@ledgerhq/revault-sdk 0.24.0 → 0.25.0

package/lib/engine.cjs

@@ -15,13 +15,14 @@ var _chunkLH4QQXUHcjs = require('./chunk-LH4QQXUH.cjs');
 
 
 
-var _chunk4ZXMEPRBcjs = require('./chunk-4ZXMEPRB.cjs');
+
+
+var _chunkDRMYBKL3cjs = require('./chunk-DRMYBKL3.cjs');
 
 // src/engine/index.ts
 var _invariant = require('invariant'); var _invariant2 = _interopRequireDefault(_invariant);
 
 // src/device/real-device.ts
-var _errors = require('@ledgerhq/errors');
 
 var _rxjs = require('rxjs');
 var MAX_CHUNK_LENGTH = 250;
@@ -36,7 +37,7 @@ var splitChunks = (chunk, buffer) => {
   }
   return chunks;
 };
-var removeStatus = (result) => result.slice(0, result.length - _chunk4ZXMEPRBcjs.STATUS_LENGTH);
+var removeStatus = (result) => result.slice(0, result.length - _chunkDRMYBKL3cjs.STATUS_LENGTH);
 var sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH) => {
   const chunks = splitChunks(chunkSize, data);
   let response = Buffer.from([]);
@@ -46,7 +47,7 @@ var sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH)
     apdu[2] = i && 128;
     response = await transport.send(apdu[0], apdu[1], apdu[2], apdu[3], chunk, [
       36864,
-      ..._chunk4ZXMEPRBcjs.PAGINATED_STATUS
+      ..._chunkDRMYBKL3cjs.PAGINATED_STATUS
     ]);
   }
   return response;
@@ -88,16 +89,16 @@ var buildAttestation = (params) => {
   return toSend;
 };
 var genericRetryOnError = (err) => {
-  if (err instanceof _errors.LockedDeviceError) return true;
-  if (_chunk4ZXMEPRBcjs.isTransportStatusError.call(void 0, err) && err.statusCode === 27913) return true;
-  if (err instanceof _errors.DisconnectedDevice) return true;
+  if (err instanceof _chunkDRMYBKL3cjs.LockedDeviceError) return true;
+  if (_chunkDRMYBKL3cjs.isTransportStatusError.call(void 0, err) && err.statusCode === 27913) return true;
+  if (err instanceof _chunkDRMYBKL3cjs.DisconnectedDevice) return true;
   return false;
 };
 function createRealDevice(options, logger) {
   const { transportId } = options;
   async function run(job, retryOnError = genericRetryOnError) {
     return _rxjs.lastValueFrom.call(void 0, 
-      _chunk4ZXMEPRBcjs.withDevicePolling.call(void 0, transportId)((transport) => _rxjs.from.call(void 0, job(transport)), retryOnError)
+      _chunkDRMYBKL3cjs.withDevicePolling.call(void 0, transportId)((transport) => _rxjs.from.call(void 0, job(transport)), retryOnError)
     );
   }
   const noRetry = () => false;
@@ -110,10 +111,10 @@ function createRealDevice(options, logger) {
       _nullishCoalesce(opts.retryOnError, () => ( alwaysRetry))
     );
     try {
-      await getPublicKey(_chunk4ZXMEPRBcjs.PATHS.U2F, { secp256k1: true, retryOnError: noRetry });
+      await getPublicKey(_chunkDRMYBKL3cjs.PATHS.U2F, { secp256k1: true, retryOnError: noRetry });
       return { isAppOpened: true };
     } catch (err) {
-      if (_chunk4ZXMEPRBcjs.isTransportStatusError.call(void 0, err) && genericRetryOnError(err)) {
+      if (_chunkDRMYBKL3cjs.isTransportStatusError.call(void 0, err) && genericRetryOnError(err)) {
         return { isAppOpened: false };
       }
       throw err;
@@ -144,18 +145,18 @@ function createRealDevice(options, logger) {
     );
     const pubKeyLength = response.readInt8(0);
     const pubKey = response.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
-    const signature = response.slice(pubKeyLength + 1, response.length - _chunk4ZXMEPRBcjs.STATUS_LENGTH).toString("base64");
+    const signature = response.slice(pubKeyLength + 1, response.length - _chunkDRMYBKL3cjs.STATUS_LENGTH).toString("base64");
     return { pubKey, signature };
   };
   const device = {
     authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {
       logger.info(`[device] Authenticate`);
       _invariant2.default.call(void 0, role !== "READ_ONLY_API_KEY", "Invalid role for authenticate: READ_ONLY_API_KEY");
-      const applicationBuffer = Buffer.from(_chunk4ZXMEPRBcjs.APPID_VAULT_ADMINISTRATOR, "hex");
+      const applicationBuffer = Buffer.from(_chunkDRMYBKL3cjs.APPID_VAULT_ADMINISTRATOR, "hex");
       const nameBuffer = Buffer.from(name);
       const workspaceBuffer = Buffer.from(workspaceName);
       const keyHandleData = Buffer.concat([
-        Buffer.from(_chunk4ZXMEPRBcjs.STR_ROLES[role], "hex"),
+        Buffer.from(_chunkDRMYBKL3cjs.STR_ROLES[role], "hex"),
         Buffer.from([nameBuffer.length]),
         nameBuffer,
         Buffer.from([workspaceBuffer.length]),
@@ -184,7 +185,7 @@ function createRealDevice(options, logger) {
     },
     generateSeedFragment: async () => {
       logger.info(`[device] generateSeedFragment`);
-      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.KEY_MATERIAL);
+      const path = getPathFromPathString(_chunkDRMYBKL3cjs.PATHS.KEY_MATERIAL);
       const data = Buffer.concat([
         Buffer.from([path.length]),
         ...path.map((derivation) => {
@@ -198,7 +199,7 @@ function createRealDevice(options, logger) {
     },
     generateWrappingKeyFragment: async () => {
       logger.info(`[device] generateWrappingKeyFragment`);
-      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.KEY_MATERIAL);
+      const path = getPathFromPathString(_chunkDRMYBKL3cjs.PATHS.KEY_MATERIAL);
       const data = Buffer.concat([
         Buffer.from([path.length]),
         ...path.map((derivation) => {
@@ -235,14 +236,14 @@ function createRealDevice(options, logger) {
         confidentialityKeySignature: sig.toString("hex")
       };
     },
-    getConfidentialityPubKey: () => getPublicKey(_chunk4ZXMEPRBcjs.PATHS.CONFIDENTIALITY, { secp256k1: true }),
+    getConfidentialityPubKey: () => getPublicKey(_chunkDRMYBKL3cjs.PATHS.CONFIDENTIALITY, { secp256k1: true }),
     getDeviceUserId: async () => {
       logger.info(`[device] getDeviceUserId`);
       const response = await run((transport) => transport.send(224, 82, 0, 0));
       return removeStatus(response).toString("hex").toUpperCase();
     },
-    getU2FPubKey: () => getPublicKey(_chunk4ZXMEPRBcjs.PATHS.U2F, { secp256k1: false }),
-    getValidationPubKey: () => getPublicKey(_chunk4ZXMEPRBcjs.PATHS.VALIDATION, { secp256k1: true }),
+    getU2FPubKey: () => getPublicKey(_chunkDRMYBKL3cjs.PATHS.U2F, { secp256k1: false }),
+    getValidationPubKey: () => getPublicKey(_chunkDRMYBKL3cjs.PATHS.VALIDATION, { secp256k1: true }),
     hasPairing: async () => {
       logger.info(`[device] hasPairing`);
       const apdu = [224, 81, 0, 0, 181];
@@ -254,13 +255,13 @@ function createRealDevice(options, logger) {
       const res = await run((transport) => transport.send(224, 70, 0, 0));
       const pubKeyLength = res.readInt8(0);
       const pubKey = res.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
-      const signature = res.slice(pubKeyLength + 1, res.length - _chunk4ZXMEPRBcjs.STATUS_LENGTH).toString("base64");
+      const signature = res.slice(pubKeyLength + 1, res.length - _chunkDRMYBKL3cjs.STATUS_LENGTH).toString("base64");
       return { pubKey, signature };
     },
     openSession: async (params) => {
       logger.info(`[device] openSession`);
       const { secureChannel } = params;
-      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.CONFIDENTIALITY);
+      const path = getPathFromPathString(_chunkDRMYBKL3cjs.PATHS.CONFIDENTIALITY);
       const dataDerivation = Buffer.concat([
         Buffer.from([path.length]),
         ...path.map((derivation) => {
@@ -284,18 +285,18 @@ function createRealDevice(options, logger) {
       lengthAttestation.writeUInt16BE(attestation.length, 0);
       const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);
       await run(
-        (transport) => sendByChunk(transport, [224, 66, 0, _chunk4ZXMEPRBcjs.SCRIPT_IDS.INIT_SESSION], data)
+        (transport) => sendByChunk(transport, [224, 66, 0, _chunkDRMYBKL3cjs.SCRIPT_IDS.INIT_SESSION], data)
       );
     },
     register: async (params) => {
       const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;
       const challenge = Buffer.from(strChallenge, "hex");
       _invariant2.default.call(void 0, challenge.length === 32, "challenge hex is expected to have 32 bytes");
-      const applicationBuf = Buffer.from(_chunk4ZXMEPRBcjs.APPID_VAULT_ADMINISTRATOR, "hex");
+      const applicationBuf = Buffer.from(_chunkDRMYBKL3cjs.APPID_VAULT_ADMINISTRATOR, "hex");
       _invariant2.default.call(void 0, applicationBuf.length === 32, "application hex is expected to have 32 bytes");
       const userNameBuff = Buffer.from(name);
       const keyHandleData = Buffer.concat([
