n this: Engine<T>,\n credentials: {\n apiKeyId: string;\n apiKeySecret: string;\n },\n opts?: { correlationId?: string },\n ): Promise<Engine<T & WithApiAuth>> {\n const res = await client.auth.authenticate.mutate(\n {\n apiKeyId: credentials.apiKeyId,\n apiKeySecret: credentials.apiKeySecret,\n workspace: __workspaceName,\n },\n buildTrpcContext({ correlationId: opts?.correlationId }),\n );\n const withApiAuth: WithApiAuth = {\n __apiAuth: res,\n };\n const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n T & WithApiAuth\n >);\n },\n } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n },\n );\n }\n\n // DecorateWithWorkspacePsdAuthenticated\n // -------------------------------------------------------------------------\n if (engine.device && engine.__workspaceName && engine.__psdToken) {\n decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n const { client, device } = engine;\n\n async function enforcePairing(): Promise<void> {\n if (await device.hasPairing()) return;\n const confidentialityKey = await device.getConfidentialityKey();\n const pairing = await client.debug.pairDevicePartition.mutate({\n confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n });\n await device.setPairing({ pairing });\n }\n\n const approveChallenge = async (\n challenge: PsdChallenge,\n params?: ApproveRequestParams,\n ): Promise<string> => {\n await enforcePairing();\n await device.startKPatternAsResponder({\n handshake: challenge.handshake,\n handshakeAttestation: challenge.handshakeAttestation,\n partitionId: challenge.partitionId,\n });\n await params?.onScreenDisplayed?.();\n const signature = await device.validateVaultOperation({\n actions: challenge.wActions,\n });\n return signature;\n };\n\n return {\n approve: async (\n request: VaultRequestResponse,\n params?: ApproveRequestParams,\n ): Promise<VaultRequestResponse> => {\n const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n if (challenge.challengeType === \"PSD\") {\n const signature = await approveChallenge(challenge, params);\n await params?.onPsdChallengeSigned?.();\n return client.requests.approve.mutate(\n {\n id: request.id,\n data: { challengeType: \"PSD\", signature },\n },\n buildTrpcContext(params),\n );\n }\n if (challenge.challengeType === \"SOFT\") {\n return client.requests.approve.mutate(\n {\n id: request.id,\n data: { challengeType: \"SOFT\" },\n },\n buildTrpcContext(params),\n );\n }\n throw new Error(\"Challenge type must be either PSD or SOFT\");\n },\n\n approveChallenge,\n\n reject: (\n request: VaultRequestResponse,\n opts?: CorrelationIdOpts,\n ): Promise<VaultRequestResponse> => {\n return client.requests.reject.mutate(\n { id: request.id, data: null },\n buildTrpcContext(opts),\n );\n },\n } satisfies DecorateWithWorkspacePsdAuthenticated;\n });\n }\n\n // DecorateWithWorkspaceApiAuthenticated\n // -------------------------------------------------------------------------\n if (engine.__workspaceName && engine.__apiAuth) {\n decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n const { client } = engine;\n return {\n getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n return challenge.payload;\n },\n\n approve: (\n request: VaultRequestResponse,\n signature: string,\n ): Promise<VaultRequestResponse> => {\n return client.requests.approve.mutate({\n id: request.id,\n data: { challengeType: \"API\", signature },\n });\n },\n\n reject: (\n request: VaultRequestResponse,\n signature: string,\n ): Promise<VaultRequestResponse> => {\n return client.requests.reject.mutate({\n id: request.id,\n data: { challengeType: \"API\", signature },\n });\n },\n } satisfies DecorateWithWorkspaceApiAuthenticated;\n });\n }\n\n return engine;\n }\n\n return {\n ...base,\n withDeviceIndex,\n withTransportId,\n withApiUser,\n withWorkspace,\n withOnboarding,\n };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n APPID_VAULT_ADMINISTRATOR,\n PAGINATED_STATUS,\n PATHS,\n SCRIPT_IDS,\n