@ledgerhq/revault-sdk 0.25.0 → 0.25.1

package/lib/engine.js

@@ -1,899 +1,842 @@
-import {
-  buildTrpcContext,
-  fetchAll,
-  fetchAllCursor
-} from "./chunk-AXI72NFY.js";
-import {
-  APPID_VAULT_ADMINISTRATOR,
-  DisconnectedDevice,
-  LockedDeviceError,
-  PAGINATED_STATUS,
-  PATHS,
-  SCRIPT_IDS,
-  STATUS_LENGTH,
-  STREAMING_NEXT_ACTION,
-  STREAMING_RESPONSE,
-  STR_ROLES,
-  createApiDevice,
-  isTransportStatusError,
-  withDevicePolling
-} from "./chunk-PFZIW6UP.js";
-
-// src/engine/index.ts
-import invariant2 from "invariant";
-
-// src/device/real-device.ts
+import { a as DisconnectedDevice, c as APPID_VAULT_ADMINISTRATOR, d as SCRIPT_IDS, f as STR_ROLES, i as withDevicePolling, l as PAGINATED_STATUS, n as isTransportStatusError, o as LockedDeviceError, s as createApiDevice, u as PATHS } from "./device-B8Fww8_6.js";
+import { i as fetchAllCursor, r as fetchAll, t as buildTrpcContext } from "./utils-BGbdjOP9.js";
 import invariant from "invariant";
 import { from, lastValueFrom } from "rxjs";
-var MAX_CHUNK_LENGTH = 250;
-var getPathFromPathString = (pathString) => {
-  const parts = pathString.split("'/").map((part) => Number.parseInt(part, 10));
-  return parts.map((part) => (part | 2147483648) >>> 0);
+import { createTRPCClient, httpLink } from "@trpc/client";
+import superjson from "superjson";
+//#region src/device/real-device.ts
+const MAX_CHUNK_LENGTH = 250;
+const getPathFromPathString = (pathString) => {
+	return pathString.split("'/").map((part) => Number.parseInt(part, 10)).map((part) => (part | 2147483648) >>> 0);
 };
-var splitChunks = (chunk, buffer) => {
-  const chunks = [];
-  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {
-    chunks.push(buffer.slice(i, i + size));
-  }
-  return chunks;
+const splitChunks = (chunk, buffer) => {
+	const chunks = [];
+	for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) chunks.push(buffer.slice(i, i + size));
+	return chunks;
 };
-var removeStatus = (result) => result.slice(0, result.length - STATUS_LENGTH);
-var sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH) => {
-  const chunks = splitChunks(chunkSize, data);
-  let response = Buffer.from([]);
-  for (let i = 0; i < chunks.length; i++) {
-    const chunk = chunks[i];
-    const apdu = [...command];
-    apdu[2] = i && 128;
-    response = await transport.send(apdu[0], apdu[1], apdu[2], apdu[3], chunk, [
-      36864,
-      ...PAGINATED_STATUS
-    ]);
-  }
-  return response;
+const removeStatus = (result) => result.slice(0, result.length - 2);
+const sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH) => {
+	const chunks = splitChunks(chunkSize, data);
+	let response = Buffer.from([]);
+	for (let i = 0; i < chunks.length; i++) {
+		const chunk = chunks[i];
+		const apdu = [...command];
+		/* v8 ignore next -- @preserve */
+		apdu[2] = i && 128;
+		response = await transport.send(apdu[0], apdu[1], apdu[2], apdu[3], chunk, [36864, ...PAGINATED_STATUS]);
+	}
+	return response;
 };
-var buildAttestation = (params) => {
-  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, "base64");
-  const sigLengthBuffer = Buffer.alloc(1);
-  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);
-  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, "base64");
-  const certLengthBuffer = Buffer.alloc(1);
-  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);
-  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, "base64");
-  const certChainData = Buffer.concat([
-    sigLengthBuffer,
-    sigBuffer,
-    pubBuffer,
-    certLengthBuffer,
-    certBuffer
-  ]);
-  const cliMsgBuffer = Buffer.from(params.handshake, "hex");
-  const cliMsgLengthBuffer = Buffer.alloc(1);
-  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);
-  const pidBuffer = Buffer.from(params.partitionId, "hex");
-  const pidLengthBuffer = Buffer.alloc(1);
-  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);
-  const certChainDataLengthBuff = Buffer.alloc(2);
-  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);
-  const data = Buffer.concat([
-    cliMsgLengthBuffer,
-    cliMsgBuffer,
-    certChainDataLengthBuff,
-    certChainData,
-    pidLengthBuffer,
-    pidBuffer
-  ]);
-  const totalLengthBuffer = Buffer.alloc(2);
-  totalLengthBuffer.writeUInt16BE(data.length, 0);
-  const toSend = Buffer.concat([totalLengthBuffer, data]);
-  return toSend;
+const buildAttestation = (params) => {
+	const sigBuffer = Buffer.from(params.handshakeAttestation.signature, "base64");
+	const sigLengthBuffer = Buffer.alloc(1);
+	sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);
+	const certBuffer = Buffer.from(params.handshakeAttestation.certificate, "base64");
+	const certLengthBuffer = Buffer.alloc(1);
+	certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);
+	const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, "base64");
+	const certChainData = Buffer.concat([
+		sigLengthBuffer,
+		sigBuffer,
+		pubBuffer,
+		certLengthBuffer,
+		certBuffer
+	]);
+	const cliMsgBuffer = Buffer.from(params.handshake, "hex");
+	const cliMsgLengthBuffer = Buffer.alloc(1);
+	cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);
+	const pidBuffer = Buffer.from(params.partitionId, "hex");
+	const pidLengthBuffer = Buffer.alloc(1);
+	pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);
+	const certChainDataLengthBuff = Buffer.alloc(2);
+	certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);
+	const data = Buffer.concat([
+		cliMsgLengthBuffer,
+		cliMsgBuffer,
+		certChainDataLengthBuff,
+		certChainData,
+		pidLengthBuffer,
+		pidBuffer
+	]);
+	const totalLengthBuffer = Buffer.alloc(2);
+	totalLengthBuffer.writeUInt16BE(data.length, 0);
+	return Buffer.concat([totalLengthBuffer, data]);
 };
-var genericRetryOnError = (err) => {
-  if (err instanceof LockedDeviceError) return true;
-  if (isTransportStatusError(err) && err.statusCode === 27913) return true;
-  if (err instanceof DisconnectedDevice) return true;
-  return false;
+/* v8 ignore next -- @preserve */
+const genericRetryOnError = (err) => {
+	if (err instanceof LockedDeviceError) return true;
+	if (isTransportStatusError(err) && err.statusCode === 27913) return true;
+	if (err instanceof DisconnectedDevice) return true;
+	return false;
 };
 function createRealDevice(options, logger) {
-  const { transportId } = options;
-  async function run(job, retryOnError = genericRetryOnError) {
-    return lastValueFrom(
-      withDevicePolling(transportId)((transport) => from(job(transport)), retryOnError)
-    );
-  }
-  const noRetry = () => false;
-  const alwaysRetry = () => true;
-  const poll = async (opts = {}) => {
-    await run(
-      // eslint-disable-next-line  @typescript-eslint/no-empty-function
-      async (_transport) => {
-      },
-      opts.retryOnError ?? alwaysRetry
-    );
-    try {
-      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });
-      return { isAppOpened: true };
-    } catch (err) {
-      if (isTransportStatusError(err) && genericRetryOnError(err)) {
-        return { isAppOpened: false };
-      }
-      throw err;
-    }
-  };
-  const pollApp = async (appName) => {
-    const res = await run(
-      (transport) => transport.send(224, 216, 0, 0, Buffer.from(appName, "utf8"))
-    );
-    await new Promise((r) => setTimeout(r, 1e3));
-    return res.toString("hex");
-  };
-  const getPublicKey = async (pathString, { secp256k1, retryOnError }) => {
-    logger.info(`[device] getPublicKey (${pathString})`);
-    const path = getPathFromPathString(pathString);
-    const data = Buffer.concat([
-      Buffer.from([path.length]),
-      ...path.map((derivation) => {
-        const buf = Buffer.alloc(4);
-        buf.writeUInt32BE(derivation, 0);
-        return buf;
-      })
-    ]);
-    const curve = secp256k1 ? 1 : 2;
-    const response = await run(
-      (transport) => transport.send(224, 64, curve, 0, data),
-      retryOnError ?? genericRetryOnError
-    );
-    const pubKeyLength = response.readInt8(0);
-    const pubKey = response.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
-    const signature = response.slice(pubKeyLength + 1, response.length - STATUS_LENGTH).toString("base64");
