@ledgerhq/revault-sdk 0.25.1 → 0.26.0

package/lib/onboarding.d.ts

@@ -1,5 +1,5 @@
 import { t as Logger } from "./logger-DWLViq7U.js";
-import { d as Engine, y as WithOnboarding } from "./types-4CfR5--z.js";
+import { d as Engine, y as WithOnboarding } from "./types-BXkDuD6i.js";
 import { OnboardingFullStateResponse, OnboardingStep } from "@ledgerhq/revault-api";
 
 //#region src/onboarding.d.ts
@@ -13,10 +13,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -96,6 +98,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -188,10 +205,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -271,6 +290,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -363,10 +397,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -446,6 +482,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -538,10 +589,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -621,6 +674,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -713,10 +781,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -796,6 +866,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -888,10 +973,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -971,6 +1058,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -1063,10 +1165,12 @@ declare const STEPS: {
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -1146,6 +1250,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -1229,19 +1348,19 @@ declare const STEPS: {
     createdAt: Date;
     completedAt: Date | null;
   }>;
-  /**
-   * Seed provisioning
-   */
-  readonly PENDING_SEED_PROVISIONING: ({
+  readonly PENDING_EXTERNAL_SIGNERS_REGISTRATION: ({
     state,
-    engine
+    engine,
+    externalSigners
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -1321,6 +1440,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -1405,18 +1539,20 @@ declare const STEPS: {
     completedAt: Date | null;
   }>;
   /**
-   * Workspace initialization
+   * Seed provisioning
    */
-  readonly PENDING_WORKSPACE_INITIALIZATION: ({
+  readonly PENDING_SEED_PROVISIONING: ({
     state,
     engine
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
-  }) => Promise<{
+    externalSigners?: string[];
+  }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -1496,6 +1632,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -1580,17 +1731,20 @@ declare const STEPS: {
     completedAt: Date | null;
   }>;
   /**
-   * Onboarding completed
+   * Workspace initialization
    */
-  readonly COMPLETED: ({
-    state
+  readonly PENDING_WORKSPACE_INITIALIZATION: ({
+    state,
+    engine
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
+    externalSigners?: string[];
   }) => Promise<{
     id: string;
     workspaceName: string;
-    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+    hsmHostingMode: "HOSTED" | "ON_PREM";
+    step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
     claimedDevices: {
       pubKey: string;
       deviceUserId: string;
@@ -1670,6 +1824,21 @@ declare const STEPS: {
         };
         signature: string | null;
       } | null;
+      reviewOfExternalSigners: {
+        challenge: {
+          challengeType: "PSD";
+          wActions: string[];
+          handshake: string;
+          handshakeAttestation: {
+            codeHash: string;
+            attestationPub: string;
+            certificate: string;
+            signature: string;
+          };
+          partitionId: string;
+        };
+        signature: string | null;
+      } | null;
     }[];
     sharedOwners: {
       name: string;
@@ -1754,11 +1923,9 @@ declare const STEPS: {
     completedAt: Date | null;
   }>;
 };
-declare function onboard({
-  engine,
-  untilStep
-}: {
+declare function onboard(opts: {
   engine: Engine<WithOnboarding>;
+  externalSigners?: string[];
   untilStep?: OnboardingStep;
 }, logger: Logger): Promise<void>;
 //#endregion

