@ledgerhq/revault-sdk 0.26.6 → 0.27.0

package/lib/bake.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-CKQMccvm.cjs");
 const require_utils = require("./utils-DbSFXp4c.cjs");
-const require_crypto = require("./crypto-BDBF_rfw.cjs");
+const require_crypto = require("./crypto-rlKUKWhL.cjs");
 let invariant = require("invariant");
 invariant = require_chunk.__toESM(invariant);
 let ts_pattern = require("ts-pattern");

package/lib/bake.js

@@ -1,5 +1,5 @@
 import { n as createDeviceIndexResolver, r as fetchAll } from "./utils-BGbdjOP9.js";
-import { t as genKeys } from "./crypto-CPCBrCSZ.js";
+import { t as genKeys } from "./crypto-DdEUFJar.js";
 import invariant from "invariant";
 import { match } from "ts-pattern";
 import _ from "lodash";

package/lib/{crypto-CPCBrCSZ.js → crypto-DdEUFJar.js}

@@ -1,5 +1,6 @@
 import { sha256 } from "@noble/hashes/sha2.js";
-import { entropyToMnemonic } from "@scure/bip39";
+import { HDKey } from "@scure/bip32";
+import { entropyToMnemonic, mnemonicToSeed } from "@scure/bip39";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
 import elliptic from "elliptic";
 import * as jose from "jose";
@@ -20,6 +21,21 @@ import crypto from "node:crypto";
 function genSeed(salt, index) {
 	return entropyToMnemonic(sha256(new TextEncoder().encode(`${salt}_${index}`)), wordlist);
 }
+const getSeedFragment = async (salt, index) => {
+	const seed = await mnemonicToSeed(genSeed(salt, index));
+	const fragment = HDKey.fromMasterSeed(seed).derive("m/5655636'/4932953'");
+	return Buffer.concat([fragment.privateKey, fragment.chainCode]);
+};
+const getMasterSeed = async (salt) => {
+	const fragments = await Promise.all([
+		getSeedFragment(salt, 7),
+		getSeedFragment(salt, 8),
+		getSeedFragment(salt, 9)
+	]);
+	const masterSeed = new Uint8Array(fragments[0].length);
+	for (let i = 0; i < fragments[0].length; i++) masterSeed[i] = fragments[0][i] ^ fragments[1][i] ^ fragments[2][i];
+	return masterSeed;
+};
 //#endregion
 //#region src/crypto/key-encoder.ts
 const ECPrivateKeyASN = asn1.define("ECPrivateKey", function() {
@@ -240,6 +256,6 @@ const sign = async (privateKeyPem, base64Challenge) => {
 	}).sign(privateKey);
 };
 //#endregion
-export { sign as n, genSeed as r, genKeys as t };
+export { getMasterSeed as i, sign as n, genSeed as r, genKeys as t };
 
-//# sourceMappingURL=crypto-CPCBrCSZ.js.map
+//# sourceMappingURL=crypto-DdEUFJar.js.map

package/lib/crypto-DdEUFJar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-DdEUFJar.js","names":[],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { HDKey } from \"@scure/bip32\";\nimport { entropyToMnemonic, mnemonicToSeed } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n\nconst getSeedFragment = async (salt: string, index: number): Promise<Uint8Array> => {\n  const seed = await mnemonicToSeed(genSeed(salt, index));\n  const secpKey = HDKey.fromMasterSeed(seed);\n  const fragment = secpKey.derive(\"m/5655636'/4932953'\");\n  return Buffer.concat([fragment.privateKey!, fragment.chainCode!]);\n};\n\nexport const getMasterSeed = async (salt: string): Promise<Uint8Array> => {\n  const fragments = await Promise.all([\n    getSeedFragment(salt, 7),\n    getSeedFragment(salt, 8),\n    getSeedFragment(salt, 9),\n  ]);\n\n  const masterSeed = new Uint8Array(fragments[0].length);\n  for (let i = 0; i < fragments[0].length; i++) {\n    masterSeed[i] = fragments[0][i]! ^ fragments[1][i]! ^ fragments[2][i]!;\n  }\n\n  return masterSeed;\n};\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,MAAc,OAAuB;AAG3D,QAAO,kBADS,OADF,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAC7B,EACK,SAAS;;AAG7C,MAAM,kBAAkB,OAAO,MAAc,UAAuC;CAClF,MAAM,OAAO,MAAM,eAAe,QAAQ,MAAM,MAAM,CAAC;CAEvD,MAAM,WADU,MAAM,eAAe,KAAK,CACjB,OAAO,sBAAsB;AACtD,QAAO,OAAO,OAAO,CAAC,SAAS,YAAa,SAAS,UAAW,CAAC;;AAGnE,MAAa,gBAAgB,OAAO,SAAsC;CACxE,MAAM,YAAY,MAAM,QAAQ,IAAI;EAClC,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACzB,CAAC;CAEF,MAAM,aAAa,IAAI,WAAW,UAAU,GAAG,OAAO;AACtD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG,QAAQ,IACvC,YAAW,KAAK,UAAU,GAAG,KAAM,UAAU,GAAG,KAAM,UAAU,GAAG;AAGrE,QAAO;;;;ACzBT,MAAM,kBAAkB,KAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KAAK,IAAI,aAAa,CAAC,QAAQ,EAC/B,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EACrD,KAAK,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACtD;EACH;AAEF,MAAM,mBAAmB,KAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;AACb,OACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KACG,IAAI,sBAAsB,CAC1B,KAAK,CACL,IAAI,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClE,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,gBAAgB,EACzD,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACvD;;CAEN;AAED,MAAM,0BAA0B,KAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClF,KAAK,IAAI,MAAM,CAAC,QAAQ,CACzB;EACH;AASF,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;GAAG;EACnC,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAS,GAAG,YAAY;EACpC;CACD,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;GAAE;EAC5C,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAS,GAAG,OAAO;EAC/B;CACF;AAoBD,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;AAE1C,MAAI,OAAO,YAAY,UAAU;;AAE/B,OAAI,YAAY,eAAe,YAAY,OACzC,OAAM,IAAI,MAAM,iBAAiB,UAAU;AAE7C,aAAU,OAAO;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAE;;;CAI7C,aAAqB,YAA8C;AACjE,SAAO;GACL,SAAS,IAAI,GAAG,EAAE;GAClB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;IACnB;GACF;;CAGH,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAI,GAAG,EAAE;GAClB,YAAY,OAAO,KAAK,eAAe,MAAM;GAC7C,YAAY,KAAK,QAAQ;GAC1B;;AAGD,MAAI,aACF,kBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,MAAM;GACvC;AAGH,SAAO;;CAGT,gBAAgB,cAGd;AACA,SAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;IACrB;GACD,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,MAAM;IACvC;GACF;;CAGH,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;AAGJ,UAAQ,gBAAR;GACE,KAAK,OAAO;AACV,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;IAGjD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,MAAM,CACvC,UAAU,MAAM;AAC7C,uBAAmB,KAAK,iBAAiB,YAAY,aAAa;AAClE;;GAGF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,cAAa,OAAO,KAAK,YAAY,MAAM;AAE7C,uBAAmB,gBAAgB,OAAO,YAAY,MAAM;AAC5D;GACF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;AAEjD,uBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,kBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,6BAA6B;;AAIjD,UAAQ,mBAAR;GACE,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,iBAAiB,WAAW,SAAS,MAAM;aACzC,0BAA0B,QACnC,QAAO,KAAK,aAAa,iBAAiB,CAAC,WAAW,WAAW,SAAS,MAAM;AAElF;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,MAAM,CAAC,SAAS,MAAM;aAC7D,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,MAAM,CAAC,SACzE,MACD;AAEH;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,kBAAkB;aAC7E,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;KACR,CAAC;AAEJ;GAEF,QACE,OAAM,IAAI,MAAM,6CAA6C;;AAGjE,QAAM,IAAI,MAAM,yCAAyC;;CAG3D,aACE,WACA,gBACA,mBACQ;EAER,IAAI;AAEJ,UAAQ,gBAAR;GACE,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,KAAK,gBAAgB,UAAU;AACjD;GAEF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,aAAY,OAAO,KAAK,WAAW,MAAM;AAE3C,sBAAkB,wBAAwB,OAAO,WAAW,MAAM;AAClE;GACF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,iBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,4BAA4B;;AAIhD,UAAQ,mBAAR;GACE,KAAK,MACH,QAAO,gBAAgB,IAAI,KAAK,SAAS,MAAM;GACjD,KAAK,MACH,QAAO,wBAAwB,OAAO,iBAAiB,MAAM,CAAC,SAAS,MAAM;GAC/E,KAAK,MACH,QAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,iBACd;GAEH,QACE,OAAM,IAAI,MAAM,4CAA4C;;;;;;AC9RpE,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,KAAI,OAAO;AACX,KAAI,KAAK;AAMT,QAJkB,OAAO,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,CAGnB,MAAM,GAAG,CACpB,SAAS,MAAM,CAAC,aAAa;;AAGtD,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,EAAE,EAAU;CACtE,MAAM,aAAa,IAAI,WAAW,OAAO;AACzC,KAAI,UACF,QAAO,WAAW,cAAc,WAAW,OAAO,MAAM;AAE1D,QAAO,WAAW,aAAa,WAAW,OAAO,MAAM;;;;;;AAOzD,SAAgB,QAAQ,SAAiC;AACvD,KAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAS,GAAG,OAAO;EAClC,MAAM,gBAAgB,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM;EAC/E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,MAAM,EAC3C,CAAC;AACF,SAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACvD,WAAW,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC;GAC3E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC;GAC9F;;CAEH,MAAM,EAAE,WAAW,eAAe,OAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EAClD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EACpD,CAAC;AAEF,QAAO;EACL;EACA;EACA,WAJgB,iBAAiB,UAAU;EAK5C;;AAGH,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,gBAAgB;CAKjE,MAAM,aAAa,OAAO,iBAAiB,cAAc;AAGzD,QAAO,MAAM,IAAI,KAAK,YAAY,mBAAmB,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;EAAO,CAAC,CAChD,KAAK,WAAW"}