-    return { pubKey, signature };
-  };
-  const device = {
-    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {
-      logger.info(`[device] Authenticate`);
-      invariant(role !== "READ_ONLY_API_KEY", "Invalid role for authenticate: READ_ONLY_API_KEY");
-      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, "hex");
-      const nameBuffer = Buffer.from(name);
-      const workspaceBuffer = Buffer.from(workspaceName);
-      const keyHandleData = Buffer.concat([
-        Buffer.from(STR_ROLES[role], "hex"),
-        Buffer.from([nameBuffer.length]),
-        nameBuffer,
-        Buffer.from([workspaceBuffer.length]),
-        workspaceBuffer
-      ]);
-      const keyHandleDataLength = Buffer.alloc(2);
-      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);
-      const data = Buffer.concat([
-        Buffer.from(challenge, "base64"),
-        applicationBuffer,
-        Buffer.from([keyHandle.length]),
-        Buffer.from(keyHandle, "hex"),
-        keyHandleDataLength,
-        keyHandleData
-      ]);
-      const authentication = await run(
-        (transport) => sendByChunk(transport, [224, 2, 0, 0], data)
-      );
-      return removeStatus(authentication).toString("hex");
-    },
-    finalizePairingHandshake: async (params) => {
-      const bufWithStatus = await run(
-        (transport) => sendByChunk(transport, [224, 71, 0, 2], buildAttestation(params))
-      );
-      return removeStatus(bufWithStatus).toString("hex");
-    },
-    generateSeedFragment: async () => {
-      logger.info(`[device] generateSeedFragment`);
-      const path = getPathFromPathString(PATHS.KEY_MATERIAL);
-      const data = Buffer.concat([
-        Buffer.from([path.length]),
-        ...path.map((derivation) => {
-          const buf = Buffer.alloc(4);
-          buf.writeUInt32BE(derivation, 0);
-          return buf;
-        })
-      ]);
-      const response = await run((transport) => transport.send(224, 68, 0, 0, data));
-      return removeStatus(response).toString("base64");
-    },
-    generateWrappingKeyFragment: async () => {
-      logger.info(`[device] generateWrappingKeyFragment`);
-      const path = getPathFromPathString(PATHS.KEY_MATERIAL);
-      const data = Buffer.concat([
-        Buffer.from([path.length]),
-        ...path.map((derivation) => {
-          const buf = Buffer.alloc(4);
-          buf.writeUInt32BE(derivation, 0);
-          return buf;
-        })
-      ]);
-      const response = await run((transport) => transport.send(224, 68, 1, 0, data));
-      return removeStatus(response).toString("base64");
-    },
-    getAttestation: async () => {
-      const bufWithStatus = await run((transport) => transport.send(224, 65, 0, 0));
-      const buffer = removeStatus(bufWithStatus);
-      const certLen = buffer.readInt8(32 + 65 + 1);
-      return {
-        attestation: {
-          codeHash: buffer.slice(0, 32).toString("base64"),
-          attestationPub: buffer.slice(32, 32 + 65).toString("base64"),
-          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString("base64")
-        },
-        buffer
-      };
-    },
-    getConfidentialityKey: async () => {
-      logger.info(`[device] getConfidentialityKey`);
-      const bufWithStatus = await run((transport) => transport.send(224, 77, 0, 0));
-      const buf = removeStatus(bufWithStatus);
-      const keyLength = buf[0];
-      const key = buf.slice(1, 1 + keyLength);
-      const sig = buf.slice(1 + keyLength + 1);
-      return {
-        confidentialityKeyCurve25519: key.toString("hex"),
-        confidentialityKeySignature: sig.toString("hex")
-      };
-    },
-    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),
-    getDeviceUserId: async () => {
-      logger.info(`[device] getDeviceUserId`);
-      const response = await run((transport) => transport.send(224, 82, 0, 0));
-      return removeStatus(response).toString("hex").toUpperCase();
-    },
-    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),
-    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),
-    hasPairing: async () => {
-      logger.info(`[device] hasPairing`);
-      const apdu = [224, 81, 0, 0, 181];
-      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));
-      const hex = Buffer.from(res).toString("hex");
-      return hex !== "6f45" && hex !== "6a87";
-    },
-    initPairingHandshake: async () => {
-      const res = await run((transport) => transport.send(224, 70, 0, 0));
-      const pubKeyLength = res.readInt8(0);
-      const pubKey = res.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
-      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString("base64");
-      return { pubKey, signature };
-    },
-    openSession: async (params) => {
-      logger.info(`[device] openSession`);
-      const { secureChannel } = params;
-      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);
-      const dataDerivation = Buffer.concat([
-        Buffer.from([path.length]),
-        ...path.map((derivation) => {
-          const buf = Buffer.alloc(4);
-          buf.writeUInt32BE(derivation, 0);
-          return buf;
-        })
-      ]);
-      const pubKey = Buffer.from(secureChannel.pubKey, "hex");
-      const sigBuffer = Buffer.from(secureChannel.certificate.signature, "base64");
-      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, "base64");
-      const certBuffer = Buffer.from(secureChannel.certificate.certificate, "base64");
-      const attestation = Buffer.concat([
-        Buffer.from([sigBuffer.length]),
-        sigBuffer,
-        attestationPubBuffer,
-        Buffer.from([certBuffer.length]),
-        certBuffer
-      ]);
-      const lengthAttestation = Buffer.alloc(2);
-      lengthAttestation.writeUInt16BE(attestation.length, 0);
-      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);
-      await run(
-        (transport) => sendByChunk(transport, [224, 66, 0, SCRIPT_IDS.INIT_SESSION], data)
-      );
-    },
-    register: async (params) => {
-      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;
-      const challenge = Buffer.from(strChallenge, "hex");
-      invariant(challenge.length === 32, "challenge hex is expected to have 32 bytes");
-      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, "hex");
-      invariant(applicationBuf.length === 32, "application hex is expected to have 32 bytes");
-      const userNameBuff = Buffer.from(name);
-      const keyHandleData = Buffer.concat([
-        Buffer.from(STR_ROLES[role], "hex"),
-        Buffer.from([userNameBuff.length]),
-        userNameBuff
-      ]);
-      const keyHandleDataLength = Buffer.alloc(2);
-      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);
-      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);
-      const response = await run(
-        (transport) => sendByChunk(transport, [224, 1, 0, 0], data)
-      );
-      let i = 0;
-      const rfu = response.slice(i, i + 1)[0];
-      i += 1;
-      const pubKey = response.slice(i, i + 65).toString("hex");
-      i += 65;
-      const keyHandleLength = response.slice(i, i + 1)[0];
-      i++;
-      const keyHandle = response.slice(i, i + keyHandleLength);
-      i += keyHandleLength;
-      return {
-        u2fRegister: removeStatus(response),
-        keyHandle,
-        rfu,
-        pubKey
-      };
-    },
-    registerData: async (params) => {
-      const { challenge: strChallenge } = params;
-      const challenge = Buffer.from(strChallenge, "hex");
-      invariant(challenge.length === 32, "challenge hex is expected to have 32 bytes");
-      const response = await run((transport) => transport.send(224, 3, 0, 0, challenge));
-      return removeStatus(response).toString("hex");
-    },
-    setPairing: async ({ pairing }) => {
-      logger.info(`[device] setPairing`);
-      const psdPayload = Buffer.from(pairing.blob, "base64");
-      const length = Buffer.alloc(2);
-      length.writeUInt16BE(psdPayload.length, 0);
-      const final = Buffer.concat([length, psdPayload]);
