@ledgerhq/revault-sdk 0.27.9 → 0.27.11

package/lib/device-DBzLykrI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-DBzLykrI.js","names":["uuidv4"],"sources":["../../../node_modules/.pnpm/is-retry-allowed@2.2.0/node_modules/is-retry-allowed/index.js","../../../node_modules/.pnpm/axios-retry@4.5.0_axios@1.17.0/node_modules/axios-retry/dist/esm/index.js","../src/device/constants.ts","../src/device/api-device.ts","../../../node_modules/.pnpm/@ledgerhq+errors@6.36.0/node_modules/@ledgerhq/errors/lib-es/helpers.js","../../../node_modules/.pnpm/@ledgerhq+errors@6.36.0/node_modules/@ledgerhq/errors/lib-es/index.js","../src/device/device-access.ts","../src/device/utils.ts"],"sourcesContent":["'use strict';\n\nconst denyList = new Set([\n\t'ENOTFOUND',\n\t'ENETUNREACH',\n\n\t// SSL errors from https://github.com/nodejs/node/blob/fc8e3e2cdc521978351de257030db0076d79e0ab/src/crypto/crypto_common.cc#L301-L328\n\t'UNABLE_TO_GET_ISSUER_CERT',\n\t'UNABLE_TO_GET_CRL',\n\t'UNABLE_TO_DECRYPT_CERT_SIGNATURE',\n\t'UNABLE_TO_DECRYPT_CRL_SIGNATURE',\n\t'UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY',\n\t'CERT_SIGNATURE_FAILURE',\n\t'CRL_SIGNATURE_FAILURE',\n\t'CERT_NOT_YET_VALID',\n\t'CERT_HAS_EXPIRED',\n\t'CRL_NOT_YET_VALID',\n\t'CRL_HAS_EXPIRED',\n\t'ERROR_IN_CERT_NOT_BEFORE_FIELD',\n\t'ERROR_IN_CERT_NOT_AFTER_FIELD',\n\t'ERROR_IN_CRL_LAST_UPDATE_FIELD',\n\t'ERROR_IN_CRL_NEXT_UPDATE_FIELD',\n\t'OUT_OF_MEM',\n\t'DEPTH_ZERO_SELF_SIGNED_CERT',\n\t'SELF_SIGNED_CERT_IN_CHAIN',\n\t'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',\n\t'UNABLE_TO_VERIFY_LEAF_SIGNATURE',\n\t'CERT_CHAIN_TOO_LONG',\n\t'CERT_REVOKED',\n\t'INVALID_CA',\n\t'PATH_LENGTH_EXCEEDED',\n\t'INVALID_PURPOSE',\n\t'CERT_UNTRUSTED',\n\t'CERT_REJECTED',\n\t'HOSTNAME_MISMATCH'\n]);\n\n// TODO: Use `error?.code` when targeting Node.js 14\nmodule.exports = error => !denyList.has(error && error.code);\n","import isRetryAllowed from 'is-retry-allowed';\nexport const namespace = 'axios-retry';\nexport function isNetworkError(error) {\n    const CODE_EXCLUDE_LIST = ['ERR_CANCELED', 'ECONNABORTED'];\n    if (error.response) {\n        return false;\n    }\n    if (!error.code) {\n        return false;\n    }\n    // Prevents retrying timed out & cancelled requests\n    if (CODE_EXCLUDE_LIST.includes(error.code)) {\n        return false;\n    }\n    // Prevents retrying unsafe errors\n    return isRetryAllowed(error);\n}\nconst SAFE_HTTP_METHODS = ['get', 'head', 'options'];\nconst IDEMPOTENT_HTTP_METHODS = SAFE_HTTP_METHODS.concat(['put', 'delete']);\nexport function isRetryableError(error) {\n    return (error.code !== 'ECONNABORTED' &&\n        (!error.response ||\n            error.response.status === 429 ||\n            (error.response.status >= 500 && error.response.status <= 599)));\n}\nexport function isSafeRequestError(error) {\n    if (!error.config?.method) {\n        // Cannot determine if the request can be retried\n        return false;\n    }\n    return isRetryableError(error) && SAFE_HTTP_METHODS.indexOf(error.config.method) !== -1;\n}\nexport function isIdempotentRequestError(error) {\n    if (!error.config?.method) {\n        // Cannot determine if the request can be retried\n        return false;\n    }\n    return isRetryableError(error) && IDEMPOTENT_HTTP_METHODS.indexOf(error.config.method) !== -1;\n}\nexport function isNetworkOrIdempotentRequestError(error) {\n    return isNetworkError(error) || isIdempotentRequestError(error);\n}\nexport function retryAfter(error = undefined) {\n    const retryAfterHeader = error?.response?.headers['retry-after'];\n    if (!retryAfterHeader) {\n        return 0;\n    }\n    // if the retry after header is a number, convert it to milliseconds\n    let retryAfterMs = (Number(retryAfterHeader) || 0) * 1000;\n    // If the retry after header is a date, get the number of milliseconds until that date\n    if (retryAfterMs === 0) {\n        retryAfterMs = (new Date(retryAfterHeader).valueOf() || 0) - Date.now();\n    }\n    return Math.max(0, retryAfterMs);\n}\nfunction noDelay(_retryNumber = 0, error = undefined) {\n    return Math.max(0, retryAfter(error));\n}\nexport function exponentialDelay(retryNumber = 0, error = undefined, delayFactor = 100) {\n    const calculatedDelay = 2 ** retryNumber * delayFactor;\n    const delay = Math.max(calculatedDelay, retryAfter(error));\n    const randomSum = delay * 0.2 * Math.random(); // 0-20% of the delay\n    return delay + randomSum;\n}\n/**\n * Linear delay\n * @param {number | undefined} delayFactor - delay factor in milliseconds (default: 100)\n * @returns {function} (retryNumber: number, error: AxiosError | undefined) => number\n */\nexport function linearDelay(delayFactor = 100) {\n    return (retryNumber = 0, error = undefined) => {\n        const delay = retryNumber * delayFactor;\n        return Math.max(delay, retryAfter(error));\n    };\n}\nexport const DEFAULT_OPTIONS = {\n    retries: 3,\n    retryCondition: isNetworkOrIdempotentRequestError,\n    retryDelay: noDelay,\n    shouldResetTimeout: false,\n    onRetry: () => { },\n    onMaxRetryTimesExceeded: () => { },\n    validateResponse: null\n};\nfunction getRequestOptions(config, defaultOptions) {\n    return { ...DEFAULT_OPTIONS, ...defaultOptions, ...config[namespace] };\n}\nfunction setCurrentState(config, defaultOptions, resetLastRequestTime = false) {\n    const currentState = getRequestOptions(config, defaultOptions || {});\n    currentState.retryCount = currentState.retryCount || 0;\n    if (!currentState.lastRequestTime || resetLastRequestTime) {\n        currentState.lastRequestTime = Date.now();\n    }\n    config[namespace] = currentState;\n    return currentState;\n}\nfunction fixConfig(axiosInstance, config) {\n    // @ts-ignore\n    if (axiosInstance.defaults.agent === config.agent) {\n        // @ts-ignore\n        delete config.agent;\n    }\n    if (axiosInstance.defaults.httpAgent === config.httpAgent) {\n        delete config.httpAgent;\n    }\n    if (axiosInstance.defaults.httpsAgent === config.httpsAgent) {\n        delete config.httpsAgent;\n    }\n}\nasync function shouldRetry(currentState, error) {\n    const { retries, retryCondition } = currentState;\n    const shouldRetryOrPromise = (currentState.retryCount || 0) < retries && retryCondition(error);\n    // This could be a promise\n    if (typeof shouldRetryOrPromise === 'object') {\n        try {\n            const shouldRetryPromiseResult = await shouldRetryOrPromise;\n            // keep return true unless shouldRetryPromiseResult return false for compatibility\n            return shouldRetryPromiseResult !== false;\n        }\n        catch (_err) {\n            return false;\n        }\n    }\n    return shouldRetryOrPromise;\n}\nasync function handleRetry(axiosInstance, currentState, error, config) {\n    currentState.retryCount += 1;\n    const { retryDelay, shouldResetTimeout, onRetry } = currentState;\n    const delay = retryDelay(currentState.retryCount, error);\n    // Axios fails merging this configuration to the default configuration because it has an issue\n    // with circular structures: https://github.com/mzabriskie/axios/issues/370\n    fixConfig(axiosInstance, config);\n    if (!shouldResetTimeout && config.timeout && currentState.lastRequestTime) {\n        const lastRequestDuration = Date.now() - currentState.lastRequestTime;\n        const timeout = config.timeout - lastRequestDuration - delay;\n        if (timeout <= 0) {\n            return Promise.reject(error);\n        }\n        config.timeout = timeout;\n    }\n    config.transformRequest = [(data) => data];\n    await onRetry(currentState.retryCount, error, config);\n    if (config.signal?.aborted) {\n        return Promise.resolve(axiosInstance(config));\n    }\n    return new Promise((resolve) => {\n        const abortListener = () => {\n            clearTimeout(timeout);\n            resolve(axiosInstance(config));\n        };\n        const timeout = setTimeout(() => {\n            resolve(axiosInstance(config));\n            if (config.signal?.removeEventListener) {\n                config.signal.removeEventListener('abort', abortListener);\n            }\n        }, delay);\n        if (config.signal?.addEventListener) {\n            config.signal.addEventListener('abort', abortListener, { once: true });\n        }\n    });\n}\nasync function handleMaxRetryTimesExceeded(currentState, error) {\n    if (currentState.retryCount >= currentState.retries)\n        await currentState.onMaxRetryTimesExceeded(error, currentState.retryCount);\n}\nconst axiosRetry = (axiosInstance, defaultOptions) => {\n    const requestInterceptorId = axiosInstance.interceptors.request.use((config) => {\n        setCurrentState(config, defaultOptions, true);\n        if (config[namespace]?.validateResponse) {\n            // by setting this, all HTTP responses will be go through the error interceptor first\n            config.validateStatus = () => false;\n        }\n        return config;\n    });\n    const responseInterceptorId = axiosInstance.interceptors.response.use(null, async (error) => {\n        const { config } = error;\n        // If we have no information to retry the request\n        if (!config) {\n            return Promise.reject(error);\n        }\n        const currentState = setCurrentState(config, defaultOptions);\n        if (error.response && currentState.validateResponse?.(error.response)) {\n            // no issue with response\n            return error.response;\n        }\n        if (await shouldRetry(currentState, error)) {\n            return handleRetry(axiosInstance, currentState, error, config);\n        }\n        await handleMaxRetryTimesExceeded(currentState, error);\n        return Promise.reject(error);\n    });\n    return { requestInterceptorId, responseInterceptorId };\n};\n// Compatibility with CommonJS\naxiosRetry.isNetworkError = isNetworkError;\naxiosRetry.isSafeRequestError = isSafeRequestError;\naxiosRetry.isIdempotentRequestError = isIdempotentRequestError;\naxiosRetry.isNetworkOrIdempotentRequestError = isNetworkOrIdempotentRequestError;\naxiosRetry.exponentialDelay = exponentialDelay;\naxiosRetry.linearDelay = linearDelay;\naxiosRetry.isRetryableError = isRetryableError;\nexport default axiosRetry;\n","export const PATHS = {\n  U2F: \"5655636'/5583430'\",\n  CONFIDENTIALITY: \"5655636'/4410950'\",\n  KEY_MATERIAL: \"5655636'/4932953'\",\n  VALIDATION: \"5655636'/5652812'\",\n} as const;\n\nexport const STATUS_LENGTH = 2;\n\nexport const SCRIPT_IDS = {\n  INIT_SESSION: 3,\n  ACCOUNT_MANAGER_SESSION: 2,\n} as const;\n\nexport const STR_ROLES: Record<\"OPERATOR\" | \"ADMIN\" | \"SHARED_OWNER\", string> = {\n  OPERATOR: \"00\",\n  ADMIN: \"01\",\n  SHARED_OWNER: \"02\",\n} as const;\n\nexport const APPID_VAULT_ADMINISTRATOR =\n  \"ad5be1a1fe011ce7f53ae081a22ae000a42021f3f94106a3bac9f76e8230e4b9\";\n\nconst all61xxStatus = [];\nfor (let i = 0x6100; i <= 0x61ff; i++) {\n  all61xxStatus.push(i);\n}\n\nexport const PAGINATED_STATUS = all61xxStatus;\nexport const STREAMING_RESPONSE = 0x02;\nexport const STREAMING_NEXT_ACTION = 0x01;\n","import type {\n  HsmCertificate,\n  PsdAuthChallengeResponse,\n  PsdPairingData,\n  PubKey,\n} from \"@ledgerhq/revault-api\";\nimport axios from \"axios\";\nimport axiosRetry from \"axios-retry\";\nimport { v4 as uuidv4 } from \"uuid\";\n\nimport type { Logger } from \"@/logger\";\n\nimport { APPID_VAULT_ADMINISTRATOR, PATHS, SCRIPT_IDS, STR_ROLES } from \"./constants\";\nimport type { Device } from \"./types\";\n\ntype Options = {\n  /**\n   * device-api URL\n   */\n  deviceApiUrl: string;\n\n  /**\n   * salt used by device-api\n   */\n  salt: string;\n\n  /**\n   * seed generation function used for device-api device spawn\n   */\n  genSeed: (p: { salt: string; index: number }) => string | Promise<string>;\n};\n\nexport type ApiDevice = {\n  /**\n   * bind a device to the given device index\n   */\n  with: (index: number) => Device;\n};\n\nexport function createApiDevice(options: Options, logger: Logger): ApiDevice {\n  const { genSeed } = options;\n  const sessionId = uuidv4();\n  const deviceApi = axios.create({ baseURL: options.deviceApiUrl });\n\n  axiosRetry(deviceApi, {\n    retryDelay: axiosRetry.linearDelay(1000),\n    retries: 3,\n    /* v8 ignore start -- @preserve */\n    retryCondition: () => true,\n    onRetry: (retryCount, err) => {\n      const formattedErr = `${err.code ?? `UNKNOWN`} on ${err.config?.method?.toUpperCase() ?? \"UNKNOWN_METHOD\"} ${err.config?.url ?? \"UNKNOWN_URL\"}`;\n      logger.warning(\n        `Retrying request to device-api (attempt ${retryCount}) - Cause: ${formattedErr}`,\n      );\n    },\n    /* v8 ignore stop */\n  });\n\n  /* v8 ignore start -- @preserve */\n  deviceApi.interceptors.request.use(\n    (config) => {\n      logger.debug(\n        `[device-api] ${config.method?.toUpperCase()} ${config.url}${config.data ? ` ${JSON.stringify(config.data)}` : \"\"}`,\n      );\n      if ([\"post\", \"put\"].includes(config.method!)) {\n        // when interceptor is called in combination with axios-retry, config.data can be a string or an object\n        // and we should return either a string or an object compatible with the original type\n        const isStringMode = typeof config.data === \"string\";\n        const data = (isStringMode ? JSON.parse(config.data) : config.data) as Record<\n          string,\n          unknown\n        >;\n        const enhancedData = {\n          sessionID: sessionId, // Used to ensure dedicated session if someones else uses same seed\n          psd_model: \"02\", // Stax\n          version: 3, // Used to properly enable noise channel\n          ...data,\n        };\n        config.data = isStringMode ? JSON.stringify(enhancedData) : enhancedData;\n      }\n      return config;\n    },\n    (error: Error) => Promise.reject(error),\n  );\n  /* v8 ignore stop */\n\n  return {\n    with: (index: number): Device => {\n      const __seed = genSeed({ salt: options.salt, index });\n\n      const getSeed = async (): Promise<string> => {\n        if (typeof __seed === \"string\") return Promise.resolve(__seed);\n        return __seed;\n      };\n\n      const authenticate = async ({\n        challenge,\n        workspaceName,\n      }: {\n        challenge: PsdAuthChallengeResponse;\n        workspaceName: string;\n      }): Promise<string> => {\n        const role = challenge.role;\n        if (role === \"READ_ONLY_API_KEY\")\n          throw new Error(\"Invalid role for authenticate: READ_ONLY_API_KEY\");\n        const { data } = await deviceApi.post<string>(\"/authenticate\", {\n          seed: await getSeed(),\n          challenge: Buffer.from(challenge.challenge, \"base64\").toString(\"hex\"),\n          application: APPID_VAULT_ADMINISTRATOR,\n          key_handle: challenge.keyHandle,\n          name: challenge.name,\n          role: STR_ROLES[role],\n          type: \"02\", // Stax\n          workspaceName,\n        });\n        return data;\n      };\n\n      const finalizePairingHandshake = async (params: {\n        handshake: string;\n        partitionId: string;\n      }): Promise<string> => {\n        const { handshake, partitionId } = params;\n        const payload = { seed: await getSeed(), handshake, ciphertext: partitionId };\n        const res = await deviceApi.post<string>(\"/finalize-pairing-handshake\", payload);\n        return res.data;\n      };\n\n      const generateSeedFragment = async (): Promise<string> => {\n        const payload = {\n          seed: await getSeed(),\n          path: PATHS.KEY_MATERIAL,\n          goal: 0, // seed fragment\n        };\n        const { data } = await deviceApi.post<string>(\"/generate-key-component\", payload);\n        return data;\n      };\n\n      const generateWrappingKeyFragment = async (): Promise<string> => {\n        const goal = 1; // means Wrapping Key\n        const payload = { seed: await getSeed(), goal, path: PATHS.KEY_MATERIAL };\n        const res = await deviceApi.post<string>(\"/generate-key-fragments\", payload);\n        return Buffer.from(res.data, \"hex\").toString(\"base64\");\n      };\n\n      const getAttestation = async (): Promise<{\n        attestation: {\n          codeHash: string;\n          attestationPub: string;\n          certificate: string;\n        };\n        buffer: Buffer;\n      }> => {\n        const { data: attestationStr } = await deviceApi.post<string>(\"/get-attestation\", {\n          seed: await getSeed(),\n        });\n        const attestationBuffer = Buffer.from(attestationStr, \"hex\");\n        const certLen = attestationBuffer.readInt8(32 + 65 + 1);\n        return {\n          attestation: {\n            codeHash: attestationBuffer.slice(0, 32).toString(\"base64\"),\n            attestationPub: attestationBuffer.slice(32, 32 + 65).toString(\"base64\"),\n            certificate: attestationBuffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n          },\n          buffer: attestationBuffer,\n        };\n      };\n\n      const getConfidentialityKey = async (): Promise<{\n        confidentialityKeyCurve25519: string;\n        confidentialityKeySignature: string;\n      }> => {\n        const res = await deviceApi.post<{\n          confidentiality_key_curve25519: string;\n          confidentiality_key_signature: string;\n        }>(\"/get-confidentiality-key\", { seed: await getSeed() });\n        return {\n          confidentialityKeyCurve25519: res.data.confidentiality_key_curve25519,\n          confidentialityKeySignature: res.data.confidentiality_key_signature,\n        };\n      };\n\n      const getConfidentialityPubKey = async (): Promise<{ pubKey: string; signature: string }> => {\n        return getPublicKey({ path: PATHS.CONFIDENTIALITY });\n      };\n\n      const getDeviceUserId = async (): Promise<string> => {\n        const res = await deviceApi.post<{ blue_device_id: string }>(\"/blue-device-id\", {\n          seed: await getSeed(),\n        });\n        return res.data.blue_device_id.toUpperCase();\n      };\n\n      const getU2FPubKey = async (): Promise<{ pubKey: string; signature: string }> => {\n        return getPublicKey({ path: PATHS.U2F });\n      };\n\n      const getValidationPubKey = async (): Promise<{ pubKey: string; signature: string }> => {\n        return getPublicKey({ path: PATHS.VALIDATION });\n      };\n\n      const hasPairing = async (): Promise<boolean> => {\n        const res = await deviceApi.post<string[]>(\"/get-partition-ids\", { seed: await getSeed() });\n        return res.data.length > 0;\n      };\n\n      const initPairingHandshake = async (): Promise<{ pubKey: string; signature: string }> => {\n        const { data } = await deviceApi.post<{ attestation: string; pubKey: string }>(\n          \"/initiate-pairing-handshake\",\n          { seed: await getSeed() },\n        );\n        return {\n          pubKey: data.pubKey,\n          signature: Buffer.from(data.attestation, \"hex\").toString(\"base64\"),\n        };\n      };\n\n      const openSession = async (params: {\n        secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n      }): Promise<void> => {\n        const { secureChannel } = params;\n        const signature = Buffer.from(secureChannel.certificate.signature, \"base64\");\n        const attestationPubKey = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n        const attestationCertificate = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n        const attestation = Buffer.concat([\n          Buffer.from([signature.length]),\n          signature,\n          attestationPubKey,\n          Buffer.from([attestationCertificate.length]),\n          attestationCertificate,\n        ]);\n        const payload = {\n          seed: await getSeed(),\n          path: PATHS.CONFIDENTIALITY,\n          pubKey: secureChannel.pubKey,\n          attestation: attestation.toString(\"hex\"),\n          scriptId: SCRIPT_IDS.INIT_SESSION,\n        };\n        const { data: deviceResponse } = await deviceApi.post<string>(\"/open-session\", payload);\n        if (deviceResponse !