package/lib/{crypto-BDBF_rfw.cjs → crypto-rlKUKWhL.cjs}

@@ -1,5 +1,6 @@
 const require_chunk = require("./chunk-CKQMccvm.cjs");
 let _noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
+let _scure_bip32 = require("@scure/bip32");
 let _scure_bip39 = require("@scure/bip39");
 let _scure_bip39_wordlists_english_js = require("@scure/bip39/wordlists/english.js");
 let elliptic = require("elliptic");
@@ -26,6 +27,21 @@ node_crypto = require_chunk.__toESM(node_crypto);
 function genSeed(salt, index) {
 	return (0, _scure_bip39.entropyToMnemonic)((0, _noble_hashes_sha2_js.sha256)(new TextEncoder().encode(`${salt}_${index}`)), _scure_bip39_wordlists_english_js.wordlist);
 }
+const getSeedFragment = async (salt, index) => {
+	const seed = await (0, _scure_bip39.mnemonicToSeed)(genSeed(salt, index));
+	const fragment = _scure_bip32.HDKey.fromMasterSeed(seed).derive("m/5655636'/4932953'");
+	return Buffer.concat([fragment.privateKey, fragment.chainCode]);
+};
+const getMasterSeed = async (salt) => {
+	const fragments = await Promise.all([
+		getSeedFragment(salt, 7),
+		getSeedFragment(salt, 8),
+		getSeedFragment(salt, 9)
+	]);
+	const masterSeed = new Uint8Array(fragments[0].length);
+	for (let i = 0; i < fragments[0].length; i++) masterSeed[i] = fragments[0][i] ^ fragments[1][i] ^ fragments[2][i];
+	return masterSeed;
+};
 //#endregion
 //#region src/crypto/key-encoder.ts
 const ECPrivateKeyASN = asn1_js.default.define("ECPrivateKey", function() {
@@ -258,6 +274,12 @@ Object.defineProperty(exports, "genSeed", {
 		return genSeed;
 	}
 });
+Object.defineProperty(exports, "getMasterSeed", {
+	enumerable: true,
+	get: function() {
+		return getMasterSeed;
+	}
+});
 Object.defineProperty(exports, "sign", {
 	enumerable: true,
 	get: function() {

package/lib/crypto-rlKUKWhL.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-rlKUKWhL.cjs","names":["wordlist","HDKey","asn1","BN","crypto"],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { HDKey } from \"@scure/bip32\";\nimport { entropyToMnemonic, mnemonicToSeed } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n\nconst getSeedFragment = async (salt: string, index: number): Promise<Uint8Array> => {\n  const seed = await mnemonicToSeed(genSeed(salt, index));\n  const secpKey = HDKey.fromMasterSeed(seed);\n  const fragment = secpKey.derive(\"m/5655636'/4932953'\");\n  return Buffer.concat([fragment.privateKey!, fragment.chainCode!]);\n};\n\nexport const getMasterSeed = async (salt: string): Promise<Uint8Array> => {\n  const fragments = await Promise.all([\n    getSeedFragment(salt, 7),\n    getSeedFragment(salt, 8),\n    getSeedFragment(salt, 9),\n  ]);\n\n  const masterSeed = new Uint8Array(fragments[0].length);\n  for (let i = 0; i < fragments[0].length; i++) {\n    masterSeed[i] = fragments[0][i]! ^ fragments[1][i]! ^ fragments[2][i]!;\n  }\n\n  return masterSeed;\n};\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,SAAgB,QAAQ,MAAc,OAAuB;AAG3D,SAAA,GAAA,aAAA,oBAAA,GAAA,sBAAA,QAFc,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAC7B,EACKA,kCAAAA,SAAS;;AAG7C,MAAM,kBAAkB,OAAO,MAAc,UAAuC;CAClF,MAAM,OAAO,OAAA,GAAA,aAAA,gBAAqB,QAAQ,MAAM,MAAM,CAAC;CAEvD,MAAM,WADUC,aAAAA,MAAM,eAAe,KAAK,CACjB,OAAO,sBAAsB;AACtD,QAAO,OAAO,OAAO,CAAC,SAAS,YAAa,SAAS,UAAW,CAAC;;AAGnE,MAAa,gBAAgB,OAAO,SAAsC;CACxE,MAAM,YAAY,MAAM,QAAQ,IAAI;EAClC,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACxB,gBAAgB,MAAM,EAAE;EACzB,CAAC;CAEF,MAAM,aAAa,IAAI,WAAW,UAAU,GAAG,OAAO;AACtD,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG,QAAQ,IACvC,YAAW,KAAK,UAAU,GAAG,KAAM,UAAU,GAAG,KAAM,UAAU,GAAG;AAGrE,QAAO;;;;ACzBT,MAAM,kBAAkBC,QAAAA,QAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KAAK,IAAI,aAAa,CAAC,QAAQ,EAC/B,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EACrD,KAAK,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACtD;EACH;AAEF,MAAM,mBAAmBA,QAAAA,QAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;AACb,OACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KACG,IAAI,sBAAsB,CAC1B,KAAK,CACL,IAAI,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClE,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,gBAAgB,EACzD,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACvD;;CAEN;AAED,MAAM,0BAA0BA,QAAAA,QAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClF,KAAK,IAAI,MAAM,CAAC,QAAQ,CACzB;EACH;AASF,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;GAAG;EACnC,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAA,QAAS,GAAG,YAAY;EACpC;CACD,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;GAAE;EAC5C,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAA,QAAS,GAAG,OAAO;EAC/B;CACF;AAoBD,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;AAE1C,MAAI,OAAO,YAAY,UAAU;;AAE/B,OAAI,YAAY,eAAe,YAAY,OACzC,OAAM,IAAI,MAAM,iBAAiB,UAAU;AAE7C,aAAU,OAAO;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAE;;;CAI7C,aAAqB,YAA8C;AACjE,SAAO;GACL,SAAS,IAAIC,MAAAA,QAAG,EAAE;GAClB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;IACnB;GACF;;CAGH,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAIA,MAAAA,QAAG,EAAE;GAClB,YAAY,OAAO,KAAK,eAAe,MAAM;GAC7C,YAAY,KAAK,QAAQ;GAC1B;;AAGD,MAAI,aACF,kBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,MAAM;GACvC;AAGH,SAAO;;CAGT,gBAAgB,cAGd;AACA,SAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;IACrB;GACD,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,MAAM;IACvC;GACF;;CAGH,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;AAGJ,UAAQ,gBAAR;GACE,KAAK,OAAO;AACV,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;IAGjD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,MAAM,CACvC,UAAU,MAAM;AAC7C,uBAAmB,KAAK,iBAAiB,YAAY,aAAa;AAClE;;GAGF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,cAAa,OAAO,KAAK,YAAY,MAAM;AAE7C,uBAAmB,gBAAgB,OAAO,YAAY,MAAM;AAC5D;GACF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;AAEjD,uBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,kBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,6BAA6B;;AAIjD,UAAQ,mBAAR;GACE,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,iBAAiB,WAAW,SAAS,MAAM;aACzC,0BAA0B,QACnC,QAAO,KAAK,aAAa,iBAAiB,CAAC,WAAW,WAAW,SAAS,MAAM;AAElF;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,MAAM,CAAC,SAAS,MAAM;aAC7D,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,MAAM,CAAC,SACzE,MACD;AAEH;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,kBAAkB;aAC7E,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;KACR,CAAC;AAEJ;GAEF,QACE,OAAM,IAAI,MAAM,6CAA6C;;AAGjE,QAAM,IAAI,MAAM,yCAAyC;;CAG3D,aACE,WACA,gBACA,mBACQ;EAER,IAAI;AAEJ,UAAQ,gBAAR;GACE,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,KAAK,gBAAgB,UAAU;AACjD;GAEF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,aAAY,OAAO,KAAK,WAAW,MAAM;AAE3C,sBAAkB,wBAAwB,OAAO,WAAW,MAAM;AAClE;GACF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,iBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,4BAA4B;;AAIhD,UAAQ,mBAAR;GACE,KAAK,MACH,QAAO,gBAAgB,IAAI,KAAK,SAAS,MAAM;GACjD,KAAK,MACH,QAAO,wBAAwB,OAAO,iBAAiB,MAAM,CAAC,SAAS,MAAM;GAC/E,KAAK,MACH,QAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,iBACd;GAEH,QACE,OAAM,IAAI,MAAM,4CAA4C;;;;;;AC9RpE,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,KAAI,OAAO;AACX,KAAI,KAAK;AAMT,QAJkB,OAAO,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,CAGnB,MAAM,GAAG,CACpB,SAAS,MAAM,CAAC,aAAa;;AAGtD,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,EAAE,EAAU;CACtE,MAAM,aAAa,IAAI,WAAW,OAAO;AACzC,KAAI,UACF,QAAO,WAAW,cAAc,WAAW,OAAO,MAAM;AAE1D,QAAO,WAAW,aAAa,WAAW,OAAO,MAAM;;;;;;AAOzD,SAAgB,QAAQ,SAAiC;AACvD,KAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAA,QAAS,GAAG,OAAO;EAClC,MAAM,gBAAgBC,YAAAA,QAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM;EAC/E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,MAAM,EAC3C,CAAC;AACF,SAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACvD,WAAW,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC;GAC3E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC;GAC9F;;CAEH,MAAM,EAAE,WAAW,eAAeA,YAAAA,QAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EAClD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EACpD,CAAC;AAEF,QAAO;EACL;EACA;EACA,WAJgB,iBAAiB,UAAU;EAK5C;;AAGH,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,gBAAgB;CAKjE,MAAM,aAAaA,YAAAA,QAAO,iBAAiB,cAAc;AAGzD,QAAO,MAAM,IAAI,KAAK,YAAY,mBAAmB,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;EAAO,CAAC,CAChD,KAAK,WAAW"}