-      await run((transport) => sendByChunk(transport, [224, 78, 0, 0], final));
-    },
-    startKKPatternAsResponder: async (params) => {
-      logger.info(`[device] startKKPatternAsResponder`);
-      const data = buildAttestation(params);
-      const bufWithStatus = await run(
-        (transport) => sendByChunk(transport, [224, 76, 0, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
-      );
-      const buffer = removeStatus(bufWithStatus);
-      const dataLength = buffer.readInt8(0);
-      return {
-        handshake: buffer.slice(1, dataLength + 1).toString("base64"),
-        signature: buffer.slice(dataLength + 1).toString("base64")
-      };
-    },
-    startKPatternAsResponder: async (params) => {
-      logger.info(`[device] startKPatternAsResponder`);
-      const data = buildAttestation(params);
-      await run(
-        (transport) => sendByChunk(transport, [224, 73, 0, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
-      );
-    },
-    validateVaultOperation: async (params) => {
-      logger.info(`[device] validateVaultOperation`);
-      const path = getPathFromPathString(PATHS.VALIDATION);
-      const paths = Buffer.concat([
-        Buffer.from([path.length]),
-        ...path.map((derivation) => {
-          const buf = Buffer.alloc(4);
-          buf.writeUInt32BE(derivation, 0);
-          return buf;
-        })
-      ]);
-      let nextActionId = 1;
-      let finalResponse = null;
-      while (!finalResponse) {
-        const screen = Buffer.from(params.actions[nextActionId - 1], "base64");
-        const length = Buffer.alloc(2);
-        length.writeUInt16BE(screen.length, 0);
-        const data = Buffer.concat([paths, length, screen]);
-        const response = await run(
-          (transport) => sendByChunk(transport, [224, 69, 0, 0], data)
-        );
-        const responseType = response.readInt8(0);
-        let responseStatus = response.readUInt16BE(response.length - 2);
-        switch (responseType) {
-          case STREAMING_NEXT_ACTION:
-            nextActionId = response.readUIntBE(1, 2);
-            break;
-          case STREAMING_RESPONSE:
-            finalResponse = response.slice(3, response.length - 2);
-            while (responseStatus !== 36864) {
-              {
-                const resp = await run((transport) => transport.send(0, 192, 0, 0));
-                responseStatus = resp.readUInt16BE(resp.length - 2);
-                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);
-              }
-            }
-            break;
-          /* v8 ignore next -- @preserve */
-          default:
-            throw new Error(`Invalid response type: ${responseType}`);
-        }
-      }
-      return finalResponse.toString("base64");
-    },
-    sendAPDU: async (apduCommand) => {
-      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, "hex")));
-      return Buffer.from(res).toString("hex");
-    },
-    getVersion: async () => {
-      const res = await run((transport) => transport.send(176, 1, 0, 0));
-      const appNameLen = res.readInt8(1);
-      const appVersionLen = res.readInt8(2 + appNameLen);
-      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);
-      const appVersion = Buffer.from(appVersionHex).toString();
-      return appVersion;
-    },
-    poll,
-    pollApp
-  };
-  return device;
+	const { transportId } = options;
+	async function run(job, retryOnError = genericRetryOnError) {
+		return lastValueFrom(withDevicePolling(transportId)((transport) => from(job(transport)), retryOnError));
+	}
+	/* v8 ignore next -- @preserve */
+	const noRetry = () => false;
+	/* v8 ignore next -- @preserve */
+	const alwaysRetry = () => true;
+	const poll = async (opts = {}) => {
+		await run(async (_transport) => {}, opts.retryOnError ?? alwaysRetry);
+		try {
+			await getPublicKey(PATHS.U2F, {
+				secp256k1: true,
+				retryOnError: noRetry
+			});
+			return { isAppOpened: true };
+		} catch (err) {
+			if (isTransportStatusError(err) && genericRetryOnError(err)) return { isAppOpened: false };
+			throw err;
+		}
+	};
+	const pollApp = async (appName) => {
+		const res = await run((transport) => transport.send(224, 216, 0, 0, Buffer.from(appName, "utf8")));
+		await new Promise((r) => setTimeout(r, 1e3));
+		return res.toString("hex");
+	};
+	const getPublicKey = async (pathString, { secp256k1, retryOnError }) => {
+		logger.info(`[device] getPublicKey (${pathString})`);
+		const path = getPathFromPathString(pathString);
+		const data = Buffer.concat([Buffer.from([path.length]), ...path.map((derivation) => {
+			const buf = Buffer.alloc(4);
+			buf.writeUInt32BE(derivation, 0);
+			return buf;
+		})]);
+		const curve = secp256k1 ? 1 : 2;
+		const response = await run((transport) => transport.send(224, 64, curve, 0, data), retryOnError ?? genericRetryOnError);
+		const pubKeyLength = response.readInt8(0);
+		return {
+			pubKey: response.slice(1, pubKeyLength + 1).toString("hex").toUpperCase(),
+			signature: response.slice(pubKeyLength + 1, response.length - 2).toString("base64")
+		};
+	};
+	return {
+		authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {
+			logger.info(`[device] Authenticate`);
+			invariant(role !== "READ_ONLY_API_KEY", "Invalid role for authenticate: READ_ONLY_API_KEY");
+			const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, "hex");
+			const nameBuffer = Buffer.from(name);
+			const workspaceBuffer = Buffer.from(workspaceName);
+			const keyHandleData = Buffer.concat([
+				Buffer.from(STR_ROLES[role], "hex"),
+				Buffer.from([nameBuffer.length]),
+				nameBuffer,
+				Buffer.from([workspaceBuffer.length]),
+				workspaceBuffer
+			]);
+			const keyHandleDataLength = Buffer.alloc(2);
+			keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);
+			const data = Buffer.concat([
+				Buffer.from(challenge, "base64"),
+				applicationBuffer,
+				Buffer.from([keyHandle.length]),
+				Buffer.from(keyHandle, "hex"),
+				keyHandleDataLength,
+				keyHandleData
+			]);
+			return removeStatus(await run((transport) => sendByChunk(transport, [
+				224,
+				2,
+				0,
+				0
+			], data))).toString("hex");
+		},
+		finalizePairingHandshake: async (params) => {
+			return removeStatus(await run((transport) => sendByChunk(transport, [
+				224,
+				71,
+				0,
+				2
+			], buildAttestation(params)))).toString("hex");
+		},
+		generateSeedFragment: async () => {
+			logger.info(`[device] generateSeedFragment`);
+			const path = getPathFromPathString(PATHS.KEY_MATERIAL);
+			const data = Buffer.concat([Buffer.from([path.length]), ...path.map((derivation) => {
+				const buf = Buffer.alloc(4);
+				buf.writeUInt32BE(derivation, 0);
+				return buf;
+			})]);
+			return removeStatus(await run((transport) => transport.send(224, 68, 0, 0, data))).toString("base64");
+		},
+		generateWrappingKeyFragment: async () => {
+			logger.info(`[device] generateWrappingKeyFragment`);
+			const path = getPathFromPathString(PATHS.KEY_MATERIAL);
+			const data = Buffer.concat([Buffer.from([path.length]), ...path.map((derivation) => {
+				const buf = Buffer.alloc(4);
+				buf.writeUInt32BE(derivation, 0);
+				return buf;
+			})]);
+			return removeStatus(await run((transport) => transport.send(224, 68, 1, 0, data))).toString("base64");
+		},
+		getAttestation: async () => {
+			const buffer = removeStatus(await run((transport) => transport.send(224, 65, 0, 0)));
+			const certLen = buffer.readInt8(98);
+			return {
+				attestation: {
+					codeHash: buffer.slice(0, 32).toString("base64"),
+					attestationPub: buffer.slice(32, 97).toString("base64"),
+					certificate: buffer.slice(97, 99 + certLen).toString("base64")
+				},
+				buffer
+			};
+		},
+		getConfidentialityKey: async () => {
+			logger.info(`[device] getConfidentialityKey`);
+			const buf = removeStatus(await run((transport) => transport.send(224, 77, 0, 0)));
+			const keyLength = buf[0];
+			const key = buf.slice(1, 1 + keyLength);
+			const sig = buf.slice(1 + keyLength + 1);
+			return {
+				confidentialityKeyCurve25519: key.toString("hex"),
+				confidentialityKeySignature: sig.toString("hex")
+			};
+		},