== \"9000\") {\n          throw new Error(`device-api device failed with code: ${deviceResponse}`);\n        }\n      };\n\n      const register = async (params: {\n        challenge: string;\n        u2fRegisterData: string;\n        name: string;\n        role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n      }): Promise<{\n        u2fRegister: Buffer;\n        keyHandle: Buffer;\n        rfu: number;\n        pubKey: string;\n      }> => {\n        const { challenge, u2fRegisterData, name, role } = params;\n        const payload = {\n          seed: await getSeed(),\n          challenge,\n          name,\n          role: STR_ROLES[role],\n          hsm_data: u2fRegisterData,\n          type: \"02\", // Stax\n          application: APPID_VAULT_ADMINISTRATOR,\n        };\n        const { data } = await deviceApi.post<string>(\"/register\", payload);\n        const response = Buffer.from(data, \"hex\");\n        let i = 0;\n        const rfu = response.slice(i, i + 1)[0]!;\n        i += 1;\n        const pubKey = response.slice(i, i + 65).toString(\"hex\");\n        i += 65;\n        const keyHandleLength = response.slice(i, i + 1)[0]!;\n        i++;\n        const keyHandle = response.slice(i, i + keyHandleLength);\n        i += keyHandleLength;\n        return {\n          u2fRegister: response.slice(0, response.length - 2),\n          keyHandle,\n          rfu,\n          pubKey,\n        };\n      };\n\n      const registerData = async (params: { challenge: string }): Promise<string> => {\n        const { challenge } = params;\n        const payload = { seed: await getSeed(), challenge };\n        const res = await deviceApi.post<string>(\"/u2f-register-data\", payload);\n        return res.data;\n      };\n\n      const setPairing = async ({ pairing }: { pairing: PsdPairingData }): Promise<void> => {\n        const payload = {\n          seed: await getSeed(),\n          blob: pairing.blob,\n          pairing: {\n            bootstrap_enabled: pairing.pairing.bootstrapEnabled,\n            partition_key: pairing.pairing.partitionKey,\n            workspace_name: pairing.pairing.workspaceName,\n          },\n          partition_key_attestation: {\n            code_hash: pairing.partitionKeyAttestation.codeHash,\n            attestation_pub: pairing.partitionKeyAttestation.attestationPub,\n            certificate: pairing.partitionKeyAttestation.certificate,\n            signature: pairing.partitionKeyAttestation.signature,\n          },\n        };\n        await deviceApi.post(\"/set-partition-key\", payload);\n      };\n\n      const startKKPatternAsResponder = async (params: {\n        handshake: string;\n        handshakeAttestation: HsmCertificate;\n        partitionId: string;\n      }): Promise<{ handshake: string; signature: string }> => {\n        const payload = {\n          seed: await getSeed(),\n          script_id: SCRIPT_IDS.ACCOUNT_MANAGER_SESSION,\n          handshake: params.handshake,\n          // for device-api it's normal to have empty string as handshake_attestation\n          handshake_attestation: \"\",\n          partition_id: params.partitionId,\n        };\n        const { data } = await deviceApi.post<string>(\"/start-kk-pattern-as-responder\", payload);\n        const buffer = Buffer.from(data, \"hex\");\n        const dataLength = buffer.readInt8(0);\n        return {\n          handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n          signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n        };\n      };\n\n      const startKPatternAsResponder = async (params: {\n        handshake: string;\n        handshakeAttestation: HsmCertificate;\n        partitionId: string;\n      }): Promise<void> => {\n        const { handshake, partitionId } = params;\n        const payload = {\n          seed: await getSeed(),\n          script_id: SCRIPT_IDS.ACCOUNT_MANAGER_SESSION,\n          handshake,\n          // for device-api it's normal to have empty string as handshake_attestation\n          handshake_attestation: \"\",\n          partition_id: partitionId,\n        };\n        const { data: deviceResponse } = await deviceApi.post<string>(\n          \"/start-k-pattern-as-responder\",\n          payload,\n        );\n        if (deviceResponse !== \"9000\") {\n          throw new Error(`device-api device failed with code: ${deviceResponse}`);\n        }\n      };\n\n      const getPublicKey = async (params: {\n        path: string;\n      }): Promise<{ pubKey: string; signature: string }> => {\n        const { path } = params;\n        type DeviceApiGetPubKeyResponse = { attestation: string; pubKey: string };\n        const payload = { seed: await getSeed(), secp256k1: true, path };\n        const res = await deviceApi.post<DeviceApiGetPubKeyResponse>(\"/get-public-key\", payload);\n        return {\n          pubKey: res.data.pubKey,\n          signature: Buffer.from(res.data.attestation, \"hex\").toString(\"base64\"),\n        };\n      };\n\n      const validateVaultOperation = async (params: { actions: string[] }): Promise<string> => {\n        const { actions } = params;\n        const payload = {\n          seed: await getSeed(),\n          path: PATHS.VALIDATION,\n          actions,\n        };\n        const { data: signature } = await deviceApi.post<string>(\"/validate-op\", payload);\n        return signature;\n      };\n\n      const sendAPDU = (_apdu: string): Promise<string> => {\n        logger.info(\"Can't send arbitrary APDU to software device\");\n        return Promise.resolve(\"9000\");\n      };\n\n      const getVersion = async (): Promise<string> => {\n        return \"1.2.3\";\n      };\n\n      const poll = async (): Promise<{ isAppOpened: boolean }> => {\n        await new Promise((r) => setTimeout(r, 1e3));\n        return { isAppOpened: true };\n      };\n\n      const pollApp = async (): Promise<string> => {\n        await new Promise((r) => setTimeout(r, 1e3));\n        return \"9000\";\n      };\n\n      return {\n        authenticate,\n        finalizePairingHandshake,\n        generateSeedFragment,\n        generateWrappingKeyFragment,\n        getAttestation,\n        getConfidentialityKey,\n        getConfidentialityPubKey,\n        getDeviceUserId,\n        getU2FPubKey,\n        getValidationPubKey,\n        hasPairing,\n        initPairingHandshake,\n        openSession,\n        register,\n        registerData,\n        setPairing,\n        startKKPatternAsResponder,\n        startKPatternAsResponder,\n        validateVaultOperation,\n        getVersion,\n        sendAPDU,\n        poll,\n        pollApp,\n      };\n    },\n  };\n}\n","/* eslint-disable no-continue */\n/* eslint-disable no-unused-vars */\n/* eslint-disable no-param-reassign */\n/* eslint-disable no-prototype-builtins */\nconst errorClasses = {};\nconst deserializers = {};\nexport const addCustomErrorDeserializer = (name, deserializer) => {\n    deserializers[name] = deserializer;\n};\nexport const createCustomErrorClass = (name) => {\n    class CustomErrorClass extends Error {\n        cause;\n        constructor(message, fields, options) {\n            // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n            // @ts-ignore\n            super(message || name, options);\n            // Set the prototype explicitly. See https://github.com/Microsoft/TypeScript/wiki/Breaking-Changes#extending-built-ins-like-error-array-and-map-may-no-longer-work\n            Object.setPrototypeOf(this, CustomErrorClass.prototype);\n            this.name = name;\n            if (fields) {\n                for (const k in fields) {\n                    // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n                    // @ts-ignore\n                    this[k] = fields[k];\n                }\n            }\n            if (options && isObject(options) && \"cause\" in options && !this.cause) {\n                // .cause was specified but the superconstructor\n                // did not create an instance property.\n                const cause = options.cause;\n                this.cause = cause;\n                if (\"stack\" in cause) {\n                    this.stack = this.stack + \"\\nCAUSE: \" + cause.stack;\n                }\n            }\n        }\n    }\n    errorClasses[name] = CustomErrorClass;\n    return CustomErrorClass;\n};\nfunction isObject(value) {\n    return typeof value === \"object\";\n}\n// inspired from https://github.com/programble/errio/blob/master/index.js\nexport const deserializeError = (object) => {\n    if (object && typeof object === \"object\") {\n        try {\n            if (typeof object.message === \"string\") {\n                const msg = JSON.parse(object.message);\n                if (msg.message && msg.name) {\n                    object = msg;\n                }\n            }\n        }\n        catch {\n            // nothing\n        }\n        let error;\n        if (typeof object.name === \"string\") {\n            const { name } = object;\n            const des = deserializers[name];\n            if (des) {\n                error = des(object);\n            }\n            else {\n                let constructor = name === \"Error\" ? Error : errorClasses[name];\n                if (!constructor) {\n                    console.warn(\"deserializing an unknown class '\" + name + \"'\");\n                    constructor = createCustomErrorClass(name);\n                }\n                error = Object.create(constructor.prototype);\n                try {\n                    for (const prop in object) {\n                        if (object.hasOwnProperty(prop)) {\n                            error[prop] = object[prop];\n                        }\n                    }\n                }\n                catch {\n                    // sometimes setting a property can fail (e.g. .name)\n                }\n            }\n        }\n        else {\n            if (typeof object.message === \"string\") {\n                error = new Error(object.message);\n            }\n        }\n        // captureStackTrace is V8/Node-specific and not in @types/node\n        const Err = Error;\n        if (error && !error.stack && Err.captureStackTrace) {\n            Err.captureStackTrace(error, deserializeError);\n        }\n        return error;\n    }\n    return new Error(String(object));\n};\n// inspired from https://github.com/sindresorhus/serialize-error/blob/master/index.js\nexport const serializeError = (value) => {\n    if (!value)\n        return value;\n    if (typeof value === \"object\") {\n        return destroyCircular(value, []);\n    }\n    if (typeof value === \"function\") {\n        return `[Function: ${value.name || \"anonymous\"}]`;\n    }\n    return value;\n};\n// https://www.npmjs.com/package/destroy-circular\nfunction destroyCircular(from, seen) {\n    const to = {};\n    seen.push(from);\n    for (const key of Object.keys(from)) {\n        const value = from[key];\n        if (typeof value === \"function\") {\n            continue;\n        }\n        if (!value || typeof value !== \"object\") {\n            to[key] = value;\n            continue;\n        }\n        if (seen.indexOf(from[key]) === -1) {\n            to[key] = destroyCircular(from[key], seen.slice(0));\n            continue;\n        }\n        to[key] = \"[Circular]\";\n    }\n    if (typeof from.name === \"string\") {\n        to.name = from.name;\n    }\n    if (typeof from.message === \"string\") {\n        to.message = from.message;\n    }\n    if (typeof from.stack === \"string\") {\n        to.stack = from.stack;\n    }\n    return to;\n}\n//# sourceMappingURL=helpers.js.map","import { serializeError, deserializeError, createCustomErrorClass, addCustomErrorDeserializer, } from \"./helpers\";\nexport { serializeError, deserializeError, createCustomErrorClass, addCustomErrorDeserializer };\nexport const AccountNameRequiredError = createCustomErrorClass(\"AccountNameRequired\");\nexport const AccountNotSupported = createCustomErrorClass(\"AccountNotSupported\");\nexport const AccountAwaitingSendPendingOperations = createCustomErrorClass(\"AccountAwaitingSendPendingOperations\");\nexport const AmountRequired = createCustomErrorClass(\"AmountRequired\");\nexport const BluetoothRequired = createCustomErrorClass(\"BluetoothRequired\");\nexport const BtcUnmatchedApp = createCustomErrorClass(\"BtcUnmatchedApp\");\nexport const CantOpenDevice = createCustomErrorClass(\"CantOpenDevice\");\nexport const CashAddrNotSupported = createCustomErrorClass(\"CashAddrNotSupported\");\nexport const ClaimRewardsFeesWarning = createCustomErrorClass(\"ClaimRewardsFeesWarning\");\nexport const CurrencyNotSupported = createCustomErrorClass(\"CurrencyNotSupported\");\nexport const DeviceAppVerifyNotSupported = createCustomErrorClass(\"DeviceAppVerifyNotSupported\");\nexport const DeviceGenuineSocketEarlyClose = createCustomErrorClass(\"DeviceGenuineSocketEarlyClose\");\nexport const DeviceNotGenuineError = createCustomErrorClass(\"DeviceNotGenuine\");\nexport const DeviceOnDashboardExpected = createCustomErrorClass(\"DeviceOnDashboardExpected\");\nexport const DeviceOnDashboardUnexpected = createCustomErrorClass(\"DeviceOnDashboardUnexpected\");\nexport const DeviceInOSUExpected = createCustomErrorClass(\"DeviceInOSUExpected\");\nexport const DeviceHalted = createCustomErrorClass(\"DeviceHalted\");\nexport const DeviceNameInvalid = createCustomErrorClass(\"DeviceNameInvalid\");\nexport const DeviceSocketFail = createCustomErrorClass(\"DeviceSocketFail\");\nexport const DeviceSocketNoBulkStatus = createCustomErrorClass(\"DeviceSocketNoBulkStatus\");\nexport const DeviceNeedsRestart = createCustomErrorClass(\"DeviceSocketNoBulkStatus\");\nexport const UnresponsiveDeviceError = createCustomErrorClass(\"UnresponsiveDeviceError\");\nexport const DisconnectedDevice = createCustomErrorClass(\"DisconnectedDevice\");\nexport const DisconnectedDeviceDuringOperation = createCustomErrorClass(\"DisconnectedDeviceDuringOperation\");\nexport const DeviceExtractOnboardingStateError = createCustomErrorClass(\"DeviceExtractOnboardingStateError\");\nexport const DeviceOnboardingStatePollingError = createCustomErrorClass(\"DeviceOnboardingStatePollingError\");\nexport const EnpointConfigError = createCustomErrorClass(\"EnpointConfig\");\nexport const EthAppPleaseEnableContractData = createCustomErrorClass(\"EthAppPleaseEnableContractData\");\nexport const SolAppPleaseEnableContractData = createCustomErrorClass(\"SolAppPleaseEnableContractData\");\nexport const CeloAppPleaseEnableContractData = createCustomErrorClass(\"CeloAppPleaseEnableContractData\");\nexport const FeeEstimationFailed = createCustomErrorClass(\"FeeEstimationFailed\");\nexport const FirmwareNotRecognized = createCustomErrorClass(\"FirmwareNotRecognized\");\nexport const HardResetFail = createCustomErrorClass(\"HardResetFail\");\nexport const InvalidXRPTag = createCustomErrorClass(\"InvalidXRPTag\");\nexport const InvalidAddress = createCustomErrorClass(\"InvalidAddress\");\nexport const InvalidTransactionError = createCustomErrorClass(\"InvalidTransactionError\");\nexport const InvalidNonce = createCustomErrorClass(\"InvalidNonce\");\nexport const InvalidAddressBecauseDestinationIsAlsoSource = createCustomErrorClass(\"InvalidAddressBecauseDestinationIsAlsoSource\");\nexport const LatestMCUInstalledError = createCustomErrorClass(\"LatestMCUInstalledError\");\nexport const LatestFirmwareVersionRequired = createCustomErrorClass(\"LatestFirmwareVersionRequired\");\nexport const UnsupportedFeatureError = createCustomErrorClass(\"UnsupportedFeatureError\");\nexport const NanoSNotSupported = createCustomErrorClass(\"NanoSNotSupported\");\nexport const UnknownMCU = createCustomErrorClass(\"UnknownMCU\");\nexport const LedgerAPIError = createCustomErrorClass(\"LedgerAPIError\");\nexport const LedgerAPIErrorWithMessage = createCustomErrorClass(\"LedgerAPIErrorWithMessage\");\nexport const LedgerAPINotAvailable = createCustomErrorClass(\"LedgerAPINotAvailable\");\nexport const ManagerAppAlreadyInstalledError = createCustomErrorClass(\"ManagerAppAlreadyInstalled\");\nexport const ManagerAppRelyOnBTCError = createCustomErrorClass(\"ManagerAppRelyOnBTC\");\nexport const ManagerAppDepInstallRequired = createCustomErrorClass(\"ManagerAppDepInstallRequired\");\nexport const ManagerAppDepUninstallRequired = createCustomErrorClass(\"ManagerAppDepUninstallRequired\");\nexport const ManagerDeviceLockedError = createCustomErrorClass(\"ManagerDeviceLocked\");\nexport const ManagerFirmwareNotEnoughSpaceError = createCustomErrorClass(\"ManagerFirmwareNotEnoughSpace\");\nexport const ManagerNotEnoughSpaceError = createCustomErrorClass(\"ManagerNotEnoughSpace\");\nexport const ManagerUninstallBTCDep = createCustomErrorClass(\"ManagerUninstallBTCDep\");\nexport const NetworkDown = createCustomErrorClass(\"NetworkDown\");\nexport const NetworkError = createCustomErrorClass(\"NetworkError\");\nexport const NoAddressesFound = createCustomErrorClass(\"NoAddressesFound\");\nexport const NotEnoughBalance = createCustomErrorClass(\"NotEnoughBalance\");\nexport const NotEnoughBalanceFees = createCustomErrorClass(\"NotEnoughBalanceFees\");\nexport const NotEnoughBalanceSwap = createCustomErrorClass(\"NotEnoughBalanceSwap\");\nexport const NotEnoughBalanceToDelegate = createCustomErrorClass(\"NotEnoughBalanceToDelegate\");\nexport const UnstakeNotEnoughStakedBalanceLeft = createCustomErrorClass(\"UnstakeNotEnoughStakedBalanceLeft\");\nexport const RestakeNotEnoughStakedBalanceLeft = createCustomErrorClass(\"RestakeNotEnoughStakedBalanceLeft\");\nexport const NotEnoughToRestake = createCustomErrorClass(\"NotEnoughToRestake\");\nexport const NotEnoughToUnstake = createCustomErrorClass(\"NotEnoughToUnstake\");\nexport const NotEnoughBalanceInParentAccount = createCustomErrorClass(\"NotEnoughBalanceInParentAccount\");\nexport const NotEnoughSpendableBalance = createCustomErrorClass(\"NotEnoughSpendableBalance\");\nexport const NotEnoughBalanceBecauseDestinationNotCreated = createCustomErrorClass(\"NotEnoughBalanceBecauseDestinationNotCreated\");\nexport const NotEnoughToStake = createCustomErrorClass(\"NotEnoughToStake\");\nexport const NoAccessToCamera = createCustomErrorClass(\"NoAccessToCamera\");\nexport const NotEnoughGas = createCustomErrorClass(\"NotEnoughGas\");\n// Error message specifically for the PTX swap flow\nexport const NotEnoughGasSwap = createCustomErrorClass(\"NotEnoughGasSwap\");\nexport const TronEmptyAccount = createCustomErrorClass(\"TronEmptyAccount\");\nexport const MaybeKeepTronAccountAlive = createCustomErrorClass(\"MaybeKeepTronAccountAlive\");\nexport const NotSupportedLegacyAddress = createCustomErrorClass(\"NotSupportedLegacyAddress\");\nexport const GasLessThanEstimate = createCustomErrorClass(\"GasLessThanEstimate\");\nexport const PriorityFeeTooLow = createCustomErrorClass(\"PriorityFeeTooLow\");\nexport const PriorityFeeTooHigh = createCustomErrorClass(\"PriorityFeeTooHigh\");\nexport const PriorityFeeHigherThanMaxFee = createCustomErrorClass(\"PriorityFeeHigherThanMaxFee\");\nexport const MaxFeeTooLow = createCustomErrorClass(\"MaxFeeTooLow\");\nexport const PasswordsDontMatchError = createCustomErrorClass(\"PasswordsDontMatch\");\nexport const PasswordIncorrectError = createCustomErrorClass(\"PasswordIncorrect\");\nexport const RecommendSubAccountsToEmpty = createCustomErrorClass(\"RecommendSubAccountsToEmpty\");\nexport const RecommendUndelegation = createCustomErrorClass(\"RecommendUndelegation\");\nexport const TimeoutTagged = createCustomErrorClass(\"TimeoutTagged\");\nexport const UnexpectedBootloader = createCustomErrorClass(\"UnexpectedBootloader\");\nexport const MCUNotGenuineToDashboard = createCustomErrorClass(\"MCUNotGenuineToDashboard\");\nexport const RecipientRequired = createCustomErrorClass(\"RecipientRequired\");\nexport const UnavailableTezosOriginatedAccountReceive = createCustomErrorClass(\"UnavailableTezosOriginatedAccountReceive\");\nexport const UnavailableTezosOriginatedAccountSend = createCustomErrorClass(\"UnavailableTezosOriginatedAccountSend\");\nexport const UpdateFetchFileFail = createCustomErrorClass(\"UpdateFetchFileFail\");\nexport const UpdateIncorrectHash = createCustomErrorClass(\"UpdateIncorrectHash\");\nexport const UpdateIncorrectSig = createCustomErrorClass(\"UpdateIncorrectSig\");\nexport const UpdateYourApp = createCustomErrorClass(\"UpdateYourApp\");\nexport const UserRefusedDeviceNameChange = createCustomErrorClass(\"UserRefusedDeviceNameChange\");\nexport const UserRefusedAddress = createCustomErrorClass(\"UserRefusedAddress\");\nexport const UserRefusedFirmwareUpdate = createCustomErrorClass(\"UserRefusedFirmwareUpdate\");\nexport const UserRefusedAllowManager = createCustomErrorClass(\"UserRefusedAllowManager\");\nexport const UserRefusedOnDevice = createCustomErrorClass(\"UserRefusedOnDevice\"); // TODO rename because it's just for transaction refusal\nexport const PinNotSet = createCustomErrorClass(\"PinNotSet\");\nexport const ExpertModeRequired = createCustomErrorClass(\"ExpertModeRequired\");\nexport const TransportOpenUserCancelled = createCustomErrorClass(\"TransportOpenUserCancelled\");\nexport const TransportInterfaceNotAvailable = createCustomErrorClass(\"TransportInterfaceNotAvailable\");\nexport const TransportRaceCondition = createCustomErrorClass(\"TransportRaceCondition\");\nexport const TransportWebUSBGestureRequired = createCustomErrorClass(\"TransportWebUSBGestureRequired\");\nexport const TransactionHasBeenValidatedError = createCustomErrorClass(\"TransactionHasBeenValidatedError\");\nexport const TransportExchangeTimeoutError = createCustomErrorClass(\"TransportExchangeTimeoutError\");\nexport const DeviceShouldStayInApp = createCustomErrorClass(\"DeviceShouldStayInApp\");\nexport const WebsocketConnectionError = createCustomErrorClass(\"WebsocketConnectionError\");\nexport const WebsocketConnectionFailed = createCustomErrorClass(\"WebsocketConnectionFailed\");\nexport const WrongDeviceForAccount = createCustomErrorClass(\"WrongDeviceForAccount\");\nexport const WrongDeviceForAccountPayout = createCustomErrorClass(\"WrongDeviceForAccountPayout\");\nexport const MissingSwapPayloadParamaters = createCustomErrorClass(\"MissingSwapPayloadParamaters\");\nexport const WrongDeviceForAccountRefund = createCustomErrorClass(\"WrongDeviceForAccountRefund\");\nexport const WrongAppForCurrency = createCustomErrorClass(\"WrongAppForCurrency\");\nexport const ETHAddressNonEIP = createCustomErrorClass(\"ETHAddressNonEIP\");\nexport const CantScanQRCode = createCustomErrorClass(\"CantScanQRCode\");\nexport const FeeNotLoaded = createCustomErrorClass(\"FeeNotLoaded\");\nexport const FeeNotLoadedSwap = createCustomErrorClass(\"FeeNotLoadedSwap\");\nexport