-        Buffer.from(_chunk4ZXMEPRBcjs.STR_ROLES[role], "hex"),
+        Buffer.from(_chunkDRMYBKL3cjs.STR_ROLES[role], "hex"),
         Buffer.from([userNameBuff.length]),
         userNameBuff
       ]);
@@ -340,7 +341,7 @@ function createRealDevice(options, logger) {
       logger.info(`[device] startKKPatternAsResponder`);
       const data = buildAttestation(params);
       const bufWithStatus = await run(
-        (transport) => sendByChunk(transport, [224, 76, 0, _chunk4ZXMEPRBcjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
+        (transport) => sendByChunk(transport, [224, 76, 0, _chunkDRMYBKL3cjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
       );
       const buffer = removeStatus(bufWithStatus);
       const dataLength = buffer.readInt8(0);
@@ -353,12 +354,12 @@ function createRealDevice(options, logger) {
       logger.info(`[device] startKPatternAsResponder`);
       const data = buildAttestation(params);
       await run(
-        (transport) => sendByChunk(transport, [224, 73, 0, _chunk4ZXMEPRBcjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
+        (transport) => sendByChunk(transport, [224, 73, 0, _chunkDRMYBKL3cjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
       );
     },
     validateVaultOperation: async (params) => {
       logger.info(`[device] validateVaultOperation`);
-      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.VALIDATION);
+      const path = getPathFromPathString(_chunkDRMYBKL3cjs.PATHS.VALIDATION);
       const paths = Buffer.concat([
         Buffer.from([path.length]),
         ...path.map((derivation) => {
@@ -380,10 +381,10 @@ function createRealDevice(options, logger) {
         const responseType = response.readInt8(0);
         let responseStatus = response.readUInt16BE(response.length - 2);
         switch (responseType) {
-          case _chunk4ZXMEPRBcjs.STREAMING_NEXT_ACTION:
+          case _chunkDRMYBKL3cjs.STREAMING_NEXT_ACTION:
             nextActionId = response.readUIntBE(1, 2);
             break;
-          case _chunk4ZXMEPRBcjs.STREAMING_RESPONSE:
+          case _chunkDRMYBKL3cjs.STREAMING_RESPONSE:
             finalResponse = response.slice(3, response.length - 2);
             while (responseStatus !== 36864) {
               {
@@ -510,7 +511,7 @@ function createEngine(options, logger) {
     baseUrl: options.baseUrl
   };
   const client = createClient(clientOptions);
-  const apiDevice = _chunk4ZXMEPRBcjs.createApiDevice.call(void 0, options, logger);
+  const apiDevice = _chunkDRMYBKL3cjs.createApiDevice.call(void 0, options, logger);
   const base = {
     client,
     createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),

package/lib/engine.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"names":["engine","client"],"mappings":"AAAA;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACPA,4FAAsB;ADStB;AACA;AEtBA,0CAAsD;AAGtD;AACA,4BAAoC;AAkBpC,IAAM,iBAAA,EAAmB,GAAA;AAMzB,IAAM,sBAAA,EAAwB,CAAC,UAAA,EAAA,GAAiC;AAC9D,EAAA,MAAM,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,EAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA,EAAM,EAAE,CAAC,CAAA;AAC5E,EAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,EAAA,GAAA,CAAU,KAAA,EAAO,UAAA,EAAA,IAAgB,CAAC,CAAA;AACtD,CAAA;AAEA,IAAM,YAAA,EAAc,CAAC,KAAA,EAAe,MAAA,EAAA,GAA6B;AAC/D,EAAA,MAAM,OAAA,EAAS,CAAC,CAAA;AAChB,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,KAAA,EAAO,KAAA,EAAO,EAAA,EAAI,MAAA,CAAO,MAAA,EAAQ,EAAA,GAAK,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA;AACT,CAAA;AAEA,IAAM,aAAA,EAAe,CAAC,MAAA,EAAA,GAA2B,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,OAAA,EAAS,+BAAa,CAAA;AAE9F,IAAM,YAAA,EAAc,MAAA,CAClB,SAAA,EACA,OAAA,EACA,IAAA,EACA,UAAA,EAAoB,gBAAA,EAAA,GACA;AACpB,EAAA,MAAM,OAAA,EAAS,WAAA,CAAY,SAAA,EAAW,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAC7B,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA;AACtB,IAAA,MAAM,KAAA,EAAO,CAAC,GAAG,OAAO,CAAA;AAGxB,IAAA,IAAA,CAAK,CAAC,EAAA,EAAI,EAAA,GAAK,GAAA;AACf,IAAA,SAAA,EAAY,MAAM,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,CAAC,CAAA,EAAI,KAAA,EAAO;AAAA,MAC7E,KAAA;AAAA,MACA,GAAG;AAAA,IACL,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,QAAA;AACT,CAAA;AAEA,IAAM,iBAAA,EAAmB,CAAC,MAAA,EAAA,GAIZ;AACZ,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,SAAA,EAAW,QAAQ,CAAA;AAC7E,EAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACtC,EAAA,eAAA,CAAgB,WAAA,CAAY,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAElD,EAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,WAAA,EAAa,QAAQ,CAAA;AAChF,EAAA,MAAM,iBAAA,EAAmB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACvC,EAAA,gBAAA,CAAiB,WAAA,CAAY,UAAA,CAAW,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAEpD,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,cAAA,EAAgB,QAAQ,CAAA;AAElF,EAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,IAClC,eAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,KAAK,CAAA;AACxD,EAAA,MAAM,mBAAA,EAAqB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACzC,EAAA,kBAAA,CAAmB,WAAA,CAAY,YAAA,CAAa,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAExD,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,WAAA,EAAa,KAAK,CAAA;AACvD,EAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACtC,EAAA,eAAA,CAAgB,WAAA,CAAY,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAElD,EAAA,MAAM,wBAAA,EAA0B,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC9C,EAAA,uBAAA,CAAwB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAE7D,EAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,IACzB,kBAAA;AAAA,IACA,YAAA;AAAA,IACA,uBAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxC,EAAA,iBAAA,CAAkB,aAAA,CAAc,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAA;AAE9C,EAAA,MAAM,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,CAAC,iBAAA,EAAmB,IAAI,CAAC,CAAA;AAEtD,EAAA,OAAO,MAAA;AACT,CAAA;AAIA,IAAM,oBAAA,EAAoC,CAAC,GAAA,EAAA,GAAQ;AAEjD,EAAA,GAAA,CAAI,IAAA,WAAe,yBAAA,EAAmB,OAAO,IAAA;AAE7C,EAAA,GAAA,CAAI,sDAAA,GAA0B,EAAA,GAAK,GAAA,CAAI,WAAA,IAAe,KAAA,EAAQ,OAAO,IAAA;AAErE,EAAA,GAAA,CAAI,IAAA,WAAe,0BAAA,EAAoB,OAAO,IAAA;AAG9C,EAAA,OAAO,KAAA;AACT,CAAA;AAEO,SAAS,gBAAA,CAAiB,OAAA,EAAkB,MAAA,EAAwB;AACzE,EAAA,MAAM,EAAE,YAAY,EAAA,EAAI,OAAA;AAExB,EAAA,MAAA,SAAe,GAAA,CACb,GAAA,EACA,aAAA,EAA6B,mBAAA,EACjB;AACZ,IAAA,OAAO,iCAAA;AAAA,MACL,iDAAA,WAA6B,CAAA,CAAK,CAAC,SAAA,EAAA,GAAc,wBAAA,GAAK,CAAI,SAAS,CAAC,CAAA,EAAG,YAAY;AAAA,IACrF,CAAA;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,EAAU,CAAA,EAAA,GAAe,KAAA;AAE/B,EAAA,MAAM,YAAA,EAAc,CAAA,EAAA,GAAe,IAAA;AACnC,EAAA,MAAM,KAAA,EAAO,MAAA,CACX,KAAA,EAAwC,CAAC,CAAA,EAAA,GACH;AAEtC,IAAA,MAAM,GAAA;AAAA;AAAA,MAEJ,MAAA,CAAO,UAAA,EAAA,GAAe;AAAA,MAAC,CAAA;AAAA,uBACvB,IAAA,CAAK,YAAA,UAAgB;AAAA,IACvB,CAAA;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,CAAa,uBAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,YAAA,EAAc,QAAQ,CAAC,CAAA;AACxE,MAAA,OAAO,EAAE,WAAA,EAAa,KAAK,CAAA;AAAA,IAC7B,EAAA,MAAA,CAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,sDAAA,GAA0B,EAAA,GAAK,mBAAA,CAAoB,GAAG,CAAA,EAAG;AAC3D,QAAA,OAAO,EAAE,WAAA,EAAa,MAAM,CAAA;AAAA,MAC9B;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,QAAA,EAAU,MAAA,CAAO,OAAA,EAAA,GAAqC;AAC1D,IAAA,MAAM,IAAA,EAAM,MAAM,GAAA;AAAA,MAAI,CAAC,SAAA,EAAA,GACrB,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,MAAM,CAAC;AAAA,IACrE,CAAA;AAEA,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,CAAA,EAAA,GAAM,UAAA,CAAW,CAAA,EAAG,GAAG,CAAC,CAAA;AAC3C,IAAA,OAAO,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,EAC3B,CAAA;AAEA,EAAA,MAAM,aAAA,EAAe,MAAA,CACnB,UAAA,EACA,EAAE,SAAA,EAAW,aAAa,CAAA,EAAA,GACyB;AACnD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,CAAG,CAAA;AACnD,IAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,UAAU,CAAA;AAC7C,IAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,MACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,MACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,QAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,QAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,QAAA,OAAO,GAAA;AAAA,MACT,CAAC;AAAA,IACH,CAAC,CAAA;AACD,IAAA,MAAM,MAAA,EAAQ,UAAA,EAAY,EAAA,EAAO,CAAA;AACjC,IAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,MACrB,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,KAAA,EAAO,CAAA,EAAM,IAAI,CAAA;AAAA,uBAC3D,YAAA,UAAgB;AAAA,IAClB,CAAA;AACA,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,QAAA,CAAS,CAAC,CAAA;AACxC,IAAA,MAAM,OAAA,EAAS,QAAA,CACZ,KAAA,CAAM,CAAA,EAAG,aAAA,EAAe,CAAC,CAAA,CACzB,QAAA,CAAS,KAAK,CAAA,CACd,WAAA,CAAY,CAAA;AACf,IAAA,MAAM,UAAA,EAAY,QAAA,CACf,KAAA,CAAM,aAAA,EAAe,CAAA,EAAG,QAAA,CAAS,OAAA,EAAS,+BAAa,CAAA,CACvD,QAAA,CAAS,QAAQ,CAAA;AACpB,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,EAC7B,CAAA;AAEA,EAAA,MAAM,OAAA,EAAiB;AAAA,IACrB,YAAA,EAAc,MAAA,CAAO,EAAE,SAAA,EAAW,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,UAAU,CAAA,EAAG,cAAc,CAAA,EAAA,GAAM;AAC1F,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,qBAAA,CAAuB,CAAA;AACnC,MAAA,iCAAA,KAAU,IAAS,mBAAA,EAAqB,kDAAkD,CAAA;AAC1F,MAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,2CAAA,EAA2B,KAAK,CAAA;AACtE,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnC,MAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA;AAEjD,MAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,2BAAA,CAAU,IAAI,CAAA,EAAG,KAAK,CAAA;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,CAAC,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,QAC/B,UAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,QACpC;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,oBAAA,EAAsB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1C,MAAA,mBAAA,CAAoB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAEzD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA;AAAA,QAC/B,iBAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,QAC9B,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,KAAK,CAAA;AAAA,QAC5B,mBAAA;AAAA,QACA;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,eAAA,EAAiB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAChC,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,MACvD,CAAA;AAEA,MAAA,OAAO,YAAA,CAAa,cAAc,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IACpD,CAAA;AAAA,IAEA,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAA,GAIV;AACrB,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC/B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,gBAAA,CAAiB,MAAM,CAAC;AAAA,MAC3E,CAAA;AACA,MAAA,OAAO,YAAA,CAAa,aAAa,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IACnD,CAAA;AAAA,IAEA,oBAAA,EAAsB,MAAA,CAAA,EAAA,GAA6B;AACjD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,6BAAA,CAA+B,CAAA;AAC3C,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,YAAY,CAAA;AACrD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AACD,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,IAAI,CAAC,CAAA;AACtF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,2BAAA,EAA6B,MAAA,CAAA,EAAA,GAA6B;AACxD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oCAAA,CAAsC,CAAA;AAClD,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,YAAY,CAAA;AACrD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AACD,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,IAAI,CAAC,CAAA;AACtF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,cAAA,EAAgB,MAAA,CAAA,EAAA,GAOV;AACJ,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AACrF,MAAA,MAAM,OAAA,EAAS,YAAA,CAAa,aAAa,CAAA;AACzC,MAAA,MAAM,QAAA,EAAU,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAA;AAC3C,MAAA,OAAO;AAAA,QACL,WAAA,EAAa;AAAA,UACX,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,UAC/C,cAAA,EAAgB,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI,GAAA,EAAK,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,UAC3D,WAAA,EAAa,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,EAAA,EAAI,OAAO,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,QAC7E,CAAA;AAAA,QACA;AAAA,MACF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,qBAAA,EAAuB,MAAA,CAAA,EAAA,GAAY;AACjC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,8BAAA,CAAgC,CAAA;AAC5C,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AACrF,MAAA,MAAM,IAAA,EAAM,YAAA,CAAa,aAAa,CAAA;AACtC,MAAA,MAAM,UAAA,EAAY,GAAA,CAAI,CAAC,CAAA;AACvB,MAAA,MAAM,IAAA,EAAM,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,SAAS,CAAA;AACtC,MAAA,MAAM,IAAA,EAAM,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,UAAA,EAAY,CAAC,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,4BAAA,EAA8B,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,QAChD,2BAAA,EAA6B,GAAA,CAAI,QAAA,CAAS,KAAK;AAAA,MACjD,CAAA;AAAA,IACF,CAAA;AAAA,IACA,wBAAA,EAA0B,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,eAAA,EAAiB,EAAE,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,IACvF,eAAA,EAAiB,MAAA,CAAA,EAAA,GAA6B;AAC5C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,wBAAA,CAA0B,CAAA;AACtC,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAChF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA,CAAE,WAAA,CAAY,CAAA;AAAA,IAC5D,CAAA;AAAA,IACA,YAAA,EAAc,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAC,CAAA;AAAA,IAChE,mBAAA,EAAqB,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,UAAA,EAAY,EAAE,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,IAC7E,UAAA,EAAY,MAAA,CAAA,EAAA,GAAY;AACtB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,CAAqB,CAAA;AACjC,MAAA,MAAM,KAAA,EAAO,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,GAAI,CAAA;AAC1C,MAAA,MAAM,IAAA,EAAM,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAC1E,MAAA,MAAM,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAU3C,MAAA,OAAO,IAAA,IAAQ,OAAA,GAAU,IAAA,IAAQ,MAAA;AAAA,IACnC,CAAA;AAAA,IAEA,oBAAA,EAAsB,MAAA,CAAA,EAAA,GAA4D;AAChF,MAAA,MAAM,IAAA,EAAM,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAC3E,MAAA,MAAM,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,CAAC,CAAA;AACnC,MAAA,MAAM,OAAA,EAAS,GAAA,CACZ,KAAA,CAAM,CAAA,EAAG,aAAA,EAAe,CAAC,CAAA,CACzB,QAAA,CAAS,KAAK,CAAA,CACd,WAAA,CAAY,CAAA;AACf,MAAA,MAAM,UAAA,EAAY,GAAA,CAAI,KAAA,CAAM,aAAA,EAAe,CAAA,EAAG,GAAA,CAAI,OAAA,EAAS,+BAAa,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAC3F,MAAA,OAAO,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,IAC7B,CAAA;AAAA,IAEA,WAAA,EAAa,MAAA,CAAO,MAAA,EAAA,GAEC;AACnB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oBAAA,CAAsB,CAAA;AAClC,MAAA,MAAM,EAAE,cAAc,EAAA,EAAI,MAAA;AAE1B,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,eAAe,CAAA;AACxD,MAAA,MAAM,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO;AAAA,QACnC,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AAED,MAAA,MAAM,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,CAAA;AAEtD,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA;AAC3E,MAAA,MAAM,qBAAA,EAAuB,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,cAAA,EAAgB,QAAQ,CAAA;AAC3F,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,WAAA,EAAa,QAAQ,CAAA;AAC9E,MAAA,MAAM,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO;AAAA,QAChC,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,QAC9B,SAAA;AAAA,QACA,oBAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxC,MAAA,iBAAA,CAAkB,aAAA,CAAc,WAAA,CAAY,MAAA,EAAQ,CAAC,CAAA;AAErD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,cAAA,EAAgB,MAAA,EAAQ,iBAAA,EAAmB,WAAW,CAAC,CAAA;AAEnF,MAAA,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GACT,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,YAAY,CAAA,EAAG,IAAI;AAAA,MAC1E,CAAA;AAAA,IACF,CAAA;AAAA,IAEA,QAAA,EAAU,MAAA,CAAO,MAAA,EAAA,GAUX;AACJ,MAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,eAAA,EAAiB,CAAA,EAAG,IAAA,EAAM,KAAK,EAAA,EAAI,MAAA;AACpE,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAEjD,MAAA,iCAAA,SAAU,CAAU,OAAA,IAAW,EAAA,EAAI,4CAA4C,CAAA;AAC/E,MAAA,MAAM,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,2CAAA,EAA2B,KAAK,CAAA;AACnE,MAAA,iCAAA,cAAU,CAAe,OAAA,IAAW,EAAA,EAAI,8CAA8C,CAAA;AAEtF,MAAA,MAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAErC,MAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,2BAAA,CAAU,IAAI,CAAA,EAAG,KAAK,CAAA;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,CAAC,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,oBAAA,EAAsB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1C,MAAA,mBAAA,CAAoB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAEzD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,cAAA,EAAgB,mBAAA,EAAqB,aAAa,CAAC,CAAA;AAE1F,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC1B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,MACvD,CAAA;AAEA,MAAA,IAAI,EAAA,EAAI,CAAA;AACR,MAAA,MAAM,IAAA,EAAM,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AACtC,MAAA,EAAA,GAAK,CAAA;AACL,MAAA,MAAM,OAAA,EAAS,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AACvD,MAAA,EAAA,GAAK,EAAA;AACL,MAAA,MAAM,gBAAA,EAAkB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AAClD,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,eAAe,CAAA;AACvD,MAAA,EAAA,GAAK,eAAA;AACL,MAAA,OAAO;AAAA,QACL,WAAA,EAAa,YAAA,CAAa,QAAQ,CAAA;AAAA,QAClC,SAAA;AAAA,QACA,GAAA;AAAA,QACA;AAAA,MACF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,MAAA,EAAA,GAAmD;AACtE,MAAA,MAAM,EAAE,SAAA,EAAW,