+		getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),
+		getDeviceUserId: async () => {
+			logger.info(`[device] getDeviceUserId`);
+			return removeStatus(await run((transport) => transport.send(224, 82, 0, 0))).toString("hex").toUpperCase();
+		},
+		getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),
+		getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),
+		hasPairing: async () => {
+			logger.info(`[device] hasPairing`);
+			const apdu = [
+				224,
+				81,
+				0,
+				0,
+				181
+			];
+			const res = await run((transport) => transport.exchange(Buffer.from(apdu)));
+			const hex = Buffer.from(res).toString("hex");
+			return hex !== "6f45" && hex !== "6a87";
+		},
+		initPairingHandshake: async () => {
+			const res = await run((transport) => transport.send(224, 70, 0, 0));
+			const pubKeyLength = res.readInt8(0);
+			return {
+				pubKey: res.slice(1, pubKeyLength + 1).toString("hex").toUpperCase(),
+				signature: res.slice(pubKeyLength + 1, res.length - 2).toString("base64")
+			};
+		},
+		openSession: async (params) => {
+			logger.info(`[device] openSession`);
+			const { secureChannel } = params;
+			const path = getPathFromPathString(PATHS.CONFIDENTIALITY);
+			const dataDerivation = Buffer.concat([Buffer.from([path.length]), ...path.map((derivation) => {
+				const buf = Buffer.alloc(4);
+				buf.writeUInt32BE(derivation, 0);
+				return buf;
+			})]);
+			const pubKey = Buffer.from(secureChannel.pubKey, "hex");
+			const sigBuffer = Buffer.from(secureChannel.certificate.signature, "base64");
+			const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, "base64");
+			const certBuffer = Buffer.from(secureChannel.certificate.certificate, "base64");
+			const attestation = Buffer.concat([
+				Buffer.from([sigBuffer.length]),
+				sigBuffer,
+				attestationPubBuffer,
+				Buffer.from([certBuffer.length]),
+				certBuffer
+			]);
+			const lengthAttestation = Buffer.alloc(2);
+			lengthAttestation.writeUInt16BE(attestation.length, 0);
+			const data = Buffer.concat([
+				dataDerivation,
+				pubKey,
+				lengthAttestation,
+				attestation
+			]);
+			await run((transport) => sendByChunk(transport, [
+				224,
+				66,
+				0,
+				SCRIPT_IDS.INIT_SESSION
+			], data));
+		},
+		register: async (params) => {
+			const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;
+			const challenge = Buffer.from(strChallenge, "hex");
+			invariant(challenge.length === 32, "challenge hex is expected to have 32 bytes");
+			const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, "hex");
+			invariant(applicationBuf.length === 32, "application hex is expected to have 32 bytes");
+			const userNameBuff = Buffer.from(name);
+			const keyHandleData = Buffer.concat([
+				Buffer.from(STR_ROLES[role], "hex"),
+				Buffer.from([userNameBuff.length]),
+				userNameBuff
+			]);
+			const keyHandleDataLength = Buffer.alloc(2);
+			keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);
+			const data = Buffer.concat([
+				challenge,
+				applicationBuf,
+				keyHandleDataLength,
+				keyHandleData
+			]);
+			const response = await run((transport) => sendByChunk(transport, [
+				224,
+				1,
+				0,
+				0
+			], data));
+			let i = 0;
+			const rfu = response.slice(i, i + 1)[0];
+			i += 1;
+			const pubKey = response.slice(i, i + 65).toString("hex");
+			i += 65;
+			const keyHandleLength = response.slice(i, i + 1)[0];
+			i++;
+			const keyHandle = response.slice(i, i + keyHandleLength);
+			i += keyHandleLength;
+			return {
+				u2fRegister: removeStatus(response),
+				keyHandle,
+				rfu,
+				pubKey
+			};
+		},
+		registerData: async (params) => {
+			const { challenge: strChallenge } = params;
+			const challenge = Buffer.from(strChallenge, "hex");
+			invariant(challenge.length === 32, "challenge hex is expected to have 32 bytes");
+			return removeStatus(await run((transport) => transport.send(224, 3, 0, 0, challenge))).toString("hex");
+		},
+		setPairing: async ({ pairing }) => {
+			logger.info(`[device] setPairing`);
+			const psdPayload = Buffer.from(pairing.blob, "base64");
+			const length = Buffer.alloc(2);
+			length.writeUInt16BE(psdPayload.length, 0);
+			const final = Buffer.concat([length, psdPayload]);
+			await run((transport) => sendByChunk(transport, [
+				224,
+				78,
+				0,
+				0
+			], final));
+		},
+		startKKPatternAsResponder: async (params) => {
+			logger.info(`[device] startKKPatternAsResponder`);
+			const data = buildAttestation(params);
+			const buffer = removeStatus(await run((transport) => sendByChunk(transport, [
+				224,
+				76,
+				0,
+				SCRIPT_IDS.ACCOUNT_MANAGER_SESSION
+			], data)));
+			const dataLength = buffer.readInt8(0);
+			return {
+				handshake: buffer.slice(1, dataLength + 1).toString("base64"),
+				signature: buffer.slice(dataLength + 1).toString("base64")
+			};
+		},
+		startKPatternAsResponder: async (params) => {
+			logger.info(`[device] startKPatternAsResponder`);
+			const data = buildAttestation(params);
+			await run((transport) => sendByChunk(transport, [
+				224,
+				73,
+				0,
+				SCRIPT_IDS.ACCOUNT_MANAGER_SESSION
+			], data));
+		},
+		validateVaultOperation: async (params) => {
+			logger.info(`[device] validateVaultOperation`);
+			const path = getPathFromPathString(PATHS.VALIDATION);
+			const paths = Buffer.concat([Buffer.from([path.length]), ...path.map((derivation) => {
+				const buf = Buffer.alloc(4);
+				buf.writeUInt32BE(derivation, 0);
+				return buf;
+			})]);
+			let nextActionId = 1;
+			let finalResponse = null;
+			while (!finalResponse) {
+				const screen = Buffer.from(params.actions[nextActionId - 1], "base64");
+				const length = Buffer.alloc(2);
+				length.writeUInt16BE(screen.length, 0);
+				const data = Buffer.concat([
+					paths,
+					length,
+					screen
+				]);
+				const response = await run((transport) => sendByChunk(transport, [
+					224,
+					69,
+					0,
+					0
+				], data));
+				const responseType = response.readInt8(0);
+				let responseStatus = response.readUInt16BE(response.length - 2);
+				switch (responseType) {
+					case 1:
+						nextActionId = response.readUIntBE(1, 2);
+						break;
+					case 2:
+						finalResponse = response.slice(3, response.length - 2);
+						while (responseStatus !== 36864) {
+							const resp = await run((transport) => transport.send(0, 192, 0, 0));
+							responseStatus = resp.readUInt16BE(resp.length - 2);
+							finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);
+						}
+						break;
+					default: throw new Error(`Invalid response type: ${responseType}`);
+				}
+			}
+			return finalResponse.toString("base64");
+		},
+		sendAPDU: async (apduCommand) => {
+			const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, "hex")));
+			return Buffer.from(res).toString("hex");
+		},
+		getVersion: async () => {
+			const res = await run((transport) => transport.send(176, 1, 0, 0));
+			const appNameLen = res.readInt8(1);
+			const appVersionLen = res.readInt8(2 + appNameLen);
+			const appVersionHex = res.slice(3 + appNameLen, 2 + appNameLen + appVersionLen + 1);
+			return Buffer.from(appVersionHex).toString();
+		},
+		poll,
+		pollApp
+	};
 }
-
-// src/trpc.ts
-import { createTRPCClient, httpLink } from "@trpc/client";
-import superjson from "superjson";
-var createClient = (options) => {
-  const trpc = createTRPCClient({
-    links: [
-      httpLink({
-        url: `${options.baseUrl}/trpc`,
-        transformer: superjson,
-        headers(opts) {
-          const contextHeaders = opts.op.context?.headers || {};
-          return {
-            ...options.debugAuthToken ? { "x-revault-debug-auth-token": options.debugAuthToken } : {},
-            ...options.rootAuthToken ? { "x-revault-root-auth-token": options.rootAuthToken } : {},
-            ...options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {},
-            ...options.apiAccessToken ? { Authorization: `Bearer ${options.apiAccessToken}` } : {},
-            // Merge in any headers passed via context
-            ...contextHeaders
-          };
-        }
-      })
-    ]
-  });
-  return trpc;
+//#endregion