const FeeRequired = createCustomErrorClass(\"FeeRequired\");\nexport const FeeTooHigh = createCustomErrorClass(\"FeeTooHigh\");\nexport const ValAddressRequired = createCustomErrorClass(\"ValAddressRequired\");\nexport const RedelegateDstValAddressRequired = createCustomErrorClass(\"RedelegateDstValAddressRequired\");\nexport const PendingOperation = createCustomErrorClass(\"PendingOperation\");\nexport const SyncError = createCustomErrorClass(\"SyncError\");\nexport const PairingFailed = createCustomErrorClass(\"PairingFailed\");\nexport const PeerRemovedPairing = createCustomErrorClass(\"PeerRemovedPairing\");\nexport const GenuineCheckFailed = createCustomErrorClass(\"GenuineCheckFailed\");\nexport const LedgerAPI4xx = createCustomErrorClass(\"LedgerAPI4xx\");\nexport const LedgerAPI5xx = createCustomErrorClass(\"LedgerAPI5xx\");\nexport const FirmwareOrAppUpdateRequired = createCustomErrorClass(\"FirmwareOrAppUpdateRequired\");\n// SpeedUp / Cancel EVM tx\nexport const ReplacementTransactionUnderpriced = createCustomErrorClass(\"ReplacementTransactionUnderpriced\");\n// Bitcoin family\nexport const OpReturnDataSizeLimit = createCustomErrorClass(\"OpReturnSizeLimit\");\nexport const DustLimit = createCustomErrorClass(\"DustLimit\");\n// Concordium family\nexport const ConcordiumInsufficientFunds = createCustomErrorClass(\"ConcordiumInsufficientFunds\");\nexport const ConcordiumMemoTooLong = createCustomErrorClass(\"ConcordiumMemoTooLong\");\nexport const ConcordiumPairingExpiredError = createCustomErrorClass(\"ConcordiumPairingExpiredError\");\nexport const ConcordiumSessionExpiredError = createCustomErrorClass(\"ConcordiumSessionExpiredError\");\nexport const ConcordiumTrustedMetadataServiceError = createCustomErrorClass(\"ConcordiumTrustedMetadataServiceError\");\nexport const ConcordiumAddressVerificationFailedError = createCustomErrorClass(\"ConcordiumAddressVerificationFailedError\");\nexport const ConcordiumInvalidMaxFeeError = createCustomErrorClass(\"ConcordiumInvalidMaxFeeError\");\n// Language\nexport const LanguageNotFound = createCustomErrorClass(\"LanguageNotFound\");\n// db stuff, no need to translate\nexport const NoDBPathGiven = createCustomErrorClass(\"NoDBPathGiven\");\nexport const DBWrongPassword = createCustomErrorClass(\"DBWrongPassword\");\nexport const DBNotReset = createCustomErrorClass(\"DBNotReset\");\nexport const SequenceNumberError = createCustomErrorClass(\"SequenceNumberError\");\nexport const DisabledTransactionBroadcastError = createCustomErrorClass(\"DisabledTransactionBroadcastError\");\nexport const InvalidParameterError = createCustomErrorClass(\"InvalidParameterError\");\n/**\n * Type of a Transport error used to represent all equivalent errors coming from all possible implementation of Transport\n */\nexport var HwTransportErrorType;\n(function (HwTransportErrorType) {\n    HwTransportErrorType[\"Unknown\"] = \"Unknown\";\n    HwTransportErrorType[\"LocationServicesDisabled\"] = \"LocationServicesDisabled\";\n    HwTransportErrorType[\"LocationServicesUnauthorized\"] = \"LocationServicesUnauthorized\";\n    HwTransportErrorType[\"BluetoothScanStartFailed\"] = \"BluetoothScanStartFailed\";\n})(HwTransportErrorType || (HwTransportErrorType = {}));\n/**\n * Represents an error coming from the usage of any Transport implementation.\n *\n * Needed to map a specific implementation error into an error that\n * can be managed by any code unaware of the specific Transport implementation\n * that was used.\n */\nexport class HwTransportError extends Error {\n    type;\n    constructor(type, message) {\n        super(message);\n        this.name = \"HwTransportError\";\n        this.type = type;\n        // Needed as long as we target < ES6\n        Object.setPrototypeOf(this, HwTransportError.prototype);\n    }\n}\n/**\n * TransportError is used for any generic transport errors.\n * e.g. Error thrown when data received by exchanges are incorrect or if exchanged failed to communicate with the device for various reason.\n */\nexport class TransportError extends Error {\n    id;\n    constructor(message, id) {\n        const name = \"TransportError\";\n        super(message || name);\n        this.name = name;\n        this.message = message;\n        this.stack = new Error(message).stack;\n        this.id = id;\n    }\n}\naddCustomErrorDeserializer(\"TransportError\", e => new TransportError(e.message, e.id));\nexport const StatusCodes = {\n    ACCESS_CONDITION_NOT_FULFILLED: 0x9804,\n    ALGORITHM_NOT_SUPPORTED: 0x9484,\n    CLA_NOT_SUPPORTED: 0x6e00,\n    CLA_NOT_SUPPORTED_BOOTLOADER: 0x6e01,\n    CODE_BLOCKED: 0x9840,\n    CODE_NOT_INITIALIZED: 0x9802,\n    COMMAND_INCOMPATIBLE_FILE_STRUCTURE: 0x6981,\n    CONDITIONS_OF_USE_NOT_SATISFIED: 0x6985,\n    CONTRADICTION_INVALIDATION: 0x9810,\n    CONTRADICTION_SECRET_CODE_STATUS: 0x9808,\n    DEVICE_IN_RECOVERY_MODE: 0x662f,\n    CUSTOM_IMAGE_EMPTY: 0x662e,\n    FILE_ALREADY_EXISTS: 0x6a89,\n    FILE_NOT_FOUND: 0x9404,\n    GP_AUTH_FAILED: 0x6300,\n    HALTED: 0x6faa,\n    INCONSISTENT_FILE: 0x9408,\n    INCORRECT_DATA: 0x6a80,\n    INCORRECT_LENGTH: 0x6700,\n    INCORRECT_P1_P2: 0x6b00,\n    INS_NOT_SUPPORTED: 0x6d00,\n    DEVICE_NOT_ONBOARDED: 0x6d07,\n    DEVICE_NOT_ONBOARDED_2: 0x6611,\n    INVALID_KCV: 0x9485,\n    INVALID_OFFSET: 0x9402,\n    LICENSING: 0x6f42,\n    LOCKED_DEVICE: 0x5515,\n    MAX_VALUE_REACHED: 0x9850,\n    MEMORY_PROBLEM: 0x9240,\n    MISSING_CRITICAL_PARAMETER: 0x6800,\n    NO_EF_SELECTED: 0x9400,\n    NOT_ENOUGH_MEMORY_SPACE: 0x6a84,\n    OK: 0x9000,\n    PIN_REMAINING_ATTEMPTS: 0x63c0,\n    REFERENCED_DATA_NOT_FOUND: 0x6a88,\n    SECURITY_STATUS_NOT_SATISFIED: 0x6982,\n    TECHNICAL_PROBLEM: 0x6f00,\n    UNKNOWN_APDU: 0x6d02,\n    USER_REFUSED_ON_DEVICE: 0x5501,\n    NOT_ENOUGH_SPACE: 0x5102,\n    APP_NOT_FOUND_OR_INVALID_CONTEXT: 0x5123,\n    INVALID_APP_NAME_LENGTH: 0x670a,\n    GEN_AES_KEY_FAILED: 0x5419,\n    INTERNAL_CRYPTO_OPERATION_FAILED: 0x541a,\n    INTERNAL_COMPUTE_AES_CMAC_FAILED: 0x541b,\n    ENCRYPT_APP_STORAGE_FAILED: 0x541c,\n    INVALID_BACKUP_STATE: 0x6642,\n    PIN_NOT_SET: 0x5502,\n    INVALID_BACKUP_LENGTH: 0x6733,\n    INVALID_RESTORE_STATE: 0x6643,\n    INVALID_CHUNK_LENGTH: 0x6734,\n    INVALID_BACKUP_HEADER: 0x684a,\n    SW_BAD_STATE: 0xb007,\n};\nexport function getAltStatusMessage(code) {\n    switch (code) {\n        // improve text of most common errors\n        case 0x6700:\n            return \"Incorrect length\";\n        case 0x6800:\n            return \"Missing critical parameter\";\n        case 0x6982:\n            return \"Security not satisfied (dongle locked or have invalid access rights)\";\n        case 0x6985:\n            return \"Condition of use not satisfied (denied by the user?)\";\n        case 0x6a80:\n            return \"Invalid data received\";\n        case 0x6b00:\n            return \"Invalid parameter received\";\n        case 0x5515:\n            return \"Locked device\";\n        case 0xb007:\n            return \"Unexpected state on the device\";\n    }\n    if (0x6f00 <= code && code <= 0x6fff) {\n        return \"Internal error, please report\";\n    }\n}\n/**\n * Error thrown when a device returned a non success status.\n * the error.statusCode is one of the `StatusCodes` exported by this library.\n */\nexport class TransportStatusError extends Error {\n    statusCode;\n    statusText;\n    /**\n     * @param statusCode The error status code coming from a Transport implementation\n     * @param options containing:\n     *  - canBeMappedToChildError: enable the mapping of TransportStatusError to an error extending/inheriting from it\n     *  . Ex: LockedDeviceError. Default to true.\n     */\n    constructor(statusCode, { canBeMappedToChildError = true } = {}) {\n        const statusText = Object.keys(StatusCodes).find(k => StatusCodes[k] === statusCode) || \"UNKNOWN_ERROR\";\n        const smsg = getAltStatusMessage(statusCode) || statusText;\n        const statusCodeStr = statusCode.toString(16);\n        const message = `Ledger device: ${smsg} (0x${statusCodeStr})`;\n        super(message);\n        this.name = \"TransportStatusError\";\n        this.statusCode = statusCode;\n        this.statusText = statusText;\n        Object.setPrototypeOf(this, TransportStatusError.prototype);\n        // Maps to a LockedDeviceError\n        if (canBeMappedToChildError && statusCode === StatusCodes.LOCKED_DEVICE) {\n            return new LockedDeviceError(message);\n        }\n    }\n}\nexport class LockedDeviceError extends TransportStatusError {\n    constructor(message) {\n        super(StatusCodes.LOCKED_DEVICE, { canBeMappedToChildError: false });\n        if (message) {\n            this.message = message;\n        }\n        this.name = \"LockedDeviceError\";\n        Object.setPrototypeOf(this, LockedDeviceError.prototype);\n    }\n}\nexport class DeviceMangementKitError extends Error {\n    constructor(name, message) {\n        super(message);\n        this.name = name;\n        Object.setPrototypeOf(this, DeviceMangementKitError.prototype);\n    }\n}\naddCustomErrorDeserializer(\"TransportStatusError\", e => new TransportStatusError(e.statusCode));\n//# sourceMappingURL=index.js.map","// biome-ignore-all lint: outside copy-paste, not worth fixing\n// ------------------------------------------------------------------------------------------------\n// ------------------------------------------------------------------------------------------------\n//                  THIS IS SOME HORRIBLE CODE IMPORTED JUST\n//              FOR THE SAKE OF NOT IMPORTING UGLY, WICKED, AND\n//                     BROKEN @ledgerhq/live-* LIBRARIES\n//\n//                 IT'S MEANT TO BE CONSIDERED AS A BLACK BOX\n// ------------------------------------------------------------------------------------------------\n// ------------------------------------------------------------------------------------------------\nimport {\n  BluetoothRequired,\n  CantOpenDevice,\n  DeviceHalted,\n  FirmwareOrAppUpdateRequired,\n  TransportInterfaceNotAvailable,\n  TransportStatusError,\n  TransportWebUSBGestureRequired,\n} from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport { Observable, throwError, timer } from \"rxjs\";\nimport { catchError, mergeMap, retryWhen } from \"rxjs/operators\";\n\nconst initialErrorRemapping = (error: Error): Observable<never> =>\n  throwError(\n    error && error instanceof TransportStatusError && error.statusCode === 0x6faa\n      ? new DeviceHalted(error.message)\n      : error instanceof TransportStatusError && error.statusCode === 0x6b00\n        ? new FirmwareOrAppUpdateRequired(error.message)\n        : error,\n  );\n\n// eslint-disable-next-line @typescript-eslint/no-empty-function\nconst never = new Promise(() => {});\n\ntype Discovery = Observable<{\n  type: \"add\" | \"remove\";\n  id: string;\n  name: string;\n}>;\n\nexport type TransportModule = {\n  // unique transport name that identify the transport module\n  id: string;\n  // open a device by an id, this id must be unique across all modules\n  // you can typically prefix it with `something|` that identify it globally\n  // returns falsy if the transport module can't handle this id\n  // here, open means we want to START doing something with the transport\n  open: (id: string) => Promise<Transport> | null | undefined;\n  // here, close means we want to STOP doing something with the transport\n  close?: (transport: Transport, id: string) => Promise<void> | null | undefined;\n  // disconnect/interrupt a device connection globally\n  // returns falsy if the transport module can't handle this id\n  disconnect: (id: string) => Promise<void> | null | undefined;\n  // optional observable that allows to discover a transport\n  discovery?: Discovery;\n};\n\nconst modules: TransportModule[] = [];\n\nexport const registerTransportModule = (module: TransportModule): void => {\n  modules.push(module);\n};\n\nexport const close = (transport: Transport, deviceId: string): Promise<void> => {\n  for (const m of modules) {\n    const p = m.close?.(transport, deviceId);\n    if (p) return p;\n  }\n  // fallback on an actual close\n  return transport.close();\n};\n\nexport const open = (deviceId: string): Promise<Transport> => {\n  for (const m of modules) {\n    const p = m.open(deviceId);\n    if (p) return p;\n  }\n  return Promise.reject(new Error(`Can't find handler to open ${deviceId}`));\n};\n\nconst transportFinally =\n  (cleanup: () => Promise<void>) =>\n  <T>(observable: Observable<T>): Observable<T> =>\n    // @ts-expect-error typescript not checking against the instanceof\n    Observable.create((o) => {\n      let done = false;\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      const finalize = (): any => {\n        if (done) return never;\n        done = true;\n        return cleanup();\n      };\n\n      const sub = observable.subscribe({\n        next: (e) => o.next(e),\n        complete: () => {\n          void finalize().then(() => o.complete());\n        },\n        error: (e) => {\n          void finalize().then(() => o.error(e));\n        },\n      });\n      return () => {\n        sub.unsubscribe();\n        void finalize();\n      };\n    });\n\ntype AccessHook = () => () => void;\n\nconst accessHooks: AccessHook[] = [];\n\nconst deviceQueues = {};\n\nexport const withDevice =\n  (deviceId: string) =>\n  <T>(job: (t: Transport) => Observable<T>): Observable<T> =>\n    new Observable((o) => {\n      // @ts-expect-error typescript not checking against the instanceof\n      let unsubscribed;\n      // @ts-expect-error typescript not checking against the instanceof\n      let sub;\n      // @ts-expect-error typescript not checking against the instanceof\n      const deviceQueue = deviceQueues[deviceId] ?? Promise.resolve();\n\n      // @ts-expect-error typescript not checking against the instanceof\n      const finalize = (transport, cleanups): Promise<void> =>\n        close(transport, deviceId)\n          // eslint-disable-next-line @typescript-eslint/no-empty-function\n          .catch(() => {})\n          .then(() => {\n            // @ts-expect-error typescript not checking against the instanceof\n            cleanups.forEach((c) => c());\n          });\n\n      // when we'll finish all the current job, we'll call finish\n      // @ts-expect-error typescript not checking against the instanceof\n      let finish;\n      // this new promise is the next exec queue\n      // @ts-expect-error typescript not checking against the instanceof\n      deviceQueues[deviceId] = new Promise((resolve) => {\n        finish = resolve;\n      });\n      // for any new job, we'll now wait the exec queue to be available\n      deviceQueue\n        .then(() => open(deviceId)) // open the transport\n        // @ts-expect-error typescript not checking against the instanceof\n        .then(async (transport) => {\n          // @ts-expect-error typescript not checking against the instanceof\n          if (unsubscribed) {\n            // it was unsubscribed prematurely\n            // @ts-expect-error typescript not checking against the instanceof\n            return finalize(transport, [finish]);\n          }\n\n          if (\n            transport.requestConnectionPriority &&\n            typeof transport.requestConnectionPriority === \"function\"\n          ) {\n            await transport.requestConnectionPriority(\"High\");\n          }\n\n          return transport;\n        })\n        // @ts-expect-error typescript not checking against the instanceof\n        .catch((e) => {\n          // @ts-expect-error typescript not checking against the instanceof\n          finish();\n          if (e instanceof BluetoothRequired) throw e;\n          if (e instanceof TransportWebUSBGestureRequired) throw e;\n          if (e instanceof TransportInterfaceNotAvailable) throw e;\n          throw new CantOpenDevice(e.message);\n        })\n        // @ts-expect-error typescript not checking against the instanceof\n        .then((transport) => {\n          if (!transport) return;\n\n          // @ts-expect-error typescript not checking against the instanceof\n          if (unsubscribed) {\n            // it was unsubscribed prematurely\n            // @ts-expect-error typescript not checking against the instanceof\n            return finalize(transport, [finish]);\n          }\n\n          const cleanups = accessHooks.map((hook) => hook());\n          sub = job(transport) // $FlowFixMe\n            .pipe(\n              catchError(initialErrorRemapping),\n              // $FlowFixMe\n              transportFinally(() =>\n                // @ts-expect-error typescript not checking against the instanceof\n                finalize(transport, [...cleanups, finish]),\n              ),\n            )\n            .subscribe(o);\n        })\n        // @ts-expect-error typescript not checking against the instanceof\n        .catch((error) => o.error(error));\n      return () => {\n        unsubscribed = true;\n        // @ts-expect-error typescript not checking against the instanceof\n        if (sub) sub.unsubscribe();\n      };\n    });\n\nconst WITH_DEVICE_POLLING_DELAY = 500;\n\nexport const retryWhileErrors =\n  (acceptError: (arg0: Error) => boolean) =>\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (attempts: Observable<any>): Observable<any> =>\n    attempts.pipe(\n      mergeMap((error) => {\n        if (!acceptError(error)) {\n          return throwError(error);\n        }\n\n        return timer(WITH_DEVICE_POLLING_DELAY);\n      }),\n    );\n\nexport const withDevicePolling =\n  (deviceId: string) =>\n  <T>(\n    job: (arg0: Transport) => Observable<T>,\n    acceptError: (arg0: Error) => boolean = () => false,\n  ): Observable<T> =>\n    withDevice(deviceId)(job).pipe(retryWhen(retryWhileErrors(acceptError)));\n","import { TransportStatusError } from \"@ledgerhq/errors\";\n\nexport const isTransportStatusError = (error: unknown): error is TransportStatusError => {\n  return (\n    error instanceof TransportStatusError ||\n    (error instanceof Error && \"statusCode\" in error && error.message.startsWith(\"Ledger device:\"))\n  );\n};\n\nconst CANCEL_STATUS_CODES = [\n  0x6985, // cancel on Ledger Blue\n\n  // STAX\n  0xb00c, // cancel collect wk fragment\n  0xb00d, // cancel user registration\n  0xb010, // cancel review\n  0xb012, // cancel master seed generation\n  0xb013, // cancel login\n  0x5501, // cancel openApp\n];\n\nexport const isDeviceCancelError = (error: Error): boolean => {\n  return