@ledgerhq/revault-sdk 0.25.0 → 0.26.0

package/lib/onboarding.js

@@ -1,188 +1,218 @@
-// src/onboarding.ts
 import invariant from "invariant";
-var roleLabels = {
-  WRAPPING_KEY_OWNER: "Wrapping Key",
-  MASTER_ADMIN: "Admin",
-  SHARED_OWNER: "Shared Owner"
+import { match } from "ts-pattern";
+//#region src/onboarding.ts
+const roleLabels = {
+	WRAPPING_KEY_OWNER: "Wrapping Key",
+	MASTER_ADMIN: "Admin",
+	SHARED_OWNER: "Shared Owner"
 };
-var devices = [
-  { index: 1, role: "WRAPPING_KEY_OWNER", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },
-  { index: 2, role: "WRAPPING_KEY_OWNER", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },
-  { index: 3, role: "WRAPPING_KEY_OWNER", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },
-  { index: 4, role: "MASTER_ADMIN", name: `${roleLabels.MASTER_ADMIN} 1` },
-  { index: 5, role: "MASTER_ADMIN", name: `${roleLabels.MASTER_ADMIN} 2` },
-  { index: 6, role: "MASTER_ADMIN", name: `${roleLabels.MASTER_ADMIN} 3` },
-  { index: 7, role: "SHARED_OWNER", name: `${roleLabels.SHARED_OWNER} 1` },
-  { index: 8, role: "SHARED_OWNER", name: `${roleLabels.SHARED_OWNER} 2` },
-  { index: 9, role: "SHARED_OWNER", name: `${roleLabels.SHARED_OWNER} 3` }
+const devices = [
+	{
+		index: 1,
+		role: "WRAPPING_KEY_OWNER",
+		name: `${roleLabels.WRAPPING_KEY_OWNER} 1`
+	},
+	{
+		index: 2,
+		role: "WRAPPING_KEY_OWNER",
+		name: `${roleLabels.WRAPPING_KEY_OWNER} 2`
+	},
+	{
+		index: 3,
+		role: "WRAPPING_KEY_OWNER",
+		name: `${roleLabels.WRAPPING_KEY_OWNER} 3`
+	},
+	{
+		index: 4,
+		role: "MASTER_ADMIN",
+		name: `${roleLabels.MASTER_ADMIN} 1`
+	},
+	{
+		index: 5,
+		role: "MASTER_ADMIN",
+		name: `${roleLabels.MASTER_ADMIN} 2`
+	},
+	{
+		index: 6,
+		role: "MASTER_ADMIN",
+		name: `${roleLabels.MASTER_ADMIN} 3`
+	},
+	{
+		index: 7,
+		role: "SHARED_OWNER",
+		name: `${roleLabels.SHARED_OWNER} 1`
+	},
+	{
+		index: 8,
+		role: "SHARED_OWNER",
+		name: `${roleLabels.SHARED_OWNER} 2`
+	},
+	{
+		index: 9,
+		role: "SHARED_OWNER",
+		name: `${roleLabels.SHARED_OWNER} 3`
+	}
 ];
-var deviceNameToIndex = (name) => {
-  const index = devices.find((d) => d.name === name)?.index;
-  invariant(index !== void 0, `Unknown device ${name}`);
-  return index;
+const deviceNameToIndex = (name) => {
+	const index = devices.find((d) => d.name === name)?.index;
+	invariant(index !== void 0, `Unknown device ${name}`);
+	return index;
 };
-var STEPS = {
-  /**
-   * Devices claiming
-   */
-  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {
-    const promises = [];
-    for (const device of devices) {
-      if (state.claimedDevices.find(
-        /* v8 ignore next -- @preserve */
-        (c) => c.deviceName === device.name
-      ) === void 0) {
-        const promise = engine.withDeviceIndex(device.index).claimDevice({ role: device.role, deviceName: device.name }).then(() => logger.info(`Claimed ${device.name}`));
-        promises.push(promise);
-      }
-    }
-    await Promise.all(promises);
-    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });
-  },
-  /**
-   * Wrapping Key provisioning
-   */
-  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {
-    const { id: onboardingId } = state;
-    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });
-    const wrappingKey = state.wrappingKey;
-    const toCollect = state.claimedDevices.filter((claimed) => {
-      if (claimed.role !== "WRAPPING_KEY_OWNER") return false;
-      const inFragment = !!state.wrappingKey?.fragments.find(