+//#region src/trpc.ts
+const createClient = (options) => {
+	return createTRPCClient({ links: [httpLink({
+		url: `${options.baseUrl}/trpc`,
+		transformer: superjson,
+		headers(opts) {
+			const contextHeaders = opts.op.context?.headers || {};
+			return {
+				...options.debugAuthToken ? { "x-revault-debug-auth-token": options.debugAuthToken } : {},
+				...options.rootAuthToken ? { "x-revault-root-auth-token": options.rootAuthToken } : {},
+				...options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {},
+				...options.apiAccessToken ? { Authorization: `Bearer ${options.apiAccessToken}` } : {},
+				...contextHeaders
+			};
+		}
+	})] });
 };
-
-// src/engine/index.ts
-async function genericRegister({
-  device,
-  name,
-  role,
-  getChallenge,
-  submitChallenge,
-  onScreenDisplayed
-}) {
-  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
-    device.getAttestation(),
-    device.getU2FPubKey(),
-    device.getConfidentialityPubKey()
-  ]);
-  const ephemeralPubKey = await device.initPairingHandshake();
-  const deviceData = {
-    name,
-    pubKey: u2fPubKey.pubKey,
-    psdModel: "STAX",
-    confidentialityKey: confidentialityKey.pubKey,
-    psdEphemeralKey: ephemeralPubKey.pubKey,
-    psdEphemeralKeyAttestation: {
-      ...attestation.attestation,
-      signature: ephemeralPubKey.signature
-    }
-  };
-  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });
-  const pairingPayload = await device.finalizePairingHandshake({
-    handshake: challenge.handshake,
-    partitionId: challenge.ciphertext,
-    handshakeAttestation: challenge.handshakeAttestation
-  });
-  await onScreenDisplayed?.();
-  const register = await device.register({
-    challenge: challenge.challenge,
-    u2fRegisterData: challenge.u2fRegisterData,
-    name,
-    role
-  });
-  const validationPubKey = await device.getValidationPubKey();
-  const registerData = await device.registerData({ challenge: challenge.challenge });
-  const attestationOffset = 67 + register.u2fRegister.readInt8(66);
-  const u2fRegister = Buffer.concat([
-    register.u2fRegister.slice(0, attestationOffset),
-    Buffer.from([attestation.buffer.length]),
-    attestation.buffer,
-    register.u2fRegister.slice(attestationOffset)
-  ]).toString("hex");
-  const challengeResponse = {
-    registerData,
-    certificate: {
-      ...attestation.attestation,
-      signature: validationPubKey.signature
-    },
-    u2fRegister,
-    u2fKeyHandle: register.keyHandle.toString("hex"),
-    validationKey: validationPubKey.pubKey,
-    pairingPayload
-  };
-  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });
+//#endregion
+//#region src/engine/index.ts
+async function genericRegister({ device, name, role, getChallenge, submitChallenge, onScreenDisplayed }) {
+	const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
+		device.getAttestation(),
+		device.getU2FPubKey(),
+		device.getConfidentialityPubKey()
+	]);
+	const ephemeralPubKey = await device.initPairingHandshake();
+	const deviceData = {
+		name,
+		pubKey: u2fPubKey.pubKey,
+		psdModel: "STAX",
+		confidentialityKey: confidentialityKey.pubKey,
+		psdEphemeralKey: ephemeralPubKey.pubKey,
+		psdEphemeralKeyAttestation: {
+			...attestation.attestation,
+			signature: ephemeralPubKey.signature
+		}
+	};
+	const challenge = await getChallenge({
+		pubKey: u2fPubKey.pubKey,
+		deviceData
+	});
+	const pairingPayload = await device.finalizePairingHandshake({
+		handshake: challenge.handshake,
+		partitionId: challenge.ciphertext,
+		handshakeAttestation: challenge.handshakeAttestation
+	});
+	await onScreenDisplayed?.();
+	const register = await device.register({
+		challenge: challenge.challenge,
+		u2fRegisterData: challenge.u2fRegisterData,
+		name,
+		role
+	});
+	const validationPubKey = await device.getValidationPubKey();
+	const registerData = await device.registerData({ challenge: challenge.challenge });
+	const attestationOffset = 67 + register.u2fRegister.readInt8(66);
+	const u2fRegister = Buffer.concat([
+		register.u2fRegister.slice(0, attestationOffset),
+		Buffer.from([attestation.buffer.length]),
+		attestation.buffer,
+		register.u2fRegister.slice(attestationOffset)
+	]).toString("hex");
+	const challengeResponse = {
+		registerData,
+		certificate: {
+			...attestation.attestation,
+			signature: validationPubKey.signature
+		},
+		u2fRegister,
+		u2fKeyHandle: register.keyHandle.toString("hex"),
+		validationKey: validationPubKey.pubKey,
+		pairingPayload
+	};
+	return submitChallenge({
+		pubKey: u2fPubKey.pubKey,
+		challengeResponse
+	});
 }
 function createEngine(options, logger) {
-  const clientOptions = {
-    baseUrl: options.baseUrl
-  };
-  const client = createClient(clientOptions);
-  const apiDevice = createApiDevice(options, logger);
-  const base = {
-    client,
-    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),
-    __options: options
-  };
-  const withDeviceIndex = function(deviceIndex) {
-    const device = apiDevice.with(deviceIndex);
-    const withPsd = { device };
-    return decorateEngine({ ...this, ...withPsd });
-  };
-  const withTransportId = function(transportId) {
-    const device = createRealDevice({ transportId }, logger);
-    const withPsd = { device };
-    return decorateEngine({ ...this, ...withPsd });
-  };
-  const withApiUser = function() {
-    const withApiUser2 = { __isApiUser: true };
-    return decorateEngine({ ...this, ...withApiUser2 });
-  };
-  const withWorkspace = function(workspaceName) {
-    const withWorkspace2 = { __workspaceName: workspaceName };
-    return decorateEngine({ ...this, ...withWorkspace2 });
-  };
-  const withOnboarding = function(onboardingId) {
-    const withOnboarding2 = { __onboardingId: onboardingId };
-    return decorateEngine({ ...this, ...withOnboarding2 });
-  };
-  function decorateEngine(engine) {
-    function decorate(decorator) {
-      Object.assign(engine, decorator(engine));
-    }
-    if (engine.device) {
-      decorate(
-        (engine2) => ({
-          getWorkspaces: async () => {
-            const { device, client: client2 } = engine2;
-            const { pubKey } = await device.getU2FPubKey();
-            const { workspaceNames } = await client2.auth.psd.findWorkspaceNames.query({ pubKey });
-            return workspaceNames;
-          },
-          getWorkspacesForSso: async () => {
-            const { device, client: client2 } = engine2;
-            const { pubKey } = await device.getU2FPubKey();
-            const { workspaces } = await client2.auth.sso.findWorkspaces.query({ pubKey });
-            return workspaces;
-          }
-        })
-      );
-    }
-    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {
-      decorate((engine2) => {
-        const { __workspaceName } = engine2;
-        return {
-          withPsdToken: function(token) {
-            const withPsdAuth = { __psdToken: token };
-            const psdAuth = `${__workspaceName}:${token}`;
-            const client2 = engine2.createClient({ psdAuth });
-            return decorateEngine({ ...this, client: client2, ...withPsdAuth });
-          }
-        };
-      });
-    }
-    if (engine.device && engine.__onboardingId) {
-      decorate((engine2) => {
-        const { device, client: client2, __onboardingId } = engine2;
-        async function enforcePairing() {
-          if (await device.hasPairing()) return;
-          const [{ pubKey }, confidentialityKey] = await Promise.all([
-            device.getU2FPubKey(),
-            device.getConfidentialityKey()
-          ]);
-          const pairing = await client2.onboarding.pairDevicePartition.mutate({
-            pubKey,
-            onboardingId: __onboardingId,
-            data: {
-              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
-              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-            }
-          });
-          await device.setPairing({ pairing });
-        }
-        return {
-          claimDevice: async (params) => {
-            const { role, deviceName } = params;
-            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([