package/lib/crypto.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_crypto = require("./crypto-BDBF_rfw.cjs");
+const require_crypto = require("./crypto-rlKUKWhL.cjs");
 exports.genKeys = require_crypto.genKeys;
 exports.genSeed = require_crypto.genSeed;
+exports.getMasterSeed = require_crypto.getMasterSeed;
 exports.sign = require_crypto.sign;

package/lib/crypto.d.cts

@@ -10,6 +10,7 @@
  * @returns A 24-word BIP39 mnemonic string
  */
 declare function genSeed(salt: string, index: number): string;
+declare const getMasterSeed: (salt: string) => Promise<Uint8Array>;
 //#endregion
 //#region src/crypto/types.d.ts
 type GeneratedKeys = {
@@ -26,4 +27,4 @@ type GeneratedKeys = {
 declare function genKeys(entropy?: string): GeneratedKeys;
 declare const sign: (privateKeyPem: string, base64Challenge: string) => Promise<string>;
 //#endregion
-export { type GeneratedKeys, genKeys, genSeed, sign };
+export { type GeneratedKeys, genKeys, genSeed, getMasterSeed, sign };

package/lib/crypto.d.ts

@@ -10,6 +10,7 @@
  * @returns A 24-word BIP39 mnemonic string
  */
 declare function genSeed(salt: string, index: number): string;
+declare const getMasterSeed: (salt: string) => Promise<Uint8Array>;
 //#endregion
 //#region src/crypto/types.d.ts
 type GeneratedKeys = {
@@ -26,4 +27,4 @@ type GeneratedKeys = {
 declare function genKeys(entropy?: string): GeneratedKeys;
 declare const sign: (privateKeyPem: string, base64Challenge: string) => Promise<string>;
 //#endregion
-export { type GeneratedKeys, genKeys, genSeed, sign };
+export { type GeneratedKeys, genKeys, genSeed, getMasterSeed, sign };

package/lib/crypto.js

@@ -1,2 +1,2 @@
-import { n as sign, r as genSeed, t as genKeys } from "./crypto-CPCBrCSZ.js";
-export { genKeys, genSeed, sign };
+import { i as getMasterSeed, n as sign, r as genSeed, t as genKeys } from "./crypto-DdEUFJar.js";
+export { genKeys, genSeed, getMasterSeed, sign };

package/lib/onboarding.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-CKQMccvm.cjs");
+const require_crypto = require("./crypto-rlKUKWhL.cjs");
 let invariant = require("invariant");
 invariant = require_chunk.__toESM(invariant);
 let ts_pattern = require("ts-pattern");
@@ -66,11 +67,13 @@ const checkHsmHostingMode = (state, expectedMode) => {
 	if (state.hsmHostingMode !== expectedMode) throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);
 };
 /* v8 ignore next -- @preserve */
-const checkExternalSigners = (state, externalSigners) => {
+const checkExternalSigners = (state, externalSigners, debugAuthToken) => {
 	const hasExternalSigners = externalSigners && externalSigners.length > 0;
-	const errorMessage = (0, ts_pattern.match)(state.hsmHostingMode).with("HOSTED", () => !hasExternalSigners ? null : "Hosted HSM does not support external signers").with("ON_PREM", () => hasExternalSigners ? null : "On-premises HSM requires at least 1 external signer").exhaustive();
+	const canFetchExternalSigner = !!debugAuthToken;
+	const errorMessage = (0, ts_pattern.match)(state.hsmHostingMode).with("HOSTED", () => !hasExternalSigners ? null : "Hosted HSM does not support external signers").with("ON_PREM", () => hasExternalSigners || canFetchExternalSigner ? null : "On-premises HSM requires at least 1 external signer or a debug auth token").exhaustive();
 	if (errorMessage !== null) throw new Error(errorMessage);
 };
+const base64ToHex = (value) => Buffer.from(value, "base64").toString("hex");
 const STEPS = {
 	PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {
 		const promises = [];
@@ -163,13 +166,28 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });
 	},
-	PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {
+	PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners, debugAuthToken, signerSeed }, logger) => {
 		checkHsmHostingMode(state, "ON_PREM");
-		(0, invariant.default)(externalSigners && externalSigners.length > 0, "External signers must exist");
 		const { id: onboardingId } = state;
+		let externalSignerPublicKeys = externalSigners;
+		if (debugAuthToken) {
+			const debugClient = engine.createClient({ debugAuthToken });
+			const seed = signerSeed ?? Buffer.from(await require_crypto.getMasterSeed(engine.__options.salt)).toString("base64");
+			await debugClient.debug.insertExternalSignerSeed.mutate({
+				workspaceName: state.workspaceName,
+				seed
+			});
+			logger.info("Inserted external signer seed");
+			if (!externalSignerPublicKeys || externalSignerPublicKeys.length === 0) {
+				const { publicKey } = await debugClient.debug.getExternalSignerAuthKeypair.query({ workspaceName: state.workspaceName });
+				externalSignerPublicKeys = [base64ToHex(publicKey)];
+				logger.info("Fetched external signer public key");
+			}
+		}
+		(0, invariant.default)(externalSignerPublicKeys && externalSignerPublicKeys.length > 0, "External signers must exist");
 		state = await engine.client.onboarding.startExternalSignersRegistration.mutate({
 			onboardingId,
-			externalSigners
+			externalSigners: externalSignerPublicKeys
 		});
 		const toCollect = state.masterAdmins.filter((admin) => !admin.reviewOfExternalSigners?.signature);
 		await Promise.all(toCollect.map(async (admin) => {
@@ -196,11 +214,11 @@ const STEPS = {
 	PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id })
 };
 async function onboard(opts, logger) {
-	const { engine, externalSigners, untilStep } = opts;
+	const { engine, externalSigners, debugAuthToken, signerSeed, untilStep } = opts;
 	const { __onboardingId } = engine;
 	logger.info(`Joining onboarding ${__onboardingId}`);
 	let state = await engine.client.onboarding.getOnboarding.query({ onboardingId: __onboardingId });
-	checkExternalSigners(state, externalSigners);
+	checkExternalSigners(state, externalSigners, debugAuthToken);
 	while (state.step !== "COMPLETED") {
 		if (untilStep && state.step === untilStep) {
 			logger.info("Skipping the rest of the onboarding");
@@ -211,7 +229,9 @@ async function onboard(opts, logger) {
 		state = await step({
 			engine,
 			state,
-			externalSigners
+			externalSigners,
+			debugAuthToken,
+			signerSeed
 		}, logger);
 	}
 }