isTransportStatusError(error) && CANCEL_STATUS_CODES.includes(error.statusCode);\n};\n"],"x_google_ignoreList":[0,1,4,5],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAEA,MAAM,WAAW,IAAI,IAAI;EACxB;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACD,CAAC;CAGD,OAAO,WAAU,UAAS,CAAC,SAAS,IAAI,SAAS,MAAM,IAAI;;ACrC3D,MAAa,YAAY;AACzB,SAAgB,eAAe,OAAO;CAClC,MAAM,oBAAoB,CAAC,gBAAgB,cAAc;CACzD,IAAI,MAAM,UACN,OAAO;CAEX,IAAI,CAAC,MAAM,MACP,OAAO;CAGX,IAAI,kBAAkB,SAAS,MAAM,IAAI,GACrC,OAAO;CAGX,QAAA,GAAA,wBAAA,QAAA,CAAsB,KAAK;AAC/B;AACA,MAAM,oBAAoB;CAAC;CAAO;CAAQ;AAAS;AACnD,MAAM,0BAA0B,kBAAkB,OAAO,CAAC,OAAO,QAAQ,CAAC;AAC1E,SAAgB,iBAAiB,OAAO;CACpC,OAAQ,MAAM,SAAS,mBAClB,CAAC,MAAM,YACJ,MAAM,SAAS,WAAW,OACzB,MAAM,SAAS,UAAU,OAAO,MAAM,SAAS,UAAU;AACtE;AACA,SAAgB,mBAAmB,OAAO;CACtC,IAAI,CAAC,MAAM,QAAQ,QAEf,OAAO;CAEX,OAAO,iBAAiB,KAAK,KAAK,kBAAkB,QAAQ,MAAM,OAAO,MAAM,MAAM;AACzF;AACA,SAAgB,yBAAyB,OAAO;CAC5C,IAAI,CAAC,MAAM,QAAQ,QAEf,OAAO;CAEX,OAAO,iBAAiB,KAAK,KAAK,wBAAwB,QAAQ,MAAM,OAAO,MAAM,MAAM;AAC/F;AACA,SAAgB,kCAAkC,OAAO;CACrD,OAAO,eAAe,KAAK,KAAK,yBAAyB,KAAK;AAClE;AACA,SAAgB,WAAW,QAAQ,KAAA,GAAW;CAC1C,MAAM,mBAAmB,OAAO,UAAU,QAAQ;CAClD,IAAI,CAAC,kBACD,OAAO;CAGX,IAAI,gBAAgB,OAAO,gBAAgB,KAAK,KAAK;CAErD,IAAI,iBAAiB,GACjB,gBAAgB,IAAI,KAAK,gBAAgB,CAAC,CAAC,QAAQ,KAAK,KAAK,KAAK,IAAI;CAE1E,OAAO,KAAK,IAAI,GAAG,YAAY;AACnC;AACA,SAAS,QAAQ,eAAe,GAAG,QAAQ,KAAA,GAAW;CAClD,OAAO,KAAK,IAAI,GAAG,WAAW,KAAK,CAAC;AACxC;AACA,SAAgB,iBAAiB,cAAc,GAAG,QAAQ,KAAA,GAAW,cAAc,KAAK;CACpF,MAAM,kBAAkB,KAAK,cAAc;CAC3C,MAAM,QAAQ,KAAK,IAAI,iBAAiB,WAAW,KAAK,CAAC;CAEzD,OAAO,QADW,QAAQ,KAAM,KAAK,OAAO;AAEhD;;;;;;AAMA,SAAgB,YAAY,cAAc,KAAK;CAC3C,QAAQ,cAAc,GAAG,QAAQ,KAAA,MAAc;EAC3C,MAAM,QAAQ,cAAc;EAC5B,OAAO,KAAK,IAAI,OAAO,WAAW,KAAK,CAAC;CAC5C;AACJ;AACA,MAAa,kBAAkB;CAC3B,SAAS;CACT,gBAAgB;CAChB,YAAY;CACZ,oBAAoB;CACpB,eAAe,CAAE;CACjB,+BAA+B,CAAE;CACjC,kBAAkB;AACtB;AACA,SAAS,kBAAkB,QAAQ,gBAAgB;CAC/C,OAAO;EAAE,GAAG;EAAiB,GAAG;EAAgB,GAAG,OAAO;CAAW;AACzE;AACA,SAAS,gBAAgB,QAAQ,gBAAgB,uBAAuB,OAAO;CAC3E,MAAM,eAAe,kBAAkB,QAAQ,kBAAkB,CAAC,CAAC;CACnE,aAAa,aAAa,aAAa,cAAc;CACrD,IAAI,CAAC,aAAa,mBAAmB,sBACjC,aAAa,kBAAkB,KAAK,IAAI;CAE5C,OAAO,aAAa;CACpB,OAAO;AACX;AACA,SAAS,UAAU,eAAe,QAAQ;CAEtC,IAAI,cAAc,SAAS,UAAU,OAAO,OAExC,OAAO,OAAO;CAElB,IAAI,cAAc,SAAS,cAAc,OAAO,WAC5C,OAAO,OAAO;CAElB,IAAI,cAAc,SAAS,eAAe,OAAO,YAC7C,OAAO,OAAO;AAEtB;AACA,eAAe,YAAY,cAAc,OAAO;CAC5C,MAAM,EAAE,SAAS,mBAAmB;CACpC,MAAM,wBAAwB,aAAa,cAAc,KAAK,WAAW,eAAe,KAAK;CAE7F,IAAI,OAAO,yBAAyB,UAChC,IAAI;EAGA,OAAO,MAFgC,yBAEH;CACxC,SACO,MAAM;EACT,OAAO;CACX;CAEJ,OAAO;AACX;AACA,eAAe,YAAY,eAAe,cAAc,OAAO,QAAQ;CACnE,aAAa,cAAc;CAC3B,MAAM,EAAE,YAAY,oBAAoB,YAAY;CACpD,MAAM,QAAQ,WAAW,aAAa,YAAY,KAAK;CAGvD,UAAU,eAAe,MAAM;CAC/B,IAAI,CAAC,sBAAsB,OAAO,WAAW,aAAa,iBAAiB;EACvE,MAAM,sBAAsB,KAAK,IAAI,IAAI,aAAa;EACtD,MAAM,UAAU,OAAO,UAAU,sBAAsB;EACvD,IAAI,WAAW,GACX,OAAO,QAAQ,OAAO,KAAK;EAE/B,OAAO,UAAU;CACrB;CACA,OAAO,mBAAmB,EAAE,SAAS,IAAI;CACzC,MAAM,QAAQ,aAAa,YAAY,OAAO,MAAM;CACpD,IAAI,OAAO,QAAQ,SACf,OAAO,QAAQ,QAAQ,cAAc,MAAM,CAAC;CAEhD,OAAO,IAAI,SAAS,YAAY;EAC5B,MAAM,sBAAsB;GACxB,aAAa,OAAO;GACpB,QAAQ,cAAc,MAAM,CAAC;EACjC;EACA,MAAM,UAAU,iBAAiB;GAC7B,QAAQ,cAAc,MAAM,CAAC;GAC7B,IAAI,OAAO,QAAQ,qBACf,OAAO,OAAO,oBAAoB,SAAS,aAAa;EAEhE,GAAG,KAAK;EACR,IAAI,OAAO,QAAQ,kBACf,OAAO,OAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;CAE7E,CAAC;AACL;AACA,eAAe,4BAA4B,cAAc,OAAO;CAC5D,IAAI,aAAa,cAAc,aAAa,SACxC,MAAM,aAAa,wBAAwB,OAAO,aAAa,UAAU;AACjF;AACA,MAAM,cAAc,eAAe,mBAAmB;CA0BlD,OAAO;EAAE,sBAzBoB,cAAc,aAAa,QAAQ,KAAK,WAAW;GAC5E,gBAAgB,QAAQ,gBAAgB,IAAI;GAC5C,IAAI,OAAA,cAAiB,EAAE,kBAEnB,OAAO,uBAAuB;GAElC,OAAO;EACX,CAkB4B;EAAG,uBAjBD,cAAc,aAAa,SAAS,IAAI,MAAM,OAAO,UAAU;GACzF,MAAM,EAAE,WAAW;GAEnB,IAAI,CAAC,QACD,OAAO,QAAQ,OAAO,KAAK;GAE/B,MAAM,eAAe,gBAAgB,QAAQ,cAAc;GAC3D,IAAI,MAAM,YAAY,aAAa,mBAAmB,MAAM,QAAQ,GAEhE,OAAO,MAAM;GAEjB,IAAI,MAAM,YAAY,cAAc,KAAK,GACrC,OAAO,YAAY,eAAe,cAAc,OAAO,MAAM;GAEjE,MAAM,4BAA4B,cAAc,KAAK;GACrD,OAAO,QAAQ,OAAO,KAAK;EAC/B,CACmD;CAAE;AACzD;AAEA,WAAW,iBAAiB;AAC5B,WAAW,qBAAqB;AAChC,WAAW,2BAA2B;AACtC,WAAW,oCAAoC;AAC/C,WAAW,mBAAmB;AAC9B,WAAW,cAAc;AACzB,WAAW,mBAAmB;;;ACxM9B,MAAa,QAAQ;CACnB,KAAK;CACL,iBAAiB;CACjB,cAAc;CACd,YAAY;AACd;AAIA,MAAa,aAAa;CACxB,cAAc;CACd,yBAAyB;AAC3B;AAEA,MAAa,YAAmE;CAC9E,UAAU;CACV,OAAO;CACP,cAAc;AAChB;AAEA,MAAa,4BACX;AAEF,MAAM,gBAAgB,CAAC;AACvB,KAAK,IAAI,IAAI,OAAQ,KAAK,OAAQ,KAChC,cAAc,KAAK,CAAC;AAGtB,MAAa,mBAAmB;;;ACWhC,SAAgB,gBAAgB,SAAkB,QAA2B;CAC3E,MAAM,EAAE,YAAY;CACpB,MAAM,YAAYA,GAAO;CACzB,MAAM,YAAY,MAAM,OAAO,EAAE,SAAS,QAAQ,aAAa,CAAC;CAEhE,WAAW,WAAW;EACpB,YAAY,WAAW,YAAY,GAAI;EACvC,SAAS;;EAET,sBAAsB;EACtB,UAAU,YAAY,QAAQ;GAC5B,MAAM,eAAe,GAAG,IAAI,QAAQ,UAAU,MAAM,IAAI,QAAQ,QAAQ,YAAY,KAAK,iBAAiB,GAAG,IAAI,QAAQ,OAAO;GAChI,OAAO,QACL,2CAA2C,WAAW,aAAa,cACrE;EACF;CAEF,CAAC;;CAGD,UAAU,aAAa,QAAQ,KAC5B,WAAW;EACV,OAAO,MACL,gBAAgB,OAAO,QAAQ,YAAY,EAAE,GAAG,OAAO,MAAM,OAAO,OAAO,IAAI,KAAK,UAAU,OAAO,IAAI,MAAM,IACjH;EACA,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,OAAO,MAAO,GAAG;GAG5C,MAAM,eAAe,OAAO,OAAO,SAAS;GAK5C,MAAM,eAAe;IACnB,WAAW;IACX,WAAW;IACX,SAAS;IACT,GARY,eAAe,KAAK,MAAM,OAAO,IAAI,IAAI,OAAO;GAS9D;GACA,OAAO,OAAO,eAAe,KAAK,UAAU,YAAY,IAAI;EAC9D;EACA,OAAO;CACT,IACC,UAAiB,QAAQ,OAAO,KAAK,CACxC;;CAGA,OAAO,EACL,OAAO,UAA0B;EAC/B,MAAM,SAAS,QAAQ;GAAE,MAAM,QAAQ;GAAM;EAAM,CAAC;EAEpD,MAAM,UAAU,YAA6B;GAC3C,IAAI,OAAO,WAAW,UAAU,OAAO,QAAQ,QAAQ,MAAM;GAC7D,OAAO;EACT;EAEA,MAAM,eAAe,OAAO,EAC1B,WACA,oBAIqB;GACrB,MAAM,OAAO,UAAU;GACvB,IAAI,SAAS,qBACX,MAAM,IAAI,MAAM,kDAAkD;GACpE,MAAM,EAAE,SAAS,MAAM,UAAU,KAAa,iBAAiB;IAC7D,MAAM,MAAM,QAAQ;IACpB,WAAW,OAAO,KAAK,UAAU,WAAW,QAAQ,CAAC,CAAC,SAAS,KAAK;IACpE,aAAa;IACb,YAAY,UAAU;IACtB,MAAM,UAAU;IAChB,MAAM,UAAU;IAChB,MAAM;IACN;GACF,CAAC;GACD,OAAO;EACT;EAEA,MAAM,2BAA2B,OAAO,WAGjB;GACrB,MAAM,EAAE,WAAW,gBAAgB;GACnC,MAAM,UAAU;IAAE,MAAM,MAAM,QAAQ;IAAG;IAAW,YAAY;GAAY;GAE5E,QAAO,MADW,UAAU,KAAa,+BAA+B,OAAO,EAAA,CACpE;EACb;EAEA,MAAM,uBAAuB,YAA6B;GACxD,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM;IACZ,MAAM;GACR;GACA,MAAM,EAAE,SAAS,MAAM,UAAU,KAAa,2BAA2B,OAAO;GAChF,OAAO;EACT;EAEA,MAAM,8BAA8B,YAA6B;GAE/D,MAAM,UAAU;IAAE,MAAM,MAAM,QAAQ;IAAG,MAAA;IAAM,MAAM,MAAM;GAAa;GACxE,MAAM,MAAM,MAAM,UAAU,KAAa,2BAA2B,OAAO;GAC3E,OAAO,OAAO,KAAK,IAAI,MAAM,KAAK,CAAC,CAAC,SAAS,QAAQ;EACvD;EAEA,MAAM,iBAAiB,YAOjB;GACJ,MAAM,EAAE,MAAM,mBAAmB,MAAM,UAAU,KAAa,oBAAoB,EAChF,MAAM,MAAM,QAAQ,EACtB,CAAC;GACD,MAAM,oBAAoB,OAAO,KAAK,gBAAgB,KAAK;GAC3D,MAAM,UAAU,kBAAkB,SAAS,EAAW;GACtD,OAAO;IACL,aAAa;KACX,UAAU,kBAAkB,MAAM,GAAG,EAAE,CAAC,CAAC,SAAS,QAAQ;KAC1D,gBAAgB,kBAAkB,MAAM,IAAI,EAAO,CAAC,CAAC,SAAS,QAAQ;KACtE,aAAa,kBAAkB,MAAM,IAAS,KAAc,OAAO,CAAC,CAAC,SAAS,QAAQ;IACxF;IACA,QAAQ;GACV;EACF;EAEA,MAAM,wBAAwB,YAGxB;GACJ,MAAM,MAAM,MAAM,UAAU,KAGzB,4BAA4B,EAAE,MAAM,MAAM,QAAQ,EAAE,CAAC;GACxD,OAAO;IACL,8BAA8B,IAAI,KAAK;IACvC,6BAA6B,IAAI,KAAK;GACxC;EACF;EAEA,MAAM,2BAA2B,YAA4D;GAC3F,OAAO,aAAa,EAAE,MAAM,MAAM,gBAAgB,CAAC;EACrD;EAEA,MAAM,kBAAkB,YAA6B;GAInD,QAAO,MAHW,UAAU,KAAiC,mBAAmB,EAC9E,MAAM,MAAM,QAAQ,EACtB,CAAC,EAAA,CACU,KAAK,eAAe,YAAY;EAC7C;EAEA,MAAM,eAAe,YAA4D;GAC/E,OAAO,aAAa,EAAE,MAAM,MAAM,IAAI,CAAC;EACzC;EAEA,MAAM,sBAAsB,YAA4D;GACtF,OAAO,aAAa,EAAE,MAAM,MAAM,WAAW,CAAC;EAChD;EAEA,MAAM,aAAa,YAA8B;GAE/C,QAAO,MADW,UAAU,KAAe,sBAAsB,EAAE,MAAM,MAAM,QAAQ,EAAE,CAAC,EAAA,CAC/E,KAAK,SAAS;EAC3B;EAEA,MAAM,uBAAuB,YAA4D;GACvF,MAAM,EAAE,SAAS,MAAM,UAAU,KAC/B,+BACA,EAAE,MAAM,MAAM,QAAQ,EAAE,CAC1B;GACA,OAAO;IACL,QAAQ,KAAK;IACb,WAAW,OAAO,KAAK,KAAK,aAAa,KAAK,CAAC,CAAC,SAAS,QAAQ;GACnE;EACF;EAEA,MAAM,cAAc,OAAO,WAEN;GACnB,MAAM,EAAE,kBAAkB;GAC1B,MAAM,YAAY,OAAO,KAAK,cAAc,YAAY,WAAW,QAAQ;GAC3E,MAAM,oBAAoB,OAAO,KAAK,cAAc,YAAY,gBAAgB,QAAQ;GACxF,MAAM,yBAAyB,OAAO,KAAK,cAAc,YAAY,aAAa,QAAQ;GAC1F,MAAM,cAAc,OAAO,OAAO;IAChC,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;IAC9B;IACA;IACA,OAAO,KAAK,CAAC,uBAAuB,MAAM,CAAC;IAC3C;GACF,CAAC;GACD,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM;IACZ,QAAQ,cAAc;IACtB,aAAa,YAAY,SAAS,KAAK;IACvC,UAAU,WAAW;GACvB;GACA,MAAM,EAAE,MAAM,mBAAmB,MAAM,UAAU,KAAa,iBAAiB,OAAO;GACtF,IAAI,mBAAmB,QACrB,MAAM,IAAI,MAAM,uCAAuC,gBAAgB;EAE3E;EAEA,MAAM,WAAW,OAAO,WAUlB;GACJ,MAAM,EAAE,WAAW,iBAAiB,MAAM,SAAS;GACnD,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB;IACA;IACA,MAAM,UAAU;IAChB,UAAU;IACV,MAAM;IACN,aAAa;GACf;GACA,MAAM,EAAE,SAAS,MAAM,UAAU,KAAa,aAAa,OAAO;GAClE,MAAM,WAAW,OAAO,KAAK,MAAM,KAAK;GACxC,IAAI,IAAI;GACR,MAAM,MAAM,SAAS,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;GACrC,KAAK;GACL,MAAM,SAAS,SAAS,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,SAAS,KAAK;GACvD,KAAK;GACL,MAAM,kBAAkB,SAAS,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;GACjD;GACA,MAAM,YAAY,SAAS,MAAM,GAAG,IAAI,eAAe;GACvD,KAAK;GACL,OAAO;IACL,aAAa,SAAS,MAAM,GAAG,SAAS,SAAS,CAAC;IAClD;IACA;IACA;GACF;EACF;EAEA,MAAM,eAAe,OAAO,WAAmD;GAC7E,MAAM,EAAE,cAAc;GACtB,MAAM,UAAU;IAAE,MAAM,MAAM,QAAQ;IAAG;GAAU;GAEnD,QAAO,MADW,UAAU,KAAa,sBAAsB,OAAO,EAAA,CAC3D;EACb;EAEA,MAAM,aAAa,OAAO,EAAE,cAA0D;GACpF,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB,MAAM,QAAQ;IACd,SAAS;KACP,mBAAmB,QAAQ,QAAQ;KACnC,eAAe,QAAQ,QAAQ;KAC/B,gBAAgB,QAAQ,QAAQ;IAClC;IACA,2BAA2B;KACzB,WAAW,QAAQ,wBAAwB;KAC3C,iBAAiB,QAAQ,wBAAwB;KACjD,aAAa,QAAQ,wBAAwB;KAC7C,WAAW,QAAQ,wBAAwB;IAC7C;GACF;GACA,MAAM,UAAU,KAAK,sBAAsB,OAAO;EACpD;EAEA,MAAM,4BAA4B,OAAO,WAIgB;GACvD,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB,WAAW,WAAW;IACtB,WAAW,OAAO;IAElB,uBAAuB;IACvB,cAAc,OAAO;GACvB;GACA,MAAM,EAAE,SAAS,MAAM,UAAU,KAAa,kCAAkC,OAAO;GACvF,MAAM,SAAS,OAAO,KAAK,MAAM,KAAK;GACtC,MAAM,aAAa,OAAO,SAAS,CAAC;GACpC,OAAO;IACL,WAAW,OAAO,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,QAAQ;IAC5D,WAAW,OAAO,MAAM,aAAa,CAAC,CAAC,CAAC,SAAS,QAAQ;GAC3D;EACF;EAEA,MAAM,2BAA2B,OAAO,WAInB;GACnB,MAAM,EAAE,WAAW,gBAAgB;GACnC,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB,WAAW,WAAW;IACtB;IAEA,uBAAuB;IACvB,cAAc;GAChB;GACA,MAAM,EAAE,MAAM,mBAAmB,MAAM,UAAU,KAC/C,iCACA,OACF;GACA,IAAI,mBAAmB,QACrB,MAAM,IAAI,MAAM,uCAAuC,gBAAgB;EAE3E;EAEA,MAAM,eAAe,OAAO,WAE0B;GACpD,MAAM,EAAE,SAAS;GAEjB,MAAM,UAAU;IAAE,MAAM,MAAM,QAAQ;IAAG,WAAW;IAAM;GAAK;GAC/D,MAAM,MAAM,MAAM,UAAU,KAAiC,mBAAmB,OAAO;GACvF,OAAO;IACL,QAAQ,IAAI,KAAK;IACjB,WAAW,OAAO,KAAK,IAAI,KAAK,aAAa,KAAK,CAAC,CAAC,SAAS,QAAQ;GACvE;EACF;EAEA,MAAM,yBAAyB,OAAO,WAAmD;GACvF,MAAM,EAAE,YAAY;GACpB,MAAM,UAAU;IACd,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM;IACZ;GACF;GACA,MAAM,EAAE,MAAM,cAAc,MAAM,UAAU,KAAa,gBAAgB,OAAO;GAChF,OAAO;EACT;EAEA,MAAM,YAAY,UAAmC;GACnD,OAAO,KAAK,8CAA8C;GAC1D,OAAO,QAAQ,QAAQ,MAAM;EAC/B;EAEA,MAAM,aAAa,YAA6B;GAC9C,OAAO;EACT;EAEA,MAAM,OAAO,YAA+C;GAC1D,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,GAAG,CAAC;GAC3C,OAAO,EAAE,aAAa,KAAK;EAC7B;EAEA,MAAM,UAAU,YAA6B;GAC3C,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,GAAG,CAAC;GAC3C,OAAO;EACT;EAEA,OAAO;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF,EACF;AACF;;;ACraA,MAAM,eAAe,CAAC;AACtB,MAAM,gBAAgB,CAAC;AACvB,MAAa,8BAA8B,MAAM,iBAAiB;CAC9D,cAAc,QAAQ;AAC1B;AACA,MAAa,0BAA0B,SAAS;CAC5C,MAAM,yBAAyB,MAAM;EACjC;EACA,YAAY,SAAS,QAAQ,SAAS;GAGlC,MAAM,WAAW,MAAM,OAAO;GAE9B,OAAO,eAAe,MAAM,iBAAiB,SAAS;GACtD,KAAK,OAAO;GACZ,IAAI,QACA,KAAK,MAAM,KAAK,QAGZ,KAAK,KAAK,OAAO;GAGzB,IAAI,WAAW,SAAS,OAAO,KAAK,WAAW,WAAW,CAAC,KAAK,OAAO;IAGnE,MAAM,QAAQ,QAAQ;IACtB,KAAK,QAAQ;IACb,IAAI,WAAW,OACX,KAAK,QAAQ,KAAK,QAAQ,cAAc,MAAM;GAEtD;EACJ;CACJ;CACA,aAAa,QAAQ;CACrB,OAAO;AACX;AACA,SAAS,SAAS,OAAO;CACrB,OAAO,OAAO,UAAU;AAC5B;ACxCwC,uBAAuB,qBAAqB;AACjD,uBAAuB,qBAAqB;AAC3B,uBAAuB,sCAAsC;AACnF,uBAAuB,gBAAgB;AACrE,MAAa,oBAAoB,uBAAuB,mBAAmB;AAC5C,uBAAuB,iBAAiB;AACvE,MAAa,iBAAiB,uBAAuB,gBAAgB;AACjC,uBAAuB,sBAAsB;AAC1C,uBAAuB,yBAAyB;AACnD,uBAAuB,sBAAsB;AACtC,uBAAuB,6BAA6B;AAClD,uBAAuB,+BAA+B;AAC9D,uBAAuB,kBAAkB;AACrC,uBAAuB,2BAA2B;AAChD,uBAAuB,6BAA6B;AAC5D,uBAAuB,qBAAqB;AAC/E,MAAa,eAAe,uBAAuB,cAAc;AAChC,uBAAuB,mBAAmB;AAC3C,uBAAuB,kBAAkB;AACjC,uBAAuB,0BAA0B;AACvD,uBAAuB,0BAA0B;AAC5C,uBAAuB,yBAAyB;AACvF,MAAa,qBAAqB,uBAAuB,oBAAoB;AAC5B,uBAAuB,mCAAmC;AAC1D,uBAAuB,mCAAmC;AAC1D,uBAAuB,mCAAmC;AACzE,uBAAuB,eAAe;AAC1B,uBAAuB,gCAAgC;AACvD,uBAAuB,gCAAgC;AACtD,uBAAuB,iCAAiC;AACpE,uBAAuB,qBAAqB;AAC1C,uBAAuB,uBAAuB;AACtD,uBAAuB,eAAe;AACtC,uBAAuB,eAAe;AACrC,uBAAuB,gBAAgB;AAC9B,uBAAuB,yBAAyB;AAC3D,uBAAuB,cAAc;AACL,uBAAuB,8CAA8C;AAC1F,uBAAuB,yBAAyB;AAC1C,uBAAuB,+BAA+B;AAC5D,uBAAuB,yBAAyB;AACtD,uBAAuB,mBAAmB;AACjD,uBAAuB,YAAY;AAC/B,uBAAuB,gBAAgB;AAC5B,uBAAuB,2BAA2B;AACtD,uBAAuB,uBAAuB;AACpC,uBAAuB,4BAA4B;AAC1D,uBAAuB,qBAAqB;AACxC,uBAAuB,8BAA8B;AACnD,uBAAuB,gCAAgC;AAC7D,uBAAuB,qBAAqB;AAClC,uBAAuB,+BAA+B;AAC9D,uBAAuB,uBAAuB;AAClD,uBAAuB,wBAAwB;AAC1D,uBAAuB,aAAa;AACnC,uBAAuB,cAAc;AACjC,uBAAuB,kBAAkB;AACzC,uBAAuB,kBAAkB;AACrC,uBAAuB,sBAAsB;AAC7C,uBAAuB,sBAAsB;AACvC,uBAAuB,4BAA4B;AAC5C,uBAAuB,mCAAmC;AAC1D,uBAAuB,mCAAmC;AACzE,uBAAuB,oBAAoB;AAC3C,uBAAuB,oBAAoB;AAC9B,uBAAuB,iCAAiC;AAC9D,uBAAuB,2BAA2B;AAC/B,uBAAuB,8CAA8C;AACjG,uBAAuB,kBAAkB;AACzC,uBAAuB,kBAAkB;AAC7C,uBAAuB,cAAc;AAEjC,uBAAuB,kBAAkB;AACzC,uBAAuB,kBAAkB;AAChC,uBAAuB,2BAA2B;AAClD,uBAAuB,2BAA2B;AACxD,uBAAuB,qBAAqB;AAC9C,uBAAuB,mBAAmB;AACzC,uBAAuB,oBAAoB;AAClC,uBAAuB,6BAA6B;AACnE,uBAAuB,cAAc;AAC1B,uBAAuB,oBAAoB;AAC5C,uBAAuB,mBAAmB;AACrC,uBAAuB,6BAA6B;AAC1D,uBAAuB,uBAAuB;AACtD,uBAAuB,eAAe;AAC/B,uBAAuB,sBAAsB;AACzC,uBAAuB,0BAA0B;AACxD,uBAAuB,mBAAmB;AACnB,uBAAuB,0CAA0C;AACpE,uBAAuB,uCAAuC;AAChF,uBAAuB,qBAAqB;AAC5C,uBAAuB,qBAAqB;AAC7C,uBAAuB,oBAAoB;AAChD,uBAAuB,eAAe;AACxB,uBAAuB,6BAA6B;AAC7D,uBAAuB,oBAAoB;AACpC,uBAAuB,2BAA2B;AACpD,uBAAuB,yBAAyB;AACpD,uBAAuB,qBAAqB;AACtD,uBAAuB,WAAW;AACzB,uBAAuB,oBAAoB;AACnC,uBAAuB,4BAA4B;AAC7F,MAAa,iCAAiC,uBAAuB,gCAAgC;AAC/D,uBAAuB,wBAAwB;AACrF,MAAa,iCAAiC,uBAAuB,gCAAgC;AACrD,uBAAuB,kCAAkC;AAC5D,uBAAuB,+BAA+B;AAC9D,uBAAuB,uBAAuB;AAC3C,uBAAuB,0BAA0B;AAChD,uBAAuB,2BAA2B;AACtD,uBAAuB,uBAAuB;AACxC,uBAAuB,6BAA6B;AACnD,uBAAuB,8BAA8B;AACtD,uBAAuB,6BAA6B;AAC5D,uBAAuB,qBAAqB;AAC/C,uBAAuB,kBAAkB;AAC3C,uBAAuB,gBAAgB;AACzC,uBAAuB,cAAc;AACjC,uBAAuB,kBAAkB;AAC9C,uBAAuB,aAAa;AACrC,uBAAuB,YAAY;AAC3B,uBAAuB,oBAAoB;AAC9B,uBAAuB,iCAAiC;AACvE,uBAAuB,kBAAkB;AAChD,uBAAuB,WAAW;AAC9B,uBAAuB,eAAe;AACjC,uBAAuB,oBAAoB;AAC3C,uBAAuB,oBAAoB;AACjD,uBAAuB,cAAc;AACrC,uBAAuB,cAAc;AACjE,MAAa,8BAA8B,uBAAuB,6BAA6B;AAE9C,uBAAuB,mCAAmC;AAEtE,uBAAuB,mBAAmB;AACtD,uBAAuB,WAAW;AAEhB,uBAAuB,6BAA6B;AAC1D,uBAAuB,uBAAuB;AACtC,uBAAuB,+BAA+B;AACtD,uBAAuB,+BAA+B;AAC9C,uBAAuB,uCAAuC;AAC3D,uBAAuB,0CAA0C;AAC7E,uBAAuB,8BAA8B;AAEjE,uBAAuB,kBAAkB;AAE5C,uBAAuB,eAAe;AACpC,uBAAuB,iBAAiB;AAC7C,uBAAuB,YAAY;AAC1B,uBAAuB,qBAAqB;AAC9B,uBAAuB,mCAAmC;AACtE,uBAAuB,uBAAuB;;;;AAInF,IAAW;CACV,SAAU,sBAAsB;CAC7B,qBAAqB,aAAa;CAClC,qBAAqB,8BAA8B;CACnD,qBAAqB,kCAAkC;CACvD,qBAAqB,8BAA8B;AACvD,EAAA,CAAG,yBAAyB,uBAAuB,CAAC,EAAE;;;;;AAsBtD,IAAa,iBAAb,cAAoC,MAAM;CACtC;CACA,YAAY,SAAS,IAAI;EACrB,MAAM,OAAO;EACb,MAAM,WAAW,IAAI;EACrB,KAAK,OAAO;EACZ,KAAK,UAAU;EACf,KAAK,QAAQ,IAAI,MAAM,OAAO,CAAC,CAAC;EAChC,KAAK,KAAK;CACd;AACJ;AACA,2BAA2B,mBAAkB,MAAK,IAAI,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC;AACrF,MAAa,cAAc;CACvB,gCAAgC;CAChC,yBAAyB;CACzB,mBAAmB;CACnB,8BAA8B;CAC9B,cAAc;CACd,sBAAsB;CACtB,qCAAqC;CACrC,iCAAiC;CACjC,4BAA4B;CAC5B,kCAAkC;CAClC,yBAAyB;CACzB,oBAAoB;CACpB,qBAAqB;CACrB,gBAAgB;CAChB,gBAAgB;CAChB,QAAQ;CACR,mBAAmB;CACnB,gBAAgB;CAChB,kBAAkB;CAClB,iBAAiB;CACjB,mBAAmB;CACnB,sBAAsB;CACtB,wBAAwB;CACxB,aAAa;CACb,gBAAgB;CAChB,WAAW;CACX,eAAe;CACf,mBAAmB;CACnB,gBAAgB;CAChB,4BAA4B;CAC5B,gBAAgB;CAChB,yBAAyB;CACzB,IAAI;CACJ,wBAAwB;CACxB,2BAA2B;CAC3B,+BAA+B;CAC/B,mBAAmB;CACnB,cAAc;CACd,wBAAwB;CACxB,kBAAkB;CAClB,kCAAkC;CAClC,yBAAyB;CACzB,oBAAoB;CACpB,kCAAkC;CAClC,kCAAkC;CAClC,4BAA4B;CAC5B,sBAAsB;CACtB,aAAa;CACb,uBAAuB;CACvB,uBAAuB;CACvB,sBAAsB;CACtB,uBAAuB;CACvB,cAAc;AAClB;AACA,SAAgB,oBAAoB,MAAM;CACtC,QAAQ,MAAR;EAEI,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;EACX,KAAK,OACD,OAAO;CACf;CACA,IAAI,SAAU,QAAQ,QAAQ,OAC1B,OAAO;AAEf;;;;;AAKA,IAAa,uBAAb,MAAa,6BAA6B,MAAM;CAC5C;CACA;;;;;;;CAOA,YAAY,YAAY,EAAE,0BAA0B,SAAS,CAAC,GAAG;EAC7D,MAAM,aAAa,OAAO,KAAK,WAAW,CAAC,CAAC,MAAK,MAAK,YAAY,OAAO,UAAU,KAAK;EAGxF,MAAM,UAAU,kBAFH,oBAAoB,UAAU,KAAK,WAET,MADjB,WAAW,SAAS,EACe,EAAE;EAC3D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,aAAa;EAClB,OAAO,eAAe,MAAM,qBAAqB,SAAS;EAE1D,IAAI,2BAA2B,eAAe,YAAY,eACtD,OAAO,IAAI,kBAAkB,OAAO;CAE5C;AACJ;AACA,IAAa,oBAAb,MAAa,0BAA0B,qBAAqB;CACxD,YAAY,SAAS;EACjB,MAAM,YAAY,eAAe,EAAE,yBAAyB,MAAM,CAAC;EACnE,IAAI,SACA,KAAK,UAAU;EAEnB,KAAK,OAAO;EACZ,OAAO,eAAe,MAAM,kBAAkB,SAAS;CAC3D;AACJ;AAQA,2BAA2B,yBAAwB,MAAK,IAAI,qBAAqB,EAAE,UAAU,CAAC;;;AC7S9F,MAAM,yBAAyB,UAC7B,WACE,SAAS,iBAAiB,wBAAwB,MAAM,eAAe,QACnE,IAAI,aAAa,MAAM,OAAO,IAC9B,iBAAiB,wBAAwB,MAAM,eAAe,QAC5D,IAAI,4BAA4B,MAAM,OAAO,IAC7C,KACR;AAGF,MAAM,QAAQ,IAAI,cAAc,CAAC,CAAC;AAyBlC,MAAM,UAA6B,CAAC;AAEpC,MAAa,2BAA2B,WAAkC;CACxE,QAAQ,KAAK,MAAM;AACrB;AAEA,MAAa,SAAS,WAAsB,aAAoC;CAC9E,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,IAAI,EAAE,QAAQ,WAAW,QAAQ;EACvC,IAAI,GAAG,OAAO;CAChB;CAEA,OAAO,UAAU,MAAM;AACzB;AAEA,MAAa,QAAQ,aAAyC;CAC5D,KAAK,MAAM,KAAK,SAAS;EACvB,MAAM,IAAI,EAAE,KAAK,QAAQ;EACzB,IAAI,GAAG,OAAO;CAChB;CACA,OAAO,QAAQ,uBAAO,IAAI,MAAM,8BAA8B,UAAU,CAAC;AAC3E;AAEA,MAAM,oBACH,aACG,eAEF,WAAW,QAAQ,MAAM;CACvB,IAAI,OAAO;CAGX,MAAM,iBAAsB;EAC1B,IAAI,MAAM,OAAO;EACjB,OAAO;EACP,OAAO,QAAQ;CACjB;CAEA,MAAM,MAAM,WAAW,UAAU;EAC/B,OAAO,MAAM,EAAE,KAAK,CAAC;EACrB,gBAAgB;GACd,SAAc,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC;EACzC;EACA,QAAQ,MAAM;GACZ,SAAc,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;EACvC;CACF,CAAC;CACD,aAAa;EACX,IAAI,YAAY;EAChB,SAAc;CAChB;AACF,CAAC;AAIL,MAAM,cAA4B,CAAC;AAEnC,MAAM,eAAe,CAAC;AAEtB,MAAa,cACV,cACG,QACF,IAAI,YAAY,MAAM;CAEpB,IAAI;CAEJ,IAAI;CAEJ,MAAM,cAAc,aAAa,aAAa,QAAQ,QAAQ;CAG9D,MAAM,YAAY,WAAW,aAC3B,MAAM,WAAW,QAAQ,CAAC,CAEvB,YAAY,CAAC,CAAC,CAAC,CACf,WAAW;EAEV,SAAS,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC;CAIL,IAAI;CAGJ,aAAa,YAAY,IAAI,SAAS,YAAY;EAChD,SAAS;CACX,CAAC;CAED,YACG,WAAW,KAAK,QAAQ,CAAC,CAAC,CAE1B,KAAK,OAAO,cAAc;EAEzB,IAAI,cAGF,OAAO,SAAS,WAAW,CAAC,MAAM,CAAC;EAGrC,IACE,UAAU,6BACV,OAAO,UAAU,8BAA8B,YAE/C,MAAM,UAAU,0BAA0B,MAAM;EAGlD,OAAO;CACT,CAAC,CAAC,CAED,OAAO,MAAM;EAEZ,OAAO;EACP,IAAI,aAAa,mBAAmB,MAAM;EAC1C,IAAI,aAAa,gCAAgC,MAAM;EACvD,IAAI,aAAa,gCAAgC,MAAM;EACvD,MAAM,IAAI,eAAe,EAAE,OAAO;CACpC,CAAC,CAAC,CAED,MAAM,cAAc;EACnB,IAAI,CAAC,WAAW;EAGhB,IAAI,cAGF,OAAO,SAAS,WAAW,CAAC,MAAM,CAAC;EAGrC,MAAM,WAAW,YAAY,KAAK,SAAS,KAAK,CAAC;EACjD,MAAM,IAAI,SAAS,CAAC,CACjB,KACC,WAAW,qBAAqB,GAEhC,uBAEE,SAAS,WAAW,CAAC,GAAG,UAAU,MAAM,CAAC,CAC3C,CACF,CAAC,CACA,UAAU,CAAC;CAChB,CAAC,CAAC,CAED,OAAO,UAAU,EAAE,MAAM,KAAK,CAAC;CAClC,aAAa;EACX,eAAe;EAEf,IAAI,KAAK,IAAI,YAAY;CAC3B;AACF,CAAC;AAEL,MAAM,4BAA4B;AAElC,MAAa,oBACV,iBAEA,aACC,SAAS,KACP,UAAU,UAAU;CAClB,IAAI,CAAC,YAAY,KAAK,GACpB,OAAO,WAAW,KAAK;CAGzB,OAAO,MAAM,yBAAyB;AACxC,CAAC,CACH;AAEJ,MAAa,qBACV,cAEC,KACA,oBAA8C,UAE9C,WAAW,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,iBAAiB,WAAW,CAAC,CAAC;;;ACnO3E,MAAa,0BAA0B,UAAkD;CACvF,OACE,iBAAiB,wBAChB,iBAAiB,SAAS,gBAAgB,SAAS,MAAM,QAAQ,WAAW,gBAAgB;AAEjG;AAEA,MAAM,sBAAsB;CAC1B;CAGA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,uBAAuB,UAA0B;CAC5D,OAAO,uBAAuB,KAAK,KAAK,oBAAoB,SAAS,MAAM,UAAU;AACvF"}

package/lib/device.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_device = require("./device-0lcfYGHr.cjs");
+const require_device = require("./device-B6QZOEDT.cjs");
 exports.createApiDevice = require_device.createApiDevice;
 exports.isDeviceCancelError = require_device.isDeviceCancelError;
 exports.isTransportStatusError = require_device.isTransportStatusError;

package/lib/device.d.cts

@@ -1,2 +1,2 @@
-import { a as createApiDevice, i as ApiDevice, n as isTransportStatusError, o as Device, r as registerTransportModule, t as isDeviceCancelError } from "./index-BE7oUpCb.cjs";
-export { ApiDevice, Device, createApiDevice, isDeviceCancelError, isTransportStatusError, registerTransportModule };
+import { a as createApiDevice, i as ApiDevice, n as isTransportStatusError, o as Device, r as registerTransportModule, t as isDeviceCancelError } from "./index-sWTlrbOl.cjs";
+export { type ApiDevice, type Device, createApiDevice, isDeviceCancelError, isTransportStatusError, registerTransportModule };

package/lib/device.d.ts

@@ -1,2 +1,2 @@
-import { a as createApiDevice, i as ApiDevice, n as isTransportStatusError, o as Device, r as registerTransportModule, t as isDeviceCancelError } from "./index--fscLDTT.js";
-export { ApiDevice, Device, createApiDevice, isDeviceCancelError, isTransportStatusError, registerTransportModule };
+import { a as createApiDevice, i as ApiDevice, n as isTransportStatusError, o as Device, r as registerTransportModule, t as isDeviceCancelError } from "./index-CuWiM97X.js";
+export { type ApiDevice, type Device, createApiDevice, isDeviceCancelError, isTransportStatusError, registerTransportModule };

package/lib/device.js

@@ -1,2 +1,2 @@
-import { n as isTransportStatusError, r as registerTransportModule, s as createApiDevice, t as isDeviceCancelError } from "./device-B8Fww8_6.js";
+import { n as isTransportStatusError, r as registerTransportModule, s as createApiDevice, t as isDeviceCancelError } from "./device-DBzLykrI.js";
 export { createApiDevice, isDeviceCancelError, isTransportStatusError, registerTransportModule };

package/lib/engine.cjs

@@ -1,13 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_chunk = require("./chunk-CKQMccvm.cjs");
-const require_device = require("./device-0lcfYGHr.cjs");
-const require_utils = require("./utils-DbSFXp4c.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
+const require_device = require("./device-B6QZOEDT.cjs");
+const require_utils = require("./utils-CavXJGCh.cjs");
 let invariant = require("invariant");
-invariant = require_chunk.__toESM(invariant);
+invariant = require_rolldown_runtime.__toESM(invariant, 1);
 let rxjs = require("rxjs");
 let _trpc_client = require("@trpc/client");
 let superjson = require("superjson");
-superjson = require_chunk.__toESM(superjson);
+superjson = require_rolldown_runtime.__toESM(superjson, 1);
 //#region src/device/real-device.ts
 const MAX_CHUNK_LENGTH = 250;
 const getPathFromPathString = (pathString) => {
@@ -386,6 +386,7 @@ function createRealDevice(options, logger) {
 							finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);
 						}
 						break;
+					/* v8 ignore next -- @preserve */
 					default: throw new Error(`Invalid response type: ${responseType}`);
 				}
 			}
@@ -861,3 +862,5 @@ function createEngine(options, logger) {
 exports.createEngine = createEngine;
 exports.fetchAll = require_utils.fetchAll;
 exports.fetchAllCursor = require_utils.fetchAllCursor;
+
+//# sourceMappingURL=engine.cjs.map