-              device.getU2FPubKey(),
-              device.getConfidentialityPubKey()
-            ]);
-            await client2.onboarding.claimDevice.mutate({
-              onboardingId: __onboardingId,
-              claim: { role, pubKey, deviceName, confidentialityKey }
-            });
-          },
-          collectWrappingKeyFragment: async (wrappingKey, params) => {
-            const [{ pubKey }, confidentialityKey] = await Promise.all([
-              device.getU2FPubKey(),
-              device.getConfidentialityPubKey()
-            ]);
-            await device.openSession({
-              secureChannel: {
-                pubKey: wrappingKey.ephemeralPubKey,
-                certificate: wrappingKey.ephemeralCertificate
-              }
-            });
-            const { attestation } = await device.getAttestation();
-            await params?.onScreenDisplayed?.();
-            const blob = await device.generateWrappingKeyFragment();
-            await client2.onboarding.submitWrappingKeyFragment.mutate({
-              pubKey,
-              onboardingId: __onboardingId,
-              fragment: {
-                blob,
-                ephemeralPubKey: confidentialityKey.pubKey,
-                ephemeralCertificate: {
-                  ...attestation,
-                  signature: confidentialityKey.signature
-                }
-              }
-            });
-          },
-          registerDevice: async (registerParams, params) => {
-            const { role, name } = registerParams;
-            const getChallengeMutation = role === "ADMIN" ? client2.onboarding.generateMasterAdminRegistrationChallenge : client2.onboarding.generateSharedOwnerRegistrationChallenge;
-            const submitChallengeMutation = role === "ADMIN" ? client2.onboarding.submitMasterAdminRegistration : client2.onboarding.submitSharedOwnerRegistration;
-            await genericRegister({
-              device,
-              name,
-              role,
-              getChallenge: ({ pubKey, deviceData }) => getChallengeMutation.mutate({
-                onboardingId: __onboardingId,
-                pubKey,
-                deviceData
-              }),
-              submitChallenge: ({ pubKey, challengeResponse }) => submitChallengeMutation.mutate({
-                onboardingId: engine2.__onboardingId,
-                pubKey,
-                // FIXME this should be renamed to `challengeResponse` on backend side
-                response: challengeResponse
-              }),
-              onScreenDisplayed: params?.onScreenDisplayed
-            });
-          },
-          reviewSharedOwner: async (challenge, params) => {
-            await enforcePairing();
-            const { pubKey } = await device.getU2FPubKey();
-            await device.startKPatternAsResponder({
-              handshake: challenge.handshake,
-              handshakeAttestation: challenge.handshakeAttestation,
-              partitionId: challenge.partitionId
-            });
-            await params?.onScreenDisplayed?.();
-            const signature = await device.validateVaultOperation({
-              actions: challenge.wActions
-            });
-            await client2.onboarding.submitReviewByMasterAdminSignature.mutate({
-              onboardingId: __onboardingId,
-              pubKey,
-              signature
-            });
-          },
-          collectSeedFragment: async (challenge, params) => {
-            await enforcePairing();
-            const [{ pubKey }, { attestation }] = await Promise.all([
-              device.getU2FPubKey(),
-              device.getAttestation()
-            ]);
-            await device.startKPatternAsResponder({
-              handshake: challenge.handshake,
-              handshakeAttestation: challenge.handshakeAttestation,
-              partitionId: challenge.partitionId
-            });
-            await params?.onScreenDisplayed?.();
-            const challengeResponse = await device.validateVaultOperation({
-              actions: challenge.wActions
-            });
-            const kkPattern = await device.startKKPatternAsResponder({
-              partitionId: challenge.partitionId,
-              handshake: challenge.kkHandshake,
-              handshakeAttestation: challenge.kkHandshakeAttestation
-            });
-            const approverBlob = await device.generateSeedFragment();
-            await client2.onboarding.submitSeedFragment.mutate({
-              onboardingId: __onboardingId,
-              pubKey,
-              seedFragment: {
-                challengeResponse,
-                approverBlob,
-                handshake: kkPattern.handshake,
-                handshakeAttestation: {
-                  ...attestation,
-                  signature: kkPattern.signature
-                }
-              }
-            });
-          }
-        };
-      });
-    }
-    if (engine.device && engine.__workspaceName && !engine.__psdToken) {
-      decorate(
-        (engine2) => {
-          const { device, client: client2, __workspaceName } = engine2;
-          return {
-            login: async function(opts) {
-              const { pubKey } = await device.getU2FPubKey();
-              const challenge = await client2.auth.psd.generateChallenge.mutate(
-                {
-                  pubKey,
-                  workspaceName: __workspaceName
-                },
-                buildTrpcContext({ correlationId: opts?.correlationId })
-              );
-              await opts?.onScreenDisplayed?.();
-              const authentication = await device.authenticate({
-                challenge,
-                workspaceName: __workspaceName
-              });
-              const authPayload = {
-                workspaceName: __workspaceName,
-                pubKey,
-                authentication,
-                challengeId: challenge.challengeId,
-                validityDurationSecs: opts?.validityDurationSecs
-              };
-              const { token } = await client2.auth.psd.authenticate.mutate(
-                { ...authPayload },
-                buildTrpcContext({ correlationId: opts?.correlationId })
-              );
-              const withPsdAuth = {
-                __psdToken: token
-              };
-              const psdAuth = `${engine2.__workspaceName}:${token}`;
-              const __authClient = engine2.createClient({ psdAuth });
-              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth });
-            },
-            register: (registration) => {
-              return genericRegister({
-                device,
-                name: registration.name,
-                role: registration.role,
-                getChallenge: async ({ deviceData }) => {
-                  const challenge = await client2.userRegistrations.generateChallenge.mutate({
-                    id: registration.id,
-                    workspaceName: __workspaceName,
-                    deviceData
-                  });
-                  return challenge;
-                },
-                submitChallenge: ({ challengeResponse }) => client2.userRegistrations.submitChallenge.mutate({
-                  workspaceName: __workspaceName,
-                  id: registration.id,
-                  challengeResponse
-                })
-              });
-            }
-          };
-        }
-      );
-    }
-    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {
-      decorate(
-        (engine2) => {
-          const { client: client2, __workspaceName } = engine2;
-          return {
-            login: async function(credentials, opts) {
-              const res = await client2.auth.authenticate.mutate(
-                {
-                  apiKeyId: credentials.apiKeyId,
-                  apiKeySecret: credentials.apiKeySecret,
-                  workspace: __workspaceName
-                },
-                buildTrpcContext({ correlationId: opts?.correlationId })
-              );
-              const withApiAuth = {
-                __apiAuth: res
-              };