STATUS_LENGTH,\n STR_ROLES,\n STREAMING_NEXT_ACTION,\n STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n const chunks = [];\n for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n chunks.push(buffer.slice(i, i + size));\n }\n return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n transport: Transport,\n command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n data: Buffer,\n chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n const chunks = splitChunks(chunkSize, data);\n let response = Buffer.from([]);\n for (let i = 0; i < chunks.length; i++) {\n const chunk = chunks[i];\n const apdu = [...command];\n // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n /* v8 ignore next -- @preserve */\n apdu[2] = i && 0x80;\n response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n 0x9000,\n ...PAGINATED_STATUS,\n ])) as Buffer<ArrayBuffer>;\n }\n return response;\n};\n\nconst buildAttestation = (params: {\n handshake: string;\n handshakeAttestation: HsmCertificate;\n partitionId: string;\n}): Buffer => {\n const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n const sigLengthBuffer = Buffer.alloc(1);\n sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n const certLengthBuffer = Buffer.alloc(1);\n certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n const certChainData = Buffer.concat([\n sigLengthBuffer,\n sigBuffer,\n pubBuffer,\n certLengthBuffer,\n certBuffer,\n ]);\n\n const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n const cliMsgLengthBuffer = Buffer.alloc(1);\n cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n const pidLengthBuffer = Buffer.alloc(1);\n pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n const certChainDataLengthBuff = Buffer.alloc(2);\n certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n const data = Buffer.concat([\n cliMsgLengthBuffer,\n cliMsgBuffer,\n certChainDataLengthBuff,\n certChainData,\n pidLengthBuffer,\n pidBuffer,\n ]);\n\n const totalLengthBuffer = Buffer.alloc(2);\n totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n // device is locked\n if (err instanceof LockedDeviceError) return true;\n // user is on dashboard when receiving a Vault app apdu\n if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n // VG-24797 error that can happen in BLE in some situations (still unclear)\n if (err instanceof DisconnectedDevice) return true;\n\n // for everything else, we don't want to retry\n return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n const { transportId } = options;\n\n async function run<T>(\n job: (transport: Transport) => Promise<T>,\n retryOnError: RetryOnError = genericRetryOnError,\n ): Promise<T> {\n return lastValueFrom(\n withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n );\n }\n\n /* v8 ignore next -- @preserve */\n const noRetry = (): boolean => false;\n /* v8 ignore next -- @preserve */\n const alwaysRetry = (): boolean => true;\n const poll = async (\n opts: { retryOnError?: RetryOnError } = {},\n ): Promise<{ isAppOpened: boolean }> => {\n // waiting for device to be turned on\n await run(\n // eslint-disable-next-line @typescript-eslint/no-empty-function\n async (_transport) => {},\n opts.retryOnError ?? alwaysRetry,\n );\n // checking if app is opened: should return directly on getPubKey\n try {\n await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n return { isAppOpened: true };\n } catch (err) {\n if (isTransportStatusError(err) && genericRetryOnError(err)) {\n return { isAppOpened: false };\n }\n throw err;\n }\n };\n\n const pollApp = async (appName: string): Promise<string> => {\n const res = await run((transport) =>\n transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n );\n // little delay to give time to the app to be fully opened\n await new Promise((r) => setTimeout(r, 1e3));\n return res.toString(\"hex\");\n };\n\n const getPublicKey = async (\n pathString: string,\n { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n ): Promise<{ pubKey: string; signature: string }> => {\n logger.info(`[device] getPublicKey (${pathString})`);\n const path = getPathFromPathString(pathString);\n const data = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n const curve = secp256k1 ? 