package/lib/onboarding.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.cjs","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    externalSigners?: string[];\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  externalSigners: string[] | undefined,\n): void => {\n  const hasExternalSigners = externalSigners && externalSigners.length > 0;\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () =>\n      !hasExternalSigners ? null : \"Hosted HSM does not support external signers\",\n    )\n    .with(\"ON_PREM\", () =>\n      hasExternalSigners ? null : \"On-premises HSM requires at least 1 external signer\",\n    )\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    invariant(externalSigners && externalSigners.length > 0, \"External signers must exist\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n      externalSigners,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    externalSigners?: string[];\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, externalSigners, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, externalSigners);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, externalSigners }, logger);\n  }\n}\n"],"mappings":";;;;;;AAsBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,EAAA,GAAA,UAAA,SAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,oBACS;CACT,MAAM,qBAAqB,mBAAmB,gBAAgB,SAAS;CACvE,MAAM,gBAAA,GAAA,WAAA,OAAqB,MAAM,eAAe,CAC7C,KAAK,gBACJ,CAAC,qBAAqB,OAAO,+CAC9B,CACA,KAAK,iBACJ,qBAAqB,OAAO,sDAC7B,CACA,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OAAO,EAAE,OAAO,QAAQ,mBAAmB,WAAW;AAC3F,sBAAoB,OAAO,UAAU;AACrC,GAAA,GAAA,UAAA,SAAU,mBAAmB,gBAAgB,SAAS,GAAG,8BAA8B;EACvF,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO;GAC7E;GACA;GACD,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAKA,QACe;CACf,MAAM,EAAE,QAAQ,iBAAiB,cAAc;CAE/C,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,gBAAgB;AAE5C,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAiB,EAAE,OAAO"}
+{"version":3,"file":"onboarding.cjs","names":["getMasterSeed"],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    externalSigners?: string[];\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  externalSigners: string[] | undefined,\n  debugAuthToken: string | undefined,\n): void => {\n  const hasExternalSigners = externalSigners && externalSigners.length > 0;\n  const canFetchExternalSigner = !!debugAuthToken;\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () =>\n      !hasExternalSigners ? null : \"Hosted HSM does not support external signers\",\n    )\n    .with(\"ON_PREM\", () =>\n      hasExternalSigners || canFetchExternalSigner\n        ? null\n        : \"On-premises HSM requires at least 1 external signer or a debug auth token\",\n    )\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nconst base64ToHex = (value: string): string => Buffer.from(value, \"base64\").toString(\"hex\");\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, externalSigners, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    let externalSignerPublicKeys = externalSigners;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n\n      if (!externalSignerPublicKeys || externalSignerPublicKeys.length === 0) {\n        const { publicKey } = await debugClient.debug.getExternalSignerAuthKeypair.query({\n          workspaceName: state.workspaceName,\n        });\n        externalSignerPublicKeys = [base64ToHex(publicKey)];\n        logger.info(\"Fetched external signer public key\");\n      }\n    }\n    invariant(\n      externalSignerPublicKeys && externalSignerPublicKeys.length > 0,\n      \"External signers must exist\",\n    );\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n      externalSigners: externalSignerPublicKeys,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    externalSigners?: string[];\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, externalSigners, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, externalSigners, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, externalSigners, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;;;;AAyBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,EAAA,GAAA,UAAA,SAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,iBACA,mBACS;CACT,MAAM,qBAAqB,mBAAmB,gBAAgB,SAAS;CACvE,MAAM,yBAAyB,CAAC,CAAC;CACjC,MAAM,gBAAA,GAAA,WAAA,OAAqB,MAAM,eAAe,CAC7C,KAAK,gBACJ,CAAC,qBAAqB,OAAO,+CAC9B,CACA,KAAK,iBACJ,sBAAsB,yBAClB,OACA,4EACL,CACA,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAM,eAAe,UAA0B,OAAO,KAAK,OAAO,SAAS,CAAC,SAAS,MAAM;AAE3F,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OACrC,EAAE,OAAO,QAAQ,iBAAiB,gBAAgB,cAClD,WACG;AACH,sBAAoB,OAAO,UAAU;EACrC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,2BAA2B;AAC/B,MAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,gBAAgB,CAAC;GAC3D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAMA,eAAAA,cAAc,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,SAAS;AAC1F,SAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;IACD,CAAC;AACF,UAAO,KAAK,gCAAgC;AAE5C,OAAI,CAAC,4BAA4B,yBAAyB,WAAW,GAAG;IACtE,MAAM,EAAE,cAAc,MAAM,YAAY,MAAM,6BAA6B,MAAM,EAC/E,eAAe,MAAM,eACtB,CAAC;AACF,+BAA2B,CAAC,YAAY,UAAU,CAAC;AACnD,WAAO,KAAK,qCAAqC;;;AAGrD,GAAA,GAAA,UAAA,SACE,4BAA4B,yBAAyB,SAAS,GAC9D,8BACD;AACD,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO;GAC7E;GACA,iBAAiB;GAClB,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAOA,QACe;CACf,MAAM,EAAE,QAAQ,iBAAiB,gBAAgB,YAAY,cAAc;CAE3E,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,iBAAiB,eAAe;AAE5D,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAiB;GAAgB;GAAY,EAAE,OAAO"}

package/lib/onboarding.d.cts

@@ -14,6 +14,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -47,7 +49,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -116,7 +118,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -206,6 +208,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -239,7 +243,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -308,7 +312,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -398,6 +402,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }) => Promise<{
     id: string;
     workspaceName: string;
@@ -431,7 +437,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -500,7 +506,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -590,6 +596,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -623,7 +631,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -692,7 +700,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -782,6 +790,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }) => Promise<{
     id: string;
     workspaceName: string;
@@ -815,7 +825,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -884,7 +894,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -974,6 +984,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1007,7 +1019,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1076,7 +1088,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1166,6 +1178,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1199,7 +1213,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1268,7 +1282,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1351,11 +1365,15 @@ declare const STEPS: {
   readonly PENDING_EXTERNAL_SIGNERS_REGISTRATION: ({
     state,
     engine,
-    externalSigners
+    externalSigners,
+    debugAuthToken,
+    signerSeed
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1389,7 +1407,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1458,7 +1476,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1548,6 +1566,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1581,7 +1601,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1650,7 +1670,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1740,6 +1760,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }) => Promise<{
     id: string;
     workspaceName: string;
@@ -1773,7 +1795,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1842,7 +1864,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1926,6 +1948,8 @@ declare const STEPS: {
 declare function onboard(opts: {
   engine: Engine<WithOnboarding>;
   externalSigners?: string[];
+  debugAuthToken?: string;
+  signerSeed?: string;
   untilStep?: OnboardingStep;
 }, logger: Logger): Promise<void>;
 //#endregion

package/lib/onboarding.d.ts

@@ -14,6 +14,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -47,7 +49,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -116,7 +118,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -206,6 +208,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -239,7 +243,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -308,7 +312,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -398,6 +402,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }) => Promise<{
     id: string;
     workspaceName: string;
@@ -431,7 +437,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -500,7 +506,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -590,6 +596,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -623,7 +631,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -692,7 +700,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -782,6 +790,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }) => Promise<{
     id: string;
     workspaceName: string;
@@ -815,7 +825,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -884,7 +894,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -974,6 +984,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1007,7 +1019,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1076,7 +1088,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1166,6 +1178,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1199,7 +1213,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1268,7 +1282,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1351,11 +1365,15 @@ declare const STEPS: {
   readonly PENDING_EXTERNAL_SIGNERS_REGISTRATION: ({
     state,
     engine,
-    externalSigners
+    externalSigners,
+    debugAuthToken,
+    signerSeed
   }: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1389,7 +1407,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1458,7 +1476,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1548,6 +1566,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }, logger: Logger) => Promise<{
     id: string;
     workspaceName: string;
@@ -1581,7 +1601,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1650,7 +1670,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1740,6 +1760,8 @@ declare const STEPS: {
     engine: Engine<WithOnboarding>;
     state: OnboardingFullStateResponse;
     externalSigners?: string[];
+    debugAuthToken?: string;
+    signerSeed?: string;
   }) => Promise<{
     id: string;
     workspaceName: string;
@@ -1773,7 +1795,7 @@ declare const STEPS: {
     } | null;
     masterAdmins: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1842,7 +1864,7 @@ declare const STEPS: {
     }[];
     sharedOwners: {
       name: string;
-      psdModel: "BLUE" | "STAX";
+      psdModel: "STAX";
       pubKey: string;
       registrationChallenge: {
         challenge: string;
@@ -1926,6 +1948,8 @@ declare const STEPS: {
 declare function onboard(opts: {
   engine: Engine<WithOnboarding>;
   externalSigners?: string[];
+  debugAuthToken?: string;
+  signerSeed?: string;
   untilStep?: OnboardingStep;
 }, logger: Logger): Promise<void>;
 //#endregion