-              const __authClient = engine2.createClient({ apiAccessToken: res.accessToken });
-              return decorateEngine({ ...this, client: __authClient, ...withApiAuth });
-            }
-          };
-        }
-      );
-    }
-    if (engine.device && engine.__workspaceName && engine.__psdToken) {
-      decorate((engine2) => {
-        const { client: client2, device } = engine2;
-        async function enforcePairing() {
-          if (await device.hasPairing()) return;
-          const confidentialityKey = await device.getConfidentialityKey();
-          const pairing = await client2.debug.pairDevicePartition.mutate({
-            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
-            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-          });
-          await device.setPairing({ pairing });
-        }
-        const approveChallenge = async (challenge, params) => {
-          await enforcePairing();
-          await device.startKPatternAsResponder({
-            handshake: challenge.handshake,
-            handshakeAttestation: challenge.handshakeAttestation,
-            partitionId: challenge.partitionId
-          });
-          await params?.onScreenDisplayed?.();
-          const signature = await device.validateVaultOperation({
-            actions: challenge.wActions
-          });
-          return signature;
-        };
-        return {
-          approve: async (request, params) => {
-            const { challenge } = await client2.requests.getChallenge.query({ id: request.id });
-            if (challenge.challengeType === "PSD") {
-              const signature = await approveChallenge(challenge, params);
-              await params?.onPsdChallengeSigned?.();
-              return client2.requests.approve.mutate(
-                {
-                  id: request.id,
-                  data: { challengeType: "PSD", signature }
-                },
-                buildTrpcContext(params)
-              );
-            }
-            if (challenge.challengeType === "SOFT") {
-              return client2.requests.approve.mutate(
-                {
-                  id: request.id,
-                  data: { challengeType: "SOFT" }
-                },
-                buildTrpcContext(params)
-              );
-            }
-            throw new Error("Challenge type must be either PSD or SOFT");
-          },
-          approveChallenge,
-          reject: (request, opts) => {
-            return client2.requests.reject.mutate(
-              { id: request.id, data: null },
-              buildTrpcContext(opts)
-            );
-          }
-        };
-      });
-    }
-    if (engine.__workspaceName && engine.__apiAuth) {
-      decorate((engine2) => {
-        const { client: client2 } = engine2;
-        return {
-          getChallenge: async (request) => {
-            const { challenge } = await client2.requests.getChallenge.query({ id: request.id });
-            invariant2(challenge.challengeType === "API", "Challenge type must be API");
-            return challenge.payload;
-          },
-          approve: (request, signature) => {
-            return client2.requests.approve.mutate({
-              id: request.id,
-              data: { challengeType: "API", signature }
-            });
-          },
-          reject: (request, signature) => {
-            return client2.requests.reject.mutate({
-              id: request.id,
-              data: { challengeType: "API", signature }
-            });
-          }
-        };
-      });
-    }
-    return engine;
-  }
-  return {
-    ...base,
-    withDeviceIndex,
-    withTransportId,
-    withApiUser,
-    withWorkspace,
-    withOnboarding
-  };
+	const clientOptions = { baseUrl: options.baseUrl };
+	const client = createClient(clientOptions);
+	const apiDevice = createApiDevice(options, logger);
+	const base = {
+		client,
+		createClient: (overrides) => createClient({
+			...clientOptions,
+			...overrides
+		}),
+		__options: options
+	};
+	const withDeviceIndex = function(deviceIndex) {
+		const withPsd = { device: apiDevice.with(deviceIndex) };
+		return decorateEngine({
+			...this,
+			...withPsd
+		});
+	};
+	const withTransportId = function(transportId) {
+		const withPsd = { device: createRealDevice({ transportId }, logger) };
+		return decorateEngine({
+			...this,
+			...withPsd
+		});
+	};
+	const withApiUser = function() {
+		const withApiUser = { __isApiUser: true };
+		return decorateEngine({
+			...this,
+			...withApiUser
+		});
+	};
+	const withWorkspace = function(workspaceName) {
+		const withWorkspace = { __workspaceName: workspaceName };
+		return decorateEngine({
+			...this,
+			...withWorkspace
+		});
+	};
+	const withOnboarding = function(onboardingId) {
+		const withOnboarding = { __onboardingId: onboardingId };
+		return decorateEngine({
+			...this,
+			...withOnboarding
+		});
+	};
+	function decorateEngine(engine) {
+		function decorate(decorator) {
+			Object.assign(engine, decorator(engine));
+		}
+		if (engine.device) decorate((engine) => ({
+			getWorkspaces: async () => {
+				const { device, client } = engine;
+				const { pubKey } = await device.getU2FPubKey();
+				const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });
+				return workspaceNames;
+			},
+			getWorkspacesForSso: async () => {
+				const { device, client } = engine;
+				const { pubKey } = await device.getU2FPubKey();
+				const { workspaces } = await client.auth.sso.findWorkspaces.query({ pubKey });
+				return workspaces;
+			}
+		}));
+		if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) decorate((engine) => {
+			const { __workspaceName } = engine;
+			return { withPsdToken: function(token) {
+				const withPsdAuth = { __psdToken: token };
+				const psdAuth = `${__workspaceName}:${token}`;
+				const client = engine.createClient({ psdAuth });
+				return decorateEngine({
+					...this,
+					client,
+					...withPsdAuth
+				});
+			} };
+		});
+		if (engine.device && engine.__onboardingId) decorate((engine) => {
+			const { device, client, __onboardingId } = engine;
+			async function enforcePairing() {
+				if (await device.hasPairing()) return;
+				const [{ pubKey }, confidentialityKey] = await Promise.all([device.getU2FPubKey(), device.getConfidentialityKey()]);
+				const pairing = await client.onboarding.pairDevicePartition.mutate({
+					pubKey,
+					onboardingId: __onboardingId,
+					data: {
+						confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+						confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+					}
+				});
+				await device.setPairing({ pairing });
+			}
+			return {
+				claimDevice: async (params) => {
+					const { role, deviceName } = params;
+					const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([device.getU2FPubKey(), device.getConfidentialityPubKey()]);
+					await client.onboarding.claimDevice.mutate({
+						onboardingId: __onboardingId,
+						claim: {
+							role,
+							pubKey,
+							deviceName,
+							confidentialityKey
+						}
+					});
+				},
+				collectWrappingKeyFragment: async (wrappingKey, params) => {
+					const [{ pubKey }, confidentialityKey] = await Promise.all([device.getU2FPubKey(), device.getConfidentialityPubKey()]);
+					await device.openSession({ secureChannel: {
+						pubKey: wrappingKey.ephemeralPubKey,
+						certificate: wrappingKey.ephemeralCertificate
+					} });
+					const { attestation } = await device.getAttestation();
+					await params?.onScreenDisplayed?.();
+					const blob = await device.generateWrappingKeyFragment();
+					await client.onboarding.submitWrappingKeyFragment.mutate({
+						pubKey,
+						onboardingId: __onboardingId,
+						fragment: {
+							blob,
+							ephemeralPubKey: confidentialityKey.pubKey,
+							ephemeralCertificate: {
+								...attestation,
+								signature: confidentialityKey.signature
+							}
+						}
+					});
+				},
+				registerDevice: async (registerParams, params) => {
+					const { role, name } = registerParams;