aAAa,EAAA,EAAI,MAAA;AACpC,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACjD,MAAA,iCAAA,SAAU,CAAU,OAAA,IAAW,EAAA,EAAI,4CAA4C,CAAA;AAC/E,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAA,EAAM,SAAS,CAAC,CAAA;AAC3F,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC9C,CAAA;AAAA,IAEA,UAAA,EAAY,MAAA,CAAO,EAAE,QAAQ,CAAA,EAAA,GAAM;AACjC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,CAAqB,CAAA;AACjC,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA;AACrD,MAAA,MAAM,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,MAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AACzC,MAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAChD,MAAA,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,yBAAA,EAA2B,MAAA,CAAO,MAAA,EAAA,GAIuB;AACvD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,kCAAA,CAAoC,CAAA;AAChD,MAAA,MAAM,KAAA,EAAO,gBAAA,CAAiB,MAAM,CAAA;AACpC,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC/B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,uBAAuB,CAAA,EAAG,IAAI;AAAA,MACrF,CAAA;AACA,MAAA,MAAM,OAAA,EAAS,YAAA,CAAa,aAAa,CAAA;AACzC,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA;AACpC,MAAA,OAAO;AAAA,QACL,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,WAAA,EAAa,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,QAC5D,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,MAC3D,CAAA;AAAA,IACF,CAAA;AAAA,IACA,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAA,GAAW;AAC1C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,CAAmC,CAAA;AAC/C,MAAA,MAAM,KAAA,EAAO,gBAAA,CAAiB,MAAM,CAAA;AACpC,MAAA,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GACT,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,uBAAuB,CAAA,EAAG,IAAI;AAAA,MACrF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,sBAAA,EAAwB,MAAA,CAAO,MAAA,EAAA,GAAW;AACxC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,+BAAA,CAAiC,CAAA;AAC7C,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,UAAU,CAAA;AACnD,MAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO;AAAA,QAC1B,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AAED,MAAA,IAAI,aAAA,EAAe,CAAA;AACnB,MAAA,IAAI,cAAA,EAA+B,IAAA;AAEnC,MAAA,MAAA,CAAO,CAAC,aAAA,EAAe;AACrB,QAAA,MAAM,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,aAAA,EAAe,CAAC,CAAA,EAAI,QAAQ,CAAA;AACtE,QAAA,MAAM,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,QAAA,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,MAAA,EAAQ,CAAC,CAAA;AACrC,QAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAM,CAAC,CAAA;AAClD,QAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,UAAI,CAAC,SAAA,EAAA,GAC1B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,QACvD,CAAA;AACA,QAAA,MAAM,aAAA,EAAe,QAAA,CAAS,QAAA,CAAS,CAAC,CAAA;AACxC,QAAA,IAAI,eAAA,EAAiB,QAAA,CAAS,YAAA,CAAa,QAAA,CAAS,OAAA,EAAS,CAAC,CAAA;AAC9D,QAAA,OAAA,CAAQ,YAAA,EAAc;AAAA,UACpB,KAAK,uCAAA;AACH,YAAA,aAAA,EAAe,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AACvC,YAAA,KAAA;AAAA,UACF,KAAK,oCAAA;AACH,YAAA,cAAA,EAAgB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,QAAA,CAAS,OAAA,EAAS,CAAC,CAAA;AACrD,YAAA,MAAA,CAAO,eAAA,IAAmB,KAAA,EAAQ;AACE,cAAA;AAChC,gBAAA,MAAM,KAAA,EAAO,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,CAAA,EAAM,GAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAC5E,gBAAA,eAAA,EAAiB,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,CAAC,CAAA;AAClD,gBAAA,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO,CAAC,aAAA,EAAe,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,cACnE;AAAA,YACF;AACA,YAAA,KAAA;AAAA;AAAA,UAEF,OAAA;AACE,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,YAAY,CAAA,CAAA;AAC1D,QAAA;AACF,MAAA;AACsC,MAAA;AACxC,IAAA;AAEyC,IAAA;AACiB,MAAA;AAClB,MAAA;AACxC,IAAA;AACwB,IAAA;AAC0C,MAAA;AAC/B,MAAA;AACgB,MAAA;AACO,MAAA;AAED,MAAA;AAEhD,MAAA;AACT,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACO,EAAA;AACT;AF5HmE;AACA;AGnaP;AAEtC;AAiB4D;AACvC,EAAA;AAChC,IAAA;AACI,MAAA;AACgB,QAAA;AACV,QAAA;AACC,QAAA;AAEoE,UAAA;AAEzE,UAAA;AAEC,YAAA;AAGA,YAAA;AAE4C,YAAA;AAEnB,YAAA;AAC1B;AAEF,YAAA;AACL,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AACD,EAAA;AACM,EAAA;AACT;AH4YmE;AACA;AChZjC;AAChC,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAca;AAC8C,EAAA;AACnC,IAAA;AACF,IAAA;AACY,IAAA;AACjC,EAAA;AACyD,EAAA;AACX,EAAA;AAC7C,IAAA;AACkB,IAAA;AACR,IAAA;AAC6B,IAAA;AACN,IAAA;AACL,IAAA;AACX,MAAA;AACY,MAAA;AAC7B,IAAA;AACF,EAAA;AACiE,EAAA;AACJ,EAAA;AACtC,IAAA;AACE,IAAA;AACS,IAAA;AACjC,EAAA;AACyB,EAAA;AACa,EAAA;AAChB,IAAA;AACM,IAAA;AAC3B,IAAA;AACA,IAAA;AACD,EAAA;AACyD,EAAA;AACE,EAAA;AACG,EAAA;AAC7B,EAAA;AACe,IAAA;AACR,IAAA;AAC3B,IAAA;AACgC,IAAA;AAC7B,EAAA;AAC4C,EAAA;AAC3D,IAAA;AACa,IAAA;AACI,MAAA;AACa,MAAA;AAC9B,IAAA;AACA,IAAA;AAC+C,IAAA;AACf,IAAA;AAChC,IAAA;AACF,EAAA;AACmD,EAAA;AACrD;AAE6E;AAClC,EAAA;AACtB,IAAA;AACnB,EAAA;AACyC,EAAA;AACQ,EAAA;AAExB,EAAA;AACvB,IAAA;AAC8D,IAAA;AACnD,IAAA;AACb,EAAA;AAKE,EAAA;AACyC,IAAA;AACJ,IAAA;AACkC,IAAA;AACzE,EAAA;AAKE,EAAA;AACuD,IAAA;AAClB,IAAA;AACkC,IAAA;AACzE,EAAA;AAEyE,EAAA;AAClB,IAAA;AACuB,IAAA;AAC9E,EAAA;AAKE,EAAA;AACsE,IAAA;AACU,IAAA;AAClF,EAAA;AAKE,EAAA;AACsE,IAAA;AACY,IAAA;AACpF,EAAA;AASa,EAAA;AAGH,IAAA;AAC2D,MAAA;AACnE,IAAA;AAImB,IAAA;AACjB,MAAA;AAEK,QAAA;AAC+C,UAAA;AACjBA,YAAAA;AACkB,YAAA;AACI,YAAA;AAC1C,YAAA;AACT,UAAA;AAIK,UAAA;AACwBA,YAAAA;AACkB,YAAA;AACA,YAAA;AACtC,YAAA;AACT,UAAA;AACF,QAAA;AACJ,MAAA;AACF,IAAA;AAI4D,IAAA;AACmB,MAAA;AAC/CA,QAAAA;AACrB,QAAA;AAC+E,UAAA;AAC7B,YAAA;AACV,YAAA;AACG,YAAA;AACF,YAAA;AAC9C,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4C,IAAA;AACyC,MAAA;AACtCA,QAAAA;AACI,QAAA;AACd,UAAA;AACwB,UAAA;AACjC,YAAA;AACS,YAAA;AAC9B,UAAA;AACuC,UAAA;AACtC,YAAA;AACc,YAAA;AACR,YAAA;AAC6C,cAAA;AACD,cAAA;AAClD,YAAA;AACD,UAAA;AACkC,UAAA;AACrC,QAAA;AACO,QAAA;AACoF,UAAA;AAC1D,YAAA;AACwB,YAAA;AAC/B,cAAA;AACY,cAAA;AACjC,YAAA;AAC0C,YAAA;AAC3B,cAAA;AACqB,cAAA;AACpC,YAAA;AACH,UAAA;AAIE,UAAA;AAEuD,YAAA;AACjC,cAAA;AACY,cAAA;AACjC,YAAA;AACwB,YAAA;AACR,cAAA;AACO,gBAAA;AACK,gBAAA;AAC3B,cAAA;AACD,YAAA;AACmD,YAAA;AAClB,YAAA;AACoB,YAAA;AACJ,YAAA;AAChD,cAAA;AACc,cAAA;AACJ,cAAA;AACR,gBAAA;AACoC,gBAAA;AACd,gBAAA;AACjB,kBAAA;AAC2B,kBAAA;AAChC,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AAKoB,UAAA;AACK,YAAA;AAGjBC,YAAAA;AAIAA,YAAAA;AAEgB,YAAA;AACpB,cAAA;AACA,cAAA;AACA,cAAA;AAEE,cAAA;AACgB,gBAAA;AACd,gBAAA;AACA,gBAAA;AACD,cAAA;AAED,cAAA;AACuB,gBAAA;AACrB,gBAAA;AAAA;AAEU,gBAAA;AACX,cAAA;AACwB,cAAA;AAC5B,YAAA;AACH,UAAA;AAKoB,UAAA;AACG,YAAA;AACwB,YAAA;AACP,YAAA;AACf,cAAA;AACW,cAAA;AACT,cAAA;AACxB,YAAA;AACiC,YAAA;AACoB,YAAA;AACjC,cAAA;AACpB,YAAA;AACuB,YAAA;AACR,cAAA;AACd,cAAA;AACA,cAAA;AACD,YAAA;AACH,UAAA;AAKoB,UAAA;AACG,YAAA;AAC+B,YAAA;AAC9B,cAAA;AACE,cAAA;AACvB,YAAA;AACqC,YAAA;AACf,cAAA;AACW,cAAA;AACT,cAAA;AACxB,YAAA;AACiC,YAAA;AACK,YAAA;AAClB,cAAA;AACpB,YAAA;AAC8B,YAAA;AACN,cAAA;AACF,cAAA;AACW,cAAA;AACjC,YAAA;AACsD,YAAA;AACL,YAAA;AAClC,cAAA;AACd,cAAA;AACc,cAAA;AACZ,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACC,gBAAA;AACjB,kBAAA;AACkB,kBAAA;AACvB,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIuD,IAAA;AACrD,MAAA;AACc,QAAA;AACkCD,UAAAA;AACrC,UAAA;AAQ+B,YAAA;AACW,cAAA;AACL,cAAA;AACtC,gBAAA;AACE,kBAAA;AACe,kBAAA;AACjB,gBAAA;AACwC,gBAAA;AAC1C,cAAA;AACgC,cAAA;AACiB,cAAA;AAC/C,gBAAA;AACe,gBAAA;AAChB,cAAA;AACmB,cAAA;AACH,gBAAA;AACf,gBAAA;AACA,gBAAA;AACuB,gBAAA;AACK,gBAAA;AAC9B,cAAA;AACwC,cAAA;AACrB,gBAAA;AACuB,gBAAA;AAC1C,cAAA;AACiC,cAAA;AACnB,gBAAA;AACd,cAAA;AACkD,cAAA;AACE,cAAA;AACX,cAAA;AAG3C,YAAA;AAIwC,YAAA;AACf,cAAA;AACrB,gBAAA;AACmB,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACP,kBAAA;AACZ,oBAAA;AACF,oBAAA;AACf,oBAAA;AACD,kBAAA;AACM,kBAAA;AACT,gBAAA;AAEEC,gBAAAA;AACiB,kBAAA;AACE,kBAAA;AACjB,kBAAA;AACD,gBAAA;AACJ,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAI4D,IAAA;AAC1D,MAAA;AACc,QAAA;AAC0BD,UAAAA;AAC7B,UAAA;AAQ+B,YAAA;AACS,cAAA;AACzC,gBAAA;AACwB,kBAAA;AACI,kBAAA;AACf,kBAAA;AACb,gBAAA;AACwC,gBAAA;AAC1C,cAAA;AACiC,cAAA;AACpB,gBAAA;AACb,cAAA;AAC2C,cAAA;AACF,cAAA;AAG3C,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAIsD,IAAA;AACoC,MAAA;AAC3DA,QAAAA;AAEoB,QAAA;AACd,UAAA;AACS,UAAA;AACe,UAAA;AACJ,YAAA;AACD,YAAA;AACjD,UAAA;AACkC,UAAA;AACrC,QAAA;AAKsB,QAAA;AACC,UAAA;AACiB,UAAA;AACf,YAAA;AACW,YAAA;AACT,YAAA;AACxB,UAAA;AACiC,UAAA;AACoB,UAAA;AACjC,YAAA;AACpB,UAAA;AACM,UAAA;AACT,QAAA;AAEO,QAAA;AAI+B,UAAA;AACU,YAAA;AACL,YAAA;AACe,cAAA;AACf,cAAA;AACN,cAAA;AAC7B,gBAAA;AACc,kBAAA;AAC4B,kBAAA;AAC1C,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACwC,YAAA;AACP,cAAA;AAC7B,gBAAA;AACc,kBAAA;AACkB,kBAAA;AAChC,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACgB,YAAA;AAClB,UAAA;AAEA,UAAA;AAKoC,UAAA;AACJ,YAAA;AACC,cAAA;AACR,cAAA;AACvB,YAAA;AACF,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIgD,IAAA;AAC2C,MAAA;AACpEA,QAAAA;AACZ,QAAA;AACoF,UAAA;AAC3C,YAAA;AACC,YAAA;AAC5B,YAAA;AACnB,UAAA;AAKoC,UAAA;AACI,YAAA;AACxB,cAAA;AAC4B,cAAA;AACzC,YAAA;AACH,UAAA;AAKoC,UAAA;AACG,YAAA;AACvB,cAAA;AAC4B,cAAA;AACzC,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAEO,IAAA;AACT,EAAA;AAEO,EAAA;AACF,IAAA;AACH,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;ADyQmE;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","sourcesContent":[null,"import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type RouterOutputs, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  OnboardingOperationParams,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n  onScreenDisplayed,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n  onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  await onScreenDisplayed?.