-        /* v8 ignore next -- @preserve */
-        (f) => f.pubKey === claimed.pubKey
-      );
-      return !inFragment;
-    }).map((c) => {
-      const index = deviceNameToIndex(c.deviceName);
-      return index;
-    });
-    await Promise.all(
-      toCollect.map(
-        (index) => engine.withDeviceIndex(index).collectWrappingKeyFragment(wrappingKey).then(() => logger.info(`Collected Wrapping Key ${index}`))
-      )
-    );
-    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });
-  },
-  /**
-   * Init Master Admins registration
-   */
-  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) => engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),
-  /**
-   * Master Admins registration
-   */
-  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {
-    const { id: onboardingId } = state;
-    const toRegister = state.claimedDevices.filter((claimed) => {
-      if (claimed.role !== "MASTER_ADMIN") return false;
-      const hasRegistered = !!state.masterAdmins.find(
-        /* v8 ignore next -- @preserve */
-        (a) => a.pubKey === claimed.pubKey
-      );
-      return !hasRegistered;
-    });
-    await Promise.all(
-      toRegister.map(async ({ deviceName: name }) => {
-        const index = deviceNameToIndex(name);
-        await engine.withDeviceIndex(index).registerDevice({ role: "ADMIN", name });
-        logger.info(`Registered ${name}`);
-      })
-    );
-    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });
-  },
-  /**
-   * Init Shared Owners registration
-   */
-  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id }),
-  /**
-   * Shared Owners registration
-   */
-  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {
-    const { id: onboardingId } = state;
-    const toRegister = state.claimedDevices.filter((claimed) => {
-      if (claimed.role !== "SHARED_OWNER") return false;
-      const hasRegistered = !!state.sharedOwners.find(
-        /* v8 ignore next -- @preserve */
-        (a) => a.pubKey === claimed.pubKey
-      );
-      return !hasRegistered;
-    });
-    await Promise.all(
-      toRegister.map(async ({ deviceName: name }) => {
-        const index = deviceNameToIndex(name);
-        await engine.withDeviceIndex(index).registerDevice({ role: "SHARED_OWNER", name });
-        logger.info(`Registered ${name}`);
-      })
-    );
-    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });
-  },
-  /**
-   * Review by master admins
-   */
-  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {
-    const { id: onboardingId } = state;
-    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });
-    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);
-    await Promise.all(
-      toCollect.map(async (admin) => {
-        const index = deviceNameToIndex(admin.name);
-        const challenge = admin.review?.challenge;
-        await engine.withDeviceIndex(index).reviewSharedOwner(challenge);
-        logger.info(`Approved with ${admin.name}`);
-      })
-    );
-    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });
-  },
-  /**
-   * Seed provisioning
-   */
-  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {
-    const { id: onboardingId } = state;
-    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });
-    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);
-    await Promise.all(
-      toCollect.map(async (so) => {
-        const index = deviceNameToIndex(so.name);