package/lib/engine.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"engine.cjs","names":["PAGINATED_STATUS","LockedDeviceError","isTransportStatusError","DisconnectedDevice","withDevicePolling","PATHS","APPID_VAULT_ADMINISTRATOR","STR_ROLES","SCRIPT_IDS","createApiDevice","buildTrpcContext"],"sources":["../src/device/real-device.ts","../src/trpc.ts","../src/engine/index.ts"],"sourcesContent":["import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: async (): Promise<string> => {\n      logger.info(`[device] generateSeedFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    generateWrappingKeyFragment: async (): Promise<string> => {\n      logger.info(`[device] generateWrappingKeyFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: async (): Promise<string> => {\n      logger.info(`[device] getDeviceUserId`);\n      const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n      return removeStatus(response).toString(\"hex\").toUpperCase();\n    },\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: async (params: {\n      secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n    }): Promise<void> => {\n      logger.info(`[device] openSession`);\n      const { secureChannel } = params;\n\n      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n      const dataDerivation = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n      const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n      const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n      const attestation = Buffer.concat([\n        Buffer.from([sigBuffer.length]),\n        sigBuffer,\n        attestationPubBuffer,\n        Buffer.from([certBuffer.length]),\n        certBuffer,\n      ]);\n\n      const lengthAttestation = Buffer.alloc(2);\n      lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n      );\n    },\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: async (params: {\n      handshake: string;\n      handshakeAttestation: HsmCertificate;\n      partitionId: string;\n    }): Promise<{ handshake: string; signature: string }> => {\n      logger.info(`[device] startKKPatternAsResponder`);\n      const data = buildAttestation(params);\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n      const buffer = removeStatus(bufWithStatus);\n      const dataLength = buffer.readInt8(0);\n      return {\n        handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n        signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n      };\n    },\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n","import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type RouterOutputs, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  OnboardingOperationParams,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n  onScreenDisplayed,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n  onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  await onScreenDisplayed?.();\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n    __options: options,\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n\n            getWorkspacesForSso: async (): Promise<\n              RouterOutputs[\"auth\"][\"sso\"][\"findWorkspaces\"][\"workspaces\"]\n            > => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaces } = await client.auth.sso.findWorkspaces.query({ pubKey });\n              return workspaces;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (\n            wrappingKey: WrappingKeyResponse,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            await params?.onScreenDisplayed?.();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (\n            registerParams: RegisterOnboardingDeviceParams,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const { role, name } = registerParams;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n              onScreenDisplayed: params?.onScreenDisplayed,\n            });\n          },\n\n          reviewSharedOwner: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          reviewExternalSigners: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitExternalSignersRegistration.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (\n            challenge: OnboardingSeedChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                challengeId: challenge.challengeId,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n              params?: OnboardingOperationParams,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n                onScreenDisplayed: params?.onScreenDisplayed,\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            if (challenge.challengeType === \"PSD\") {\n              const signature = await approveChallenge(challenge, params);\n              await params?.onPsdChallengeSigned?.();\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"PSD\", signature },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            if (challenge.challengeType === \"SOFT\") {\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"SOFT\" },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            throw new Error(\"Challenge type must be either PSD or SOFT\");\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,mBAAmB;AAMzB,MAAM,yBAAyB,eAAiC;AAE9D,QADc,WAAW,MAAM,KAAK,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC,CAChE,KAAK,UAAU,OAAO,gBAAgB,EAAE;;AAGvD,MAAM,eAAe,OAAe,WAA6B;CAC/D,MAAM,SAAS,EAAE;AACjB,MAAK,IAAI,IAAI,GAAG,OAAO,OAAO,IAAI,OAAO,QAAQ,KAAK,MAAM,OAAO,MACjE,QAAO,KAAK,OAAO,MAAM,GAAG,IAAI,KAAK,CAAC;AAExC,QAAO;;AAGT,MAAM,gBAAgB,WAA2B,OAAO,MAAM,GAAG,OAAO,SAAA,EAAuB;AAE/F,MAAM,cAAc,OAClB,WACA,SACA,MACA,YAAoB,qBACA;CACpB,MAAM,SAAS,YAAY,WAAW,KAAK;CAC3C,IAAI,WAAW,OAAO,KAAK,EAAE,CAAC;AAC9B,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,CAAC,GAAG,QAAQ;;AAGzB,OAAK,KAAK,KAAK;AACf,aAAY,MAAM,UAAU,KAAK,KAAK,IAAK,KAAK,IAAK,KAAK,IAAI,KAAK,IAAK,OAAO,CAC7E,OACA,GAAGA,eAAAA,iBACJ,CAAC;;AAEJ,QAAO;;AAGT,MAAM,oBAAoB,WAIZ;CACZ,MAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,WAAW,SAAS;CAC9E,MAAM,kBAAkB,OAAO,MAAM,EAAE;AACvC,iBAAgB,YAAY,UAAU,QAAQ,GAAG,EAAE;CAEnD,MAAM,aAAa,OAAO,KAAK,OAAO,qBAAqB,aAAa,SAAS;CACjF,MAAM,mBAAmB,OAAO,MAAM,EAAE;AACxC,kBAAiB,YAAY,WAAW,QAAQ,GAAG,EAAE;CAErD,MAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,gBAAgB,SAAS;CAEnF,MAAM,gBAAgB,OAAO,OAAO;EAClC;EACA;EACA;EACA;EACA;EACD,CAAC;CAEF,MAAM,eAAe,OAAO,KAAK,OAAO,WAAW,MAAM;CACzD,MAAM,qBAAqB,OAAO,MAAM,EAAE;AAC1C,oBAAmB,YAAY,aAAa,QAAQ,GAAG,EAAE;CAEzD,MAAM,YAAY,OAAO,KAAK,OAAO,aAAa,MAAM;CACxD,MAAM,kBAAkB,OAAO,MAAM,EAAE;AACvC,iBAAgB,YAAY,UAAU,QAAQ,GAAG,EAAE;CAEnD,MAAM,0BAA0B,OAAO,MAAM,EAAE;AAC/C,yBAAwB,cAAc,cAAc,QAAQ,EAAE;CAE9D,MAAM,OAAO,OAAO,OAAO;EACzB;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;CAEF,MAAM,oBAAoB,OAAO,MAAM,EAAE;AACzC,mBAAkB,cAAc,KAAK,QAAQ,EAAE;AAI/C,QAFe,OAAO,OAAO,CAAC,mBAAmB,KAAK,CAAC;;;AAOzD,MAAM,uBAAqC,QAAQ;AAEjD,KAAI,eAAeC,eAAAA,kBAAmB,QAAO;AAE7C,KAAIC,eAAAA,uBAAuB,IAAI,IAAI,IAAI,eAAe,MAAQ,QAAO;AAErE,KAAI,eAAeC,eAAAA,mBAAoB,QAAO;AAG9C,QAAO;;AAGT,SAAgB,iBAAiB,SAAkB,QAAwB;CACzE,MAAM,EAAE,gBAAgB;CAExB,eAAe,IACb,KACA,eAA6B,qBACjB;AACZ,UAAA,GAAA,KAAA,eACEC,eAAAA,kBAAkB,YAAY,EAAK,eAAA,GAAA,KAAA,MAAmB,IAAI,UAAU,CAAC,EAAE,aAAa,CACrF;;;CAIH,MAAM,gBAAyB;;CAE/B,MAAM,oBAA6B;CACnC,MAAM,OAAO,OACX,OAAwC,EAAE,KACJ;AAEtC,QAAM,IAEJ,OAAO,eAAe,IACtB,KAAK,gBAAgB,YACtB;AAED,MAAI;AACF,SAAM,aAAaC,eAAAA,MAAM,KAAK;IAAE,WAAW;IAAM,cAAc;IAAS,CAAC;AACzE,UAAO,EAAE,aAAa,MAAM;WACrB,KAAK;AACZ,OAAIH,eAAAA,uBAAuB,IAAI,IAAI,oBAAoB,IAAI,CACzD,QAAO,EAAE,aAAa,OAAO;AAE/B,SAAM;;;CAIV,MAAM,UAAU,OAAO,YAAqC;EAC1D,MAAM,MAAM,MAAM,KAAK,cACrB,UAAU,KAAK,KAAM,KAAM,GAAM,GAAM,OAAO,KAAK,SAAS,OAAO,CAAC,CACrE;AAED,QAAM,IAAI,SAAS,MAAM,WAAW,GAAG,IAAI,CAAC;AAC5C,SAAO,IAAI,SAAS,MAAM;;CAG5B,MAAM,eAAe,OACnB,YACA,EAAE,WAAW,mBACsC;AACnD,SAAO,KAAK,0BAA0B,WAAW,GAAG;EACpD,MAAM,OAAO,sBAAsB,WAAW;EAC9C,MAAM,OAAO,OAAO,OAAO,CACzB,OAAO,KAAK,CAAC,KAAK,OAAO,CAAC,EAC1B,GAAG,KAAK,KAAK,eAAe;GAC1B,MAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,OAAI,cAAc,YAAY,EAAE;AAChC,UAAO;IACP,CACH,CAAC;EACF,MAAM,QAAQ,YAAY,IAAO;EACjC,MAAM,WAAW,MAAM,KACpB,cAAc,UAAU,KAAK,KAAM,IAAM,OAAO,GAAM,KAAK,EAC5D,gBAAgB,oBACjB;EACD,MAAM,eAAe,SAAS,SAAS,EAAE;AAQzC,SAAO;GAAE,QAPM,SACZ,MAAM,GAAG,eAAe,EAAE,CAC1B,SAAS,MAAM,CACf,aAAa;GAIC,WAHC,SACf,MAAM,eAAe,GAAG,SAAS,SAAA,EAAuB,CACxD,SAAS,SAAS;GACO;;AAmV9B,QAhVuB;EACrB,cAAc,OAAO,EAAE,WAAW,EAAE,WAAW,MAAM,MAAM,aAAa,oBAAoB;AAC1F,UAAO,KAAK,wBAAwB;AACpC,IAAA,GAAA,UAAA,SAAU,SAAS,qBAAqB,mDAAmD;GAC3F,MAAM,oBAAoB,OAAO,KAAKI,eAAAA,2BAA2B,MAAM;GACvE,MAAM,aAAa,OAAO,KAAK,KAAK;GACpC,MAAM,kBAAkB,OAAO,KAAK,cAAc;GAElD,MAAM,gBAAgB,OAAO,OAAO;IAClC,OAAO,KAAKC,eAAAA,UAAU,OAAO,MAAM;IACnC,OAAO,KAAK,CAAC,WAAW,OAAO,CAAC;IAChC;IACA,OAAO,KAAK,CAAC,gBAAgB,OAAO,CAAC;IACrC;IACD,CAAC;GAEF,MAAM,sBAAsB,OAAO,MAAM,EAAE;AAC3C,uBAAoB,cAAc,cAAc,QAAQ,EAAE;GAE1D,MAAM,OAAO,OAAO,OAAO;IACzB,OAAO,KAAK,WAAW,SAAS;IAChC;IACA,OAAO,KAAK,CAAC,UAAU,OAAO,CAAC;IAC/B,OAAO,KAAK,WAAW,MAAM;IAC7B;IACA;IACD,CAAC;AAMF,UAAO,aAJgB,MAAM,KAAK,cAChC,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;IAAK,EAAE,KAAK,CACvD,CAEkC,CAAC,SAAS,MAAM;;EAGrD,0BAA0B,OAAO,WAIV;AAIrB,UAAO,aAHe,MAAM,KAAK,cAC/B,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;IAAK,EAAE,iBAAiB,OAAO,CAAC,CAC3E,CACiC,CAAC,SAAS,MAAM;;EAGpD,sBAAsB,YAA6B;AACjD,UAAO,KAAK,gCAAgC;GAC5C,MAAM,OAAO,sBAAsBF,eAAAA,MAAM,aAAa;GACtD,MAAM,OAAO,OAAO,OAAO,CACzB,OAAO,KAAK,CAAC,KAAK,OAAO,CAAC,EAC1B,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,QAAI,cAAc,YAAY,EAAE;AAChC,WAAO;KACP,CACH,CAAC;AAEF,UAAO,aADU,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,KAAK,CAAC,CAC1D,CAAC,SAAS,SAAS;;EAElD,6BAA6B,YAA6B;AACxD,UAAO,KAAK,uCAAuC;GACnD,MAAM,OAAO,sBAAsBA,eAAAA,MAAM,aAAa;GACtD,MAAM,OAAO,OAAO,OAAO,CACzB,OAAO,KAAK,CAAC,KAAK,OAAO,CAAC,EAC1B,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,QAAI,cAAc,YAAY,EAAE;AAChC,WAAO;KACP,CACH,CAAC;AAEF,UAAO,aADU,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,KAAK,CAAC,CAC1D,CAAC,SAAS,SAAS;;EAElD,gBAAgB,YAOV;GAEJ,MAAM,SAAS,aADO,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,EAAK,CAAC,CAC5C;GAC1C,MAAM,UAAU,OAAO,SAAS,GAAY;AAC5C,UAAO;IACL,aAAa;KACX,UAAU,OAAO,MAAM,GAAG,GAAG,CAAC,SAAS,SAAS;KAChD,gBAAgB,OAAO,MAAM,IAAI,GAAQ,CAAC,SAAS,SAAS;KAC5D,aAAa,OAAO,MAAM,IAAS,KAAc,QAAQ,CAAC,SAAS,SAAS;KAC7E;IACD;IACD;;EAEH,uBAAuB,YAAY;AACjC,UAAO,KAAK,iCAAiC;GAE7C,MAAM,MAAM,aADU,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,EAAK,CAAC,CAC/C;GACvC,MAAM,YAAY,IAAI;GACtB,MAAM,MAAM,IAAI,MAAM,GAAG,IAAI,UAAU;GACvC,MAAM,MAAM,IAAI,MAAM,IAAI,YAAY,EAAE;AACxC,UAAO;IACL,8BAA8B,IAAI,SAAS,MAAM;IACjD,6BAA6B,IAAI,SAAS,MAAM;IACjD;;EAEH,gCAAgC,aAAaA,eAAAA,MAAM,iBAAiB,EAAE,WAAW,MAAM,CAAC;EACxF,iBAAiB,YAA6B;AAC5C,UAAO,KAAK,2BAA2B;AAEvC,UAAO,aADU,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,EAAK,CAAC,CACpD,CAAC,SAAS,MAAM,CAAC,aAAa;;EAE7D,oBAAoB,aAAaA,eAAAA,MAAM,KAAK,EAAE,WAAW,OAAO,CAAC;EACjE,2BAA2B,aAAaA,eAAAA,MAAM,YAAY,EAAE,WAAW,MAAM,CAAC;EAC9E,YAAY,YAAY;AACtB,UAAO,KAAK,sBAAsB;GAClC,MAAM,OAAO;IAAC;IAAM;IAAM;IAAM;IAAM;IAAK;GAC3C,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC;GAC3E,MAAM,MAAM,OAAO,KAAK,IAAI,CAAC,SAAS,MAAM;AAU5C,UAAO,QAAQ,UAAU,QAAQ;;EAGnC,sBAAsB,YAA4D;GAChF,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,EAAK,CAAC;GAC5E,MAAM,eAAe,IAAI,SAAS,EAAE;AAMpC,UAAO;IAAE,QALM,IACZ,MAAM,GAAG,eAAe,EAAE,CAC1B,SAAS,MAAM,CACf,aAAa;IAEC,WADC,IAAI,MAAM,eAAe,GAAG,IAAI,SAAA,EAAuB,CAAC,SAAS,SAAS;IAChE;;EAG9B,aAAa,OAAO,WAEC;AACnB,UAAO,KAAK,uBAAuB;GACnC,MAAM,EAAE,kBAAkB;GAE1B,MAAM,OAAO,sBAAsBA,eAAAA,MAAM,gBAAgB;GACzD,MAAM,iBAAiB,OAAO,OAAO,CACnC,OAAO,KAAK,CAAC,KAAK,OAAO,CAAC,EAC1B,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,QAAI,cAAc,YAAY,EAAE;AAChC,WAAO;KACP,CACH,CAAC;GAEF,MAAM,SAAS,OAAO,KAAK,cAAc,QAAQ,MAAM;GAEvD,MAAM,YAAY,OAAO,KAAK,cAAc,YAAY,WAAW,SAAS;GAC5E,MAAM,uBAAuB,OAAO,KAAK,cAAc,YAAY,gBAAgB,SAAS;GAC5F,MAAM,aAAa,OAAO,KAAK,cAAc,YAAY,aAAa,SAAS;GAC/E,MAAM,cAAc,OAAO,OAAO;IAChC,OAAO,KAAK,CAAC,UAAU,OAAO,CAAC;IAC/B;IACA;IACA,OAAO,KAAK,CAAC,WAAW,OAAO,CAAC;IAChC;IACD,CAAC;GAEF,MAAM,oBAAoB,OAAO,MAAM,EAAE;AACzC,qBAAkB,cAAc,YAAY,QAAQ,EAAE;GAEtD,MAAM,OAAO,OAAO,OAAO;IAAC;IAAgB;IAAQ;IAAmB;IAAY,CAAC;AAEpF,SAAM,KAAK,cACT,YAAY,WAAW;IAAC;IAAM;IAAM;IAAMG,eAAAA,WAAW;IAAa,EAAE,KAAK,CAC1E;;EAGH,UAAU,OAAO,WAUX;GACJ,MAAM,EAAE,WAAW,cAAc,iBAAiB,GAAG,MAAM,SAAS;GACpE,MAAM,YAAY,OAAO,KAAK,cAAc,MAAM;AAElD,IAAA,GAAA,UAAA,SAAU,UAAU,WAAW,IAAI,6CAA6C;GAChF,MAAM,iBAAiB,OAAO,KAAKF,eAAAA,2BAA2B,MAAM;AACpE,IAAA,GAAA,UAAA,SAAU,eAAe,WAAW,IAAI,+CAA+C;GAEvF,MAAM,eAAe,OAAO,KAAK,KAAK;GAEtC,MAAM,gBAAgB,OAAO,OAAO;IAClC,OAAO,KAAKC,eAAAA,UAAU,OAAO,MAAM;IACnC,OAAO,KAAK,CAAC,aAAa,OAAO,CAAC;IAClC;IACD,CAAC;GAEF,MAAM,sBAAsB,OAAO,MAAM,EAAE;AAC3C,uBAAoB,cAAc,cAAc,QAAQ,EAAE;GAE1D,MAAM,OAAO,OAAO,OAAO;IAAC;IAAW;IAAgB;IAAqB;IAAc,CAAC;GAE3F,MAAM,WAAW,MAAM,KAAK,cAC1B,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;IAAK,EAAE,KAAK,CACvD;GAED,IAAI,IAAI;GACR,MAAM,MAAM,SAAS,MAAM,GAAG,IAAI,EAAE,CAAC;AACrC,QAAK;GACL,MAAM,SAAS,SAAS,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,MAAM;AACxD,QAAK;GACL,MAAM,kBAAkB,SAAS,MAAM,GAAG,IAAI,EAAE,CAAC;AACjD;GACA,MAAM,YAAY,SAAS,MAAM,GAAG,IAAI,gBAAgB;AACxD,QAAK;AACL,UAAO;IACL,aAAa,aAAa,SAAS;IACnC;IACA;IACA;IACD;;EAEH,cAAc,OAAO,WAAmD;GACtE,MAAM,EAAE,WAAW,iBAAiB;GACpC,MAAM,YAAY,OAAO,KAAK,cAAc,MAAM;AAClD,IAAA,GAAA,UAAA,SAAU,UAAU,WAAW,IAAI,6CAA6C;AAEhF,UAAO,aADU,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,GAAM,UAAU,CAAC,CAC/D,CAAC,SAAS,MAAM;;EAG/C,YAAY,OAAO,EAAE,cAAc;AACjC,UAAO,KAAK,sBAAsB;GAClC,MAAM,aAAa,OAAO,KAAK,QAAQ,MAAM,SAAS;GACtD,MAAM,SAAS,OAAO,MAAM,EAAE;AAC9B,UAAO,cAAc,WAAW,QAAQ,EAAE;GAC1C,MAAM,QAAQ,OAAO,OAAO,CAAC,QAAQ,WAAW,CAAC;AACjD,SAAM,KAAK,cAAc,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;IAAK,EAAE,MAAM,CAAC;;EAEnF,2BAA2B,OAAO,WAIuB;AACvD,UAAO,KAAK,qCAAqC;GACjD,MAAM,OAAO,iBAAiB,OAAO;GAIrC,MAAM,SAAS,aAHO,MAAM,KAAK,cAC/B,YAAY,WAAW;IAAC;IAAM;IAAM;IAAMC,eAAAA,WAAW;IAAwB,EAAE,KAAK,CACrF,CACyC;GAC1C,MAAM,aAAa,OAAO,SAAS,EAAE;AACrC,UAAO;IACL,WAAW,OAAO,MAAM,GAAG,aAAa,EAAE,CAAC,SAAS,SAAS;IAC7D,WAAW,OAAO,MAAM,aAAa,EAAE,CAAC,SAAS,SAAS;IAC3D;;EAEH,0BAA0B,OAAO,WAAW;AAC1C,UAAO,KAAK,oCAAoC;GAChD,MAAM,OAAO,iBAAiB,OAAO;AACrC,SAAM,KAAK,cACT,YAAY,WAAW;IAAC;IAAM;IAAM;IAAMA,eAAAA,WAAW;IAAwB,EAAE,KAAK,CACrF;;EAEH,wBAAwB,OAAO,WAAW;AACxC,UAAO,KAAK,kCAAkC;GAC9C,MAAM,OAAO,sBAAsBH,eAAAA,MAAM,WAAW;GACpD,MAAM,QAAQ,OAAO,OAAO,CAC1B,OAAO,KAAK,CAAC,KAAK,OAAO,CAAC,EAC1B,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,EAAE;AAC3B,QAAI,cAAc,YAAY,EAAE;AAChC,WAAO;KACP,CACH,CAAC;GAEF,IAAI,eAAe;GACnB,IAAI,gBAA+B;AAEnC,UAAO,CAAC,eAAe;IACrB,MAAM,SAAS,OAAO,KAAK,OAAO,QAAQ,eAAe,IAAK,SAAS;IACvE,MAAM,SAAS,OAAO,MAAM,EAAE;AAC9B,WAAO,cAAc,OAAO,QAAQ,EAAE;IACtC,MAAM,OAAO,OAAO,OAAO;KAAC;KAAO;KAAQ;KAAO,CAAC;IACnD,MAAM,WAAW,MAAM,KAAK,cAC1B,YAAY,WAAW;KAAC;KAAM;KAAM;KAAM;KAAK,EAAE,KAAK,CACvD;IACD,MAAM,eAAe,SAAS,SAAS,EAAE;IACzC,IAAI,iBAAiB,SAAS,aAAa,SAAS,SAAS,EAAE;AAC/D,YAAQ,cAAR;KACE,KAAA;AACE,qBAAe,SAAS,WAAW,GAAG,EAAE;AACxC;KACF,KAAA;AACE,sBAAgB,SAAS,MAAM,GAAG,SAAS,SAAS,EAAE;AACtD,aAAO,mBAAmB,OACU;OAChC,MAAM,OAAO,MAAM,KAAK,cAAc,UAAU,KAAK,GAAM,KAAM,GAAM,EAAK,CAAC;AAC7E,wBAAiB,KAAK,aAAa,KAAK,SAAS,EAAE;AACnD,uBAAgB,OAAO,OAAO,CAAC,eAAe,aAAa,KAAK,CAAC,CAAC;;AAGtE;KAEF,QACE,OAAM,IAAI,MAAM,0BAA0B,eAAe;;;AAG/D,UAAO,cAAc,SAAS,SAAS;;EAGzC,UAAU,OAAO,gBAAwB;GACvC,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,SAAS,OAAO,KAAK,aAAa,MAAM,CAAC,CAAC;AACzF,UAAO,OAAO,KAAK,IAAI,CAAC,SAAS,MAAM;;EAEzC,YAAY,YAAY;GACtB,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,EAAK,CAAC;GAC5E,MAAM,aAAa,IAAI,SAAS,EAAE;GAClC,MAAM,gBAAgB,IAAI,SAAS,IAAI,WAAW;GAClD,MAAM,gBAAgB,IAAI,MAAM,IAAQ,YAAY,IAAI,aAAa,gBAAgB,EAAE;AAIvF,UAFmB,OAAO,KAAK,cAAc,CAAC,UAAU;;EAI1D;EACA;EACD;;;;ACzgBH,MAAa,gBAAgB,YAAqD;AA4BhF,SAAA,GAAA,aAAA,kBA3ByC,EACvC,OAAO,EAAA,GAAA,aAAA,UACI;EACP,KAAK,GAAG,QAAQ,QAAQ;EACxB,aAAa,UAAA;EACb,QAAQ,MAAM;GAEZ,MAAM,iBAAkB,KAAK,GAAG,SAAS,WAAsC,EAAE;AAEjF,UAAO;IACL,GAAI,QAAQ,iBACR,EAAE,8BAA8B,QAAQ,gBAAgB,GACxD,EAAE;IACN,GAAI,QAAQ,gBACR,EAAE,6BAA6B,QAAQ,eAAe,GACtD,EAAE;IACN,GAAI,QAAQ,UAAU,EAAE,eAAe,WAAW,QAAQ,WAAW,GAAG,EAAE;IAC1E,GAAI,QAAQ,iBACR,EAAE,eAAe,UAAU,QAAQ,kBAAkB,GACrD,EAAE;IAEN,GAAG;IACJ;;EAEJ,CAAC,CACH,EACF,CAAC;;;;ACDJ,eAAe,gBAAmB,EAChC,QACA,MACA,MACA,cACA,iBACA,qBAca;CACb,MAAM,CAAC,aAAa,WAAW,sBAAsB,MAAM,QAAQ,IAAI;EACrE,OAAO,gBAAgB;EACvB,OAAO,cAAc;EACrB,OAAO,0BAA0B;EAClC,CAAC;CACF,MAAM,kBAAkB,MAAM,OAAO,sBAAsB;CAC3D,MAAM,aAAyC;EAC7C;EACA,QAAQ,UAAU;EAClB,UAAU;EACV,oBAAoB,mBAAmB;EACvC,iBAAiB,gBAAgB;EACjC,4BAA4B;GAC1B,GAAG,YAAY;GACf,WAAW,gBAAgB;GAC5B;EACF;CACD,MAAM,YAAY,MAAM,aAAa;EAAE,QAAQ,UAAU;EAAQ;EAAY,CAAC;CAC9E,MAAM,iBAAiB,MAAM,OAAO,yBAAyB;EAC3D,WAAW,UAAU;EACrB,aAAa,UAAU;EACvB,sBAAsB,UAAU;EACjC,CAAC;AACF,OAAM,qBAAqB;CAC3B,MAAM,WAAW,MAAM,OAAO,SAAS;EACrC,WAAW,UAAU;EACrB,iBAAiB,UAAU;EAC3B;EACA;EACD,CAAC;CACF,MAAM,mBAAmB,MAAM,OAAO,qBAAqB;CAC3D,MAAM,eAAe,MAAM,OAAO,aAAa,EAAE,WAAW,UAAU,WAAW,CAAC;CAClF,MAAM,oBAAoB,KAAK,SAAS,YAAY,SAAS,GAAG;CAChE,MAAM,cAAc,OAAO,OAAO;EAChC,SAAS,YAAY,MAAM,GAAG,kBAAkB;EAChD,OAAO,KAAK,CAAC,YAAY,OAAO,OAAO,CAAC;EACxC,YAAY;EACZ,SAAS,YAAY,MAAM,kBAAkB;EAC9C,CAAC,CAAC,SAAS,MAAM;CAClB,MAAM,oBAAuD;EAC3D;EACA,aAAa;GACX,GAAG,YAAY;GACf,WAAW,iBAAiB;GAC7B;EACD;EACA,cAAc,SAAS,UAAU,SAAS,MAAM;EAChD,eAAe,iBAAiB;EAChC;EACD;AACD,QAAO,gBAAgB;EAAE,QAAQ,UAAU;EAAQ;EAAmB,CAAC;;AAGzE,SAAgB,aAAa,SAAwB,QAAwB;CAC3E,MAAM,gBAAmC,EACvC,SAAS,QAAQ,SAClB;CACD,MAAM,SAAS,aAAa,cAAc;CAC1C,MAAM,YAAYI,eAAAA,gBAAgB,SAAS,OAAO;CAElD,MAAM,OAAmB;EACvB;EACA,eAAe,cAAc,aAAa;GAAE,GAAG;GAAe,GAAG;GAAW,CAAC;EAC7E,WAAW;EACZ;CAED,MAAM,kBAA6C,SAEjD,aACA;EAEA,MAAM,UAAsB,EAAE,QADf,UAAU,KAAK,YAAY,EACJ;AACtC,SAAO,eAAe;GAAE,GAAG;GAAM,GAAG;GAAS,CAA2B;;CAG1E,MAAM,kBAA6C,SAEjD,aACA;EAEA,MAAM,UAAsB,EAAE,QADf,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAClB;AACtC,SAAO,eAAe;GAAE,GAAG;GAAM,GAAG;GAAS,CAA2B;;CAG1E,MAAM,cAAqC,WAA8B;EACvE,MAAM,cAA2B,EAAE,aAAa,MAAM;AACtD,SAAO,eAAe;GAAE,GAAG;GAAM,GAAG;GAAa,CAA4B;;CAG/E,MAAM,gBAAyC,SAE7C,eACA;EACA,MAAM,gBAA+B,EAAE,iBAAiB,eAAe;AACvE,SAAO,eAAe;GAAE,GAAG;GAAM,GAAG;GAAe,CAA8B;;CAGnF,MAAM,iBAA2C,SAE/C,cACA;EACA,MAAM,iBAAiC,EAAE,gBAAgB,cAAc;AACvE,SAAO,eAAe;GAAE,GAAG;GAAM,GAAG;GAAgB,CAA+B;;CAGrF,SAAS,eACP,QAMW;EACX,SAAS,SACP,WACM;AACN,UAAO,OAAO,QAAQ,UAAU,OAAiC,CAAC;;AAKpE,MAAI,OAAO,OACT,WACG,YACE;GACC,eAAe,YAA+B;IAC5C,MAAM,EAAE,QAAQ,WAAW;IAC3B,MAAM,EAAE,WAAW,MAAM,OAAO,cAAc;IAC9C,MAAM,EAAE,mBAAmB,MAAM,OAAO,KAAK,IAAI,mBAAmB,MAAM,EAAE,QAAQ,CAAC;AACrF,WAAO;;GAGT,qBAAqB,YAEhB;IACH,MAAM,EAAE,QAAQ,WAAW;IAC3B,MAAM,EAAE,WAAW,MAAM,OAAO,cAAc;IAC9C,MAAM,EAAE,eAAe,MAAM,OAAO,KAAK,IAAI,eAAe,MAAM,EAAE,QAAQ,CAAC;AAC7E,WAAO;;GAEV,EACJ;AAKH,MAAI,OAAO,mBAAmB,CAAC,OAAO,cAAc,CAAC,OAAO,UAC1D,WAAkE,WAAW;GAC3E,MAAM,EAAE,oBAAoB;AAC5B,UAAO,EACL,cAAc,SAA8B,OAAwC;IAClF,MAAM,cAA2B,EAAE,YAAY,OAAO;IACtD,MAAM,UAAU,GAAG,gBAAgB,GAAG;IACtC,MAAM,SAAS,OAAO,aAAa,EAAE,SAAS,CAAC;AAC/C,WAAO,eAAe;KAAE,GAAG;KAAM;KAAQ,GAAG;KAAa,CAA4B;MAExF;IACD;AAKJ,MAAI,OAAO,UAAU,OAAO,eAC1B,WAAwE,WAAW;GACjF,MAAM,EAAE,QAAQ,QAAQ,mBAAmB;GAC3C,eAAe,iBAAgC;AAC7C,QAAI,MAAM,OAAO,YAAY,CAAE;IAC/B,MAAM,CAAC,EAAE,UAAU,sBAAsB,MAAM,QAAQ,IAAI,CACzD,OAAO,cAAc,EACrB,OAAO,uBAAuB,CAC/B,CAAC;IACF,MAAM,UAAU,MAAM,OAAO,WAAW,oBAAoB,OAAO;KACjE;KACA,cAAc;KACd,MAAM;MACJ,8BAA8B,mBAAmB;MACjD,6BAA6B,mBAAmB;MACjD;KACF,CAAC;AACF,UAAM,OAAO,WAAW,EAAE,SAAS,CAAC;;AAEtC,UAAO;IACL,aAAa,OAAO,WAAqE;KACvF,MAAM,EAAE,MAAM,eAAe;KAC7B,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,wBAAwB,MAAM,QAAQ,IAAI,CACrE,OAAO,cAAc,EACrB,OAAO,0BAA0B,CAClC,CAAC;AACF,WAAM,OAAO,WAAW,YAAY,OAAO;MACzC,cAAc;MACd,OAAO;OAAE;OAAM;OAAQ;OAAY;OAAoB;MACxD,CAAC;;IAGJ,4BAA4B,OAC1B,aACA,WACkB;KAClB,MAAM,CAAC,EAAE,UAAU,sBAAsB,MAAM,QAAQ,IAAI,CACzD,OAAO,cAAc,EACrB,OAAO,0BAA0B,CAClC,CAAC;AACF,WAAM,OAAO,YAAY,EACvB,eAAe;MACb,QAAQ,YAAY;MACpB,aAAa,YAAY;MAC1B,EACF,CAAC;KACF,MAAM,EAAE,gBAAgB,MAAM,OAAO,gBAAgB;AACrD,WAAM,QAAQ,qBAAqB;KACnC,MAAM,OAAO,MAAM,OAAO,6BAA6B;AACvD,WAAM,OAAO,WAAW,0BAA0B,OAAO;MACvD;MACA,cAAc;MACd,UAAU;OACR;OACA,iBAAiB,mBAAmB;OACpC,sBAAsB;QACpB,GAAG;QACH,WAAW,mBAAmB;QAC/B;OACF;MACF,CAAC;;IAGJ,gBAAgB,OACd,gBACA,WACkB;KAClB,MAAM,EAAE,MAAM,SAAS;KACvB,MAAM,uBACJ,SAAS,UACL,OAAO,WAAW,2CAClB,OAAO,WAAW;KACxB,MAAM,0BACJ,SAAS,UACL,OAAO,WAAW,gCAClB,OAAO,WAAW;AACxB,WAAM,gBAAgB;MACZ;MACR;MACA;MACA,eAAe,EAAE,QAAQ,iBACvB,qBAAqB,OAAO;OAC1B,cAAc;OACd;OACA;OACD,CAAC;MACJ,kBAAkB,EAAE,QAAQ,wBAC1B,wBAAwB,OAAO;OAC7B,cAAc,OAAO;OACrB;OAEA,UAAU;OACX,CAAC;MACJ,mBAAmB,QAAQ;MAC5B,CAAC;;IAGJ,mBAAmB,OACjB,WACA,WACkB;AAClB,WAAM,gBAAgB;KACtB,MAAM,EAAE,WAAW,MAAM,OAAO,cAAc;AAC9C,WAAM,OAAO,yBAAyB;MACpC,WAAW,UAAU;MACrB,sBAAsB,UAAU;MAChC,aAAa,UAAU;MACxB,CAAC;AACF,WAAM,QAAQ,qBAAqB;KACnC,MAAM,YAAY,MAAM,OAAO,uBAAuB,EACpD,SAAS,UAAU,UACpB,CAAC;AACF,WAAM,OAAO,WAAW,mCAAmC,OAAO;MAChE,cAAc;MACd;MACA;MACD,CAAC;;IAGJ,uBAAuB,OACrB,WACA,WACkB;AAClB,WAAM,gBAAgB;KACtB,MAAM,EAAE,WAAW,MAAM,OAAO,cAAc;AAC9C,WAAM,OAAO,yBAAyB;MACpC,WAAW,UAAU;MACrB,sBAAsB,UAAU;MAChC,aAAa,UAAU;MACxB,CAAC;AACF,WAAM,QAAQ,qBAAqB;KACnC,MAAM,YAAY,MAAM,OAAO,uBAAuB,EACpD,SAAS,UAAU,UACpB,CAAC;AACF,WAAM,OAAO,WAAW,kCAAkC,OAAO;MAC/D,cAAc;MACd;MACA;MACD,CAAC;;IAGJ,qBAAqB,OACnB,WACA,WACkB;AAClB,WAAM,gBAAgB;KACtB,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,MAAM,QAAQ,IAAI,CACtD,OAAO,cAAc,EACrB,OAAO,gBAAgB,CACxB,CAAC;AACF,WAAM,OAAO,yBAAyB;MACpC,WAAW,UAAU;MACrB,sBAAsB,UAAU;MAChC,aAAa,UAAU;MACxB,CAAC;AACF,WAAM,QAAQ,qBAAqB;KACnC,MAAM,oBAAoB,MAAM,OAAO,uBAAuB,EAC5D,SAAS,UAAU,UACpB,CAAC;KACF,MAAM,YAAY,MAAM,OAAO,0BAA0B;MACvD,aAAa,UAAU;MACvB,WAAW,UAAU;MACrB,sBAAsB,UAAU;MACjC,CAAC;KACF,MAAM,eAAe,MAAM,OAAO,sBAAsB;AACxD,WAAM,OAAO,WAAW,mBAAmB,OAAO;MAChD,cAAc;MACd;MACA,cAAc;OACZ;OACA;OACA,WAAW,UAAU;OACrB,sBAAsB;QACpB,GAAG;QACH,WAAW,UAAU;QACtB;OACF;MACF,CAAC;;IAEL;IACD;AAKJ,MAAI,OAAO,UAAU,OAAO,mBAAmB,CAAC,OAAO,WACrD,WACG,WAAW;GACV,MAAM,EAAE,QAAQ,QAAQ,oBAAoB;AAC5C,UAAO;IACL,OAAO,eAEL,MAKkC;KAClC,MAAM,EAAE,WAAW,MAAM,OAAO,cAAc;KAC9C,MAAM,YAAY,MAAM,OAAO,KAAK,IAAI,kBAAkB,OACxD;MACE;MACA,eAAe;MAChB,EACDC,cAAAA,iBAAiB,EAAE,eAAe,MAAM,eAAe,CAAC,CACzD;AACD,WAAM,MAAM,qBAAqB;KAKjC,MAAM,cAAc;MAClB,eAAe;MACf;MACA,gBAPqB,MAAM,OAAO,aAAa;OAC/C;OACA,eAAe;OAChB,CAAC;MAKA,aAAa,UAAU;MACvB,sBAAsB,MAAM;MAC7B;KACD,MAAM,EAAE,UAAU,MAAM,OAAO,KAAK,IAAI,aAAa,OACnD,EAAE,GAAG,aAAa,EAClBA,cAAAA,iBAAiB,EAAE,eAAe,MAAM,eAAe,CAAC,CACzD;KACD,MAAM,cAA2B,EAC/B,YAAY,OACb;KACD,MAAM,UAAU,GAAG,OAAO,gBAAgB,GAAG;KAC7C,MAAM,eAAe,OAAO,aAAa,EAAE,SAAS,CAAC;AACrD,YAAO,eAAe;MAAE,GAAG;MAAM,QAAQ;MAAc,GAAG;MAAa,CAErE;;IAGJ,WACE,cACA,WACsC;AACtC,YAAO,gBAAgB;MACrB;MACA,MAAM,aAAa;MACnB,MAAM,aAAa;MACnB,cAAc,OAAO,EAAE,iBAAiB;AAMtC,cALkB,MAAM,OAAO,kBAAkB,kBAAkB,OAAO;QACxE,IAAI,aAAa;QACjB,eAAe;QACf;QACD,CAAC;;MAGJ,kBAAkB,EAAE,wBAClB,OAAO,kBAAkB,gBAAgB,OAAO;OAC9C,eAAe;OACf,IAAI,aAAa;OACjB;OACD,CAAC;MACJ,mBAAmB,QAAQ;MAC5B,CAAC;;IAEL;IAEJ;AAKH,MAAI,OAAO,mBAAmB,OAAO,eAAe,CAAC,OAAO,UAC1D,WACG,WAAW;GACV,MAAM,EAAE,QAAQ,oBAAoB;AACpC,UAAO,EACL,OAAO,eAEL,aAIA,MACkC;IAClC,MAAM,MAAM,MAAM,OAAO,KAAK,aAAa,OACzC;KACE,UAAU,YAAY;KACtB,cAAc,YAAY;KAC1B,WAAW;KACZ,EACDA,cAAAA,iBAAiB,EAAE,eAAe,MAAM,eAAe,CAAC,CACzD;IACD,MAAM,cAA2B,EAC/B,WAAW,KACZ;IACD,MAAM,eAAe,OAAO,aAAa,EAAE,gBAAgB,IAAI,aAAa,CAAC;AAC7E,WAAO,eAAe;KAAE,GAAG;KAAM,QAAQ;KAAc,GAAG;KAAa,CAErE;MAEL;IAEJ;AAKH,MAAI,OAAO,UAAU,OAAO,mBAAmB,OAAO,WACpD,WAA6E,WAAW;GACtF,MAAM,EAAE,QAAQ,WAAW;GAE3B,eAAe,iBAAgC;AAC7C,QAAI,MAAM,OAAO,YAAY,CAAE;IAC/B,MAAM,qBAAqB,MAAM,OAAO,uBAAuB;IAC/D,MAAM,UAAU,MAAM,OAAO,MAAM,oBAAoB,OAAO;KAC5D,8BAA8B,mBAAmB;KACjD,6BAA6B,mBAAmB;KACjD,CAAC;AACF,UAAM,OAAO,WAAW,EAAE,SAAS,CAAC;;GAGtC,MAAM,mBAAmB,OACvB,WACA,WACoB;AACpB,UAAM,gBAAgB;AACtB,UAAM,OAAO,yBAAyB;KACpC,WAAW,UAAU;KACrB,sBAAsB,UAAU;KAChC,aAAa,UAAU;KACxB,CAAC;AACF,UAAM,QAAQ,qBAAqB;AAInC,WAHkB,MAAM,OAAO,uBAAuB,EACpD,SAAS,UAAU,UACpB,CAAC;;AAIJ,UAAO;IACL,SAAS,OACP,SACA,WACkC;KAClC,MAAM,EAAE,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,IAAI,CAAC;AAClF,SAAI,UAAU,kBAAkB,OAAO;MACrC,MAAM,YAAY,MAAM,iBAAiB,WAAW,OAAO;AAC3D,YAAM,QAAQ,wBAAwB;AACtC,aAAO,OAAO,SAAS,QAAQ,OAC7B;OACE,IAAI,QAAQ;OACZ,MAAM;QAAE,eAAe;QAAO;QAAW;OAC1C,EACDA,cAAAA,iBAAiB,OAAO,CACzB;;AAEH,SAAI,UAAU,kBAAkB,OAC9B,QAAO,OAAO,SAAS,QAAQ,OAC7B;MACE,IAAI,QAAQ;MACZ,MAAM,EAAE,eAAe,QAAQ;MAChC,EACDA,cAAAA,iBAAiB,OAAO,CACzB;AAEH,WAAM,IAAI,MAAM,4CAA4C;;IAG9D;IAEA,SACE,SACA,SACkC;AAClC,YAAO,OAAO,SAAS,OAAO,OAC5B;MAAE,IAAI,QAAQ;MAAI,MAAM;MAAM,EAC9BA,cAAAA,iBAAiB,KAAK,CACvB;;IAEJ;IACD;AAKJ,MAAI,OAAO,mBAAmB,OAAO,UACnC,WAA8E,WAAW;GACvF,MAAM,EAAE,WAAW;AACnB,UAAO;IACL,cAAc,OAAO,YAAoE;KACvF,MAAM,EAAE,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,IAAI,CAAC;AAClF,MAAA,GAAA,UAAA,SAAU,UAAU,kBAAkB,OAAO,6BAA6B;AAC1E,YAAO,UAAU;;IAGnB,UACE,SACA,cACkC;AAClC,YAAO,OAAO,SAAS,QAAQ,OAAO;MACpC,IAAI,QAAQ;MACZ,MAAM;OAAE,eAAe;OAAO;OAAW;MAC1C,CAAC;;IAGJ,SACE,SACA,cACkC;AAClC,YAAO,OAAO,SAAS,OAAO,OAAO;MACnC,IAAI,QAAQ;MACZ,MAAM;OAAE,eAAe;OAAO;OAAW;MAC1C,CAAC;;IAEL;IACD;AAGJ,SAAO;;AAGT,QAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;EACD"}