();\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n    __options: options,\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n\n            getWorkspacesForSso: async (): Promise<\n              RouterOutputs[\"auth\"][\"sso\"][\"findWorkspaces\"][\"workspaces\"]\n            > => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaces } = await client.auth.sso.findWorkspaces.query({ pubKey });\n              return workspaces;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (\n            wrappingKey: WrappingKeyResponse,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            await params?.onScreenDisplayed?.();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (\n            registerParams: RegisterOnboardingDeviceParams,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const { role, name } = registerParams;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n              onScreenDisplayed: params?.onScreenDisplayed,\n            });\n          },\n\n          reviewSharedOwner: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (\n            challenge: OnboardingSeedChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                challengeId: challenge.challengeId,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            if (challenge.challengeType === \"PSD\") {\n              const signature = await approveChallenge(challenge, params);\n              await params?.onPsdChallengeSigned?.();\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"PSD\", signature },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            if (challenge.challengeType === \"SOFT\") {\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"SOFT\" },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            throw new Error(\"Challenge type must be either PSD or SOFT\");\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: async (): Promise<string> => {\n      logger.info(`[device] generateSeedFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    generateWrappingKeyFragment: async (): Promise<string> => {\n      logger.info(`[device] generateWrappingKeyFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: async (): Promise<string> => {\n      logger.info(`[device] getDeviceUserId`);\n      const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n      return removeStatus(response).toString(\"hex\").toUpperCase();\n    },\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: async (params: {\n      secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n    }): Promise<void> => {\n      logger.info(`[device] openSession`);\n      const { secureChannel } = params;\n\n      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n      const dataDerivation = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n      const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n      const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n      const attestation = Buffer.concat([\n        Buffer.from([sigBuffer.length]),\n        sigBuffer,\n        attestationPubBuffer,\n        Buffer.from([certBuffer.length]),\n        certBuffer,\n      ]);\n\n      const lengthAttestation = Buffer.alloc(2);\n      lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n      );\n    },\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: async (params: {\n      handshake: string;\n      handshakeAttestation: HsmCertificate;\n      partitionId: string;\n    }): Promise<{ handshake: string; signature: string }> => {\n      logger.info(`[device] startKKPatternAsResponder`);\n      const data = buildAttestation(params);\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n      const buffer = removeStatus(bufWithStatus);\n      const dataLength = buffer.readInt8(0);\n      return {\n        handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n        signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n      };\n    },\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n"]}
+{"version":3,"sources":["/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","../src/engine/index.ts","../src/device/real-device.ts","../src/trpc.ts"],"names":["engine","client"],"mappings":"AAAA;AACE;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACTA,4FAAsB;ADWtB;AACA;AErBA;AACA,4BAAoC;AAkBpC,IAAM,iBAAA,EAAmB,GAAA;AAMzB,IAAM,sBAAA,EAAwB,CAAC,UAAA,EAAA,GAAiC;AAC9D,EAAA,MAAM,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,IAAI,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,EAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA,EAAM,EAAE,CAAC,CAAA;AAC5E,EAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,EAAA,GAAA,CAAU,KAAA,EAAO,UAAA,EAAA,IAAgB,CAAC,CAAA;AACtD,CAAA;AAEA,IAAM,YAAA,EAAc,CAAC,KAAA,EAAe,MAAA,EAAA,GAA6B;AAC/D,EAAA,MAAM,OAAA,EAAS,CAAC,CAAA;AAChB,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,KAAA,EAAO,KAAA,EAAO,EAAA,EAAI,MAAA,CAAO,MAAA,EAAQ,EAAA,GAAK,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO;AACxE,IAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA;AACT,CAAA;AAEA,IAAM,aAAA,EAAe,CAAC,MAAA,EAAA,GAA2B,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,OAAA,EAAS,+BAAa,CAAA;AAE9F,IAAM,YAAA,EAAc,MAAA,CAClB,SAAA,EACA,OAAA,EACA,IAAA,EACA,UAAA,EAAoB,gBAAA,EAAA,GACA;AACpB,EAAA,MAAM,OAAA,EAAS,WAAA,CAAY,SAAA,EAAW,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,EAAW,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAC7B,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,CAAC,CAAA;AACtB,IAAA,MAAM,KAAA,EAAO,CAAC,GAAG,OAAO,CAAA;AAGxB,IAAA,IAAA,CAAK,CAAC,EAAA,EAAI,EAAA,GAAK,GAAA;AACf,IAAA,SAAA,EAAY,MAAM,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,EAAI,IAAA,CAAK,CAAC,CAAA,EAAG,IAAA,CAAK,CAAC,CAAA,EAAI,KAAA,EAAO;AAAA,MAC7E,KAAA;AAAA,MACA,GAAG;AAAA,IACL,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,QAAA;AACT,CAAA;AAEA,IAAM,iBAAA,EAAmB,CAAC,MAAA,EAAA,GAIZ;AACZ,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,SAAA,EAAW,QAAQ,CAAA;AAC7E,EAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACtC,EAAA,eAAA,CAAgB,WAAA,CAAY,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAElD,EAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,WAAA,EAAa,QAAQ,CAAA;AAChF,EAAA,MAAM,iBAAA,EAAmB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACvC,EAAA,gBAAA,CAAiB,WAAA,CAAY,UAAA,CAAW,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAEpD,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,oBAAA,CAAqB,cAAA,EAAgB,QAAQ,CAAA;AAElF,EAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,IAClC,eAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,KAAK,CAAA;AACxD,EAAA,MAAM,mBAAA,EAAqB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACzC,EAAA,kBAAA,CAAmB,WAAA,CAAY,YAAA,CAAa,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAExD,EAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,WAAA,EAAa,KAAK,CAAA;AACvD,EAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACtC,EAAA,eAAA,CAAgB,WAAA,CAAY,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,CAAC,CAAA;AAElD,EAAA,MAAM,wBAAA,EAA0B,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC9C,EAAA,uBAAA,CAAwB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAE7D,EAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,IACzB,kBAAA;AAAA,IACA,YAAA;AAAA,IACA,uBAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxC,EAAA,iBAAA,CAAkB,aAAA,CAAc,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAA;AAE9C,EAAA,MAAM,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,CAAC,iBAAA,EAAmB,IAAI,CAAC,CAAA;AAEtD,EAAA,OAAO,MAAA;AACT,CAAA;AAIA,IAAM,oBAAA,EAAoC,CAAC,GAAA,EAAA,GAAQ;AAEjD,EAAA,GAAA,CAAI,IAAA,WAAe,mCAAA,EAAmB,OAAO,IAAA;AAE7C,EAAA,GAAA,CAAI,sDAAA,GAA0B,EAAA,GAAK,GAAA,CAAI,WAAA,IAAe,KAAA,