-        const challenge = so.review?.seedChallenge;
-        await engine.withDeviceIndex(index).collectSeedFragment(challenge);
-        logger.info(`Collected fragment for ${so.name}`);
-      })
-    );
-    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });
-  },
-  /**
-   * Workspace initialization
-   */
-  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),
-  /**
-   * Onboarding completed
-   */
-  COMPLETED: async ({ state }) => state
+const checkHsmHostingMode = (state, expectedMode) => {
+	/* v8 ignore next -- @preserve */
+	if (state.hsmHostingMode !== expectedMode) throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);
 };
-var STEPS_LIST = Object.values(STEPS);
-async function onboard({
-  engine,
-  untilStep
-}, logger) {
-  const { __onboardingId } = engine;
-  logger.info(`Joining onboarding ${__onboardingId}`);
-  let state = await engine.client.onboarding.getOnboarding.query({
-    onboardingId: __onboardingId
-  });
-  for (const step of STEPS_LIST.slice(STEPS_LIST.indexOf(STEPS[state.step]))) {
-    if (untilStep && state.step === untilStep) {
-      logger.info("Skipping the rest of the onboarding");
-      break;
-    }
-    const index = STEPS_LIST.indexOf(step);
-    const stepProgress = `${(index + 1).toString().padStart(2, "0")}/${STEPS_LIST.length}`;
-    logger.info(`(${stepProgress}) ${step.name}`);
-    state = await step({ engine, state }, logger);
-  }
-}
-export {
-  STEPS,
-  onboard
+/* v8 ignore next -- @preserve */
+const checkExternalSigners = (state, externalSigners) => {
+	const hasExternalSigners = externalSigners && externalSigners.length > 0;
+	const errorMessage = match(state.hsmHostingMode).with("HOSTED", () => !hasExternalSigners ? null : "Hosted HSM does not support external signers").with("ON_PREM", () => hasExternalSigners ? null : "On-premises HSM requires at least 1 external signer").exhaustive();
+	if (errorMessage !== null) throw new Error(errorMessage);
+};
+const STEPS = {
+	PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {
+		const promises = [];
+		for (const device of devices) {
+			if (state.hsmHostingMode === "ON_PREM" && device.role === "SHARED_OWNER") continue;
+			/* v8 ignore else -- @preserve */
+			if (state.claimedDevices.find(
+				/* v8 ignore next -- @preserve */
+				(c) => c.deviceName === device.name
+			) === void 0) {
+				const promise = engine.withDeviceIndex(device.index).claimDevice({
+					role: device.role,
+					deviceName: device.name
+				}).then(() => logger.info(`Claimed ${device.name}`));
+				promises.push(promise);
+			}
+		}
+		await Promise.all(promises);
+		return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });
+	},
+	PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {
+		const { id: onboardingId } = state;
+		state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });
+		const wrappingKey = state.wrappingKey;
+		const toCollect = state.claimedDevices.filter((claimed) => {
+			if (claimed.role !== "WRAPPING_KEY_OWNER") return false;
+			return !!!state.wrappingKey?.fragments.find(
+				/* v8 ignore next -- @preserve */
+				(f) => f.pubKey === claimed.pubKey
+			);
+		}).map((c) => {
+			return deviceNameToIndex(c.deviceName);
+		});
+		await Promise.all(toCollect.map((index) => engine.withDeviceIndex(index).collectWrappingKeyFragment(wrappingKey).then(() => logger.info(`Collected Wrapping Key ${index}`))));
+		return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });
+	},