0x01 : 0x02;\n const response = await run(\n (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n retryOnError ?? genericRetryOnError,\n );\n const pubKeyLength = response.readInt8(0);\n const pubKey = response\n .slice(1, pubKeyLength + 1)\n .toString(\"hex\")\n .toUpperCase();\n const signature = response\n .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n .toString(\"base64\");\n return { pubKey, signature };\n };\n\n const device: Device = {\n authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n logger.info(`[device] Authenticate`);\n invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n const nameBuffer = Buffer.from(name);\n const workspaceBuffer = Buffer.from(workspaceName);\n\n const keyHandleData = Buffer.concat([\n Buffer.from(STR_ROLES[role], \"hex\"),\n Buffer.from([nameBuffer.length]),\n nameBuffer,\n Buffer.from([workspaceBuffer.length]),\n workspaceBuffer,\n ]);\n\n const keyHandleDataLength = Buffer.alloc(2);\n keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n const data = Buffer.concat([\n Buffer.from(challenge, \"base64\"),\n applicationBuffer,\n Buffer.from([keyHandle.length]),\n Buffer.from(keyHandle, \"hex\"),\n keyHandleDataLength,\n keyHandleData,\n ]);\n\n const authentication = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n );\n\n return removeStatus(authentication).toString(\"hex\");\n },\n\n finalizePairingHandshake: async (params: {\n handshake: string;\n partitionId: string;\n handshakeAttestation: HsmCertificate;\n }): Promise<string> => {\n const bufWithStatus = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n );\n return removeStatus(bufWithStatus).toString(\"hex\");\n },\n\n generateSeedFragment: async (): Promise<string> => {\n logger.info(`[device] generateSeedFragment`);\n const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n const data = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n return removeStatus(response).toString(\"base64\");\n },\n generateWrappingKeyFragment: async (): Promise<string> => {\n logger.info(`[device] generateWrappingKeyFragment`);\n const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n const data = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n return removeStatus(response).toString(\"base64\");\n },\n getAttestation: async (): Promise<{\n attestation: {\n codeHash: string;\n attestationPub: string;\n certificate: string;\n };\n buffer: Buffer;\n }> => {\n const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n const buffer = removeStatus(bufWithStatus);\n const certLen = buffer.readInt8(32 + 65 + 1);\n return {\n attestation: {\n codeHash: buffer.slice(0, 32).toString(\"base64\"),\n attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n },\n buffer,\n };\n },\n getConfidentialityKey: async () => {\n logger.info(`[device] getConfidentialityKey`);\n const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n const buf = removeStatus(bufWithStatus);\n const keyLength = buf[0]!;\n const key = buf.slice(1, 1 + keyLength);\n const sig = buf.slice(1 + keyLength + 1);\n return {\n confidentialityKeyCurve25519: key.toString(\"hex\"),\n confidentialityKeySignature: sig.toString(\"hex\"),\n };\n },\n getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n getDeviceUserId: async (): Promise<string> => {\n logger.info(`[device] getDeviceUserId`);\n const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n return removeStatus(response).toString(\"hex\").toUpperCase();\n },\n getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n hasPairing: async () => {\n logger.info(`[device] hasPairing`);\n const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n const hex = Buffer.from(res).toString(\"hex\");\n\n // 6f45 => this error means that there is no partition ID on the device\n // if no error, it means there is (at least) one\n //\n // 6a87 => TEMPORARY hack because Stax apparently does not implement\n // the \"get partition id\" APDU, so it returns \"incorrect length\"\n // easier to just assume that in this case there is no partition,\n // and try to insert one anyway (done on revault onboarding)\n //\n return hex !