package/lib/onboarding.js

@@ -1,3 +1,4 @@
+import { i as getMasterSeed } from "./crypto-DdEUFJar.js";
 import invariant from "invariant";
 import { match } from "ts-pattern";
 //#region src/onboarding.ts
@@ -63,11 +64,13 @@ const checkHsmHostingMode = (state, expectedMode) => {
 	if (state.hsmHostingMode !== expectedMode) throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);
 };
 /* v8 ignore next -- @preserve */
-const checkExternalSigners = (state, externalSigners) => {
+const checkExternalSigners = (state, externalSigners, debugAuthToken) => {
 	const hasExternalSigners = externalSigners && externalSigners.length > 0;
-	const errorMessage = match(state.hsmHostingMode).with("HOSTED", () => !hasExternalSigners ? null : "Hosted HSM does not support external signers").with("ON_PREM", () => hasExternalSigners ? null : "On-premises HSM requires at least 1 external signer").exhaustive();
+	const canFetchExternalSigner = !!debugAuthToken;
+	const errorMessage = match(state.hsmHostingMode).with("HOSTED", () => !hasExternalSigners ? null : "Hosted HSM does not support external signers").with("ON_PREM", () => hasExternalSigners || canFetchExternalSigner ? null : "On-premises HSM requires at least 1 external signer or a debug auth token").exhaustive();
 	if (errorMessage !== null) throw new Error(errorMessage);
 };
+const base64ToHex = (value) => Buffer.from(value, "base64").toString("hex");
 const STEPS = {
 	PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {
 		const promises = [];
@@ -160,13 +163,28 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });
 	},
-	PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {
+	PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners, debugAuthToken, signerSeed }, logger) => {
 		checkHsmHostingMode(state, "ON_PREM");
-		invariant(externalSigners && externalSigners.length > 0, "External signers must exist");
 		const { id: onboardingId } = state;
+		let externalSignerPublicKeys = externalSigners;
+		if (debugAuthToken) {
+			const debugClient = engine.createClient({ debugAuthToken });
+			const seed = signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString("base64");
+			await debugClient.debug.insertExternalSignerSeed.mutate({
+				workspaceName: state.workspaceName,
+				seed
+			});
+			logger.info("Inserted external signer seed");
+			if (!externalSignerPublicKeys || externalSignerPublicKeys.length === 0) {
+				const { publicKey } = await debugClient.debug.getExternalSignerAuthKeypair.query({ workspaceName: state.workspaceName });
+				externalSignerPublicKeys = [base64ToHex(publicKey)];
+				logger.info("Fetched external signer public key");
+			}
+		}
+		invariant(externalSignerPublicKeys && externalSignerPublicKeys.length > 0, "External signers must exist");
 		state = await engine.client.onboarding.startExternalSignersRegistration.mutate({
 			onboardingId,
-			externalSigners
+			externalSigners: externalSignerPublicKeys
 		});
 		const toCollect = state.masterAdmins.filter((admin) => !admin.reviewOfExternalSigners?.signature);
 		await Promise.all(toCollect.map(async (admin) => {
@@ -193,11 +211,11 @@ const STEPS = {
 	PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id })
 };
 async function onboard(opts, logger) {
-	const { engine, externalSigners, untilStep } = opts;
+	const { engine, externalSigners, debugAuthToken, signerSeed, untilStep } = opts;
 	const { __onboardingId } = engine;
 	logger.info(`Joining onboarding ${__onboardingId}`);
 	let state = await engine.client.onboarding.getOnboarding.query({ onboardingId: __onboardingId });
-	checkExternalSigners(state, externalSigners);
+	checkExternalSigners(state, externalSigners, debugAuthToken);
 	while (state.step !== "COMPLETED") {
 		if (untilStep && state.step === untilStep) {
 			logger.info("Skipping the rest of the onboarding");
@@ -208,7 +226,9 @@ async function onboard(opts, logger) {
 		state = await step({
 			engine,
 			state,
-			externalSigners
+			externalSigners,
+			debugAuthToken,
+			signerSeed
 		}, logger);
 	}
 }

package/lib/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    externalSigners?: string[];\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  externalSigners: string[] | undefined,\n): void => {\n  const hasExternalSigners = externalSigners && externalSigners.length > 0;\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () =>\n      !hasExternalSigners ? null : \"Hosted HSM does not support external signers\",\n    )\n    .with(\"ON_PREM\", () =>\n      hasExternalSigners ? null : \"On-premises HSM requires at least 1 external signer\",\n    )\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async ({ state, engine, externalSigners }, logger) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    invariant(externalSigners && externalSigners.length > 0, \"External signers must exist\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n      externalSigners,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    externalSigners?: string[];\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, externalSigners, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, externalSigners);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, externalSigners }, logger);\n  }\n}\n"],"mappings":";;;AAsBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,WAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,oBACS;CACT,MAAM,qBAAqB,mBAAmB,gBAAgB,SAAS;CACvE,MAAM,eAAe,MAAM,MAAM,eAAe,CAC7C,KAAK,gBACJ,CAAC,qBAAqB,OAAO,+CAC9B,CACA,KAAK,iBACJ,qBAAqB,OAAO,sDAC7B,CACA,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OAAO,EAAE,OAAO,QAAQ,mBAAmB,WAAW;AAC3F,sBAAoB,OAAO,UAAU;AACrC,YAAU,mBAAmB,gBAAgB,SAAS,GAAG,8BAA8B;EACvF,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO;GAC7E;GACA;GACD,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAKA,QACe;CACf,MAAM,EAAE,QAAQ,iBAAiB,cAAc;CAE/C,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,gBAAgB;AAE5C,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAiB,EAAE,OAAO"}
+{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    externalSigners?: string[];\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  externalSigners: string[] | undefined,\n  debugAuthToken: string | undefined,\n): void => {\n  const hasExternalSigners = externalSigners && externalSigners.length > 0;\n  const canFetchExternalSigner = !!debugAuthToken;\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () =>\n      !hasExternalSigners ? null : \"Hosted HSM does not support external signers\",\n    )\n    .with(\"ON_PREM\", () =>\n      hasExternalSigners || canFetchExternalSigner\n        ? null\n        : \"On-premises HSM requires at least 1 external signer or a debug auth token\",\n    )\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nconst base64ToHex = (value: string): string => Buffer.from(value, \"base64\").toString(\"hex\");\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, externalSigners, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    let externalSignerPublicKeys = externalSigners;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n\n      if (!externalSignerPublicKeys || externalSignerPublicKeys.length === 0) {\n        const { publicKey } = await debugClient.debug.getExternalSignerAuthKeypair.query({\n          workspaceName: state.workspaceName,\n        });\n        externalSignerPublicKeys = [base64ToHex(publicKey)];\n        logger.info(\"Fetched external signer public key\");\n      }\n    }\n    invariant(\n      externalSignerPublicKeys && externalSignerPublicKeys.length > 0,\n      \"External signers must exist\",\n    );\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n      externalSigners: externalSignerPublicKeys,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    externalSigners?: string[];\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, externalSigners, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, externalSigners, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, externalSigners, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;AAyBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,WAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,iBACA,mBACS;CACT,MAAM,qBAAqB,mBAAmB,gBAAgB,SAAS;CACvE,MAAM,yBAAyB,CAAC,CAAC;CACjC,MAAM,eAAe,MAAM,MAAM,eAAe,CAC7C,KAAK,gBACJ,CAAC,qBAAqB,OAAO,+CAC9B,CACA,KAAK,iBACJ,sBAAsB,yBAClB,OACA,4EACL,CACA,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAM,eAAe,UAA0B,OAAO,KAAK,OAAO,SAAS,CAAC,SAAS,MAAM;AAE3F,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OACrC,EAAE,OAAO,QAAQ,iBAAiB,gBAAgB,cAClD,WACG;AACH,sBAAoB,OAAO,UAAU;EACrC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,2BAA2B;AAC/B,MAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,gBAAgB,CAAC;GAC3D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAM,cAAc,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,SAAS;AAC1F,SAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;IACD,CAAC;AACF,UAAO,KAAK,gCAAgC;AAE5C,OAAI,CAAC,4BAA4B,yBAAyB,WAAW,GAAG;IACtE,MAAM,EAAE,cAAc,MAAM,YAAY,MAAM,6BAA6B,MAAM,EAC/E,eAAe,MAAM,eACtB,CAAC;AACF,+BAA2B,CAAC,YAAY,UAAU,CAAC;AACnD,WAAO,KAAK,qCAAqC;;;AAGrD,YACE,4BAA4B,yBAAyB,SAAS,GAC9D,8BACD;AACD,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO;GAC7E;GACA,iBAAiB;GAClB,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAOA,QACe;CACf,MAAM,EAAE,QAAQ,iBAAiB,gBAAgB,YAAY,cAAc;CAE3E,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,iBAAiB,eAAe;AAE5D,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAiB;GAAgB;GAAY,EAAE,OAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ledgerhq/revault-sdk",
-  "version": "0.26.6",
+  "version": "0.27.0",
   "license": "Apache-2.0",
   "type": "module",
   "files": [
@@ -47,6 +47,7 @@
     "@ledgerhq/errors": "^6.32.0",
     "@ledgerhq/hw-transport": "^6.34.1",
     "@noble/hashes": "^2.0.1",
+    "@scure/bip32": "^2.0.1",
     "@scure/bip39": "^2.0.1",
     "@trpc/client": "11.16.0",
     "@trpc/server": "11.16.0",
@@ -63,7 +64,7 @@
     "ts-pattern": "^5.9.0",
     "uuid": "^14.0.0",
     "zod": "^4.3.6",
-    "@ledgerhq/revault-api": "1.62.0"
+    "@ledgerhq/revault-api": "1.63.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",