+	PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) => engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),
+	PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {
+		const { id: onboardingId } = state;
+		const toRegister = state.claimedDevices.filter((claimed) => {
+			if (claimed.role !== "MASTER_ADMIN") return false;
+			return !!!state.masterAdmins.find(
+				/* v8 ignore next -- @preserve */
+				(a) => a.pubKey === claimed.pubKey
+			);
+		});
+		await Promise.all(toRegister.map(async ({ deviceName: name }) => {
+			const index = deviceNameToIndex(name);
+			await engine.withDeviceIndex(index).registerDevice({
+				role: "ADMIN",
+				name
+			});
+			logger.info(`Registered ${name}`);
+		}));
+		return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });
+	},
+	PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {
+		checkHsmHostingMode(state, "HOSTED");
+		return engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id });
+	},
+	PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {
+		checkHsmHostingMode(state, "HOSTED");
+		const { id: onboardingId } = state;
+		const toRegister = state.claimedDevices.filter((claimed) => {
+			if (claimed.role !== "SHARED_OWNER") return false;
+			return !!!state.sharedOwners.find(
+				/* v8 ignore next -- @preserve */
+				(a) => a.pubKey === claimed.pubKey
+			);
+		});
+		await Promise.all(toRegister.map(async ({ deviceName: name }) => {
+			const index = deviceNameToIndex(name);
+			await engine.withDeviceIndex(index).registerDevice({
+				role: "SHARED_OWNER",
+				name
+			});
+			logger.info(`Registered ${name}`);
+		}));
+		return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });
+	},
+	PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {
+		const { id: onboardingId } = state;
+		state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });
+		const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);
+		await Promise.all(toCollect.map(async (admin) => {
+			const index = deviceNameToIndex(admin.name);
+			const challenge = admin.review?.challenge;
+			await engine.withDeviceIndex(index).reviewSharedOwner(challenge);
+			logger.info(`Approved with ${admin.name}`);
+		}));
+		return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });
+	},
+	PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {
+		checkHsmHostingMode(state, "ON_PREM");
+		invariant(externalSigners && externalSigners.length > 0, "External signers must exist");
+		const { id: onboardingId } = state;
+		state = await engine.client.onboarding.startExternalSignersRegistration.mutate({
+			onboardingId,
+			externalSigners
+		});
+		const toCollect = state.masterAdmins.filter((admin) => !admin.reviewOfExternalSigners?.signature);
+		await Promise.all(toCollect.map(async (admin) => {
+			const index = deviceNameToIndex(admin.name);
+			const challenge = admin.reviewOfExternalSigners?.challenge;
+			await engine.withDeviceIndex(index).reviewExternalSigners(challenge);
+			logger.info(`Approved with ${admin.name}`);
+		}));
+		return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });
+	},
+	PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {
+		checkHsmHostingMode(state, "HOSTED");
+		const { id: onboardingId } = state;
+		state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });
+		const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);
+		await Promise.all(toCollect.map(async (so) => {
+			const index = deviceNameToIndex(so.name);
+			const challenge = so.review?.seedChallenge;