EAAQ,OAAO,IAAA;AAErE,EAAA,GAAA,CAAI,IAAA,WAAe,oCAAA,EAAoB,OAAO,IAAA;AAG9C,EAAA,OAAO,KAAA;AACT,CAAA;AAEO,SAAS,gBAAA,CAAiB,OAAA,EAAkB,MAAA,EAAwB;AACzE,EAAA,MAAM,EAAE,YAAY,EAAA,EAAI,OAAA;AAExB,EAAA,MAAA,SAAe,GAAA,CACb,GAAA,EACA,aAAA,EAA6B,mBAAA,EACjB;AACZ,IAAA,OAAO,iCAAA;AAAA,MACL,iDAAA,WAA6B,CAAA,CAAK,CAAC,SAAA,EAAA,GAAc,wBAAA,GAAK,CAAI,SAAS,CAAC,CAAA,EAAG,YAAY;AAAA,IACrF,CAAA;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,EAAU,CAAA,EAAA,GAAe,KAAA;AAE/B,EAAA,MAAM,YAAA,EAAc,CAAA,EAAA,GAAe,IAAA;AACnC,EAAA,MAAM,KAAA,EAAO,MAAA,CACX,KAAA,EAAwC,CAAC,CAAA,EAAA,GACH;AAEtC,IAAA,MAAM,GAAA;AAAA;AAAA,MAEJ,MAAA,CAAO,UAAA,EAAA,GAAe;AAAA,MAAC,CAAA;AAAA,uBACvB,IAAA,CAAK,YAAA,UAAgB;AAAA,IACvB,CAAA;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,CAAa,uBAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,YAAA,EAAc,QAAQ,CAAC,CAAA;AACxE,MAAA,OAAO,EAAE,WAAA,EAAa,KAAK,CAAA;AAAA,IAC7B,EAAA,MAAA,CAAS,GAAA,EAAK;AACZ,MAAA,GAAA,CAAI,sDAAA,GAA0B,EAAA,GAAK,mBAAA,CAAoB,GAAG,CAAA,EAAG;AAC3D,QAAA,OAAO,EAAE,WAAA,EAAa,MAAM,CAAA;AAAA,MAC9B;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,QAAA,EAAU,MAAA,CAAO,OAAA,EAAA,GAAqC;AAC1D,IAAA,MAAM,IAAA,EAAM,MAAM,GAAA;AAAA,MAAI,CAAC,SAAA,EAAA,GACrB,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,MAAM,CAAC;AAAA,IACrE,CAAA;AAEA,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,CAAA,EAAA,GAAM,UAAA,CAAW,CAAA,EAAG,GAAG,CAAC,CAAA;AAC3C,IAAA,OAAO,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,EAC3B,CAAA;AAEA,EAAA,MAAM,aAAA,EAAe,MAAA,CACnB,UAAA,EACA,EAAE,SAAA,EAAW,aAAa,CAAA,EAAA,GACyB;AACnD,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,CAAG,CAAA;AACnD,IAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,UAAU,CAAA;AAC7C,IAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,MACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,MACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,QAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,QAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,QAAA,OAAO,GAAA;AAAA,MACT,CAAC;AAAA,IACH,CAAC,CAAA;AACD,IAAA,MAAM,MAAA,EAAQ,UAAA,EAAY,EAAA,EAAO,CAAA;AACjC,IAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,MACrB,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,KAAA,EAAO,CAAA,EAAM,IAAI,CAAA;AAAA,uBAC3D,YAAA,UAAgB;AAAA,IAClB,CAAA;AACA,IAAA,MAAM,aAAA,EAAe,QAAA,CAAS,QAAA,CAAS,CAAC,CAAA;AACxC,IAAA,MAAM,OAAA,EAAS,QAAA,CACZ,KAAA,CAAM,CAAA,EAAG,aAAA,EAAe,CAAC,CAAA,CACzB,QAAA,CAAS,KAAK,CAAA,CACd,WAAA,CAAY,CAAA;AACf,IAAA,MAAM,UAAA,EAAY,QAAA,CACf,KAAA,CAAM,aAAA,EAAe,CAAA,EAAG,QAAA,CAAS,OAAA,EAAS,+BAAa,CAAA,CACvD,QAAA,CAAS,QAAQ,CAAA;AACpB,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,EAC7B,CAAA;AAEA,EAAA,MAAM,OAAA,EAAiB;AAAA,IACrB,YAAA,EAAc,MAAA,CAAO,EAAE,SAAA,EAAW,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,UAAU,CAAA,EAAG,cAAc,CAAA,EAAA,GAAM;AAC1F,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,qBAAA,CAAuB,CAAA;AACnC,MAAA,iCAAA,KAAU,IAAS,mBAAA,EAAqB,kDAAkD,CAAA;AAC1F,MAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,2CAAA,EAA2B,KAAK,CAAA;AACtE,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AACnC,MAAA,MAAM,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA;AAEjD,MAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,2BAAA,CAAU,IAAI,CAAA,EAAG,KAAK,CAAA;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,CAAC,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,QAC/B,UAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,QACpC;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,oBAAA,EAAsB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1C,MAAA,mBAAA,CAAoB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAEzD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA;AAAA,QAC/B,iBAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,QAC9B,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,KAAK,CAAA;AAAA,QAC5B,mBAAA;AAAA,QACA;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,eAAA,EAAiB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAChC,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,MACvD,CAAA;AAEA,MAAA,OAAO,YAAA,CAAa,cAAc,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IACpD,CAAA;AAAA,IAEA,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAA,GAIV;AACrB,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC/B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,gBAAA,CAAiB,MAAM,CAAC;AAAA,MAC3E,CAAA;AACA,MAAA,OAAO,YAAA,CAAa,aAAa,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IACnD,CAAA;AAAA,IAEA,oBAAA,EAAsB,MAAA,CAAA,EAAA,GAA6B;AACjD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,6BAAA,CAA+B,CAAA;AAC3C,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,YAAY,CAAA;AACrD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AACD,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,IAAI,CAAC,CAAA;AACtF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,2BAAA,EAA6B,MAAA,CAAA,EAAA,GAA6B;AACxD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oCAAA,CAAsC,CAAA;AAClD,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,YAAY,CAAA;AACrD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO;AAAA,QACzB,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AACD,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,IAAI,CAAC,CAAA;AACtF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,IACjD,CAAA;AAAA,IACA,cAAA,EAAgB,MAAA,CAAA,EAAA,GAOV;AACJ,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AACrF,MAAA,MAAM,OAAA,EAAS,YAAA,CAAa,aAAa,CAAA;AACzC,MAAA,MAAM,QAAA,EAAU,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,GAAA,EAAK,CAAC,CAAA;AAC3C,MAAA,OAAO;AAAA,QACL,WAAA,EAAa;AAAA,UACX,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,UAC/C,cAAA,EAAgB,MAAA,CAAO,KAAA,CAAM,EAAA,EAAI,GAAA,EAAK,EAAE,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,UAC3D,WAAA,EAAa,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,EAAA,EAAI,OAAO,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,QAC7E,CAAA;AAAA,QACA;AAAA,MACF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,qBAAA,EAAuB,MAAA,CAAA,EAAA,GAAY;AACjC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,8BAAA,CAAgC,CAAA;AAC5C,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AACrF,MAAA,MAAM,IAAA,EAAM,YAAA,CAAa,aAAa,CAAA;AACtC,MAAA,MAAM,UAAA,EAAY,GAAA,CAAI,CAAC,CAAA;AACvB,MAAA,MAAM,IAAA,EAAM,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,SAAS,CAAA;AACtC,MAAA,MAAM,IAAA,EAAM,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,UAAA,EAAY,CAAC,CAAA;AACvC,MAAA,OAAO;AAAA,QACL,4BAAA,EAA8B,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,QAChD,2BAAA,EAA6B,GAAA,CAAI,QAAA,CAAS,KAAK;AAAA,MACjD,CAAA;AAAA,IACF,CAAA;AAAA,IACA,wBAAA,EAA0B,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,eAAA,EAAiB,EAAE,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,IACvF,eAAA,EAAiB,MAAA,CAAA,EAAA,GAA6B;AAC5C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,wBAAA,CAA0B,CAAA;AACtC,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAChF,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA,CAAE,WAAA,CAAY,CAAA;AAAA,IAC5D,CAAA;AAAA,IACA,YAAA,EAAc,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAC,CAAA;AAAA,IAChE,mBAAA,EAAqB,CAAA,EAAA,GAAM,YAAA,CAAa,uBAAA,CAAM,UAAA,EAAY,EAAE,SAAA,EAAW,KAAK,CAAC,CAAA;AAAA,IAC7E,UAAA,EAAY,MAAA,CAAA,EAAA,GAAY;AACtB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,CAAqB,CAAA;AACjC,MAAA,MAAM,KAAA,EAAO,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAA,EAAM,GAAI,CAAA;AAC1C,MAAA,MAAM,IAAA,EAAM,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA;AAC1E,MAAA,MAAM,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAU3C,MAAA,OAAO,IAAA,IAAQ,OAAA,GAAU,IAAA,IAAQ,MAAA;AAAA,IACnC,CAAA;AAAA,IAEA,oBAAA,EAAsB,MAAA,CAAA,EAAA,GAA4D;AAChF,MAAA,MAAM,IAAA,EAAM,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAC3E,MAAA,MAAM,aAAA,EAAe,GAAA,CAAI,QAAA,CAAS,CAAC,CAAA;AACnC,MAAA,MAAM,OAAA,EAAS,GAAA,CACZ,KAAA,CAAM,CAAA,EAAG,aAAA,EAAe,CAAC,CAAA,CACzB,QAAA,CAAS,KAAK,CAAA,CACd,WAAA,CAAY,CAAA;AACf,MAAA,MAAM,UAAA,EAAY,GAAA,CAAI,KAAA,CAAM,aAAA,EAAe,CAAA,EAAG,GAAA,CAAI,OAAA,EAAS,+BAAa,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAC3F,MAAA,OAAO,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,IAC7B,CAAA;AAAA,IAEA,WAAA,EAAa,MAAA,CAAO,MAAA,EAAA,GAEC;AACnB,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,oBAAA,CAAsB,CAAA;AAClC,MAAA,MAAM,EAAE,cAAc,EAAA,EAAI,MAAA;AAE1B,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,eAAe,CAAA;AACxD,MAAA,MAAM,eAAA,EAAiB,MAAA,CAAO,MAAA,CAAO;AAAA,QACnC,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AAED,MAAA,MAAM,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,CAAA;AAEtD,