package/lib/crypto-BDBF_rfw.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto-BDBF_rfw.cjs","names":["wordlist","asn1","BN","crypto"],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { entropyToMnemonic } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,MAAc,OAAuB;AAG3D,SAAA,GAAA,aAAA,oBAAA,GAAA,sBAAA,QAFc,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAC7B,EACKA,kCAAAA,SAAS;;;;ACF7C,MAAM,kBAAkBC,QAAAA,QAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KAAK,IAAI,aAAa,CAAC,QAAQ,EAC/B,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EACrD,KAAK,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACtD;EACH;AAEF,MAAM,mBAAmBA,QAAAA,QAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;AACb,OACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KACG,IAAI,sBAAsB,CAC1B,KAAK,CACL,IAAI,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClE,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,gBAAgB,EACzD,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACvD;;CAEN;AAED,MAAM,0BAA0BA,QAAAA,QAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClF,KAAK,IAAI,MAAM,CAAC,QAAQ,CACzB;EACH;AASF,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;GAAG;EACnC,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAA,QAAS,GAAG,YAAY;EACpC;CACD,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;GAAE;EAC5C,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAA,QAAS,GAAG,OAAO;EAC/B;CACF;AAoBD,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;AAE1C,MAAI,OAAO,YAAY,UAAU;;AAE/B,OAAI,YAAY,eAAe,YAAY,OACzC,OAAM,IAAI,MAAM,iBAAiB,UAAU;AAE7C,aAAU,OAAO;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAE;;;CAI7C,aAAqB,YAA8C;AACjE,SAAO;GACL,SAAS,IAAIC,MAAAA,QAAG,EAAE;GAClB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;IACnB;GACF;;CAGH,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAIA,MAAAA,QAAG,EAAE;GAClB,YAAY,OAAO,KAAK,eAAe,MAAM;GAC7C,YAAY,KAAK,QAAQ;GAC1B;;AAGD,MAAI,aACF,kBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,MAAM;GACvC;AAGH,SAAO;;CAGT,gBAAgB,cAGd;AACA,SAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;IACrB;GACD,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,MAAM;IACvC;GACF;;CAGH,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;AAGJ,UAAQ,gBAAR;GACE,KAAK,OAAO;AACV,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;IAGjD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,MAAM,CACvC,UAAU,MAAM;AAC7C,uBAAmB,KAAK,iBAAiB,YAAY,aAAa;AAClE;;GAGF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,cAAa,OAAO,KAAK,YAAY,MAAM;AAE7C,uBAAmB,gBAAgB,OAAO,YAAY,MAAM;AAC5D;GACF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;AAEjD,uBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,kBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,6BAA6B;;AAIjD,UAAQ,mBAAR;GACE,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,iBAAiB,WAAW,SAAS,MAAM;aACzC,0BAA0B,QACnC,QAAO,KAAK,aAAa,iBAAiB,CAAC,WAAW,WAAW,SAAS,MAAM;AAElF;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,MAAM,CAAC,SAAS,MAAM;aAC7D,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,MAAM,CAAC,SACzE,MACD;AAEH;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,kBAAkB;aAC7E,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;KACR,CAAC;AAEJ;GAEF,QACE,OAAM,IAAI,MAAM,6CAA6C;;AAGjE,QAAM,IAAI,MAAM,yCAAyC;;CAG3D,aACE,WACA,gBACA,mBACQ;EAER,IAAI;AAEJ,UAAQ,gBAAR;GACE,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,KAAK,gBAAgB,UAAU;AACjD;GAEF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,aAAY,OAAO,KAAK,WAAW,MAAM;AAE3C,sBAAkB,wBAAwB,OAAO,WAAW,MAAM;AAClE;GACF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,iBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,4BAA4B;;AAIhD,UAAQ,mBAAR;GACE,KAAK,MACH,QAAO,gBAAgB,IAAI,KAAK,SAAS,MAAM;GACjD,KAAK,MACH,QAAO,wBAAwB,OAAO,iBAAiB,MAAM,CAAC,SAAS,MAAM;GAC/E,KAAK,MACH,QAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,iBACd;GAEH,QACE,OAAM,IAAI,MAAM,4CAA4C;;;;;;AC9RpE,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,KAAI,OAAO;AACX,KAAI,KAAK;AAMT,QAJkB,OAAO,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,CAGnB,MAAM,GAAG,CACpB,SAAS,MAAM,CAAC,aAAa;;AAGtD,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,EAAE,EAAU;CACtE,MAAM,aAAa,IAAI,WAAW,OAAO;AACzC,KAAI,UACF,QAAO,WAAW,cAAc,WAAW,OAAO,MAAM;AAE1D,QAAO,WAAW,aAAa,WAAW,OAAO,MAAM;;;;;;AAOzD,SAAgB,QAAQ,SAAiC;AACvD,KAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAA,QAAS,GAAG,OAAO;EAClC,MAAM,gBAAgBC,YAAAA,QAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM;EAC/E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,MAAM,EAC3C,CAAC;AACF,SAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACvD,WAAW,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC;GAC3E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC;GAC9F;;CAEH,MAAM,EAAE,WAAW,eAAeA,YAAAA,QAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EAClD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EACpD,CAAC;AAEF,QAAO;EACL;EACA;EACA,WAJgB,iBAAiB,UAAU;EAK5C;;AAGH,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,gBAAgB;CAKjE,MAAM,aAAaA,YAAAA,QAAO,iBAAiB,cAAc;AAGzD,QAAO,MAAM,IAAI,KAAK,YAAY,mBAAmB,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;EAAO,CAAC,CAChD,KAAK,WAAW"}