+{"version":3,"file":"engine.cjs","names":["PAGINATED_STATUS","LockedDeviceError","isTransportStatusError","DisconnectedDevice","withDevicePolling","PATHS","APPID_VAULT_ADMINISTRATOR","STR_ROLES","SCRIPT_IDS","createApiDevice","buildTrpcContext"],"sources":["../src/device/real-device.ts","../src/trpc.ts","../src/engine/index.ts"],"sourcesContent":["import { DisconnectedDevice, LockedDeviceError } from \"@ledgerhq/errors\";\nimport type Transport from \"@ledgerhq/hw-transport\";\nimport type { HsmCertificate, PubKey } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { from, lastValueFrom } from \"rxjs\";\n\nimport type { Logger } from \"@/logger\";\n\nimport {\n  APPID_VAULT_ADMINISTRATOR,\n  PAGINATED_STATUS,\n  PATHS,\n  SCRIPT_IDS,\n  STATUS_LENGTH,\n  STR_ROLES,\n  STREAMING_NEXT_ACTION,\n  STREAMING_RESPONSE,\n} from \"./constants\";\nimport { withDevicePolling } from \"./device-access\";\nimport type { Device } from \"./types\";\nimport { isTransportStatusError } from \"./utils\";\n\nconst MAX_CHUNK_LENGTH = 250;\n\ntype Options = {\n  transportId: string;\n};\n\nconst getPathFromPathString = (pathString: string): number[] => {\n  const parts = pathString.split(\"'/\").map((part) => Number.parseInt(part, 10));\n  return parts.map((part) => (part | 0x80000000) >>> 0);\n};\n\nconst splitChunks = (chunk: number, buffer: Buffer): Buffer[] => {\n  const chunks = [];\n  for (let i = 0, size = chunk; i < buffer.length; i += size, size = chunk) {\n    chunks.push(buffer.slice(i, i + size));\n  }\n  return chunks;\n};\n\nconst removeStatus = (result: Buffer): Buffer => result.slice(0, result.length - STATUS_LENGTH);\n\nconst sendByChunk = async (\n  transport: Transport,\n  command: number[], // eg [0xe0, 0x45, 0x00, 0x00]\n  data: Buffer,\n  chunkSize: number = MAX_CHUNK_LENGTH,\n): Promise<Buffer> => {\n  const chunks = splitChunks(chunkSize, data);\n  let response = Buffer.from([]);\n  for (let i = 0; i < chunks.length; i++) {\n    const chunk = chunks[i];\n    const apdu = [...command];\n    // command is 0xe0,0x45,0x00,0x00 for first chunk, then it's 0xe0,0x45,0x80,0x00\n    /* v8 ignore next -- @preserve */\n    apdu[2] = i && 0x80;\n    response = (await transport.send(apdu[0]!, apdu[1]!, apdu[2], apdu[3]!, chunk, [\n      0x9000,\n      ...PAGINATED_STATUS,\n    ])) as Buffer<ArrayBuffer>;\n  }\n  return response;\n};\n\nconst buildAttestation = (params: {\n  handshake: string;\n  handshakeAttestation: HsmCertificate;\n  partitionId: string;\n}): Buffer => {\n  const sigBuffer = Buffer.from(params.handshakeAttestation.signature, \"base64\");\n  const sigLengthBuffer = Buffer.alloc(1);\n  sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);\n\n  const certBuffer = Buffer.from(params.handshakeAttestation.certificate, \"base64\");\n  const certLengthBuffer = Buffer.alloc(1);\n  certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);\n\n  const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, \"base64\");\n\n  const certChainData = Buffer.concat([\n    sigLengthBuffer,\n    sigBuffer,\n    pubBuffer,\n    certLengthBuffer,\n    certBuffer,\n  ]);\n\n  const cliMsgBuffer = Buffer.from(params.handshake, \"hex\");\n  const cliMsgLengthBuffer = Buffer.alloc(1);\n  cliMsgLengthBuffer.writeUIntBE(cliMsgBuffer.length, 0, 1);\n\n  const pidBuffer = Buffer.from(params.partitionId, \"hex\");\n  const pidLengthBuffer = Buffer.alloc(1);\n  pidLengthBuffer.writeUIntBE(pidBuffer.length, 0, 1);\n\n  const certChainDataLengthBuff = Buffer.alloc(2);\n  certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);\n\n  const data = Buffer.concat([\n    cliMsgLengthBuffer,\n    cliMsgBuffer,\n    certChainDataLengthBuff,\n    certChainData,\n    pidLengthBuffer,\n    pidBuffer,\n  ]);\n\n  const totalLengthBuffer = Buffer.alloc(2);\n  totalLengthBuffer.writeUInt16BE(data.length, 0);\n\n  const toSend = Buffer.concat([totalLengthBuffer, data]);\n\n  return toSend;\n};\n\ntype RetryOnError = (err: Error) => boolean;\n/* v8 ignore next -- @preserve */\nconst genericRetryOnError: RetryOnError = (err) => {\n  // device is locked\n  if (err instanceof LockedDeviceError) return true;\n  // user is on dashboard when receiving a Vault app apdu\n  if (isTransportStatusError(err) && err.statusCode === 0x6d09) return true;\n  // VG-24797 error that can happen in BLE in some situations (still unclear)\n  if (err instanceof DisconnectedDevice) return true;\n\n  // for everything else, we don't want to retry\n  return false;\n};\n\nexport function createRealDevice(options: Options, logger: Logger): Device {\n  const { transportId } = options;\n\n  async function run<T>(\n    job: (transport: Transport) => Promise<T>,\n    retryOnError: RetryOnError = genericRetryOnError,\n  ): Promise<T> {\n    return lastValueFrom(\n      withDevicePolling(transportId)<T>((transport) => from(job(transport)), retryOnError),\n    );\n  }\n\n  /* v8 ignore next -- @preserve */\n  const noRetry = (): boolean => false;\n  /* v8 ignore next -- @preserve */\n  const alwaysRetry = (): boolean => true;\n  const poll = async (\n    opts: { retryOnError?: RetryOnError } = {},\n  ): Promise<{ isAppOpened: boolean }> => {\n    // waiting for device to be turned on\n    await run(\n      // eslint-disable-next-line  @typescript-eslint/no-empty-function\n      async (_transport) => {},\n      opts.retryOnError ?? alwaysRetry,\n    );\n    // checking if app is opened: should return directly on getPubKey\n    try {\n      await getPublicKey(PATHS.U2F, { secp256k1: true, retryOnError: noRetry });\n      return { isAppOpened: true };\n    } catch (err) {\n      if (isTransportStatusError(err) && genericRetryOnError(err)) {\n        return { isAppOpened: false };\n      }\n      throw err;\n    }\n  };\n\n  const pollApp = async (appName: string): Promise<string> => {\n    const res = await run((transport) =>\n      transport.send(0xe0, 0xd8, 0x00, 0x00, Buffer.from(appName, \"utf8\")),\n    );\n    // little delay to give time to the app to be fully opened\n    await new Promise((r) => setTimeout(r, 1e3));\n    return res.toString(\"hex\");\n  };\n\n  const getPublicKey = async (\n    pathString: string,\n    { secp256k1, retryOnError }: { secp256k1: boolean; retryOnError?: RetryOnError },\n  ): Promise<{ pubKey: string; signature: string }> => {\n    logger.info(`[device] getPublicKey (${pathString})`);\n    const path = getPathFromPathString(pathString);\n    const data = Buffer.concat([\n      Buffer.from([path.length]),\n      ...path.map((derivation) => {\n        const buf = Buffer.alloc(4);\n        buf.writeUInt32BE(derivation, 0);\n        return buf;\n      }),\n    ]);\n    const curve = secp256k1 ? 0x01 : 0x02;\n    const response = await run(\n      (transport) => transport.send(0xe0, 0x40, curve, 0x00, data),\n      retryOnError ?? genericRetryOnError,\n    );\n    const pubKeyLength = response.readInt8(0);\n    const pubKey = response\n      .slice(1, pubKeyLength + 1)\n      .toString(\"hex\")\n      .toUpperCase();\n    const signature = response\n      .slice(pubKeyLength + 1, response.length - STATUS_LENGTH)\n      .toString(\"base64\");\n    return { pubKey, signature };\n  };\n\n  const device: Device = {\n    authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {\n      logger.info(`[device] Authenticate`);\n      invariant(role !== \"READ_ONLY_API_KEY\", \"Invalid role for authenticate: READ_ONLY_API_KEY\");\n      const applicationBuffer = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      const nameBuffer = Buffer.from(name);\n      const workspaceBuffer = Buffer.from(workspaceName);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([nameBuffer.length]),\n        nameBuffer,\n        Buffer.from([workspaceBuffer.length]),\n        workspaceBuffer,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([\n        Buffer.from(challenge, \"base64\"),\n        applicationBuffer,\n        Buffer.from([keyHandle.length]),\n        Buffer.from(keyHandle, \"hex\"),\n        keyHandleDataLength,\n        keyHandleData,\n      ]);\n\n      const authentication = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x02, 0x00, 0x00], data),\n      );\n\n      return removeStatus(authentication).toString(\"hex\");\n    },\n\n    finalizePairingHandshake: async (params: {\n      handshake: string;\n      partitionId: string;\n      handshakeAttestation: HsmCertificate;\n    }): Promise<string> => {\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x47, 0x00, 0x02], buildAttestation(params)),\n      );\n      return removeStatus(bufWithStatus).toString(\"hex\");\n    },\n\n    generateSeedFragment: async (): Promise<string> => {\n      logger.info(`[device] generateSeedFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x00, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    generateWrappingKeyFragment: async (): Promise<string> => {\n      logger.info(`[device] generateWrappingKeyFragment`);\n      const path = getPathFromPathString(PATHS.KEY_MATERIAL);\n      const data = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n      const response = await run((transport) => transport.send(0xe0, 0x44, 0x01, 0x00, data));\n      return removeStatus(response).toString(\"base64\");\n    },\n    getAttestation: async (): Promise<{\n      attestation: {\n        codeHash: string;\n        attestationPub: string;\n        certificate: string;\n      };\n      buffer: Buffer;\n    }> => {\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x41, 0x00, 0x00));\n      const buffer = removeStatus(bufWithStatus);\n      const certLen = buffer.readInt8(32 + 65 + 1);\n      return {\n        attestation: {\n          codeHash: buffer.slice(0, 32).toString(\"base64\"),\n          attestationPub: buffer.slice(32, 32 + 65).toString(\"base64\"),\n          certificate: buffer.slice(32 + 65, 32 + 65 + 2 + certLen).toString(\"base64\"),\n        },\n        buffer,\n      };\n    },\n    getConfidentialityKey: async () => {\n      logger.info(`[device] getConfidentialityKey`);\n      const bufWithStatus = await run((transport) => transport.send(0xe0, 0x4d, 0x00, 0x00));\n      const buf = removeStatus(bufWithStatus);\n      const keyLength = buf[0]!;\n      const key = buf.slice(1, 1 + keyLength);\n      const sig = buf.slice(1 + keyLength + 1);\n      return {\n        confidentialityKeyCurve25519: key.toString(\"hex\"),\n        confidentialityKeySignature: sig.toString(\"hex\"),\n      };\n    },\n    getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),\n    getDeviceUserId: async (): Promise<string> => {\n      logger.info(`[device] getDeviceUserId`);\n      const response = await run((transport) => transport.send(0xe0, 0x52, 0x00, 0x00));\n      return removeStatus(response).toString(\"hex\").toUpperCase();\n    },\n    getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),\n    getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),\n    hasPairing: async () => {\n      logger.info(`[device] hasPairing`);\n      const apdu = [0xe0, 0x51, 0x00, 0x00, 0xb5];\n      const res = await run((transport) => transport.exchange(Buffer.from(apdu)));\n      const hex = Buffer.from(res).toString(\"hex\");\n\n      // 6f45 => this error means that there is no partition ID on the device\n      // if no error, it means there is (at least) one\n      //\n      // 6a87 => TEMPORARY hack because Stax apparently does not implement\n      //         the \"get partition id\" APDU, so it returns \"incorrect length\"\n      //         easier to just assume that in this case there is no partition,\n      //         and try to insert one anyway (done on revault onboarding)\n      //\n      return hex !== \"6f45\" && hex !== \"6a87\";\n    },\n\n    initPairingHandshake: async (): Promise<{ pubKey: string; signature: string }> => {\n      const res = await run((transport) => transport.send(0xe0, 0x46, 0x00, 0x00));\n      const pubKeyLength = res.readInt8(0);\n      const pubKey = res\n        .slice(1, pubKeyLength + 1)\n        .toString(\"hex\")\n        .toUpperCase();\n      const signature = res.slice(pubKeyLength + 1, res.length - STATUS_LENGTH).toString(\"base64\");\n      return { pubKey, signature };\n    },\n\n    openSession: async (params: {\n      secureChannel: { pubKey: PubKey; certificate: HsmCertificate };\n    }): Promise<void> => {\n      logger.info(`[device] openSession`);\n      const { secureChannel } = params;\n\n      const path = getPathFromPathString(PATHS.CONFIDENTIALITY);\n      const dataDerivation = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      const pubKey = Buffer.from(secureChannel.pubKey, \"hex\");\n\n      const sigBuffer = Buffer.from(secureChannel.certificate.signature, \"base64\");\n      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, \"base64\");\n      const certBuffer = Buffer.from(secureChannel.certificate.certificate, \"base64\");\n      const attestation = Buffer.concat([\n        Buffer.from([sigBuffer.length]),\n        sigBuffer,\n        attestationPubBuffer,\n        Buffer.from([certBuffer.length]),\n        certBuffer,\n      ]);\n\n      const lengthAttestation = Buffer.alloc(2);\n      lengthAttestation.writeUInt16BE(attestation.length, 0);\n\n      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);\n\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x42, 0x00, SCRIPT_IDS.INIT_SESSION], data),\n      );\n    },\n\n    register: async (params: {\n      challenge: string;\n      u2fRegisterData: string;\n      name: string;\n      role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n    }): Promise<{\n      u2fRegister: Buffer;\n      keyHandle: Buffer;\n      rfu: number;\n      pubKey: string;\n    }> => {\n      const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const applicationBuf = Buffer.from(APPID_VAULT_ADMINISTRATOR, \"hex\");\n      invariant(applicationBuf.length === 32, \"application hex is expected to have 32 bytes\");\n\n      const userNameBuff = Buffer.from(name);\n\n      const keyHandleData = Buffer.concat([\n        Buffer.from(STR_ROLES[role], \"hex\"),\n        Buffer.from([userNameBuff.length]),\n        userNameBuff,\n      ]);\n\n      const keyHandleDataLength = Buffer.alloc(2);\n      keyHandleDataLength.writeUInt16BE(keyHandleData.length, 0);\n\n      const data = Buffer.concat([challenge, applicationBuf, keyHandleDataLength, keyHandleData]);\n\n      const response = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x01, 0x00, 0x00], data),\n      );\n\n      let i = 0;\n      const rfu = response.slice(i, i + 1)[0]!;\n      i += 1;\n      const pubKey = response.slice(i, i + 65).toString(\"hex\");\n      i += 65;\n      const keyHandleLength = response.slice(i, i + 1)[0]!;\n      i++;\n      const keyHandle = response.slice(i, i + keyHandleLength);\n      i += keyHandleLength;\n      return {\n        u2fRegister: removeStatus(response),\n        keyHandle,\n        rfu,\n        pubKey,\n      };\n    },\n    registerData: async (params: { challenge: string }): Promise<string> => {\n      const { challenge: strChallenge } = params;\n      const challenge = Buffer.from(strChallenge, \"hex\");\n      invariant(challenge.length === 32, \"challenge hex is expected to have 32 bytes\");\n      const response = await run((transport) => transport.send(0xe0, 0x03, 0x00, 0x00, challenge));\n      return removeStatus(response).toString(\"hex\");\n    },\n\n    setPairing: async ({ pairing }) => {\n      logger.info(`[device] setPairing`);\n      const psdPayload = Buffer.from(pairing.blob, \"base64\");\n      const length = Buffer.alloc(2);\n      length.writeUInt16BE(psdPayload.length, 0);\n      const final = Buffer.concat([length, psdPayload]);\n      await run((transport) => sendByChunk(transport, [0xe0, 0x4e, 0x00, 0x00], final));\n    },\n    startKKPatternAsResponder: async (params: {\n      handshake: string;\n      handshakeAttestation: HsmCertificate;\n      partitionId: string;\n    }): Promise<{ handshake: string; signature: string }> => {\n      logger.info(`[device] startKKPatternAsResponder`);\n      const data = buildAttestation(params);\n      const bufWithStatus = await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x4c, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n      const buffer = removeStatus(bufWithStatus);\n      const dataLength = buffer.readInt8(0);\n      return {\n        handshake: buffer.slice(1, dataLength + 1).toString(\"base64\"),\n        signature: buffer.slice(dataLength + 1).toString(\"base64\"),\n      };\n    },\n    startKPatternAsResponder: async (params) => {\n      logger.info(`[device] startKPatternAsResponder`);\n      const data = buildAttestation(params);\n      await run((transport) =>\n        sendByChunk(transport, [0xe0, 0x49, 0x00, SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data),\n      );\n    },\n    validateVaultOperation: async (params) => {\n      logger.info(`[device] validateVaultOperation`);\n      const path = getPathFromPathString(PATHS.VALIDATION);\n      const paths = Buffer.concat([\n        Buffer.from([path.length]),\n        ...path.map((derivation) => {\n          const buf = Buffer.alloc(4);\n          buf.writeUInt32BE(derivation, 0);\n          return buf;\n        }),\n      ]);\n\n      let nextActionId = 1;\n      let finalResponse: Buffer | null = null;\n\n      while (!finalResponse) {\n        const screen = Buffer.from(params.actions[nextActionId - 1]!, \"base64\");\n        const length = Buffer.alloc(2);\n        length.writeUInt16BE(screen.length, 0);\n        const data = Buffer.concat([paths, length, screen]);\n        const response = await run((transport) =>\n          sendByChunk(transport, [0xe0, 0x45, 0x00, 0x00], data),\n        );\n        const responseType = response.readInt8(0);\n        let responseStatus = response.readUInt16BE(response.length - 2);\n        switch (responseType) {\n          case STREAMING_NEXT_ACTION:\n            nextActionId = response.readUIntBE(1, 2);\n            break;\n          case STREAMING_RESPONSE:\n            finalResponse = response.slice(3, response.length - 2);\n            while (responseStatus !== 0x9000) {\n              /* v8 ignore next -- @preserve */ {\n                const resp = await run((transport) => transport.send(0x00, 0xc0, 0x00, 0x00));\n                responseStatus = resp.readUInt16BE(resp.length - 2);\n                finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);\n              }\n            }\n            break;\n          /* v8 ignore next -- @preserve */\n          default:\n            throw new Error(`Invalid response type: ${responseType}`);\n        }\n      }\n      return finalResponse.toString(\"base64\");\n    },\n\n    sendAPDU: async (apduCommand: string) => {\n      const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, \"hex\")));\n      return Buffer.from(res).toString(\"hex\");\n    },\n    getVersion: async () => {\n      const res = await run((transport) => transport.send(0xb0, 0x01, 0x00, 0x00));\n      const appNameLen = res.readInt8(1);\n      const appVersionLen = res.readInt8(2 + appNameLen);\n      const appVersionHex = res.slice(2 + 1 + appNameLen, 2 + appNameLen + appVersionLen + 1);\n\n      const appVersion = Buffer.from(appVersionHex).toString();\n\n      return appVersion;\n    },\n    poll,\n    pollApp,\n  };\n  return device;\n}\n","import type { AppRouter } from \"@ledgerhq/revault-api\";\nimport { createTRPCClient, httpLink, type TRPCClient } from \"@trpc/client\";\nimport type { inferRouterInputs, inferRouterOutputs } from \"@trpc/server\";\nimport superjson from \"superjson\";\n\nexport type TRPCClientOptions = {\n  baseUrl: string;\n  debugAuthToken?: string;\n  rootAuthToken?: string;\n  apiAccessToken?: string;\n  psdAuth?: string;\n};\n\nexport type RevaultApiTRPCClient = TRPCClient<AppRouter>;\n\nexport type RouterInputs = inferRouterInputs<AppRouter>;\nexport type RouterOutputs = inferRouterOutputs<AppRouter>;\n\nexport type TRPCContext = { context: Record<string, unknown> } | undefined;\n\nexport const createClient = (options: TRPCClientOptions): RevaultApiTRPCClient => {\n  const trpc = createTRPCClient<AppRouter>({\n    links: [\n      httpLink({\n        url: `${options.baseUrl}/trpc`,\n        transformer: superjson,\n        headers(opts) {\n          // Extract headers from the operation context\n          const contextHeaders = (opts.op.context?.headers as Record<string, string>) || {};\n\n          return {\n            ...(options.debugAuthToken\n              ? { \"x-revault-debug-auth-token\": options.debugAuthToken }\n              : {}),\n            ...(options.rootAuthToken\n              ? { \"x-revault-root-auth-token\": options.rootAuthToken }\n              : {}),\n            ...(options.psdAuth ? { Authorization: `PsdAuth ${options.psdAuth}` } : {}),\n            ...