package/lib/onboarding.js

@@ -1,4 +1,5 @@
 import invariant from "invariant";
+import { match } from "ts-pattern";
 //#region src/onboarding.ts
 const roleLabels = {
 	WRAPPING_KEY_OWNER: "Wrapping Key",
@@ -57,20 +58,32 @@ const deviceNameToIndex = (name) => {
 	invariant(index !== void 0, `Unknown device ${name}`);
 	return index;
 };
+const checkHsmHostingMode = (state, expectedMode) => {
+	/* v8 ignore next -- @preserve */
+	if (state.hsmHostingMode !== expectedMode) throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);
+};
+/* v8 ignore next -- @preserve */
+const checkExternalSigners = (state, externalSigners) => {
+	const hasExternalSigners = externalSigners && externalSigners.length > 0;
+	const errorMessage = match(state.hsmHostingMode).with("HOSTED", () => !hasExternalSigners ? null : "Hosted HSM does not support external signers").with("ON_PREM", () => hasExternalSigners ? null : "On-premises HSM requires at least 1 external signer").exhaustive();
+	if (errorMessage !== null) throw new Error(errorMessage);
+};
 const STEPS = {
 	PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {
 		const promises = [];
-		for (const device of devices)
- /* v8 ignore else -- @preserve */
-		if (state.claimedDevices.find(
-			/* v8 ignore next -- @preserve */
-			(c) => c.deviceName === device.name
-		) === void 0) {
-			const promise = engine.withDeviceIndex(device.index).claimDevice({
-				role: device.role,
-				deviceName: device.name
-			}).then(() => logger.info(`Claimed ${device.name}`));
-			promises.push(promise);
+		for (const device of devices) {
+			if (state.hsmHostingMode === "ON_PREM" && device.role === "SHARED_OWNER") continue;
+			/* v8 ignore else -- @preserve */
+			if (state.claimedDevices.find(
+				/* v8 ignore next -- @preserve */
+				(c) => c.deviceName === device.name
+			) === void 0) {
+				const promise = engine.withDeviceIndex(device.index).claimDevice({
+					role: device.role,
+					deviceName: device.name
+				}).then(() => logger.info(`Claimed ${device.name}`));
+				promises.push(promise);
+			}
 		}
 		await Promise.all(promises);
 		return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });
@@ -111,8 +124,12 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });
 	},
-	PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id }),
+	PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {
+		checkHsmHostingMode(state, "HOSTED");
+		return engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id });
+	},
 	PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {
+		checkHsmHostingMode(state, "HOSTED");
 		const { id: onboardingId } = state;
 		const toRegister = state.claimedDevices.filter((claimed) => {
 			if (claimed.role !== "SHARED_OWNER") return false;
@@ -143,7 +160,25 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });
 	},
+	PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {
+		checkHsmHostingMode(state, "ON_PREM");
+		invariant(externalSigners && externalSigners.length > 0, "External signers must exist");
+		const { id: onboardingId } = state;
+		state = await engine.client.onboarding.startExternalSignersRegistration.mutate({
+			onboardingId,
+			externalSigners
+		});
+		const toCollect = state.masterAdmins.filter((admin) => !admin.reviewOfExternalSigners?.signature);
+		await Promise.all(toCollect.map(async (admin) => {
+			const index = deviceNameToIndex(admin.name);
+			const challenge = admin.reviewOfExternalSigners?.challenge;
+			await engine.withDeviceIndex(index).reviewExternalSigners(challenge);
+			logger.info(`Approved with ${admin.name}`);
+		}));
+		return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });
+	},
 	PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {
+		checkHsmHostingMode(state, "HOSTED");
 		const { id: onboardingId } = state;
 		state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });
 		const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);
@@ -155,24 +190,25 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });
 	},
-	PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),
-	COMPLETED: async ({ state }) => state
+	PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id })
 };
-const STEPS_LIST = Object.values(STEPS);
-async function onboard({ engine, untilStep }, logger) {
+async function onboard(opts, logger) {
+	const { engine, externalSigners, untilStep } = opts;
 	const { __onboardingId } = engine;
 	logger.info(`Joining onboarding ${__onboardingId}`);
 	let state = await engine.client.onboarding.getOnboarding.query({ onboardingId: __onboardingId });
-	for (const step of STEPS_LIST.slice(STEPS_LIST.indexOf(STEPS[state.step]))) {
+	checkExternalSigners(state, externalSigners);
+	while (state.step !== "COMPLETED") {
 		if (untilStep && state.step === untilStep) {
 			logger.info("Skipping the rest of the onboarding");
 			break;
 		}
-		const stepProgress = `${(STEPS_LIST.indexOf(step) + 1).toString().padStart(2, "0")}/${STEPS_LIST.length}`;
-		logger.info(`(${stepProgress}) ${step.name}`);
+		const step = STEPS[state.step];
+		logger.info(step.name);
 		state = await step({
 			engine,
-			state
+			state,
+			externalSigners
 		}, logger);
 	}
 }