+			await engine.withDeviceIndex(index).collectSeedFragment(challenge);
+			logger.info(`Collected fragment for ${so.name}`);
+		}));
+		return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });
+	},
+	PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id })
 };
-/* v8 ignore else -- @preserve */
+async function onboard(opts, logger) {
+	const { engine, externalSigners, untilStep } = opts;
+	const { __onboardingId } = engine;
+	logger.info(`Joining onboarding ${__onboardingId}`);
+	let state = await engine.client.onboarding.getOnboarding.query({ onboardingId: __onboardingId });
+	checkExternalSigners(state, externalSigners);
+	while (state.step !== "COMPLETED") {
+		if (untilStep && state.step === untilStep) {
+			logger.info("Skipping the rest of the onboarding");
+			break;
+		}
+		const step = STEPS[state.step];
+		logger.info(step.name);
+		state = await step({
+			engine,
+			state,
+			externalSigners
+		}, logger);
+	}
+}
+//#endregion
+export { STEPS, onboard };
+
 //# sourceMappingURL=onboarding.js.map

package/lib/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n\n  /**\n   * Onboarding completed\n   */\n  COMPLETED: async ({ state }) => state,\n} as const satisfies Record<OnboardingStep, StepAction>;\n\nconst STEPS_LIST = Object.values(STEPS);\n\nexport async function onboard(\n  {\n    engine,\n    untilStep,\n  }: {\n    engine: Engine<WithOnboarding>;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  for (const step of STEPS_LIST.slice(STEPS_LIST.indexOf(STEPS[state.step]))) {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const index = STEPS_LIST.indexOf(step);\n    const stepProgress = `${(index + 1).toString().padStart(2, \"0\")}/${STEPS_LIST.length}`;\n    logger.info(`(${stepProgress}) ${step.name}`);\n    state = await step({ engine, state }, logger);\n  }\n}\n"],"mappings":";AAKA,OAAO,eAAe;AActB,IAAM,aAA0C;AAAA,EAC9C,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,cAAc;AAChB;AAEA,IAAM,UAAgE;AAAA,EACpE,EAAE,OAAO,GAAG,MAAM,sBAAsB,MAAM,GAAG,WAAW,kBAAkB,KAAK;AAAA,EACnF,EAAE,OAAO,GAAG,MAAM,sBAAsB,MAAM,GAAG,WAAW,kBAAkB,KAAK;AAAA,EACnF,EAAE,OAAO,GAAG,MAAM,sBAAsB,MAAM,GAAG,WAAW,kBAAkB,KAAK;AAAA,EACnF,EAAE,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,WAAW,YAAY,KAAK;AAAA,EACvE,EAAE,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,WAAW,YAAY,KAAK;AAAA,EACvE,EAAE,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,WAAW,YAAY,KAAK;AAAA,EACvE,EAAE,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,WAAW,YAAY,KAAK;AAAA,EACvE,EAAE,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,WAAW,YAAY,KAAK;AAAA,EACvE,EAAE,OAAO,GAAG,MAAM,gBAAgB,MAAM,GAAG,WAAW,YAAY,KAAK;AACzE;AAEA,IAAM,oBAAoB,CAAC,SAAyB;AAClD,QAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACpD,YAAU,UAAU,QAAW,kBAAkB,IAAI,EAAE;AACvD,SAAO;AACT;AAEO,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA,EAInB,uBAAuB,OAAO,EAAE,OAAO,OAAO,GAAG,WAAW;AAC1D,UAAM,WAA4B,CAAC;AACnC,eAAW,UAAU,SAAS;AAE5B,UACE,MAAM,eAAe;AAAA;AAAA,QAEnB,CAAC,MAAM,EAAE,eAAe,OAAO;AAAA,MACjC,MAAM,QACN;AACA,cAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,EAC5B,YAAY,EAAE,MAAM,OAAO,MAAM,YAAY,OAAO,KAAK,CAAC,EAC1D,KAAK,MAAM,OAAO,KAAK,WAAW,OAAO,IAAI,EAAE,CAAC;AACnD,iBAAS,KAAK,OAAO;AAAA,MACvB;AAAA,IACF;AACA,UAAM,QAAQ,IAAI,QAAQ;AAC1B,WAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA,EAKA,mCAAmC,OAAO,EAAE,OAAO,OAAO,GAAG,WAAW;AACtE,UAAM,EAAE,IAAI,aAAa,IAAI;AAC7B,YAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