(options.apiAccessToken\n              ? { Authorization: `Bearer ${options.apiAccessToken}` }\n              : {}),\n            // Merge in any headers passed via context\n            ...contextHeaders,\n          };\n        },\n      }),\n    ],\n  });\n  return trpc;\n};\n","import type {\n  ApiChallenge,\n  ClaimedRole,\n  OnboardingSeedChallenge,\n  PsdChallenge,\n  UserRegistrationChallenge,\n  UserRegistrationChallengeResponse,\n  UserRegistrationDeviceData,\n  UserRegistrationResponse,\n  VaultRequestResponse,\n  WrappingKeyResponse,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport { createApiDevice, type Device } from \"@/device\";\nimport { createRealDevice } from \"@/device/real-device\";\nimport type { Logger } from \"@/logger\";\nimport { createClient, type RouterOutputs, type TRPCClientOptions } from \"@/trpc\";\n\nimport { buildTrpcContext } from \"../utils\";\nimport type {\n  ApproveRequestParams,\n  CorrelationIdOpts,\n  DecorateWithApiUserAndWorkspaceUnauthenticated,\n  DecorateWithDevice,\n  DecorateWithDeviceAndOnboarding,\n  DecorateWithDeviceAndWorkspaceUnauthenticated,\n  DecorateWithWorkspaceApiAuthenticated,\n  DecorateWithWorkspacePsdAuthenticated,\n  DecorateWithWorkspaceUnauthenticated,\n  Engine,\n  EngineBase,\n  EngineOptions,\n  OnboardingOperationParams,\n  RegisterOnboardingDeviceParams,\n  WithApiAuth,\n  WithApiUser,\n  WithDevice,\n  WithOnboarding,\n  WithPsdAuth,\n  WithWorkspace,\n} from \"./types\";\n\nexport { fetchAll, fetchAllCursor } from \"../utils\";\nexport type * from \"./types\";\n\nasync function genericRegister<T>({\n  device,\n  name,\n  role,\n  getChallenge,\n  submitChallenge,\n  onScreenDisplayed,\n}: {\n  device: Device;\n  name: string;\n  role: \"ADMIN\" | \"SHARED_OWNER\" | \"OPERATOR\";\n  getChallenge: (p: {\n    pubKey: string;\n    deviceData: UserRegistrationDeviceData;\n  }) => Promise<UserRegistrationChallenge>;\n  submitChallenge: (p: {\n    pubKey: string;\n    challengeResponse: UserRegistrationChallengeResponse;\n  }) => Promise<T>;\n  onScreenDisplayed?: () => void | Promise<void>;\n}): Promise<T> {\n  const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([\n    device.getAttestation(),\n    device.getU2FPubKey(),\n    device.getConfidentialityPubKey(),\n  ]);\n  const ephemeralPubKey = await device.initPairingHandshake();\n  const deviceData: UserRegistrationDeviceData = {\n    name,\n    pubKey: u2fPubKey.pubKey,\n    psdModel: \"STAX\",\n    confidentialityKey: confidentialityKey.pubKey,\n    psdEphemeralKey: ephemeralPubKey.pubKey,\n    psdEphemeralKeyAttestation: {\n      ...attestation.attestation,\n      signature: ephemeralPubKey.signature,\n    },\n  };\n  const challenge = await getChallenge({ pubKey: u2fPubKey.pubKey, deviceData });\n  const pairingPayload = await device.finalizePairingHandshake({\n    handshake: challenge.handshake,\n    partitionId: challenge.ciphertext,\n    handshakeAttestation: challenge.handshakeAttestation,\n  });\n  await onScreenDisplayed?.();\n  const register = await device.register({\n    challenge: challenge.challenge,\n    u2fRegisterData: challenge.u2fRegisterData,\n    name,\n    role,\n  });\n  const validationPubKey = await device.getValidationPubKey();\n  const registerData = await device.registerData({ challenge: challenge.challenge });\n  const attestationOffset = 67 + register.u2fRegister.readInt8(66);\n  const u2fRegister = Buffer.concat([\n    register.u2fRegister.slice(0, attestationOffset),\n    Buffer.from([attestation.buffer.length]),\n    attestation.buffer,\n    register.u2fRegister.slice(attestationOffset),\n  ]).toString(\"hex\");\n  const challengeResponse: UserRegistrationChallengeResponse = {\n    registerData,\n    certificate: {\n      ...attestation.attestation,\n      signature: validationPubKey.signature,\n    },\n    u2fRegister,\n    u2fKeyHandle: register.keyHandle.toString(\"hex\"),\n    validationKey: validationPubKey.pubKey,\n    pairingPayload,\n  };\n  return submitChallenge({ pubKey: u2fPubKey.pubKey, challengeResponse });\n}\n\nexport function createEngine(options: EngineOptions, logger: Logger): Engine {\n  const clientOptions: TRPCClientOptions = {\n    baseUrl: options.baseUrl,\n  };\n  const client = createClient(clientOptions);\n  const apiDevice = createApiDevice(options, logger);\n\n  const base: EngineBase = {\n    client,\n    createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),\n    __options: options,\n  };\n\n  const withDeviceIndex: Engine[\"withDeviceIndex\"] = function <T>(\n    this: Engine<T>,\n    deviceIndex: number,\n  ) {\n    const device = apiDevice.with(deviceIndex);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withTransportId: Engine[\"withTransportId\"] = function <T>(\n    this: Engine<T>,\n    transportId: string,\n  ) {\n    const device = createRealDevice({ transportId }, logger);\n    const withPsd: WithDevice = { device };\n    return decorateEngine({ ...this, ...withPsd } as Engine<T & WithDevice>);\n  };\n\n  const withApiUser: Engine[\"withApiUser\"] = function <T>(this: Engine<T>) {\n    const withApiUser: WithApiUser = { __isApiUser: true };\n    return decorateEngine({ ...this, ...withApiUser } as Engine<T & WithApiUser>);\n  };\n\n  const withWorkspace: Engine[\"withWorkspace\"] = function <T>(\n    this: Engine<T>,\n    workspaceName: string,\n  ) {\n    const withWorkspace: WithWorkspace = { __workspaceName: workspaceName };\n    return decorateEngine({ ...this, ...withWorkspace } as Engine<T & WithWorkspace>);\n  };\n\n  const withOnboarding: Engine[\"withOnboarding\"] = function <T>(\n    this: Engine<T>,\n    onboardingId: string,\n  ) {\n    const withOnboarding: WithOnboarding = { __onboardingId: onboardingId };\n    return decorateEngine({ ...this, ...withOnboarding } as Engine<T & WithOnboarding>);\n  };\n\n  function decorateEngine<T>(\n    engine: Engine<\n      T &\n        Partial<\n          WithDevice & WithOnboarding & WithWorkspace & WithPsdAuth & WithApiUser & WithApiAuth\n        >\n    >,\n  ): Engine<T> {\n    function decorate<TEnhanced, TDecoration>(\n      decorator: (engine: EngineBase & TEnhanced) => TDecoration,\n    ): void {\n      Object.assign(engine, decorator(engine as EngineBase & TEnhanced));\n    }\n\n    // DecorateWithDevice\n    // -------------------------------------------------------------------------\n    if (engine.device) {\n      decorate<WithDevice, DecorateWithDevice<T>>(\n        (engine) =>\n          ({\n            getWorkspaces: async (): Promise<string[]> => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaceNames } = await client.auth.psd.findWorkspaceNames.query({ pubKey });\n              return workspaceNames;\n            },\n\n            getWorkspacesForSso: async (): Promise<\n              RouterOutputs[\"auth\"][\"sso\"][\"findWorkspaces\"][\"workspaces\"]\n            > => {\n              const { device, client } = engine;\n              const { pubKey } = await device.getU2FPubKey();\n              const { workspaces } = await client.auth.sso.findWorkspaces.query({ pubKey });\n              return workspaces;\n            },\n          }) satisfies DecorateWithDevice<T>,\n      );\n    }\n\n    // DecorateWithWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && !engine.__psdToken && !engine.__apiAuth) {\n      decorate<WithWorkspace, DecorateWithWorkspaceUnauthenticated<T>>((engine) => {\n        const { __workspaceName } = engine;\n        return {\n          withPsdToken: function <T>(this: Engine<T>, token: string): Engine<T & WithPsdAuth> {\n            const withPsdAuth: WithPsdAuth = { __psdToken: token };\n            const psdAuth = `${__workspaceName}:${token}`;\n            const client = engine.createClient({ psdAuth });\n            return decorateEngine({ ...this, client, ...withPsdAuth } as Engine<T & WithPsdAuth>);\n          },\n        } satisfies DecorateWithWorkspaceUnauthenticated<T>;\n      });\n    }\n\n    // DecorateWithDeviceAndOnboarding\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__onboardingId) {\n      decorate<WithDevice & WithOnboarding, DecorateWithDeviceAndOnboarding>((engine) => {\n        const { device, client, __onboardingId } = engine;\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const [{ pubKey }, confidentialityKey] = await Promise.all([\n            device.getU2FPubKey(),\n            device.getConfidentialityKey(),\n          ]);\n          const pairing = await client.onboarding.pairDevicePartition.mutate({\n            pubKey,\n            onboardingId: __onboardingId,\n            data: {\n              confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n              confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n            },\n          });\n          await device.setPairing({ pairing });\n        }\n        return {\n          claimDevice: async (params: { role: ClaimedRole; deviceName: string }): Promise<void> => {\n            const { role, deviceName } = params;\n            const [{ pubKey }, { pubKey: confidentialityKey }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await client.onboarding.claimDevice.mutate({\n              onboardingId: __onboardingId,\n              claim: { role, pubKey, deviceName, confidentialityKey },\n            });\n          },\n\n          collectWrappingKeyFragment: async (\n            wrappingKey: WrappingKeyResponse,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const [{ pubKey }, confidentialityKey] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getConfidentialityPubKey(),\n            ]);\n            await device.openSession({\n              secureChannel: {\n                pubKey: wrappingKey.ephemeralPubKey,\n                certificate: wrappingKey.ephemeralCertificate,\n              },\n            });\n            const { attestation } = await device.getAttestation();\n            await params?.onScreenDisplayed?.();\n            const blob = await device.generateWrappingKeyFragment();\n            await client.onboarding.submitWrappingKeyFragment.mutate({\n              pubKey,\n              onboardingId: __onboardingId,\n              fragment: {\n                blob,\n                ephemeralPubKey: confidentialityKey.pubKey,\n                ephemeralCertificate: {\n                  ...attestation,\n                  signature: confidentialityKey.signature,\n                },\n              },\n            });\n          },\n\n          registerDevice: async (\n            registerParams: RegisterOnboardingDeviceParams,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            const { role, name } = registerParams;\n            const getChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.generateMasterAdminRegistrationChallenge\n                : client.onboarding.generateSharedOwnerRegistrationChallenge;\n            const submitChallengeMutation =\n              role === \"ADMIN\"\n                ? client.onboarding.submitMasterAdminRegistration\n                : client.onboarding.submitSharedOwnerRegistration;\n            await genericRegister({\n              device: device,\n              name,\n              role,\n              getChallenge: ({ pubKey, deviceData }) =>\n                getChallengeMutation.mutate({\n                  onboardingId: __onboardingId,\n                  pubKey,\n                  deviceData,\n                }),\n              submitChallenge: ({ pubKey, challengeResponse }) =>\n                submitChallengeMutation.mutate({\n                  onboardingId: engine.__onboardingId,\n                  pubKey,\n                  // FIXME this should be renamed to `challengeResponse` on backend side\n                  response: challengeResponse,\n                }),\n              onScreenDisplayed: params?.onScreenDisplayed,\n            });\n          },\n\n          reviewSharedOwner: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitReviewByMasterAdminSignature.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          reviewExternalSigners: async (\n            challenge: PsdChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const { pubKey } = await device.getU2FPubKey();\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const signature = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            await client.onboarding.submitExternalSignersRegistration.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              signature,\n            });\n          },\n\n          collectSeedFragment: async (\n            challenge: OnboardingSeedChallenge,\n            params?: OnboardingOperationParams,\n          ): Promise<void> => {\n            await enforcePairing();\n            const [{ pubKey }, { attestation }] = await Promise.all([\n              device.getU2FPubKey(),\n              device.getAttestation(),\n            ]);\n            await device.startKPatternAsResponder({\n              handshake: challenge.handshake,\n              handshakeAttestation: challenge.handshakeAttestation,\n              partitionId: challenge.partitionId,\n            });\n            await params?.onScreenDisplayed?.();\n            const challengeResponse = await device.validateVaultOperation({\n              actions: challenge.wActions,\n            });\n            const kkPattern = await device.startKKPatternAsResponder({\n              partitionId: challenge.partitionId,\n              handshake: challenge.kkHandshake,\n              handshakeAttestation: challenge.kkHandshakeAttestation,\n            });\n            const approverBlob = await device.generateSeedFragment();\n            await client.onboarding.submitSeedFragment.mutate({\n              onboardingId: __onboardingId,\n              pubKey,\n              seedFragment: {\n                challengeResponse,\n                approverBlob,\n                handshake: kkPattern.handshake,\n                handshakeAttestation: {\n                  ...attestation,\n                  signature: kkPattern.signature,\n                },\n              },\n            });\n          },\n        } satisfies DecorateWithDeviceAndOnboarding;\n      });\n    }\n\n    // DecorateWithDeviceAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && !engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithDeviceAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { device, client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              opts?: {\n                validityDurationSecs?: number;\n                onScreenDisplayed?: () => void | Promise<void>;\n                correlationId?: string;\n              },\n            ): Promise<Engine<T & WithPsdAuth>> {\n              const { pubKey } = await device.getU2FPubKey();\n              const challenge = await client.auth.psd.generateChallenge.mutate(\n                {\n                  pubKey,\n                  workspaceName: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              await opts?.onScreenDisplayed?.();\n              const authentication = await device.authenticate({\n                challenge,\n                workspaceName: __workspaceName,\n              });\n              const authPayload = {\n                workspaceName: __workspaceName,\n                pubKey,\n                authentication,\n                challengeId: challenge.challengeId,\n                validityDurationSecs: opts?.validityDurationSecs,\n              };\n              const { token } = await client.auth.psd.authenticate.mutate(\n                { ...authPayload },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withPsdAuth: WithPsdAuth = {\n                __psdToken: token,\n              };\n              const psdAuth = `${engine.__workspaceName}:${token}`;\n              const __authClient = engine.createClient({ psdAuth });\n              return decorateEngine({ ...this, client: __authClient, ...withPsdAuth } as Engine<\n                T & WithPsdAuth\n              >);\n            },\n\n            register: (\n              registration: UserRegistrationResponse,\n              params?: OnboardingOperationParams,\n            ): Promise<UserRegistrationResponse> => {\n              return genericRegister({\n                device,\n                name: registration.name,\n                role: registration.role,\n                getChallenge: async ({ deviceData }) => {\n                  const challenge = await client.userRegistrations.generateChallenge.mutate({\n                    id: registration.id,\n                    workspaceName: __workspaceName,\n                    deviceData,\n                  });\n                  return challenge;\n                },\n                submitChallenge: ({ challengeResponse }) =>\n                  client.userRegistrations.submitChallenge.mutate({\n                    workspaceName: __workspaceName,\n                    id: registration.id,\n                    challengeResponse,\n                  }),\n                onScreenDisplayed: params?.onScreenDisplayed,\n              });\n            },\n          } satisfies DecorateWithDeviceAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithApiUserAndWorkspaceUnauthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__isApiUser && !engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiUser, DecorateWithApiUserAndWorkspaceUnauthenticated<T>>(\n        (engine) => {\n          const { client, __workspaceName } = engine;\n          return {\n            login: async function <T>(\n              this: Engine<T>,\n              credentials: {\n                apiKeyId: string;\n                apiKeySecret: string;\n              },\n              opts?: { correlationId?: string },\n            ): Promise<Engine<T & WithApiAuth>> {\n              const res = await client.auth.authenticate.mutate(\n                {\n                  apiKeyId: credentials.apiKeyId,\n                  apiKeySecret: credentials.apiKeySecret,\n                  workspace: __workspaceName,\n                },\n                buildTrpcContext({ correlationId: opts?.correlationId }),\n              );\n              const withApiAuth: WithApiAuth = {\n                __apiAuth: res,\n              };\n              const __authClient = engine.createClient({ apiAccessToken: res.accessToken });\n              return decorateEngine({ ...this, client: __authClient, ...withApiAuth } as Engine<\n                T & WithApiAuth\n              >);\n            },\n          } satisfies DecorateWithApiUserAndWorkspaceUnauthenticated<T>;\n        },\n      );\n    }\n\n    // DecorateWithWorkspacePsdAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.device && engine.__workspaceName && engine.__psdToken) {\n      decorate<WithDevice & WithWorkspace, DecorateWithWorkspacePsdAuthenticated>((engine) => {\n        const { client, device } = engine;\n\n        async function enforcePairing(): Promise<void> {\n          if (await device.hasPairing()) return;\n          const confidentialityKey = await device.getConfidentialityKey();\n          const pairing = await client.debug.pairDevicePartition.mutate({\n            confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,\n            confidentialityKeySignature: confidentialityKey.confidentialityKeySignature,\n          });\n          await device.setPairing({ pairing });\n        }\n\n        const approveChallenge = async (\n          challenge: PsdChallenge,\n          params?: ApproveRequestParams,\n        ): Promise<string> => {\n          await enforcePairing();\n          await device.startKPatternAsResponder({\n            handshake: challenge.handshake,\n            handshakeAttestation: challenge.handshakeAttestation,\n            partitionId: challenge.partitionId,\n          });\n          await params?.onScreenDisplayed?.();\n          const signature = await device.validateVaultOperation({\n            actions: challenge.wActions,\n          });\n          return signature;\n        };\n\n        return {\n          approve: async (\n            request: VaultRequestResponse,\n            params?: ApproveRequestParams,\n          ): Promise<VaultRequestResponse> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            if (challenge.challengeType === \"PSD\") {\n              const signature = await approveChallenge(challenge, params);\n              await params?.onPsdChallengeSigned?.();\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"PSD\", signature },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            if (challenge.challengeType === \"SOFT\") {\n              return client.requests.approve.mutate(\n                {\n                  id: request.id,\n                  data: { challengeType: \"SOFT\" },\n                },\n                buildTrpcContext(params),\n              );\n            }\n            throw new Error(\"Challenge type must be either PSD or SOFT\");\n          },\n\n          approveChallenge,\n\n          reject: (\n            request: VaultRequestResponse,\n            opts?: CorrelationIdOpts,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate(\n              { id: request.id, data: null },\n              buildTrpcContext(opts),\n            );\n          },\n        } satisfies DecorateWithWorkspacePsdAuthenticated;\n      });\n    }\n\n    // DecorateWithWorkspaceApiAuthenticated\n    // -------------------------------------------------------------------------\n    if (engine.