package/lib/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n\n  /**\n   * Onboarding completed\n   */\n  COMPLETED: async ({ state }) => state,\n} as const satisfies Record<OnboardingStep, StepAction>;\n\nconst STEPS_LIST = Object.values(STEPS);\n\nexport async function onboard(\n  {\n    engine,\n    untilStep,\n  }: {\n    engine: Engine<WithOnboarding>;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  for (const step of STEPS_LIST.slice(STEPS_LIST.indexOf(STEPS[state.step]))) {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const index = STEPS_LIST.indexOf(step);\n    const stepProgress = `${(index + 1).toString().padStart(2, \"0\")}/${STEPS_LIST.length}`;\n    logger.info(`(${stepProgress}) ${step.name}`);\n    state = await step({ engine, state }, logger);\n  }\n}\n"],"mappings":";;AAmBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,WAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU;;AAEnB,MACE,MAAM,eAAe;;IAElB,MAAM,EAAE,eAAe,OAAO;GAChC,KAAK,KAAA,GACN;GACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;IAAE,MAAM,OAAO;IAAM,YAAY,OAAO;IAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,YAAS,KAAK,QAAQ;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAMrF,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAKjF,WAAW,OAAO,EAAE,YAAY;CACjC;AAED,MAAM,aAAa,OAAO,OAAO,MAAM;AAEvC,eAAsB,QACpB,EACE,QACA,aAKF,QACe;CACf,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,MAAK,MAAM,QAAQ,WAAW,MAAM,WAAW,QAAQ,MAAM,MAAM,MAAM,CAAC,EAAE;AAC1E,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAGF,MAAM,eAAe,IADP,WAAW,QAAQ,KAAK,GACL,GAAG,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,WAAW;AAC9E,SAAO,KAAK,IAAI,aAAa,IAAI,KAAK,OAAO;AAC7C,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO,EAAE,OAAO"}
+{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    externalSigners?: string[];\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  externalSigners: string[] | undefined,\n): void => {\n  const hasExternalSigners = externalSigners && externalSigners.length > 0;\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () =>\n      !hasExternalSigners ? null : \"Hosted HSM does not support external signers\",\n    )\n    .with(\"ON_PREM\", () =>\n      hasExternalSigners ? null : \"On-premises HSM requires at least 1 external signer\",\n    )\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    invariant(externalSigners && externalSigners.length > 0, \"External signers must exist\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n      externalSigners,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    externalSigners?: string[];\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, externalSigners, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, externalSigners);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, externalSigners }, logger);\n  }\n}\n"],"mappings":";;;AAsBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,WAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,oBACS;CACT,MAAM,qBAAqB,mBAAmB,gBAAgB,SAAS;CACvE,MAAM,eAAe,MAAM,MAAM,eAAe,CAC7C,KAAK,gBACJ,CAAC,qBAAqB,OAAO,+CAC9B,CACA,KAAK,iBACJ,qBAAqB,OAAO,sDAC7B,CACA,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OAAO,EAAE,OAAO,QAAQ,mBAAmB,WAAW;AAC3F,sBAAoB,OAAO,UAAU;AACrC,YAAU,mBAAmB,gBAAgB,SAAS,GAAG,8BAA8B;EACvF,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO;GAC7E;GACA;GACD,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAKA,QACe;CACf,MAAM,EAAE,QAAQ,iBAAiB,cAAc;CAE/C,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,gBAAgB;AAE5C,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAiB,EAAE,OAAO"}

package/lib/{types-4CfR5--z.d.ts → types-BXkDuD6i.d.ts}

@@ -114,6 +114,10 @@ type DecorateWithDeviceAndOnboarding = {
    * Review Shared-Owner with Admin
    */
   reviewSharedOwner: (challenge: PsdChallenge, params?: OnboardingOperationParams) => Promise<void>;
+  /**
+   * Review external signer with Admin
+   */
+  reviewExternalSigners: (challenge: PsdChallenge, params?: OnboardingOperationParams) => Promise<void>;
   /**
    * Collect master seed fragment
    */

package/lib/{types-Byf9V35t.d.cts → types-Ngwgtu_U.d.cts}

@@ -114,6 +114,10 @@ type DecorateWithDeviceAndOnboarding = {
    * Review Shared-Owner with Admin
    */
   reviewSharedOwner: (challenge: PsdChallenge, params?: OnboardingOperationParams) => Promise<void>;
+  /**
+   * Review external signer with Admin
+   */
+  reviewExternalSigners: (challenge: PsdChallenge, params?: OnboardingOperationParams) => Promise<void>;
   /**
    * Collect master seed fragment
    */

package/lib/utils-DbSFXp4c.cjs

@@ -82,5 +82,3 @@ Object.defineProperty(exports, "fetchAllCursor", {
 		return fetchAllCursor;
 	}
 });
-
-//# sourceMappingURL=utils-DbSFXp4c.cjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ledgerhq/revault-sdk",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "license": "Apache-2.0",
   "type": "module",
   "files": [
@@ -63,7 +63,7 @@
     "ts-pattern": "^5.9.0",
     "uuid": "^13.0.0",
     "zod": "^4.3.6",
-    "@ledgerhq/revault-api": "1.56.0"
+    "@ledgerhq/revault-api": "1.57.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",