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,SAAA,EAAW,QAAQ,CAAA;AAC3E,MAAA,MAAM,qBAAA,EAAuB,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,cAAA,EAAgB,QAAQ,CAAA;AAC3F,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,WAAA,EAAa,QAAQ,CAAA;AAC9E,MAAA,MAAM,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO;AAAA,QAChC,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,QAC9B,SAAA;AAAA,QACA,oBAAA;AAAA,QACA,MAAA,CAAO,IAAA,CAAK,CAAC,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,kBAAA,EAAoB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxC,MAAA,iBAAA,CAAkB,aAAA,CAAc,WAAA,CAAY,MAAA,EAAQ,CAAC,CAAA;AAErD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,cAAA,EAAgB,MAAA,EAAQ,iBAAA,EAAmB,WAAW,CAAC,CAAA;AAEnF,MAAA,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GACT,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,YAAY,CAAA,EAAG,IAAI;AAAA,MAC1E,CAAA;AAAA,IACF,CAAA;AAAA,IAEA,QAAA,EAAU,MAAA,CAAO,MAAA,EAAA,GAUX;AACJ,MAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,eAAA,EAAiB,CAAA,EAAG,IAAA,EAAM,KAAK,EAAA,EAAI,MAAA;AACpE,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAEjD,MAAA,iCAAA,SAAU,CAAU,OAAA,IAAW,EAAA,EAAI,4CAA4C,CAAA;AAC/E,MAAA,MAAM,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,2CAAA,EAA2B,KAAK,CAAA;AACnE,MAAA,iCAAA,cAAU,CAAe,OAAA,IAAW,EAAA,EAAI,8CAA8C,CAAA;AAEtF,MAAA,MAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAErC,MAAA,MAAM,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,2BAAA,CAAU,IAAI,CAAA,EAAG,KAAK,CAAA;AAAA,QAClC,MAAA,CAAO,IAAA,CAAK,CAAC,YAAA,CAAa,MAAM,CAAC,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,oBAAA,EAAsB,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1C,MAAA,mBAAA,CAAoB,aAAA,CAAc,aAAA,CAAc,MAAA,EAAQ,CAAC,CAAA;AAEzD,MAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,cAAA,EAAgB,mBAAA,EAAqB,aAAa,CAAC,CAAA;AAE1F,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC1B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,MACvD,CAAA;AAEA,MAAA,IAAI,EAAA,EAAI,CAAA;AACR,MAAA,MAAM,IAAA,EAAM,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AACtC,MAAA,EAAA,GAAK,CAAA;AACL,MAAA,MAAM,OAAA,EAAS,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AACvD,MAAA,EAAA,GAAK,EAAA;AACL,MAAA,MAAM,gBAAA,EAAkB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,CAAC,CAAA,CAAE,CAAC,CAAA;AAClD,MAAA,CAAA,EAAA;AACA,MAAA,MAAM,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAA,EAAI,eAAe,CAAA;AACvD,MAAA,EAAA,GAAK,eAAA;AACL,MAAA,OAAO;AAAA,QACL,WAAA,EAAa,YAAA,CAAa,QAAQ,CAAA;AAAA,QAClC,SAAA;AAAA,QACA,GAAA;AAAA,QACA;AAAA,MACF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,YAAA,EAAc,MAAA,CAAO,MAAA,EAAA,GAAmD;AACtE,MAAA,MAAM,EAAE,SAAA,EAAW,aAAa,EAAA,EAAI,MAAA;AACpC,MAAA,MAAM,UAAA,EAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACjD,MAAA,iCAAA,SAAU,CAAU,OAAA,IAAW,EAAA,EAAI,4CAA4C,CAAA;AAC/E,MAAA,MAAM,SAAA,EAAW,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,GAAA,EAAM,CAAA,EAAM,CAAA,EAAM,CAAA,EAAM,SAAS,CAAC,CAAA;AAC3F,MAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC9C,CAAA;AAAA,IAEA,UAAA,EAAY,MAAA,CAAO,EAAE,QAAQ,CAAA,EAAA,GAAM;AACjC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,mBAAA,CAAqB,CAAA;AACjC,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,CAAA;AACrD,MAAA,MAAM,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,MAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AACzC,MAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAChD,MAAA,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,yBAAA,EAA2B,MAAA,CAAO,MAAA,EAAA,GAIuB;AACvD,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,kCAAA,CAAoC,CAAA;AAChD,MAAA,MAAM,KAAA,EAAO,gBAAA,CAAiB,MAAM,CAAA;AACpC,MAAA,MAAM,cAAA,EAAgB,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GAC/B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,uBAAuB,CAAA,EAAG,IAAI;AAAA,MACrF,CAAA;AACA,MAAA,MAAM,OAAA,EAAS,YAAA,CAAa,aAAa,CAAA;AACzC,MAAA,MAAM,WAAA,EAAa,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA;AACpC,MAAA,OAAO;AAAA,QACL,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,WAAA,EAAa,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAA,QAC5D,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ;AAAA,MAC3D,CAAA;AAAA,IACF,CAAA;AAAA,IACA,wBAAA,EAA0B,MAAA,CAAO,MAAA,EAAA,GAAW;AAC1C,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,CAAmC,CAAA;AAC/C,MAAA,MAAM,KAAA,EAAO,gBAAA,CAAiB,MAAM,CAAA;AACpC,MAAA,MAAM,GAAA;AAAA,QAAI,CAAC,SAAA,EAAA,GACT,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,4BAAA,CAAW,uBAAuB,CAAA,EAAG,IAAI;AAAA,MACrF,CAAA;AAAA,IACF,CAAA;AAAA,IACA,sBAAA,EAAwB,MAAA,CAAO,MAAA,EAAA,GAAW;AACxC,MAAA,MAAA,CAAO,IAAA,CAAK,CAAA,+BAAA,CAAiC,CAAA;AAC7C,MAAA,MAAM,KAAA,EAAO,qBAAA,CAAsB,uBAAA,CAAM,UAAU,CAAA;AACnD,MAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO;AAAA,QAC1B,MAAA,CAAO,IAAA,CAAK,CAAC,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,QACzB,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,UAAA,EAAA,GAAe;AAC1B,UAAA,MAAM,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,UAAA,GAAA,CAAI,aAAA,CAAc,UAAA,EAAY,CAAC,CAAA;AAC/B,UAAA,OAAO,GAAA;AAAA,QACT,CAAC;AAAA,MACH,CAAC,CAAA;AAED,MAAA,IAAI,aAAA,EAAe,CAAA;AACnB,MAAA,IAAI,cAAA,EAA+B,IAAA;AAEnC,MAAA,MAAA,CAAO,CAAC,aAAA,EAAe;AACrB,QAAA,MAAM,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,aAAA,EAAe,CAAC,CAAA,EAAI,QAAQ,CAAA;AACtE,QAAA,MAAM,OAAA,EAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,QAAA,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,MAAA,EAAQ,CAAC,CAAA;AACrC,QAAA,MAAM,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAM,CAAC,CAAA;AAClD,QAAA,MAAM,SAAA,EAAW,MAAM,GAAA;AAAA,UAAI,CAAC,SAAA,EAAA,GAC1B,WAAA,CAAY,SAAA,EAAW,CAAC,GAAA,EAAM,EAAA,EAAM,CAAA,EAAM,CAAI,CAAA,EAAG,IAAI;AAAA,QACvD,CAAA;AACA,QAAA,MAAM,aAAA,EAAe,QAAA,CAAS,QAAA,CAAS,CAAC,CAAA;AACxC,QAAA,IAAI,eAAA,EAAiB,QAAA,CAAS,YAAA,CAAa,QAAA,CAAS,OAAA,EAAS,CAAC,CAAA;AAC9D,QAAA,OAAA,CAAQ,YAAA,EAAc;AAAA,UACpB,KAAK,uCAAA;AACH,YAAA,aAAA,EAAe,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA;AACvC,YAAA,KAAA;AAAA,UACF,KAAK,oCAAA;AACH,YAAA,cAAA,EAAgB,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,QAAA,CAAS,OAAA,EAAS,CAAC,CAAA;AACrD,YAAA,MAAA,CAAO,eAAA,IAAmB,KAAA,EAAQ;AACE,cAAA;AAChC,gBAAA,MAAM,KAAA,EAAO,MAAM,GAAA,CAAI,CAAC,SAAA,EAAA,GAAc,SAAA,CAAU,IAAA,CAAK,CAAA,EAAM,GAAA,EAAM,CAAA,EAAM,CAAI,CAAC,CAAA;AAC5E,gBAAA,eAAA,EAAiB,IAAA,CAAK,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,CAAC,CAAA;AAClD,gBAAA,cAAA,EAAgB,MAAA,CAAO,MAAA,CAAO,CAAC,aAAA,EAAe,YAAA,CAAa,IAAI,CAAC,CAAC,CAAA;AAAA,cACnE;AAAA,YACF;AACA,YAAA,KAAA;AAAA;AAAA,UAEF,OAAA;AACE,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,YAAY,CAAA,CAAA;AAC1D,QAAA;AACF,MAAA;AACsC,MAAA;AACxC,IAAA;AAEyC,IAAA;AACiB,MAAA;AAClB,MAAA;AACxC,IAAA;AACwB,IAAA;AAC0C,MAAA;AAC/B,MAAA;AACgB,MAAA;AACO,MAAA;AAED,MAAA;AAEhD,MAAA;AACT,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACO,EAAA;AACT;AF3HmE;AACA;AGpaP;AAEtC;AAiB4D;AACvC,EAAA;AAChC,IAAA;AACI,MAAA;AACgB,QAAA;AACV,QAAA;AACC,QAAA;AAEoE,UAAA;AAEzE,UAAA;AAEC,YAAA;AAGA,YAAA;AAE4C,YAAA;AAEnB,YAAA;AAC1B;AAEF,YAAA;AACL,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AACD,EAAA;AACM,EAAA;AACT;AH6YmE;AACA;ACjZjC;AAChC,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAca;AAC8C,EAAA;AACnC,IAAA;AACF,IAAA;AACY,IAAA;AACjC,EAAA;AACyD,EAAA;AACX,EAAA;AAC7C,IAAA;AACkB,IAAA;AACR,IAAA;AAC6B,IAAA;AACN,IAAA;AACL,IAAA;AACX,MAAA;AACY,MAAA;AAC7B,IAAA;AACF,EAAA;AACiE,EAAA;AACJ,EAAA;AACtC,IAAA;AACE,IAAA;AACS,IAAA;AACjC,EAAA;AACyB,EAAA;AACa,EAAA;AAChB,IAAA;AACM,IAAA;AAC3B,IAAA;AACA,IAAA;AACD,EAAA;AACyD,EAAA;AACE,EAAA;AACG,EAAA;AAC7B,EAAA;AACe,IAAA;AACR,IAAA;AAC3B,IAAA;AACgC,IAAA;AAC7B,EAAA;AAC4C,EAAA;AAC3D,IAAA;AACa,IAAA;AACI,MAAA;AACa,MAAA;AAC9B,IAAA;AACA,IAAA;AAC+C,IAAA;AACf,IAAA;AAChC,IAAA;AACF,EAAA;AACmD,EAAA;AACrD;AAE6E;AAClC,EAAA;AACtB,IAAA;AACnB,EAAA;AACyC,EAAA;AACQ,EAAA;AAExB,EAAA;AACvB,IAAA;AAC8D,IAAA;AACnD,IAAA;AACb,EAAA;AAKE,EAAA;AACyC,IAAA;AACJ,IAAA;AACkC,IAAA;AACzE,EAAA;AAKE,EAAA;AACuD,IAAA;AAClB,IAAA;AACkC,IAAA;AACzE,EAAA;AAEyE,EAAA;AAClB,IAAA;AACuB,IAAA;AAC9E,EAAA;AAKE,EAAA;AACsE,IAAA;AACU,IAAA;AAClF,EAAA;AAKE,EAAA;AACsE,IAAA;AACY,IAAA;AACpF,EAAA;AASa,EAAA;AAGH,IAAA;AAC2D,MAAA;AACnE,IAAA;AAImB,IAAA;AACjB,MAAA;AAEK,QAAA;AAC+C,UAAA;AACjBA,YAAAA;AACkB,YAAA;AACI,YAAA;AAC1C,YAAA;AACT,UAAA;AAIK,UAAA;AACwBA,YAAAA;AACkB,YAAA;AACA,YAAA;AACtC,YAAA;AACT,UAAA;AACF,QAAA;AACJ,MAAA;AACF,IAAA;AAI4D,IAAA;AACmB,MAAA;AAC/CA,QAAAA;AACrB,QAAA;AAC+E,UAAA;AAC7B,YAAA;AACV,YAAA;AACG,YAAA;AACF,YAAA;AAC9C,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAI4C,IAAA;AACyC,MAAA;AACtCA,QAAAA;AACI,QAAA;AACd,UAAA;AACwB,UAAA;AACjC,YAAA;AACS,YAAA;AAC9B,UAAA;AACuC,UAAA;AACtC,YAAA;AACc,YAAA;AACR,YAAA;AAC6C,cAAA;AACD,cAAA;AAClD,YAAA;AACD,UAAA;AACkC,UAAA;AACrC,QAAA;AACO,QAAA;AACoF,UAAA;AAC1D,YAAA;AACwB,YAAA;AAC/B,cAAA;AACY,cAAA;AACjC,YAAA;AAC0C,YAAA;AAC3B,cAAA;AACqB,cAAA;AACpC,YAAA;AACH,UAAA;AAIE,UAAA;AAEuD,YAAA;AACjC,cAAA;AACY,cAAA;AACjC,YAAA;AACwB,YAAA;AACR,cAAA;AACO,gBAAA;AACK,gBAAA;AAC3B,cAAA;AACD,YAAA;AACmD,YAAA;AAClB,YAAA;AACoB,YAAA;AACJ,YAAA;AAChD,cAAA;AACc,cAAA;AACJ,cAAA;AACR,gBAAA;AACoC,gBAAA;AACd,gBAAA;AACjB,kBAAA;AAC2B,kBAAA;AAChC,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AAKoB,UAAA;AACK,YAAA;AAGjBC,YAAAA;AAIAA,YAAAA;AAEgB,YAAA;AACpB,cAAA;AACA,cAAA;AACA,cAAA;AAEE,cAAA;AACgB,gBAAA;AACd,gBAAA;AACA,gBAAA;AACD,cAAA;AAED,cAAA;AACuB,gBAAA;AACrB,gBAAA;AAAA;AAEU,gBAAA;AACX,cAAA;AACwB,cAAA;AAC5B,YAAA;AACH,UAAA;AAKoB,UAAA;AACG,YAAA;AACwB,YAAA;AACP,YAAA;AACf,cAAA;AACW,cAAA;AACT,cAAA;AACxB,YAAA;AACiC,YAAA;AACoB,YAAA;AACjC,cAAA;AACpB,YAAA;AACuB,YAAA;AACR,cAAA;AACd,cAAA;AACA,cAAA;AACD,YAAA;AACH,UAAA;AAKoB,UAAA;AACG,YAAA;AAC+B,YAAA;AAC9B,cAAA;AACE,cAAA;AACvB,YAAA;AACqC,YAAA;AACf,cAAA;AACW,cAAA;AACT,cAAA;AACxB,YAAA;AACiC,YAAA;AACK,YAAA;AAClB,cAAA;AACpB,YAAA;AAC8B,YAAA;AACN,cAAA;AACF,cAAA;AACW,cAAA;AACjC,YAAA;AACsD,YAAA;AACL,YAAA;AAClC,cAAA;AACd,cAAA;AACc,cAAA;AACZ,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACC,gBAAA;AACjB,kBAAA;AACkB,kBAAA;AACvB,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIuD,IAAA;AACrD,MAAA;AACc,QAAA;AACkCD,UAAAA;AACrC,UAAA;AAQ+B,YAAA;AACW,cAAA;AACL,cAAA;AACtC,gBAAA;AACE,kBAAA;AACe,kBAAA;AACjB,gBAAA;AACwC,gBAAA;AAC1C,cAAA;AACgC,cAAA;AACiB,cAAA;AAC/C,gBAAA;AACe,gBAAA;AAChB,cAAA;AACmB,cAAA;AACH,gBAAA;AACf,gBAAA;AACA,gBAAA;AACuB,gBAAA;AACK,gBAAA;AAC9B,cAAA;AACwC,cAAA;AACrB,gBAAA;AACuB,gBAAA;AAC1C,cAAA;AACiC,cAAA;AACnB,gBAAA;AACd,cAAA;AACkD,cAAA;AACE,cAAA;AACX,cAAA;AAG3C,YAAA;AAIwC,YAAA;AACf,cAAA;AACrB,gBAAA;AACmB,gBAAA;AACA,gBAAA;AACqB,gBAAA;AACP,kBAAA;AACZ,oBAAA;AACF,oBAAA;AACf,oBAAA;AACD,kBAAA;AACM,kBAAA;AACT,gBAAA;AAEEC,gBAAAA;AACiB,kBAAA;AACE,kBAAA;AACjB,kBAAA;AACD,gBAAA;AACJ,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAI4D,IAAA;AAC1D,MAAA;AACc,QAAA;AAC0BD,UAAAA;AAC7B,UAAA;AAQ+B,YAAA;AACS,cAAA;AACzC,gBAAA;AACwB,kBAAA;AACI,kBAAA;AACf,kBAAA;AACb,gBAAA;AACwC,gBAAA;AAC1C,cAAA;AACiC,cAAA;AACpB,gBAAA;AACb,cAAA;AAC2C,cAAA;AACF,cAAA;AAG3C,YAAA;AACF,UAAA;AACF,QAAA;AACF,MAAA;AACF,IAAA;AAIsD,IAAA;AACoC,MAAA;AAC3DA,QAAAA;AAEoB,QAAA;AACd,UAAA;AACS,UAAA;AACe,UAAA;AACJ,YAAA;AACD,YAAA;AACjD,UAAA;AACkC,UAAA;AACrC,QAAA;AAKsB,QAAA;AACC,UAAA;AACiB,UAAA;AACf,YAAA;AACW,YAAA;AACT,YAAA;AACxB,UAAA;AACiC,UAAA;AACoB,UAAA;AACjC,YAAA;AACpB,UAAA;AACM,UAAA;AACT,QAAA;AAEO,QAAA;AAI+B,UAAA;AACU,YAAA;AACL,YAAA;AACe,cAAA;AACf,cAAA;AACN,cAAA;AAC7B,gBAAA;AACc,kBAAA;AAC4B,kBAAA;AAC1C,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACwC,YAAA;AACP,cAAA;AAC7B,gBAAA;AACc,kBAAA;AACkB,kBAAA;AAChC,gBAAA;AACuB,gBAAA;AACzB,cAAA;AACF,YAAA;AACgB,YAAA;AAClB,UAAA;AAEA,UAAA;AAKoC,UAAA;AACJ,YAAA;AACC,cAAA;AACR,cAAA;AACvB,YAAA;AACF,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAIgD,IAAA;AAC2C,MAAA;AACpEA,QAAAA;AACZ,QAAA;AACoF,UAAA;AAC3C,YAAA;AACC,YAAA;AAC5B,YAAA;AACnB,UAAA;AAKoC,UAAA;AACI,YAAA;AACxB,cAAA;AAC4B,cAAA;AACzC,YAAA;AACH,UAAA;AAKoC,UAAA;AACG,YAAA;AACvB,cAAA;AAC4B,cAAA;AACzC,YAAA;AACH,UAAA;AACF,QAAA;AACD,MAAA;AACH,IAAA;AAEO,IAAA;AACT,EAAA;AAEO,EAAA;AACF,IAAA;AACH,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;AD0QmE;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/_work/revault/revault/packages/sdk/lib/engine.cjs","sourcesContent":[null,"import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type RouterOutputs, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  OnboardingOperationParams,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n  onScreenDisplayed,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n  onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  await onScreenDisplayed?.();\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n    __options: options,\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n\n            getWorkspacesForSso: async (): Promise<\n              RouterOutputs[\"auth\"][\"sso\"][\"findWorkspaces\"][\"workspaces\"]\n            > => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaces } = await client.auth.sso.findWorkspaces.query({ pubKey });\n              return workspaces;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (\n            wrappingKey: WrappingKeyResponse,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            await params?.onScreenDisplayed?.();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (\n            registerParams: RegisterOnboardingDeviceParams,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const { role, name } = registerParams;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n              onScreenDisplayed: params?.onScreenDisplayed,\n            });\n          },\n\n          reviewSharedOwner: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (\n            challenge: OnboardingSeedChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                challengeId: challenge.challengeId,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            if (challenge.challengeType === \"PSD\") {\n              const signature = await approveChallenge(challenge, params);\n              await params?.onPsdChallengeSigned?.();\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"PSD\", signature },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            if (challenge.challengeType === \"SOFT\") {\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"SOFT\" },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            throw new Error(\"Challenge type must be either PSD or SOFT\");\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n","import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: async (): Promise<string> => {\n      logger.info(`[device] generateSeedFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    generateWrappingKeyFragment: async (): Promise<string> => {\n      logger.info(`[device] generateWrappingKeyFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: async (): Promise<string> => {\n      logger.info(`[device] getDeviceUserId`);\n      const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n      return removeStatus(response).toString(\"hex\").toUpperCase();\n    },\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: async (params: {\n      secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n    }): Promise<void> => {\n      logger.info(`[device] openSession`);\n      const { secureChannel } = params;\n\n      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n      const dataDerivation = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n      const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n      const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n      const attestation = Buffer.concat([\n        Buffer.from([sigBuffer.length]),\n        sigBuffer,\n        attestationPubBuffer,\n        Buffer.from([certBuffer.length]),\n        certBuffer,\n      ]);\n\n      const lengthAttestation = Buffer.alloc(2);\n      lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n      );\n    },\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: async (params: {\n      handshake: string;\n      handshakeAttestation: HsmCertificate;\n      partitionId: string;\n    }): Promise<{ handshake: string; signature: string }> => {\n      logger.info(`[device] startKKPatternAsResponder`);\n      const data = buildAttestation(params);\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n      const buffer = removeStatus(bufWithStatus);\n      const dataLength = buffer.readInt8(0);\n      return {\n        handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n        signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n      };\n    },\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n"]}

package/lib/engine.js

@@ -5,6 +5,8 @@ import {
 } from "./chunk-AXI72NFY.js";
 import {
   APPID_VAULT_ADMINISTRATOR,
+  DisconnectedDevice,
+  LockedDeviceError,
   PAGINATED_STATUS,
   PATHS,
   SCRIPT_IDS,
@@ -15,13 +17,12 @@ import {
   createApiDevice,
   isTransportStatusError,
   withDevicePolling
-} from "./chunk-QWC3M2RL.js";
+} from "./chunk-PFZIW6UP.js";
 
 // src/engine/index.ts
 import invariant2 from "invariant";
 
 // src/device/real-device.ts
-import { DisconnectedDevice, LockedDeviceError } from "@ledgerhq/errors";
 import invariant from "invariant";
 import { from, lastValueFrom } from "rxjs";
 var MAX_CHUNK_LENGTH = 250;