__workspaceName && engine.__apiAuth) {\n      decorate<WithWorkspace & WithApiAuth, DecorateWithWorkspaceApiAuthenticated>((engine) => {\n        const { client } = engine;\n        return {\n          getChallenge: async (request: VaultRequestResponse): Promise<ApiChallenge[\"payload\"]> => {\n            const { challenge } = await client.requests.getChallenge.query({ id: request.id });\n            invariant(challenge.challengeType === \"API\", \"Challenge type must be API\");\n            return challenge.payload;\n          },\n\n          approve: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.approve.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n\n          reject: (\n            request: VaultRequestResponse,\n            signature: string,\n          ): Promise<VaultRequestResponse> => {\n            return client.requests.reject.mutate({\n              id: request.id,\n              data: { challengeType: \"API\", signature },\n            });\n          },\n        } satisfies DecorateWithWorkspaceApiAuthenticated;\n      });\n    }\n\n    return engine;\n  }\n\n  return {\n    ...base,\n    withDeviceIndex,\n    withTransportId,\n    withApiUser,\n    withWorkspace,\n    withOnboarding,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,mBAAmB;AAMzB,MAAM,yBAAyB,eAAiC;CAE9D,OADc,WAAW,MAAM,IAAI,CAAC,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,EAAE,CAChE,CAAC,CAAC,KAAK,UAAU,OAAO,gBAAgB,CAAC;AACtD;AAEA,MAAM,eAAe,OAAe,WAA6B;CAC/D,MAAM,SAAS,CAAC;CAChB,KAAK,IAAI,IAAI,GAAG,OAAO,OAAO,IAAI,OAAO,QAAQ,KAAK,MAAM,OAAO,OACjE,OAAO,KAAK,OAAO,MAAM,GAAG,IAAI,IAAI,CAAC;CAEvC,OAAO;AACT;AAEA,MAAM,gBAAgB,WAA2B,OAAO,MAAM,GAAG,OAAO,SAAA,CAAsB;AAE9F,MAAM,cAAc,OAClB,WACA,SACA,MACA,YAAoB,qBACA;CACpB,MAAM,SAAS,YAAY,WAAW,IAAI;CAC1C,IAAI,WAAW,OAAO,KAAK,CAAC,CAAC;CAC7B,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,CAAC,GAAG,OAAO;;EAGxB,KAAK,KAAK,KAAK;EACf,WAAY,MAAM,UAAU,KAAK,KAAK,IAAK,KAAK,IAAK,KAAK,IAAI,KAAK,IAAK,OAAO,CAC7E,OACA,GAAGA,eAAAA,gBACL,CAAC;CACH;CACA,OAAO;AACT;AAEA,MAAM,oBAAoB,WAIZ;CACZ,MAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,WAAW,QAAQ;CAC7E,MAAM,kBAAkB,OAAO,MAAM,CAAC;CACtC,gBAAgB,YAAY,UAAU,QAAQ,GAAG,CAAC;CAElD,MAAM,aAAa,OAAO,KAAK,OAAO,qBAAqB,aAAa,QAAQ;CAChF,MAAM,mBAAmB,OAAO,MAAM,CAAC;CACvC,iBAAiB,YAAY,WAAW,QAAQ,GAAG,CAAC;CAEpD,MAAM,YAAY,OAAO,KAAK,OAAO,qBAAqB,gBAAgB,QAAQ;CAElF,MAAM,gBAAgB,OAAO,OAAO;EAClC;EACA;EACA;EACA;EACA;CACF,CAAC;CAED,MAAM,eAAe,OAAO,KAAK,OAAO,WAAW,KAAK;CACxD,MAAM,qBAAqB,OAAO,MAAM,CAAC;CACzC,mBAAmB,YAAY,aAAa,QAAQ,GAAG,CAAC;CAExD,MAAM,YAAY,OAAO,KAAK,OAAO,aAAa,KAAK;CACvD,MAAM,kBAAkB,OAAO,MAAM,CAAC;CACtC,gBAAgB,YAAY,UAAU,QAAQ,GAAG,CAAC;CAElD,MAAM,0BAA0B,OAAO,MAAM,CAAC;CAC9C,wBAAwB,cAAc,cAAc,QAAQ,CAAC;CAE7D,MAAM,OAAO,OAAO,OAAO;EACzB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CAED,MAAM,oBAAoB,OAAO,MAAM,CAAC;CACxC,kBAAkB,cAAc,KAAK,QAAQ,CAAC;CAI9C,OAFe,OAAO,OAAO,CAAC,mBAAmB,IAAI,CAEzC;AACd;;AAIA,MAAM,uBAAqC,QAAQ;CAEjD,IAAI,eAAeC,eAAAA,mBAAmB,OAAO;CAE7C,IAAIC,eAAAA,uBAAuB,GAAG,KAAK,IAAI,eAAe,OAAQ,OAAO;CAErE,IAAI,eAAeC,eAAAA,oBAAoB,OAAO;CAG9C,OAAO;AACT;AAEA,SAAgB,iBAAiB,SAAkB,QAAwB;CACzE,MAAM,EAAE,gBAAgB;CAExB,eAAe,IACb,KACA,eAA6B,qBACjB;EACZ,QAAA,GAAA,KAAA,cAAA,CACEC,eAAAA,kBAAkB,WAAW,CAAC,EAAK,eAAA,GAAA,KAAA,KAAA,CAAmB,IAAI,SAAS,CAAC,GAAG,YAAY,CACrF;CACF;;CAGA,MAAM,gBAAyB;;CAE/B,MAAM,oBAA6B;CACnC,MAAM,OAAO,OACX,OAAwC,CAAC,MACH;EAEtC,MAAM,IAEJ,OAAO,eAAe,CAAC,GACvB,KAAK,gBAAgB,WACvB;EAEA,IAAI;GACF,MAAM,aAAaC,eAAAA,MAAM,KAAK;IAAE,WAAW;IAAM,cAAc;GAAQ,CAAC;GACxE,OAAO,EAAE,aAAa,KAAK;EAC7B,SAAS,KAAK;GACZ,IAAIH,eAAAA,uBAAuB,GAAG,KAAK,oBAAoB,GAAG,GACxD,OAAO,EAAE,aAAa,MAAM;GAE9B,MAAM;EACR;CACF;CAEA,MAAM,UAAU,OAAO,YAAqC;EAC1D,MAAM,MAAM,MAAM,KAAK,cACrB,UAAU,KAAK,KAAM,KAAM,GAAM,GAAM,OAAO,KAAK,SAAS,MAAM,CAAC,CACrE;EAEA,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,GAAG,CAAC;EAC3C,OAAO,IAAI,SAAS,KAAK;CAC3B;CAEA,MAAM,eAAe,OACnB,YACA,EAAE,WAAW,mBACsC;EACnD,OAAO,KAAK,0BAA0B,WAAW,EAAE;EACnD,MAAM,OAAO,sBAAsB,UAAU;EAC7C,MAAM,OAAO,OAAO,OAAO,CACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC,GACzB,GAAG,KAAK,KAAK,eAAe;GAC1B,MAAM,MAAM,OAAO,MAAM,CAAC;GAC1B,IAAI,cAAc,YAAY,CAAC;GAC/B,OAAO;EACT,CAAC,CACH,CAAC;EACD,MAAM,QAAQ,YAAY,IAAO;EACjC,MAAM,WAAW,MAAM,KACpB,cAAc,UAAU,KAAK,KAAM,IAAM,OAAO,GAAM,IAAI,GAC3D,gBAAgB,mBAClB;EACA,MAAM,eAAe,SAAS,SAAS,CAAC;EAQxC,OAAO;GAAE,QAPM,SACZ,MAAM,GAAG,eAAe,CAAC,CAAC,CAC1B,SAAS,KAAK,CAAC,CACf,YAIW;GAAG,WAHC,SACf,MAAM,eAAe,GAAG,SAAS,SAAA,CAAsB,CAAC,CACxD,SAAS,QACa;EAAE;CAC7B;CAkVA,OAAO;EA/UL,cAAc,OAAO,EAAE,WAAW,EAAE,WAAW,MAAM,MAAM,aAAa,oBAAoB;GAC1F,OAAO,KAAK,uBAAuB;GACnC,CAAA,GAAA,UAAA,QAAA,CAAU,SAAS,qBAAqB,kDAAkD;GAC1F,MAAM,oBAAoB,OAAO,KAAKI,eAAAA,2BAA2B,KAAK;GACtE,MAAM,aAAa,OAAO,KAAK,IAAI;GACnC,MAAM,kBAAkB,OAAO,KAAK,aAAa;GAEjD,MAAM,gBAAgB,OAAO,OAAO;IAClC,OAAO,KAAKC,eAAAA,UAAU,OAAO,KAAK;IAClC,OAAO,KAAK,CAAC,WAAW,MAAM,CAAC;IAC/B;IACA,OAAO,KAAK,CAAC,gBAAgB,MAAM,CAAC;IACpC;GACF,CAAC;GAED,MAAM,sBAAsB,OAAO,MAAM,CAAC;GAC1C,oBAAoB,cAAc,cAAc,QAAQ,CAAC;GAEzD,MAAM,OAAO,OAAO,OAAO;IACzB,OAAO,KAAK,WAAW,QAAQ;IAC/B;IACA,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;IAC9B,OAAO,KAAK,WAAW,KAAK;IAC5B;IACA;GACF,CAAC;GAMD,OAAO,aAAa,MAJS,KAAK,cAChC,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;GAAI,GAAG,IAAI,CACvD,CAEkC,CAAC,CAAC,SAAS,KAAK;EACpD;EAEA,0BAA0B,OAAO,WAIV;GAIrB,OAAO,aAAa,MAHQ,KAAK,cAC/B,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;GAAI,GAAG,iBAAiB,MAAM,CAAC,CAC3E,CACiC,CAAC,CAAC,SAAS,KAAK;EACnD;EAEA,sBAAsB,YAA6B;GACjD,OAAO,KAAK,+BAA+B;GAC3C,MAAM,OAAO,sBAAsBF,eAAAA,MAAM,YAAY;GACrD,MAAM,OAAO,OAAO,OAAO,CACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC,GACzB,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,CAAC;IAC1B,IAAI,cAAc,YAAY,CAAC;IAC/B,OAAO;GACT,CAAC,CACH,CAAC;GAED,OAAO,aAAa,MADG,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,IAAI,CAAC,CAC1D,CAAC,CAAC,SAAS,QAAQ;EACjD;EACA,6BAA6B,YAA6B;GACxD,OAAO,KAAK,sCAAsC;GAClD,MAAM,OAAO,sBAAsBA,eAAAA,MAAM,YAAY;GACrD,MAAM,OAAO,OAAO,OAAO,CACzB,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC,GACzB,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,CAAC;IAC1B,IAAI,cAAc,YAAY,CAAC;IAC/B,OAAO;GACT,CAAC,CACH,CAAC;GAED,OAAO,aAAa,MADG,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,GAAM,IAAI,CAAC,CAC1D,CAAC,CAAC,SAAS,QAAQ;EACjD;EACA,gBAAgB,YAOV;GAEJ,MAAM,SAAS,aAAa,MADA,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC,CAC5C;GACzC,MAAM,UAAU,OAAO,SAAS,EAAW;GAC3C,OAAO;IACL,aAAa;KACX,UAAU,OAAO,MAAM,GAAG,EAAE,CAAC,CAAC,SAAS,QAAQ;KAC/C,gBAAgB,OAAO,MAAM,IAAI,EAAO,CAAC,CAAC,SAAS,QAAQ;KAC3D,aAAa,OAAO,MAAM,IAAS,KAAc,OAAO,CAAC,CAAC,SAAS,QAAQ;IAC7E;IACA;GACF;EACF;EACA,uBAAuB,YAAY;GACjC,OAAO,KAAK,gCAAgC;GAE5C,MAAM,MAAM,aAAa,MADG,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC,CAC/C;GACtC,MAAM,YAAY,IAAI;GACtB,MAAM,MAAM,IAAI,MAAM,GAAG,IAAI,SAAS;GACtC,MAAM,MAAM,IAAI,MAAM,IAAI,YAAY,CAAC;GACvC,OAAO;IACL,8BAA8B,IAAI,SAAS,KAAK;IAChD,6BAA6B,IAAI,SAAS,KAAK;GACjD;EACF;EACA,gCAAgC,aAAaA,eAAAA,MAAM,iBAAiB,EAAE,WAAW,KAAK,CAAC;EACvF,iBAAiB,YAA6B;GAC5C,OAAO,KAAK,0BAA0B;GAEtC,OAAO,aAAa,MADG,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC,CACpD,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,YAAY;EAC5D;EACA,oBAAoB,aAAaA,eAAAA,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;EAChE,2BAA2B,aAAaA,eAAAA,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;EAC7E,YAAY,YAAY;GACtB,OAAO,KAAK,qBAAqB;GACjC,MAAM,OAAO;IAAC;IAAM;IAAM;IAAM;IAAM;GAAI;GAC1C,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,SAAS,OAAO,KAAK,IAAI,CAAC,CAAC;GAC1E,MAAM,MAAM,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,KAAK;GAU3C,OAAO,QAAQ,UAAU,QAAQ;EACnC;EAEA,sBAAsB,YAA4D;GAChF,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,IAAM,GAAM,CAAI,CAAC;GAC3E,MAAM,eAAe,IAAI,SAAS,CAAC;GAMnC,OAAO;IAAE,QALM,IACZ,MAAM,GAAG,eAAe,CAAC,CAAC,CAC1B,SAAS,KAAK,CAAC,CACf,YAEW;IAAG,WADC,IAAI,MAAM,eAAe,GAAG,IAAI,SAAA,CAAsB,CAAC,CAAC,SAAS,QAC1D;GAAE;EAC7B;EAEA,aAAa,OAAO,WAEC;GACnB,OAAO,KAAK,sBAAsB;GAClC,MAAM,EAAE,kBAAkB;GAE1B,MAAM,OAAO,sBAAsBA,eAAAA,MAAM,eAAe;GACxD,MAAM,iBAAiB,OAAO,OAAO,CACnC,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC,GACzB,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,CAAC;IAC1B,IAAI,cAAc,YAAY,CAAC;IAC/B,OAAO;GACT,CAAC,CACH,CAAC;GAED,MAAM,SAAS,OAAO,KAAK,cAAc,QAAQ,KAAK;GAEtD,MAAM,YAAY,OAAO,KAAK,cAAc,YAAY,WAAW,QAAQ;GAC3E,MAAM,uBAAuB,OAAO,KAAK,cAAc,YAAY,gBAAgB,QAAQ;GAC3F,MAAM,aAAa,OAAO,KAAK,cAAc,YAAY,aAAa,QAAQ;GAC9E,MAAM,cAAc,OAAO,OAAO;IAChC,OAAO,KAAK,CAAC,UAAU,MAAM,CAAC;IAC9B;IACA;IACA,OAAO,KAAK,CAAC,WAAW,MAAM,CAAC;IAC/B;GACF,CAAC;GAED,MAAM,oBAAoB,OAAO,MAAM,CAAC;GACxC,kBAAkB,cAAc,YAAY,QAAQ,CAAC;GAErD,MAAM,OAAO,OAAO,OAAO;IAAC;IAAgB;IAAQ;IAAmB;GAAW,CAAC;GAEnF,MAAM,KAAK,cACT,YAAY,WAAW;IAAC;IAAM;IAAM;IAAMG,eAAAA,WAAW;GAAY,GAAG,IAAI,CAC1E;EACF;EAEA,UAAU,OAAO,WAUX;GACJ,MAAM,EAAE,WAAW,cAAc,iBAAiB,GAAG,MAAM,SAAS;GACpE,MAAM,YAAY,OAAO,KAAK,cAAc,KAAK;GAEjD,CAAA,GAAA,UAAA,QAAA,CAAU,UAAU,WAAW,IAAI,4CAA4C;GAC/E,MAAM,iBAAiB,OAAO,KAAKF,eAAAA,2BAA2B,KAAK;GACnE,CAAA,GAAA,UAAA,QAAA,CAAU,eAAe,WAAW,IAAI,8CAA8C;GAEtF,MAAM,eAAe,OAAO,KAAK,IAAI;GAErC,MAAM,gBAAgB,OAAO,OAAO;IAClC,OAAO,KAAKC,eAAAA,UAAU,OAAO,KAAK;IAClC,OAAO,KAAK,CAAC,aAAa,MAAM,CAAC;IACjC;GACF,CAAC;GAED,MAAM,sBAAsB,OAAO,MAAM,CAAC;GAC1C,oBAAoB,cAAc,cAAc,QAAQ,CAAC;GAEzD,MAAM,OAAO,OAAO,OAAO;IAAC;IAAW;IAAgB;IAAqB;GAAa,CAAC;GAE1F,MAAM,WAAW,MAAM,KAAK,cAC1B,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;GAAI,GAAG,IAAI,CACvD;GAEA,IAAI,IAAI;GACR,MAAM,MAAM,SAAS,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;GACrC,KAAK;GACL,MAAM,SAAS,SAAS,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,SAAS,KAAK;GACvD,KAAK;GACL,MAAM,kBAAkB,SAAS,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;GACjD;GACA,MAAM,YAAY,SAAS,MAAM,GAAG,IAAI,eAAe;GACvD,KAAK;GACL,OAAO;IACL,aAAa,aAAa,QAAQ;IAClC;IACA;IACA;GACF;EACF;EACA,cAAc,OAAO,WAAmD;GACtE,MAAM,EAAE,WAAW,iBAAiB;GACpC,MAAM,YAAY,OAAO,KAAK,cAAc,KAAK;GACjD,CAAA,GAAA,UAAA,QAAA,CAAU,UAAU,WAAW,IAAI,4CAA4C;GAE/E,OAAO,aAAa,MADG,KAAK,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,GAAM,SAAS,CAAC,CAC/D,CAAC,CAAC,SAAS,KAAK;EAC9C;EAEA,YAAY,OAAO,EAAE,cAAc;GACjC,OAAO,KAAK,qBAAqB;GACjC,MAAM,aAAa,OAAO,KAAK,QAAQ,MAAM,QAAQ;GACrD,MAAM,SAAS,OAAO,MAAM,CAAC;GAC7B,OAAO,cAAc,WAAW,QAAQ,CAAC;GACzC,MAAM,QAAQ,OAAO,OAAO,CAAC,QAAQ,UAAU,CAAC;GAChD,MAAM,KAAK,cAAc,YAAY,WAAW;IAAC;IAAM;IAAM;IAAM;GAAI,GAAG,KAAK,CAAC;EAClF;EACA,2BAA2B,OAAO,WAIuB;GACvD,OAAO,KAAK,oCAAoC;GAChD,MAAM,OAAO,iBAAiB,MAAM;GAIpC,MAAM,SAAS,aAAa,MAHA,KAAK,cAC/B,YAAY,WAAW;IAAC;IAAM;IAAM;IAAMC,eAAAA,WAAW;GAAuB,GAAG,IAAI,CACrF,CACyC;GACzC,MAAM,aAAa,OAAO,SAAS,CAAC;GACpC,OAAO;IACL,WAAW,OAAO,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,QAAQ;IAC5D,WAAW,OAAO,MAAM,aAAa,CAAC,CAAC,CAAC,SAAS,QAAQ;GAC3D;EACF;EACA,0BAA0B,OAAO,WAAW;GAC1C,OAAO,KAAK,mCAAmC;GAC/C,MAAM,OAAO,iBAAiB,MAAM;GACpC,MAAM,KAAK,cACT,YAAY,WAAW;IAAC;IAAM;IAAM;IAAMA,eAAAA,WAAW;GAAuB,GAAG,IAAI,CACrF;EACF;EACA,wBAAwB,OAAO,WAAW;GACxC,OAAO,KAAK,iCAAiC;GAC7C,MAAM,OAAO,sBAAsBH,eAAAA,MAAM,UAAU;GACnD,MAAM,QAAQ,OAAO,OAAO,CAC1B,OAAO,KAAK,CAAC,KAAK,MAAM,CAAC,GACzB,GAAG,KAAK,KAAK,eAAe;IAC1B,MAAM,MAAM,OAAO,MAAM,CAAC;IAC1B,IAAI,cAAc,YAAY,CAAC;IAC/B,OAAO;GACT,CAAC,CACH,CAAC;GAED,IAAI,eAAe;GACnB,IAAI,gBAA+B;GAEnC,OAAO,CAAC,eAAe;IACrB,MAAM,SAAS,OAAO,KAAK,OAAO,QAAQ,eAAe,IAAK,QAAQ;IACtE,MAAM,SAAS,OAAO,MAAM,CAAC;IAC7B,OAAO,cAAc,OAAO,QAAQ,CAAC;IACrC,MAAM,OAAO,OAAO,OAAO;KAAC;KAAO;KAAQ;IAAM,CAAC;IAClD,MAAM,WAAW,MAAM,KAAK,cAC1B,YAAY,WAAW;KAAC;KAAM;KAAM;KAAM;IAAI,GAAG,IAAI,CACvD;IACA,MAAM,eAAe,SAAS,SAAS,CAAC;IACxC,IAAI,iBAAiB,SAAS,aAAa,SAAS,SAAS,CAAC;IAC9D,QAAQ,cAAR;KACE,KAAA;MACE,eAAe,SAAS,WAAW,GAAG,CAAC;MACvC;KACF,KAAA;MACE,gBAAgB,SAAS,MAAM,GAAG,SAAS,SAAS,CAAC;MACrD,OAAO,mBAAmB,OACU;OAChC,MAAM,OAAO,MAAM,KAAK,cAAc,UAAU,KAAK,GAAM,KAAM,GAAM,CAAI,CAAC;OAC5E,iBAAiB,KAAK,aAAa,KAAK,SAAS,CAAC;OAClD,gBAAgB,OAAO,OAAO,CAAC,eAAe,aAAa,IAAI,CAAC,CAAC;MACnE;MAEF;;KAEF,SACE,MAAM,IAAI,MAAM,0BAA0B,cAAc;IAC5D;GACF;GACA,OAAO,cAAc,SAAS,QAAQ;EACxC;EAEA,UAAU,OAAO,gBAAwB;GACvC,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,SAAS,OAAO,KAAK,aAAa,KAAK,CAAC,CAAC;GACxF,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,KAAK;EACxC;EACA,YAAY,YAAY;GACtB,MAAM,MAAM,MAAM,KAAK,cAAc,UAAU,KAAK,KAAM,GAAM,GAAM,CAAI,CAAC;GAC3E,MAAM,aAAa,IAAI,SAAS,CAAC;GACjC,MAAM,gBAAgB,IAAI,SAAS,IAAI,UAAU;GACjD,MAAM,gBAAgB,IAAI,MAAM,IAAQ,YAAY,IAAI,aAAa,gBAAgB,CAAC;GAItF,OAFmB,OAAO,KAAK,aAAa,CAAC,CAAC,SAE9B;EAClB;EACA;EACA;CAEU;AACd;;;AC3gBA,MAAa,gBAAgB,YAAqD;CA4BhF,QAAA,GAAA,aAAA,iBAAA,CA3ByC,EACvC,OAAO,EAAA,GAAA,aAAA,SAAA,CACI;EACP,KAAK,GAAG,QAAQ,QAAQ;EACxB,aAAa,UAAA;EACb,QAAQ,MAAM;GAEZ,MAAM,iBAAkB,KAAK,GAAG,SAAS,WAAsC,CAAC;GAEhF,OAAO;IACL,GAAI,QAAQ,iBACR,EAAE,8BAA8B,QAAQ,eAAe,IACvD,CAAC;IACL,GAAI,QAAQ,gBACR,EAAE,6BAA6B,QAAQ,cAAc,IACrD,CAAC;IACL,GAAI,QAAQ,UAAU,EAAE,eAAe,WAAW,QAAQ,UAAU,IAAI,CAAC;IACzE,GAAI,QAAQ,iBACR,EAAE,eAAe,UAAU,QAAQ,iBAAiB,IACpD,CAAC;IAEL,GAAG;GACL;EACF;CACF,CAAC,CACH,EACF,CACU;AACZ;;;ACHA,eAAe,gBAAmB,EAChC,QACA,MACA,MACA,cACA,iBACA,qBAca;CACb,MAAM,CAAC,aAAa,WAAW,sBAAsB,MAAM,QAAQ,IAAI;EACrE,OAAO,eAAe;EACtB,OAAO,aAAa;EACpB,OAAO,yBAAyB;CAClC,CAAC;CACD,MAAM,kBAAkB,MAAM,OAAO,qBAAqB;CAC1D,MAAM,aAAyC;EAC7C;EACA,QAAQ,UAAU;EAClB,UAAU;EACV,oBAAoB,mBAAmB;EACvC,iBAAiB,gBAAgB;EACjC,4BAA4B;GAC1B,GAAG,YAAY;GACf,WAAW,gBAAgB;EAC7B;CACF;CACA,MAAM,YAAY,MAAM,aAAa;EAAE,QAAQ,UAAU;EAAQ;CAAW,CAAC;CAC7E,MAAM,iBAAiB,MAAM,OAAO,yBAAyB;EAC3D,WAAW,UAAU;EACrB,aAAa,UAAU;EACvB,sBAAsB,UAAU;CAClC,CAAC;CACD,MAAM,oBAAoB;CAC1B,MAAM,WAAW,MAAM,OAAO,SAAS;EACrC,WAAW,UAAU;EACrB,iBAAiB,UAAU;EAC3B;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,MAAM,OAAO,oBAAoB;CAC1D,MAAM,eAAe,MAAM,OAAO,aAAa,EAAE,WAAW,UAAU,UAAU,CAAC;CACjF,MAAM,oBAAoB,KAAK,SAAS,YAAY,SAAS,EAAE;CAC/D,MAAM,cAAc,OAAO,OAAO;EAChC,SAAS,YAAY,MAAM,GAAG,iBAAiB;EAC/C,OAAO,KAAK,CAAC,YAAY,OAAO,MAAM,CAAC;EACvC,YAAY;EACZ,SAAS,YAAY,MAAM,iBAAiB;CAC9C,CAAC,CAAC,CAAC,SAAS,KAAK;CACjB,MAAM,oBAAuD;EAC3D;EACA,aAAa;GACX,GAAG,YAAY;GACf,WAAW,iBAAiB;EAC9B;EACA;EACA,cAAc,SAAS,UAAU,SAAS,KAAK;EAC/C,eAAe,iBAAiB;EAChC;CACF;CACA,OAAO,gBAAgB;EAAE,QAAQ,UAAU;EAAQ;CAAkB,CAAC;AACxE;AAEA,SAAgB,aAAa,SAAwB,QAAwB;CAC3E,MAAM,gBAAmC,EACvC,SAAS,QAAQ,QACnB;CACA,MAAM,SAAS,aAAa,aAAa;CACzC,MAAM,YAAYI,eAAAA,gBAAgB,SAAS,MAAM;CAEjD,MAAM,OAAmB;EACvB;EACA,eAAe,cAAc,aAAa;GAAE,GAAG;GAAe,GAAG;EAAU,CAAC;EAC5E,WAAW;CACb;CAEA,MAAM,kBAA6C,SAEjD,aACA;EAEA,MAAM,UAAsB,EAAE,QADf,UAAU,KAAK,WACK,EAAE;EACrC,OAAO,eAAe;GAAE,GAAG;GAAM,GAAG;EAAQ,CAA2B;CACzE;CAEA,MAAM,kBAA6C,SAEjD,aACA;EAEA,MAAM,UAAsB,EAAE,QADf,iBAAiB,EAAE,YAAY,GAAG,MACd,EAAE;EACrC,OAAO,eAAe;GAAE,GAAG;GAAM,GAAG;EAAQ,CAA2B;CACzE;CAEA,MAAM,cAAqC,WAA8B;EACvE,MAAM,cAA2B,EAAE,aAAa,KAAK;EACrD,OAAO,eAAe;GAAE,GAAG;GAAM,GAAG;EAAY,CAA4B;CAC9E;CAEA,MAAM,gBAAyC,SAE7C,eACA;EACA,MAAM,gBAA+B,EAAE,iBAAiB,cAAc;EACtE,OAAO,eAAe;GAAE,GAAG;GAAM,GAAG;EAAc,CAA8B;CAClF;CAEA,MAAM,iBAA2C,SAE/C,cACA;EACA,MAAM,iBAAiC,EAAE,gBAAgB,aAAa;EACtE,OAAO,eAAe;GAAE,GAAG;GAAM,GAAG;EAAe,CAA+B;CACpF;CAEA,SAAS,eACP,QAMW;EACX,SAAS,SACP,WACM;GACN,OAAO,OAAO,QAAQ,UAAU,MAAgC,CAAC;EACnE;EAIA,IAAI,OAAO,QACT,UACG,YACE;GACC,eAAe,YAA+B;IAC5C,MAAM,EAAE,QAAQ,WAAW;IAC3B,MAAM,EAAE,WAAW,MAAM,OAAO,aAAa;IAC7C,MAAM,EAAE,mBAAmB,MAAM,OAAO,KAAK,IAAI,mBAAmB,MAAM,EAAE,OAAO,CAAC;IACpF,OAAO;GACT;GAEA,qBAAqB,YAEhB;IACH,MAAM,EAAE,QAAQ,WAAW;IAC3B,MAAM,EAAE,WAAW,MAAM,OAAO,aAAa;IAC7C,MAAM,EAAE,eAAe,MAAM,OAAO,KAAK,IAAI,eAAe,MAAM,EAAE,OAAO,CAAC;IAC5E,OAAO;GACT;EACF,EACJ;EAKF,IAAI,OAAO,mBAAmB,CAAC,OAAO,cAAc,CAAC,OAAO,WAC1D,UAAkE,WAAW;GAC3E,MAAM,EAAE,oBAAoB;GAC5B,OAAO,EACL,cAAc,SAA8B,OAAwC;IAClF,MAAM,cAA2B,EAAE,YAAY,MAAM;IACrD,MAAM,UAAU,GAAG,gBAAgB,GAAG;IACtC,MAAM,SAAS,OAAO,aAAa,EAAE,QAAQ,CAAC;IAC9C,OAAO,eAAe;KAAE,GAAG;KAAM;KAAQ,GAAG;IAAY,CAA4B;GACtF,EACF;EACF,CAAC;EAKH,IAAI,OAAO,UAAU,OAAO,gBAC1B,UAAwE,WAAW;GACjF,MAAM,EAAE,QAAQ,QAAQ,mBAAmB;GAC3C,eAAe,iBAAgC;IAC7C,IAAI,MAAM,OAAO,WAAW,GAAG;IAC/B,MAAM,CAAC,EAAE,UAAU,sBAAsB,MAAM,QAAQ,IAAI,CACzD,OAAO,aAAa,GACpB,OAAO,sBAAsB,CAC/B,CAAC;IACD,MAAM,UAAU,MAAM,OAAO,WAAW,oBAAoB,OAAO;KACjE;KACA,cAAc;KACd,MAAM;MACJ,8BAA8B,mBAAmB;MACjD,6BAA6B,mBAAmB;KAClD;IACF,CAAC;IACD,MAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;GACrC;GACA,OAAO;IACL,aAAa,OAAO,WAAqE;KACvF,MAAM,EAAE,MAAM,eAAe;KAC7B,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,wBAAwB,MAAM,QAAQ,IAAI,CACrE,OAAO,aAAa,GACpB,OAAO,yBAAyB,CAClC,CAAC;KACD,MAAM,OAAO,WAAW,YAAY,OAAO;MACzC,cAAc;MACd,OAAO;OAAE;OAAM;OAAQ;OAAY;MAAmB;KACxD,CAAC;IACH;IAEA,4BAA4B,OAC1B,aACA,WACkB;KAClB,MAAM,CAAC,EAAE,UAAU,sBAAsB,MAAM,QAAQ,IAAI,CACzD,OAAO,aAAa,GACpB,OAAO,yBAAyB,CAClC,CAAC;KACD,MAAM,OAAO,YAAY,EACvB,eAAe;MACb,QAAQ,YAAY;MACpB,aAAa,YAAY;KAC3B,EACF,CAAC;KACD,MAAM,EAAE,gBAAgB,MAAM,OAAO,eAAe;KACpD,MAAM,QAAQ,oBAAoB;KAClC,MAAM,OAAO,MAAM,OAAO,4BAA4B;KACtD,MAAM,OAAO,WAAW,0BAA0B,OAAO;MACvD;MACA,cAAc;MACd,UAAU;OACR;OACA,iBAAiB,mBAAmB;OACpC,sBAAsB;QACpB,GAAG;QACH,WAAW,mBAAmB;OAChC;MACF;KACF,CAAC;IACH;IAEA,gBAAgB,OACd,gBACA,WACkB;KAClB,MAAM,EAAE,MAAM,SAAS;KACvB,MAAM,uBACJ,SAAS,UACL,OAAO,WAAW,2CAClB,OAAO,WAAW;KACxB,MAAM,0BACJ,SAAS,UACL,OAAO,WAAW,gCAClB,OAAO,WAAW;KACxB,MAAM,gBAAgB;MACZ;MACR;MACA;MACA,eAAe,EAAE,QAAQ,iBACvB,qBAAqB,OAAO;OAC1B,cAAc;OACd;OACA;MACF,CAAC;MACH,kBAAkB,EAAE,QAAQ,wBAC1B,wBAAwB,OAAO;OAC7B,cAAc,OAAO;OACrB;OAEA,UAAU;MACZ,CAAC;MACH,mBAAmB,QAAQ;KAC7B,CAAC;IACH;IAEA,mBAAmB,OACjB,WACA,WACkB;KAClB,MAAM,eAAe;KACrB,MAAM,EAAE,WAAW,MAAM,OAAO,aAAa;KAC7C,MAAM,OAAO,yBAAyB;MACpC,WAAW,UAAU;MACrB,sBAAsB,UAAU;MAChC,aAAa,UAAU;KACzB,CAAC;KACD,MAAM,QAAQ,oBAAoB;KAClC,MAAM,YAAY,MAAM,OAAO,uBAAuB,EACpD,SAAS,UAAU,SACrB,CAAC;KACD,MAAM,OAAO,WAAW,mCAAmC,OAAO;MAChE,cAAc;MACd;MACA;KACF,CAAC;IACH;IAEA,uBAAuB,OACrB,WACA,WACkB;KAClB,MAAM,eAAe;KACrB,MAAM,EAAE,WAAW,MAAM,OAAO,aAAa;KAC7C,MAAM,OAAO,yBAAyB;MACpC,WAAW,UAAU;MACrB,sBAAsB,UAAU;MAChC,aAAa,UAAU;KACzB,CAAC;KACD,MAAM,QAAQ,oBAAoB;KAClC,MAAM,YAAY,MAAM,OAAO,uBAAuB,EACpD,SAAS,UAAU,SACrB,CAAC;KACD,MAAM,OAAO,WAAW,kCAAkC,OAAO;MAC/D,cAAc;MACd;MACA;KACF,CAAC;IACH;IAEA,qBAAqB,OACnB,WACA,WACkB;KAClB,MAAM,eAAe;KACrB,MAAM,CAAC,EAAE,UAAU,EAAE,iBAAiB,MAAM,QAAQ,IAAI,CACtD,OAAO,aAAa,GACpB,OAAO,eAAe,CACxB,CAAC;KACD,MAAM,OAAO,yBAAyB;MACpC,WAAW,UAAU;MACrB,sBAAsB,UAAU;MAChC,aAAa,UAAU;KACzB,CAAC;KACD,MAAM,QAAQ,oBAAoB;KAClC,MAAM,oBAAoB,MAAM,OAAO,uBAAuB,EAC5D,SAAS,UAAU,SACrB,CAAC;KACD,MAAM,YAAY,MAAM,OAAO,0BAA0B;MACvD,aAAa,UAAU;MACvB,WAAW,UAAU;MACrB,sBAAsB,UAAU;KAClC,CAAC;KACD,MAAM,eAAe,MAAM,OAAO,qBAAqB;KACvD,MAAM,OAAO,WAAW,mBAAmB,OAAO;MAChD,cAAc;MACd;MACA,cAAc;OACZ;OACA;OACA,WAAW,UAAU;OACrB,sBAAsB;QACpB,GAAG;QACH,WAAW,UAAU;OACvB;MACF;KACF,CAAC;IACH;GACF;EACF,CAAC;EAKH,IAAI,OAAO,UAAU,OAAO,mBAAmB,CAAC,OAAO,YACrD,UACG,WAAW;GACV,MAAM,EAAE,QAAQ,QAAQ,oBAAoB;GAC5C,OAAO;IACL,OAAO,eAEL,MAKkC;KAClC,MAAM,EAAE,WAAW,MAAM,OAAO,aAAa;KAC7C,MAAM,YAAY,MAAM,OAAO,KAAK,IAAI,kBAAkB,OACxD;MACE;MACA,eAAe;KACjB,GACAC,cAAAA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC,CACzD;KACA,MAAM,MAAM,oBAAoB;KAKhC,MAAM,cAAc;MAClB,eAAe;MACf;MACA,gBAAA,MAP2B,OAAO,aAAa;OAC/C;OACA,eAAe;MACjB,CAAC;MAKC,aAAa,UAAU;MACvB,sBAAsB,MAAM;KAC9B;KACA,MAAM,EAAE,UAAU,MAAM,OAAO,KAAK,IAAI,aAAa,OACnD,EAAE,GAAG,YAAY,GACjBA,cAAAA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC,CACzD;KACA,MAAM,cAA2B,EAC/B,YAAY,MACd;KACA,MAAM,UAAU,GAAG,OAAO,gBAAgB,GAAG;KAC7C,MAAM,eAAe,OAAO,aAAa,EAAE,QAAQ,CAAC;KACpD,OAAO,eAAe;MAAE,GAAG;MAAM,QAAQ;MAAc,GAAG;KAAY,CAErE;IACH;IAEA,WACE,cACA,WACsC;KACtC,OAAO,gBAAgB;MACrB;MACA,MAAM,aAAa;MACnB,MAAM,aAAa;MACnB,cAAc,OAAO,EAAE,iBAAiB;OAMtC,OAAO,MALiB,OAAO,kBAAkB,kBAAkB,OAAO;QACxE,IAAI,aAAa;QACjB,eAAe;QACf;OACF,CAAC;MAEH;MACA,kBAAkB,EAAE,wBAClB,OAAO,kBAAkB,gBAAgB,OAAO;OAC9C,eAAe;OACf,IAAI,aAAa;OACjB;MACF,CAAC;MACH,mBAAmB,QAAQ;KAC7B,CAAC;IACH;GACF;EACF,CACF;EAKF,IAAI,OAAO,mBAAmB,OAAO,eAAe,CAAC,OAAO,WAC1D,UACG,WAAW;GACV,MAAM,EAAE,QAAQ,oBAAoB;GACpC,OAAO,EACL,OAAO,eAEL,aAIA,MACkC;IAClC,MAAM,MAAM,MAAM,OAAO,KAAK,aAAa,OACzC;KACE,UAAU,YAAY;KACtB,cAAc,YAAY;KAC1B,WAAW;IACb,GACAA,cAAAA,iBAAiB,EAAE,eAAe,MAAM,cAAc,CAAC,CACzD;IACA,MAAM,cAA2B,EAC/B,WAAW,IACb;IACA,MAAM,eAAe,OAAO,aAAa,EAAE,gBAAgB,IAAI,YAAY,CAAC;IAC5E,OAAO,eAAe;KAAE,GAAG;KAAM,QAAQ;KAAc,GAAG;IAAY,CAErE;GACH,EACF;EACF,CACF;EAKF,IAAI,OAAO,UAAU,OAAO,mBAAmB,OAAO,YACpD,UAA6E,WAAW;GACtF,MAAM,EAAE,QAAQ,WAAW;GAE3B,eAAe,iBAAgC;IAC7C,IAAI,MAAM,OAAO,WAAW,GAAG;IAC/B,MAAM,qBAAqB,MAAM,OAAO,sBAAsB;IAC9D,MAAM,UAAU,MAAM,OAAO,MAAM,oBAAoB,OAAO;KAC5D,8BAA8B,mBAAmB;KACjD,6BAA6B,mBAAmB;IAClD,CAAC;IACD,MAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;GACrC;GAEA,MAAM,mBAAmB,OACvB,WACA,WACoB;IACpB,MAAM,eAAe;IACrB,MAAM,OAAO,yBAAyB;KACpC,WAAW,UAAU;KACrB,sBAAsB,UAAU;KAChC,aAAa,UAAU;IACzB,CAAC;IACD,MAAM,QAAQ,oBAAoB;IAIlC,OAAO,MAHiB,OAAO,uBAAuB,EACpD,SAAS,UAAU,SACrB,CAAC;GAEH;GAEA,OAAO;IACL,SAAS,OACP,SACA,WACkC;KAClC,MAAM,EAAE,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC;KACjF,IAAI,UAAU,kBAAkB,OAAO;MACrC,MAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM;MAC1D,MAAM,QAAQ,uBAAuB;MACrC,OAAO,OAAO,SAAS,QAAQ,OAC7B;OACE,IAAI,QAAQ;OACZ,MAAM;QAAE,eAAe;QAAO;OAAU;MAC1C,GACAA,cAAAA,iBAAiB,MAAM,CACzB;KACF;KACA,IAAI,UAAU,kBAAkB,QAC9B,OAAO,OAAO,SAAS,QAAQ,OAC7B;MACE,IAAI,QAAQ;MACZ,MAAM,EAAE,eAAe,OAAO;KAChC,GACAA,cAAAA,iBAAiB,MAAM,CACzB;KAEF,MAAM,IAAI,MAAM,2CAA2C;IAC7D;IAEA;IAEA,SACE,SACA,SACkC;KAClC,OAAO,OAAO,SAAS,OAAO,OAC5B;MAAE,IAAI,QAAQ;MAAI,MAAM;KAAK,GAC7BA,cAAAA,iBAAiB,IAAI,CACvB;IACF;GACF;EACF,CAAC;EAKH,IAAI,OAAO,mBAAmB,OAAO,WACnC,UAA8E,WAAW;GACvF,MAAM,EAAE,WAAW;GACnB,OAAO;IACL,cAAc,OAAO,YAAoE;KACvF,MAAM,EAAE,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,EAAE,IAAI,QAAQ,GAAG,CAAC;KACjF,CAAA,GAAA,UAAA,QAAA,CAAU,UAAU,kBAAkB,OAAO,4BAA4B;KACzE,OAAO,UAAU;IACnB;IAEA,UACE,SACA,cACkC;KAClC,OAAO,OAAO,SAAS,QAAQ,OAAO;MACpC,IAAI,QAAQ;MACZ,MAAM;OAAE,eAAe;OAAO;MAAU;KAC1C,CAAC;IACH;IAEA,SACE,SACA,cACkC;KAClC,OAAO,OAAO,SAAS,OAAO,OAAO;MACnC,IAAI,QAAQ;MACZ,MAAM;OAAE,eAAe;OAAO;MAAU;KAC1C,CAAC;IACH;GACF;EACF,CAAC;EAGH,OAAO;CACT;CAEA,OAAO;EACL,GAAG;EACH;EACA;EACA;EACA;EACA;CACF;AACF"}