== \"6f45\" && hex !== \"6a87\";\n },\n\n initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n const pubKeyLength = res.readInt8(0);\n const pubKey = res\n .slice(1, pubKeyLength + 1)\n .toString(\"hex\")\n .toUpperCase();\n const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n return { pubKey, signature };\n },\n\n openSession: async (params: {\n secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n }): Promise<void> => {\n logger.info(`[device] openSession`);\n const { secureChannel } = params;\n\n const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n const dataDerivation = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n\n const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n const attestation = Buffer.concat([\n Buffer.from([sigBuffer.length]),\n sigBuffer,\n attestationPubBuffer,\n Buffer.from([certBuffer.length]),\n certBuffer,\n ]);\n\n const lengthAttestation = Buffer.alloc(2);\n lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n await run((transport) =>\n sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n );\n },\n\n register: async (params: {\n challenge: string;\n u2fRegisterData: string;\n name: string;\n role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n }): Promise<{\n u2fRegister: Buffer;\n keyHandle: Buffer;\n rfu: number;\n pubKey: string;\n }> => {\n const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n const challenge = Buffer.from(strChallenge, \"hex\");\n\n invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n const userNameBuff = Buffer.from(name);\n\n const keyHandleData = Buffer.concat([\n Buffer.from(STR_ROLES[role], \"hex\"),\n Buffer.from([userNameBuff.length]),\n userNameBuff,\n ]);\n\n const keyHandleDataLength = Buffer.alloc(2);\n keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n const response = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n );\n\n let i = 0;\n const rfu = response.slice(i, i + 1)[0]!;\n i += 1;\n const pubKey = response.slice(i, i + 65).toString(\"hex\");\n i += 65;\n const keyHandleLength = response.slice(i, i + 1)[0]!;\n i++;\n const keyHandle = response.slice(i, i + keyHandleLength);\n i += keyHandleLength;\n return {\n u2fRegister: removeStatus(response),\n keyHandle,\n rfu,\n pubKey,\n };\n },\n registerData: async (params: { challenge: string }): Promise<string> => {\n const { challenge: strChallenge } = params;\n const challenge = Buffer.from(strChallenge, \"hex\");\n invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n return removeStatus(response).toString(\"hex\");\n },\n\n setPairing: async ({ pairing }) => {\n logger.info(`[device] setPairing`);\n const psdPayload = Buffer.from(pairing.blob, \"base64\");\n const length = Buffer.alloc(2);\n length.writeUInt16BE(psdPayload.length, 0);\n const final = Buffer.concat([length, psdPayload]);\n await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n },\n startKKPatternAsResponder: async (params: {\n handshake: string;\n handshakeAttestation: HsmCertificate;\n partitionId: string;\n }): Promise<{ handshake: string; signature: string }> => {\n logger.info(`[device] startKKPatternAsResponder`);\n const data = buildAttestation(params);\n const bufWithStatus = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n );\n const buffer = removeStatus(bufWithStatus);\n const dataLength = buffer.readInt8(0);\n return {\n handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n };\n },\n startKPatternAsResponder: async (params) => {\n logger.info(`[device] startKPatternAsResponder`);\n const data = buildAttestation(params);\n await run((transport) =>\n sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n );\n },\n validateVaultOperation: async (params) => {\n logger.info(`[device] validateVaultOperation`);\n const path = getPathFromPathString(PATHS.VALIDATION);\n const paths = Buffer.concat([\n Buffer.from([path.length]),\n ...path.map((derivation) => {\n const buf = Buffer.alloc(4);\n buf.writeUInt32BE(derivation, 0);\n return buf;\n }),\n ]);\n\n let nextActionId = 1;\n let finalResponse: Buffer | null = null;\n\n while (!finalResponse) {\n const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n const length = Buffer.alloc(2);\n length.writeUInt16BE(screen.length, 0);\n const data = Buffer.concat([paths, length, screen]);\n const response = await run((transport) =>\n sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n );\n const responseType = response.readInt8(0);\n let responseStatus = response.readUInt16BE(response.length - 2);\n switch (responseType) {\n case STREAMING_NEXT_ACTION:\n nextActionId = response.readUIntBE(1, 2);\n break;\n case STREAMING_RESPONSE:\n finalResponse = response.slice(3, response.length - 2);\n while (responseStatus !== 0x9000) {\n /* v8 ignore next -- @preserve */ {\n const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n responseStatus = resp.readUInt16BE(resp.length - 2);\n finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n }\n }\n break;\n /* v8 ignore next -- @preserve */\n default:\n throw new Error(`Invalid response type: ${responseType}`);\n }\n }\n return finalResponse.toString(\"base64\");\n },\n\n sendAPDU: async (apduCommand: string) => {\n const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n return Buffer.from(res).toString(\"hex\");\n },\n getVersion: async () => {\n const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n const appNameLen = res.readInt8(1);\n const appVersionLen = res.readInt8(2 + appNameLen);\n const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n const appVersion = Buffer.from(appVersionHex).toString();\n\n return appVersion;\n },\n poll,\n pollApp,\n };\n return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n baseUrl: string;\n debugAuthToken?: string;\n rootAuthToken?: string;\n apiAccessToken?: string;\n psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n const trpc = createTRPCClient<AppRouter>({\n links: [\n httpLink({\n url: `${options.baseUrl}/trpc`,\n transformer: superjson,\n headers(opts) {\n // Extract headers from the operation context\n const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n return {\n ...(options.debugAuthToken\n ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n : {}),\n ...(options.rootAuthToken\n ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n : {}),\n ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n ...(options.apiAccessToken\n ? { Authorization: `Bearer ${options.apiAccessToken}` }\n : {}),\n // Merge in any headers passed via context\n ...contextHeaders,\n };\n },\n }),\n ],\n });\n return trpc;\n};\n"]}
package/lib/engine.d.cts CHANGED
@@ -1,6 +1,6 @@
1
1
  import { L as Logger } from './logger-C-TPbnjv.cjs';
2
- import { a as EngineOptions, E as Engine } from './types-mF8XT2Vl.cjs';
3
- export { A as ApproveRequestParams, C as CorrelationIdOpts, m as DecorateWithApiUserAndWorkspaceUnauthenticated, D as DecorateWithDevice, e as DecorateWithDeviceAndOnboarding, k as DecorateWithDeviceAndWorkspaceUnauthenticated, g as DecorateWithWorkspace, j as DecorateWithWorkspaceApiAuthenticated, i as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, b as EngineBase, R as RegisterOnboardingDeviceParams, n as WithApiAuth, d as WithApiUser, c as WithDevice, W as WithOnboarding, l as WithPsdAuth, f as WithWorkspace } from './types-mF8XT2Vl.cjs';
2
+ import { a as EngineOptions, E as Engine } from './types-6nV5J9yp.cjs';