package/lib/crypto-CPCBrCSZ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto-CPCBrCSZ.js","names":[],"sources":["../src/crypto/gen-seed.ts","../src/crypto/key-encoder.ts","../src/crypto/utils.ts"],"sourcesContent":["import { sha256 } from \"@noble/hashes/sha2.js\";\nimport { entropyToMnemonic } from \"@scure/bip39\";\nimport { wordlist } from \"@scure/bip39/wordlists/english.js\";\n\n/**\n * Generate a deterministic BIP39 mnemonic from a salt and device index.\n *\n * Produces `entropyToMnemonic(SHA256(salt + \"_\" + index))`, matching\n * the behavior of `@ledgerhq/vault-common`'s `genSeed`.\n *\n * @param salt  The workspace salt\n * @param index The device index (1-based)\n * @returns A 24-word BIP39 mnemonic string\n */\nexport function genSeed(salt: string, index: number): string {\n  const input = new TextEncoder().encode(`${salt}_${index}`);\n  const entropy = sha256(input);\n  return entropyToMnemonic(entropy, wordlist);\n}\n","// ========================================================================== //\n//                                                                            //\n//                                 DISCLAIMER                                 //\n//                                                                            //\n//                This code has been blindly copy-pasted from:                //\n//                    https://github.com/LedgerHQ/pkey-ts                     //\n//                                                                            //\n// ========================================================================== //\n//\n// @ts-expect-error this library does not ship types\nimport asn1 from \"asn1.js\";\nimport BN from \"bn.js\";\nimport elliptic from \"elliptic\";\n\n/* cspell:disable */\nconst ECPrivateKeyASN = asn1.define(\"ECPrivateKey\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"version\").int(),\n      self.key(\"privateKey\").octstr(),\n      self.key(\"parameters\").explicit(0).objid().optional(),\n      self.key(\"publicKey\").explicit(1).bitstr().optional(),\n    );\n});\n\nconst ECPrivateKey8ASN = asn1.define(\n  \"ECPrivateKey\",\n  /* v8 ignore next -- @preserve */\n  function () {\n    // @ts-expect-error pure black box\n    // biome-ignore lint/suspicious/noExplicitAny: black box\n    const self = this as any;\n    self\n      .seq()\n      .obj(\n        self.key(\"version\").int(),\n        self\n          .key(\"privateKeyAlgorithm\")\n          .seq()\n          .obj(self.key(\"ecPublicKey\").objid(), self.key(\"curve\").objid()),\n        self.key(\"privateKey\").octstr().contains(ECPrivateKeyASN),\n        self.key(\"attributes\").explicit(0).bitstr().optional(),\n      );\n  },\n);\n\nconst SubjectPublicKeyInfoASN = asn1.define(\"SubjectPublicKeyInfo\", function () {\n  // @ts-expect-error pure black box\n  // biome-ignore lint/suspicious/noExplicitAny: black box\n  const self = this as any;\n  self\n    .seq()\n    .obj(\n      self.key(\"algorithm\").seq().obj(self.key(\"id\").objid(), self.key(\"curve\").objid()),\n      self.key(\"pub\").bitstr(),\n    );\n});\n\ntype CurveOptions = {\n  curveParameters: number[];\n  privatePEMOptions: { label: string };\n  publicPEMOptions: { label: string };\n  curve: elliptic.ec;\n};\n\nconst curves: Record<string, CurveOptions> = {\n  secp256k1: {\n    curveParameters: [1, 3, 132, 0, 10],\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"secp256k1\"),\n  },\n  p256: {\n    curveParameters: [1, 2, 840, 10045, 3, 1, 7], // OID for p256 curve\n    privatePEMOptions: { label: \"EC PRIVATE KEY\" },\n    publicPEMOptions: { label: \"PUBLIC KEY\" },\n    curve: new elliptic.ec(\"p256\"),\n  },\n};\n\ntype PrivateKeyPKCS1 = {\n  version: BN;\n  privateKey: Buffer;\n  parameters: number[];\n  publicKey?: {\n    unused: number;\n    data: Buffer;\n  };\n};\n\ntype PrivateKeyPKCS8 = {\n  version: BN;\n  privateKey: PrivateKeyPKCS1;\n  privateKeyAlgorithm: { ecPublicKey: number[]; curve: number[] };\n};\n\nexport type KeyFormat = \"raw\" | \"pem\" | \"der\";\n\nexport class KeyEncoder {\n  algorithmID: number[];\n  options: CurveOptions;\n\n  constructor(options: string | CurveOptions) {\n    /* v8 ignore else -- @preserve */\n    if (typeof options === \"string\") {\n      /* v8 ignore if -- @preserve */\n      if (options !== \"secp256k1\" && options !== \"p256\") {\n        throw new Error(`Unknown curve ${options}`);\n      }\n      options = curves[options]!;\n    }\n    this.options = options;\n    this.algorithmID = [1, 2, 840, 10045, 2, 1];\n  }\n\n  /* v8 ignore next -- @preserve */\n  private PKCS1toPKCS8(privateKey: PrivateKeyPKCS1): PrivateKeyPKCS8 {\n    return {\n      version: new BN(0),\n      privateKey,\n      privateKeyAlgorithm: {\n        ecPublicKey: this.algorithmID,\n        curve: privateKey.parameters,\n      },\n    };\n  }\n\n  privateKeyObject(rawPrivateKey: string, rawPublicKey: string): PrivateKeyPKCS1 {\n    const privateKeyObject: PrivateKeyPKCS1 = {\n      version: new BN(1),\n      privateKey: Buffer.from(rawPrivateKey, \"hex\"),\n      parameters: this.options.curveParameters,\n    };\n\n    /* v8 ignore else -- @preserve */\n    if (rawPublicKey) {\n      privateKeyObject.publicKey = {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      };\n    }\n\n    return privateKeyObject;\n  }\n\n  publicKeyObject(rawPublicKey: string): {\n    algorithm: { id: number[]; curve: number[] };\n    pub: { unused: number; data: Buffer };\n  } {\n    return {\n      algorithm: {\n        id: this.algorithmID,\n        curve: this.options.curveParameters,\n      },\n      pub: {\n        unused: 0,\n        data: Buffer.from(rawPublicKey, \"hex\"),\n      },\n    };\n  }\n\n  encodePrivate(\n    privateKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n    destinationFormatType: \"pkcs8\" | \"pkcs1\" = \"pkcs1\",\n  ): string {\n    let privateKeyObject: PrivateKeyPKCS1;\n\n    /* Parse the incoming private key and convert it to a private key object */\n    switch (originalFormat) {\n      case \"raw\": {\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        const keyPair = this.options.curve.keyFromPrivate(privateKey, \"hex\");\n        const rawPublicKey = keyPair.getPublic(\"hex\");\n        privateKeyObject = this.privateKeyObject(privateKey, rawPublicKey);\n        break;\n      }\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof privateKey === \"string\") {\n          privateKey = Buffer.from(privateKey, \"hex\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(privateKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof privateKey !== \"string\") {\n          throw new Error(\"private key must be a string\");\n        }\n        privateKeyObject = ECPrivateKeyASN.decode(\n          privateKey,\n          \"pem\",\n          this.options.privatePEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid private key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        if (destinationFormatType === \"pkcs1\") {\n          return privateKeyObject.privateKey.toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return this.PKCS1toPKCS8(privateKeyObject).privateKey.privateKey.toString(\"hex\");\n        }\n        break;\n      case \"der\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"der\").toString(\"hex\");\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"der\").toString(\n            \"hex\",\n          );\n        }\n        break;\n      case \"pem\":\n        if (destinationFormatType === \"pkcs1\") {\n          return ECPrivateKeyASN.encode(privateKeyObject, \"pem\", this.options.privatePEMOptions);\n        } else if (destinationFormatType === \"pkcs8\") {\n          return ECPrivateKey8ASN.encode(this.PKCS1toPKCS8(privateKeyObject), \"pem\", {\n            ...this.options.privatePEMOptions,\n            label: \"PRIVATE KEY\",\n          });\n        }\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for private key\");\n    }\n\n    throw new Error(\"unsupported destination format or type\");\n  }\n\n  encodePublic(\n    publicKey: string | Buffer,\n    originalFormat: KeyFormat,\n    destinationFormat: KeyFormat,\n  ): string {\n    // biome-ignore lint/suspicious/noImplicitAnyLet: melting pot object\n    let publicKeyObject;\n\n    switch (originalFormat) {\n      case \"raw\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = this.publicKeyObject(publicKey);\n        break;\n      /* v8 ignore next -- @preserve */\n      case \"der\":\n        if (typeof publicKey === \"string\") {\n          publicKey = Buffer.from(publicKey, \"hex\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(publicKey, \"der\");\n        break;\n      case \"pem\":\n        if (typeof publicKey !