,aAAa,CAAC;AAC3F,UAAM,cAAc,MAAM;AAC1B,UAAM,YAAY,MAAM,eACrB,OAAO,CAAC,YAAY;AACnB,UAAI,QAAQ,SAAS,qBAAsB,QAAO;AAClD,YAAM,aAAa,CAAC,CAAC,MAAM,aAAa,UAAU;AAAA;AAAA,QAEhD,CAAC,MAAM,EAAE,WAAW,QAAQ;AAAA,MAC9B;AACA,aAAO,CAAC;AAAA,IACV,CAAC,EACA,IAAI,CAAC,MAAM;AACV,YAAM,QAAQ,kBAAkB,EAAE,UAAU;AAC5C,aAAO;AAAA,IACT,CAAC;AACH,UAAM,QAAQ;AAAA,MACZ,UAAU;AAAA,QAAI,CAAC,UACb,OACG,gBAAgB,KAAK,EACrB,2BAA2B,WAAW,EACtC,KAAK,MAAM,OAAO,KAAK,0BAA0B,KAAK,EAAE,CAAC;AAAA,MAC9D;AAAA,IACF;AACA,WAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,aAAa,CAAC;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA,EAKA,yCAAyC,OAAO,EAAE,QAAQ,MAAM,MAC9D,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK1F,oCAAoC,OAAO,EAAE,OAAO,OAAO,GAAG,WAAW;AACvE,UAAM,EAAE,IAAI,aAAa,IAAI;AAC7B,UAAM,aAAa,MAAM,eAAe,OAAO,CAAC,YAAY;AAC1D,UAAI,QAAQ,SAAS,eAAgB,QAAO;AAC5C,YAAM,gBAAgB,CAAC,CAAC,MAAM,aAAa;AAAA;AAAA,QAEzC,CAAC,MAAM,EAAE,WAAW,QAAQ;AAAA,MAC9B;AACA,aAAO,CAAC;AAAA,IACV,CAAC;AACD,UAAM,QAAQ;AAAA,MACZ,WAAW,IAAI,OAAO,EAAE,YAAY,KAAK,MAAM;AAC7C,cAAM,QAAQ,kBAAkB,IAAI;AACpC,cAAM,OAAO,gBAAgB,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,KAAK,CAAC;AAC1E,eAAO,KAAK,cAAc,IAAI,EAAE;AAAA,MAClC,CAAC;AAAA,IACH;AACA,WAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA,EAKA,yCAAyC,OAAO,EAAE,QAAQ,MAAM,MAC9D,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK1F,oCAAoC,OAAO,EAAE,OAAO,OAAO,GAAG,WAAW;AACvE,UAAM,EAAE,IAAI,aAAa,IAAI;AAC7B,UAAM,aAAa,MAAM,eAAe,OAAO,CAAC,YAAY;AAC1D,UAAI,QAAQ,SAAS,eAAgB,QAAO;AAC5C,YAAM,gBAAgB,CAAC,CAAC,MAAM,aAAa;AAAA;AAAA,QACP,CAAC,MAAM,EAAE,WAAW,QAAQ;AAAA,MAChE;AACA,aAAO,CAAC;AAAA,IACV,CAAC;AACD,UAAM,QAAQ;AAAA,MACZ,WAAW,IAAI,OAAO,EAAE,YAAY,KAAK,MAAM;AAC7C,cAAM,QAAQ,kBAAkB,IAAI;AACpC,cAAM,OAAO,gBAAgB,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,KAAK,CAAC;AACjF,eAAO,KAAK,cAAc,IAAI,EAAE;AAAA,MAClC,CAAC;AAAA,IACH;AACA,WAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,iCAAiC,OAAO,EAAE,OAAO,OAAO,GAAG,WAAW;AACpE,UAAM,EAAE,IAAI,aAAa,IAAI;AAC7B,YAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;AACxF,UAAM,YAAY,MAAM,aAAa,OAAO,CAAC,UAAU,CAAC,MAAM,QAAQ,SAAS;AAC/E,UAAM,QAAQ;AAAA,MACZ,UAAU,IAAI,OAAO,UAAU;AAC7B,cAAM,QAAQ,kBAAkB,MAAM,IAAI;AAC1C,cAAM,YAAY,MAAM,QAAQ;AAChC,cAAM,OAAO,gBAAgB,KAAK,EAAE,kBAAkB,SAAU;AAChE,eAAO,KAAK,iBAAiB,MAAM,IAAI,EAAE;AAAA,MAC3C,CAAC;AAAA,IACH;AACA,WAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA,EAKA,2BAA2B,OAAO,EAAE,OAAO,OAAO,GAAG,WAAW;AAC9D,UAAM,EAAE,IAAI,aAAa,IAAI;AAC7B,YAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;AACpF,UAAM,YAAY,MAAM,aAAa,OAAO,CAAC,OAAO,CAAC,GAAG,QAAQ,YAAY;AAC5E,UAAM,QAAQ;AAAA,MACZ,UAAU,IAAI,OAAO,OAAO;AAC1B,cAAM,QAAQ,kBAAkB,GAAG,IAAI;AACvC,cAAM,YAAY,GAAG,QAAQ;AAC7B,cAAM,OAAO,gBAAgB,KAAK,EAAE,oBAAoB,SAAU;AAClE,eAAO,KAAK,0BAA0B,GAAG,IAAI,EAAE;AAAA,MACjD,CAAC;AAAA,IACH;AACA,WAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA,EAKA,kCAAkC,OAAO,EAAE,OAAO,OAAO,MACvD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAKhF,WAAW,OAAO,EAAE,MAAM,MAAM;AAClC;AAEA,IAAM,aAAa,OAAO,OAAO,KAAK;AAEtC,eAAsB,QACpB;AAAA,EACE;AAAA,EACA;AACF,GAIA,QACe;AACf,QAAM,EAAE,eAAe,IAAI;AAC3B,SAAO,KAAK,sBAAsB,cAAc,EAAE;AAClD,MAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM;AAAA,IAC7D,cAAc;AAAA,EAChB,CAAC;AAED,aAAW,QAAQ,WAAW,MAAM,WAAW,QAAQ,MAAM,MAAM,IAAI,CAAC,CAAC,GAAG;AAC1E,QAAI,aAAa,MAAM,SAAS,WAAW;AACzC,aAAO,KAAK,qCAAqC;AACjD;AAAA,IACF;AACA,UAAM,QAAQ,WAAW,QAAQ,IAAI;AACrC,UAAM,eAAe,IAAI,QAAQ,GAAG,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,WAAW,MAAM;AACpF,WAAO,KAAK,IAAI,YAAY,KAAK,KAAK,IAAI,EAAE;AAC5C,YAAQ,MAAM,KAAK,EAAE,QAAQ,MAAM,GAAG,MAAM;AAAA,EAC9C;AACF;","names":[]}