3
+ export { A as ApproveRequestParams, C as CorrelationIdOpts, D as DecorateWithApiUserAndWorkspaceUnauthenticated, b as DecorateWithDevice, c as DecorateWithDeviceAndOnboarding, d as DecorateWithDeviceAndWorkspaceUnauthenticated, e as DecorateWithWorkspace, f as DecorateWithWorkspaceApiAuthenticated, g as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, i as EngineBase, O as OnboardingOperationParams, R as RegisterOnboardingDeviceParams, j as WithApiAuth, k as WithApiUser, l as WithDevice, W as WithOnboarding, m as WithPsdAuth, n as WithWorkspace } from './types-6nV5J9yp.cjs';
4
4
  import { Paginated, CursorPaginated } from '@ledgerhq/revault-api';
5
5
  import { T as TRPCContext } from './types-CpGEbAxh.cjs';
6
6
  import './types-DJfbanPz.cjs';
package/lib/engine.d.ts CHANGED
@@ -1,6 +1,6 @@
1
1
  import { L as Logger } from './logger-C-TPbnjv.js';
2
- import { a as EngineOptions, E as Engine } from './types-BTcYWX_0.js';
3
- export { A as ApproveRequestParams, C as CorrelationIdOpts, m as DecorateWithApiUserAndWorkspaceUnauthenticated, D as DecorateWithDevice, e as DecorateWithDeviceAndOnboarding, k as DecorateWithDeviceAndWorkspaceUnauthenticated, g as DecorateWithWorkspace, j as DecorateWithWorkspaceApiAuthenticated, i as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, b as EngineBase, R as RegisterOnboardingDeviceParams, n as WithApiAuth, d as WithApiUser, c as WithDevice, W as WithOnboarding, l as WithPsdAuth, f as WithWorkspace } from './types-BTcYWX_0.js';
2
+ import { a as EngineOptions, E as Engine } from './types-BdCVJxZy.js';
3
+ export { A as ApproveRequestParams, C as CorrelationIdOpts, D as DecorateWithApiUserAndWorkspaceUnauthenticated, b as DecorateWithDevice, c as DecorateWithDeviceAndOnboarding, d as DecorateWithDeviceAndWorkspaceUnauthenticated, e as DecorateWithWorkspace, f as DecorateWithWorkspaceApiAuthenticated, g as DecorateWithWorkspacePsdAuthenticated, h as DecorateWithWorkspaceUnauthenticated, i as EngineBase, O as OnboardingOperationParams, R as RegisterOnboardingDeviceParams, j as WithApiAuth, k as WithApiUser, l as WithDevice, W as WithOnboarding, m as WithPsdAuth, n as WithWorkspace } from './types-BdCVJxZy.js';
4
4
  import { Paginated, CursorPaginated } from '@ledgerhq/revault-api';
5
5
  import { T as TRPCContext } from './types-CpGEbAxh.js';
6
6
  import './types-DJfbanPz.js';
package/lib/engine.js CHANGED
@@ -15,7 +15,7 @@ import {
15
15
  createApiDevice,
16
16
  isTransportStatusError,
17
17
  withDevicePolling
18
- } from "./chunk-42CFPNWC.js";
18
+ } from "./chunk-QWC3M2RL.js";
19
19
 
20
20
  // src/engine/index.ts
21
21
  import invariant2 from "invariant";
@@ -25,9 +25,6 @@ import { DisconnectedDevice, LockedDeviceError } from "@ledgerhq/errors";
25
25
  import invariant from "invariant";
26
26
  import { from, lastValueFrom } from "rxjs";
27
27
  var MAX_CHUNK_LENGTH = 250;
28
- var FIXME_NOT_IMPLEMENTED = (fnName) => async () => {
29
- throw new Error(`Not implemented: ${fnName}`);
30
- };
31
28
  var getPathFromPathString = (pathString) => {
32
29
  const parts = pathString.split("'/").map((part) => Number.parseInt(part, 10));
33
30
  return parts.map((part) => (part | 2147483648) >>> 0);
@@ -185,8 +182,34 @@ function createRealDevice(options, logger) {
185
182
  );
186
183
  return removeStatus(bufWithStatus).toString("hex");
187
184
  },
188
- generateSeedFragment: FIXME_NOT_IMPLEMENTED("generateSeedFragment"),
189
- generateWrappingKeyFragment: FIXME_NOT_IMPLEMENTED("generateWrappingKeyFragment"),
185
+ generateSeedFragment: async () => {
186
+ logger.info(`[device] generateSeedFragment`);
187
+ const path = getPathFromPathString(PATHS.KEY_MATERIAL);
188
+ const data = Buffer.concat([
189
+ Buffer.from([path.length]),
190
+ ...path.map((derivation) => {
191
+ const buf = Buffer.alloc(4);
192
+ buf.writeUInt32BE(derivation, 0);
193
+ return buf;
194
+ })
195
+ ]);
196