== \"string\") {\n          throw new Error(\"public key must be a string\");\n        }\n        publicKeyObject = SubjectPublicKeyInfoASN.decode(\n          publicKey,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n        break;\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid public key format\");\n    }\n\n    /* Export the private key object to the desired format */\n    switch (destinationFormat) {\n      case \"raw\":\n        return publicKeyObject.pub.data.toString(\"hex\");\n      case \"der\":\n        return SubjectPublicKeyInfoASN.encode(publicKeyObject, \"der\").toString(\"hex\");\n      case \"pem\":\n        return SubjectPublicKeyInfoASN.encode(\n          publicKeyObject,\n          \"pem\",\n          this.options.publicPEMOptions,\n        );\n      /* v8 ignore next -- @preserve */\n      default:\n        throw new Error(\"invalid destination format for public key\");\n    }\n  }\n}\n/* cspell:enable */\n","import elliptic from \"elliptic\";\nimport * as jose from \"jose\";\n\nimport { KeyEncoder } from \"./key-encoder\";\nimport type { GeneratedKeys } from \"./types\";\nimport crypto from \"node:crypto\";\n\nfunction extractPublicKey(pemKey: string): string {\n  // convert the PEM formatted public key to raw public key in X9.62 uncompressed format\n  // this is an oversimplified method and may not work with different curves or PEM formats\n  const pem = pemKey.split(\"\\n\");\n  pem.shift(); // remove the first line (BEGIN PUBLIC KEY)\n  pem.pop(); // remove the last line (END PUBLIC KEY)\n  // convert base64 to buffer\n  const keyBuffer = Buffer.from(pem.join(\"\"), \"base64\");\n  // assuming the first 26 bytes are the header for the SPKI formatted key.\n  // the actual key should begin after this header.\n  const actualKeyBuffer = keyBuffer.slice(26);\n  return actualKeyBuffer.toString(\"hex\").toUpperCase();\n}\n\nfunction hexToPem(hexString: string, { isPrivate = true } = {}): string {\n  const keyEncoder = new KeyEncoder(\"p256\");\n  if (isPrivate) {\n    return keyEncoder.encodePrivate(hexString, \"raw\", \"pem\");\n  }\n  return keyEncoder.encodePublic(hexString, \"raw\", \"pem\");\n}\n\n/**\n * If `entropy` is passed, will generate keys pair deterministically\n * else, random keys pair generated\n */\nexport function genKeys(entropy?: string): GeneratedKeys {\n  if (entropy) {\n    const ec = new elliptic.ec(\"p256\");\n    const hashedEntropy = crypto.createHash(\"sha256\").update(entropy).digest(\"hex\");\n    const keyPair = ec.genKeyPair({\n      entropy: Buffer.from(hashedEntropy, \"hex\"),\n    });\n    return {\n      privateKey: String(hexToPem(keyPair.getPrivate(\"hex\"))),\n      publicKey: String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false })),\n      hexPubKey: extractPublicKey(String(hexToPem(keyPair.getPublic(\"hex\"), { isPrivate: false }))),\n    };\n  }\n  const { publicKey, privateKey } = crypto.generateKeyPairSync(\"ec\", {\n    namedCurve: \"P-256\",\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n    privateKeyEncoding: { type: \"sec1\", format: \"pem\" },\n  });\n  const hexPubKey = extractPublicKey(publicKey);\n  return {\n    privateKey,\n    publicKey,\n    hexPubKey,\n  };\n}\n\nexport const sign = async (privateKeyPem: string, base64Challenge: string): Promise<string> => {\n  // Decode base64url challenge to bytes\n  const challengeDataBytes = jose.base64url.decode(base64Challenge);\n\n  // For EC private key format, we need to use a different import method\n  // Since jose doesn't support SEC1 format directly, let's use Node.js crypto\n  // Create a KeyObject from the EC private key\n  const privateKey = crypto.createPrivateKey(privateKeyPem);\n\n  // Use jose with the KeyObject\n  return await new jose.CompactSign(challengeDataBytes)\n    .setProtectedHeader({ alg: \"ES256\", typ: \"JWT\" })\n    .sign(privateKey);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,MAAc,OAAuB;AAG3D,QAAO,kBADS,OADF,IAAI,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAC7B,EACK,SAAS;;;;ACF7C,MAAM,kBAAkB,KAAK,OAAO,gBAAgB,WAAY;CAG9D,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KAAK,IAAI,aAAa,CAAC,QAAQ,EAC/B,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EACrD,KAAK,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACtD;EACH;AAEF,MAAM,mBAAmB,KAAK;CAC5B;;CAEA,WAAY;EAGV,MAAM,OAAO;AACb,OACG,KAAK,CACL,IACC,KAAK,IAAI,UAAU,CAAC,KAAK,EACzB,KACG,IAAI,sBAAsB,CAC1B,KAAK,CACL,IAAI,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClE,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,gBAAgB,EACzD,KAAK,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CACvD;;CAEN;AAED,MAAM,0BAA0B,KAAK,OAAO,wBAAwB,WAAY;CAG9E,MAAM,OAAO;AACb,MACG,KAAK,CACL,IACC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,EAClF,KAAK,IAAI,MAAM,CAAC,QAAQ,CACzB;EACH;AASF,MAAM,SAAuC;CAC3C,WAAW;EACT,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAG;GAAG;EACnC,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAS,GAAG,YAAY;EACpC;CACD,MAAM;EACJ,iBAAiB;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAG;GAAE;EAC5C,mBAAmB,EAAE,OAAO,kBAAkB;EAC9C,kBAAkB,EAAE,OAAO,cAAc;EACzC,OAAO,IAAI,SAAS,GAAG,OAAO;EAC/B;CACF;AAoBD,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,SAAgC;;AAE1C,MAAI,OAAO,YAAY,UAAU;;AAE/B,OAAI,YAAY,eAAe,YAAY,OACzC,OAAM,IAAI,MAAM,iBAAiB,UAAU;AAE7C,aAAU,OAAO;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;GAAC;GAAG;GAAG;GAAK;GAAO;GAAG;GAAE;;;CAI7C,aAAqB,YAA8C;AACjE,SAAO;GACL,SAAS,IAAI,GAAG,EAAE;GAClB;GACA,qBAAqB;IACnB,aAAa,KAAK;IAClB,OAAO,WAAW;IACnB;GACF;;CAGH,iBAAiB,eAAuB,cAAuC;EAC7E,MAAM,mBAAoC;GACxC,SAAS,IAAI,GAAG,EAAE;GAClB,YAAY,OAAO,KAAK,eAAe,MAAM;GAC7C,YAAY,KAAK,QAAQ;GAC1B;;AAGD,MAAI,aACF,kBAAiB,YAAY;GAC3B,QAAQ;GACR,MAAM,OAAO,KAAK,cAAc,MAAM;GACvC;AAGH,SAAO;;CAGT,gBAAgB,cAGd;AACA,SAAO;GACL,WAAW;IACT,IAAI,KAAK;IACT,OAAO,KAAK,QAAQ;IACrB;GACD,KAAK;IACH,QAAQ;IACR,MAAM,OAAO,KAAK,cAAc,MAAM;IACvC;GACF;;CAGH,cACE,YACA,gBACA,mBACA,wBAA2C,SACnC;EACR,IAAI;AAGJ,UAAQ,gBAAR;GACE,KAAK,OAAO;AACV,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;IAGjD,MAAM,eADU,KAAK,QAAQ,MAAM,eAAe,YAAY,MAAM,CACvC,UAAU,MAAM;AAC7C,uBAAmB,KAAK,iBAAiB,YAAY,aAAa;AAClE;;GAGF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,cAAa,OAAO,KAAK,YAAY,MAAM;AAE7C,uBAAmB,gBAAgB,OAAO,YAAY,MAAM;AAC5D;GACF,KAAK;AACH,QAAI,OAAO,eAAe,SACxB,OAAM,IAAI,MAAM,+BAA+B;AAEjD,uBAAmB,gBAAgB,OACjC,YACA,OACA,KAAK,QAAQ,kBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,6BAA6B;;AAIjD,UAAQ,mBAAR;GACE,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,iBAAiB,WAAW,SAAS,MAAM;aACzC,0BAA0B,QACnC,QAAO,KAAK,aAAa,iBAAiB,CAAC,WAAW,WAAW,SAAS,MAAM;AAElF;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,MAAM,CAAC,SAAS,MAAM;aAC7D,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,MAAM,CAAC,SACzE,MACD;AAEH;GACF,KAAK;AACH,QAAI,0BAA0B,QAC5B,QAAO,gBAAgB,OAAO,kBAAkB,OAAO,KAAK,QAAQ,kBAAkB;aAC7E,0BAA0B,QACnC,QAAO,iBAAiB,OAAO,KAAK,aAAa,iBAAiB,EAAE,OAAO;KACzE,GAAG,KAAK,QAAQ;KAChB,OAAO;KACR,CAAC;AAEJ;GAEF,QACE,OAAM,IAAI,MAAM,6CAA6C;;AAGjE,QAAM,IAAI,MAAM,yCAAyC;;CAG3D,aACE,WACA,gBACA,mBACQ;EAER,IAAI;AAEJ,UAAQ,gBAAR;GACE,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,KAAK,gBAAgB,UAAU;AACjD;GAEF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,aAAY,OAAO,KAAK,WAAW,MAAM;AAE3C,sBAAkB,wBAAwB,OAAO,WAAW,MAAM;AAClE;GACF,KAAK;AACH,QAAI,OAAO,cAAc,SACvB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,sBAAkB,wBAAwB,OACxC,WACA,OACA,KAAK,QAAQ,iBACd;AACD;GAEF,QACE,OAAM,IAAI,MAAM,4BAA4B;;AAIhD,UAAQ,mBAAR;GACE,KAAK,MACH,QAAO,gBAAgB,IAAI,KAAK,SAAS,MAAM;GACjD,KAAK,MACH,QAAO,wBAAwB,OAAO,iBAAiB,MAAM,CAAC,SAAS,MAAM;GAC/E,KAAK,MACH,QAAO,wBAAwB,OAC7B,iBACA,OACA,KAAK,QAAQ,iBACd;GAEH,QACE,OAAM,IAAI,MAAM,4CAA4C;;;;;;AC9RpE,SAAS,iBAAiB,QAAwB;CAGhD,MAAM,MAAM,OAAO,MAAM,KAAK;AAC9B,KAAI,OAAO;AACX,KAAI,KAAK;AAMT,QAJkB,OAAO,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,CAGnB,MAAM,GAAG,CACpB,SAAS,MAAM,CAAC,aAAa;;AAGtD,SAAS,SAAS,WAAmB,EAAE,YAAY,SAAS,EAAE,EAAU;CACtE,MAAM,aAAa,IAAI,WAAW,OAAO;AACzC,KAAI,UACF,QAAO,WAAW,cAAc,WAAW,OAAO,MAAM;AAE1D,QAAO,WAAW,aAAa,WAAW,OAAO,MAAM;;;;;;AAOzD,SAAgB,QAAQ,SAAiC;AACvD,KAAI,SAAS;EACX,MAAM,KAAK,IAAI,SAAS,GAAG,OAAO;EAClC,MAAM,gBAAgB,OAAO,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM;EAC/E,MAAM,UAAU,GAAG,WAAW,EAC5B,SAAS,OAAO,KAAK,eAAe,MAAM,EAC3C,CAAC;AACF,SAAO;GACL,YAAY,OAAO,SAAS,QAAQ,WAAW,MAAM,CAAC,CAAC;GACvD,WAAW,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC;GAC3E,WAAW,iBAAiB,OAAO,SAAS,QAAQ,UAAU,MAAM,EAAE,EAAE,WAAW,OAAO,CAAC,CAAC,CAAC;GAC9F;;CAEH,MAAM,EAAE,WAAW,eAAe,OAAO,oBAAoB,MAAM;EACjE,YAAY;EACZ,mBAAmB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EAClD,oBAAoB;GAAE,MAAM;GAAQ,QAAQ;GAAO;EACpD,CAAC;AAEF,QAAO;EACL;EACA;EACA,WAJgB,iBAAiB,UAAU;EAK5C;;AAGH,MAAa,OAAO,OAAO,eAAuB,oBAA6C;CAE7F,MAAM,qBAAqB,KAAK,UAAU,OAAO,gBAAgB;CAKjE,MAAM,aAAa,OAAO,iBAAiB,cAAc;AAGzD,QAAO,MAAM,IAAI,KAAK,YAAY,mBAAmB,CAClD,mBAAmB;EAAE,KAAK;EAAS,KAAK;EAAO,CAAC,CAChD,KAAK,WAAW"}