+					const getChallengeMutation = role === "ADMIN" ? client.onboarding.generateMasterAdminRegistrationChallenge : client.onboarding.generateSharedOwnerRegistrationChallenge;
+					const submitChallengeMutation = role === "ADMIN" ? client.onboarding.submitMasterAdminRegistration : client.onboarding.submitSharedOwnerRegistration;
+					await genericRegister({
+						device,
+						name,
+						role,
+						getChallenge: ({ pubKey, deviceData }) => getChallengeMutation.mutate({
+							onboardingId: __onboardingId,
+							pubKey,
+							deviceData
+						}),
+						submitChallenge: ({ pubKey, challengeResponse }) => submitChallengeMutation.mutate({
+							onboardingId: engine.__onboardingId,
+							pubKey,
+							response: challengeResponse
+						}),
+						onScreenDisplayed: params?.onScreenDisplayed
+					});
+				},
+				reviewSharedOwner: async (challenge, params) => {
+					await enforcePairing();
+					const { pubKey } = await device.getU2FPubKey();
+					await device.startKPatternAsResponder({
+						handshake: challenge.handshake,
+						handshakeAttestation: challenge.handshakeAttestation,
+						partitionId: challenge.partitionId
+					});
+					await params?.onScreenDisplayed?.();
+					const signature = await device.validateVaultOperation({ actions: challenge.wActions });
+					await client.onboarding.submitReviewByMasterAdminSignature.mutate({
+						onboardingId: __onboardingId,
+						pubKey,
+						signature
+					});
+				},
+				collectSeedFragment: async (challenge, params) => {
+					await enforcePairing();
+					const [{ pubKey }, { attestation }] = await Promise.all([device.getU2FPubKey(), device.getAttestation()]);
+					await device.startKPatternAsResponder({
+						handshake: challenge.handshake,
+						handshakeAttestation: challenge.handshakeAttestation,
+						partitionId: challenge.partitionId
+					});
+					await params?.onScreenDisplayed?.();
+					const challengeResponse = await device.validateVaultOperation({ actions: challenge.wActions });
+					const kkPattern = await device.startKKPatternAsResponder({
+						partitionId: challenge.partitionId,
+						handshake: challenge.kkHandshake,
+						handshakeAttestation: challenge.kkHandshakeAttestation
+					});
+					const approverBlob = await device.generateSeedFragment();
+					await client.onboarding.submitSeedFragment.mutate({
+						onboardingId: __onboardingId,
+						pubKey,
+						seedFragment: {
+							challengeResponse,
+							approverBlob,
+							handshake: kkPattern.handshake,
+							handshakeAttestation: {
+								...attestation,
+								signature: kkPattern.signature
+							}
+						}
+					});
+				}
+			};
+		});
+		if (engine.device && engine.__workspaceName && !engine.__psdToken) decorate((engine) => {
+			const { device, client, __workspaceName } = engine;
+			return {
+				login: async function(opts) {
+					const { pubKey } = await device.getU2FPubKey();
+					const challenge = await client.auth.psd.generateChallenge.mutate({
+						pubKey,
+						workspaceName: __workspaceName
+					}, buildTrpcContext({ correlationId: opts?.correlationId }));
+					await opts?.onScreenDisplayed?.();
+					const authPayload = {
+						workspaceName: __workspaceName,
+						pubKey,
+						authentication: await device.authenticate({
+							challenge,
+							workspaceName: __workspaceName
+						}),
+						challengeId: challenge.challengeId,
+						validityDurationSecs: opts?.validityDurationSecs
+					};
+					const { token } = await client.auth.psd.authenticate.mutate({ ...authPayload }, buildTrpcContext({ correlationId: opts?.correlationId }));
+					const withPsdAuth = { __psdToken: token };
+					const psdAuth = `${engine.__workspaceName}:${token}`;
+					const __authClient = engine.createClient({ psdAuth });
+					return decorateEngine({
+						...this,
+						client: __authClient,
+						...withPsdAuth
+					});
+				},
+				register: (registration) => {
+					return genericRegister({
+						device,
+						name: registration.name,
+						role: registration.role,
+						getChallenge: async ({ deviceData }) => {
+							return await client.userRegistrations.generateChallenge.mutate({
+								id: registration.id,
+								workspaceName: __workspaceName,
+								deviceData
+							});
+						},
+						submitChallenge: ({ challengeResponse }) => client.userRegistrations.submitChallenge.mutate({
+							workspaceName: __workspaceName,
+							id: registration.id,
+							challengeResponse
+						})
+					});
+				}
+			};
+		});
+		if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) decorate((engine) => {
+			const { client, __workspaceName } = engine;
+			return { login: async function(credentials, opts) {
+				const res = await client.auth.authenticate.mutate({
+					apiKeyId: credentials.apiKeyId,
+					apiKeySecret: credentials.apiKeySecret,
+					workspace: __workspaceName
+				}, buildTrpcContext({ correlationId: opts?.correlationId }));
+				const withApiAuth = { __apiAuth: res };
+				const __authClient = engine.createClient({ apiAccessToken: res.accessToken });
+				return decorateEngine({
+					...this,
+					client: __authClient,
+					...withApiAuth
+				});
+			} };
+		});
+		if (engine.device && engine.__workspaceName && engine.__psdToken) decorate((engine) => {
+			const { client, device } = engine;
+			async function enforcePairing() {
+				if (await device.hasPairing()) return;
+				const confidentialityKey = await device.getConfidentialityKey();
+				const pairing = await client.debug.pairDevicePartition.mutate({
+					confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+					confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+				});
+				await device.setPairing({ pairing });
+			}
+			const approveChallenge = async (challenge, params) => {
+				await enforcePairing();
+				await device.startKPatternAsResponder({
+					handshake: challenge.handshake,
+					handshakeAttestation: challenge.handshakeAttestation,
+					partitionId: challenge.partitionId
+				});
+				await params?.onScreenDisplayed?.();
+				return await device.validateVaultOperation({ actions: challenge.wActions });
+			};
+			return {
+				approve: async (request, params) => {
+					const { challenge } = await client.requests.getChallenge.query({ id: request.id });
+					if (challenge.challengeType === "PSD") {
+						const signature = await approveChallenge(challenge, params);
+						await params?.onPsdChallengeSigned?.();
+						return client.requests.approve.mutate({
+							id: request.id,
+							data: {
+								challengeType: "PSD",
+								signature
+							}
+						}, buildTrpcContext(params));
+					}
+					if (challenge.challengeType === "SOFT") return client.requests.approve.mutate({
+						id: request.id,
+						data: { challengeType: "SOFT" }
+					}, buildTrpcContext(params));
+					throw new Error("Challenge type must be either PSD or SOFT");
+				},
+				approveChallenge,
+				reject: (request, opts) => {
+					return client.requests.reject.mutate({
+						id: request.id,
+						data: null
+					}, buildTrpcContext(opts));
+				}
+			};
+		});
+		if (engine.__workspaceName && engine.__apiAuth) decorate((engine) => {
+			const { client } = engine;
+			return {
+				getChallenge: async (request) => {
+					const { challenge } = await client.requests.getChallenge.query({ id: request.id });
+					invariant(challenge.challengeType === "API", "Challenge type must be API");
+					return challenge.payload;
+				},
+				approve: (request, signature) => {
+					return client.requests.approve.mutate({
+						id: request.id,
+						data: {
+							challengeType: "API",
+							signature
+						}
+					});
+				},
+				reject: (request, signature) => {
+					return client.requests.reject.mutate({
+						id: request.id,
+						data: {
+							challengeType: "API",
+							signature
+						}
+					});
+				}
+			};
+		});
+		return engine;
+	}
+	return {
+		...base,
+		withDeviceIndex,
+		withTransportId,
+		withApiUser,
+		withWorkspace,
+		withOnboarding
+	};
 }
-export {
-  createEngine,
-  fetchAll,
-  fetchAllCursor
-};
-/* v8 ignore next -- @preserve */
+//#endregion
+export { createEngine, fetchAll, fetchAllCursor };
+
 //# sourceMappingURL=engine.js.map