+ const response = await run((transport) => transport.send(224, 68, 0, 0, data));
197
+ return removeStatus(response).toString("base64");
198
+ },
199
+ generateWrappingKeyFragment: async () => {
200
+ logger.info(`[device] generateWrappingKeyFragment`);
201
+ const path = getPathFromPathString(PATHS.KEY_MATERIAL);
202
+ const data = Buffer.concat([
203
+ Buffer.from([path.length]),
204
+ ...path.map((derivation) => {
205
+ const buf = Buffer.alloc(4);
206
+ buf.writeUInt32BE(derivation, 0);
207
+ return buf;
208
+ })
209
+ ]);
210
+ const response = await run((transport) => transport.send(224, 68, 1, 0, data));
211
+ return removeStatus(response).toString("base64");
212
+ },
190
213
  getAttestation: async () => {
191
214
  const bufWithStatus = await run((transport) => transport.send(224, 65, 0, 0));
192
215
  const buffer = removeStatus(bufWithStatus);
@@ -213,7 +236,11 @@ function createRealDevice(options, logger) {
213
236
  };
214
237
  },
215
238
  getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),
216
- getDeviceUserId: FIXME_NOT_IMPLEMENTED("getDeviceUserId"),
239
+ getDeviceUserId: async () => {
240
+ logger.info(`[device] getDeviceUserId`);
241
+ const response = await run((transport) => transport.send(224, 82, 0, 0));
242
+ return removeStatus(response).toString("hex").toUpperCase();
243
+ },
217
244
  getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),
218
245
  getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),
219
246
  hasPairing: async () => {
@@ -230,7 +257,36 @@ function createRealDevice(options, logger) {
230
257
  const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString("base64");
231
258
  return { pubKey, signature };
232
259
  },
233
- openSession: FIXME_NOT_IMPLEMENTED("openSession"),
260
+ openSession: async (params) => {
261
+ logger.info(`[device] openSession`);
262
+ const { secureChannel } = params;
263
+ const path = getPathFromPathString(PATHS.CONFIDENTIALITY);
264
+ const dataDerivation = Buffer.concat([
265
+ Buffer.from([path.length]),
266
+ ...path.map((derivation) => {
267
+ const buf = Buffer.alloc(4);
268
+ buf.writeUInt32BE(derivation, 0);
269
+ return buf;
270
+ })
271
+ ]);
272
+ const pubKey = Buffer.from(secureChannel.pubKey, "hex");
273
+ const sigBuffer = Buffer.from(secureChannel.certificate.signature, "base64");
274
+ const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, "base64");
275
+ const certBuffer = Buffer.from(secureChannel.certificate.certificate, "base64");
276
+ const attestation = Buffer.concat([
277
+ Buffer.from([sigBuffer.length]),
278
+ sigBuffer,
279
+ attestationPubBuffer,
280
+ Buffer.from([certBuffer.length]),
281
+ certBuffer
282
+ ]);
283
+ const lengthAttestation = Buffer.alloc(2);
284
+ lengthAttestation.writeUInt16BE(attestation.length, 0);
285
+ const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);
286
+ await run(
287
+ (transport) => sendByChunk(transport, [224, 66, 0, SCRIPT_IDS.INIT_SESSION], data)
288
+ );
289
+ },
234
290
  register: async (params) => {
235
291
  const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;
236
292
  const challenge = Buffer.from(strChallenge, "hex");
@@ -280,7 +336,19 @@ function createRealDevice(options, logger) {
280
336
  const final = Buffer.concat([length, psdPayload]);
281
337
  await run((transport) => sendByChunk(transport, [224, 78, 0, 0], final));
282
338
  },
283
- startKKPatternAsResponder: FIXME_NOT_IMPLEMENTED("startKKPatternAsResponder"),
339
+ startKKPatternAsResponder: async (params) => {
340
+ logger.info(`[device] startKKPatternAsResponder`);
341
+ const data = buildAttestation(params);
342
+ const bufWithStatus = await run(
343
+ (transport) => sendByChunk(transport, [224, 76, 0, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
344
+ );
345
+ const buffer = removeStatus(bufWithStatus);
346
+ const dataLength = buffer.readInt8(0);
347
+ return {
348
+ handshake: buffer.slice(1, dataLength + 1).toString("base64"),