+{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    externalSigners?: string[];\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  externalSigners: string[] | undefined,\n): void => {\n  const hasExternalSigners = externalSigners && externalSigners.length > 0;\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () =>\n      !hasExternalSigners ? null : \"Hosted HSM does not support external signers\",\n    )\n    .with(\"ON_PREM\", () =>\n      hasExternalSigners ? null : \"On-premises HSM requires at least 1 external signer\",\n    )\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    invariant(externalSigners && externalSigners.length > 0, \"External signers must exist\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n      externalSigners,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    externalSigners?: string[];\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, externalSigners, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, externalSigners);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, externalSigners }, logger);\n  }\n}\n"],"mappings":";;;AAsBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,WAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,oBACS;CACT,MAAM,qBAAqB,mBAAmB,gBAAgB,SAAS;CACvE,MAAM,eAAe,MAAM,MAAM,eAAe,CAC7C,KAAK,gBACJ,CAAC,qBAAqB,OAAO,+CAC9B,CACA,KAAK,iBACJ,qBAAqB,OAAO,sDAC7B,CACA,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OAAO,EAAE,OAAO,QAAQ,mBAAmB,WAAW;AAC3F,sBAAoB,OAAO,UAAU;AACrC,YAAU,mBAAmB,gBAAgB,SAAS,GAAG,8BAA8B;EACvF,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO;GAC7E;GACA;GACD,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAKA,QACe;CACf,MAAM,EAAE,QAAQ,iBAAiB,cAAc;CAE/C,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,gBAAgB;AAE5C,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAiB,EAAE,OAAO"}

package/lib/trpc-CWGPr8Ox.d.ts

@@ -0,0 +1,20 @@
+import { AppRouter } from "@ledgerhq/revault-api";
+import { TRPCClient } from "@trpc/client";
+import { inferRouterInputs, inferRouterOutputs } from "@trpc/server";
+
+//#region src/trpc.d.ts
+type TRPCClientOptions = {
+  baseUrl: string;
+  debugAuthToken?: string;
+  rootAuthToken?: string;
+  apiAccessToken?: string;
+  psdAuth?: string;
+};
+type RevaultApiTRPCClient = TRPCClient<AppRouter>;
+type RouterInputs = inferRouterInputs<AppRouter>;
+type RouterOutputs = inferRouterOutputs<AppRouter>;
+type TRPCContext = {
+  context: Record<string, unknown>;
+} | undefined;
+//#endregion
+export { TRPCContext as a, TRPCClientOptions as i, RouterInputs as n, RouterOutputs as r, RevaultApiTRPCClient as t };

package/lib/trpc-C_dUOB1u.d.cts

@@ -0,0 +1,20 @@
+import { AppRouter } from "@ledgerhq/revault-api";
+import { TRPCClient } from "@trpc/client";
+import { inferRouterInputs, inferRouterOutputs } from "@trpc/server";
+
+//#region src/trpc.d.ts
+type TRPCClientOptions = {
+  baseUrl: string;
+  debugAuthToken?: string;
+  rootAuthToken?: string;
+  apiAccessToken?: string;
+  psdAuth?: string;
+};
+type RevaultApiTRPCClient = TRPCClient<AppRouter>;
+type RouterInputs = inferRouterInputs<AppRouter>;
+type RouterOutputs = inferRouterOutputs<AppRouter>;
+type TRPCContext = {
+  context: Record<string, unknown>;
+} | undefined;
+//#endregion
+export { TRPCContext as a, TRPCClientOptions as i, RouterInputs as n, RouterOutputs as r, RevaultApiTRPCClient as t };