349
+ signature: buffer.slice(dataLength + 1).toString("base64")
350
+ };
351
+ },
284
352
  startKPatternAsResponder: async (params) => {
285
353
  logger.info(`[device] startKPatternAsResponder`);
286
354
  const data = buildAttestation(params);
@@ -382,7 +450,8 @@ async function genericRegister({
382
450
  name,
383
451
  role,
384
452
  getChallenge,
385
- submitChallenge
453
+ submitChallenge,
454
+ onScreenDisplayed
386
455
  }) {
387
456
  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
388
457
  device.getAttestation(),
@@ -407,6 +476,7 @@ async function genericRegister({
407
476
  partitionId: challenge.ciphertext,
408
477
  handshakeAttestation: challenge.handshakeAttestation
409
478
  });
479
+ await onScreenDisplayed?.();
410
480
  const register = await device.register({
411
481
  challenge: challenge.challenge,
412
482
  u2fRegisterData: challenge.u2fRegisterData,
@@ -528,7 +598,7 @@ function createEngine(options, logger) {
528
598
  claim: { role, pubKey, deviceName, confidentialityKey }
529
599
  });
530
600
  },
531
- collectWrappingKeyFragment: async (wrappingKey) => {
601
+ collectWrappingKeyFragment: async (wrappingKey, params) => {
532
602
  const [{ pubKey }, confidentialityKey] = await Promise.all([
533
603
  device.getU2FPubKey(),
534
604
  device.getConfidentialityPubKey()
@@ -540,6 +610,7 @@ function createEngine(options, logger) {
540
610
  }
541
611
  });
542
612
  const { attestation } = await device.getAttestation();
613
+ await params?.onScreenDisplayed?.();
543
614
  const blob = await device.generateWrappingKeyFragment();
544
615
  await client2.onboarding.submitWrappingKeyFragment.mutate({
545
616
  pubKey,
@@ -554,8 +625,8 @@ function createEngine(options, logger) {
554
625
  }
555
626
  });
556
627
  },
557
- registerDevice: async (params) => {
558
- const { role, name } = params;
628
+ registerDevice: async (registerParams, params) => {
629
+ const { role, name } = registerParams;
559
630
  const getChallengeMutation = role === "ADMIN" ? client2.onboarding.generateMasterAdminRegistrationChallenge : client2.onboarding.generateSharedOwnerRegistrationChallenge;
560
631
  const submitChallengeMutation = role === "ADMIN" ? client2.onboarding.submitMasterAdminRegistration : client2.onboarding.submitSharedOwnerRegistration;
561
632
  await genericRegister({
@@ -572,10 +643,11 @@ function createEngine(options, logger) {
572
643
  pubKey,
573
644
  // FIXME this should be renamed to `challengeResponse` on backend side
574
645
  response: challengeResponse
575
- })
646
+ }),
647
+ onScreenDisplayed: params?.onScreenDisplayed
576
648
  });
577
649
  },
578
- reviewSharedOwner: async (challenge) => {
650
+ reviewSharedOwner: async (challenge, params) => {
579
651
  await enforcePairing();
580
652
  const { pubKey } = await device.getU2FPubKey();
581
653
  await device.startKPatternAsResponder({
@@ -583,6 +655,7 @@ function createEngine(options, logger) {
583
655
  handshakeAttestation: challenge.handshakeAttestation,
584
656
  partitionId: challenge.partitionId
585
657
  });
658
+ await params?.onScreenDisplayed?.();
586
659
  const signature = await device.validateVaultOperation({
587
660
  actions: challenge.wActions
588
661
  });
@@ -592,7 +665,7 @@ function createEngine(options, logger) {
592
665
  signature
593
666
  });
594
667
  },
595
- collectSeedFragment: async (challenge) => {
668
+ collectSeedFragment: async (challenge, params) => {
596
669
  await enforcePairing();
597
670
  const [{ pubKey }, { attestation }] = await Promise.all([
598
671
  device.getU2FPubKey(),
@@ -603,6 +676,7 @@ function createEngine(options, logger) {
603
676
  handshakeAttestation: challenge.handshakeAttestation,
604
677
  partitionId: challenge.partitionId
605
678
  });
679
+ await params?.onScreenDisplayed?.();
606
680
  const challengeResponse = await device.validateVaultOperation({
607
681
  actions: challenge.wActions
608
682
  });